SecurityAdvisory 2015-04-14

The source code contains a logical flaw related to user PIN aka PW1 verification that allows an attacker with local host privileges and/or physical proximity NFC to perform security operations without knowledge of the user’s PIN code...

Use HTC One vulnerability to crack mobile PIN password-vulnerability warning-the black bar safety net

HTC One phone is running Android 4.2.2 and HBOOT 1.54.0000, it exists a file called Bootloader vulnerability. This vulnerability early in the 2 0 1 4 year 2 month's report to the HTC official, and at times months to fix the vulnerability. In get HTC official consent, we will now take the entire...

Security Advisory-WPS PIN Offline Brute Force Cracking Vulnerability in Huawei Home Gateway Products

Some Huawei home gateways are affected by the PIN offline brute force cracking vulnerability of the WPS protocol because the random number generator RNG used in the supplier’s solution is not random enough. As a result, brute force cracking the PIN code is easier. After an attacker cracks the PIN...

Quantum Encryption Makes Credit Cards Fraud-Proof

Credit card frauds are very common these days – today a data breach occurs in retailer’s shop, online shopping site or banking site and at the next moment millions of cards appears in the underground black market – how simple is that for cyber criminals nowadays. But imagine if there is no possib...

Smartwatch Hacked... Data Exchange with Smartphone Not So Secure

We are living in an era of smart devices that we sync with our smartphones and make our lives very simple and easy, but these smart devices that inter-operates with our phones could leave our important and personal data wide open to hackers and cybercriminals. Security researchers have demonstrat...

Home Depot Breach Cost Company $43 Million in Third Quarter

The massive Home Depot data breach disclosed earlier this fall involved the theft of 56 million credit and debit card numbers, and now the company has revealed that the incident so far has cost it $43 million. The costs are the result of both the investigation into the data breach as well as the...

American Express Brings Tokenization to Payment Cards

American Express has taken steps toward lifting the burden from retailers having to store payment-card data with the announcement of its American Express Token Service. The service will replace traditional 16-digit credit card numbers with a digital token. Consumers carrying a card supporting the...

NSA-Approved Samsung Knox Stores PIN in Cleartext

A security researcher has tossed a giant bucket of ice water on Samsung’s thumbs up from the NSA approving use of certain Galaxy devices within in the agency. The NSA’s blessing, given under the agency’s Commercial Solutions for Classified Program, meant that the Samsung Galaxy 4, 5 and Galaxy No...

Obama Executive Order Forces Chip & Pin, EMV on Government

President Barack Obama last week signed an Executive Order that will force the federal government to adopt chip and PIN technology for government payment cards and to outfit retail point-of-sale terminals at federal facilities – like national parks and post offices – with the capacity to accept...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

openssh security, bug fix, and enhancement update

5.3p1-104 - ignore SIGXFSZ in postauth monitor child 1133906 5.3p1-103 - don't try to generate DSA keys in the init script in FIPS mode 1118735 5.3p1-102 - ignore SIGPIPE in ssh-keyscan 1108836 5.3p1-101 - ssh-add: fix fatal exit when removing card 1042519 5.3p1-100 - fix race in backported...

Hackers publish the BadUSB fix patch only applies to the latest version of the group with the USB 3.0 firmware-bug warning-the black bar safety net

Last week, two hackers announced they had the BadUSB code reverse engineering, and on GitHub published. As for the reason for this, is to give the industry the pressure is applied, in order to quickly come up with a solution--although doing so will also make the user more vulnerable to face...

CVE-2014-2942

Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code...

Code injection

Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code...

CVE-2014-2942

Cobham Aviator 700D and 700E satellite terminals use an improper algorithm for PIN codes, which makes it easier for attackers to obtain a privileged terminal session by calculating the superuser code, and then leveraging physical access or terminal access to enter this code...

CVE-2014-2942

Cobham Aviator 700D/700E satellite terminals are affected by CVE-2014-2942 due to use of a broken/risky cryptographic algorithm to generate PINs. This enables a local, unauthenticated attacker to calculate a superuser PIN and gain full control of the terminal, given physical access or access to t...

PHP Stock Management System 1.02 - Multiple Persistent Cross Site Scripting Vulnerabilities

No description provided by source. ​ Exploit Title: Multiple Persistent Cross Site Scripting Vulnerabilities in PHP Stock Management System 1.02 Date: 25 Aug 2014 Exploit Author: ​Ragha Deepthi K R Vendor Homepage: ​http://www.posnic.com/​ Software Link:​...

Home Depot Data Breach Confirmed

Home Depot today finally confirmed that its payment systems have been breached, but a number of crucial questions remain unanswered by the giant home improvement retailer. In a statement released late this afternoon, Home Depot said customers using payment cards at its U.S. and Canada locations,...

LSE Leading Security Experts GmbH - LSE-2014-07-13 - Granding Grand MA 300 - Weak Pin Verification

=== LSE Leading Security Experts GmbH - Security Advisory 2014-07-13 === Grand MA 300 Fingerprint Reader - Weak Pin Verification ------------------------------------------------------------------------ Affected Versions ================= Grand MA 300/ID with firmware 6.60 Issue Overview...