2013
Research Into BIOS Attacks Underscores Their Danger
The jury is out on BadBIOS, but malware for motherboards and other hardware is both possible and, with the rise of the Internet of Things, likely.
A New Modular Malware Platform Sold On The Underground
Security researcher Dancho Danchev profiled a new commercially modular malware platform recently released on the underground marketplace.
‘Young Romanian Woman’ Car Accident Hoax Spreads on Facebook
A Facebook message calling attention to a Romanian woman who deliberately causes a car accident could be aimed at bringing fraud from the streets to …
Fuzzing for SQL injection with Burp Suite Intruder
This article introduces Burp Suite Intruder and shows how it can be used for SQL injection fuzzing.
Facebook Concerned about their Users
Facebook has warned its users to change their login data to protect their accounts in the light of the recent Adobe breach.
CZ.NIC launches the Good Domain educational campaign
The aim of this ongoing campaign is to familiarise the public with the possibility of connecting their existence in the Internet world with their own…
Gentoo Hardening: Part 2: Introduction to PaX and Grsecurity
We’ve already briefly discussed PaX, but now it’s time to describe it in detail.
IE Zero-Day Vulnerability Exploiting msvcrt.dll
FireEye Labs has discovered an "exploit that leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to…
Command Injection Vulnerability in Vicidal software
Input Validation Error in manager_send.php file.
Search Engines Reconnaissance – The Magic Weapons
Search engines are formidable tools for reconnaissance, Google Hacking is essential knowledge for professionals searching for website vulnerabilities…
Microsoft Patch Tuesday Preview
Looks like next Tuesday will be another "average" patch Tuesday. We are to expect 8 total patches, 3 of which are rated "critical" with the remaining…
Gentoo Hardening Part 1: Introduction To Hardened Profile
In this tutorial, we’ll talk about how to harden a Linux system to make it more secure. We’ll specifically use Gentoo Linux, but the concepts should …
Is A Tsunami Of SAP Attacks Coming?
Last week at RSA Europe, a leading researcher in the security of business critical applications warned that a new wave of SAP attacks could crash dow…
LinkedIn – How To Exploit Social Media For Targeted Attacks
The professional social network LinkedIn is a mine of information for any king of attackers, a Websense post described a typical attack scenario.
Massive Spike in Reconnaissance Using Source Port Zero Traffic: Cisco
According to Cisco’s Craig Williams, this traffic can be an attempt to identify network security devices.
Autumn Internet and Technology Conference To Present Key Projects of the CZ.NIC and CESNET Ass.
Unique routers with advanced security features, electronic aids for children with dyslexia and technology in the arts. Those are just some of the top…
Google Chrome Adds Automatic Malware Blocking For Suspicious Downloads
Google has developed a security feature for Chrome that lets the browser detect and stop malware downloads. The feature has been added to Chrome Cana…
SQL Injection, XSS And URL Redirect Found In Popular Websites
Security Researcher Mohamed Osman Saeed has identified numerous vulnerabilities and reported them all, they include SQL Injection, XSS and URL Redire…
Facebook Credit Generator Scam Claims Thousands of Victims
Over 70,000 users were apparently fooled by a credit generator scam that started circulating on Facebook today.
The CZ.NIC Academy offers a new 3D printing course
The course will give participants the necessary theoretical background and, above all, the opportunity to work with a 3D printer.
Prague, 31 October 2…
Exploit Cocktail (Struts, Java, Windows) Going After 3-Month Old Vulnerabilities
When ISC reader Yin reported earlier today that one of their servers had been hacked via the Apache Struts remote command execution vulnerability (CV…
Serious Vulnerability In Facebook Android App Allows Attackers To Steal Access Token
There are more than 100 Million users who are using Facebook mobile app. Facebook has fixed multiple critical vulnerabilities in its Android based ap…
Layer Seven DDoS Attacks
The tendency of DDoS attacks shows infallibly that perpetrators take aim and move up the OSI network model over time. The relocation of the prime tar…
Validating mojeID accounts at the Moravian Library in Brno
Validation offers positive verification of the identity of individual users of mojeID services, especially by towns and villages or by the operators …
Hackers: Here's How Apple's iMessage Surveillance Flaw Works
Hackers this week showed security conference attendees findings and demonstrations directly contradicting Apple's public claim that it can't read iMe…
Facebook FBStalker Tool Uses Graph Search For Powerful OSINT Analysis
Experts Werrett and Lee demonstrated how to conduct a powerful analysis using FBStalker, a tool created to find a comprehensive amount of data on any…
Fake Social Empires Cheat Exposes over 135,000 Facebook Users to Fraud
More than 135,000 Facebook users were exposed to fraud and [identity theft(http://www.hotforsecurity.com/blog/fake-social-empires-cheat-exposes-over-…
Critical Vulnerability Haunts NetGear ReadyNAS Devices
A critical vulnerability in NETGEAR's ReadyNAS network attached storage devices can allow attackers to gain root access without authentication.
