2013
Adobe Confirms Source Code Breach, Theft of Customer Data
Adobe Systems confirmed its network had been breached in an attack that compromised information belonging to 2.9 million of its customers.
Web Hosting software WHMCS vulnerable to SQL Injection; emergency security update released
WHMCS, a popular client management, billing and support application for Web hosting providers, released an emergency security update for the 5.2 and …
Identifying Evil An Introduction To Reverse Engineering Malware And Other Software
Bart Hopper presentation on DerbyCon - 3.0 conference.
Research detects dangerous malware hiding in peripherals
A Berlin researcher has demonstrated the capability to detect previously undetectable stealthy malware that resides in graphics and network cards.
Ajax Security Issues
This article is about exploring major security issues we come across during assessment of Ajax based applications.
Vulnerability in Android Firefox allows hackers to steal user's data from SD card
Vulnerability allows hackers to access both the contents of the SD card and the browser's private data. Vulnerability is not exploitable if victim do…
Beware fake iMessage app for Android
One month after a fake Apple iMessage app for Android was released it was downloaded more than 10000 times. Application that allows Android users to …
Thousands of Wordpress Blogs Compromised To Perform DDoS Attack
If you are running WordPress sites, now would be a good time to ensure that strong passwords are always used and that your username should be changed…
Windows Systems and Artifacts in Digital Forensics, Part I: Registry
Learning about artifacts in Windows is crucial for digital forensics examiners, as Windows accounts for most of the traffic in the world (91.8 of tra…
How to Prevent Social Engineering Attacks
This post is about social engineering. It will cover some of the dangers of social engineering and focus more on what a corporation or a company can …
A second iOS 7 Lockscreen vulnerability concerns Apple users
A new iOS 7 Lockscreen vulnerability has been discovered, the flaw allows attackers with physical access to the phone to make calls, including intern…
CSRF Vulnerability in eBay Allows Hackers to Hijack User Accounts
As the largest online auction site, eBay has an estimated 110 million users across 28 countries. Towards the end of July 2013, I identified severa…
New Zero-Day vulnerability in Internet Explorer
Microsoft announced to be aware of a new Zero Day vulnerability that effects Internet Explorer browsers 8 a 9. This new flaw was confirmed just after…
Android WebView vulnerability allows hacker to install malicious apps
WebView is an essential component in Android and iOS. It enables applications to display content from online resources and simplifies task of perform…
Attacks Targeting Unsupported Java 6 Are On The Rise
Zero-day vulnerabilities are less of a problem than the old-ones since many people use the older, vulnerable versions of the software. In february 20…
Java SE 7 Now Lets Administrators Control What Versions of Java Can Run Where
Oracle on Wednesday announced the availability of the Oracle Java Development Kit (JDK) 7 Update 40 (JDK 7u40), a release that gives system administr…
Group-IB has issued a report on cyber crime and threats
Group-IB has issued a report on the state and dynamics of today’s market of computer crimes and current cyber threats for the year 2012 and first qua…
The Hunt for Memory Malware
Memory forensic is a skill to find out all the artefacts in the memory that is present in the running computer. It is an interesting method to find o…
Forensic Implications of a Person Using Firefox’s Private Browsing
This post is about Firefox’s Private Browsing feature. One of the key statements in the Private Browsing description in the Mozilla product page is: …
5 Signs Of Trouble In Your Network
Companies analyzing the voluminous data produced by information systems should make sure to check user access and configuration changes, among other …
Sykipot Malware Now Targeting Civil Aviation Information
An older malware exploit called Sykipot has recently been reworked to steal data on the civil aviation sector in the United States, TrendLabs researc…
Web Application Security: PHP SuperGlobal Variables Are Vulnerable to Hackers
Hackers are focusing on vulnerabilities in the PHP web application development platform threatening 80% websites in the world, including many big web…
Fake Grand Theft Auto V torrent spreading malware
Cyber Criminals has already released a fake version of GTA 5 contains malware on torrent networks.
Microsoft Set to Issue 14 Security Updates for Patch Tuesday
Microsoft is planning to release 14 security bulletins next week as part of its Patch Tuesday update, including four critical updates for Internet Ex…
Sophisticated Android Trojan Spreads Through Mobile Botnet
Researchers at Kaspersky Lab say a sophisticated piece of Google Android malware is being blasted out via a mobile botnet spamming victims with text …
Why we really need DNSSEC?
