Collaborate Disseminate
(Analysis by Lena Frid, Bar Menachem and Victor Hora) Shortly after the recent Drupalgeddon vulnerabilities hit the popular content management system, new vulnerabilities were discovered. As reported by PortSwigger Web Security, Drupal versions 8.x are… Continue reading Drupal Cache Poisoning SA-CORE-2018-005
Overview WCX files can be used to configure a Microsoft Workplace on a system with a couple of clicks. The enrollment process could disclose credentials in the form of a NetNTLM hash. Authentication will either take place automatically on older…
Continue reading Firework: Leveraging Microsoft Workspaces in a Penetration Test
On July 17th 2018 Oracle released Critical Patch Update (CPU) in accordance with their predefined schedule. That collection of patches officially included fixes for 3 security vulnerabilities for Oracle Database Server versions 11.2.0.4, 12.1.0.2, 12.2… Continue reading Oracle Critical Patch Update July 2018 and Security Alert for CVE-2018-3110
A cross site scripting (XSS) vulnerability exists in Apache ActiveMQ prior to version 5.15.5. Apache ActiveMQ is a popular open source message broker acting as a middle man to communicate data between other software. The vulnerability is a reflected XS… Continue reading CVE-2018-8006: XSS in Apache ActiveMQ
Evading AV detection is part of a malware author’s routine in crafting spam campaigns and an old and effective way of achieving this is spamming a password protected document. Recently, we observed such a password protected document being spammed out,…
Continue reading Password Protected Word Document Delivers HERMES Ransomware
Last week we wrote about some malicious spam containing Microsoft Publisher files, leading to the FlawedAmmyy RAT, where the actors behind the campaign were targeting banks. The same actors have resumed business today, however this time, they embedded … Continue reading Bank Malspam Revisited
It’s very unusual for malware authors to utilize publishing software like Microsoft Publisher which is mainly used for fancy documents and desktop publishing tasks. So when we saw an email sample with a .pub attachment (Microsoft Office Publisher file)… Continue reading Malspam Campaign Targets Banks Using Microsoft Publisher
Patch Tuesday, August 2018 Just as Defcon/BSides/BlackHat wraps up in Las Vegas, August’s Patch Tuesday is here to remind us of the importance of patching. Today’s release brings with it 4 “Defense in Depth” Advisories and patches for 60 CVEs….
Continue reading Patch Tuesday, August 2018
Social Mapper is a Social Media Enumeration & Correlation Tool
Continue reading Mapping Social Media with Facial Recognition: A New Tool for Penetration Testers and Red Teamers
Social Mapper is a Social Media Enumeration & Correlation Tool
Continue reading Mapping Social Media with Facial Recognition: A New Tool for Penetration Testers and Red Teamers