'The Washington Post' compromised 3rd time in the last 3 years

Security experts at Mandiant intelligence firm have discovered a new intrusion into the network of The Washington Post, it is the third time in the last three years. In time I'm writing it is still not clear the extension of the attack neither an estimation of the losses. Mandiant reported the...

Chinese Hackers group 'Comment Crew' is still active and operating under cover

Security experts are confident that the Chinese hackers group known as Comment Crew is still operating under cover. “The Comment Crew is back again” this is the rumor within Intelligence community, researchers suspect the involvement of the group of hackers in the recent cyber dispute between U.S...

Spear Phishing Campaigns Use Fake Mandiant APT1 Report as Lure

People looking to download and read the Mandiant report on Chinese government attacks on U.S. infrastructure should look carefully at the name of the file before opening it. Researchers say that there are at least two different spear-phishing attacks going on right now that are using rigged copie...

Markey: GRID Act Passage Long Overdue

Representative Ed Markey D-MA is urging the Chairman of the House Committee on Energy and Commerce, Fred Upton R-MI, to take immediate action toward passing the Grid Reliability and Infrastructure Defense GRID Act, which Markey calls a bipartisan bill aimed at hardening the nation’s electrical gr...

Avoid The Attack Attribution Distraction

Plenty has been written this month about attack attribution, but, really, if your network is under siege, how often does the “who” matter as much as the “how,” “what,” and “where”? It seems that knowing who the actor is behind a network intrusion matters little to a bank, restaurant or retail...

Comment Crew Exposé a New Level of China Attack Attribution

China has been blamed for cyberattacks on every major industrial base in the United States—and even in some corners for the Super Bowl blackout. But most of it has been rampant speculation coupled with the lacing together of a number of loose ends. Examples of the kind of direct attribution to th...

Mandiant revealed Chinese APT1 Cyber Espionage campaign

Few weeks after the discovery of the sophisticated cyber espionage campaign against principal US media The Mandiant® Intelligence Center™ released an shocking report that reveals an enterprise-scale computer espionage campaign dubbed APT1. The term APT1 is referred to one of the numerous cyber...

Mandiant revealed Chinese APT1 Cyber Espionage campaign

Few weeks after the discovery of the sophisticated cyber espionage campaign against principal US media The Mandiant® Intelligence Center™ released an shocking report that reveals an enterprise-scale computer espionage campaign dubbed APT1. The term APT1 is referred to one of the numerous cyber...

A Look Back at 2012: The Armory

As we are mere hours away from celebrating 2013, we'd like to focus today on M-Unition's Armory channel. The Armory is the place to be if you want to be the first to find out about the latest releases, free tools and of course, our ever popular M-Trends report. The most popular posts in this...

An In-Depth Look Into Data Stacking

Mandiant's Nick Bennett and Jake Valletta discussed data stacking at MIRcon™ last month. If you were unable to attend the talk, we will discuss this data analysis technique here on the M-Unition blog. What is Data Stacking? Data stacking is the application of frequency analysis to large volumes o...

James Butler and Peter Silberman talk malware

James Butler and Peter Silberman of MANDIANT with Threatpost’s Robert Vamosi about malware and their new memory forensic software, Memoryze...

CVE-2006-6475

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a denial of service refused connections via malformed requests, which results in a mishandled exception...

CVE-2006-6476

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 all interfaces, opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service loss of daemon operation...

CVE-2006-6477

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle MITM attack...

CVE-2006-6476

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode and when the agent is bound to 0.0.0.0 all interfaces, opens sockets in non-exclusive mode, which allows local users to hijack the socket, and capture data or cause a denial of service loss of daemon operation...

CVE-2006-6475

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode with SSL enabled, allows remote attackers to cause a denial of service refused connections via malformed requests, which results in a mishandled exception...

CVE-2006-6476

CVE-2006-6476 affects Mandiant First Response (FRAgent.exe) prior to version 1.1.1. When run as a daemon and bound to 0.0.0.0 (all interfaces), FRAgent opens sockets in non-exclusive mode, enabling a local attacker to hijack the listening socket and potentially capture data or cause a denial of s...

CVE-2006-6475

CVE-2006-6475 affects Mandiant First Response (FRAgent.exe) prior to version 1.1.1 in daemon/SSL mode. The vulnerability is a denial-of-service condition: remotely sending malformed requests to an SSL-enabled daemon can trigger an unhandled exception, causing sockets to reach an indefinite CLOSE_...

CVE-2006-6477

FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle MITM attack...

CVE-2006-6477

CVE-2006-6477 concerns Mandiant First Response (MFR) prior to 1.1.1. The issue arises when the FRAgent daemon runs with HTTP (and also in SSL mode as per Symantec advisory) and binds non-exclusively to a socket, enabling a local attacker to hijack the agent and conduct a man-in-the-middle attack ...