New Facebook-Spread Malware Triggers Credential Theft, Cryptomining

A new malware campaign rapidly spreading via Facebook is infecting victims’ systems to steal their social media credentials and download cryptomining code. The malware, dubbed Nigelthorn by the Radware researchers who first discovered it, is being propagated via socially engineered links on...

Microsoft Patches Two Zero-Day Flaws Under Active Attack

It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...

Microsoft Patches Two Zero-Day Flaws Under Active Attack

It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...

The King is dead. Long live the King!

In late April 2018, a new zero-day vulnerability for Internet Explorer IE was found using our sandbox; more than two years since the last in the wild example CVE-2016-0189. This particular vulnerability and subsequent exploit are interesting for many reasons. The following article will examine th...

WebKitGTK+ Memory Corruption / Code Execution Vulnerability

Exploit for windows platform in category dos / poc ------------------------------------------------------------------------ WebKitGTK+ Security Advisory WSA-2018-0004 ------------------------------------------------------------------------ Date reported : May 07, 2018 Advisory ID : WSA-2018-0004...

Microsoft Patch Tuesday, May 2018 Edition

Microsoft today released a bundle of security updates to fix at least 67 holes in its various Windows operating systems and related software, including one dangerous flaw that Microsoft warns is actively being exploited. Meanwhile, as it usually does on Microsoft's Patch Tuesday -- the second...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 30, 2018

When I was little, I discovered the joy of jumping on the bed. While it was fun to jump on the bed, I wanted to make it more challenging so I started to imitate the ski jumpers I had seen during the 1976 Winter Olympics and jump from my parents’ dresser to the bed. I quickly found out there’s a...

SQLi, XSS zero-days expose Belkin IoT devices, Android smartphones

LONDON, UK – Research director Scott Tenaglia and lead research engineer Joe Tanen detailed the vulnerabilities during their ‘Breaking BHAD: Abusing Belkin Home Automation devices’ talk at the Black Hat Europe conference in London last Friday. The zero-day flaws specifically relate to Belkin’s...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 23, 2018

I was having dinner with friends recently and one of the newer members of the group asked me what I did for a living. I told him that I worked for a cybersecurity company and his reply was, “I don’t need to worry about security – I have a MacBook.” I thought that at any second, Rod Serling was...

Drupalgeddon3: Third Critical Flaw Discovered

For the third time in the last 30 days, Drupal site owners are forced to patch their installations. As the Drupal team noted a few days ago, new versions of the Drupal CMS were released, to patch one more critical RCE vulnerability affecting Drupal 7 and 8 core. The vulnerability, code-named...

PyRoMine Uses NSA Exploit for Monero Mining and Backdoors

The ShadowBrokers’ release of a trove of National Security Agency exploits last year appears to be the gift that keeps on giving, to the hacker community at least: A fresh malware that uses the EternalRomance tool has hit the scene, with Monero-mining as the stated goal. However, more damaging...

Router vulnerability analysis the sixth bullet: CVE-2018-7445 MikroTik router system buffer overflow vulnerability-vulnerability warning-the black bar safety net

A. Vulnerability overview CVE-2018-7445 MikroTik RouterOS SMB buffer overflow Reference information: https://www.coresecurity.com/advisories/mikrotik-routeros-smb-buffer-overflow Vulnerability firmware version: mikrotik-6.40.6.iso the x86 version Download: https://mikrotik.com/download Mikrotik...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 16, 2018

It was a crazy week at this year’s RSA Conference in San Francisco. I always try to get a quick view of the floor to see companies old and new exhibit their wares. Unfortunately, work never sleeps when you attend a conference, and the shortage of seating at this year’s event left many, including...

Jolokia Vulnerabilities - RCE & XSS(CVE-2018-1000130,CVE-2018-1000129)

Recently, during a client engagement, Gotham Digital Science found a couple of zero-day vulnerabilities in the Jolokia service. Jolokia is an open source product that provides an HTTP API interface for JMX Java Management Extensions technology. It contains an API we can use for calling MBeans...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

Z-BlogPHP Cross-Site Request Forgery Vulnerability

Z-BlogPHP is a powerful blogging program. A cross-site request forgery vulnerability exists in pluginedit.php in Z-BlogPHP 1.5.1 Zero. An attacker can exploit this vulnerability to execute arbitrary PHP code...

Exploit kits: Winter 2018 review

In the past, we used to do a blog series on exploit kits where we would periodically check in on the main players in the market. In March 2017, we wrote the Winter 2017 review, before exploit kit activity dropped down to a whisper. We've since discontinued our blog series, for lack of development...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 19, 2018

Back in 2005, there were a number of us in a conference room in Austin, Texas working to determine how we would structure it, what we would name it, and how to deal with the potential backlash that would come after we announced it. What is it? I’m referring to our Zero Day Initiative. It’s been a...

Vulnerabilities are a Cybercriminal’s Best Friend

When discussions around the ways cybercriminals and hackers are able to compromise and penetrate an organization, it regularly leads to the use of exploits and exploit kits. Because all software can contain flaws and bugs, a threat actor only has to either find a new, undisclosed vulnerability...

A week in security (March 12 – March 18)

Last week on Malwarebytes Labs, we took a look at the inner workings of a fileless attack, explored what happened in a zero day ransomware attack aimed at South Koreans, gave you hints and tips for avoiding cold calls, and took a deep dive into the secretive world of GrayKey. Other news The Equif...