Experts in Lather Over ‘gSOAP’ Security Flaw

Axis Communications -- a maker of high-end security cameras whose devices can be found in many high-security areas -- recently patched a dangerous coding flaw in virtually all of its products that an attacker could use to remotely seize control over or crash the devices. The problem wasn't specif...

July 18, 2017 – Morning Cyber Coffee Headlines – “Thomas Edison” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 18, 2017 - Headlines U.S. House Panel to Consider Self-Driving Car...

Remotely Exploitable Flaw Puts Millions of Internet-Connected Devices at Risk

Security researchers have discovered a critical remotely exploitable vulnerability in an open-source software development library used by major manufacturers of the Internet-of-Thing devices that eventually left millions of devices vulnerable to hacking. The vulnerability CVE-2017-9765, discovere...

AttifyOS: IoT Devices Testing Distribution!

PenTestIT RSS Feed Distributions such as Kali Linux make it easier for us to carry out our penetration tests, vulnerability assessments, digital forensics gigs and wireless assessments. However, there are very few tools on such distributions that help you test the security of Internet of Things I...

iSmartAlarm CubeOne Remote Command Execution Exploit

iSmartAlarm CubeOne suffers from a remote command execution vulnerability that allows disabling the alarm and setting it off. + Credits: Ilia Shnaidman + @0x496c on Twitter + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/...

iSmartAlarm CubeOne Remote Command Execution

Credits: Ilia Shnaidman + @0x496c on Twitter + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/ Vendor: ============= iSmartAlarm, inc. Product: =========================== iSmartAlarm cube - All iSmartAlarm is one of the...

iSmartAlarm CubeOne Missing SSL Certificate Validation Vulnerability

Exploit for hardware platform in category remote exploits + Credits: Ilia Shnaidman + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/ Vendor: ============= iSmartAlarm, inc. Product: =========================== iSmartAlarm cube...

iSmartAlarm Backend Server-Side Request Forgery Vulnerability

Exploit for hardware platform in category remote exploits + Credits: Ilia Shnaidman + Source: http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities/ Vendor: ============= iSmartAlarm, inc. Product: ============= iSmartAlarm Backend iSmartAlar...

July 12, 2017 – Morning Cyber Coffee Headlines – “Henry David Thoreau” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 12, 2017 - Headlines Carbon Black in the News: Closing Bell July 11, 2017 ...

Telit IoT TI Tag Viewer - External URLs, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application Telit IoT TI Tag Viewer published at the 'play' market has multiple vulnerabilities...

July 10, 2017 – Morning Cyber Coffee Headlines – “Nikola Tesla” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 10, 2017 - Headlines ‘Time to Move Forward,’ Trump Says After Putin Denies...

IoT mDNS/DNS-SD QM Amplification Distributed Denial Of Service

!/usr/bin/perl IoT mDNS/DNS-SD 'QM' amplification ddos Copyright 2017 c Todor Donev [email protected] https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous program is for Educational purpose ONLY. Do not use it without permission. The usual...

IoT mDNS / DNS-SD QM Amplification Distributed Denial Of Service Exploit

IoT mDNS/DNS-SD QM amplification distributed denial of service exploit. !/usr/bin/perl IoT mDNS/DNS-SD 'QM' amplification ddos Copyright 2017 c Todor Donev email protected https://www.ethical-hacker.org/ https://www.facebook.com/ethicalhackerorg Disclaimer: This or previous program is for...

Telit IoT Innovation - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Telit IoT Innovation published at the 'play' market has multiple vulnerabilities...

As Cities Get Smarter, So Should Their Security

TrendMicro Today, more urban centers than ever are implementing a range of advanced technological systems. These sensors and networks used in combination with citizens' mobile devices create smarter cities capable of reduced pollution, increased safety, better engagement with residents and more...

Legislation to Strengthen IoT Marketplace Transparency

Senator Ed Markey D-MA is poised to introduce legislation to develop a voluntary cybersecurity standards program for the Internet of Things IoT. The legislation, called the Cyber Shield Act, would enable IoT products that comply with the standards to display a label indicating a strong level of...

IoT Network Security Analysis Tool: ASTo

IoT Network Security Analysis Tool Apparatus is a security framework to facilitate security analysis in IoT systems. To make the usage of the Apparatus framework easier the ASTo app was created ASTo stands for Apparatus Software Tool. ASTo is based on electron and cytoscape.js . The application i...

Inside Secure MatrixSSL Buffer Overflow Vulnerability (CNVD-2017-15853)

Inside Secure MatrixSSL is an IoT application toolkit from Inside Secure, France, that enables modular implementation of TLS and DTLS. A heap buffer overflow vulnerability exists in the X509 certificate parsing feature in Inside Secure MatrixSSL version 3.8.7b. A remote attacker could exploit thi...

Vulnerability Spotlight: Multiple Vulnerabilities in InsideSecure MatrixSSL

These vulnerabilities were discovered by Aleksandar Nikolic of Cisco TalosOverviewMatrixSSL is a TLS/SSL stack offered in the form of a Software Development Kit SDK that is geared towards application in Internet of Things IOT devices and other embedded systems. It features low resource overhead a...

InsideSecure MatrixSSL x509 certificate IssuerDomainPolicy Remote Code Execution Vulnerability

Summary An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a...