TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 30, 2018

When I was little, I discovered the joy of jumping on the bed. While it was fun to jump on the bed, I wanted to make it more challenging so I started to imitate the ski jumpers I had seen during the 1976 Winter Olympics and jump from my parents’ dresser to the bed. I quickly found out there’s a...

SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones

LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 23, 2018

I was having dinner with friends recently and one of the newer members of the group asked me what I did for a living. I told him that I worked for a cybersecurity company and his reply was, “I don’t need to worry about security – I have a MacBook.” I thought that at any second, Rod Serling was...

Drupalgeddon3: Third Critical Flaw Discovered

For the third time in the last 30 days, Drupal site owners are forced to patch their installations. As the Drupal team noted a few days ago, new versions of the Drupal CMS were released, to patch one more critical RCE vulnerability affecting Drupal 7 and 8 core. The vulnerability, code-named...

PyRoMine Uses NSA Exploit for Monero Mining and Backdoors

The ShadowBrokers’ release of a trove of National Security Agency exploits last year appears to be the gift that keeps on giving, to the hacker community at least: A fresh malware that uses the EternalRomance tool has hit the scene, with Monero-mining as the stated goal. However, more damaging...

Router vulnerability analysis the sixth bullet: CVE-2018-7445 MikroTik router system buffer overflow vulnerability-vulnerability warning-the black bar safety net

A. Vulnerability overview CVE-2018-7445 MikroTik RouterOS SMB buffer overflow Reference information: https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow Vulnerability firmware version: mikrotik-6.40.6.iso the x86 version Download: https://mikrotik.com/download Mikrotik...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 16, 2018

It was a crazy week at this year’s RSA Conference in San Francisco. I always try to get a quick view of the floor to see companies old and new exhibit their wares. Unfortunately, work never sleeps when you attend a conference, and the shortage of seating at this year’s event left many, including...

Jolokia Vulnerabilities - RCE & XSS(CVE-2018-1000130,CVE-2018-1000129)

Recently, during a client engagement, Gotham Digital Science found a couple of zero-day vulnerabilities in the Jolokia service. Jolokia is an open source product that provides an HTTP API interface for JMX Java Management Extensions technology. It contains an API we can use for calling MBeans...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

Z-BlogPHP Cross-Site Request Forgery Vulnerability

Z-BlogPHP is a powerful blogging program. A cross-site request forgery vulnerability exists in pluginedit.php in Z-BlogPHP 1.5.1 Zero. An attacker can exploit this vulnerability to execute arbitrary PHP code...

Exploit kits: Winter 2018 review

In the past, we used to do a blog series on exploit kits where we would periodically check in on the main players in the market. In March 2017, we wrote the Winter 2017 review, before exploit kit activity dropped down to a whisper. We've since discontinued our blog series, for lack of development...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 19, 2018

Back in 2005, there were a number of us in a conference room in Austin, Texas working to determine how we would structure it, what we would name it, and how to deal with the potential backlash that would come after we announced it. What is it? I’m referring to our Zero Day Initiative. It’s been a...

Vulnerabilities are a Cybercriminal’s Best Friend

When discussions around the ways cybercriminals and hackers are able to compromise and penetrate an organization, it regularly leads to the use of exploits and exploit kits. Because all software can contain flaws and bugs, a threat actor only has to either find a new, undisclosed vulnerability...

A week in security (March 12 – March 18)

Last week on Malwarebytes Labs, we took a look at the inner workings of a fileless attack, explored what happened in a zero day ransomware attack aimed at South Koreans, gave you hints and tips for avoiding cold calls, and took a deep dive into the secretive world of GrayKey. Other news The Equif...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 12, 2018

This week marked the 11th annual Pwn2Own contest held during the CanSecWest conference in Vancouver and while the contest had fewer entries compared to previous years, it was still an exciting event filled with a little drama. Over the course of two days, the Zero Day Initiative awarded $267,000...

A View of Upcoming Threat Coverage from Pwn2Own 2018

This blog will be updated throughout the competition so keep tracking for the latest updates on upcoming threat coverage! St. Patrick’s Day is coming up later this week, but the contestants at Pwn2Own 2018 will need more than luck on their side. They will need to dive into their expert hacking...

Flash, Windows Users: It’s Time to Patch

Adobe and Microsoft each pushed critical security updates to their products today. Adobe's got a new version of Flash Player available, and Microsoft released 14 updates covering more than 75 vulnerabilities, two of which were publicly disclosed prior to today's patch release. The Microsoft updat...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 5, 2018

Today marks the first day of South by Southwest SXSW here in Austin and if you happen to be in town for the event, Trend Micro will be there! Starting tomorrow, Trend Micro will be exhibiting at the SXSW Job Market in booth 523. The SXSW Job Market is being held on March 10-11, 2018 at the Palmer...

Leaked NSA Dump Also Contains Tools Agency Used to Track Other Hackers

A years ago when the mysterious hacking group 'The Shadow Brokers' dumped a massive trove of sensitive data stolen from the US intelligence agency NSA, everyone started looking for secret hacking tools and zero-day exploits. A group of Hungarian security researchers from CrySyS Lab and Ukatemi ha...

Eaton ELCSoft

CVSS v3 6.3 ATTENTION: Exploitable remotely/low skill level to exploit. Vendor: Eaton Equipment: ELCSoft Vulnerability: Improper Input Validation AFFECTED PRODUCTS ELCSoft is programming software for all Eaton ELC programmable logic controllers. The ELC programmable logic controllers are not...