CVE-2014-0322

It’s a new year and while some things change, some things stay the same (or similar). There’s lots of FUD about the sophisticated cyber attacks that are multi-threaded and obfuscated. Certainly there are attacks that fall into this category, but if you look at all of the cybercrime activity from the past year, it’s clear that the majority of threats do not have the level of sophistication that is often talked about.

Japanese commercial and critical infrastructure organizations have been targeted a long-running campaign dubbed Operation Dust Storm. Security firm Cylance have uncovered a long-running hacking campaign dubbed ‘Operation Dust Storm’ targeting commercial and critical infrastructure organizations in Japan. Threat actors behind the Operation Dust Storm have been active since at least 2010, the hackers targeted several organizations in Japan, […]

Commercial and critical infrastructure organizations in Japan have been targeted in a multi-year campaign dubbed by researchers “Operation Dust Storm.”

A group has been singled out as the attacker behind the recently disclosed hack against Anthem, believed to be the largest waged against a health care company. It was Black Vine that broke into the health insurer’s systems and stole more than 80 million patients records, Symantec said Tuesday in a report. For Black Vine, […]

Black Vine Espionage Group Attacked Aerospace, Energy, Healthcare Industries Symantec has been monitoring the activities of the cyber espionage group that breached health insurance giant Anthem last year. Researchers say Anthem is just one of the threat actor’s many high profile targets.

What is old may not always be new, but when it comes to hacking, it’s still effective.

Security experts at Trend Micro detected a new banking trojan dubbed TSPY_BANKER.YYSI which uses Pinterest as command and control system. According to researchers at Trend Micro once again, banks in South Korea are targeted by a new financial malware designed to target their customers. The attackers have targeted customers of the principal financial institutions of […]

A new financial malware designed to target the customers of South Korean banks has been spotted in the wild by researchers at Trend Micro.

Continuing a recent trend in which Internet Explorer vulnerabilities are exploited using Flash, samples of an SWF purportedly used in conjunction with CVE-2014-6332 have appeared in several places. The most famous examples of this trend are the exploits for CVE-2014-0322 and CVE-2014-1776. We have yet to encounter the SWF sample with its original exploit attached,

After analyzing public vulnerabilities and exploit trends in the first half of 2014, Bromium Labs concluded that Internet Explorer is the “sweet spot for attackers.” “Internet Explorer was the most patched and also one of the most exploited products,” the report (pdf) states. Microsoft’s browser “set a record high for reported vulnerabilities in the first […]

Use-after-free bugs have affected Internet Explorer for years. In the past year alone, Microsoft patched 122 IE vulnerabilities, the majority of which were use-after-free bugs. This year Microsoft has already patched 126 IE vulnerabilities to date. Of those vulnerabilities, 4 were actively being exploited in the wild. These 4 exploits (CVE-2014-1815, CVE-2014-1776, CVE-2014-0322, CVE-2014-0324) were

Attackers are targeting vulnerabilities in major Web browsers to compromise cloud-based point-of-sale (PoS) systems, according to cyber threat intelligence firm, IntelCrawler. The malware, called POSCLOUD by IntelCrawler, targets cloud-based PoS software commonly used by grocery stores, retailers, and other small businesses, the company wrote in a report released Wednesday. Unlike most PoS malware, POSCLOUD doesn’t bother with RAM scraping to intercept payment card information before the system gets a chance to encrypt the data. Instead, the malware relies on keylogging and stealth screenshots to steal personal information and financial data, which are then sold on underground forums to identity thieves, IntelCrawler said. Researchers initially uncovered the malware after a big botnet takedown, said Andrew Komarov, CEO of IntelCrawler. Many of these cloud systems integrate with locally-attached hardware such as credit card readers, barcode scanners, cash drawers, and receipt printer a…

In February, Microsoft awarded $100,000 to Yu Yang (@Tombkeeper) for reporting a new mitigation bypass technique as part of Microsoft’s Bounty Program. Yu later demonstrated his research at CanSecWest in March. In his slides, he mentioned that a "god mode" of Internet Explorer could be turned on by a one byte overwrite. However, he had

