APT29 Domain Fronting With TOR

Mandiant has observed Russian nation-state attackers APT29 employing domain fronting techniques for stealthy backdoor access to victim environments for at least two years. There has been considerable discussion about domain fronting following the release of a paper detailing these techniques...

The Changing Face of Carbanak

Months of ramped up Carbanak activity that includes a new host of targets and new command and control strategy has reinvigorated attention on a criminal outfit that may have at one time stolen up to $1 billion from banks worldwide. Carbanak has moved on from an almost exclusive focus on financial...

Deception Technology: Can It Detect Intruders Earlier in their Attack Chain?

Every infosec conference is chatting about the Attack Chain, a visual mapping of the steps an intruder must take to breach a network. If you can detect traces of an attack earlier, you not only have more time to respond, but can stop the unauthorized access to monetizable data and its exfiltratio...

Pwned by Vpon

Vpon is one of many mobile ad SDKs marketed towards mainland Chinese and Taiwanese developers and app users. Recently, FireEye mobile security researchers identified a branch of Vpon ad SDK on iOS containing code that allows a malicious actor be it the app developer or the SDK creator to remotely...

JSRat - Reverse HTTP Shell Using JavaScript

JSRat is a reverse HTTP Shell by using JavaScript. JSRat use rundll32.exe to load the JavaScript code in cmd and a HTTP Shell is returned when the code is executed. The special part is that after running the cmd command, rundll32.exe will remain in the background to continuously connect to the...

X (Formerly Twitter): Insufficient OAuth callback validation which leads to Periscope account takeover

Hi, I would like to report an issue in the Periscope Twitter application which allows attacker to circumvent the callback locking to takeover victim's Periscope account which is connected to a Twitter account. Detail In the mobile Periscope app, the consumerkey and consumersecret for Twitter...

Attackers Replacing Firmware on Cisco Routers

Cisco routers are built into the fabric of the Internet and enterprise networks, a fact that makes them highly attractive targets for attackers. Researchers at FireEye have come across attacks recently in which hackers have been modifying the firmware of Cisco routers and using that foothold to...

HackerOne: Logic Issue with Reputation: Boost Reputation Points

Hi, I'm disclosing a bug that can allow a program member to escalate a profile reputation by +2 points indefinitely till the extent he/she wants and the process will be somewhat stealthy as there won't be a trace on member's profile say fake resolved bugs etc. Prologue BugBug - Imaginary program ...

Long range RFID hacking tool to be released at Black Hat

Out of necessity come many interesting inventions. Fran Brown, a year ago, was working a penetration test for an electric utility doing an assessment of its SCADA network. His first challenge was to get inside the facility, meaning, in short that he had to break in. To do so, he decided to test t...

WinRM VBS Remote Code Execution Vulnerability

This Metasploit module uses valid credentials to login to the WinRM service and execute a payload. It has two available methods for payload delivery: Powershell 2.0 and VBS CmdStager. The module will check if Powershell 2.0 is available, and if so uses that method. Otherwise it falls back to the...

New Android Malware Variant Can Remotely Root Phone

A new version of Android malware has been tweaked so it doesn’t require user interaction for an attacker to own the device, according to research published by Lookout Mobile Security yesterday. An updated variant of the Legacy Native LeNa malware utilizes the GingerBreak exploit to gain root...

Removing CarrierIQ Is A Really Bad Idea For Most Mobile Phone Users

The controversy over stealthy monitoring software by CarrierIQ has raised important questions about user privacy and business ethics in the Brave New World of smart phones, tablets and the like. In the uproar over CarrierIQ’s surreptitious monitoring of mobile phone users, various tools have...

Dissecting the ZeroAccess Rootkit

The ZeroAccess rootkit isn’t the most well-known or closely watched piece of malware in recent history, but, as an extremely detailed new analysis of the program shows, it is a perfect example of the kind of sophisticated malware that attack crews are using to maintain persistent, silent access t...

The Coming Wave of Mobile Attacks

The pace of innovation on mobile phones and other smart wireless devices has accelerated greatly in the last few years, adding features, speed and computing power. But now the attackers are beginning to outstrip the good guys on mobile platforms, developing innovative new attacks and methods for...

Twitter Domain API Back in Malware Fray

Malware writers have revamped code that uses a popular Twitter command to generate hard-to-predict domain names, a technique that brings stealth to their drive-by exploits. Read the full article. The Register...

You can also when hackers create the perfect IE the page Trojan-vulnerability warning-the black bar safety net

If you want to create the perfect IE web Trojan, first of all have to give our perfect to develop a standard, I personally think that a perfect ＩＥ web Trojans should have at least the following four characteristics: A: you can hide from antivirus software and the hunted; the Two: you can avoid th...

Mad virus mad firewall—emerging-Trojan NameLess BackDoor Vengeance in mind(figure)-vulnerability warning-the black bar safety net

Editor's note: mention of the NameLess Latest 1. 4 version of the source code of the site there is a download NameLess Virus is a new Xing of DLL-Trojans, this Trojan was born not long, but is definitely a horse of great potential of a thousand miles Colt is. Speaking of the NameLess Trojan...

Cross-Site Scripting (CSS) in Hosting Controller All Version and hot fix it hehe ;)

Cross-Site Scripting CSS in Hosting Controller All Version and hot fix it hehe ; [email protected] Ashiyane Security Team SegmentationFault Group iam sun-os hehe :P Greetz to : S4P0 - failed - Xsupr3mo - Status-x - Stealh Greetz to : berhooz - nima - ehsan - Mehrtash and...