2015
WPScanner: Automated Security Testing Tool for WordPress
Most of the big companies hire security analysts who keep on finding vulnerabilities and patch them before hackers get in. But what about users who h…
Act on cybersecurity comes into effect
Act on cybersecurity comes into effect on January 1st 2015. National CERT that is operated by CZ.NIC association is according to the law receiving re…
2014
First Time Ever Apple Automatically Pushes Security Patch for Mac OS
First time ever in the History, Apple Inc. has pushed out an automatic security update for Macintosh OS X computers to address a critical security is…
Stalkers, Nude Photos and Beheadings: Top Facebook Scams and Malware Attacks in 2014
Millions of people fell for Facebook scams in 2014. They lost money, reputation and even their jobs after simply clicking on the wrong social media l…
Tor Warns of Possible Attempts to Disable Anonymity Network
The Tor Project has learned that there may be an attempt to incapacitate our network in the next few days through the seizure of specialized servers …
Critical #NTP Vulnerability in ntpd prior to 4.2.8
The Google security team discovered several vulnerabilities in current NTP implementations, one of which can lead to arbitrary code execution. NTP se…
12 Million Home Routers Vulnerable to Takeover
More than 12 million devices running an embedded webserver called RomPager are vulnerable to a simple attack that could give a hacker man-in-the-midd…
ICANN Targeted in Spear Phishing Attack
ICANN is investigating a recent intrusion into our systems. We believe a "spear phishing" attack was initiated in late November 2014. It involved ema…
CSIRT.CZ presented its new website
The national security team CSIRT.CZ launched a new version of its website today. Our goal was to modify the website so that it is prepared for Januar…
Fixed a critical flaw in Blogger that allows to write posts on any blog
A security expert discovered a critical CSRF vulnerability in Blogger.com that allows an attacker to write posts in any blog hosted on the popular pl…
Worm Uses ShellShock to Infect QNAP Network Storage Systems
Researchers have uncovered a worm that's designed to plant backdoors on QNAP network-attached storage (NAS) devices. The malware is distributed throu…
The CZ.NIC Publications releases a book on LibreOffice Writer
This is the 9th publication issued as a part of the CZ.NIC Publications project. Its author is a well-known promoter of open source solutions, Vlasti…
SoakSoak Malware Compromises 100,000+ WordPress Websites
This Sunday has started with a bang. Google has blacklisted over 11,000 domains with this latest malware campaign from SoakSoak.ru. Our analysis is s…
Buffer Overflow Vulnerability Found in FreeBSD
Researchers at threat intelligence company Norse have identified a serious vulnerability in FreeBSD, the popular Unix-like operating system that's us…
Red October Cyber Spy Op Goes Mobile via Spear-Phishing
A sophisticated cyber-espionage campaign believed to be the continuation of the Red October operation has been identified to target specific users of…
Stolen Sony certificates used to digitally sign Destover Malware
Security experts at Kaspersky Lab Đhave detected a strain of Destover Malware that has been digitally signed with the certificates stolen during Sony…
POODLE SSL flaw is threatening also TLS Security Protocol
Researchers at Qualys revealed that POODLE is likely to hit some of the most popular websites because the flaw also affects implementations of newer …
Detected the first samples of Penquin Turla for Linux systems
Security Experts at Kaspersky have discovered a new variant of Turla malware which was designed to hit Linux systems and for this reason it was calle…
Wearable Plain-Text Communication Exposed Through Brute-Force, Bitdefender Finds
Everything from SMS messages to Facebook or Google Hangouts chats are constantly being forwarded to your smartwatch. So all this communication should…
Hackers Grab Yahoo Credentials through Mail Activity Reports Campaign
Yahoo users are being targeted by a new phishing campaign that helps hackers grab their credentials and hijack accounts. Bitdefender was already bloc…
Keurig 2.0 Genuine K-Cup Spoofing Vulnerability
Keurig 2.0 Coffee Maker contains a vulnerability in which the authenticity of coffee pods, known as K-Cups, uses weak verification methods, which are…
Hacker Lexicon: What Is an Air Gap?
How do you remotely hack a computer that is not connected to the internet? Most of the time you can’t, which is why so-called air-gapped computers ar…
Kaspersky exposes SONY-CRIPPLING malware DETAILS
Kaspersky bod Kurt Baumgartner has released more details on the Sony-plundering malware and links it to attacks on Saudi Aramco and South Korea.
Home Wi-Fi security is as bad as PC security in the 90s
Nearly three out of four internet-connected households in the UK are at risk of getting attacked through their wireless router, according to a recent…
Lizard Squad launches DDoS attack also on PlayStation network
Lizard Squad claims to have hacked also Sony PlayStation Network that suffered a DDoS attack.
