A year of Windows kernel font fuzzing #1: the results

Posted by Mateusz Jurczyk of Google Project Zero This post series is about how we used at-scale fuzzing to discover and report a total of 16 vulnerabilities in the handling of TrueType and OpenType fonts in the Windows kernel during the last year. In part 1 here, we present a general overview of...

Uber: Stored XSS in developer.uber.com

An attacker can make a series of requests to https://uber.readme.io/ that will result in permanent defacement/stored XSS of all the documentation pages on https://developer.uber.com/ I'm not entirely sure if this is in scope, but it could definitely have a major impact on developer.uber.com so I...

Apple Mac OS X Gatekeeper Bypass

Gatekeeper is Mac OS X’s guardian against rogue applications and malware sneaking into Apple’s famous walled garden. It’s also been a favorite target of researchers and advanced attackers desperate to gain control of Apple devices. Tomorrow at Virus Bulletin in Prague, researcher Patrick Wardle,...

Report Companies Still Not Patching Security Vulnerabilities

The Cisco 2015 Annual Security Report is out and the findings are troubling as always: for every positive finding in the report, it seems, there is a negative finding, neutralizing any gains in the network security struggle. Chief information security officers say their security postures are stro...

HTML Help Workshop 1.4 - Local Buffer Overflow (SEH)

import subprocess Exploit Title: HTML Help Workshop 1.4 - Local Buffer Overflow Exploit SEH Date: 31/08/2014 Author: mr.pr0n @pr0n Homepage: http://ghostinthelab.wordpress.com/ Software Link: http://msdn.microsoft.com/en-us/library/windows/desktop/ms669985%28v=vs.85%29.aspx Version: 1.4 Tested on...

Sophos Products - Multiple Vulnerabilities

No description provided by source. List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled Practical Attacks against Sophos Antivirus. As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper includes a...

Factlink: HTML5 cross-origin resource sharing

Issue: HTML5 cross-origin resource sharing Host: https://staging.factlink.com Path: /about Issue detail The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can...

[Kvasir] Tools for effective data management during a Penetration Test

Welcome to Kvasir! Herein these directories lay the groundwork tools for effective data management during a Penetration Test. Penetration tests can be data management nightmares because of the large amounts of information that is generally obtained. Vulnerability scanners return lots of actual an...

[BeEF] Fake Browser Update Exploitation

How to use BeEF Framework for fake browser update exploitation. Fake Browser Update : - In BeEF Framework there is a new feature available in social-engineering called Clippy using this feature we are sending the fake Update notification and if user click on that so obviously he is going to insta...

multiple critical vulnerabilities in sophos products

List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper includes a working pre-authentication remote...

Sophos Products - Multiple Vulnerabilities

Sophos Products - Multiple Vulnerabilities List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper...

[BeEF 0.4.3.8] Browser Exploitation Framework

The Browser Exploitation Framework BeEF is a powerful professional security tool. It is a penetration testing tool that focuses on the web browser. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security...

NeXpose 5.0 vulnerability management solution Released by Rapid7

NeXpose 5.0 vulnerability management solution Released by Rapid7 Nexpose proactively supports the entire vulnerability management lifecycle, including discovery, detection, verification, risk classification, impact analysis, reporting and mitigation. This gives organizations immediate insight int...

Financial Services Industry Report Urges Rethink on Malware

BITS, a financial services industry trade group has published a guide to malicious software and cyber crime that finds many industry attempts to fight the problem haven’t worked. The report calls on financial services firms to cooperate more in fighting malware. The Malware Risks and Mitigation...

The iPad: As Insecure As The iPhone

Forbes reporter Andy Greenberg polled a group of security researchers about the security posture of Apple’s new iPad device and comes away with a simple conclusion: The iPad is just as insecure as the iPhone. Some quotes from the story: Aaron Portnoy, security researcher, Tipping Point: “It’s...

Audit Finds Gaping Holes in NASA Security

The U.S. Government Accountability Office GAO has painted a bleak picture of the NASA’s IT security posture. An audit of the space agency’s computer systems found weaknesses in several critical areas, especially in the way NASA implemented access controls like user accounts, passwords and the...

Hathaway Resigns as Federal Cybersecurity Adviser

Melissa Hathaway has left her post as the country’s top cybersecurity adviser, casting even more doubt on who will take the open job of cybersecurity coordinator created by President Obama in May. Hathaway said she is resigning for personal reasons and has no interest in the coordinator job,...