Latest Hacking News And Events - dA1337: Vulnerabilities

Critical 'Port Fail' Vulnerability Reveals Real IP Addresses of VPN Users

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s1600/vpn-hacking.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjysD8aD63_udawCkQwXO0jmzMJ32kKgA4V6Oz14-WSXQ0x0zAp4KCkavwbj1DHU5Zk-kVNaf5f2YfZk5yC3g4AuwFSPo_rcuyE2e6avv3d2_6zW4yyvJHVSo-oJ2149J6PgEsE7aa7DUg/s640/vpn-hacking.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>
<div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">A 
newly discovered flaw affecting all VPN protocols and operating systems 
has the capability to reveal the real IP-addresses of users' computers, 
including BitTorrent users, with relative ease.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><br /></span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
The vulnerability, dubbed <b>Port Fail </b>by VPN provider Perfect 
Privacy (PP) who discovered the issue, is a simple port forwarding trick
 and affects those services that:</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><ul style="text-align: left;">
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Allow port forwarding</span></li>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<li style="text-align: justify;"><span style="font-family: Georgia,"Times New Roman",serif;">Have no protection against this specific attack</span></li>
</ul>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><div style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;">
Port Forwarding trick means if an attacker uses the same VPN (<b>Virtual Private Network</b>) as the victim, then the real IP-address of the victim can be exposed by forwarding Internet traffic to a specific port.</span></div>
<span style="font-family: Georgia,"Times New Roman",serif;">
</span><blockquote style="text-align: justify;">
<span style="font-family: Georgia,"Times New Roman",serif;"><i>"The crucial issue here is that a VPN user connecting to his own VPN 
server will use his default route with his real IP address, as this is 
required for the VPN connection to work," </i>Perfect Privacy wrote in a <a href="https://www.perfect-privacy.com/blog/2015/11/26/ip-leak-vulnerability-affecting-vpn-providers-with-port-forwarding/" rel="nofollow" target="_blank">blog post</a> on Thursday.</span></blockquote>
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<div style="text-align: justify;">
Port Fail affects all VPN protocols including…</div>
<ul style="text-align: left;">
<li style="text-align: justify;">OpenVPN</li>
<li style="text-align: justify;">IPSec</li>
</ul>
<div style="text-align: justify;">
…as well as applies to all operating systems, posing a huge privacy risk. </div>
<h3 style="text-align: justify;">
How Does 'Port Fail' Work?</h3>
<div style="text-align: justify;">
A successful IP address leak attack requires an attacker to be on the 
same VPN network as the victim and to know the victim's VPN exit IP 
address, which could be discovered by tricking a victim into visiting a 
website control controlled by the attacker.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
For example, an attacker with port forwarding enabled can see the 
request from the victim's actual IP addresses by tricking the victim 
into opening an image file. </div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
The same attack is possible for<b> BitTorrent users</b>, but, in this case, there is no need for the attacker to redirect the victim to their page. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
In this case, the attacker only with the activated port forwarding for 
the default BitTorrent port, can expose the real IP-address of a VPN 
user on the same network.</div>
<br />
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><br />
<h3 style="text-align: justify;">
Affected VPN Providers</h3>
<div style="text-align: justify;">
The flaw affected various large VPN providers. Perfect Privacy tested 
nine VPN providers out of which five were found to be vulnerable to this
 flaw and were alerted last week. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
VPN providers including Private Internet Access (PIA), Ovpn.to and nVPN have fixed the issue before publication.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
However, the company warned, <i>"other VPN providers may be vulnerable to this attack as we could not possibly test all."</i></div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
VPN aims to make you sure that your real identity remains anonymous on 
the Internet so that nobody could track the origin of your connection 
back to you, but this newly discovered flaw shows that it's quite easy 
to bypass this on some VPN providers.</div>
<span style="font-family: Georgia,"Times New Roman",serif;"> </span></div>

A newly discovered flaw affecting all VPN protocols and operating systems has the capability to reveal the real IP-addresses of us...

Researcher Hijacks Android Phone via Chrome Vulnerability

9:17 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix_g_PCLWPYz1I4YzFe3KIzfP38dOhfsqv0DRjxgt9H8uwswBqGGDVa7hvnfHv_LkY7SrgpZT1Hf0bmim5IkVqtSgjbcERHVxrOgMAXjqQI6_TfO_bxS5pztOIlarLMnPzLXwX0HwXLMY/s1600/android-exploit.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEix_g_PCLWPYz1I4YzFe3KIzfP38dOhfsqv0DRjxgt9H8uwswBqGGDVa7hvnfHv_LkY7SrgpZT1Hf0bmim5IkVqtSgjbcERHVxrOgMAXjqQI6_TfO_bxS5pztOIlarLMnPzLXwX0HwXLMY/s640/android-exploit.jpg" width="640" /></a></div>
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span>
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong>Over the past few months, Google has been busy squashing security vulnerabilities in its popular Android mobile operating system, but many remain undiscovered, and some can be easily exploited.</strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Chinese researcher <a href="https://twitter.com/oldfresher" style="color: #0076b4; font-weight: bold; text-decoration: none;">Guang Gong</a> from Qihoo 360 demonstrated at <strong>MobilePwn2Own</strong> at the PacSec conference in Tokyo how an Android device running the latest version of the operating system can be hijacked by exploiting a JavaScript v8 vulnerability through the Chrome browser. Granted, the security flaw did not reside in the Android OS itself, but devices running on the platform are vulnerable.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"></span></span><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">Gong discovered a JavaScript v8 vulnerability in Chrome for Android that allowed him to install an arbitrary application on the affected device, in this case a BMX Bike game, without requiring any user interaction, PacSec organizer Dragos Ruiu explained in a </span><a href="https://plus.google.com/103470457057356043365/posts/KLDx2YJKSg8" style="color: #0076b4; font-family: 'trebuchet ms', geneva; font-size: medium; font-weight: bold; text-decoration: none;" target="_blank">Google+ post</a><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">. As long as Chrome is used to navigate to a malicious site an attacker set up, the device can be infected.</span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-family: "trebuchet ms" , "geneva"; font-size: small;"><br /></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The exploit was demonstrated on a Google Project Fi Nexus 6 running the latest Android 6.0 Marshmallow build and with all applications up-to-date. The researcher demonstrated that the vulnerability could provide an attacker with complete control of the device, and that successful exploitation does not require chaining multiple vulnerabilities.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">This one shot exploit was revealed after three-months of work, Ruiu said, but exact details on the security flaw were not publicly disclosed. According to Ruiu, the exploit was tested on other devices as well, and it worked on all of them.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Given that the vulnerability is in the JavaScript engine in Chrome, it is believed to affect all Android versions with the latest version of the browser installed. Details on the vulnerability were handed to a Chrome engineer at the conference, Ruiu announced <a href="https://twitter.com/dragosr/status/664367172718751744" style="color: #0076b4; font-weight: bold; text-decoration: none;">via Twitter</a>.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Unfortunately for Gong, his presentation at the conference did not result in an immediate reward for his efforts, though it is likely that Google will reward him for discovering the vulnerability, as the company has a <a href="https://www.google.com/about/appsecurity/chrome-rewards/" style="color: #0076b4; font-weight: bold; text-decoration: none;">bug bounty program</a> set up for Chrome and Chrome OS.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“Since we don't have any lavish prizes for him, I'm bringing him to Canada next year for some skiing/snowboarding at CanSecWest,” Ruiu said, so it seems that a prize will be coming from the PacSec organizers.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Google will most likely resolve the vulnerability soon, even if the details on the exploit haven’t been made public as of now.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
</div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Security researchers have discovered a series of critical Android vulnerabilities this year, including the Stagefright flaw that affected close to a billion devices, and a Stagefright 2 issuesuspected to affect devices running all Android versions, starting with the initial release.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Hacking news Latest News Security news Vulnerabilities Researcher Hijacks Android Phone via Chrome Vulnerability

