TippingPoint Threat Intelligence and Zero-Day Coverage – Week of October 23, 2017

Just like Bugs Bunny wears disguises to avert his enemies, there’s another “wascally” rabbit causing trouble in the form of ransomware. Bad Rabbit is the latest ransomware campaign hitting Eastern European countries with what looks like a variant of the Petya/NotPetya ransomware. Bad Rabbit sprea...

pigment.tokyo XSS vulnerability

Vulnerable URL: https://pigment.tokyo/product/?q==min=max=range==xss%22%3E%3Csvg/onload=prompt%27openbugbounty%27%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1235659 VIP...

lifetech.tokyo Open Redirect vulnerability

Vulnerable URL: http://lifetech.tokyo/shogichannel/redirect?rssId=3334=https://openbugbounty.org Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.12.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated V...

Design/Logic Flaw

The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication...

CVE-2016-7812

The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication...

CVE-2016-7812

The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication...

CVE-2016-7812

CVE-2016-7812 affects Bank of Tokyo-Mitsubishi UFJ Android apps (versions 5.3.1, 5.2.2 and earlier). The vulnerability allows a man-in-the-middle to downgrade TLS v1.2 to SSL v3.0, enabling eavesdropping on encrypted traffic and exposing the session to POODLE-like weaknesses. Connected sources (N...

CVE-2016-7812: Undefined Security Weakness

The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android ver5.3.1, ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0, which may result in the attacker to eavesdrop on an encrypted communication...

PT-2017-9363

Name of the Vulnerable Software and Affected Versions The Bank of Tokyo-Mitsubishi UFJ, Ltd. App for Android versions 5.3.1, 5.2.2 and earlier Description The issue allows a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0,...

Bridging the Skills Gap with Trend Micro’s Capture the Flag (CTF) Competition

We all know the IT security industry is suffering from chronic skills gaps and shortages around the world. In the US things are no different, with an estimated talent shortfall of around 40,000 jobs for information security analyst roles alone. While various initiatives have been proposed, few ha...

Code injection

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

CVE-2016-1184

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

CVE-2016-1184

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

CVE-2016-1184

This CVE concerns the Tokyo Star bank App for Android before 1.4 and iOS before 1.4 failing to validate SSL server certificates, enabling potential man-in-the-middle eavesdropping. Affected apps are Android v1.3 and earlier and iOS v1.3 and earlier. Root cause: lack of server certificate validati...

CVE-2016-1184

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

CVE-2016-1184: Improper Certificate Validation

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

PT-2017-7932

Name of the Vulnerable Software and Affected Versions Tokyo Star bank App for Android versions prior to 1.4 Tokyo Star bank App for iOS versions prior to 1.4 Description The issue concerns the failure to validate SSL certificates. This could potentially allow for man-in-the-middle attacks...

The Bank of Tokyo-Mitsubishi UFJ for Android vulnerable to SSL/TLS downgrade attack

Overview The Bank of Tokyo-Mitsubishi UFJ for Android may be exploited by SSL/TLS downgrade attack. The Bank of Tokyo-Mitsubishi UFJ for Android provided by The Bank of Tokyo-Mitsubishi UFJ, Ltd. tries to communicate with a server via TLS v1.2. However, when a response from the server indicates S...

Keen Lab Takes Down iPhone 6S, Nexus 6P, at Mobile Pwn2Own

Hackers identified a series of vulnerabilities in Android and iOS to take down a Google Nexus 6P and an Apple iPhone 6S this week at Mobile Pwn2Own. The mobile version of the popular hacking challenge, put on by Trend Micro and Tipping Point’s Zero Day Initiative, was held in tandem with the...

Chinese Hackers won $215,000 for Hacking iPhone and Google Nexus at Mobile Pwn2Own

The Tencent Keen Security Lab Team from China has won a total prize money of $215,000 in the 2016 Mobile Pwn2Own contest run by Trend Micro's Zero Day Initiative ZDI in Tokyo, Japan. Despite the implementation of high-security measures in current devices, the famous Chinese hackers crew has...