SHA-1 End Times Have Arrived

For the past couple of years, browser makers have raced to migrate from SHA-1 to SHA-2 as researchers have intensified warnings about collision attacks moving from theoretical to practical. In just weeks, a transition deadline set by Google, Mozilla and Microsoft for the deprecation of SHA-1 is u...

Hindu Matrimonial Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-scrip...

QIWI: [XSS/3dsecure.qiwi.com] 3DSecure XSS

При отправке POST запроса: POST https://3dsecure.qiwi.com/acs/pareq?network=VISA HTTP/1.1 Host: 3dsecure.qiwi.com Connection: keep-alive Content-Length: 37 Cache-Control: max-age=0 Origin: https://pay.qiwi.com Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

New Relic: Restricted User can view multiple account details including customer_root_account_id, payment method, date of first payment, etc.

Summary When a restricted user visits this URL: There is a request sent to this URL: https://www.staging-bam.nr-data.net. Within that request leaks the following information about the entire account, that the restricted user can view:...

Hindu Matrimonial Script - Authentication Bypass

Hindu Matrimonial Script - Authentication Bypass Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-script/...

Threat Outbreak Alert RuleID27166: Email Messages Distributing Malicious Software on January 12, 2017

Medium Alert ID: 52311 First Published: 2017 January 12 16:47 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27166 may contain the following files: Name |...

Los Angeles College Pays Hackers $28,000 Ransom To Get Its Files Back

Ransomware has turned on to a noxious game of Hackers to get paid effortlessly. Once again the heat was felt by the Los Angeles Valley College LAVC when hackers managed to infect its computer network with ransomware and demanded US$28,000 payment in Bitcoins to get back online. The cyber-attack...

Netgear launches Bug Bounty Program for Hacker; Offering up to $15,000 in Rewards

It might be the easiest bug bounty program ever. Netgear launched on Thursday a bug bounty program to offer up to $15,000 in rewards to hackers who will find security flaws in its products. Since criminals have taken aim at a rapidly growing threat surface created by millions of new Internet of...

Threat Outbreak Alert RuleID27049: Email Messages Distributing Malicious Software on January 3, 2017

Medium Alert ID: 52245 First Published: 2017 January 3 16:57 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27049 may contain the following files: Name |...

BHIM App — How to Send & Receive Money with UPI

After the lack of supply of cash in India following its Prime Minister step to remove high-denomination banknotes from circulation in November 2016, the country is moving a step closer towards becoming a cashless economy with the launch of Unified Payment Interface UPI. Unified Payment Interface...

Threat Outbreak Alert RuleID27010: Email Messages Distributing Malicious Software on December 22, 2016

Medium Alert ID: 52208 First Published: 2016 December 22 15:23 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID27010 may contain the following files: Name |...

Threat Outbreak Alert RuleID26871: Email Messages Distributing Malicious Software on December 19, 2016

Medium Alert ID: 52165 First Published: 2016 December 20 15:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID26871 may contain the following files: Name |...

New Decryptor Unlocks CryptXXX v3 Files

Researchers have neutralized the threat of the latest strain of the CryptXXX v.3 ransomware, releasing a decryption tool for unlocking files, and have added it to the RannohDecryptor, a free utility hosted by Kaspersky Lab’s No Ransom Project. Previous decryption tools had been available for...

FBI Most Wanted Fugitive JPMorgan Hacker Arrested in New York

One of the FBI's most wanted hackers who was behind the largest theft of financial data has finally been arrested at the JFK airport in New York. Joshua Samuel Aaron is accused of being part of a hacking group that attacked several major financial institutions, including JPMorgan Chase, and...

Fast Breakfast App Has Arbitrary User Payment Password Change Vulnerability

Fast Breakfast APP is a mobile service software. There is an arbitrary user payment password modification vulnerability in Fast Breakfast APP. Due to the use of loginStatus and userTel parameters to query the userID of any user, it is possible to modify the payment password of any user...

Experts Explain How Hackers Can Hack Your Credit Cards In Seconds

As India attempts an upgrade to a cashless society, cyber security experts have raised serious concerns and revealed how to find credit card information – including expiration dates and CVV numbers – in just 6 Seconds. And what's more interesting? The hack uses nothing more than guesswork by...

Distributed Guessing Attack Reels in Payment Card Data

Academics at Newcastle University have proven that an attacker in possession of a minimal amount of existing information can, in an automated way, guess payment card data by exploiting weaknesses in online payment processes. The issue lies in the fact that the global payment system lacks a...

‘One-Stop Shop’ – Phishing Domain Targets Information from Customers of Several Indian Banks

FireEye Labs recently discovered a malicious phishing domain designed to steal a variety of information – including credentials and mobile numbers – from customers of several banks in India. Currently, we have not observed this domain being used in any campaigns. The phishing websites appear to b...

PortSwigger Web Security: Order-phishing via Payment ID URL

Hello. I discovered the endpoint, which allows the attacker conduct the fishing attack to other users and they can pay for attacker's order. Why this can happen? On the site, order id parameter sends to the https://portswigger.net/CCPayment.aspx as POST, but attacker can append it as GET and it...

‘One-Stop Shop’ – Phishing Domain Targets Information from Customers of Several Indian Banks

FireEye Labs recently discovered a malicious phishing domain designed to steal a variety of information – including credentials and mobile numbers – from customers of several banks in India. Currently, we have not observed this domain being used in any campaigns. The phishing websites appear to b...