vulnerability | Page 6


A few months ago, Tinba’s source code was leaked in the wild. It is now inevitable that a different and enhanced version of it is out there. Tinba, also known as Tiny Banker, made its debut a couple of years ago. Though it is small, it is capable of doing what its big brothers can do. For more details on some of its features, you can read my article posted on Virus Bulletin. 64-bit Injected Code As expected, we have seen some new changes added to the original malware. Tinba is now capable of injecting its code into a 64-bit running process. The... [Read More]
by RSS Raul Alvarez  |  Oct 06, 2014  |  Filed in: Security Research
While the Shellshock story is taking the media by storm, and as the reports of exploitation in the wild start to emerge, some questions about the worse-than-heartbleed infamous bug remain unanswered. "Will there be a Slammer-like worm owning half of the Internet within a few hours?", "Besides Apache, DHCP and SSH, are there other ways to remotely set environment variables?", "Has the NSA known about it for 20 years?", "Are iOS and Android vulnerable?"... While here at FortiGuard Labs, we have our own opinion on all of these questions, the one we... [Read More]
by RSS Guillaume Lovet  |  Sep 26, 2014  |  Filed in: Security Research
[Read More]
by RSS Michael Perna  |  Sep 13, 2014  |  Filed in: Industry Trends
[Read More]
by RSS Michael Perna  |  Aug 29, 2014  |  Filed in: Industry Trends
[Read More]
by RSS Michael Perna  |  Jul 26, 2014  |  Filed in: Industry Trends
The Isolated Heap for DOM objects included in the Microsoft Patch Tuesday for June 2014 was just a fire drill aimed at making the exploitation of use-after-free (UAF) vulnerabilities more difficult. The patch for July 2014, however, has been quite a shock to exploit developers! In this release, Microsoft showed some determination in fighting back against UAF bugs with this improvement - the introduction of a new memory protector in Microsoft Internet Explorer, which would make exploitation of UAF vulnerabilities extremely difficult. An Overview... [Read More]
by RSS Zhenhua 'Eric' Liu  |  Jul 16, 2014  |  Filed in: Security Research
Exploit developers should be very excited recently; lots of big bombs have been dropped to the community. In February, Yang Yu was awarded the Microsoft mitigation bypass bounty, the top prize in Microsoft Bounty Programs. He talked about parts of his mitigation bypass in his presentation at CanSecWest 2014. However, the most interesting part - the so-called "Vital Point Strike" - was just left as blurred pages in his slides. Soonafter, another security researcher, Yuki Chen, published ExpLib2, which is Yuki's exploitation library for Internet... [Read More]
by RSS Zhenhua 'Eric' Liu  |  Jun 16, 2014  |  Filed in: Security Research
Hong Kei Chan, Junior AntiVirus Analyst On April 26, 2014, Microsoft published an advisory for a critical vulnerability in Internet Explorer (CVE-2014-1776) that would allow attackers to perform remote code execution. This zero-day vulnerability affects Internet Explorer 6 through 11, but is targeted mostly toward IE 9 through 11. The attack exploits the use-after-free vulnerability in IE by utilizing Adobe Flash Player to bypass the Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). This blog post will step through... [Read More]
by RSS Hong Kei Chan  |  May 27, 2014  |  Filed in: Security Research
Today Adobe announced an out-of-cycle emergency patch for their ubiquitous Flash Player software. The patch impacts Windows, Mac OS X and Linux users of Flash Player. Normally when a patch like this is released, it is due to an unpatched vulnerability being actively exploited in the wild and impacting users. Adobe's full bulletin can be read here; it appears that this is a remote code execution vulnerability that would allow an attacker to deliver malware to their target computer. I would encourage all users to update their computers right away,... [Read More]
by RSS Richard Henderson  |  Feb 04, 2014  |  Filed in: Industry Trends
Zerg Rush - Image courtesy of http://sheezyart.com/art/view/1244706/ As you probably do not know, I am a StarCraft II player. I really hadn't expected it to be of any use to my job as an analyst, until yesterday where I read this tweet: "I don't even know what 'zerg rush' means and now I can't google for answer either" This is about the first time I am going to be able to boast for some StarCraft culture! Yeah! :)) StarCraft is real time strategy game developed by Blizzard. It features three different races: Zerg, Terran, Protoss. Each race... [Read More]
by RSS Axelle Apvrille  |  Jun 19, 2012  |  Filed in: Security Research