Hackin9

iT News

How Airbus defends against 12 big cyber attacks each year
iT News
Civil aircraft manufacturer Airbus Group is hit by up to 12 major systems attacks each year, its chief information security officer has revealed, mostly through ransomware and state-sponsored hackers. Stephane Lenco told the Australian Cyber Security ...

 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 

Techworm

Meizu Pro 6 takes a feature from the iPhone and also packs great hardware
Techworm
Meizu Pro 6 features a 5.2-inch AMOLED display and has a ton of great and powerful hardware present inside. However, like so many Chinese manufacturers out there, Pro 6 has taken one feature from Apple's iPhone 6s and 6s Plus and that happens to be ...

and more »
 

Earlier this week, PFSense 2.3 was released. The new release changed the name of a function I use in our pfsense log submission client, and the client will fail to parse the logs. I just released a new version of the script, that you can download here:

https://isc.sans.edu/clients/dshieldpfsense.txt (GPG Signature: https://isc.sans.edu/clients/dshieldpfsense.txt.asc ).

If you rather just apply the change to your existing file, find the line (should be line 65):

$flent = parse_filter_line(trim($line));

and replace filter with firewall_log

This should fix the issue. The new client checks what version you are running, so it will work with 2.2 and 2.3. (but only tested with 2.3 right now).

Please let me know if you have any problems! And thanks to those who reported the issue.

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

 

Global Cloud Security Market Expected to Grow Exponentially | @CloudExpo #Cloud
SYS-CON Media (press release)
According to a study the rising number of cloud-specific security attacks are likely to propel the demand for cloud security systems to 20 percent CAGR over the next four years. Adoption of cloud computing services has risen and so have the security ...

 

Enlarge / The number of zero days showed their sharpest rise ever in 2015, reaching a record 54. (credit: Symantec)

The number of attacks that exploited previously unknown software vulnerabilities more than doubled in 2015 as hackers raced against security defenders to find effective ways to infect end users with malware, according to a recently released report.

The number of "zero-day" exploits—a term that was coined because affected software developers have zero days to release a patch that keeps users protected—reached an unprecedented 54, according to researchers at security firm Symantec. That number compared with 24 in 2014, 23 in 2013, and 14 in 2012. The increase was partly caused by the breach of Italy-based zero day broker Hacking Team, which spilled six closely guarded zero days into the public domain. It also came as Adobe and other developers significantly reduced the time it took to release patches that plugged zero-day holes.

"It is difficult to defend against new and unknown vulnerabilities, particularly zero-day vulnerabilities for which there may be no patch, and attackers are trying hard to exploit them faster than vendors can roll out patches," Symantec researchers wrote in the company's annual Internet Security Threat Report. The report went on to say that the Angler exploit kit, a package sold in Internet crime forums, was able to quickly integrate the growing number of zero days into its arsenal.

Read 3 remaining paragraphs | Comments

 
Cisco Security Advisory:Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability
 

Softpedia News

Linux Computers Targeted by New Backdoor and DDoS Trojan
Softpedia News
... but crooks lace these malicious packages with another malware called Linux.Downloader. This is what the infosec community calls a payload downloader, malware that's small enough to fit inside other apps, tasked only with downloading other malware.

 

Infosecurity Magazine

Massive Syrian Government Hack All Down to Joomla
Infosecurity Magazine
The Cyber Justice Team has taken responsibility for a big hack of Syrian government networks, which resulted in a massive 43GB data leak online. But what's really to blame is the CMS the regime appears to favor. The hack, which took place on April 6 ...

and more »
 

Techworm

Intel Compute Sticks to become as small as your thumb
Techworm
Intel is finally going to solve one terrible thing about its Compute Sticks; their size. Skylake powered Compute Sticks are going to ship out in April and they will possess the size of your thumb. When you have an efficient processor that is ...

and more »
 
Mybb Cms (create forum and edit) Cross-Site Script Vulnerability
 

UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification. But there's a problem: UL's refusal to share the text of the new standard leaves some experts wondering if UL knows what they're doing.

When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

"It's very concerning," Brian Knopf of I Am The Cavalry, a group of security researchers focused on public safety issues, told Ars. "Without transparency, the research community cannot help improve or audit the standards." As Ars has previously reported, Knopf is leading an effort to develop a five-star cybersecurity rating system for IoT devices.

Read 20 remaining paragraphs | Comments

 
Webline CMS (2016Q2) - SQL Injection Vulnerability
 
Vbulletin Cms (Sendmessage.php Page) 0Day Exploit
 
[SE-2012-01] Yet another broken security fix in IBM Java 7/8
 

Global Cloud Security Market Expected to Grow Exponentially | @CloudExpo #Cloud
SYS-CON Media (press release)
According to a study the rising number of cloud-specific security attacks are likely to propel the demand for cloud security systems to 20 percent CAGR over the next four years. Adoption of cloud computing services has risen and so have the security ...

 

Techworm

Watch Franky Zapata's awesome Flyboard Air
Techworm
About Us. Techworm is a Security News Platform that centers around Infosec, Hacking, Xero-days, Malware, Vulnerabilities,Cyber Crime, DDoS, Surveillance and Privacy Issues and to keep you Informed and Secure.

 

SANS Announces 2016 Security Operations Center Summit Keynote Speakers
SYS-CON Media (press release)
BETHESDA, Md., April 12, 2016 /PRNewswire-USNewswire/ -- SANS Institute, the global leader in information security training, today announced the keynote speakers for the 2016 Security Operations Center (SOC) Summit, taking place May 19 – 26 in ...

 
Internet Storm Center Infocon Status