Recently-Patched Adobe ColdFusion Flaw Exploited By APT

An Adobe ColdFusion vulnerability, patched two months ago, was being exploited in the wild by a China-linked APT group, researchers found. The vulnerability, CVE-2018-15961, is a critical unrestricted file upload bug that could also lead to arbitrary code-execution, researchers at Volexity, who...

In County Crippled by Hurricane, Water Utility Targeted in Ransomware Attack

A “critical water utility” has been targeted in a recent ransomware attack, significantly impeding its ability to provide service in the week after Hurricane Florence hit the East Coast of the U.S. The Onslow Water and Sewer Authority ONWASA said in a Monday release that a “sophisticated ransomwa...

Four Critical Flaws Patched in Adobe Digital Edition

Adobe on Tuesday issued patches for 16 vulnerabilities spanning several of its products. The most serious of those flaws, four critical glitches in Adobe Digital Edition, could enable arbitrary code-execution. Adobe Digital Editions is an reader software program used for acquiring, managing and...

Google Patches Critical Vulnerabilities in Android OS

Google patched six critical remote code execution flaws in its Android operating system as part of its October Android Security Bulletin. Four of those remote code execution flaws are tied to Android’s Media framework and impact a wide range of Android devices including Google’s Pixel and Nexus...

Intel Halts Spectre Fixes On Older Chips, Citing Limited Ecosystem Support

Intel has halted patches for an array of older chips that would protect them against the Spectre vulnerability, according to a recent microcode update. The microcode update shows that its older products – including Wolfdale, Bloomfield, Clarksfield, Gulftown, Harpertown, Jasper Forest, SoFIA 3GR,...

Apple Announces Emergency Patch to Fix High Sierra Login Bug

Apple said on Wednesday that it will rush an emergency patch to users that fixes an embarrassing login bug in its High Sierra operating system. The patch is expected to be pushed out by Apple sometime Wednesday, according to a company spokesperson. The serious High Sierra login bug surfaced...

Patched Flash Player Sandbox Escape Leaked Windows Credentials

One of the patches included in Tuesday’s Adobe Flash Player update was a do-over after the researcher who privately reported the problem earlier this year discovered the original patch incompletely resolved the issue. Dutch researcher Bjorn Ruytenberg disclosed details after Adobe updated the...

Subtitle Hack Leaves 200 Million Vulnerable to Remote Code Execution

A proof of concept attack using malicious video subtitle files reveals how adversaries can execute remote code on PCs, Smart TVs and mobile devices using popular video players and services such as VLC Media Player, Kodi, Stremio and Popcorn Time. “This is a brand new attack vector. We haven’t see...

Unpatched WordPress Password Reset Vulnerability Lingers

A zero-day vulnerability exists in WordPress Core that in some instances could allow an attacker to reset a user’s password and gain access to their account. Researcher Dawid Golunski of Legal Hackers disclosed the vulnerability on Wednesday via his new ExploitBox service. All versions of...

High Severity BIND Vulnerability Can Lead to A Crash

The Internet Systems Consortium patched the BIND domain name system this week, addressing a remotely exploitable vulnerability it considers high severity and said could lead to a crash. The issue affects servers that use both the DNS64 and RPZ function simultaneously. DNS64 is a mechanism for...

January 2017 Adobe Flash, Reader, Acrobat Security Patches

Adobe today released its first patches of the year, a familiar refrain of Flash Player and Reader fixes, none of which are under attack. The Flash update addresses 13 vulnerabilities, all but one of which trigger remote code execution attacks. Meanwhile, 29 bugs were patched in Reader and Acrobat...

Google Reveals Windows Kernel Zero Day Under Attack

A Windows zero-day vulnerability is being used in an unknown number of attacks, Google disclosed today, 10 days after it privately reported the issue to Microsoft. Google’s disclosure follows its internal policy, which states that companies should fix or publicly report flaws that are under attac...

