Showing 1262 results

Is ModSecurity's SecRules Turing Complete?

Have you ever seen a rule for ModSecurity? They may look similar to the following: SecRule REQUEST_URI "@endswith example.com/index.html" "id:1,log,deny,redirect:http://modsecurity.org" This rule may look complicated, but it is extremely basic. It says, if you find a URL ending with example.com/index.html...

Microsoft Patch Tuesday, January 2017

It's everyone's favorite Patch Tuesday, January's Patch Tuesday. Historically January has always been a light month for bulletins and this January is the lightest in years. With only four bulletins and three CVEs, Admins should have a relatively easy time...

Terror Exploit Kit? More like Error Exploit Kit

Q: What does it take to create a simple, yet fully functioning exploit kit? A: Just a little bit of determination. A few weeks ago a website popped up on our radar: www[.]***empowernetwork[.]com This web site, like many others in...

Steganalysis, the Counterpart of Steganography

In my last blog post I discussed the art of embedding secret messages in any file so that only the sender and the receiver know about the presence of that message. This is called steganography. In this post I will...

Raiding the Piggy Bank: Webshell Secrets Revealed

Introduction A recent investigation into credit card fraud that was enabled by a webshell revealed several interesting methods used by the attacker. These methods are the subject of this blog, as well as providing some suggestions on what E-commerce companies...

Microsoft Patch Tuesday, December 2016

December's Patch Tuesday is here to greet you with the pleasant tidings of patches for all of your (currently known Microsoft) vulnerabilities. It's a big release just in time for the holidays with 12 bulletins covering 48 CVEs. Five of...

A Backdoor in Skype for Mac OS X

Trustwave recently reported a locally exploitable issue in the Skype Desktop API Mac OS-X which provides an API to local programs/plugins executing on the local machine. The API is formally known as the Desktop API (previously known as the Skype...

New Carbanak / Anunak Attack Methodology

In the last month Trustwave was engaged by two separate hospitality clients, and one restaurant chain for investigations by an unknown attacker or attackers. The modus operandi for all three investigations were very similar and appear to be a new...

OWASP Core Rule Set 3.0.0 (Final) release

The OWASP Core Rule Set (CRS) team is excited to announce the immediate availability of the OWASP Core Rule Set Version 3.0.0 stable release. This release represents over two and a half years of effort with nearly 1000 commits and...

TrustKeeper Scan Engine Update for November 02, 2016

Summary The latest update to the TrustKeeper scan engine that powers our Trustwave Vulnerability Management product (including both internal and external vulnerability scanning) is now available. Enjoy! New Vulnerability Test Highlights Some of the more interesting vulnerability tests we added...

Microsoft Patch Tuesday, November 2016

The November Patch Tuesday is here and it's a big one with 14 bulletins covering 68 unique CVEs. Despite the large volume of patches, this patch cycle still promises to be less painful than Election Day here in the USA....

Bopup Communications Server Remote Buffer Overflow Vulnerability

Trustwave recently discovered a remotely exploitable issue in all current versions of "B Labs" Bopup Communications Server. The issues were discovered and confirmed to exist in version 4.5.1.12872 as detailed in the recently posted Trustwave advisory. Bopup Communications Server runs...

Database Security Knowledgebase Update 5.06

This month's update for Database Security Knowledgebase is now available. Knowledgebase version 5.06 includes new and updated checks for IBMDB2 LUW, Microsoft SQL Server and SAP (Sybase) ASE. New Vulnerability and Configuration Check Highlights IBMDB2 LUW Restrict Access to SYSCAT.AUDITPOLICIES...

OWASP ModSecurity CRS Version 3.0 RC2 Released

The OWASP Core Rule Set (CRS) is an Open Source project run by the Open Web Application Security Project (OWASP) and is frequently paired with the Open Source ModSecurity project. As part of Trustwave's commitment to ModSecurity, the Spiderlabs Web...

Microsoft Patch Tuesday, October 2016

October has arrived with seasonal changes and a new Microsoft Patch Tuesday. This Patch Tuesday brings with it 10 bulletins with a total of 36 unique CVE's, definitely a step back from September's massive list, but also not a light...