Author Archives: Lucian Constantin

Security researchers have released tools this week that could help users recover files encrypted by two relatively new ransomware threats: Bart and PowerWare.

PowerWare, also known as PoshCoder, was first spotted in March, when it was used in attacks against healthcare organizations. It stood out because it was implemented in Windows PowerShell, a scripting environment designed for automating system and application administration tasks.

Researchers from security firm Palo Alto Networks have recently found a new version of this threat that imitates a sophisticated and widespread ransomware program called Locky. It uses the extension .locky for encrypted files and also displays the same ransom note used by the real Locky ransomware.

To read this article in full or to leave a comment, please click here

Security researchers have released tools this week that could help users recover files encrypted by two relatively new ransomware threats: Bart and PowerWare.

PowerWare, also known as PoshCoder, was first spotted in March, when it was used in attacks against healthcare organizations. It stood out because it was implemented in Windows PowerShell, a scripting environment designed for automating system and application administration tasks.

Researchers from security firm Palo Alto Networks have recently found a new version of this threat that imitates a sophisticated and widespread ransomware program called Locky. It uses the extension .locky for encrypted files and also displays the same ransom note used by the real Locky ransomware.

To read this article in full or to leave a comment, please click here

Dell has patched several critical flaws in its central management system for SonicWALL enterprise security appliances, such as firewalls and VPN gateways.

If left unfixed, the vulnerabilities allow remote, unauthenticated attackers to gain full control of SonicWALL Global Management System (GMS) deployments and the devices managed through those systems.

The SonicWALL GMS virtual appliance software has six vulnerabilities, four of which are rated critical, according to researchers from security firm Digital Defense.

First, unauthenticated attackers could inject arbitrary commands through the system’s web interface that would be executed with root privileges. This is possible through two vulnerable methods: set_time_config and set_dns.

To read this article in full or to leave a comment, please click here

Dell has patched several critical flaws in its central management system for SonicWALL enterprise security appliances, such as firewalls and VPN gateways.

If left unfixed, the vulnerabilities allow remote, unauthenticated attackers to gain full control of SonicWALL Global Management System (GMS) deployments and the devices managed through those systems.

The SonicWALL GMS virtual appliance software has six vulnerabilities, four of which are rated critical, according to researchers from security firm Digital Defense.

First, unauthenticated attackers could inject arbitrary commands through the system’s web interface that would be executed with root privileges. This is possible through two vulnerable methods: set_time_config and set_dns.

To read this article in full or to leave a comment, please click here

Oracle has released a new quarterly batch of security updates for more than 80 products from its software portfolio, fixing 276 vulnerabilities.

This is the largest Oracle Critical Patch Update (CPU) to date. The average number of flaws fixed per Oracle update last year was 161, according to security vendor Qualys. Furthermore, out of the 276 security flaws fixed in this update, 159 can be exploited remotely without authentication.

At the top of the priority list should be the Java patches, which address 13 new vulnerabilities. That’s because Java is used in a lot of applications and is installed on a large number of systems.

“Customers really do need to apply these Java CPU patches as soon as possible,”  said John Matthew Holt, the CTO of application security firm Waratek, via email. Among the patches that require urgent attention are those for the HotSpot Java virtual machine for desktops and servers, which received high CVSS (Common Vulnerabilities Scoring System) scores, Holt noted.

To read this article in full or to leave a comment, please click here

Some of the intrusive techniques used by security, performance, virtualization and other types of programs to monitor third-party processes have introduced vulnerabilities that hackers can exploit.

Researchers from data exfiltration prevention company enSilo found six common security issues affecting over 15 products when they studied how software vendors use ‘hooking’ to inject code into a process in order to intercept, monitor or modify the potentially sensitive system API (application programming interface) calls made by that process.

Most of the flaws enSilo found allow attackers to easily bypass the anti-exploit mitigations available in Windows or third-party applications, allowing attackers to exploit vulnerabilities that they couldn’t otherwise or whose exploitation would have been difficult. Other flaws allow attackers to remain undetected on victims’ computers or to inject malicious code into any process running on them, the enSilo researchers said in a report sent via email that’s scheduled to be published Tuesday.

To read this article in full or to leave a comment, please click here

Some of the intrusive techniques used by security, performance, virtualization and other types of programs to monitor third-party processes have introduced vulnerabilities that hackers can exploit.

Researchers from data exfiltration prevention company enSilo found six common security issues affecting over 15 products when they studied how software vendors use ‘hooking’ to inject code into a process in order to intercept, monitor or modify the potentially sensitive system API (application programming interface) calls made by that process.

Most of the flaws enSilo found allow attackers to easily bypass the anti-exploit mitigations available in Windows or third-party applications, allowing attackers to exploit vulnerabilities that they couldn’t otherwise or whose exploitation would have been difficult. Other flaws allow attackers to remain undetected on victims’ computers or to inject malicious code into any process running on them, the enSilo researchers said in a report sent via email that’s scheduled to be published Tuesday.

To read this article in full or to leave a comment, please click here