Three Charged with Creating, Distributing Gozi Banking Malware

Charges will be brought today in the U.S. District Court for the Southern District of New York against three men allegedly involved with creating and distributing the Gozi banking Trojan. Gozi infected more than a million computers worldwide, including a handful at NASA, leading to tens of millio...

ADP-Themed Phishing Emails Lead to Blackhole Sites

Scammers are spamming out malicious emails purporting to come from payroll processing company ADP, according Dancho Danchev of Webroot. The emails arrive under the subject line “ADP Immediate Notifications” and contain links to compromised websites hosting the latest iteration of the Blackhole...

Bank DDoS Attacks Using Compromised Web Servers as Bots

A rash of politically and socially motivated distributed denial-of-service attacks against major U.S. banks has been able to intermittently disrupt online and mobile banking services. The attackers have been able to fire unprecedented amounts of traffic at the likes of Wells Fargo, Bank of Americ...

Cool, BlackHole Exploit Kits Created by Same Hacker

If the relatively cheap, easily available, and totally reliable Blackhole exploit kit is the Toyota Camry of exploit kits, then the Cool exploit kit is the Lexus LS: both kits are reportedly developed by the same crew, but the latter is astronomically more expensive and presumably loaded with...

Official Debian and Python Wiki Servers Compromised

Administration from Debian and Python project official websites confirmed that their WIKI servers were compromised by some unknown hackers recently. Hackers was able to hack because of several vulnerabilities in "moin" package. According to Brian Curtin at Python Project, Hacker user some unknown...

Malware stole 3000 confidential Documents from Japan ministry

Japan ministry become the recent victim of a cyber attack through a malware that suspected to have compromised and sent overseas more than 3,000 confidential documents from the ministry, including many on global trade negotiations. After investigation, experts found that Hackers use "HTran" the...

CVE-2012-4545

CVE-2012-4545 affects ELinks 0.12 up to (but not including) 0.12pre6, where using HTTP Negotiate or GSS-Negotiate authentication delegates user credentials via GSSAPI. This can allow a remote server to authenticate as the client using delegated credentials. The CVSS score from NVD is 5.1 (Medium)...

CVE-2012-4545

The httpnegotiatecreatecontext function in protocol/http/httpnegotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials...

CVE-2012-4545

The httpnegotiatecreatecontext function in protocol/http/httpnegotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials...

Xxe

IBM SPSS Modeler 14.0, 14.1, 14.2 through FP3, and 15.0 before FP2 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service CPU and memory consumption, via an XML external entity declaration in conjunction with an entity...

CVE-2012-0741

IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate...

CVE-2012-0741

IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 fail to validate X.509 certificates when using the Manual Explore Proxy feature, enabling man-in-the-middle attackers to spoof SSL servers with an arbitrary certificate. The CVE describes a vulnerability in S...

CVE-2012-0738

IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate...

PT-2012-2830

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions prior to 8.6.0.2 IBM Rational Policy Tester versions prior to 8.5.0.3 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate because X.509 certificate...

Stabuniq Trojan rapidly stealing data from US banks

--- Trojan.Stabuniq geographic distribution by unique IP address Security researchers from Symantec have identified a new Trojan that appears to be targeting financial institutions. Dubbed Trojan.Stabuniq, the malware has been collecting information from infected systems potentially for the...

CRIME vulnerability via the SPDY protocol CVE-2012-4930

The SPDY protocol 3, and earlier, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences during a series of guesses in which a string i...

Tor-Powered Botnet Linked to Malware Coder's AMA on Reddit

In the process of analyzing a seemingly new and fairly small botnet called Skynet, Rapid7 security researchers determined that this was precisely the same network described by its creator in a particularly bold ‘Ask Me Anything’ AMA on the social news site Reddit earlier this year. Claudio...

DNS ANY Request Malformed Payload Denial of Service

A denial of service vulnerability has been reported in DNS servers...

RHEL 6 : bind (RHSA-2012:1549)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:1549 advisory. - bind: DoS on servers using DNS64 CVE-2012-5688 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Zitmo Trojan Variant Eurograbber Beats Two-Factor Authentication to Steal Millions

Online banking customers in Europe are falling victim by the thousands to a new banking Trojan that is infecting Android and BlackBerry devices and is capable of defeating two-factor authentication. The Trojan, dubbed Eurograbber by researchers at Check Point Software Technologies and Verasafe, i...