St. Jude Faces New Claim Heart Devices are Hackable

St. Jude Medical is facing fresh allegations its heart implant devices are vulnerable to cyberattacks. The claims were introduced by the defense as part of St. Jude’s defamation lawsuit against short seller Muddy Waters and security firm MedSec. In a legal filing submitted Monday, experts hired b...

Adobe Emergency Update Patches Flash Zero Day

As promised earlier this week, Adobe today released an updated version of Flash Player that includes a patch for a zero-day vulnerability. Adobe said it is aware of the existence of a public exploit for CVE-2016-4117, but said the flaw has not been publicly attacked. The vulnerability affects Fla...

Latest Flash Zero Day Being Used to Push Ransomware

Exploits for a zero-day vulnerability in Adobe Flash Player are being aggressively distributed in two exploit kits. The zero day, meanwhile, was patched by Adobe in an emergency update released Thursday night. Attackers are using the previously unpatched flaw in the maligned Flash Player to infec...

Google Fixes Sandbox Escape in Chrome

Google has patched a high-risk vulnerability in its Chrome browser that allows an attacker to escape the Chrome sandbox. That vulnerability is one of 37 bugs fixed in version 43 of Chrome. Six of those flaws are rated as high risks and Google paid out more than $38,000 in rewards to researchers w...

Microsoft Brings Perfect Forward Secrecy to Windows

Microsoft yesterday added four cryptographic cipher suites to its default priority ordering list in Windows, a move that brings Perfect Forward Secrecy to the operating system. Update 3042058 is available for now only on the Microsoft Download Center, affording users the opportunity to test the...

PHP 5.6.5 Released With Several Security Fixes

Several new versions of PHP have been released, fixing a number of security vulnerabilities and other bugs in the popular scripting language. PHP 5.6.5 is the newest version of the language, and it has patches for a handful of vulnerabilities, including a use-after-free flaw that could lead to...

Edward Snowden Effect on Privacy Attitudes

Serious concessions have been made about privacy post-Snowden, in particular about how personal information is processed and consumed online. Results from a survey conducted by the Pew Research Center of Washington, D.C., show that the Snowden leaks have raised consumers’ consciousness about not...

Samsung Insists Find My Mobile Service Safe

Samsung this week tried to quell recent reports that its Find My Mobile service is vulnerable to hacking, firing back at NIST National Institute of Standards and Technology who warned last month that the feature could be exploited. In a blog post on the company’s global blog Tuesday, Samsung...

Google Patches Four Pwn2Own Bugs in Chrome 33

Now that the dust has settled after the Pwn2Own contest, the browser manufacturers are beginning to roll out patches for the vulnerabilities exploited by contestants. Google on Monday released fixes for a number of bugs in Chrome discovered and exploited during Pwn2Own, releasing new versions of...

Apache Upgrade Repairs Struts, Fixes Two Vulnerabilities

Developers behind the Apache Struts framework have released an update that fixes two vulnerabilities. Creators of the open-source web application framework are encouraging users to upgrade to Struts 2.3.15.2 immediately. One of the fixes addresses an issue CVE-2013-4316 in the Dynamic Method...

Another Java 6 Vulnerability Found in the Wild

Unless you have an Oracle product that requires Java 6 or are paying for support for that version of the platform, you’d seen the last publicly available updates as of February. That doesn’t mean attackers have pushed back from targeting Java 6, and that certainly doesn’t mean that organizations...

Attackers Target Older Java Bugs

It’s no secret that Java has moved to the top of the target list for many attackers. It has all the ingredients they love: ubiquity, cross-platform support and, best of all, lots of vulnerabilities. Malware targeting Java flaws has become a major problem, and new statistics show that this epidemi...

Watering Hole Attack Hits US Department of Labor Website

The United States Department of Labor website is the latest high-profile government site to fall victim to a watering hole attack. Researchers at a number of security companies reported today that the site was hosting malware and redirecting visitors to a site hosting the Poison Ivy remote access...

