3387 matches found
Hello! My name is Dtrack
Our investigation into the Dtrack RAT actually began with a different activity. In the late summer of 2018, we discovered ATMDtrack, a piece of banking malware targeting Indian banks. Further analysis showed that the malware was designed to be planted on the victim's ATMs, where it could read and...
PT-2019-12495 · Eclipse +1 · Eclipse Mosquitto +1
Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.6.0 through 1.6.4 Description: A use after free error occurs when an MQTT v5 client connects to the affected Eclipse Mosquitto versions, sets a last will and testament, a will delay interval, and a session expiry...
ThreatList: Apple Adware, Phishing, APT Attacks Threaten macOS Users
While macOS is often touted as “safer” on the cybersecurity front compared to Windows-based systems, cybercriminals are in fact increasingly targeting Apple’s ecosystem. The number of attacks on macOS users through malicious and potentially unwanted programs has been increasing annually since 201...
IT threat evolution Q2 2019
Targeted attacks and malware campaigns More about ShadowHammer In March, we published the results of our investigation into a sophisticated supply-chain attack involving the ASUS Live Update Utility, used to deliver BIOS, UEFI and software updates to ASUS laptops and desktops. The attackers added...
A case study in industry collaboration: Poisoned RDP vulnerability disclosure and response
Earlier this year, I reached out to Check Point researcher Eyal Itkin, who had published multiple flaws in several Remote Desktop Protocol RDP clients, including a vulnerability in mstsc.exe, the built-in RDP client application in Windows. While there were no active exploits detected in the wild,...
DHS Warning: Small Aircraft are Ripe for Hacking
The Department of Homeland Security issued an alert Tuesday warning that small aircraft are vulnerable to hackers that can gain physical access to a plane. It warned that a hacker can easily manipulate aircraft telemetry data, which can result in loss of control of the airplane. The bulletin was...
The evolution of Microsoft Threat Protection—July update
Modern security teams need to proactively, efficiently, and effectively hunt for threats across multiple attack vectors. To address this need, today we’re excited to give you a glimpse of a new threat hunting capability coming soon to Microsoft Threat Protection. Building off the threat hunting...
CVE-2019-11273 PKS Telemetry logs credentials
Pivotal Container Services PKS versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information...
Uber: Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information
The dropwizard instance running on display.uber-adsystem.com is unsecured, meaning any unauthenticated user can view and use it's admin tools. These tools expose sensitive information on Uber production servers, including the current threads running, info on the CPU, and more server info that...
Latest FinSpy Modules Lift Data from Secure Messaging Apps
The latest iOS and Android versions of the FinSpy espionage malware have been deployed in the wild, and are capable of collecting a raft of personal information such as contacts, SMS/MMS messages, emails, calendars, GPS location, photos, files in memory, phone call recordings and data – even from...
New FinSpy iOS and Android implants revealed ITW
Updated: 23.07.2019 After publication of this article, we received a letter from a representative of Gamma Group International Ltd. stating that they disposed of all interests in FinFisher FinSpy in 2013. This article has been corrected in accordance with this new information. According to...
Dismantling a fileless campaign: Microsoft Defender ATP’s Antivirus exposes Astaroth attack
The prevailing perception about fileless threats, among the security industry’s biggest areas of concern today, is that security solutions are helpless against these supposedly invincible threats. Because fileless attacks run the payload directly in memory or leverage legitimate system tools to r...
ScarCruft continues to evolve, introduces Bluetooth harvester
Executive summary After publishing our initial series of blogposts back in 2016, we have continued to track the ScarCruft threat actor. ScarCruft is a Korean-speaking and allegedly state-sponsored threat actor that usually targets organizations and companies with links to the Korean peninsula. Th...
[SECURITY] Fedora 30 Update: mosquitto-1.6.2-1.fc30
Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...
Schneider Electric X80 RTU Detection
Binary data 762309.prm...
Schneider Electric X80 RTU Detection
Binary data 762308.prm...
DEBIAN-CVE-2019-5432
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding...
Low: Red Hat Security Advisory: openstack-ceilometer security update
An update for openstack-ceilometer is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
How to tap the RPC vulnerability, Part 2-the vulnerability warning-the black bar safety net
One, Foreword In a previous article, translation, and FortiGuard Labs to share with you how to use the RPCView to find the RPC server in the logical loopholes, the final we in the Microsoft Universal Telemetry service found a potential problem. As you may remember, in the previous article we...