Backdoor Found In Chinese Tenda Wireless Routers, Allows Root Access To Hackers
Last week Craig Heffner, specialized on the embedded device hacking exposed a serious backdoor in number of D-Link routers allows unauthorized backdo…
Facebook Teens More Vulnerable to Stalkers
Teenagers who create a Facebook account are more vulnerable to stalkers and cyber-crooks, as their posts and photos will be publicly available if the…
A vBulletin Exploit Used To Hack Thousands of Websites
Security firm Imperva revealed that more than 35000 websites based on vBulletin CMS have been hacked exploiting a known vulnerability.
On August v…
ASLR Bypass Techniques Are Popular with APT Attacks
Address space layout randomization (ASLR) is a security technique involved in protection from buffer overflow attacks. Many recent APT (Advanced Pers…
Recommendations for securing networks in the event of DoS or DDoS attack
On the basis of an analysis of April’s DDoS attacks in the Czech Republic, the National Cyber Security Centre along with partners from the state, pri…
Android Malvertising Scam Promises Antivirus, Delivers Lifetime Subscription to Ringtones
This scam appeared as a pop-up ad delivered by an advertising SDK that can be found in a lot of legitimate applications. When users download an app c…
Researchers Highlight Security Vulnerabilities In Ship-Tracking System
At the Hack in the Box conference, a group of researchers will demonstrate how attackers could fool a system meant to help ships avoid collisions.
The mojeID Service Surpasses the Quarter Million Mark
MojeID is free of charge for users, who will most often encounter it on the websites of online stores and media or community servers.
Prague, 15 Octob…
Hiding Webshell Backdoor Code in Image Files
First appearances may be deceiving... Web attackers have have been using a method of stashing pieces of their PHP backdoor exploit code within the m…
Charity Scams: Does Your Click Save a Starving Child?
Nowadays, scammers take advantage of the good-hearted by manipulating web search results, blasting them with spam and devising ever-more sophisticate…
A Backdoor Present In Many D-Link Devices Allows To Bypass Authentication
The researcher Craig demonstrated the presence of a backdoor within some DLink routers that allows an attacker to access the administration web inter…
CZ.NIC Co-organises Seminar on a Single Digital Market
This seminar will focus on selected aspects of information technologies within the single EU market, examining draft legislation as well as large pil…
Internet Explorer Zero-Day Times Two
Yet another Microsoft IE bug covered in yesterday's big patch was already being used in the wild in targeted APT-style attacks
Dangerous vBulletin exploit in the wild
vBulletin is a popular proprietary CMS that was recently reported to be vulnerable to an unspecified attack vector. vBulletin is currently positioned…
Fight Graph Search Abuse with Facebook Privacy Settings
In January, Bitdefender warned that Facebook users are vulnerable to Graph Search abuse, as the new feature is also being tested by cyber-criminals. …
Adobe Confirms Source Code Breach, Theft of Customer Data
Adobe Systems confirmed its network had been breached in an attack that compromised information belonging to 2.9 million of its customers.
Web Hosting software WHMCS vulnerable to SQL Injection; emergency security update released
WHMCS, a popular client management, billing and support application for Web hosting providers, released an emergency security update for the 5.2 and …
Identifying Evil An Introduction To Reverse Engineering Malware And Other Software
Bart Hopper presentation on DerbyCon - 3.0 conference.
Research detects dangerous malware hiding in peripherals
A Berlin researcher has demonstrated the capability to detect previously undetectable stealthy malware that resides in graphics and network cards.
Ajax Security Issues
This article is about exploring major security issues we come across during assessment of Ajax based applications.