Exploit Code, Metasploit Module Out for Ruby on Rails Flaws

Just two days after the disclosure of a string of serious vulnerabilities in Ruby on Rails, researchers have released proof-of-concept exploit code for a couple of the flaws and the team at Metasploit have released a module for the penetration testing framework that exploit one of the bugs, as...

Blackhole Exploit Kit's Dominance On Infected Hosts Could Push Rivals To the Cloud

The Blackhole exploit kit has a near monopoly on infected Web pages, according to Web security firm M86’s latest Security Labs Report, issued today. PDF The bi-annual report, which covers the last half of 2011, July to December, describe Blackhole as the source of a whopping 95 percent of all the...

Adobe Plans Critical Security Updates for Reader, Acrobat Next Week

Adobe said on Friday that it will issue critical fixes for its popular Reader and Acrobat products on Tuesday, January 10. The company said it is planning to release updates for Adobe Reader and Acrobat versions X and earlier for both the Windows and Macintosh platforms to fix a slew of critical...

Google Fixes Seven Flaws in New Chrome 14 Release

Google has fixed seven security vulnerabilities in its Chrome browser with a new release on Tuesday. Six of the bugs fixed in Chrome are rated high, with just one listed as critical. The company paid out $10,000 in bounties for the bugs it fixed in this release. In addition to the security fixes,...

Cryptome Outs Identities of Hackers Behind Breach

Less than a week after the Cryptome.org archive was hacked and defaced, the site has posted the names, addresses and phone numbers of two individuals it accuses of being involved in the attack. In an update on Friday, Cryptome founder John Young posted contact information for three individuals he...

Adobe to Release Flash Patch June 10

Adobe said on Monday that it will have a patch available for the newly discovered critical vulnerability in Flash ready by June 10 for most platforms. The patches for Adobe Reader and Acrobat, which also are affected by the flaw, won’t be released until June 29. The new flaw was discovered late...

Adobe Patches Critical Illustrator Security Holes

Adobe has released a critical patch to cover two serious security vulnerabilities in the Adobe Illustrator CS3 and CS4 products. The vulnerabilities could lead to arbitrary code execution. Affected software includes Adobe Illustrator CS4 14.0.0 and Adobe Illustrator CS3 13.0.3 and earlier version...

'High Risk' Flaw Fixed in Google Chrome

Google has pushed out a new version of its Chrome browser to fix a high-severity security hole that could lead to malicious code execution attacks. The vulnerability could be exploited to run arbitrary code within the Google Chrome sandbox, the company said in an advisory. The raw details: The v8...

SMB2 Exploit Fitted into Metasploit; Attacks Likely

Fully functional exploit code for the still unpatched Windows SMB v2 vulnerability has been released to the public domain via the freely available Metasploit point-and-click attack tool, raising the likelihood for remote in-the-wild code execution attacks. The exploit, created and released by...

Experts call for better measurement of security

If there’s one key message coming through all of the noise at the RSA Conference this week it’s the fact that there’s a pressing need for more data. Data on attacks, data on vulnerabilities, data on data breaches, data on software security, data on everything having to do with security. The...

Magecart Serves Up Card Skimmers on Restaurant-Ordering Systems

Magecart campaigns have been skimming payment-card credentials of unsuspecting customers using three online restaurant-ordering systems, affecting about 300 restaurants that use the services and compromising tens of thousands of cards so far, researchers have found. Two separate ongoing Magecart...

Google Boots Multiple Malware-laced Android Apps from Marketplace

Google has removed eight apps from its Google Play store that were propagating a new variant of the Joker spyware, but not before they already had garnered more than 3 million downloads. French security researcher Maxime Ingrao of cybersecurity firm Evina discovered a malware that he dubbed...