Over the past few months, Google has been busy squashing security vulnerabilities in its popular Android mobile operating system, but ...

Google finds 11 vulnerabilities in the Samsung Galaxy S6 Edge; eight fixed

3:12 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhz98ySZzvFNv8eERMZkazieJ6-r7W66LOyo7ydyRh_VjfQhNgN-yyypilOs0xGb3KRgOvqnQ9ZBy3kCzE4Ab-ZYb1y8XEGkJaeP5TqcIaCgVnxkIkhZ7lcZjhyyxWSZmMHN2MNMqKJBYY/s1600/03_GALAXY-S6-Edge-624x351.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhz98ySZzvFNv8eERMZkazieJ6-r7W66LOyo7ydyRh_VjfQhNgN-yyypilOs0xGb3KRgOvqnQ9ZBy3kCzE4Ab-ZYb1y8XEGkJaeP5TqcIaCgVnxkIkhZ7lcZjhyyxWSZmMHN2MNMqKJBYY/s640/03_GALAXY-S6-Edge-624x351.jpg" width="640" /></a><i><span style="font-family: Georgia,"Times New Roman",serif;">When Google researchers tried looking for vulnerabilities in the Android OS running on Samsung’s latest <strong>Galaxy S6 Edge</strong>, they found not less than 11 bugs.</span></i><br />
<br />
<i><span style="font-family: Georgia,"Times New Roman",serif;">
</span></i><i><span style="font-family: Georgia,"Times New Roman",serif;">Google’s Project Zero looks into vulnerabilities of the device made 
by OEMs using the Android Open-Source Project (AOSP). “Having done some 
previous research on Google-made Nexus devices running AOSP, we wanted 
to see how different attacking an OEM device would be. In particular, we
 wanted to see how difficult finding bugs would be, what type of bugs we
 would find and whether mitigations in AOSP would make finding or 
exploiting bugs more difficult,” Google writes in the Project Zero <strong>blog</strong>.</span></i><br />
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<i><span style="font-family: Georgia,"Times New Roman",serif;">
</span></i><i><span style="font-family: Georgia,"Times New Roman",serif;">The most serious issue was Samsung’s WifiHs20UtilityService path 
traversal, a service that scans zip file in SDcard, downloads and also 
unzips it. The bug exploits the API used to unzip and does not verify 
the path, causing it to be written in any unidentified location.</span></i><br />
<br />
<i><span style="font-family: Georgia,"Times New Roman",serif;">
</span></i><i><span style="font-family: Georgia,"Times New Roman",serif;">A script injection issue in the Samsung email client makes JavaScript
 vulnerabilities in the Android WebView reachable remotely via email and
 could increase surface attack on email client. Then, the project Zero 
team also found three driver issues, which can be used by bugs in media 
processing. “We found three bugs that would allow an exploit to disable 
SELinux, so it’s not an effective mitigation against every bug,” the <span style="background-color: lime;"><span style="color: white;"><strong><a href="http://googleprojectzero.blogspot.ro/2015/11/hack-galaxy-hunting-bugs-in-samsung.html" rel="nofollow" target="_blank">blog</a></strong></span></span> states.</span></i><br />
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<i><span style="font-family: Georgia,"Times New Roman",serif;">
</span></i><i><span style="font-family: Georgia,"Times New Roman",serif;">Overall, the team found sufficient number of high-severity issues. 
The issues have been reported to Samsung and the company has already 
responded stating about eight issues have been fixed in the October 
Maintenance Release.</span></i></div>

Android Smartphone Vulnerabilities Google finds 11 vulnerabilities in the Samsung Galaxy S6 Edge; eight fixed

When Google researchers tried looking for vulnerabilities in the Android OS running on Samsung’s latest Galaxy S6 Edge , they found not les...

