Iranian Ajax Security Team targets US Defense Industry

The Iranian hacking group, which calls itself the “Ajax Security Team”, was quite famous from last few years for websites defacement attacks, and then suddenly they went into dark since past few months. But that doesn't mean that the group was inactive, rather defacing the websites, the group was...

NSA Reportedly Intercepts US-made Internet Routers to Install Spyware

The US Intelligence Agency, NSA has been reportedly intercepting and accessing routers, servers, and other computer networking hardware to plant data gathering “backdoors” and other spywares before they are exported and delivered to the international customers, reported by the Guardian. Yesterday...

Google Releases Security Update for Chrome

Google has released Chrome 34.0.1847.137 for Windows, Mac, and Linux to address multiple vulnerabilities. Some of these vulnerabilities could potentially allow an attacker to take control of the affected system. US-CERT encourages users and administrators to review the Google Chrome Blog post and...

PointDNS Recovers from Massive DDoS Attack

PointDNS says most of its DNS servers are online again after a massive DDoS attack late last week took down the service provider. A post on the company’s Twitter account on Friday said the provider was adding nameservers and working with network providers to restore service to its customers. Many...

Russian Hacker Charged in Biggest U.S Hacking Case Doesn't Want Extradition to U.S

A Russian Hacker who was arrested in year 2012 by the authorities of the Netherlands and accused for allegedly hacking into the computer networks of more than a dozen major American corporations and stole over 160 million Credit and Debit Card Numbers. Earlier we reported, 33-year-old Russian...

US Navy's Nuclear Reactor System Administrator Arrested on Hacking Charges

The United States charged two men for their involvement in a conspiracy to hack into the computer systems of dozens of government and commercial organizations, including the U.S. Navy and National Geospatial-Intelligence Agency NGA, according to the U.S. Attorney's Office in Tulsa. On Monday, the...

Microsoft Releases Security Update for Internet Explorer Use-After-Free Vulnerability

Microsoft has released out-of-band updates to address a critical use-after-free vulnerability in Internet Explorer versions 6 through 11, including IE versions running on Windows XP. US-CERT recommends that users and administrators review Microsoft Security Bulletin MS14-021 and apply the necessa...

Microsoft Internet Explorer Use-After-Free Vulnerability Guidance

US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer. This vulnerability affects IE versions 6 through 11 and could allow unauthorized remote code execution. US-CERT recommends that users and administrators review Microsoft Security Advisory...

Firmware Update for Apple AirPort Devices

Apple has released firmware update 7.7.3 for AirPort Extreme and AirPort Time Capsule base stations with 802.11ac. The update addresses the OpenSSL "Heartbleed" vulnerability where an attacker may obtain memory contents. US-CERT recommends that users and administrators review Apple Security Updat...

Adobe Releases Security Update for Reader Mobile

Adobe has released a security update to address a vulnerability in Adobe Reader Mobile 11.1.3 and earlier versions for Android. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code via a crafted PDF document. US-CERT recommends that users and administrators...

Oracle Releases April 2014 Security Advisory

Oracle has released its Critical Patch Update for April 2014 to address 104 vulnerabilities across multiple products. This update contains the following security fixes: 2 for Oracle Database Server 20 for Oracle Fusion Middleware 3 for Oracle Hyperion 10 for Oracle Supply Chain Products Suite 8 f...

OpenSSL Heartbeat (Heartbleed) Information Leak

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Auxiliary include Msf::Exploit::Remote::Tcp include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report CIPHERSUITES = 0xc014,...

Microsoft Internet Explorer内存破坏漏洞(CVE-2014-0235)

Bugtraq ID:66646 CVE ID:CVE-2014-0235 Internet Explorer是微软公司推出的一款网页浏览器。 由于一个未明的错误可以导致内存破坏。 0 Microsoft Internet Explorer 6.x Microsoft Internet Explorer 7.x Microsoft Internet Explorer 8.x Microsoft Internet Explorer 9.x Microsoft Internet Explorer 11.x 目前厂商已经发布了升级补丁以修复漏洞，请下载使用：...

OpenSSL 'Heartbleed' Vulnerability

A vulnerability in OpenSSL could allow a remote attacker to expose sensitive data, possibly including user authentication credentials and secret keys, through incorrect memory handling in the TLS heartbeat extension. This may allow an attacker to decrypt traffic or perform other attacks. OpenSSL...

Microsoft Releases April 2014 Security Bulletin

Microsoft has released updates to address vulnerabilities in Microsoft Office, Office Services, Web Apps, Windows and Internet Explorer as part of the Microsoft Security Bulletin Summary for April, 2014. These vulnerabilities could allow remote code executions. US-CERT encourages users and...

OpenSSL Heartbeat (Heartbleed) Client Memory Exposure

This module provides a fake SSL service that is intended to leak memory from client systems as they connect. This module is hardcoded for using the AES-128-CBC-SHA1 cipher. Module Options msf use auxiliary/server/openssl/heartbeatclientmemory msf undefinedheartbeatclientmemory show actions...

Malaysian flight MH370 tragedy abused by Chinese hackers for Espionage attacks

The Mysterious Malaysian Airlines flight MH370, a Boeing 777-200 aircraft that has gone missing by the time it flew from Kuala Lumpur to Beijing. The Malaysian Prime Minister had also confirmed that the Malaysia Airlines plane had crashed in a remote part of the southern Indian Ocean. Cyber...

Microsoft Releases Security Advisory

Microsoft has released a security advisory for Microsoft Word. A vulnerability exists for remote code execution which could allow an attacker to gain user rights by opening a specifically crafted Rich Text Format file. Applying the Microsoft Fix it solution will disable the opening of RTF content...

Exploits for Two-Year-Old PHP Security Vulnerability Found

Close to two years ago, a serious vulnerability in PHP was accidentally disclosed after it was discovered months prior during a hacking contest. A patch was released in relatively short order, and one would assume that given PHP’s prevalence as a web development framework, the fix would have been...

Google Releases Security Updates for Chrome

Google has released security updates to address multiple vulnerabilities in Chrome. Some of these vulnerabilities may lead to memory corruption or arbitrary code execution. Updates available include: Chrome 33.0.1750.154 for Windows. Chrome 33.0.1750.152 for Mac and Linux. Chrome 33.0.1750.152 fo...