2013
LinkedIn – How To Exploit Social Media For Targeted Attacks
The professional social network LinkedIn is a mine of information for any king of attackers, a Websense post described a typical attack scenario.
Massive Spike in Reconnaissance Using Source Port Zero Traffic: Cisco
According to Cisco’s Craig Williams, this traffic can be an attempt to identify network security devices.
Autumn Internet and Technology Conference To Present Key Projects of the CZ.NIC and CESNET Ass.
Unique routers with advanced security features, electronic aids for children with dyslexia and technology in the arts. Those are just some of the top…
Google Chrome Adds Automatic Malware Blocking For Suspicious Downloads
Google has developed a security feature for Chrome that lets the browser detect and stop malware downloads. The feature has been added to Chrome Cana…
SQL Injection, XSS And URL Redirect Found In Popular Websites
Security Researcher Mohamed Osman Saeed has identified numerous vulnerabilities and reported them all, they include SQL Injection, XSS and URL Redire…
Facebook Credit Generator Scam Claims Thousands of Victims
Over 70,000 users were apparently fooled by a credit generator scam that started circulating on Facebook today.
The CZ.NIC Academy offers a new 3D printing course
The course will give participants the necessary theoretical background and, above all, the opportunity to work with a 3D printer.
Prague, 31 October 2…
Exploit Cocktail (Struts, Java, Windows) Going After 3-Month Old Vulnerabilities
When ISC reader Yin reported earlier today that one of their servers had been hacked via the Apache Struts remote command execution vulnerability (CV…
Serious Vulnerability In Facebook Android App Allows Attackers To Steal Access Token
There are more than 100 Million users who are using Facebook mobile app. Facebook has fixed multiple critical vulnerabilities in its Android based ap…
Layer Seven DDoS Attacks
The tendency of DDoS attacks shows infallibly that perpetrators take aim and move up the OSI network model over time. The relocation of the prime tar…
Validating mojeID accounts at the Moravian Library in Brno
Validation offers positive verification of the identity of individual users of mojeID services, especially by towns and villages or by the operators …
Hackers: Here's How Apple's iMessage Surveillance Flaw Works
Hackers this week showed security conference attendees findings and demonstrations directly contradicting Apple's public claim that it can't read iMe…
Facebook FBStalker Tool Uses Graph Search For Powerful OSINT Analysis
Experts Werrett and Lee demonstrated how to conduct a powerful analysis using FBStalker, a tool created to find a comprehensive amount of data on any…
Fake Social Empires Cheat Exposes over 135,000 Facebook Users to Fraud
More than 135,000 Facebook users were exposed to fraud and [identity theft(http://www.hotforsecurity.com/blog/fake-social-empires-cheat-exposes-over-…
Critical Vulnerability Haunts NetGear ReadyNAS Devices
A critical vulnerability in NETGEAR's ReadyNAS network attached storage devices can allow attackers to gain root access without authentication.
Backdoor Found In Chinese Tenda Wireless Routers, Allows Root Access To Hackers
Last week Craig Heffner, specialized on the embedded device hacking exposed a serious backdoor in number of D-Link routers allows unauthorized backdo…
Facebook Teens More Vulnerable to Stalkers
Teenagers who create a Facebook account are more vulnerable to stalkers and cyber-crooks, as their posts and photos will be publicly available if the…
A vBulletin Exploit Used To Hack Thousands of Websites
Security firm Imperva revealed that more than 35000 websites based on vBulletin CMS have been hacked exploiting a known vulnerability.
On August v…
ASLR Bypass Techniques Are Popular with APT Attacks
Address space layout randomization (ASLR) is a security technique involved in protection from buffer overflow attacks. Many recent APT (Advanced Pers…
Recommendations for securing networks in the event of DoS or DDoS attack
On the basis of an analysis of April’s DDoS attacks in the Czech Republic, the National Cyber Security Centre along with partners from the state, pri…
Android Malvertising Scam Promises Antivirus, Delivers Lifetime Subscription to Ringtones
This scam appeared as a pop-up ad delivered by an advertising SDK that can be found in a lot of legitimate applications. When users download an app c…
Researchers Highlight Security Vulnerabilities In Ship-Tracking System
At the Hack in the Box conference, a group of researchers will demonstrate how attackers could fool a system meant to help ships avoid collisions.
The mojeID Service Surpasses the Quarter Million Mark
MojeID is free of charge for users, who will most often encounter it on the websites of online stores and media or community servers.
