InfoSec Week 51, 2017
There is a remotely exploitable vulnerability in the Vitek CCTV firmware. Reverse netcat shell included.
Posted
#Weekly-News
DevOps, Security, Whatever
InfoSec Week 50, 2017
Crooks hacked Fox-IT by capturing fox-it.com DNS record, then obtained a certificated and executed a man-in-the-middle attack on connection.
Posted
#Weekly-News
InfoSec Week 49, 2017
The 'Janus' Android vulnerability (CVE-2017-13156) allows attackers to modify the code in applications without affecting their signatures. The root of the problem is that a file can be a valid APK file and a valid DEX file at the same time. The vulnerability allows attackers to inject malware into legitimate application and avoiding detection.
Posted
#Weekly-News
InfoSec Week 48, 2017
The German Interior Minister is preparing a law that will force device manufacturers to include backdoors within their products that law enforcement agencies could use at their discretion for legal investigations.
Posted
#Weekly-News
InfoSec Week 47, 2017
According to the annual State of Open Source Security report, 77% of 433000 analyzed sites use at least one front-end JavaScript library with a known security vulnerability.
Posted
#Weekly-News
InfoSec Week 46, 2017
Multiple critical vulnerabilities were found in the Intel Management Engine, Trusted Execution Engine and Server Platform Services by Intel audit after 3rd party researchers reported the privilege escalation vulnerability.
Posted
#Weekly-News
InfoSec Week 45, 2017
Researchers exploited antivirus software quarantine mechanism to gain privileges by manipulating the restore process from the virus quarantine. By abusing NTFS directory junctions, the AV quarantine restore process can be manipulated, so that previously quarantined files can be written to arbitrary file system locations.
Posted
#Weekly-News
InfoSec Week 44, 2017
There are at least 14 newly discovered vulnerabilities in the Linux kernel USB subsystem. The vulnerabilities were found by the Google syzkaller kernel fuzzer. According to the researchers, all of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine.
Posted
#Weekly-News
InfoSec Week 43, 2017
Researchers from the Masaryk University finally published full paper of the practical cryptographic attack against the implementation of RSA in the widely used trusted platform modules / crypto tokens. 'The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli'
Posted
#Weekly-News
InfoSec Week 42, 2017
Interesting research on the possibility of a cheap online surveillance. 'In this work we examine the capability of [..] an individual with a modest budget -- to access the data collected by the advertising ecosystem. Specifically, we find that an individual can use the targeted advertising system to conduct physical and digital surveillance on targets that use smartphone apps with ads.'
Posted
#Weekly-News