D-Link Devices - 'info.cgi' POST Buffer Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link info.cgi POST Request Buffer Overflow', 'Description' = %q This module exploits an anonymous remote code execution vulnerabili...

Php Blue Dragon CMS 3.0.0 - Remote Code Execution Exploit

No description provided by source. ?php // Exploit Name: Php Blue Dragon CMS 3.0.0 Code Execution Exploit //Script Homepage: http://phpbluedragon.pl/ // Autor: Kacper [email protected] // Autor Homepage: devilteam.eu | kacper.bblog.pl //Pozdrawiam wszystkich ludzi z DEVIL TEAM, Zapraszam na irc...

New Oil and Natural Gas ONG-ISAC Launches

Energy utilities certainly have not been spared by hackers who for years have targeted vulnerabilities in process control systems and networks with alarming success. In a move to close the gap and keep that corner of the U.S.’ critical infrastructure secure, a new information sharing group popped...

Dyreza Banker Trojan Seen Bypassing SSL

Banker Trojans have proven to be reliable and effective tools for attackers interested in quietly stealing large amounts of money from unwitting victims. Zeus, Carberp and many others have made piles of money for their creators and the attackers who use them, and researchers have been looking at ...

OpenX 2.8.10 Cross Site Scripting / SQL Injection Vulnerabilities

OpenX version 2.8.10 suffers from cross site scripting and remote SQL injection vulnerabilities. Exploit Title: OpenX 2.8.10 - Multiples Vulnerabilites Product: OpenX Vulnerable Versions: 2.8.10 and probably prior Tested Version: 2.8.10 Official site: http://www.openx.com Risk Level: High Exploit...

Apple Phishing Scams on the Rise

Apple has one of the more gilded consumer brands and the company spends a lot of time and money to keep it that way. Consumers love Apple. Scammers and attackers do too, though, and security researchers in recent months have seen a major spike in the volume of phishing emails abusing Apple’s bran...

Malicious Firefox, Chrome Extensions Target Facebook Users

Facebook users are being warned of malicious Firefox and Chrome extensions that can give an attacker remote control over a Facebook profile. Microsoft has seen an increase in activity around these extensions, in particular in Brazil. The threat is detected as Trojan:JS/Febipos.A and has been...

Data-Stealing Spyware Redpill Back, Targeting India

A form of spyware first seen in 2008 and known for siphoning away users’ bank account credentials, emails, screenshots and various other bits of information has surfaced again – this time targeting computer users in India. Nicknamed Redpill, a reference to a plot device used in The Matrix films,...

Telephony Denial-of-Service Attacks Prompt Federal Attention

The call-center equivalent of network-based denial-of-service attacks, known as telephony denial-of-service TDoS, have targeted emergency services among other industries, enough to garner attention from the Department of Homeland Security, Federal Bureau of Investigation, Federal Communications...

Why Watering Hole Attacks Work

Information security is littered with bad analogies. And none sounds sillier than a watering hole attack, which plays off the tactic that dominant animals use when stalking food by loitering at a watering hole. Rather than chase their prey, a lion will wait for prey to come to it. Hackers are doi...

Facebook Partners with Data Brokers for Better Ads

In late February, Facebook forged a partnership with four of its most prolific data brokers in order to more accurately target users with relevant advertisements. Facebook announced on Feb. 27 that it would be expanding its custom audiences tool, an earlier initiative designed to target users wit...

Mobile Phone Number Harvester Fuels SMS Spam

The latest version of a phone number harvesting tool offers its users the ability to trawl the public web and collect mobile phone numbers indexed on sites that ask visitors for them, according to a Webroot report. The numbers are later used as targets for SMS spam campaigns peddling whatever get...

New Backdoor DDoS Malware Co-Existing on Gh0stRAT-Infected Machines

Gh0st RAT has a new roommate. A new backdoor called ADDNEW has been discovered on machines infected with the Gh0st remote access Trojan, adding new distributed denial of service attack capabilities, as well as a feature that targets passwords and credentials stored on the Firefox browser. Gh0st R...

[SET] Social-Engineer Toolkit 4.1.3

TrustedSec Release the latest version of Social-Engineer Toolkit SET as 4.1.3. As most of us know that, It is an open source, python-driven, social-engineering penetration testing framework of custom tools which solely focuses on attacking the human element of penetration testing. It was designed...

Citadel Trojan Updates with Dynamic Config Mechanism that Streamlines Fraud Activity

The elusive authors of the Citadel Trojan have released a new version of their banking botnet malware and service. The latest version, the sixth since it debuted in January and dubbed Rain, includes a dynamic configuration mechanism that allows botmasters to inject malicious content to compromise...

Mac Security: How Threats Against OS X Have Escalated

In this special edition Threatpost editor-in-chief Dennis Fisher talks with founding editor, Ryan Naraine about Mac security. They discuss why it took longer for the security community to understand the vulnerabilities of the Mac and when these conversations started. You’ll hear how cybercriminal...

Apple, Following Microsoft's Lead, Plans to Disable Flashback Botnet

Apple, which usually doesn’t get involved much in security issues outside of issuing patches when needed, said it is working with internet service providers around the world to disable the Flashback botnet’s command and control servers. Flashback exploits a security flaw in Java, Apple explains,...

Russian Agencies Take Down Carberp Gang

A collaborative effort between a Russian security company and two Russian federal agencies has yielded the arrest of eight men allegedly involved in the Carberp Trojan scam, it was announced today. Officials from Russia’s Ministry of Internal Affairs MVD and Federal Security Service FSB, along wi...

SMS Trojans Spreading to the Rest of the World

SMS Trojans that ride along on supposedly benign mobile apps and then send out messages to high-priced numbers have been a problem in some Asian and Eastern European countries for several years now, most notably in Russia and China. But now the attackers have realized that there’s a whole big wor...

Theregister.co.uk , Vodafone, Telegraph, Acer, National Geographic got hacked by Turkguvenligi

Theregister.co.uk , Vodafone, Telegraph, Acer, National Geographic got hacked by Turkguvenligi The Register One of the Biggest British technology news and opinion website got hacked by Turkguvenligi . Not only this Vodafone, Telegraph, Acer, National Geographic, Ups.com , betfair.com also got...