Collaborate Disseminate
Today we are publishing a SpiderLabs Advanced Threat Report that details a major cyberattack targeting banks mainly located in post-Soviet states. All the attacks share a common profile and the finely tuned orchestration of the entire operation shows a… Continue reading Post-Soviet Bank Heists: A Hybrid Cybercrime Study
October is here and brings with it patches for 62 CVEs and a handful of additional advisories. 28 of the vulnerabilities patched are rated “Critical” and 34 are rated “Important”. The largest number of vulnerabilities patched (18 total) reside in…
Continue reading Microsoft Patch Tuesday, October 2017
Trustwave Spiderlabs is pleased to announce the release of CorSigs version 4.50 for Trustwave Web Application Firewall (WAF) versions 7.6, 8.0 and 8.5. These rules are written to detect attacks or classes of attacks on web applications and their compon… Continue reading Trustwave Web Application Firewall Signature Update 4.50 Now Available
Trustwave Spiderlabs is pleased to announce the release of CorSigs version 4.50 for Trustwave Web Application Firewall (WAF) versions 7.6, 8.0 and 8.5. These rules are written to detect attacks or classes of attacks on web applications and their compon… Continue reading Trustwave Web Application Firewall Signature Update 4.50 Now Available
Authors: Dr. Fahim Abbasi and Nicholas Ramos We witnessed a widespread phishing campaign targeting O2 customers, that surfaced on 18th August, 2017 and continued intermittently until 21st August, 2017. Telefonica UK Limited, trading as O2, is a major t… Continue reading Emotet lives another day using Fake O2 invoice notifications
The seventh entry on the most recent OWASP Top 10 release (from 2013, due to the 2017 release candidate being rejected!) is “Missing Function Level Access Control”, which is essentially what leads to Privilege Escalation issues. This common vulnerabili… Continue reading Introducing Burplay, A Burp Extension for Detecting Privilege Escalations
The seventh entry on the most recent OWASP Top 10 release (from 2013, due to the 2017 release candidate being rejected!) is “Missing Function Level Access Control”, which is essentially what leads to Privilege Escalation issues. This common vulnerabili… Continue reading Introducing Burplay, A Burp Extension for Detection Privilege Escalations
We have released new commercial rules for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules’ purpose is to protect against new emerging attacks that target vulnerabilities in public software. For this release we would like to highl… Continue reading ModSecurity Web Application Firewall – Commercial Rules Update(3)
Authors: Dr. Fahim Abbasi and Rodel Mendrez We witnessed a sophisticated phishing campaign on 16th August 2017, targeting victims by sending spoofed phishing email messages appearing to come from Xero. Xero is a New Zealand-based software company that … Continue reading Malware Xeroing in on Cloud Accounting Customers
Recently we announced the first release candidate for libModSecurity (also as known as ModSecurity version 3). The goal was to turn ModSecurity into a mature library that could be used seamlessly regardless of web server or platform. The motivations fo… Continue reading ModSecurity version 3.0.0 first release candidate