Hackers WIN $1 Million Bounty for Remotely Hacking latest iOS 9 iPhone

10:49 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil46lfE1SMPcpRaLvAG9zr_RHcbpbhYMO1Znj7eMaim6xaumrvN65xp_rsgve-IhyphenhyphenzI23mcJAOIfBBn-MjW8HSuxLFc2C9_FHBe_JXzEWa8lHBHpTBEploKf8ZYVev8dg97QhKkIcm_Tk/s1600/iphone-hacked-jailbreak-zerodium-million-dollar-720x340.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil46lfE1SMPcpRaLvAG9zr_RHcbpbhYMO1Znj7eMaim6xaumrvN65xp_rsgve-IhyphenhyphenzI23mcJAOIfBBn-MjW8HSuxLFc2C9_FHBe_JXzEWa8lHBHpTBEploKf8ZYVev8dg97QhKkIcm_Tk/s640/iphone-hacked-jailbreak-zerodium-million-dollar-720x340.jpg" width="640" /></a></div>
<div style="text-align: center;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i> </i></span></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>Well, here's some terrible news for all Apple iOS users…</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
Someone just found an iOS zero-day vulnerability that could allow an 
attacker to remotely hack your iPhone running the latest version of iOS,
 i.e. iOS 9.</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
Yes, an unknown group of hackers has sold a zero-day vulnerability to <b>Zerodium</b>, a startup by French-based company Vupen that Buys and Sells zero-day exploits.</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
And Guess what, in How much?</i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script><br /></i></span></div>
<span style="font-family: Arial,Helvetica,sans-serif;"><i>
</i></span><div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b>$1,000,000. Yes, $1 Million.</b></i></span></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b> </b></i></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjExcA92xEmyzv-ZzP2vj_Os4L5C7tQpBBovqnIu_AT76Hlf6Db9LrWfuEx3mfHYxdQCV1VlhtB7LhlsixiwT35EPG4C_88kOkRnEzDbpdmchIhtWqdeGNS0O3ssf-2MZVA34xQh_kSMik/s1600/zerodium.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="366" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjExcA92xEmyzv-ZzP2vj_Os4L5C7tQpBBovqnIu_AT76Hlf6Db9LrWfuEx3mfHYxdQCV1VlhtB7LhlsixiwT35EPG4C_88kOkRnEzDbpdmchIhtWqdeGNS0O3ssf-2MZVA34xQh_kSMik/s640/zerodium.png" width="640" /></a></div>
<div style="text-align: justify;">
<span style="font-family: Arial,Helvetica,sans-serif;"><i><b><span class="main-article-info"><div style="text-align: justify;">
Last month, a <span style="font-weight: normal;">Bug bounty challenge
 was announced by Zerodium for finding a hack that must allow an 
attacker to remotely compromise a non-jailbroken Apple device through:</span></div>
<span style="font-weight: normal;">
</span><div style="text-align: justify;">
</div>
<span style="font-weight: normal;">
</span><ul>
<li><span style="font-weight: normal;">A web page on Safari or Chrome browser,</span></li>
<li><span style="font-weight: normal;">In-app browsing action, or</span></li>
<li><span style="font-weight: normal;">Text message or MMS.</span></li>
</ul>
</span></b></i></span><span style="font-family: Arial,Helvetica,sans-serif;"><i><b> </b><span class="main-article-info"><div style="text-align: justify;">
Zerodium's Founder Chaouki Bekrar<b> </b><a href="https://twitter.com/Zerodium/status/661240316331069443?ref_src=twsrc%5Etfw" rel="nofollow" target="_blank">confirmed</a> on Twitter that an unnamed group of hackers has won this $1 Million Bounty for sufficiently submitting a remote browser-based iOS 9.1/9.2b Jailbreak (untethered) Exploit.</div>
<div style="text-align: justify;">
</div>
<h3 style="text-align: justify;">
NO More Fun. It's Serious Threat to iOS Users</h3>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
For those who are not aware, this remote Jailbreak is not really cool.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Why? Because…</div>
<div style="text-align: justify;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhU2tB1-kWfyAqObo02LMIAMUl-cDOKgTCPvxx0MzHLMYH5y9ijdsCI_WwciOJsFh2yzTY_Y1_CtvtijAmPnQ37MtvPr6_vJDgJuyaiizafA_t1vhbbvPfO4UAPOICt5tMCOyXfjPW76g/s1600/Zerodium-channelbiz.es_.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="227" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhU2tB1-kWfyAqObo02LMIAMUl-cDOKgTCPvxx0MzHLMYH5y9ijdsCI_WwciOJsFh2yzTY_Y1_CtvtijAmPnQ37MtvPr6_vJDgJuyaiizafA_t1vhbbvPfO4UAPOICt5tMCOyXfjPW76g/s400/Zerodium-channelbiz.es_.jpg" width="400" /></a></div>
<div style="text-align: justify;">
The only difference between a malicious cyber attack and Jailbreak is – <b>Payload</b>, the code that executes on target system after exploitation.</div>
<div style="text-align: justify;">
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
</div>
<div style="text-align: justify;">
A traditional jailbreak process is usually used to deploy an alternative
 App Store, but in hands of Hackers or law enforcement agencies, the 
same exploit can allow them to install any app they want with full 
privileges i.e. <b>Spyware</b>, <b>Malware</b> or <b>Surveillance software</b>.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Moreover, We know that Zerodium's parent company Vupen develops hacking 
techniques based on those bugs and typically sells them to multiple 
government customers.</div>
</span></i></span><span style="font-family: Arial,Helvetica,sans-serif;"><i><span class="main-article-info">So, 
the chances are high that the firm will resell the newly discovered and 
undisclosed remote iOS zero-day jailbreak exploit to its clients, which 
are said to include Spy agencies, Governments, and Law enforcement 
agencies.</span></i></span></div>
</div>

Hacking news ios9 Latest News Security news Vulnerabilities Hackers WIN $1 Million Bounty for Remotely Hacking latest iOS 9 iPhone

Well, here's some terrible news for all Apple iOS users… Someone just found an iOS zero-day vulnerability that could allo...

