McAfee Threat Intelligence Exchange Server Authorization Issues Vulnerability

McAfee TIE Server is a network threat defense server from the U.S. company McAfee McAfee. An authorization issue vulnerability exists in the API in McAfee Threat Intelligence Exchange Server version 3.0.0. The vulnerability stems from a lack of authentication measures or insufficient authenticati...

Mobile threat defense and intelligence are a core part of cyber defense

The modern workplace is a mobile workplace. Today’s organizations rely on mobility to increase productivity and improve the customer experience. But the proliferation of smartphones and other mobile devices has also expanded the attack surface of roughly 5 billion mobile devices in the world, man...

TheTHE - Simple, Shareable, Team-Focused And Expandable Threat Hunting Experience

TheTHE is an environment intended to help analysts and hunters over the early stages of their work in an easier, unified and quicker way. One of the major drawbacks when dealing with a hunting is the collection of information available on a high number of sources, both public and private. All thi...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Tofsee Botnet

Tofsee is a botnet which has not been reported on since the following analysis in September of 2016 by the Cert Polka team and Cisco Talos. This updated campaign employs new techniques in order to aggressively send large volumes of spam emails primarily targeting the adult dating scene. This new...

Threat Analysis Unit (TAU) Threat Intelligence Notification: BlackRemote RAT

BlackRemote is a relatively new commodity RAT discovered in September 2019. Similar to other Remote Access Trojans, it offers typical functionality such as keylogging, remote desktop, file transfer, credential harvesting, and more. Despite the discovery of this RAT being caught early, and while t...

The FireEye Approach to Operational Technology Security

Today FireEye launches the Cyber Physical Threat Intelligence subscription, which provides cyber security professionals with unmatched context, data and actionable analysis on threats and risk to cyber physical systems. In light of this release, we thought it would be helpful to explain FireEye’s...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Skidmap

Hijacking machine resources and using them to mine for cryptocurrency continues to be an attractive and lucrative target for threat actors. As we’ve continued to see this type of attack used, we’ve also seen more platforms being targeted. Seeing cryptocurrency mining malware targeting Linux and...

Latest Enterprise EDR Now Available on All Major Operating Systems

VMware Carbon Black is today announcing new capabilities for macOS systems protected by our cloud-native enterprise endpoint detection and response EDR solution, CB ThreatHunter. This latest release on the VMware Carbon Black Cloud further expands customizable detection, threat intelligence,...

Threat Analysis Unit (TAU) Threat Intelligence Notification: AsyncRAT

AsyncRAT is a Remote Access Tool RAT designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop...

CVE-2019-3641

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server TIE Server 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages...

CVE-2019-3641

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server TIE Server 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages...

CVE-2019-3641

CVE-2019-3641 affects McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0, where an Abuse of Authorization in the exposed APIs allows remote authenticated users to modify stored reputation data via specially crafted messages. The root cause is an authorization/control weakness in TIE Se...

CVE-2019-3641 Exploitation of Authorization in TIE Server

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server TIE Server 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages...

New partnership brings together Talos’ visibility with IR’s unmatched response capabilities

By Jon Munshaw. The threat landscape has evolved into a complex, challenging environment for organizations everywhere. A talent shortage, combined with an increase in incidents, has led to a generally weak security posture among most organizations. Defenders’ backs are up against the wall...

McAfee Threat Intelligence Exchange Server CVE-2019-3641 Unauthorized Access Vulnerability

Description McAfee Threat Intelligence Exchange Server is prone to an unauthorized-access vulnerability. Attackers can exploit this issue to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. McAfee Threat Intelligence Exchange Server 3.0.0 is vulnerable...

threat_note - DPS' Lightweight Investigation Notebook

threatnote is a web application built by Defense Point Security to allow security researchers the ability to add and retrieve indicators related to their research. As of right now this includes the ability to add IP Addresses, Domains and Threat Actors, with more types being added in the future...

Microsegmentation and Isolation: 2 Essential Strategies in Zero-Trust Security

The headlines over the past few years have been consistent – enterprises are pouring more and more money into cybersecurity countermeasures. Indications are that 2020 will be no different, with reports that nearly three quarters of CISOs plan to ask their CFOs for increased cybersecurity investme...

Taking Reputation to Scale: The Delicate Balance of Latency, Scale, and Cost (Part 1)

When it comes to serving reputation, even a millisecond of latency could create havoc, resulting in the unwanted spread of malware and causing costly consequences that no security company or customer wants. And that’s why we, as engineers here at Carbon Black, are constantly working towards...

Beers with Talos Ep. #65: Please welcome to the show… Talos Incident Response

By Mitch Neff. Beers with Talos BWT Podcast episode No. 65 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Oct. 25, 2019 Today is a bit different. We normally keep things pretty neutral on this show not...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...