Sneaky New Orbit Malware Backdoors Linux Devices

A sneaky malware for Linux is backdooring devices to steal data and can affect all the processes running on a particular machine, researchers have found. The malware, dubbed Orbit, is unlike other Linux threats in that it steals information from different commands and utilities and then stores th...

Facebook Messenger Scam Duped Millions

For months now, millions of Facebook users have been duped by the same phishing scam that cons users into handing over their account credentials. According to a report outlining the phishing campaign, the scam is still active and continues to push victims to a fake Facebook login page where victi...

Firms Push for CVE-Like Cloud Bug System

Big gaps exist in the 22-year-old Common Vulnerability and Exposures CVE system that do not address dangerous flaws in cloud services that drive millions of apps and backend services. Too often, cloud providers needlessly expose customers to risk by not sharing the details of bugs discovered on...

New GootLoader Campaign Targets Accounting, Law Firms

Once prolific spreaders of REvil ransomware, the GootLoader malware gang has pivoted to actively targeting employees of law and accounting firms with malicious downloads. The Threat Response Unit from eSentire issued an alert about having over the past three weeks observed GootLoader attacks on...

Researchers Flag 300K Banking Trojan Infections from Google Play in 4 Months

Overcoming Google Play app restrictions, attackers have successfully racked up more than 300,000 banking trojan installations over just the past four months in the official Android app marketplace. Researchers from Threat Fabric reported that these threat groups have honed their ability to use...

12 New Flaws Used in Ransomware Attacks in Q3

A dozen new vulnerabilities were used in ransomware attacks this quarter, bringing the total number of bugs associated with ransomware to 278. That’s a 4.5 percent increase over Q2, according to researchers. Five of the newbies can be used to achieve remote code execution RCE, while two can be us...

Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers

Vulnerabilities in the Brizy Page Builder plugin for WordPress sites could be chained together to allow attackers to completely take over a website, according to researchers. Brizy or Brizy – Page Builder has been installed on more than 90,000 sites. It’s billed as an intuitive website builder fo...

Credential Spear-Phishing Uses Spoofed Zix Encrypted Email

Armorblox researchers have spotted an ongoing credential-phishing attack that spoofs an encrypted Zix email – one coming, weirdly enough, from what looks like a legitimate domain associated with the Baptist religion. At least, the threat actor is sending the phishing attack from...

Netgear SOHO Security Bug Allows RCE, Corporate Attacks

A high-severity security bug affecting several Netgear small office/home office SOHO routers could allow remote code execution RCE via a man-in-the-middle MiTM attack. The bug CVE-2021-40847 exists in a third-party component that Netgear includes in its firmware, called Circle – it handles the...

Poly Network Recoups $610M Stolen from DeFi Platform

A threat actor called “Mr. White Hat” has returned the $610 million they stole from the decentralized finance platform Poly Network. The breached company did everything from threaten to sic law enforcement on the attacker on up to its ultimate offer: the position of chief security officer in...

Memory Bugs in BlackBerry’s QNX Embedded OS Open Devices to Attacks

The potential danger from a raft of memory-allocation bugs discovered by Microsoft in April has now spread to older versions of multiple BlackBerry QNX products. The Cybersecurity Infrastructure and Security Agency CISA and BlackBerry warned in separate alerts Tuesday that threat actors can take...

NSA Watchdog Will Review Tucker Carlson Spy Claims

The National Security Agency’s Inspector General Robert Storch has announced a review of whether the agency illegally conducted cyber-espionage and collected the electronic communications of Fox News opinion-show host Tucker Carlson, who has accused the NSA of trying to capture embarrassing...

Fuzz Off: How to Shake Up Code to Get It Right – Podcast

LAS VEGAS – In 2014, two teams of security researchers independently started fuzz testing OpenSSL. Within days, the advanced black-box software technique led to an exploitable vulnerability in OpenSSL: namely, the Heartbleed vulnerability. What is fuzzing? That’s what the FuzzCon event is all...