Obfuscated Command Line Detection Using Machine Learning

This blog post presents a machine learning ML approach to solving an emerging security problem: detecting obfuscated Windows command line invocations on endpoints. We start out with an introduction to this relatively new threat capability, and then discuss how such problems have traditionally bee...

GandCrab’s Rotten EGGs Hatch Ransomware in South Korea

The VenusLocker group appears to be back, hatching a fresh GandCrab ransomware campaign, so to speak, using the EGG niche file type. The emails with EGG attachments are meant to specifically take aim at South Korean users. Trend Micro researchers, who first observed the offensive campaign in earl...

CVE-2017-16053

fabric-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Information Disclosure Through Typo-squatting

acqusition, apidev-coop, bzip, crypt, django-server, pwd, setup-tools, telnet, urlib3, and urllib are packages that are typosquatting other packages with malicious intent. These libraries contain the same source code as the original libraries, however the installation files have been modified to...

New Relic: Potential sub-domain hijacking

Hey New Relic Security team, I noticed what appeared to be a configuration oversight and I wanted to mention it to you. The following domains are currently pointing to Fastly: fr.newrelic.com 151.101.192.207 es.newrelic.com 151.101.0.207 When you visit them, you should see something like this:...

GTK+ 1.2.8 Arbitrary Loadable Module Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2165/info GTK+ is the Gimp Toolkit, freely available to the public and maintained by the GTK Development Team. A problem exists in the Gimp Toolkit that could allow a user elevated privileges. The problem occurs in the...

Ten Years Later, Cabir Worm's Place in History is Unique

It’s difficult to remember now–and seems quaint even if you can recall it–but there was a time in the not-so-distant past when industry analysts and security experts were worried about the coming mobile malware apocalypse. Self-replicating malware would soon be flooding our phones, deleting our...

Phony SSL Certs Spoof Google, Facebook, GoDaddy, others

Dozens of phony SSL certificates were discovered this week mocking legitimate certs from banks, e-commerce sites, ISPs and social networks. If a user stumbled over one of the bogus certificates on a mobile device it could put them at risk for a man-in-the-middle attack. Disguised as official...

WordPress ThisWay Shell Upload

. . / / | // | | .. / \ \ \ \ \ / ||| \ | | / \ / |/ | |/ | / | | // | | | | \ / //|| /\ \ ||| / | /\ /// \ \ //|| | / /|| /| ||/|| / / / / || // / / / / || / / Exploit title: WordPress ThisWay theme - Arbitrary File Upload Vulnerability Author: Bet0 Google Dork:...

Pre-Owned Hardware

Counterfeit and “certified pre-owned” hardware is nothing new, but we think 2012 will see this issue morph from a sideshow in the cyber security world to center stage, with new revelations about contamination of the global supply chain by hardware and software components of dubious origin and...

SSL Certificate Fails to Adhere to Basic Constraints / Key Usage Extensions

An X.509 certificate sent by the remote host contains one or more violations of the restrictions imposed on it by RFC 5280. This means that either a root or intermediate Certificate Authority signed a certificate incorrectly. Certificates that fail to adhere to the restrictions in their extension...

FreeSchool 1.1.0 Remote File Inclusion

x FreeSchool = 1.1.0 Mutiple Remote File Include Vulnerability ! Download Script : http://sourceforge.net/projects/freeschool/files/ ! Author : cr4wl3r ! Contact : cr4wl3r4tlinuxmaildotorg ! Location : Gorontalo - INDONESIA ! Dork : "FuCk y0u MaLaYsia" x 3xplo!t :...

FreeIPS 1.0 Protected Service - Denial of Service

/ source: https://www.securityfocus.com/bid/10541/info It is reported that FreeIPS is susceptible to a denial of service vulnerability. FreeIPS scans TCP connections for particular strings, defined by regular expressions. If a packet matches the regular expression, FreeIPS assumes malicious inten...

PHP PHPfi 2.0 - Directory Traversal

PHP PHPfi 2.0 - Directory Traversal source: https://www.securityfocus.com/bid/2250/info PHP/FI is an software suite designed to offer enhanced features to sites served via the World Wide Web. It is open source, freely available, and maintained by the PHP development team. A problem with the...

PHP PHP/fi 2.0 - Directory Traversal

source: https://www.securityfocus.com/bid/2250/info PHP/FI is an software suite designed to offer enhanced features to sites served via the World Wide Web. It is open source, freely available, and maintained by the PHP development team. A problem with the software could allow remote users access ...