2013
Massive Android Mobile Botnet Hijacking SMS Data
A mobile botnet called MisoSMS is wreaking havoc on the Android platform, stealing personal SMS messages and exfiltrating them to attackers in China.
CZ.NIC Publications Releases Book for Teenage Internet Users
The seventh book to be published is a Czech translation of Own Your Space by Linda McCarthy, renowned security expert with more than twenty years of …
Weak Security In Most Mobile Banking Apps
Most mobile banking apps -- including those of major financial institutions -- contain configuration and design weaknesses that leave them with weake…
Website traffic report shows an increase of malicious bots activity
Incapula security firm published a new report on the analysis of website traffic evidencing the increment for malicious activities.
ENISA Threat Landscape 2013 Report, The Rise Of Cyber Threats
ENISA releases the ENISA Threat Landscape 2013, it a collection of information on top cyber-threats that have been assessed in the reporting period.
Fraudsters Target Cyber-Stalkers, Bitdefender Finds
“Stalkers may be the next big target for cyber-criminals because they have the characteristics of an easy-to-trick victim: incontrollable curiosity a…
Malware Dons Disguise as Microsoft IIS Module
According to Trustwave, the malware is manually installed by attackers after they have compromised a web server. Known as ISN, the malware is used by…
Facebook Phishing and Malware via Tumblr Redirects
We got a couple reports of pretty convincing Facebook spam redirecting users to malware and a Facebook phishing site.
Microsoft Released Security Patch For CVE-2013-5065 TIFF Zero-Day Vulnerability
Microsoft has released 11 Security Patch this Tuesday, including one for CVE-2013-5065 zero-day vulnerability, recently discovered Local privilege es…
Cisco Prime Network Registrar Cross Site Scripting Vulnerability Patch
Cisco Prime Network Registrar CVE-2013-3394 Cross Site Scripting Vulnerability.
Rogue Android Gaming App That Steals WhatsApp Conversations
Google has recently removed a Rogue Android gaming app called "Balloon Pop 2" from its official Play store that was actually stealing user's private …
Hardware Hacker Demos Zombie Drone Hijacker
The SkyJack drone automatically seeks out and hijacks other nearby Parrot drones. Will this mean trouble for Amazon's planned drone delivery fleet?
Microsoft, Europol, FBI And Partners Decapitated ZeroAccess Botnet
Microsoft Digital Crimes Unit, FBI, Europol and industry partners decapitated the feared ZeroAccess botnet that hijacks search results
Two Million Stolen Facebook, Twitter Login Credentials Found On 'Pony Botnet' Server
Security researchers at Trustwave's SpiderLabs found a Netherlands-based Pony Botnet Controller Server with almost two Million usernames and password…
D-Link Upgrades Its Firmware To Fix Backdoor Presence
D-Link company has recently released a new version of firmware to fix backdoor vulnerability in various network device models.
ENISA Releases Guide for Defending Against Attacks on Industrial Control Systems
The European Network and Information Security Agency (ENISA), has released a new guide designed to help organizations better mitigate attacks against…
VMware Patches Privilege Escalation Vulnerability Affecting Popular Products
Virtualization giant VMware released a series of patches on Tuesday to address a vulnerability that affects several of its popular software products …
Google Nexus Phone Vulnerable To SMS-Based DOS Attack
Nexus Smartphones are vulnerable to SMS-based DOS attack, where an attacker can force it to restart, freeze, or lose network connection by sending a …
Linux Worm Targets "Internet of things"
Malware hunters have stumbled upon a new Linux worm squirming through an old PHP vulnerability to infect hidden, Internet-enabled devices.
New Member of the CZ.NIC Association
The company TERMS a. s. is new member of the CZ.NIC Association as of 1 December 2013. TERMS a. s. is members of the Chamber of Registrars. The Assoc…
New Rules And Business Terms To Take Effect On 1 January 2014
New Registration Rules, Alternative Dispute Resolution Rules and Business Terms will take effect on the first day of the New Year. The new versions o…
CZ.NIC Laboratories develop unique aid for dyslexic children
The first version of the application contains three separate games for distinguishing sounds, spatial orientation and working memory. Tablexia was cr…
Ruby on Rails CookieStore Flaw Exposes Thousand of Websites
A security issue inside cookie-based storage mechanism of Ruby on Rails could expose thousand websites to cyber attacks.
