Clik here to view.
History theft with CSS Boolean algebra
Up until mid-2010, any rogue website could get a good sense of your browsing habits by specifying a distinctive :visited pseudo-class, rendering thousands of interesting URLs off-screen, and then...
View ArticleClik here to view.
EVERY C99.PHP SHELL IS BACKDOORED (A.K.A. FREE SHELLS FOR EVERYONE!)
Earlier I made a post calling out the wrong people for backdooring the C99.php shell hosted on r57.gen.tr. They look to possibly be only exploiting an already existing vulnerability in the C99 shell....
View ArticleClik here to view.
A peek inside a commercially available Android-based botnet for hire
Relying on the systematic release of DIY (do-it-yourself) mobile malware generating tools, commercial availability of mobile malware releases intersecting with the efficient exploitation of legitimate...
View ArticleClik here to view.
The official website of AskMen is compromised to serve malicious code
Websense® ThreatSeeker® Intelligence Cloud has detected that the official website of AskMen (at www.askmen.com ), a popular free online men's web portal, has been compromised and injected with...
View ArticleClik here to view.
Fire in the (root) hole!
This will, I think, be the first time blogging about something quite so retroactively, but for reasons which should be apparent, I could not blog about this little adventure until now. This is the...
View ArticleClik here to view.
The Citadel and Gameover Campaigns of 5CB682C10440B2EBAF9F28C1FE438468
As the infosec community waits for the researchers involved to present their Zeus Gameover take down spoils at the next big conference; ASERT wanted to profile a threat actor that uses both Citadel, “a...
View ArticleClik here to view.
Havex Hunts for ICS/SCADA Systems
During the past year, we've been keeping a close eye on the Havex malware family and the group behind it. Havex is known to be used in targeted attacks against different industry sectors, and it was...
View ArticleClik here to view.
AUDITING WP-DB-BACKUP WORDPRESS PLUGIN & WHY USING THE DATABASE PASSWORD FOR...
After installing the WordPress plugin “WP-DB-Backup” found at http://wordpress.org/plugins/wp-db-backup/ I saw some insecure looking practices being taken when it came to storing the created backups....
View ArticleClik here to view.
[security fix] GnuPG 1.4.17 released
We are pleased to announce the availability of a new stable GnuPG-1release: Version 1.4.17. This release includes a *security fix* to stopa possible DoS using garbled compressed data packets which can...
View ArticleClik here to view.
Police Story: Hacking Team’s Government Surveillance Malware- thats right,...
In Part 1, we analyze a newly discovered Android implant that we attribute to Hacking Team and highlight the political subtext of the bait content and attack context.In Part 2, we expose the...
View ArticleClik here to view.
Running OS X 10.10 Yosemite’s iTunes in LLDB
With each version of iTunes, Apple tries to prevent people reverse-engineering it, in order to protect some sensitive stuff, involving DRMs, device management, etc.Different levels of protection are...
View ArticleClik here to view.
Lunar CMS 3.3 - CSRF And Stored XSS Vulnerability
<!--Lunar CMS 3.3 CSRF And Stored XSS VulnerabilityVendor: Lunar CMSProduct web page: http://www.lunarcms.comAffected version: 3.3Summary: Lunar CMS is a freely distributable open...
View ArticleClik here to view.
Have you been compromised by Gameover Zeus (aka Zeus GMO)
Check to see if you have been infected with Gameover Zeus (aka Zeus GMO)by clicking on the following link...goz.shadowserver.org/gozcheck/
View ArticleClik here to view.
Turing Test in Reverse: New Sandbox-Evasion Techniques Seek Human Interaction
Last year, we published a paper titled Hot Knives Through Butter, Evading File-Based Sandboxes. In this paper, we explained many sandbox evasion methods–and today’s blog post adds to our growing...
View ArticleClik here to view.
Steganographic Key Leakage Through Payload Metadata
Steganography is the ancient art of invisible communication, where the goal is to hide the very fact that you are trying to hide something. It adds another layer of protection after cryptography,...
View ArticleClik here to view.
HackingTeam 2.0: The Story Goes Mobile
More than a year has passed since the release of our last article on HackingTeam, the Italian company that develops a “legal” spyware tool known as Remote Control System, or short, RCS. In the meantime...
View ArticleClik here to view.
CVE-2014-3868: ZeusCart 4.x Remote SQL Injection Vulnerability
On May 27th our research labs discovered a vulnerability (CVE-2014-3868)in an e-commerce shopping cart application known as "ZeusCart". Thesame day,we reported this vulnerability to mitre.org and the...
View ArticleClik here to view.
Wordpress TimThumb 2.8.13 WebShot Remote Code Execution (0-day)
####################################################################### _ ___ _ _ ____ ____ _ _____# | | / _ \| \ | |/ ___|/ ___| / \|_ _|# | | | | | | \| | | _| | / _ \ |...
View ArticleClik here to view.
R2DR2: ANALYSIS AND EXPLOITATION OF UDP AMPLIFICATION VULNERABILITIES
Since we began our studies in the Master's degree on ICT security at the European University, drew our attention the possibility of doing a project under the guidance of Alejandro Ramos (@aramosf), a...
View ArticleClik here to view.
Pony Loader 2.0 Steals Credentials and Bitcoin Wallets: Source Code for Sale
Pony Loader malware has been around for years. The source code for version 1.9 was leaked on the Internet, giving criminals the opportunity to modify it to their liking. Recently, Damballa’s Threat...
View Article