Baseon Lantronix MSS IOT/Cameras Device Servers telnet-Service NO require password authentication

Baseon Lantronix MSS IOT/Cameras Device Servers telnet-Service NO require password authentication had Exposed on the internet in ZoomEye : https://www.zoomeye.org/searchResult?q=%22prompt%20for%20assistance%22%20%2Bport:%2223%22&t=all login telnet with no password...

DNS Rebinding Attack: DNS Rebind Toolkit

DNS Rebind Toolkit is a frontend JavaScript framework for developing DNS Rebinding exploits against vulnerable hosts and services on a local area network LAN. It can be used to target devices like Google Home, Roku, Sonos WiFi speakers, WiFi routers, “smart” thermostats, and other IoT devices. Wi...

Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 shipped with IBM Predictive Maintenance and Quality (CVE-2016-9840, CVE-2016-9841, CVE-2017-1297, CVE-2017-1105)

Summary IBM DB2 is shipped as components of IBM Predictive Maintenance and Quality. Information about some security vulnerability affecting IBM DB2 have been published their respective security bulletins. Vulnerability Details Please consult the security bulletin IBM® DB2® LUW on AIX and Linux...

Roku TV, Sonos Speaker Devices Open to Takeover

The DNS rebinding flaw reported in Google Home and Chromecast devices earlier this week is about to get a patch — but the same type of flaws have come to light for other top-name consumer Internet of Things devices, from Roku and Sonos. Fortunately, Roku has already started deploying its update,...

Axis cameras there are security flaws, three of the vulnerabilities can be taken over-vulnerability warning-the black bar safety net

Network security company VDOO researchers recently discovered several vulnerabilities affect the Axis nearly 400 security cameras. From the network security company VDOO researchers on IOT devices conducted a study and found that the axis company manufacturing the camera of the presence of seven...

QSC18 Virtual Edition: Securing Hybrid IT Environments from Endpoints to Clouds

As organizations embrace digital transformation to boost business processes, traditional IT environments get altered, becoming distributed, elastic and hybrid. “That’s creating a new challenge for security,” Chris Carlson, Qualys’ Product Management VP, said during QSC18 Virtual Edition. As...

What’s causing the cybersecurity skills gap?

The proliferation of next-gen technology into mainstream society has been a boon for consumers, entrepreneurs, and business owners alike. Between the rise of mobile computing, the Internet of Things IoT, and modern social media, our society is more connected than ever before. But all of this...

When It Comes To IoT Security, Liability Is Muddled

BOSTON—From hacked connected cars to power grids, the implications of IoT security issues seem to be getting graver – yet when it comes to pointing fingers for security troubles, many times victims don’t even know where to start. IoT experts said at the Security of Things Forum today said that a...

“Unbreakable” Smart Lock Tapplock Issues Critical Security Patch

Tapplock, a smart padlock that received positive reviews and media hype when it was released earlier this year, has issued a critical patch after researchers discovered several security issues enabling them to easily hack into and unlock the device. The $100 lock is Bluetooth-based and can be...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM Predictive Maintenance and Quality

Summary IBM DB2 is shipped with IBM Predictive Maintenance and Quality. Information about some security vulnerabilities affecting IBM DB2 have been published their respective security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section. Affecte...

Totally Pwning the Tapplock (the API way)

An awesome researcher contacted us on the back of our recent Tapplock pwnage. We had been looking at the local BLE unlock mechanism, however he focussed instead on the mobile app API. Vangelis Stykas @evstykas has found a way to unlock any lock, plus scrape users PII and home addresses. Read his...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 11, 2018

As a native Texan, I’ve seen more than my fair share of bugs - actual physical bugs that love the hot, humid Texas climate and my curly hair for some reason. The Zero Day Initiative ZDI sees many bugs of the software variety, including those that affect SCADA control systems. Fritz Sands recently...

Totally Pwning the Tapplock Smart Lock

TL;DR – How to open a Tapplock over BLE in under two seconds: Totally Pwning the Tapplock Smart Lock A couple of weekends ago, a YouTuber called JerryRigEverything posted a teardown of a “smart” padlock, called the Tapplock. He discovered that, using a sticky GoPro mount, he could remove the back...

Android Devices With Misconfigured ADB, a Ripe Target for Cryptojacking Malware

Poorly configured Android devices, where the Android Debug Bridge is left enabled, have become an attractive target for hackers. According to researchers, adversaries are using the common misconfiguration to install cryptojacking malware on a wide selection of Android-based IoT devices ranging fr...

IoT Discussion at the Leidos Supplier Innovation & Technology Symposium

Coalfire was asked to participate on a technical panel about the Internet of Things IoT at the Leidos Supplier Innovation & Technology Symposium on June 6. This event is a dynamic day enabling Leidos largest suppliers as well as targeted start-ups to showcase their offerings and capabilities to a...

Thousands of Android Devices Running Insecure Remote ADB Service

Despite warnings about the threat of leaving insecure remote services enabled on Android devices, manufacturers continue to ship devices with open ADB debug port setups that leave Android-based devices exposed to hackers. Android Debug Bridge ADB is a command-line feature that generally uses for...

A week in security (June 4 – June 10)

Last week on Labs, we took a look at hidden mobile ads, the perils of social media spam, and how to shore up your landline defenses. We also took a deep dive into Emotet malware analysis, and gave you some summertime safety tips. Other news Update your Adobe Flash player if you haven't already...

Threatpost News Wrap Podcast for June 8

Threatpost editors Tom Spring, Tara Seals and Lindsey O’Donnell discuss the week’s information security news, including a bevy of IoT device privacy incidents, a critical Adobe Flash vulnerability, and an update on the breadth and impact of the VPNFilter malware found last month by Cisco Talos...

Operation Prowli Profits On Weak IoT Devices, Servers

A malicious campaign has compromised more than 40,000 machines globally, carrying out traffic-hijacking and cryptomining. Researchers at Guardicore Labs, who called the campaign Operation Prowli, said it targets a variety of platforms – including Drupal CMS websites, WordPress sites, backup serve...

Baby Cam Creeper Actively Watched New Mom

It’s a bad week for connected parents: A South Carolina mom says a stranger hacked into her baby monitor to spy on her and her family. She shared the experience on Facebook after she noticed someone had taken control of the 360-degree motion feature and was moving the camera toward her bed to see...