Joomla 3.4.5 patches Critical SQL Injection Vulnerability

3:21 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_7bBIFcW964da8is50rLmSnISe5pLMycdTXmXTcVpN8yg4JBVPGCA-8RHFwN06F0L2Ff6CYlcGxUUHjMBjWBNMPbowpnMTg4eZydd7Twi41MIQhYvn6WuGCSIkz6j7LCZPEkhSMkO71s/s1600/joomla-org-og.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_7bBIFcW964da8is50rLmSnISe5pLMycdTXmXTcVpN8yg4JBVPGCA-8RHFwN06F0L2Ff6CYlcGxUUHjMBjWBNMPbowpnMTg4eZydd7Twi41MIQhYvn6WuGCSIkz6j7LCZPEkhSMkO71s/s640/joomla-org-og.jpg" width="640" /></a><b>       </b></div>
<span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"></span></span><span style="font-family: Georgia,"Times New Roman",serif;"><span class="main-article-info"><div style="text-align: justify;">
<b>Joomla</b> – one of the most popular open source Content Management 
System (CMS) software packages, has reportedly patched three critical 
vulnerabilities in its software.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The flaws, exist in the Joomla version 3.2 to 3.4.4, include <b>SQL injection vulnerabilities</b> that could allow hackers to take admin privileges on most customer websites. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The patch was an upgrade to<b> Joomla <a href="https://www.joomla.org/announcements/release-news/5634-joomla-3-4-5-released.html" rel="nofollow" target="_blank">version 3.4.5</a></b> and only contained security fixes.</div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
The vulnerability, <a href="https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/" rel="nofollow" target="_blank">discovered</a>
 by Trustwave SpiderLabs researcher Asaf Orpani and Netanel Rubin of 
PerimeterX, could be exploited to attack a website with SQL injections.</div>
<div style="text-align: justify;">
 </div>
<div style="text-align: justify;">
<span class="main-article-info"><div style="text-align: justify;">
<b>SQL injection</b> (<b>SQLi</b>) is an injection attack wherein a bad 
actor can inject/insert malicious SQL commands/query (malicious 
payloads) through the input data from the client to the application.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The vulnerability is one of the oldest, most powerful and most dangerous
 flaw that could affect any website or web application that uses an 
SQL-based database.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The recent SQLi in Joomla discovered by Orpani are:</div>
<div style="text-align: justify;">
</div>
<ul>
<li>CVE-2015-7297</li>
<li>CVE-2015-7857</li>
<li>CVE-2015-7858</li>
</ul>
<div style="text-align: justify;">
<b>CVE-2015-7857</b> enables an unauthorized remote attacker to gain 
administrator privileges by hijacking the admin session. Once exploited,
 the attacker may gain full control of the website and execute 
additional attacks.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The vulnerability discovered in a core module that doesn't require any 
extensions, therefore, all the websites that use Joomla versions 3.2 
(released in November 2013) and above are vulnerable.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Researchers also discovered the related vulnerabilities, <b>CVE-2015-7858 </b>and <b>CVE-2015-7297</b>, as part of their research.</div>
<div style="text-align: justify;">
</div>
<br />
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br />
<div style="text-align: justify;">
Actually the Joomla code resided in <i>/administrator /components /com_contenthistory/ models/history.php</i> was vulnerable to SQL injection. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
Orpani came across many weak links in this code, that could:</div>
<div style="text-align: justify;">
</div>
<ol>
<li>Exploit the vulnerability to gain the administrator session key</li>
<li>On executing the request on Joomla site returns the admin session key</li>
<li>Using the admin key to hijack the session and further gaining:</li>
</ol>
<ul style="text-align: left;">
<li>Access to the /administrator/ folder</li>
<li>Administrator privileges</li>
<li>Access to the administrator Control Panel </li>
</ul>
<h3 style="text-align: justify;">
Vulnerability in DRUPAL</h3>
<div style="text-align: justify;">
The popular CMS Drupal has also patched an <b>Open Redirect vulnerability </b>in the Overlay module in its Core project (7.x versions prior to 7.41).  </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The Overlay module in Drupal core project displays administrative pages 
as a layer on the current page, rather than replacing the page in the 
browser window. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
However, the module doesn't sufficiently validate URLs prior to 
displaying their contents, which leads to an open redirect 
vulnerability, according to Drupal's <a href="https://www.drupal.org/SA-CORE-2015-004" rel="nofollow" target="_blank">official blog</a>. </div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The vulnerability affected the site users with administrative rights; i.e. if only the<i> "Access the administrative overlay"</i> permission is enabled the vulnerability could be exploited.</div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
The fix for the open redirect vulnerability was released and required the sites to upgrade to <b><a href="https://www.drupal.org/drupal-7.41-release-notes" rel="nofollow" target="_blank">Drupal version 7.41</a>.    </b></div>
<div style="text-align: justify;">
</div>
<div style="text-align: justify;">
If you were not aware of these vulnerabilities, do not panic you can patch your CMS now!</div>
</span></div>
</span></span></div>

Latest News Security news Vulnerabilities Joomla 3.4.5 patches Critical SQL Injection Vulnerability

Joomla – one of the most popular open source Content Management System (CMS) software packages, has reportedly patched three cr...

New NTP Vulnerabilities Put Networks at Risk

11:30 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEid5LqBHPKyedjE38MXa0GiyfUsSUaGreQKujVZ0sTwD7U0ADeTgsgXFIqpAsZ4L3Zog0Lpcx4ujpBcmEOFFaHz93jJJc8UPlOWKfH10_1qeX2ysJ-d899kl2cHxojM8GioSFkn8F_MgbM/s1600/Software-Vulnerabilities.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="181" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEid5LqBHPKyedjE38MXa0GiyfUsSUaGreQKujVZ0sTwD7U0ADeTgsgXFIqpAsZ4L3Zog0Lpcx4ujpBcmEOFFaHz93jJJc8UPlOWKfH10_1qeX2ysJ-d899kl2cHxojM8GioSFkn8F_MgbM/s320/Software-Vulnerabilities.jpg" width="320" /></a></div>
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Network Time Foundation’s NTP Project has released an update for the Network Time Protocol (NTP) to address a series of low and medium severity vulnerabilities reported by experts from Cisco, Red Hat, IDA, Boston University, and Tenable Networks.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">NTP is a protocol used to synchronize clocks between computer systems on a network. While NTP is highly useful, it’s also known to be plagued by various security flaws, and it has often been abused to amplify distributed denial-of-service (DDoS) attacks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The latest update to NTP, ntp-4.2.8p4, patches a total of 13 flaws, including denial-of-service (DoS), directory traversal, memory corruption, authentication bypass, and file overwrite issues.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“NAK to the Future” Vulnerability</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to an <a href="http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">advisory</a> published by the NTP Project on Wednesday, the only generally exploitable bug, with a CVSS score of 6.4, is a <a href="http://talosintel.com/reports/TALOS-2015-0069/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">crypto-NAK issue</a> (CVE-2015-7871) uncovered by researchers at Cisco.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The vulnerability, which exists due to a logic error in the handling of certain crypto-NAK packets by the Network Time Protocol daemon (ntpd), can be exploited by an unauthenticated off-path attacker to force ntpd processes to peer with malicious time sources in an effort to make changes to the system time.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Once they manage to change system time, attackers can authenticate to services using expired passwords and accounts, they can bypass web security mechanisms such as HTTP STS and certificate pinning, they can cause TLS clients to accept revoked and expired certificates, damage systems, deny service to authentication systems and services that use time-limited authentication tickets, and cause a negative impact on system performance by forcing caching systems like content delivery networks (CDNs) and DNS to flush caches.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“This vulnerability has been confirmed in ntp version 4.2.8p3. The vulnerable code path was introduced in ntp version 4.2.5p186 (late 2009). Therefore, all ntp-4 stable releases from 4.2.5p186 through 4.2.8p3 appear to be vulnerable. All ntp-4 development versions from 4.3.0 through, at least, 4.3.76 also appear to be vulnerable,” Cisco said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The networking giant is currently trying to determine which of its products are <a href="http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">affected by the vulnerabilities</a> patched with the release of ntp-4.2.8p4. The company will then release software updates to patch the security holes.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">New Attacks on NTP</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After the NTP Project released the update addressing the vulnerabilities they discovered (CVE-2015-7704 and CVE-2015-7705), Boston University researchers published a paper detailing their findings.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The experts detailed a method an on-path attacker can use to hijack traffic to the NTP server and change the time on its clients. They also described a technique that an off-path attacker located anywhere on the targeted organization’s network can use to disable NTP synchronization via a low-rate denial-of-service attack.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to Boston University researchers, an off-path attacker can also use IPv4 fragmentation to hijack the NTP connection between the client and server to alter time.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The impact of these vulnerabilities is generally similar to the attack scenarios described by Cisco. However, Boston University also described a scenario affecting the digital currency Bitcoin.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Bitcoin is a digital currency that allows a decentralized network of node to arrive at a consensus on a distributed public ledger of transactions, aka ‘the blockchain’. The blockchain consists of timestamped ‘blocks’; bitcoin nodes use computational proofs-of-work to add blocks to the blockchain,” experts explained in their <a href="http://www.cs.bu.edu/~goldbe/papers/NTPattack.pdf" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">paper</a>. “Because blocks should be added to the blockchain according to their validity interval (about 2 hours), an NTP attacker can trick a victim into rejecting a legitimate block, or into wasting computational power on proofs-of-work for a stale block.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">An NTP server fragmentation vulnerability testing <a href="http://www.cs.bu.edu/~goldbe/NTPattack.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">tool</a> made available by Boston University allows organizations to check their configuration simply by entering their IP address or domain name.</span></span></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Hacking news Latest News Security news Vulnerabilities New NTP Vulnerabilities Put Networks at Risk