Prague, 15 Octob…
Hiding Webshell Backdoor Code in Image Files
First appearances may be deceiving... Web attackers have have been using a method of stashing pieces of their PHP backdoor exploit code within the m…
Charity Scams: Does Your Click Save a Starving Child?
Nowadays, scammers take advantage of the good-hearted by manipulating web search results, blasting them with spam and devising ever-more sophisticate…
A Backdoor Present In Many D-Link Devices Allows To Bypass Authentication
The researcher Craig demonstrated the presence of a backdoor within some DLink routers that allows an attacker to access the administration web inter…
CZ.NIC Co-organises Seminar on a Single Digital Market
This seminar will focus on selected aspects of information technologies within the single EU market, examining draft legislation as well as large pil…
Internet Explorer Zero-Day Times Two
Yet another Microsoft IE bug covered in yesterday's big patch was already being used in the wild in targeted APT-style attacks
Dangerous vBulletin exploit in the wild
vBulletin is a popular proprietary CMS that was recently reported to be vulnerable to an unspecified attack vector. vBulletin is currently positioned…
Fight Graph Search Abuse with Facebook Privacy Settings
In January, Bitdefender warned that Facebook users are vulnerable to Graph Search abuse, as the new feature is also being tested by cyber-criminals. …
Adobe Confirms Source Code Breach, Theft of Customer Data
Adobe Systems confirmed its network had been breached in an attack that compromised information belonging to 2.9 million of its customers.
Web Hosting software WHMCS vulnerable to SQL Injection; emergency security update released
WHMCS, a popular client management, billing and support application for Web hosting providers, released an emergency security update for the 5.2 and …
Identifying Evil An Introduction To Reverse Engineering Malware And Other Software
Bart Hopper presentation on DerbyCon - 3.0 conference.
Research detects dangerous malware hiding in peripherals
A Berlin researcher has demonstrated the capability to detect previously undetectable stealthy malware that resides in graphics and network cards.
Ajax Security Issues
This article is about exploring major security issues we come across during assessment of Ajax based applications.
Vulnerability in Android Firefox allows hackers to steal user's data from SD card
Vulnerability allows hackers to access both the contents of the SD card and the browser's private data. Vulnerability is not exploitable if victim do…
CSIRT.CZ is a Partner of the European Cybernetic Security Month
The event is part of the international October campaign of European Cybernetic Security Month.
The CSIRT.CZ national security team operated by the CZ.…
CSIRT.CZ is a Partner of the European Cybernetic Security Month
The event is part of the international October campaign of European Cybernetic Security Month.
The CSIRT.CZ national security team operated by the CZ.…
The ‘What’s Internet For’ project returns to TV
The first new series will begin in October, with the second following a month later.
Prague, 1 October 2013 - In cooperation with Czech Television, t…
Beware fake iMessage app for Android
One month after a fake Apple iMessage app for Android was released it was downloaded more than 10000 times. Application that allows Android users to …
Thousands of Wordpress Blogs Compromised To Perform DDoS Attack
If you are running WordPress sites, now would be a good time to ensure that strong passwords are always used and that your username should be changed…
Windows Systems and Artifacts in Digital Forensics, Part I: Registry
Learning about artifacts in Windows is crucial for digital forensics examiners, as Windows accounts for most of the traffic in the world (91.8 of tra…
How to Prevent Social Engineering Attacks
This post is about social engineering. It will cover some of the dangers of social engineering and focus more on what a corporation or a company can …
A second iOS 7 Lockscreen vulnerability concerns Apple users
A new iOS 7 Lockscreen vulnerability has been discovered, the flaw allows attackers with physical access to the phone to make calls, including intern…
CSRF Vulnerability in eBay Allows Hackers to Hijack User Accounts
As the largest online auction site, eBay has an estimated 110 million users across 28 countries. Towards the end of July 2013, I identified severa…
TheCZ.NIC Academy Offers New Education Courses For Open-source Software Developers
The courses Free Application Security and Open Source SW Quality Assurance are offered at the Academy in Prague and at the Association’s Brno branch.
…
New Zero-Day vulnerability in Internet Explorer
Microsoft announced to be aware of a new Zero Day vulnerability that effects Internet Explorer browsers 8 a 9. This new flaw was confirmed just after…
Android WebView vulnerability allows hacker to install malicious apps
WebView is an essential component in Android and iOS. It enables applications to display content from online resources and simplifies task of perform…