Securityexploits

Lenovo Made Big Cybersecurity Mistake & now Komodia

by

Here is the underlying Lenovo problem: http://www.kb.cert.org/vuls/id/529496  ” Komodia Redirector with SSL Digestor installs non-unique root CA certificates and private keys, making systems broadly vulnerable to HTTPS spoofing” And unfortunately this Komodia Redirector is inside a Lenovo software installation (Superfish) Here is a Techworld  story: http://www.techworld.com/news/security/lenovo-not-alone-in-suffering-from-superfish-security-flaw-3598898/  which also discusses  the problem both in Lenovo systems: “ Security researchers … Read more

Hackers hacked a Foscam Baby Monitor

by

Computerworld has the story: http://www.computerworld.com/article/2878741/hacker-hijacks-wireless-foscam-baby-monitor-talks-and-freaks-out-nanny.html?utm_source=dlvr.it&utm_medium=twitter#tk.rss_all    We have posted about this before Jun11, 2014 http://oversitesentry.com/what-if-your-new-gadget-gets-hacked-even-your-countertop-or-toilet/ The creepy hacker said some words to the nanny and caused the nanny to turn off the webcam. There seems to be a sad theme here as well as our post(Nov16) of regular webcams (not just babycams) http://oversitesentry.com/change-default-passwords-online-cams/ It seems it … Read more

Ghost: glibc vulnerability CVE2015-0235

by

How dangerous is it?  It is an inherent Linux glibc vulnerability. RedHat is discussing it on their articles page – has the CVE number 2015-0235 https://access.redhat.com/articles/1332213 It is nicknamed “Ghost” due to the ghostbyname() function calls in the glibc library, specifically: “GHOST is a ‘buffer overflow’ bug affecting the gethostbyname() and gethostbyname2() function calls in the … Read more

What does state-of-art Spear Phishing Look Like?

by

Hackread has the story: http://hackread.com/outlook-web-app-phishing-page-on-russian-site/  screenshot from fake page as on Hackread That looks like a standard OWA access panel right?  Except that it is actually on a Russian site designed to steal your credentials.   If you received an email stating: “check your email with this link, must see document ” Then your click … Read more

Another Desktop Exploit – Silverlight Problem

by

Checkpoint has the scoop: http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf Silverlight exploits may be less common, but unfortunately this particular exploit obfuscates itself and can infect the desktop that has loaded Silverlight. Background to Silverlight: “The Silverlight framework enables the development of web applications with features similar to those of Adobe flash and Java Applets. The Silverlight runtime environment is … Read more