Google App Engine affected by more than 30 vulnerabilities
Security researchers at Security Explorations have found more than 30 vulnerabilities in the Google App Engine that allow code execution and sandbox …
What Is End-to-End Encryption? Why Should You Care
It seems everyone is into end-to-end encryption these days. WhatsApp, Google or Dropbox. But what exactly is it? More than a cool catch phrase of …
SpoofedMe attacks exploit popular websites social login flaws
The experts at IBM have found several problems in implementation of the social login authentication of several identity providers.
VMware Fixes Several Vulnerabilities in vSphere Platform
VMware has released software updates to address a series of vulnerabilities affecting the company's popular vSphere virtualization platform.
Security Advisory – High Severity – WordPress Download Manager
If you’re using the popular WP Download Manager plugin (around 850,000 downloads), you should update right away.
Avoiding Mod Security False Positives with White-listing
In this article we will discuss different types of techniques for writing the white-listing rules for Mod Security.
How Could Hacker Grinch Steal Your Christmas: Five Security Scenarios to Avoid
We hate to sound gloomy before the holidays, but Christmas not only brings joy and presents. It comes with increasing cyber-crime activity as well, a…
Malware Found Pre-loaded on Phones Sold in Asia, Africa: Research
Researchers at mobile security firm Lookout say they have found malware pre-loaded on mobile devices being sold in Asia and Africa.
Microsoft Readies Seven Security Bulletins for Patch Tuesday
Microsoft is planning to close out the year with seven security bulletins next week for Patch Tuesday.
Three of the seven bulletins are rated 'critic…
A Physical Security Policy Can Save Your Company Thousands of Dollars
Investments in cybersecurity and physical security are proportionally connected to your organization’s improved financial picture for a long-term per…
Google Can Now Tell You’re Not a Robot With Just One Click
On Wednesday, Google announced that many of its “Captchas”—the squiggled text tests designed to weed out automated spambots—will be reduced to nothin…
Hacking PayPal Account with a single exploit
An Egyptian hacker demonstrated that using a single exploit is possible to take control of any PayPal account due to the presence of a series of flaw…
New "LusyPOS" Malware Uses Tor For C&C Communications
A sample of a new piece of malware designed to target point-of-sale (PoS) systems was submitted to VirusTotal a few days ago, according to researcher…
OpenVPN plugs DoS hole
OpenVPN has patched a denial-of-service vulnerability which authenticated users could trigger by sending malicious packets.
Firefox releases version 34 with SSLv3 fixes
At the same time, Firefox has disabled SSLv3 support. Google made a similar move when it released Chrome 39 in October. This comes after Google disco…
Crashing WhatsApp by sending a specially crafted message
Indian researchers have discovered a flaw in WhatsApp that allows anyone to remotely crash the popular mobile app by sending a specially crafted mess…
Cybercriminals Testing New PoS Malware 'Poslogr'
Researchers at Trend Micro have come across a sample of a new point-of-sale (PoS) malware that appears to be under development.
XSS Vulnerability Found in Alcatel-Lucent Carrier-Grade Switches
A reflected cross-site scripting (XSS) vulnerability has been identified in the management interface of the Alcatel-Lucent 1830 Photonic Service Swit…
Acrobat Reader Windows sandbox is affected by critical flaw
A researcher at Google discovered a critical flaw in Windows Acrobat Reader 11 Sandbox that could be exploited to access a system and gain higher pri…
Android Application hacking with Insecure Bank Part 1
In this article series, we will learn at the various concepts of Android application security while exploiting a vulnerable app InsecureBankv2. We wi…
Bitcoin anonymity, hackers can deanonymize users from their transactions
A group of researchers at the University of Luxembourg have demonstrated that is it possible to de-anonymize Bitcoin users from its transactions.
The Twitter App Graph feature will track users mobile apps for commercial purposes
Twitter announced app graph, it will now track every mobile app its users have Installed on their smartphones and tables. Privacy advocates arise.
PoS Malware Hits Vending Machines and Electronic Kiosks
A new sophisticated backdoor dubbed d4re|dev1| is infecting ticket vending machines used by mass transportation systems and electronic kiosks found i…
Adobe Fixes Highly Critical Vulnerability in Flash Player
Adobe has issued a fix for critical vulnerability (CVE-2014-8439) found in Adobe Flash Player software, according to Adobe’s APSB14-26 security bulle…
Google Launches New Security Dashboard
Google launched a “Devices and Activity Dashboard” to offer users more control over which devices connect to their Google accounts and prevent unauth…