Collaborate Disseminate
Researcher Matt Nelson disclosed another Windows UAC bypass, this one abusing the sdclt.exe backup and restore utility to execute a payload without triggering an alert. Continue reading Fileless UAC Bypass Uses Windows Backup and Restore Utility
Today’s WikiLeaks Vault 7 Dark Matter release shows the CIA’s capabilities to attack and persist on Apple iPhone and Mac firmware and an apparent interdiction of the iPhone supply chain. Continue reading WikiLeaks Dump Shows CIA Interdiction of iPhone Supply Chain
Bruce Schneier and Orin Kerr have written a paper that explains the technological and legal issues associated with six encryption workarounds available to law enforcement. Continue reading Paper Spells Out Tech, Legal Options for Encryption Workarounds
Jigsaw and Google said they would offer a free suite of security tools aimed at securing political elections. Continue reading Google, Jigsaw Partner on Free Tools to Secure Elections
Researchers at ERPScan today disclosed details and a proof-of-concept exploit for a SAP GUI remote code execution vulnerability patched last week. Continue reading SAP Vulnerability Puts Business Data at Risk for Thousands of Companies
A severe vulnerability has been disclosed in libpurple, the library used in the development of a number of popular instant messaging clients, including Adium for the macOS platform. Continue reading Code Execution Vulnerability Found in Libpurple IM Library
Since January, a number of ransomware families are sharing a common infrastructure with different techniques allowing the malware to hide from detection systems. Continue reading Locky, Cerber Ransomware Skilled at Hiding
A researcher has published a method by which a local admin can hijack any other Windows sessions without the need for credentials. Continue reading Local Windows Admins Can Hijack Sessions Without Credentials
Researchers at SEC Consult disclosed a command injection vulnerability in Ubiquiti Networks gear for ISPs after a private disclosure to the vendor in November went unresolved. Continue reading Vulnerability Disclosed in Ubquiti Networks Admin Interface
Researchers at SEC Consult disclosed a command injection vulnerability in Ubiquiti Networks gear for ISPs after a private disclosure to the vendor in November went unresolved. Continue reading Vulnerability Disclosed in Ubquiti Networks Admin Interface