FIN10: Anatomy of a Cyber Extortion Operation

FireEye has identified a set of financially motivated intrusion operations being carried out by a threat actor we have dubbed FIN10. FIN10 is known for compromising networks, stealing sensitive data, and directly engaging victim executives and board members in an attempt to extort them into payin...

HackerOne: Updating payout preference to CurrencyCloud doesn't notify user via email

When change payment method in user's payments, then a notification about Change payment method is sent to the user email. However, user not always gets a notification about change payment method - when change payment method via add payout method on Payout Methods, then such a notification is not...

Threat Outbreak Alert RuleID29474: Email Messages Distributing Malicious Software on June 13, 2017

Medium Alert ID: 54185 First Published: 2017 June 13 13:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29474 may contain the following files: Name | Siz...

Ctrip APP payment passwords suffer from a plaintext transmission vulnerability

Ctrip APP is a mobile client that provides users with mobile booking services for special hotels, discounted air tickets and train tickets. A plaintext transmission vulnerability exists in the payment password of Ctrip APP. Since the client does not encrypt the user's payment password, an attacke...

GameStop Online Shoppers Officially Warned of Breach

GameStop customers received breach notification warnings this week, cautioning them that their personal and financial information could have been compromised nine months ago. According to postal letters sent to customers, GameStop said an undisclosed number of online customers had their credit ca...

Threat Outbreak Alert RuleID29458: Email Messages Distributing Malicious Software on June 9, 2017

Medium Alert ID: 54166 First Published: 2017 June 9 15:14 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29458 may contain the following files: Name | Size...

My NJ Client APP has an overstepping vulnerability

My Nanjing Client APP is a city-level public service mobile application that integrates all kinds of living information in Nanjing. There is a vulnerability in the authentication mechanism of the social security payment query function of My Nanjing Client APP, which allows an attacker to view the...

Joomla! Component Payage 2.05 - 'aid' SQL Injection

Exploit Title: Joomla Payage 2.05 - SQL Injection Exploit Author: Persian Hack Team Discovered by : Mojtaba MobhaM Mojtaba Kazemi Vendor Home : https://extensions.joomla.org/extensions/extension/e-commerce/payment-systems/payage/ My Home : http://persian-team.ir/ Google Dork :...

VirtueMart com_virtuemart component SQL injection vulnerability in Joomla!

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, it provides RSS feeds , site search and other features . VirtueMart comvirtuemart is one of the e-commerce components . A SQL injection vulnerability exists in version 3.0.14 of the Joomla!...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

CVE-2017-8930

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

Stealing Voice Prints

This article feels like hyperbole: The scam has arrived in Australia after being used in the United States and Britain. The scammer may ask several times "can you hear me?", to which people would usually reply "yes." The scammer is then believed to record the "yes" response and end the call. That...

Threat Outbreak Alert RuleID29039: Email Messages Distributing Malicious Software on May 8, 2017

Medium Alert ID: 53750 First Published: 2017 May 8 19:45 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29039 may contain the following files: Name | Size ...

Carbanak Attackers Devise Clever New Persistence Trick

Hackers behind the Carbanak criminal gang have devised a clever way to gain persistence on targeted systems to more effectively pull off financially motivated crimes. The technique involves creating a bogus instance of a Microsoft Windows app compatibility feature. On Wednesday, Mandiant, FireEye...

Dridex and Locky Return Via PDF Attachments in Latest Campaigns

Dridex and Locky, two prolific malware families that made waves in 2016 after being distributed in several high-volume spam campaigns, have returned after a brief hiatus. FireEye observed a decline in the volume of Dridex and Locky in the latter half of 2016, but we recently observed two new larg...

Sabre Corp. Investigating Breach of Reservation System

Travel services company Sabre Corp., acknowledged this week that it’s in the middle of investigating a data breach in its Hospitality Solutions reservation system that may have spilled personally identifiable information and payment card data belonging to its customers. The Texas-based company...

Threat Outbreak Alert RuleID28827: Email Messages Distributing Malicious Software on May 3, 2017

Medium Alert ID: 53680 First Published: 2017 May 3 15:18 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID28827 may contain the following files: Name | Size ...

Breach at Sabre Corp.’s Hospitality Unit

Breaches involving major players in the hospitality industry continue to pile up. Today, travel industry giant Sabre Corp. disclosed what could be a significant breach of payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and oth...

The continuing threat of POS malware

Point-of-sale systems have seen numerous changes in recent years. From the shift to chip-card readers and the inclusion of new technology for contactless mobile payments, POS systems aren't just for swiping cards anymore. At the same time, two important factors haven't changed - the criticality o...

heartland-php reflective cross-site scripting vulnerability

heartland-php allows PHP applications to integrate with Heartland's Portico Gateway API and other APIs such as MasterPass and PayPal Express Checkout. A reflected cross-site scripting vulnerability exists in heartland-php, which can be exploited by an attacker to conduct reflected cross-site...