Security Blog

Emails Disclosure on WordPress

Emails Disclosure on WordpressPassword brute force is one of the common most attack on Wordpress. Only a few hours after the deployment of a new blog, we can see login attempts to /xmlrpc.php or /wp-login.php endpoints. While not being sophisticated, they remain strong attacks as they put pressure on the limited complexity passwords and potential password reuse from users. In this article, we are going to explain how the public wordpress.com REST API makes it easier for brute-force attacks on millions of WordPress instances managed by wordpress.com or private instances with the Jetpack plugin installed.

read more

CVE-2021-3271 Pressbooks Stored Cross Site Scripting Proof of Concept

CVE-2021-3271 Pressbooks Stored Cross Site Scripting Proof of ConceptA Pressbooks stored cross site scripting vulnerability was discovered in all version ≤5.17.3. The application is vulnerable to Stored Cross-Site Scripting (XSS) injections via description body. An attacker can thus trick a user into clicking on a malicious link or preview the document that contains the JavaScript code. Once triggered, the malicious JavaScript code is fed in the victim’s browser and executed.

read more

BazarLoader Mocks Researchers in December 2020 Malspam Campaign

Our Inbox Detection and Response (IDR) team has observed a new BazarLoader campaign targeting the information technology, aeronautic and financial industries. The IDR team has successfully blocked over 550 thousand BazarLoader malspam emails throughout this campaign alone.

GoSecure researchers received a sample from the IDR team which was suspected of being BazarLoader, named Report Preview15-10.exe, on 2020-10-06. Shortly after, GoSecure researchers received yet another BazarLoader sample on 2020-10-08 named Document2-85.exe, which exhibited similar behavior.

read more

Vera – Stored XSS & Improper Access Control

Vera-XSS-and-Improper-Access-Control_ThumbWe discovered a stored cross site scripting (XSS) vulnerability on Vera, a platform for online proofing and custom workflows used in the printing industry. An authenticated user could leverage the last name field in the User module of the system to execute a stored cross site scripting vulnerability. Furthermore, an Improper Access Control vulnerability was discovered in the projects module where a user could view and download project related documents without the proper permissions. The vulnerable version is Vera – 4.9.1.26180.

read more

Deep Dive into an Obfuscation-as-a-Service for Android Malware

Deep Dive into an Obfuscation-as-a-Service for Android MalwareThis blogpost summarizes cutting-edge research that uncovers an obfuscation-as-a-service platform for Android applications. From a thorough analysis of the obfuscation techniques to comprehending the service’s usage, efficiency, and potential profitability, as well as placing the service in its wider market context, the research provides a practical deep dive into the modus operandi of malicious actors attempting to complicate the work of security analysts.

read more

Categories

Titan Managed Detection & Response
Next-Generation Antivirus
Endpoint Detection & Response
Network Detection & Response
Inbox Detection & Response
Insider Threat Detection & Response
Managed Firewall
Managed SIEM
Vulnerability Management as a Service
GoSecure Titan
Titan Software
Email Security
Web Security
ResponderPRO Forensics Toolkit
Advisory Services
Cybersecurity Assessment
Security Compromise Assessment
Ethical Hacking
Incident Response & Forensics
Compliance & Audit
3rd Party Technology

Pin It on Pinterest