Showing 1277 results

Protecting Yourself from MongoDB Ransomware

In the realm of malware, ransomware has been king for the last few years, compromising unsecured hosts and kindly requesting payment from their rightful owners. Back in January 2017, an attacker extended the concept to MongoDB and was hitting unsecured...

Exploiting Privilege Escalation in Serv-U by SolarWinds

I was recently working on an external network penetration test where I identified a new vulnerability in a file sharing web application called Serv-U by SolarWinds. This vulnerability granted me administrative privileges to the Serv-U application, and, allowed for remote...

Authentication and Encryption in PAS Web Shell Variant

Introduction During a recent incident response case, we were tasked with discovering the point of entry for an attacker that had compromised the entire Windows network. Among other things we uncovered evidence of web application attacks targeting the company's public...

Database Security Knowledgebase Update 5.12

This month's update for Database Security Knowledgebase is now available. Knowledgebase version 5.12 includes new and updated checks for Oracle and Sybase ASE. New Vulnerability and Configuration Check Highlights Oracle SQL Injection in CDBView package o Database Activity Monitoring -...

Microsoft Patch Tuesday, March 2017

We knew that the Microsoft's Valentine's gift to cancel Patch Tuesday on February 14th was only going to be a temporary stay and, sure enough, Patch Tuesday is back and bigger than ever for March. Over all there are 18...

Undocumented Backdoor Account in DBLTek GoIP

Trustwave recently reported a remotely exploitable issue in the Telnet administrative interface of numerous DblTek branded devices. The issue permits a remote attacker to gain a shell with root privileges on the affected device due to a vendor backdoor in...

Unauthenticated Backdoor Access in Unanet

The default configuration of the Unanet web application has a backdoor that can allow unauthenticated users to login and manipulate the user accounts and the roles they maintain. This vulnerability is due to a code branch that exists within the...

Database Security Knowledgebase Update 5.11

This month's update for Database Security Knowledgebase is now available. Knowledgebase version 5.11 includes new checks for MySQL, SQL Server and Oracle as well as updated checks for SQL Server and MySQL. New Vulnerability and Configuration Check Highlights MySQL Critical...

Underground Scams: Cutting the Head Off a Snake

Shortly after publishing our post about Terror EK, "King Cobra" (a Twitter account that we mentioned at the end of that blog post), tweeted a note to us: Figure 1: King Cobra's tweet to Trustwave This, along with other feedback...

SVG Files Are Not As Benign As It May Seem

Bad guys are getting quite creative trying to evade spam filters and antivirus scanners. Last week, we have observed an influx of spam campaign targeting a Japanese audience. Translated to English: Subject: Photo We always appreciate your regards. (This is...

Is ModSecurity's SecRules Turing Complete?

Have you ever seen a rule for ModSecurity? They may look similar to the following: SecRule REQUEST_URI "@endswith example.com/index.html" "id:1,log,deny,redirect:http://modsecurity.org" This rule may look complicated, but it is extremely basic. It says, if you find a URL ending with example.com/index.html...

Microsoft Patch Tuesday, January 2017

It's everyone's favorite Patch Tuesday, January's Patch Tuesday. Historically January has always been a light month for bulletins and this January is the lightest in years. With only four bulletins and three CVEs, Admins should have a relatively easy time...