Hackers Find Bugs, Extort Ransom and Call it a Public Service

Crooks breaking into enterprise networks are holding data they steal for ransom under the guise they are doing the company a favor by exposing a flaw. The criminal act is described as bug poaching by IBM researchers and is becoming a growing new threat to businesses vulnerable to attacks. Accordi...

Exploit Kits Attacking Adobe Flash Player Zero Day

Update Exploits for the most recent Adobe Flash Player zero-day vulnerability have been integrated into the Angler, Neutrino and Magnitude exploit kits, and are leading compromised computers to different ransomware strains, banking malware, and a credential-stealing Trojan. A French researcher wh...

WordPress Plugin Job Script by Scubez - Remote Code Execution

WordPress Plugin Job Script by Scubez - Remote Code Execution !C:/Python27/python.exe -u JobScript Remote Code Execution Exploit Vendor: Jobscript Product web page: http://www.jobscript.in Affected version: Unknown Summary: JobScript is inbuilt structured website was developed in PHP and MySQL...

Apple iOS/watchOS/tvOS and OS X El Capitan IOAcceleratorFamily Denial of Service Vulnerability

Apple iOS is an operating system on Apple's cell phones. oS X El Capitan is a dedicated operating system developed for Mac computers. watchOS is a smartwatch operating system. A security vulnerability in IOAcceleratorFamily in Apple iOS, watchOS, and OS X El Capitan allows an attacker to exploit...

Windows Zero-Day Vulnerability, CVE-2 0 1 6-0 1 6 7: the attack Payment Card data-vulnerability warning-the black bar safety net

2 0 1 6 years 3 month, there has been a batch of economic motivation to the retail, Foodservice and hospitality industry as the target of the attack, these attacks, the message contains a large number of with embedded macros of the Microsoft Word document, once downloaded it will execute a named...

CVE-2016-4117: Flash Zero-Day Exploited in the Wild

On May 8, 2016, FireEye detected an attack exploiting a previously unknown vulnerability in Adobe Flash Player CVE-2016-4117 and reported the issue to the Adobe Product Security Incident Response Team PSIRT. Adobe released a patch for the vulnerability in APSB16-15 just four days later. Attackers...

CVE-2016-4117: Flash Zero-Day Exploited in the Wild

On May 8, 2016, FireEye detected an attack exploiting a previously unknown vulnerability in Adobe Flash Player CVE-2016-4117 and reported the issue to the Adobe Product Security Incident Response Team PSIRT. Adobe released a patch for the vulnerability in APSB16-15 just four days later. Attackers...

On Zero Days, SAP Vulnerabilities, and FBI vs. Tor

Mike Mimoso and Chris Brook discuss the news of the week, including zero day vulnerabilities–both in Adobe Flash and Windows, a nasty vulnerability in SAP business applications, Mozilla asking FBI to disclose a Tor exploit, and more. Download: ThreatpostNewsWrapMay132016.mp3 Music by Chris Gonsal...

Adobe Emergency Update Patches Flash Zero Day

As promised earlier this week, Adobe today released an updated version of Flash Player that includes a patch for a zero-day vulnerability. Adobe said it is aware of the existence of a public exploit for CVE-2016-4117, but said the flaw has not been publicly attacked. The vulnerability affects Fla...

Motion Filed Asking FBI To Disclose Tor Browser Zero Day

Mozilla on Wednesday filed a motion with the U.S. District Court in Tacoma, Wa., asking the government to disclose a vulnerability it exploited in the Tor Browser and Firefox. The FBI used the zero-day to hack a child pornography site and de-anonymize users visiting the site using the Tor Browser...

Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks

In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and execut...

FireEye Details Microsoft Zero Day Attack on 100 Companies

More than 100 North American companies were attacked by crooks exploiting a Windows zero day vulnerability. The attacks began in early March and involved the zero day vulnerability CVE-2016-0167 reported and partially fixed in April’s Patch Tuesday security bulletins by Microsoft. The zero day wa...

Adobe Patches 95 Vulnerabilities in Acrobat, Reader, Warns of Flash Zero Day

Adobe rolled out security updates for three of its products on Tuesday, including 95 fixes it pushed for Acrobat, Reader, and ColdFusion. Users will have to wait until later this week, however, to patch a critical vulnerability that exists in Flash Player. It may only be a matter of time until th...

Warning — Widely Popular ImageMagick Tool Vulnerable to Remote Code Execution

A serious zero-day vulnerability has been discovered in ImageMagick, a widely popular software tool used by a large number of websites to process user's photos, which could allow hackers to execute malicious code remotely on servers. ImageMagick is an open-source image processing library that let...

Platinum APT Group Abuses Windows Hotpatching

An obscure Windows feature known as hotpatching, missing in the OS since the introduction of Windows 8, is a preferred tool used by a resourced attack group called Platinum that was uncovered by Microsoft. The group has carried out targeted attacks in South and Southeast Asia since at least 2009,...

Adobe Analytics AppMeasurement for Flash Library Patch

Adobe today patched a vulnerability in the Adobe Analytics AppMeasurement for Flash library, which can be added to Flash projects to measure the usage of Flash-based content. The vulnerability is a DOM-based cross-site scripting flaw that can be abused for cookie theft, said researcher Randy...

Google Chrome Security Update 50.0.2662.75

Google on Wednesday pushed its third Chrome update since the beginning of March, patching a pair of high-severity vulnerabilities in the browser. Yesterday’s update brings Chrome to version 50.0.2662.75 and patched 20 vulnerabilities, according to the Google Chrome Releases blog. Eight of the bug...

Latest Flash Zero Day Being Used to Push Ransomware

Exploits for a zero-day vulnerability in Adobe Flash Player are being aggressively distributed in two exploit kits. The zero day, meanwhile, was patched by Adobe in an emergency update released Thursday night. Attackers are using the previously unpatched flaw in the maligned Flash Player to infec...

CVE-2016-1019: A New Flash Exploit Included in Magnitude Exploit Kit

On April 2, security researcher @Kafeine at Proofpoint discovered a change to the Magnitude Exploit Kit. Thanks to their collaboration, we analyzed the sample and discovered that Magnitude EK was exploiting a previously unknown vulnerability in Adobe Flash Player CVE-2016-1019. The in-the-wild...

Apple Mac OS X Zero Day Vulnerability SIP Bypass

System Integrity Protection SIP was implemented in OS X El Capitan and imposes limitations on what actions that Mac computers’ root accounts can take against protected paths of the operating system. Yesterday at the SysCan360 conference in Singapore, a researcher from SentinelOne disclosed detail...