Collaborate Disseminate
On July 31st , just after getting back to the office from my talk at RSA Asia 2018 about how cyber criminals use cryptocurrencies for their malicious activities, I noticed a huge surge of CoinHive in Brazil. After a quick…
Continue reading Mass MikroTik Router Infection – First we cryptojack Brazil, then we take the World?
The Trustwave SpiderLabs team has found additional information that we believe may be associated with the recent SingHealth breach. You can read a summary of the breach in a previous post, but as a quick summary, Singaporean authorities announced on…
Continue reading New Indicators Suggest Penetration Vectors and Earlier Dates for the SingHealth Breach
Executive Summary On July 20th 2018, the Singapore authorities announced1 that Singapore’s largest healthcare group SingHealth was targeted by a major cyber-attack, resulting in a breach which affected about 1.5 million patients’ records. The breach wa… Continue reading SingHealth Data Breach – An Analytical Perspective
Trustwave recently discovered a locally exploitable issue in all current versions of Oracle Solaris 10/11 as detailed in the recently posted Trustwave advisory. The issue is present in the kernel and is locally exploitable as an unprivileged user provi… Continue reading CVE-2018-2892 – Kernel Level Privilege Escalation in Oracle Solaris
Recently, a proof-of-concept emerged on how the filetype SettingContent can be abused when getting embedded in Microsoft Office Documents. SettingContent is a feature in Windows 10 which acts as a shortcut to different system settings. Legitimate examp… Continue reading Malicious SettingContent now delivered through PDF
During a recent penetration testing engagement, I came across a particularly interesting web application called RLM, running on the non-standard port 5054, which naturally caught my eye. After a bit of poking around, I was able to identify a critical…
Continue reading Unpatched Remote Code Execution in Reprise License Manager
Authors: Dr. Fahim Abbasi and Diana Lopera We recently observed phishing emails targeting Australian customers with fake MYOB invoices. Instead of the usual HTTP links, these emails were ridden with FTP links pointing to compromised FTP servers. While … Continue reading DanaBot Riding Fake MYOB Invoice Emails
Part of our job as security researchers is keeping up with new tools and techniques used to monitor for malicious or unauthorized activity. Strong encryption is an important security pillar that provides essential privacy and access controls, but of co… Continue reading Inspecting Encrypted Network Traffic with JA3
July’s Patch Tuesday is here with patches for 53 CVEs and the standard roll up of patches for critical remote code execution vulnerabilities in Adobe Flash. Of those 53 CVEs patched, 17 are rated “Critical”, 34 are rated “Important” and…
Continue reading Patch Tuesday, July 2018
(Analysis by Rodel Mendrez and Lloyd Macrohon) Spam Campaign It all started with a spam message, which curiously had an Android App attachment. The spam email vaguely claims that the attachment was a dating app for finding anonymous sex-acquaintances c… Continue reading Red Alert v2.0: Misadventures in Reversing Android Bot Malware