Glenn Greenwald to Publish Names of US citizens that NSA Spied On Illegally

Two weeks ago, it was revealed that NSA has been reportedly intercepting and accessing routers, servers, and other computer networking hardware to plant data gathering “backdoors” and other spywares before they were exported and delivered to the international customers. Now, the journalist Glenn...

Threatpost News Wrap, May 23, 2014

Dennis Fisher and Mike Mimoso discuss the US indictments of Chinese army officers for hacking, the Blackshades malware arrests, the new IE 8 zero day and the US prospects in the World Cup. Download: digitalunderground154.mp3 Music by Chris Gonsalves...

Cisco Releases Security Advisories

Cisco has released two security advisories to address multiple product vulnerabilities, one of which may allow a remote attacker to execute arbitrary code with elevated privileges. The advisories are listed below: Cisco Wide Area Application Services Remote Code Execution Vulnerability Multiple...

Iranian Ajax Security Team targets US Defense Industry

The Iranian hacking group, which calls itself the “Ajax Security Team”, was quite famous from last few years for websites defacement attacks, and then suddenly they went into dark since past few months. But that doesn't mean that the group was inactive, rather defacing the websites, the group was...

NSA Reportedly Intercepts US-made Internet Routers to Install Spyware

The US Intelligence Agency, NSA has been reportedly intercepting and accessing routers, servers, and other computer networking hardware to plant data gathering “backdoors” and other spywares before they are exported and delivered to the international customers, reported by the Guardian. Yesterday...

Google Releases Security Update for Chrome

Google has released Chrome 34.0.1847.137 for Windows, Mac, and Linux to address multiple vulnerabilities. Some of these vulnerabilities could potentially allow an attacker to take control of the affected system. US-CERT encourages users and administrators to review the Google Chrome Blog post and...

PointDNS Recovers from Massive DDoS Attack

PointDNS says most of its DNS servers are online again after a massive DDoS attack late last week took down the service provider. A post on the company’s Twitter account on Friday said the provider was adding nameservers and working with network providers to restore service to its customers. Many...

Russian Hacker Charged in Biggest U.S Hacking Case Doesn't Want Extradition to U.S

A Russian Hacker who was arrested in year 2012 by the authorities of the Netherlands and accused for allegedly hacking into the computer networks of more than a dozen major American corporations and stole over 160 million Credit and Debit Card Numbers. Earlier we reported, 33-year-old Russian...

US Navy's Nuclear Reactor System Administrator Arrested on Hacking Charges

The United States charged two men for their involvement in a conspiracy to hack into the computer systems of dozens of government and commercial organizations, including the U.S. Navy and National Geospatial-Intelligence Agency NGA, according to the U.S. Attorney's Office in Tulsa. On Monday, the...

Microsoft Releases Security Update for Internet Explorer Use-After-Free Vulnerability

Microsoft has released out-of-band updates to address a critical use-after-free vulnerability in Internet Explorer versions 6 through 11, including IE versions running on Windows XP. US-CERT recommends that users and administrators review Microsoft Security Bulletin MS14-021 and apply the necessa...

Microsoft Internet Explorer Use-After-Free Vulnerability Guidance

US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and could allow unauthorized remote code execution. US-CERT recommends that users and administrators review Microsoft Security Advisory...

Firmware Update for Apple AirPort Devices

Apple has released firmware update 7.7.3 for AirPort Extreme and AirPort Time Capsule base stations with 802.11ac. The update addresses the OpenSSL "Heartbleed" vulnerability where an attacker may obtain memory contents. US-CERT recommends that users and administrators review Apple Security Updat...

Adobe Releases Security Update for Reader Mobile

Adobe has released a security update to address a vulnerability in Adobe Reader Mobile 11.1.3 and earlier versions for Android. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code via a crafted PDF document. US-CERT recommends that users and administrators...

Oracle Releases April 2014 Security Advisory

Oracle has released its Critical Patch Update for April 2014 to address 104 vulnerabilities across multiple products. This update contains the following security fixes: 2 for Oracle Database Server 20 for Oracle Fusion Middleware 3 for Oracle Hyperion 10 for Oracle Supply Chain Products Suite 8 f...

OpenSSL Heartbeat (Heartbleed) Information Leak

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Auxiliary include Msf::Exploit::Remote::Tcp include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report CIPHERSUITES = 0xc014,...

Microsoft Internet Explorer内存破坏漏洞(CVE-2014-0235)

Bugtraq ID:66646 CVE ID:CVE-2014-0235 Internet Explorer是微软公司推出的一款网页浏览器。 由于一个未明的错误可以导致内存破坏。 0 Microsoft Internet Explorer 6.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 9.x Microsoft Internet Explorer 11.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

Microsoft Releases April 2014 Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Office, Office Services, Web Apps, Windows and Internet Explorer as part of the Microsoft Security Bulletin Summary for April, 2014. These vulnerabilities could allow remote code executions. US-CERT encourages users and...

OpenSSL 'Heartbleed' Vulnerability

A vulnerability in OpenSSL could allow a remote attacker to expose sensitive data, possibly including user authentication credentials and secret keys, through incorrect memory handling in the TLS heartbeat extension. This may allow an attacker to decrypt traffic or perform other attacks. OpenSSL...

OpenSSL Heartbeat (Heartbleed) Client Memory Exposure

This module provides a fake SSL service that is intended to leak memory from client systems as they connect. This module is hardcoded for using the AES-128-CBC-SHA1 cipher. Module Options msf use auxiliary/server/openssl/heartbeatclientmemory msf undefinedheartbeatclientmemory show actions...

Malaysian flight MH370 tragedy abused by Chinese hackers for Espionage attacks

The Mysterious Malaysian Airlines flight MH370, a Boeing 777-200 aircraft that has gone missing by the time it flew from Kuala Lumpur to Beijing. The Malaysian Prime Minister had also confirmed that the Malaysia Airlines plane had crashed in a remote part of the southern Indian Ocean. Cyber...