Lightning Framework, modular Linux malware

Researchers at Intezer have published a technical analysis of Lightning Framework, a previously undocumented and undetected Linux threat. Lightning is a modular framework that is very versatile and something we don’t see very often in the Linux space. The old argument that Linux systems or Macs f...

Code injection

libnxapl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201...

CVE-2022-32985

CVE-2022-32985 affects Nexans FTTO GigaSwitch industrial/office switches (HW v5) through vulnerable libnx_apl.so; SEC Consult and Red Hat/NVD describe a hardcoded backdoor account enabling SSH logins on ports 50200/50201. The issue stems from outdated components in HW version 5, with fixed versio...

Sneaky New Orbit Malware Backdoors Linux Devices

A sneaky malware for Linux is backdooring devices to steal data and can affect all the processes running on a particular machine, researchers have found. The malware, dubbed Orbit, is unlike other Linux threats in that it steals information from different commands and utilities and then stores th...

CVE-2020-5763

Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering a challenge prompt...

CVE-2020-10263

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can i read Wi-Fi SSID or password, ii read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, iii use Text-To-Speech tools pretend...

Hackers Exploit Zero-Day Bugs in Draytek Devices to Target Enterprise Networks

Cybersecurity researchers with Qihoo 360's NetLab today unveiled details of two recently spotted zero-day cyberattack campaigns in the wild targeting enterprise-grade networking devices manufactured by Taiwan-based DrayTek. According to the report, at least two separate groups of hackers exploite...

Design/Logic Flaw

An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI...

CVE-2019-12776

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocaterevB scripts copies the hardcoded key to...

CVE-2019-12776

The CVE-2019-12776 issue affects ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482, where a hard-coded SSH key enables remote root access. Root cause: hard-coded cryptographic key enabling SSH/SCP access to root via relocate/relocate_revB scripts...

CVE-2019-12776

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044update05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocaterevB scripts copies the hardcoded key to...

Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Exploit

Exploit for linux platform in category remote exploits !/usr/bin/env python SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 Usage: ./fgtsshbackdoor.py import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import t...

Tecnovision DLX Spot - SSH Backdoor Vulnerability

Exploit for multiple platform in category remote exploits Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password. Google Dork: "DlxSpot - Player4" Date: 2017-05-14 Discoverer: Simon Brannstrom Authors Website: https://unknownpwn.github.io/ Vendor Homepage:...

Hacker Who Used Linux Botnet to Send Millions of Spam Emails Pleads Guilty

A Russian man accused of infecting tens of thousands of computer servers worldwide to generate millions in illicit profit has finally entered a guilty plea in the United States and is going to face sentencing in August. Maxim Senakh, 41, of Velikii Novgorod, Russia, pleaded guilty in a US federal...

Fortinet(FortiGate)suspected the presence of the SSH Backdoor influence 4. 0 to 5.0.7 version-bug warning-the black bar safety net

Overview 1 On 1 2 May, twitter user@esizkur published information that the Fortigate exist ssh back door, the impact of the version from 4. 0 to 5. 0. 7, and in the link given in the attached full attack using the code. According to the disclosure of information display, the attacker can use this...

Fortinet FortiGate 4.x 5.0.7 - SSH Backdoor Access

Fortinet FortiGate 4.x 5.0.7 - SSH Backdoor Access !/usr/bin/env python SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 Usage: ./fgtsshbackdoor.py import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import tty d...

Fortinet FortiGate 4.x < 5.0.7 - SSH Backdoor Access

!/usr/bin/env python SSH Backdoor for FortiGate OS Version 4.x up to 5.0.7 Usage: ./fgtsshbackdoor.py import socket import select import sys import paramiko from paramiko.py3compat import u import base64 import hashlib import termios import tty def customhandlertitle, instructions, promptlist: n ...

Custom-SSH-Backdoor - SSH Backdoor using Paramiko

Custom ssh backdoor, coded in python using Paramiko. Paramiko is a Python 2.6+, 3.3+ implementation of the SSHv2 protocol, providing both client and server functionality. While it leverages a Python C extension for low level cryptography PyCrypto, Paramiko itself is a pure Python interface around...

HP StoreVirtual Storage Remote Unauthorized Access

The remote HP storage system running LeftHand OS has an SSH support backdoor mechanism built in that may allow a remote attacker to gain root shell access to the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid73461; scriptversion"2.4"; scriptcvsdate"Date:...

Predictive Security Analytics Tool Available Free to Researchers

SAN JUAN, Puerto Rico – Dan Hubbard has lately been a regular face at a lot of big data meet-ups. He’s also often been the lone security face at these meet-ups, which are dominated by analytics, search, social media and advertising professionals. That may change soon for the CTO of DNS and securi...