MS Windows Local Privilege Escalation Zero-Day in The Wild
FireEye Labs has identified a new Windows local privilege escalation vulnerability in the wild. The vulnerability cannot be used for remote code exec…
New Crimekit Atrax Exploits Tor, Mines Bitcoin and Much More
Atrax, yet another commercial crimekit on the black market, a malware able to exploit Tor and that implements numerous features including Bitcoin min…
CZ.NIC Reviews Registry Data and Offers Higher Security
Everyone who takes part in the campaign and verifies their contact details before 31 December 2013 will receive a complimentary 8GB flash drive. Ever…
Datovka for Android and iDatovka Apps Selected Best Czech eGovernment Projects
Both applications were created at the CZ.NIC Laboratories, the research and development centre of the CZ.NIC Association. The contest, which was held…
SIM Card Forensics: An Introduction
The SIM (subscriber identity module) is a fundamental component of cellular phones.
Most iOS Apps Are Vulnerable to Hackers, Study Shows
Some 90 percent of iOS mobile applications have at least one security vulnerability, according to HP research. The company’s enterprise security team…
Fake Donation Requests for Victims of the Typhoon in Philippines
Would you like to help victims of the recent typhoon that devastated the Philippines? Well, don’t do it via e-mails or directly to people who may be …
Fake AV Uses Stolen Digital Certificate to Evade Detection
Malware creators, who first started pumping out fake antivirus solutions in 2008, are now taking them to the next level by tinkering with user trust.
What The Carna Botnet Also Found
Researcher at Black Hat Brazil to present new data and analysis of the controversial Internet Census project.
The Security Impact of HTTP Caching Headers
Earlier this week, an update for Media-Wiki fixed a bug in how it used caching headers. The headers allowed authenticated content to be cached, which…
vBulletin Forum Hacked With Zero Day Vulnerability, Caused Macrumors Forum Data Breach
Last Tuesday, Popular Mac news website MacRumors's user forums was hacked and forum database has been compromised including the username, email and p…
Finding SQL Injection Attacks In Unexpected Quarters
SQL injection attacks have been plaguing the Web for so long that it may seem as if they've grown ho-hum.
Linux Backdoor Fokirtor Implements Covert Communication Protocol
In May sophisticated attackers breached a large Internet hosting provider and gained access to internal administrative systems using a singular Linux…
The Company Seznam.cz Has Establihed Own CSIRT Team
Seznam.cz has now his own CSIRT team SEZNAM.CZ-CSIRT. SEZNAM.CZ-CSIRT is already listed in Trusted Introducer CSIRT teams list. Hopefully, this activ…
Research Into BIOS Attacks Underscores Their Danger
The jury is out on BadBIOS, but malware for motherboards and other hardware is both possible and, with the rise of the Internet of Things, likely.
A New Modular Malware Platform Sold On The Underground
Security researcher Dancho Danchev profiled a new commercially modular malware platform recently released on the underground marketplace.
‘Young Romanian Woman’ Car Accident Hoax Spreads on Facebook
A Facebook message calling attention to a Romanian woman who deliberately causes a car accident could be aimed at bringing fraud from the streets to …
Fuzzing for SQL injection with Burp Suite Intruder
This article introduces Burp Suite Intruder and shows how it can be used for SQL injection fuzzing.
Facebook Concerned about their Users
Facebook has warned its users to change their login data to protect their accounts in the light of the recent Adobe breach.
CZ.NIC launches the Good Domain educational campaign
The aim of this ongoing campaign is to familiarise the public with the possibility of connecting their existence in the Internet world with their own…
Gentoo Hardening: Part 2: Introduction to PaX and Grsecurity
We’ve already briefly discussed PaX, but now it’s time to describe it in detail.
IE Zero-Day Vulnerability Exploiting msvcrt.dll
FireEye Labs has discovered an "exploit that leverages a new information leakage vulnerability and an IE out-of-bounds memory access vulnerability to…
Command Injection Vulnerability in Vicidal software
Input Validation Error in manager_send.php file.
Search Engines Reconnaissance – The Magic Weapons
Search engines are formidable tools for reconnaissance, Google Hacking is essential knowledge for professionals searching for website vulnerabilities…
Microsoft Patch Tuesday Preview
Looks like next Tuesday will be another "average" patch Tuesday. We are to expect 8 total patches, 3 of which are rated "critical" with the remaining…
Gentoo Hardening Part 1: Introduction To Hardened Profile
In this tutorial, we’ll talk about how to harden a Linux system to make it more secure. We’ll specifically use Gentoo Linux, but the concepts should …
Is A Tsunami Of SAP Attacks Coming?
Last week at RSA Europe, a leading researcher in the security of business critical applications warned that a new wave of SAP attacks could crash dow…