Leaked NSA Exploit Spreading Ransomware Worldwide

A ransomware attack running rampant through Europe today is spreading via an exploit leaked in the most recent ShadowBrokers dump. Researchers at Kaspersky Lab said the attackers behind today’s outbreak of WannaCry ransomware are using EternalBlue, the codename for an exploit made public by the...

PT-2018-20: Arbitrary Code Execution in Schneider Electric's BMXNOR0200

The specialists of the Positive Research center have detected an Arbitrary Code Execution vulnerability in Schneider Electric's BMXNOR0200. A vulnerability in the HTTP request parser allows remote attackers to execute arbitrary code. How to fix Use the vendor's advisory:...

EaST - Exploits and Security Tools Framework

Pentest framework environment is the basis of IT security specialist’s toolkit. This software is essential as for learning and improving of knowledge in IT systems attacks and for inspections and proactive protection. The need of native comprehensive open source pen test framework with high level...

Kaseya Virtual System Administrator File Download / Open Redirect Vulnerabilities

Kaseya Virtual System Administrator suffers from arbitrary file download open redirection vulnerabilities. Two vulns in Kaseya Virtual System Administrator - an authenticated arbitrary file download and two lame open redirects. Full advisory text below and at 1. Thanks to CERT for helping me to...

Belgium’s largest Telcom 'Belgacom' hacked; NSA could be behind the Attack

Belgacom, the largest telecommunications company in Belgium today announced that their IT Systems were hacked and infected with an unknown Malware. In order to eliminate that virus effectively, they clean up the entire system. The company also highlights that they have no indication of any impact...

Creative Ideas for Replacing Passwords

Passwords have been the de facto manner of providing security for IT systems. Theyve got a bad reputation, but its not the passwords themselves that deserve the reputation - its the individuals using them and the weak standards to which these passwords are managed. In fact, a password system...

Senate Introduces Cybersecurity Bill that Prioritizes Information Sharing

The United States Senate says it will prioritize the passage of a comprehensive cybersecurity bill designed to fortify the nation’s public and private IT systems in this session of Congress. Senators John D. Rockefeller IV D-WV, Chairman of the Senate Commerce, Science, and Transportation...

RHEL 4 / 5 : jboss-seam2 (RHSA-2011:0460)

Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

IT Security Horror Stories: Truth is Scarier Than Fiction

At Coalfire Labs, we discover--and help our clients address--some pretty scary security and compliance problems. Everyones heard of blood-sucking cyber criminals looking for vulnerable IT systems. Even when organizations have protections in place, these monsters just wont give up. Their appetite ...

Important: Red Hat Security Advisory: jboss-seam2 security update

Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 5.1 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: jboss-seam2 security update

Updated jboss-seam2 packages that fix one security issue are now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS...

India Orders Security Certification for Government Websites After CBI Hack

India has mandated that all government ministries and departments secure their websites with proper certification. This directive follows the hacking of the Central Bureau of Investigation CBI website by a group calling themselves the "Pakistani Cyber Army." The National Informatics Centre has be...

Inspector General Finds Vulns at US-CERT

A scan of IT systems at US-CERT, the Homeland Security Department’s primary operational cybersecurity agency, found hundreds of vulnerabilities that could allow someone to compromise data, according to a recent inspector general’s report. Read the full article. Government Computer News...

DoD Considers Protecting Private IT Systems

The Pentagon has raised the possibility of the Defense Department becoming engaged in safeguarding nationally critical IT systems run by business. Read the full article. GovInfoSecurity...

IT-Grundschutz M4.001: Passwortschutz für IT-Systeme

IT-Grundschutz M4.001: Passwortschutz für IT-Systeme. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94172 Diese Prüfung bezieht sich auf die 11. Ergänzungslieferung 1...

Cyberthieves Find Workplace Networks Are Easy Pickings

In a feature article in USAToday, Byron Acohido writes about porous and difficult to defend workplace networks that provide a haven for professional cybercrimals. Acohido writes: “Overly complex IT systems are producing endless opportunities for cyberthieves, who need only to master simple hackin...