Vulnerabilities and exploits

This month’s Adobe Security Update round is a relatively quiet one, in contrast to the Microsoft patch cycle. There are two bulletins, one affecting Flash Player and one affecting ColdFusion. After the discovery of a major breach at Adobe recently some would perhaps have expected a bigger number of CVEs to get patched this round. It will be

Microsoft’s November 2013 Patch Tuesday delivers a set of three critical Bulletins and five Bulletins rated “important”. This month’s MS13-088 patches eight critical vulnerabilities and two important vulnerabilities in Internet Explorer. Overall, Microsoft is addressing 19 issues in Internet Explorer, Office and Windows itself. The star of the show is MS13-090 which addresses CVE-2013-3918, an

On November 5, Microsoft announced the discovery of a new vulnerability CVE-2013-3906 which can be exploited when TIFF images are processed. By exploiting this vulnerability it is possible to attack software – including Microsoft Office and Lync – that uses a vulnerable DLL for processing TIFF images. On the same day, there were reports that Microsoft had recorded attacks

As Bitcoin reached an all-time high of $327/BTC, news about yet another huge robbery hit the world of crypto-currencies. One of the relatively new “Bitcoin banking” services named inputs.io claimed it has been compromised by hackers. The attackers were able to penetrate the server on October 23 and 26 and transfer 4100 BTC (approximately US$1.2 million). According to

One of the biggest problems facing the IT security industry is the use of vulnerabilities in legitimate software to launch malware attacks. In our new study we decided to focus on Oracle Java. This choice reflects the huge increase in attacks on this product over the past year.

During the last days, several high profile domains have been defaced including domains from two prominent security companies. In addition to these, high profile domains such as alexa.com, whatsapp.com and redtube.com were also defaced. From our quick analysis It does not seem that the actual webserver has been compromised, the most possible attack vector was

Microsoft’s 2013 Treehouse of Horror Bulletins include a long list of fixes for memory corruption vulnerabilities effecting mostly previous versions of the software, and not the latest versions. Of immediate interest to most Windows users are the critical vulnerabilities being patched in Internet Explorer, multiple Windows drivers, and the .Net Framework which even effects the

Learn about the new Internet Explorer vulnerability – CVE-2013-3893, affecting IE versions 6 through 11 for platforms from Windows XP through Windows 8.1.

As a security analyst we often get asked the question: “What threats and vulnerabilities do you expect us to see in the future?” This is a very interesting question but also an indication that the way we think about and discuss IT-security is fundamentally wrong. Do we really need to invest time and resources to focus on

Microsoft releases a long list of security bulletins this month on the server and client side, patching a longer list of vulnerabilities in this month’s array of technologies. Only four of the bulletins are rated “critical” this month: Internet Explorer, a variety of built-in Windows components, and Sharepoint and Office Web Services. Thirteen security bulletins

In this article, we discuss how a computer can be infected using the BlackHole exploit kit and the relevant protection mechanisms that can be employed.

We’re currently seeing a spam run which involves a (fake) report from CNN saying that the US have started bombing Syria. Clicking the shortened link will lead to an exploit kit which targets older, vulnerable versions of Adobe Reader and Java. The attackers favor using the Java exploit over the Reader exploit, as Java exploits

We’ve discovered Backdoor.AndroidOS.Obad.a is the first malware being distributed using botnets that were created using completely different mobile malware.

While I was investigating the Trojan.JS.Iframe.aeq case one of the files dropped by the Exploit Kit was an Applet exploiting a vulnerability.

Not many weeks ago Google released a new revision of its flagship mobile operating system, Android 4.3. Although some say that this time updates have been quite scarce, from a security perspective there have been some undeniable improvements (among others, the “MasterKey” vulnerability has been finally patched). One of the most prominent is SELinux. Many