Threat Post

Risks Limited With Latest Apache Bug, Optionsbleed

Threat Post - 37 min 51 sec ago
The risks surrounding the latest Apache bug, called Optionsbleed, are limited given it can only be attacked under certain conditions. Apache, and many Linux distributions, have patched the flaw.
Categories: Threat Post

Attackers Use Undocumented MS Office Feature to Leak System Profile Data

Threat Post - Mon, 09/18/2017 - 4:33pm
An undocumented Microsoft Office feature allows for spying via specially crafted Word documents—no macros, exploits or any other active content needed.
Categories: Threat Post

Pirate Bay Spotted Hosting Monero Cryptocurrency Miner

Threat Post - Mon, 09/18/2017 - 2:19pm
A cryptocurrency miner surfaced on The Pirate Bay for a day over the weekend.
Categories: Threat Post

200K WordPress Sites Exposed to Rogue Version of ‘Display Widgets’

Threat Post - Fri, 09/15/2017 - 3:54pm
A rogue version of the WordPress plugin called “Display Widget” allowed third-parties to injecting spam advertising content into victims’ sites.
Categories: Threat Post

VMware Patches Bug That Allows Guest to Execute Code on Host

Threat Post - Fri, 09/15/2017 - 11:51am
Users who run four different types of VMware products, ESXi, vCenter Server, Fusion and Workstation, are being encouraged to update to address a series of vulnerabilities, one critical.
Categories: Threat Post

Equifax Confirms March Struts Vulnerability Behind Breach

Threat Post - Thu, 09/14/2017 - 4:00pm
Equifax divulged on Wednesday that the culprit behind this summer's breach of 143 million Americans was an Apache Struts vulnerability, CVE-2017-5638, patched back in March.
Categories: Threat Post

Premium SMS Malware ‘ExpensiveWall’ Infects Millions of Android Devices

Threat Post - Thu, 09/14/2017 - 2:49pm
Google has ejected 50 apps from its Google Play store that were harboring mobile malware dubbed ExpensiveWall.
Categories: Threat Post

Thousands of Elasticsearch Servers Hijacked to Host PoS Malware

Threat Post - Wed, 09/13/2017 - 3:51pm
Over 4,000 insecure Elasticsearch servers have been hosting the point-of-sale malware Alina and JackPoS.
Categories: Threat Post

Zerodium Offering $1M for Tor Browser Zero Days

Threat Post - Wed, 09/13/2017 - 12:54pm
Exploit acquisition vendor Zerodium said Wednesday it will pay up to $1M for an unknown Tor Browser zero day.
Categories: Threat Post

Microsoft Patches .NET Zero Day Vulnerability in September Update

Threat Post - Tue, 09/12/2017 - 3:59pm
Microsoft fixes 25 critical vulnerabilities including one zero day under attack and one tied to the high-profile BlueBorne attack vector.
Categories: Threat Post

Adobe Fixes Eight Vulnerabilities in Flash, RoboHelp, Flash Player

Threat Post - Tue, 09/12/2017 - 3:27pm
Adobe fixed eight vulnerabilities across three products, Flash Player, RoboHelp for Windows, and ColdFusion, as part of its September Patch Tuesday updates.
Categories: Threat Post

FreeXL Library Fixes Two Remote Code Execution Vulnerabilities

Threat Post - Tue, 09/12/2017 - 11:54am
Researchers warned Monday of two remote code execution vulnerabilities in FreeXL that could let an attacker execute code with local user privileges.
Categories: Threat Post

Wireless ‘BlueBorne’ Attacks Target Billions of Bluetooth Devices

Threat Post - Tue, 09/12/2017 - 9:00am
Bluetooth attack vector, dubbed ‘BlueBorne’, leaves billions of smart Bluetooth devices open to attack including Android and Apple phones and millions more Linux-based smart devices.
Categories: Threat Post

Apache Foundation Refutes Involvement in Equifax Breach

Threat Post - Mon, 09/11/2017 - 3:02pm
The Vice President of the Apache Struts PMC says the attackers likely used an unknown Struts zero day or an earlier announced vulnerability.
Categories: Threat Post

Popular D-Link Router Riddled with Vulnerabilities

Threat Post - Mon, 09/11/2017 - 2:09pm
D-Link router model 850L has 10 vulnerabilities that could allow a hacker to gain remote access and control of device, according to researcher.
Categories: Threat Post

Android Users Vulnerable to ‘High-Severity’ Overlay Attacks

Threat Post - Sat, 09/09/2017 - 10:00am
Android phones not running the latest Oreo OS are vulnerable to a high-severity “toast” overlay attack.
Categories: Threat Post

Many Questions, Few Answers For Equifax Breach Victims

Threat Post - Fri, 09/08/2017 - 1:23pm
Victims of the massive Equifax breach may have to wait days to find out if they were impacted.
Categories: Threat Post

Equifax Says Breach Affects 143 Million Americans

Threat Post - Thu, 09/07/2017 - 7:11pm
Equifax, one of the three largest credit agencies in the United States, disclosed Thursday afternoon it's looking into a data breach that may have affected upwards to 143 million Americans.
Categories: Threat Post

New Dridex Phishing Campaign Delivers Fake Accounting Invoices

Threat Post - Thu, 09/07/2017 - 3:24pm
A new variant of the banking trojan Dridex is part of a sophisticated phishing attack targeting users of the cloud-based accounting firm Xero.
Categories: Threat Post

Microsoft Won’t Fix Security Bypass Vulnerability in Edge

Threat Post - Thu, 09/07/2017 - 2:24pm
Microsoft is opting to stand pat and not fix a content security bypass vulnerability in its Edge browser, something researchers warn could potentially lead to the disclosure of confidential information.
Categories: Threat Post

Pages