Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers – is the security community’s go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

0-Day Alert: Your Humax WiFi Router Might Be In Danger

Over the years WiFi Routers have been notoriously susceptible to simple attacks. In early 2017, Trustwave SpiderLabs Researcher Simon Kenin identified 43 different models of Netgear Router to be vulnerable for Remote and Local Password Disclosure. More recently, in May...

Bopup Communications Server Remote Buffer Overflow Vulnerability

Trustwave recently discovered a remotely exploitable issue in all current versions of "B Labs" Bopup Communications Server. The issues were discovered and confirmed to exist in version 4.5.1.12872 as detailed in the recently posted Trustwave advisory. Bopup Communications Server runs...

Zero Day Auction for the Masses

UPDATE: The seller once again lowered their price on the 6th of June to $85,000USD. This means that the exploit hasn't sold yet and seller may be having problems finding a buyer. Over the years we've seen practically exponential growth...

Zero-day in Magmi database client for popular e-commerce platform Magento targeted in the wild

Magento is the most popular e-commerce platform owned by eBay since 2011. We illustrate how a severe security flaw can be introduced into a Magneto based e-commerce system, when installing a commonly used vulnerable version of the open-source Magmi utility and failing to change the default security configuration. The appearance of HTTP requests attempting to exploit this vulnerability in the wild indicates that some bad actors are onto this method as well. Once successful, the attacker gains the Magento site credentials and the encryption key for the Magento database.

Tsar Team Microsoft Office Zero Day CVE-2015-2424

After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes referred to as the APT28 and Operation Pawn Storm. iSIGHT Partners discovered...

A Flash Exploit (CVE-2015-5119) From the Hacking Team Leak

***Update July 12, 2015--It was recently discovered that Hacking Team possessed an additional zero-day exploit for Adobe Flash--CVE-2015-5122. CVE-2015-5122 was patched by Adobe on July 8, 2015. While a different exploit than CVE-2015-5119 discussed below, Trustwave SWG customers are also...

[Honeypot Alert] Fritz!Box – Remote Command Execution Exploit Attempt

Our web honeypots picked up some exploit attempts for a remote command execution vulnerability in FRITZ!Box, a series of routers produced by AVM. This exploit targets router firmware issues, and we're seeing an increase in this type of activity. Here...

A New Zero-Day of Adobe Flash CVE-2015-0313 Exploited in the Wild

Just yesterday Adobe announced a zero-day vulnerability in Adobe Flash Player version 16.0.0.296. The zero-day exploit is delivered by a lesser known Exploit Kit - HanJuan - potentially attacking a large number of users. Since the attack is exploiting Adobe...

Powerpoint Vulnerability (CVE-2014-4114) used in Malicious Spam

Following last week’s announcement of a zero-day vulnerability for PowerPoint (CVE-2014-4114), we suspected it would not be too long before we saw this attack being used via email attachments. So when this email with a PowerPoint attachment appeared in our...

CVE-2014-2120 – A Tale of Cisco ASA “Zero-Day”

A few months ago I was trying to PoC a known cross-site scripting vulnerability in the Cisco ASA WebVPN portal (CVE-2013-3414) for inclusion in the TrustKeeper Scan Engine. I tried a number of different techniques on multiple different ASA versions/branches...

Microsoft Internet Explorer 0-Day (CVE-2014-1776)

A zero-day vulnerability in Microsoft Internet Explorer, CVE-2014-1776, was recently discovered when it was used as part of a targeted attack. Despite being an exploit for Internet Explorer, the attack used a Flash file to deliver the malicious code and...

Microsoft Word RTF 0-Day (CVE-2014-1761)

A zero-day vulnerability in Microsoft Word involving the handling of the RTF file format was published last week in the form of a Microsoft advisory. In its advisory, Microsoft states that it is aware of “limited, targeted attacks” exploiting this...

Deep Analysis of CVE-2014-0502 – A Double Free Story

A lot has already been said about CVE-2014-0502, the Adobe Flash Player zero-day that was part of a targeted attack that infected several nonprofit organizations’ websites. Several interesting aspects of the exploit were covered in various blog posts; including its...

DaumGame ActiveX 0day

One might think that vulnerabilities in ActiveX controls are a thing of the past, but we continue to find evidence that they have not. Just this year, dozens of vulnerabilities have been discovered. In some cases an ActiveX exploit is...

The Kernel is calling a zero(day) pointer – CVE-2013-5065 – Ring Ring

SpiderLabs investigates a number of suspicious binary files on a daily basis. A week ago we came across a PDF file which had two different vulnerabilities, a remote-code-execution vulnerability in Adobe Reader and a new escalation-of-privileges vulnerability in Windows Kernel....

The Technical Aspects of Exploiting IE Zero-Day CVE-2013-3897

Just two days ago we announced the discovery of in-the-wild attacks that used the zero-day which is now known as CVE-2013-3897. At that time we also promised to provide a more detailed analysis of the exploit. Now we have the...

Another Day, SpiderLabs Discovers Another IE Zero-Day

We at SpiderLabs investigate many suspicious webpages on a daily basis. Occasionally we run into something that seems new and unfamiliar to us, which is generally when things become interesting. A recent discovery of ours began just like that and...

Stay Connected


Subscribe

Sign up to receive the latest security news and trends from Trustwave.

No spam, unsubscribe at any time.


Trending Topics