The Network Time Foundation’s NTP Project has released an update for the Network Time Protocol (NTP) to address a series of low and med...

Vulnerabilities Found in HP ArcSight Products

4:31 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgh8D07u5B4G2ON_Vy0J35ae9XoAZ34QEM_5wMnrPbR-1xY7FFJyMZwBf94C1CpmhHCu3dwqPXRgecAZUjbJRsC_dz_UUxhjULht0fq5OITHU-LC15jywlycd-pEgmsfzr-ehwVUTkwUFU/s1600/hp-ArcSight.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgh8D07u5B4G2ON_Vy0J35ae9XoAZ34QEM_5wMnrPbR-1xY7FFJyMZwBf94C1CpmhHCu3dwqPXRgecAZUjbJRsC_dz_UUxhjULht0fq5OITHU-LC15jywlycd-pEgmsfzr-ehwVUTkwUFU/s640/hp-ArcSight.jpg" width="640" /></a></div>
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">HP has started releasing software updates for its ArcSight enterprise security management solution to address a series of vulnerabilities reported by researchers.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">An advisory published by CERT on Monday shows that ArcSight Logger, a log management software tool, is plagued by an authentication bypass vulnerability (CVE-2015-2136) that allows a remote, authenticated user without Logger Search permissions to conduct searches through the SOAP interface.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Another security issue related to the SOAP interface has been described by CERT as improper restriction of excessive authentication attempts (CVE-2015-6029). The weakness allows a remote, unauthenticated attacker to conduct brute force attacks on the SOAP interface in an effort to guess user passwords. The problem is that ArcSight Logger does not log or block incorrect logins, and repeated attempts to enter the password don’t trigger any alerts.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The last flaw found in HP ArcSight products has been classified as “insufficient compartmentalization” (CVE-2015-6030).</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Several key files for ArcSight are owned by the <em>arcsight</em> user, but are executed with root privileges. This may allow a user with <em>arcsight</em> credentials to escalate privileges to root when running commands,” CERT wrote in its <a href="http://www.kb.cert.org/vuls/id/842252" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">advisory</a>.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">This could be a serious issue, but the potential risk is mitigated because in practice only system administrators appear to know the credentials for the “arcsight” user. If it turns out that these credentials can be obtained through another method, the impact rating of the vulnerability will be changed, CERT noted.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The authentication bypass and brute force issues affect ArcSight Logger 6.0.0.7307.1 and possibly other versions. The compartmentalization flaw affects ArcSight Logger 6.0.0.7307.1, ArcSight Command Center 6.8.0.1896.0, and ArcSight Connector Appliance 6.4.0.6881.3. Other versions of these products and ArcSight SmartConnector for UNIX-like systems might also be impacted.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Hubert Mach and Julian Horoszkiewicz have been credited for finding and reporting these issues.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">HP has already released ArcSight Logger v6.0 P2 to address the authentication bypass vulnerability. The company has also started releasing updates to resolve the other flaws. Until these updates become available — HP estimates to complete the task by November — users are advised to restrict access to the “arcsight” account, and monitor network traffic in order to detect potential brute force attacks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Last week, Rapid7 reported finding a command injection flaw in HP SiteScope. While the issue sounds severe, HP has not released any updates, arguing that its product documentation covers the concern.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Laptops Latest News Security news Vulnerabilities Vulnerabilities Found in HP ArcSight Products

HP has started releasing software updates for its ArcSight enterprise security management solution to address a series of vulnerabiliti...