Why we really need DNSSEC? That's the title of actual blogpost from Ondřej Surý, R&D Manager, in which he wrote about new way of DNS Cache poisoning …
Traffic Correlation Attacks against Anonymity on Tor
The researchers led by Aaron Johnson of the Naval Research Laboratory published the paper on Traffic Correlation Attacks against Anonymity on Tor.
Silent Circle Launches Secure Text, File Transfer App for Android
Silent Circle's apps and services route encrypted calls, messages and attachments exclusively between Silent Circle users' iOS and Android devices wi…
Counter-measures against Man-in-the-Browser attacks
Though phishing and key-loggers is still widely in use, banks have become aware of these threats and introduced multi-factor authentication including…
Mobile Trojan Defeats Dual Authentication
A new cross-device mobile Trojan that already has targeted online-banking customers has been linked to the same group that waged the successful High …
Developers Hack Dropbox, Show How to Access to User Data
Developers who were able to bypass Dropbox's security by reverse-engineering Python applications -- the language used by the cloud storage provider -…
Hacking, Surveilling, and Deceiving victims on Smart TV
Smart TVs sold over 80,000,000 units around the world in 2012. This next generation "smart" platform is becoming more and more popular. On the other …
Fake Xerox Scans Deliver Malware
A recent spam campaign abuses the name of Xerox, inviting users to download a scanned file to infect their systems with Trojans. The subject tagline …
Java Vulnerability Exploit Added to Neutrino Attack Kit
Security researchers are recommending Java users upgrade to the latest version due to a new exploit that has made its way into the Neutrino exploit k…
Critical Pinterest Exploit threatens the privacy of millions of users
The security researcher Dan Melamed has found a Critical Pinterest Exploit that compromised the privacy of over 70 Million Users, the flaw allows hac…
How Online Role-Playing Games Infect Your Computer
Massively multiplayer online role-playing games (MMORPGs) such as "World of Warcraft" or "EVE Online" are a lot of fun, but beware: The games can als…
Short Password Reset Code Vulnerability Allows Hackers To Brute Force Many Websites
The hacker used a Firefox Browser equipped with the Fireforce add-on, a very simple a Firefox extension designed to perform brute force attacks on GE…
Microsoft: Windows XP Usage Means Zero-Day Attacks Forever
Microsoft has a blunt warning for computer users still using Windows XP: Upgrade to a newer operating system now or risk exposure to zero-day attacks…
Microsoft Re-releases Windows Server Security Update
Microsoft has re-issued a patch for a Windows Server vulnerability related to Active Directory Federation Services.
Hackers Targeting Servers Running Apache Struts Applications, Researchers Say
Chinese hackers are using an automated tool to exploit known vulnerabilities in Apache Struts, in order to install backdoors on servers hosting appli…
USB Internet Modems Vulnerability Exposes Millions of PCs
The Indian security expert ‘Rahul Sasi‘ announced to have found a USB Internet modems vulnerability, that could allow an attacker to execute maliciou…
Dell BIOS In Some Latitude Laptops and Precision Mobile Workstations Vulnerable To Buffer Overflow
By convincing a user with root or administrative privileges to execute a malicious BIOS update, an attacker can bypass the signed BIOS enforcement to…
Google Releases Android Patches After Bitcoin Theft
Google has pushed out patches to partners to address a cryptographic vulnerability tied to the theft of bitcoins from Android users.
Hacker Proofing Apache & PHP Configuration
Apache has been truly one of the dominant web servers of the World Wide Web. Now first we will learn about the techniques to how harden our Apache co…
Security Flaw in Philips Lighting System Lets Hackers Keep You in the Dark
A misfortunate implementation of the security token in the Hue intelligent lighting system from Phillips could allow an attacker to control the light…
Unpatch Wednesday: Microsoft Pulls Flawed Exchange Server Patch
Just 24 hours after shipping a critical Exchange Server 2013 patch to cover several remote code execution vulnerabilities, Microsoft has yanked the u…
Microsoft Patch Tuesday to Fix Three Critical Remote Code Execution vulnerabilities
Today the Microsoft Security team will issue eight security updates in total. Three are designated as critical and rest five as Important updates, th…
Simple Hack Threatens Outdated Joomla Sites
If you run a site powered by the Joomla content management system and haven’t yet applied a critical update for this software released less than two …
DNS Impairment Redirects Tthousands of Websites To Malware Sides
On 5 August tree Dutch webhosting companies suffered cyber attacks. Their name servers were altered by attackers that appear to have accessed an acco…
New Banking Trojan Targets Linux Users
Researchers from RSA have uncovered a new banking Trojan designed to steal information from machines running the Linux operating system. Dubbed “Hand…