Experts at Symantec have discovered that behind the Elderwood Platform there is a still active group which is providing Zero-Day exploit used recently. Do you remember the Elderwood project? It was September 2012 when Symantec security firm published an analysis that demonstrate the link between a series of cyber attacks against more than 30 companies and the cyber […]

Further investigation into an exploit kit known as “Elderwood” shows the attackers using it are more numerous and possibly better funded than previously thought, according to new research from Symantec. Elderwood is a hacking platform that has attack code which abuses software vulnerabilities in programs such as Adobe Systems’ Flash multimedia program and Microsoft’s Internet […]

Researchers at Symantec say the Elderwood attack platform is at the center of numerous zero-day attacks launched by hacker crews around the world this year.

Summary The exploit code used in the recent CVE-2014-1776 attacks shares many similar characteristics with code that exploited CVE-2014-0322 and CVE-2013-3163. The shared techniques, variable names and code structure suggest these exploits share a common author or template. Palo Alto Networks customers are protected by from exploitation of CVE-2014-1776 with content release 433-2194. Late last

Today Microsoft released five security updates, two rated Critical and three rated Important. The March security bulletins address 23 Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Internet Explorer and Silverlight. It’s Patch Tuesday again and MS14-012 is the first one to jump on for March 2014 in order to patch the critical zero-day vulnerability […]

The bad news – attackers have continued to leverage a highly-publicized Internet Explorer vulnerability. The good news is however that vulnerability now has a patch.

Last week Microsoft has announced that today’s Patch Tuesday will include a fix for the critical IE zero-day vulnerability that was found exploited in watering hole attacks earlier this year – and none too soon, as a number of bad actors have been using the same exploit code in other similar attack since then. Initially, the exploit was used to compromise the visitors of a fake French aerospace association GIFAS site and the legitimate but … More →

Earlier this month, security researchers from FireEye discovered a new IE 10 Zero-Day exploit (CVE-2014-0322) that was being used in a watering hole attack on the US Veterans of Foreign Wars’ website.

The number of attacks exploiting a yet-to-be-patched vulnerability in Internet Explorer has increased dramatically over the past few days, indicating the exploit is no longer used just in targeted attacks against particular groups of people. The vulnerability affects Internet Explorer 9 and 10 and was publicly revealed on Feb. 13 by researchers from security firm […]

Microsoft said it is investigating an Internet Explorer vulnerability at the center of reports of attacks against IE 10.

Here’s an overview of some of last week’s most interesting news and articles: Account details of 27,000 Barclays customers stolen, sold to brokers (In)famous UK-based multinational bank Barclays has been hit this Friday with claims that someone has stolen personal and financial information of some 27,000 of its customers and has been selling it to City traders. Sochi security forbids journalists to use private Wi-Fi The Winter Olympics in Sochi are under way, and we … More →

Security researchers from FireEye have recently discovered a new IE 10 Zero-Day exploit being used in a watering hole attack. Security experts at FireEye discovered a new IE 10 Zero-Day exploit (CVE-2014-0322) being used in a watering hole attack on the US Veterans of Foreign Wars (VFW) website. The zero-day allows the attacker to modify one byte […]

An Internet Explorer zero-day vulnerability (CVE-2014-0322) is actively exploited in the wild in a watering-hole attack targeting visitors to the official website of the U.S. Veterans of Foreign Wars, FireEye researchers warned on Thursday. “It’s a brand new zero-day that targets IE 10 users visiting the compromised website – a classic drive-by download attack. Upon successful exploitation, this zero-day attack will download a XOR encoded payload from a remote server, decode and execute it,” they … More →

Security researchers from FireEye have discovered a new IE 10 Zero-Day exploit (CVE-2014-0322) being used in a watering hole attack on the US Veterans of Foreign Wars’ website. Dubbed “ Operation SnowMan ” by FireEye, the attack targets IE 10 with Adobe Flash.

A new and currently unpatched flaw affecting Internet Explorer 10 (CVE-2014-0322) has been discovered on some highly targeted websites, indicating a…