Manufacturers Fail to Eliminate Vulnerabilities on Mobile Devices

10:28 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtjtn32rKwnMoJaTiFPXvy-6e-J6LohvAela1Cn0OonL1iKJ6bIn4FcSocnsc3cw-GtXPelNxRCa_BncJ7v43FonstgSHcM3ig3RlACiPtT-BTQiMaarWLLSxcJq38igT9QKrcbnw1O1I/s1600/Manufacturers-Fail-to-Eliminate-Vulnerabilities-on-Mobile-Devices.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtjtn32rKwnMoJaTiFPXvy-6e-J6LohvAela1Cn0OonL1iKJ6bIn4FcSocnsc3cw-GtXPelNxRCa_BncJ7v43FonstgSHcM3ig3RlACiPtT-BTQiMaarWLLSxcJq38igT9QKrcbnw1O1I/s640/Manufacturers-Fail-to-Eliminate-Vulnerabilities-on-Mobile-Devices.gif" width="640" /></a></div>
<br />
<br />
<h2 style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; line-height: 19px; margin: 0px 0px 10px; padding: 0px;">
<div style="margin-bottom: 10px; margin-right: 14px; margin-top: 5px; padding: 0px;">
<span style="font-size: small;">Android smartphones are vulnerable to critical security flaws an average of approximately 88 percent of the time, a group of researchers finds.</span></div>
</h2>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">The infrequent release of security updates for Android devices has left 88 percent of smartphones and tablets vulnerable to at least one of 11 critical security flaws over the last four years, according to research published earlier this month by computer scientists at the University of Cambridge.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Using data from 20,400 devices and 40 different software projects that make up the majority of the Android code base, the researchers found that an average of 87.7 percent of devices were classified as insecure between July 2011 and July 2015. As part of the research, the computer scientists created a method of scoring the security of mobile devices in a way that takes into account how diligent manufacturers are in patching the underlying operating system.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">The analysis shows that manufacturers are not taking the required steps to help lock down customers'' devices, Daniel Thomas, a researcher in computer science at the University of Cambridge and a </span><a href="http://talks.cam.ac.uk/talk/index/61354" style="background-color: white; color: #19417e; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin: 0px; padding: 0px; text-align: justify; text-decoration: none;">co-author of the report</a><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">, told </span><em style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin: 0px; padding: 0px; text-align: justify;">eWEEK </em><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">in an email. The issues will become more significant as a variety of devices—not just smartphones—become interconnected as part of the Internet of things, he said.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">"Both secure system designs and prompt security updates will be required to provide security in the Internet of things,"</span><br />
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;"><br /></span>
<br />
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">The researchers focused on the Android ecosystem because there is readily available data on vulnerabilities and software updates, but iOS devices likely have the same problems, Thomas said.</span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;"><br /></span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">"We could perform exactly the same analysis if we had the same kind of data," he said. "Since iOS is less transparent, we have not been able to obtain this data yet."</span></span><br />
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;"><br /></span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">To perform the analysis on the Android ecosystem, the researchers collected vulnerability data from the AndroidVulnerabilities.org Website and historical data from the Device Analyzer project.</span></span><br />
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;"><br /></span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">The researchers found that, even though the devices are typically used for at least two years after purchase, the manufacturers rarely update the core system software, with only 1.26 updates issued for each device, on average. The slow update cycle results in extended periods of vulnerability, they found.</span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">The researchers proposed a benchmark to measure the overall security of devices and the support of their manufacturers. The benchmark, dubbed the FUM score, uses three metrics: the proportions of devices free from critical vulnerabilities and running the latest version of the Android operating system, and the mean number of vulnerabilities still unpatched by the manufacturer.</span></span><br />
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;"><br /></span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">Although the most secure device, the Google Nexus, had a score of 5.17 out of a best of 10, popular manufacturers were far below that level, the researchers found. LG, the device maker with the highest security rating, only scored 3.97 out of 10, while HTC and Sony both scored a much lower 2.63.</span></span></div>
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">The scoring system could give government procurers and consumers a way to discern which devices are the most secure, Thomas said.</span></span></div>
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="background-color: white; line-height: 19px; text-align: justify;"></span></span><br />
<div style="text-align: justify;">
<span style="color: #333333; font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;"><span style="line-height: 19px;">"The best way to put pressure on manufacturers to provide updates is to only buy devices from manufacturers that promise to provide updates and which have a historical record of doing so," he said. "The FUM score is hard to game, and so if companies try to maximize their score, then they will also maximize the security of their users."</span></span></div>
<div class="noncsa" id="olaad" style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin: 0px; padding: 0px; text-align: justify;">
<div id="olal-container" style="margin: 0px; padding: 0px;">
<div class="cachedWidget" id="assetsListings" style="background: rgb(207, 207, 207); margin: 0px; padding: 0px;">
<div id="assetsListings_listing" style="margin: 0px; padding: 0px;">
<div class="assetNew" style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; cursor: pointer; display: table; float: left; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 12px; font-weight: bold; margin: 5px 0px 10px; overflow: hidden; padding: 0px; width: 640px;">
<div class="assetNew-icon" style="border: 0px; float: left; height: 32px; margin: 0px; padding: 0px; width: 110px;">
</div>
</div>
</div>
</div>
</div>
</div>
<div style="-webkit-text-stroke-width: 0px; background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: 19px; margin: 5px 14px 14px 0px; orphans: auto; padding: 0px; text-align: justify; text-indent: 0px; text-transform: none; white-space: normal; widows: 1; word-spacing: 0px;">
</div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Latest News Security news Smartphone Vulnerabilities Manufacturers Fail to Eliminate Vulnerabilities on Mobile Devices

Android smartphones are vulnerable to critical security flaws an average of approximately 88 percent of the time, a group of researc...

Serious Vulnerabilities Patched in SAP Products

10:43 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglA9PEQIHwPZdKmioAN066m5vokt7GE3FkgBI-Fq39fPWQiknkcWbV4H59I5qguGDWENC40dq1Dke8OHx1enmN-fILmBhgQSj_h2qXdkezhDMJVuN1kHj9DYZ6JbweuRGXxmAvtrlZK0s/s1600/sap-patch.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglA9PEQIHwPZdKmioAN066m5vokt7GE3FkgBI-Fq39fPWQiknkcWbV4H59I5qguGDWENC40dq1Dke8OHx1enmN-fILmBhgQSj_h2qXdkezhDMJVuN1kHj9DYZ6JbweuRGXxmAvtrlZK0s/s640/sap-patch.gif" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Enterprise software maker SAP has released patches to address a series of high severity vulnerabilities affecting various products.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">As part of its <a href="http://scn.sap.com/community/security/blog/2015/10/13/sap-security-patch-day--october-2015" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">October 2015 Security Patch Day</a>, SAP released a total of 29 patches and support packages. According to SAP, there are 17 new security notes and four updates to previous notes.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Of these 21 notes, one has been rated critical and 15 have been classified as having high priority. The security updates resolve missing authorization checks, information disclosure issues, cross-site scripting (XSS) flaws, buffer overflows, a missing authentication check, and a SQL injection vulnerability.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The most severe of the patched issues, with a CVSS score of 9.3, is a remote command execution vulnerability affecting the SAP HANA database management system. The flaw was patched by SAP with the release of the 2197428 security note.</span></span></div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“An attacker can use Remote Command Execution to run commands remotely without authorization, under the privileges of the service that executes them,” SAP security solutions provider ERPScan said in an <a href="http://erpscan.com/press-center/blog/sap-security-notes-october-2015-review/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">advisory</a> describing the bug. “The attacker can access arbitrary files and directories located in an SAP server filesystem, including application source code, configuration, and critical system files. It allows the attacker to obtain critical technical and business-related information stored in the vulnerable SAP system.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Interestingly, both ERPScan and SAP security provider Onapsis have taken credit for reporting the flaw fixed with the 2197428 patch. Onapsis has described the issue as a buffer overflow vulnerability in the SQL interface of SAP Hana Extended Application Services.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The most likely scenario is that the companies independently reported the same flaw to SAP, ERPScan CTO Alexander Polyakov told <em>SecurityWeek</em>. This would indicate that the flaw is easy to find and it’s possible that others have known about it. However, there is also a slight possibility that each security firm reported different vulnerabilities that SAP decided to patch together.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The list of high priority issues patched by SAP includes an input validation vulnerability affecting the Service Data Control Center (SDCC) Download Function Module, a weakness that can be exploited via the RFC gateway against NetWeaver Search and Classification (TREX) or NetWeaver Business Warehouse Accelerator (BWA), and a remote code execution bug in 3D Visual Enterprise components.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">An <a href="https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">advisory</a> published by Onapsis also summarizes other high severity issues patched by SAP with the October updates, including information disclosure related to NetWeaver Application Server Java, a log injection flaw affecting the HANA audit log, a directory traversal in a component of ABAP, and a validation failure issue is the Internet Communication Framework.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Missing authorization checks continue to be the most common flaws. A report published last year by ERPScan showed that of the 3,000 vulnerabilities patched by SAP since 2001, roughly 20 percent were in this category.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Latest News Patched Security news Vulnerabilities Serious Vulnerabilities Patched in SAP Products

Enterprise software maker SAP has released patches to address a series of high severity vulnerabilities affecting various products. ...

