CVE-2013-0422

Another day, another news about a clamorous data breach, this time the Reuters agency revealed that Microsoft suffered a major security breach back in 2013. According to five former employees, hackers broke into the company vulnerabilities and bug reports database, but the news was never disclosed. The former employees explained that Microsoft addressed all the […]

What is old may not always be new, but when it comes to hacking, it’s still effective.

Due to the constant growth in the number of cyber attacks it is necessary to properly define the actions composing an incident response plan. FireEye firm published an interesting post on the need of incident response (IR) capabilities to reply numerous cyber attacks that daily hit almost any web service. Starting from the data proposed […]

Several media sites, including two Washington, DC-based radio stations, have been compromised to infect unsuspecting visitors’ systems with fake antivirus software.

Exploit Kit authors must really love Java . Not only is it ripe with vulnerabilities but its own language provides a…

As researchers find more security flaws in Oracle Java, the software continues to be used for exploitation and malware delivery. This…

Researchers at Kaspersky Lab and Crysys Lab have discovered two previously-unknown infections mechanisms for MiniDuke, the cyber-espionage malware linked to attacks across the globe.

Researchers from Kaspersky and CrySyS Lab continue to analyze the MiniDuke backdoor and have discovered two previously unknown infection mechanisms. Recently discovered to have been used to attack multiple government entities and institutions worldwide, MiniDuke is highly customized and very small in size, and was spotted being delivered to victims via malicious PDF documents rigged with exploits attacking Adobe Reader versions 9, 10, and 11, bypassing its sandbox. But, as it turns out, this might … More →

Exploit kit, a name which has become depressingly familiar, crimaware kit that contains malicious code to exploit principal vulnerabilities in large consume product such as browsers, last news is that a new kit named Whitehole has emerged on the underground market. Generally the exploit kits are malicious Web-based applications designed to install malware on computers […]

The name BlackHole looms large over the marketplace for crimeware kits, but a new player is said to have emerged with similar code and a similar name.

A new exploit kit called Whitehole has emerged on the underground market, providing cybercriminals with one more tool to infect computers with malware over the Web, security researchers from antivirus vendor Trend Micro reported Wednesday. Exploit kits are malicious Web-based applications designed to install malware on computers by exploiting vulnerabilities in outdated browser plug-ins like […]

The effectiveness of exploit kits has made them malware peddlers’ preferred way of distributing their malicious wares. The Blackhole exploit kit is, by far, the most most used one, and has pretty much cornered the market at the moment, but there are other kits out there looking to challenge its supremacy. Among them is a new exploit kit that has been dubbed “Whitehole” by researchers for the simple reason of differentiating it from Blackhole. Whitehole … More →

UPDATE: As of 1/28, the Facebook page for Malwarebiter appears to have been deleted.Overview A few days ago Malwarebytes Intelligence Analyst Adam…

Watering hole attacks continue unabated and, according to Avast’s Director of Threat Intelligence Jindrich Kubec, the finger could be safely pointed to China once again. The latest website compromised to redirect visitors to sites serving exploits for the recently patched IE zero-day vulnerability and two Java flaws (CVE-2013-0422 and CVE-2011-3544) is the official site of Reporters Without Borders (Reporters sans Frontières), an international non-governmental organization advocating freedom of the press and freedom of information. “Such … More →

The website for Reporters Without Borders was booby-trapped to deliver malicious software using the latest Java and Internet Explorer vulnerabilities, security vendor Avast said on Tuesday. Reporters Without Borders, based in Paris, is an international advocate for press freedom. Avast, which discovered the site had been tampered with, said the group’s profile makes it “an […]

The latest Java zero-day flaw has the tech world in an uproar. This newest hole, actively exploited in the wild, was patched by Oracle yesterday — only to have multiple ultratrusted security gurus saying Oracle didn’t address every bug and some even maintaining it could take Oracle two years to fix all the vulnerabilities. You know […]

After the Department of Homeland Security’s US-CERT warned users to disable Java to stop hackers from taking control of users’ machines, Oracle issued an emergency patch on Sunday. Last week, Carnegie Mellon University (CMU) Software Engineering Institute (SEI) CERT Program warned that the newest Java “vulnerability is being attacked in the wild, and is reported […]

Oracle released two out-of-band patches on Sunday for vulnerabilities in its Java programming language, both of which pose a high risk to users browsing the web. The company’s speed in issuing patches may be due to part that exploit code for at least one of the vulnerabilities, CVE-2013-0422, has already been wrapped into two “exploit […]

The year is start way for Oracle Java platform, a new Java 0-day vulnerability has been discovered and worldwide security community is very concerned on the potential effect of the bug. We have discovered how much dangerous could be the exploit of a zero-day vulnerability especially against institutional targets and governments (e.g. Elderwood project), state-sponsored hackers […]