1 Vulnerability Overview On February 28, 2019, a security vendor outside of China spotted a 0-day vulnerability in Google's Chrome browser, which could lead to information disclosure upon a user's opening of a malicious PDF file using Chrome. Up to now, a number of malicious samples have been found to...
Category: Emergency Response
Drupal Remote Code Execution Vulnerability (CVE-2019-6340) Threat Alert
Overview Drupal released a security advisory, announcing remediation of a highly critical remote code execution vulnerability (CVE-2019-6430), which stems from some field types improperly sanitizing data from non-form sources, leading to potential execution of arbitrary PHP code. (more…)
Gafgy Botnet – Practitioner of the BaaS Mode
Overview In an era of everything being connected, with the increase of IoT devices exposed on the Internet and vulnerabilities detected in them, more and more malware focuses on the inexhaustible zombie repository. Therefore, IoT platform-based malware families have undergone an exponential growth. The year 2018 alone saw 21 new...
Attack and Defense Around PowerShell Event Logging
0x00 Overview PowerShell has been a focus of concern for network defense. The fileless PowerShell, featuring LotL and excellent ease of use, is widely used in various attack scenarios. In order to capture PowerShell-based attacks, an increasing number of security professionals tend to, through PowerShell event log analysis, extract attack...
WinRAR Code Execution Vulnerability Threat Alert
1 Vulnerability Overview Recently, a security researcher found a logical bug in WinRAR using the WinAFL fuzzer and exploited it to gain full control over a victim's computer. An attacker could exploit this vulnerability by crafting an archive and then tricking victims into downloading it by means of a phishing...
Microsoft Security Bulletin for February 2019 Patches That Fix 79 Security Vulnerabilities
Overview Microsoft released the January 2019 security patch on Tuesday that fixes 79 vulnerabilities ranging from simple spoofing attacks to remote code execution in various products, including .NET Framework, Adobe Flash Player, Azure, Internet Explorer, Microsoft Browsers, Microsoft Edge, Microsoft Exchange Server, Microsoft Graphics Component, Microsoft JET Database Engine, Microsoft...