VMware Aims to Use Encryption to Secure Virtualization

3:29 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<h2 style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 11px; line-height: 19px; margin: 0px 0px 10px; padding: 0px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU5fhQ8krtpx-G7btwrcVQMQvlOcnNmnDuMFkZfrkedzVrumOeaXIUD5Wj3RvVyMNaOYAWI5gJ6A20z_Vgzx98GcCDE7qFyBoJ36sUpcCRO9Vzfmgyys9vpeYwGqCSZvjC46g3owrrBZ8/s1600/290x195ciprivatecloud9.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="430" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgU5fhQ8krtpx-G7btwrcVQMQvlOcnNmnDuMFkZfrkedzVrumOeaXIUD5Wj3RvVyMNaOYAWI5gJ6A20z_Vgzx98GcCDE7qFyBoJ36sUpcCRO9Vzfmgyys9vpeYwGqCSZvjC46g3owrrBZ8/s640/290x195ciprivatecloud9.jpg" width="640" /></a></div>
<div style="margin-bottom: 10px; margin-right: 14px; margin-top: 5px; padding: 0px;">
<br /></div>
<div style="margin-bottom: 10px; margin-right: 14px; margin-top: 5px; padding: 0px;">
Network virtualization is a backbone that security can make use of with an approach VMware is referring to as Distributed Network Encryption.</div>
</h2>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">VMware is working on new encryption technology to improve the security of virtual networks and application workloads that run on them. Although encryption has been in use in various forms for a long time, VMware is aiming to use it in more extensively inside data centers.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">Making encryption easily usable in a meaningful way has been challenging, said Martin Casado, senior vice president and general manager of the Networking and Security business unit at VMware. Among the key challenges is how to manage the key distribution problem.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">Network virtualization might hold the key to making pervasive encryption more usable since it's already a distribution platform, managing things in a disturbed way as they move around an environment, Casado said. Network virtualization is a backbone that security can make use of with an approach VMware is referring to as Distributed Network Encryption (DNE), he explained.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">"With DNE, encryption just becomes a native attribute to an application," Casado told </span><em style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin: 0px; padding: 0px; text-align: justify;">Hackntech</em><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">. "You spin up an application, click a checkbox to encrypt all the packets in an application, and you don't have to worry about all the traditional encryption issues that have slowed adoption."</span><br />
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><br /></span>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">Currently, the DNE effort is still in early development, though Casado has some solid ideas on how and where it will fit into an existing network deployment. VMware's NSX network virtualization technology creates virtual networks by way of an API call. The basic idea for DNE is that, when an API call is made to NSX, that attribute is included to make sure the packets are encrypted.</span></span><br />
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><br /></span></span>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">"NSX will then take care of key management and setting up security associations," Casado said. "Then all of the tunnel end-points of the virtual network, running within the hypervisors, will encrypt and decrypt packets."</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">In the Web world, Secure Sockets Layer/Transport Layer Security (SSL/TLS) is the normal form of encryption, which Casado doesn't see as being entirely sufficient for virtualized data center application traffic. With DNE, an entire application workflow is encrypted as packets traverse a network, he explained.</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">Additionally, with SSL/TLS, there is often a challenge with authenticity and validating the integrity of a given connection. Certificate Authorities (CAs) are the general way that SSL/TLS integrity is maintained, but it's not without challenges, Casado said. With DNE, the challenge of authenticity is somewhat reduced, given that it's intended to be a data center technology.</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">"In the data center, we know all the end-points, so we don't have to rely on a public authority," Casado said.</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">Yet SSL/TLS has a role to play in the DNE world that VMware is now building. Casado explained that DNE is an infrastructure-level technology. So, for example, with a virtual network, there is a virtual switch and router, and with DNE, all packets will be encrypted between them.</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">"So there is some infrastructure, but it doesn't do anything at the application layer above it," Casado said. "I think you need to protect at every layer."</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">The DNE effort at VMware is currently under active development with code being written, though it's not yet entirely clear when the technology will become generally available.</span></span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;"><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 14px; line-height: 19px; text-align: justify;">"This is something we're investing in materially with research and development resources, right now," Casado said.</span></span></div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Internet Security news Vulnerabilities VMware Aims to Use Encryption to Secure Virtualization

Network virtualization is a backbone that security can make use of with an approach VMware is referring to as Distributed Network En...

Zero-Day Flaw in Magento Tool Exploited in the Wild

2:36 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7zSVtPdfeJNVN3vBpVR9mRm2BtxNkb1coRCQnEwUFOA6Whleve7YCH6Q6eWycMCMOYhiYdUiq9-D_h3fxwwg6tISiym42hpoEGg31cWZsESAhyvyLfpcCqnH_-NvedJ7ORDlT2mKGoJ0/s1600/Zero-Day-Flaw-in-Magento-Tool-Exploited-in-the-Wild.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7zSVtPdfeJNVN3vBpVR9mRm2BtxNkb1coRCQnEwUFOA6Whleve7YCH6Q6eWycMCMOYhiYdUiq9-D_h3fxwwg6tISiym42hpoEGg31cWZsESAhyvyLfpcCqnH_-NvedJ7ORDlT2mKGoJ0/s640/Zero-Day-Flaw-in-Magento-Tool-Exploited-in-the-Wild.gif" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Thousands of online shops powered by eBay’s Magento ecommerce platform could be vulnerable to hacker attacks due to a security hole in a popular third-party tool.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to researchers at Trustwave, the <a href="https://www.trustwave.com/Resources/SpiderLabs-Blog/Zero-day-in-Magmi-database-client-for-popular-e-commerce-platform-Magento-targeted-in-the-wild/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">vulnerability</a> exists in Magmi, a mass importer tool that allows users to import a large number of products faster and more efficiently compared to the default system in Magento.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Magmi, developed as a Magento database client, is available for download on both <a href="https://github.com/dweeves/magmi-git" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">GitHub</a>and <a href="http://sourceforge.net/projects/magmi/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">SourceForge</a>, and while the versions offered on the two websites should be synchronized, experts discovered that the one from SourceForge includes a file (download_file.php) that makes Magento installations vulnerable to attacks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The problem with “download_file.php” is that it opens a file specified in the request parameter without conducting the checks required to prevent directory traversal attacks. Since Magmi is usually installed on the server in the same folder as Magento, attackers can exploit the directory traversal vulnerability to access sensitive files.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Trustwave started seeing attacks exploiting this vulnerability last month. The HTTP requests observed by the security firm attempt to exploit the weakness to obtain Magento site credentials and database encryption keys.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“The vulnerability can only be exploited if the Magmi installation including the ‘\web’ location is not secured. It's best to protect Magmi wherever it resides using HTTP basic authentication or other methods,” Trustwave’s Assi Barak explained in a blog post. “If you installed Magmi without securing it, you're already vulnerable because credentials can be found in the Magmi UI admin pages. However, the directory traversal vulnerability in download_file.php makes the attack much easier to perform using a single GET request.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">As experts have pointed out, the Magmi version hosted on GitHub has been updated recently, but the version offered on SourceForge was last updated in December 2014. Considering that Magmi was downloaded from SourceForge nearly 30,000 times this year, a large number of websites could be vulnerable. Experts believe many users have downloaded Magmi from SourceForge because it’s the first result in a Google search for “magmi.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After being alerted by Trustwave, Magento said it identified 1,700 apparently vulnerable websites, whose owners have been contacted. Sebastien Bracquemont, aka “dweeves,” the developer of Magmi, has also been notified, but the issue appears to remain unpatched.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Magento platform is used by more than 240,000 merchants, which makes it a tempting target for malicious actors. In April, Check Point Software reported uncovering a critical flaw in Magento that could be leveraged to gain access to sensitive information, including payment card data. Experts noticed malicious attempts to exploit the vulnerability within 24 hours after disclosure.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Latest News Security news Vulnerabilities Zero-Day Flaw in Magento Tool Exploited in the Wild

