Fake SEO Plugin Used In WordPress Malware Attacks

Malware masquerading itself as an SEO plugin called WP-Base-SEO has infected close to 4,000 WordPress sites in the past two weeks, according to security experts. The intent of the hackers behind the malware is to hide in plain sight, appearing as legitimate SEO plugin, at the same time creating a...

go-jose signature obfuscation vulnerability

go-jose is a standard method for implementing JavaScript object signing and encryption . A security vulnerability exists in go-jose. As the program fails to verify the validity of the signature. An attacker could exploit the vulnerability to read unauthorized data...

New Clues Surface on Shamoon 2's Destructive Behavior

Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate...

APT29 Domain Fronting With TOR

Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques...

APT29 Domain Fronting With TOR

Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques...

Locky, Cerber Ransomware Skilled at Avoiding Detection

The latest versions of Cerber and Locky ransomware have been, since mid-January, finding great success in bypassing existing security detection systems through the use of a common infrastructure that allows the malicious code to bury itself inside NSIS installers, and use several layers of...

Github enterprise remote code execution vulnerability analysis-vulnerability warning-the black bar safety net

Right now, almost everyone in the use of GitHub. If you have a lot of Green Paper or for your own code very paranoid, then you can run your own GitHub. Paid$ 2500 dollars, you can get a GitHub Enterprise version for 10 users for one year. In fact, Github enterprise is a virtual machine, but...

Google Chrome metrics type obfuscation code execution vulnerability

Google Chrome is a popular web browser. A type-obfuscated code execution vulnerability in Google Chrome metrics allows remote attackers to exploit the vulnerability to build malicious WEB pages that can be tricked into parsing by the user, which can crash the application or execute arbitrary code...

Adobe Flash Player Type Obfuscation Vulnerability (CNVD-2017-01779)

Adobe Flash Player is a widely used, proprietary multimedia program player developed by Adobe in the United States. Adobe Flash Player suffers from a type-obfuscation vulnerability, which can be exploited by an attacker to execute arbitrary code via type-obfuscation...

Boozt Fashion AB: Application code is not obfuscated -- OWASP M9 (2016)

Description : Boost android app is not obfuscated which lead to view the source code of the app. Impact : Attackers can steal code and reuse it or sell it to create new application or create a malicious fake application based on the initial one. POC : Step 1 : First, I did the basic reverse...

Locky Ransomware, Kovter Click-Fraud Malware Spreading in Same Campaigns

Researchers at Microsoft’s Malware Protection Center have spotted malicious email campaigns using .lnk attachments to spread Locky ransomware and the Kovter click-fraud Trojan, the first time criminals have simultaneously distributed both pieces of malware. According to Microsoft, the .lnk file n...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

PT-2017-9000

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 Description The issue allows context-dependent attackers to obtain cleartext passwords by leveraging access to the "WEB-INF/conf/securitydbData.xml" file, due to the use of a weak obfuscation...

The Changing Face of Carbanak

Months of ramped up Carbanak activity that includes a new host of targets and new command and control strategy has reinvigorated attention on a criminal outfit that may have at one time stolen up to $1 billion from banks worldwide. Carbanak has moved on from an almost exclusive focus on financial...

New Variant of Ploutus ATM Malware Observed in the Wild in Latin America

Introduction Ploutus is one of the most advanced ATM malware families we’ve seen in the last few years. Discovered for the first time in Mexico back in 2013, Ploutus enabled criminals to empty ATMs using either an external keyboard attached to the machine or via SMS message, a technique that had...

Linux/x86 - Egg-hunter Shellcode (31 bytes)

Linux/x86 - Egg-hunter Shellcode 31 bytes. Shellcode exploit for Linx86 platform / ;author: Filippo "zinzloun" Bersani ;date: 28/11/2016 ;version: 1.0 ;X86 Assembly/NASM Syntax ;tested on: Linux OpenSuse001 2.6.34-12-desktop 32bit ; Linux ubuntu 3.13.0-100-generic 147precise1-Ubuntu 32bit ; Linux...

Adobe Flash Player Type Obfuscation Remote Code Execution Vulnerability (CNVD-2016-10908)

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. A type-obfuscated remote code execution vulnerability exists in Adobe Flash Player versions 23.0.0.205 and earlier...

Adobe Flash Player Type Obfuscation Remote Code Execution Vulnerability (CNVD-2016-10909)

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. A type-obfuscated remote code execution vulnerability exists in Adobe Flash Player versions 23.0.0.205 and earlier...

Adobe Flash Player Type Obfuscation Remote Code Execution Vulnerability

Adobe Flash Player is a cross-platform, browser-based multimedia player product from Adobe. The product supports cross-screen and browser viewing of applications, content and videos. A type-obfuscated remote code execution vulnerability exists in Adobe Flash Player versions 23.0.0.205 and earlier...