438 matches found
The Nature of Mass Exploitation Campaigns
We’ve all seen the movies where there’s a dark hooded figure sitting behind a keyboard entering a 3D virtualized representation of the internet. Focusing in on their target, the figure sees various bits of information about that person, from their birth date, to headshot of them stepping out of a...
Patch Tuesday, November 2018 Edition
Microsoft on Tuesday released 16 software updates to fix more than 60 security holes in various flavors of Windows and other Microsoft products. Adobe also has security patches available for Flash Player, Acrobat and Reader users. As per usual, most of the critical flaws -- those that can be...
63 New Flaws (Including 0-Days) Windows Users Need to Patch Now
It's Patch Tuesday once again…time for another round of security updates for the Windows operating system and other Microsoft products. This month Windows users and system administrators need to immediately take care of a total of 63 security vulnerabilities, of which 12 are rated critical, 49...
A new exploit for zero-day vulnerability CVE-2018-8589
Yesterday, Microsoft published its security bulletin, which patches a vulnerability discovered by our technologies. We reported it to Microsoft on October 17, 2018. The company confirmed the vulnerability and assigned it CVE-2018-8589. In October 2018, our Automatic Exploit Prevention AEP systems...
Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online
An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox —a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine guest OS and execute code on the operating...
Hackers Stole 50 Million Facebook Users' Access Tokens Using Zero-Day Flaw
Logged out from your Facebook account automatically? Well you're not alone… Facebook just admitted that an unknown hacker or a group of hackers exploited a zero-day vulnerability in its social media platform that allowed them to steal secret access tokens for more than 50 million accounts...
ex-NSA Hacker Discloses macOS Mojave 10.14 Zero-Day Vulnerability
The same day Apple released its latest macOS Mojave operating system, a security researcher demonstrated a potential way to bypass new privacy implementations in macOS using just a few lines of code and access sensitive user data. On Monday, Apple started rolling out its new macOS Mojave 10.14...
Mac Mojave Zero-Day Allows Malicious Apps to Access Sensitive Info
A zero-day vulnerability in the brand-new version of the Apple Mojave macOS has been uncovered, which would allow an attacker to access private and confidential information by using an unprivileged app. The flaw was found by Patrick Wardle, co-founder of Digita Security and creator of Objective-S...
Researcher Discloses New Zero-Day Affecting All Versions of Windows
A security researcher has publicly disclosed an unpatched zero-day vulnerability in all supported versions of Microsoft Windows operating system including server editions after the company failed to patch a responsibly disclosed bug within the 120-days deadline. Discovered byLucas Leong of the...
Researcher Discloses New Zero-Day Affecting All Versions of Windows
A security researcher has publicly disclosed an unpatched zero-day vulnerability in all supported versions of Microsoft Windows operating system including server editions after the company failed to patch a responsibly disclosed bug within the 120-days deadline. Discovered by Lucas Leong of the...
Bad Actors Sizing Up Systems Via Lightweight Recon Malware
Well-known financial crime gang Cobalt Group and other threat actors have recently shifted tactics to incorporate lightweight modular downloaders that “vet” target machines for their attractiveness before proceeding with a full-fledged attack. The emergence of the AdvisorsBot and Marap malwares, ...
Hackers Publish PoC of Zero-day Vulnerability in Windows on Twitter
By Waqas New Privilege Escalation Bug Identified in Windows OS. Recently a Twitter user, using the handle SandboxEscaper, disclosed that the Microsoft Windows OS has a zero-day vulnerability, which is yet unknown to the company. Tweeting on the microblogging platform, the user stated: "Here is th...
Hacker Discloses Unpatched Windows Zero-Day Vulnerability (With PoC)
A security researcher has publicly disclosed the details of a previously unknown zero-day vulnerability in the Microsoft's Windows operating system that could help a local user or malicious program obtain system privileges on the targeted machine. And guess what? The zero-day flaw has been...
ex-NSA Hacker Discloses macOS High Sierra Zero-Day Vulnerability
Your Mac computer running the Apple's latest High Sierra operating system can be hacked by tweaking just two lines of code, a researcher demonstrated at the Def Con security conference on Sunday. Patrick Wardle, an ex-NSA hacker and now Chief Research Officer of Digita Security, uncovered a...
ex-NSA Hacker Discloses macOS High Sierra Zero-Day Vulnerability
Your Mac computer running the Apple's latest High Sierra operating system can be hacked by tweaking just two lines of code, a researcher demonstrated at the Def Con security conference on Sunday. Patrick Wardle, an ex-NSA hacker and now Chief Research Officer of Digita Security, uncovered a...
Hackers are exploiting a new zero-day flaw in GPON routers
Even after being aware of various active cyber attacks against the GPON Wi-Fi routers, if you haven't yet taken them off the Internet, then be careful—because a new botnet has joined the GPON party, which is exploiting an undisclosed zero-day vulnerability in the wild. Security researchers from...
The King is dead. Long live the King!
In late April 2018, a new zero-day vulnerability for Internet Explorer IE was found using our sandbox; more than two years since the last in the wild example CVE-2016-0189. This particular vulnerability and subsequent exploit are interesting for many reasons. The following article will examine th...
Router vulnerability analysis the sixth bullet: CVE-2018-7445 MikroTik router system buffer overflow vulnerability-vulnerability warning-the black bar safety net
A. Vulnerability overview CVE-2018-7445 MikroTik RouterOS SMB buffer overflow Reference information: https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow Vulnerability firmware version: mikrotik-6.40.6.iso the x86 version Download: https://mikrotik.com/download Mikrotik...
Hackers Exploit 'Telegram Messenger' Zero-Day Flaw to Spread Malware
A zero-day vulnerability has been discovered in the desktop version for end-to-end encrypted Telegram messaging app that was being exploited in the wild in order to spread malware that mines cryptocurrencies such as Monero and ZCash. The Telegram vulnerability was uncovered by security researcher...
Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations
On Jan. 31, KISA KrCERT published an advisory about an Adobe Flash zero-day vulnerability CVE-2018-4878 being exploited in the wild. On Feb. 1, Adobe issued an advisory confirming the vulnerability exists in Adobe Flash Player 28.0.0.137 and earlier versions, and that successful exploitation coul...