Thousands of online shops powered by eBay’s Magento ecommerce platform could be vulnerable to hacker attacks due to a security hole in...

Recently Patched Adobe Flash Versions Hit by Another Zero-day Exploit

10:36 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_mEUGcUz-cQKDtiCB66qUMsPRP3Ycrg91dsP-wGBS03QvxXSfsFuHYu3cQP4lu5fBfJX-txDyrFM_rNTjGDWkvCay7E-Xzp3FQls-EuS7vxCGOcsuuzW361BU-VjdIUWQIwml3SFb9k/s1600/adobe-flash-exploit-update%255B1%255D.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy_mEUGcUz-cQKDtiCB66qUMsPRP3Ycrg91dsP-wGBS03QvxXSfsFuHYu3cQP4lu5fBfJX-txDyrFM_rNTjGDWkvCay7E-Xzp3FQls-EuS7vxCGOcsuuzW361BU-VjdIUWQIwml3SFb9k/s640/adobe-flash-exploit-update%255B1%255D.png" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Does <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Adobe Flash</b>, the standard that animated the early Web, needs to Die?</i></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
Unfortunately, <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Yes.</b></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
Despite Adobe’s best efforts, Flash is not safe anymore for Internet security, as a recent zero-day Flash exploit has been identified.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
Just Yesterday Adobe released its monthly <a href="https://helpx.adobe.com/security/products/flash-player/apsb15-25.html" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">patch update</a> that addressed a total of 69 critical vulnerabilities in Reader, Acrobat, including 13 critical patches for Flash Player.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
Now today, Security researchers have <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/" rel="nofollow" style="border: 0px; color: #3d5a99; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: bold; line-height: inherit; margin: 0px; outline: none; padding: 0px; text-decoration: none; vertical-align: baseline;" target="_blank">disclosed</a> a new zero-day vulnerability in fully patched versions of Adobe Flash, which is currently being exploited in the wild by a Russian state-sponsored hacking groups, named “<b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Pawn Storm</b>”.</div>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<br /></div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>
<div style="background-color: white; border: 0px; font-family: 'PT Sans', arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 30px; margin: 0px; outline: 0px; padding: 0px; text-align: justify; vertical-align: baseline;">
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<h3 style="border: 0px; font-family: inherit; font-size: 1.4em; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
NO Patch For Latest Flash Exploit</h3>
</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
That means, even users with an entirely up-to-date installation (<i style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">versions 19.0.0.185 and 19.0.0.207</i>) of the Flash software are also vulnerable to the latest zero-day exploit.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Luckily, for the time being, this exploit is only being used against Government agencies and several foreign affairs ministries from around the globe.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
However, now, when the zero-day vulnerability is publicly known to everyone, hackers could exploit it to target innocent Flash Player users too.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Adobe has been notified of latest discovery and researchers are also working with them to address this flaw.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Readers are advised to disable or completely uninstall Adobe Flash Player immediately.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<h3 style="border: 0px; font-family: inherit; font-size: 1.4em; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
“OYE Flash! Enough is Enough”, said The Internet</h3>
<div>
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzoIADTxAFX7ox38qCgzvGZQAkcHSCOKXMMsfG6-YMau9qd6W4Qml0Qy8PXtUNMilRYbJMid8tYLOuStCaZ6L_Jb5j1f1UuS_nIUMy28LBtHRpJ1n5q8JsQXgp12nXdDYLHbUSlxI2dQE/s1600/adobe-flash-player%255B1%255D.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzoIADTxAFX7ox38qCgzvGZQAkcHSCOKXMMsfG6-YMau9qd6W4Qml0Qy8PXtUNMilRYbJMid8tYLOuStCaZ6L_Jb5j1f1UuS_nIUMy28LBtHRpJ1n5q8JsQXgp12nXdDYLHbUSlxI2dQE/s640/adobe-flash-player%255B1%255D.png" width="640" /></a></div>
<div>
<br /></div>
<div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Adobe Flash Player is dead and its time has passed. In January this year, YouTube moved away from Flash for delivering videos.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
In between, Flash made an effort to beef up its security in an effort to justify its existence.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
However, things got a bit heated when Firefox became aware of a critical security flaw and blocked the Flash plugin entirely.</div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<br style="content: " "; display: block; margin: 20px 0px 0px; outline: 0px; padding: 0px;" /></div>
<div style="border: 0px; font-stretch: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
Facebook’s Security Chief publicly called for Adobe to announce a <b style="border: 0px; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; line-height: inherit; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">kill-date for Flash</b> and Google Chrome has also begun blocking auto-playing Flash ads by default.</div>
</div>
</div>
</div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Latest News Security news Vulnerabilities Recently Patched Adobe Flash Versions Hit by Another Zero-day Exploit

Does Adobe Flash , the standard that animated the early Web, needs to Die? Unfortunately, Yes. Despite Adobe’s best efforts...

Latest Hacking News And Events - dA1337