Trump's Ukraine Server Delusion Is Spreading

Even secretary of state Mike Pompeo has given credence to Trump's demonstrably wrong theory that Ukraine hacked the DNC...

Threat Roundup for October 4 to October 11

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Oct. 4 and Oct. 11. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Sandbox Breakout

Overview Versions of realms-shim prior to 1.2.0 are vulnerable to a Sandbox Breakout. The package's confined evaluator depended upon correct behavior of the spread operator a = ...b, ...c, which could be modified by the confined code. This may allow an attacker to escape the sandbox and run...

We All Could Pay a Price for the Latest Slap at Huawei

An international cybersecurity group has evicted the Chinese telecom company to comply with US sanctions. That could allow malware to spread more easily...

New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware

Researchers have identified a new threat actor that is using impersonation fraud to purchase digital certificates that are then used for the spread of malware. Security firm ReversingLabs identified a bad actor that deceives certificate authorities into selling them legitimate digital certificate...

The Wrong Way to Talk About the El Paso Shooter's Manifesto

The more oxygen these manifestos get, the wider their messages spread. And no one understands that better than the people posting them...

Brand-New SystemBC Proxy Malware Spotted Using SOCKS5 for Stealth

A previously undocumented proxy malware, dubbed “SystemBC,” is upping the stealth game by using SOCKS5 to evade detection. It’s being distributed by the Fallout and RIG exploit kits EKs, according to researchers. Proofpoint researchers said on Thursday that in the most recently tracked example, t...

CVE-2019-13626

SDL Simple DirectMedia Layer 2.x through 2.0.9 has a heap-based buffer over-read in FillIMAADPCMblock, caused by an integer overflow in IMAADPCMdecode in audio/SDLwave.c...

Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors

Canadian government regulators are using the country's powerful new anti-spam law to pursue hefty fines of up to a million dollars against Canadian citizens suspected of helping to spread malicious software. In March 2019, the Canadian Radio-television and Telecommunications Commission CRTC --...

Gustuff banking botnet targets Australia

Vitor Ventura authored this post. Executive summary Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions. As the investigation progressed, Talos came to understand that this campaign was associated with the "ChristinaMorrow" text message spam scam...

Security update for pspp, spread-sheet-widget (moderate)

openSUSE Security Update: Security update for pspp, spread-sheet-widget Announcement ID: openSUSE-SU-2019:0240-1 Rating: moderate References: 1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Backports SLE-15 An update that fixes one vulnerability is now available. Description:...

openSUSE Security Update : pspp / spread-sheet-widget (openSUSE-2019-212)

This update for pspp to version 1.2.0 fixes the following issues : Security issue fixed : - CVE-2018-20230: Fixed a heap-based buffer overflow in readbytesinternal function that could lead to denial-of-service bsc1120061. Other bug fixes and changes : - Add upstream patch to avoid compiling with...

openSUSE: Security Advisory for pspp (openSUSE-SU-2019:0198-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

openSUSE Security Update : pspp / spread-sheet-widget (openSUSE-2019-198)

This update for pspp to version 1.2.0 fixes the following issues: Security issue fixed : - CVE-2018-20230: Fixed a heap-based buffer overflow in readbytesinternal function that could lead to denial-of-service bsc1120061. Other bug fixes and changes : - Add upstream patch to avoid compiling with o...

Security update for pspp, spread-sheet-widget (moderate)

openSUSE Security Update: Security update for pspp, spread-sheet-widget Announcement ID: openSUSE-SU-2019:0212-1 Rating: moderate References: 1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 42.3 An update that fixes one vulnerability is now available. Description: This...

Security update for pspp, spread-sheet-widget (moderate)

openSUSE Security Update: Security update for pspp, spread-sheet-widget Announcement ID: openSUSE-SU-2019:0198-1 Rating: moderate References: 1120061 Cross-References: CVE-2018-20230 Affected Products: openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description: This...

Router vulnerability-prone, Mirai new variant of the struck-vulnerability warning-the black bar safety net

One, Foreword Recently, Tencent Security Cloud Ding lab to listen to the wind threat perception platform monitoring the discovery A to attack router worm, after analysis, found that this worm is mirai virus new variants, and before mirai viruses, the worms not only by the early generation of mira...

WannaMine upgrade to V3. 0 version, the alert caught it! - Vulnerability warning-the black bar safety net

Recently, several companies feedback a large number of hosts and services, the presence of Cottonwood and blue screen phenomenon, in the quest for Sangfor assists after using EDR for the entire network scan found a large number of hosts infected by the same virus. Sangfor security team Research...

WhatsApp Flaw Lets Users Modify Group Chats to Spread Fake News

WhatsApp, the most popular messaging application in the world, has been found vulnerable to multiple security vulnerabilities that could allow malicious users to intercept and modify the content of messages sent in both private as well as group conversations. Discovered by security researchers at...

Huge Cryptomining Attack on ISP-Grade Routers Spreads Globally

UPDATE A massive hacking campaign has been uncovered, compromising tens of thousands of MikroTik routers to embed Coinhive cryptomining scripts in websites using a known vulnerability. As of Thursday morning, Censys.io has reported more than 170,000 active MikroTik devices infected with the...