Aggregator

DroneXtract DroneXtract is a comprehensive digital forensics suite for DJI drones made with Golang. It can be used to analyze drone sensor values and telemetry data, visualize drone flight maps, audit for criminal activity,...

The post DroneXtract: A digital forensics suite for DJI drones appeared first on Penetration Testing Tools.

A vulnerability classified as problematic was found in RemotelyAnywhere 8.0.668. Affected by this vulnerability is an unknown functionality of the file remotelyanywhere.exe. The manipulation leads to improper input validation. This vulnerability is known as CVE-2008-1278. The attack can be launched remotely. Furthermore, there is an exploit available.

#软件资讯 Microsoft 365 系列应用将在 10 月份停止支持 Windows 10 系统，因为到 10 月份 Windows 10 要被结束支持不再提供安全更新。届时 Mi

HackerNews 编译，转载请注明出处： 网络安全研究人员发出警告，一项新的恶意广告活动正针对通过谷歌广告进行宣传的个人和企业，试图通过谷歌上的欺诈广告进行网络钓鱼，窃取他们的登录凭证。 Malwarebytes威胁情报高级总监Jérôme Segura在一份与The Hacker News共享的报告中指出：“该诈骗方案通过冒充谷歌广告，诱骗受害者访问假冒的登录页面，从而窃取尽可能多的广告主账户。” 据推测，该活动的最终目的是利用窃取的凭证继续扩大诈骗活动，同时还在地下论坛上将这些凭证出售给其他犯罪分子。根据Reddit、Bluesky和谷歌官方支持论坛上的帖子，这一威胁自2024年11月中旬以来便已开始活跃。 这一系列活动与利用窃取器恶意软件窃取与Facebook广告和商业账户相关的数据，以劫持这些账户并用于推送进一步传播恶意软件的恶意广告活动的行为极为相似。 新发现的诈骗活动专门针对在谷歌搜索引擎上搜索谷歌广告的用户，向他们展示虚假的谷歌广告，点击后会将用户重定向到托管在Google Sites上的欺诈网站。 这些网站作为着陆页，引导访问者访问外部钓鱼网站，这些网站通过WebSocket捕获他们的登录凭证和二次验证码（2FA），并将其传输到攻击者控制的远程服务器上。 Segura表示：“这些假冒的谷歌广告来自不同地点和行业的个人和企业（包括一家地区机场）。其中一些账户已有数百条其他合法广告在运行。” 该诈骗活动的一个巧妙之处在于，它利用了谷歌广告不要求最终URL（用户点击广告后到达的网页）与展示URL必须相同（只要域名匹配）的规则。 这使得威胁分子可以在sites.google[.]com上托管他们的中间着陆页，同时保持展示URL为ads.google[.]com。此外，他们的作案手法还包括使用指纹技术、反爬虫流量检测、受验证码启发的诱饵、伪装和混淆等技术来隐藏钓鱼基础设施。 Malwarebytes表示，窃取的凭证随后被用于登录受害者的谷歌广告账户，添加新的管理员，并利用他们的预算发布虚假的谷歌广告。 换句话说，威胁分子正在接管谷歌广告账户来推送自己的广告，以便将新受害者添加到不断增长的被黑客攻击的账户池中，这些账户被用于进一步延续诈骗活动。 Segura说：“这些活动背后似乎有几个个人或团体。值得注意的是，他们中的大多数是葡萄牙语使用者，可能位于巴西。钓鱼基础设施依赖于使用.pt顶级域名（TLD）的中间域名，这表明与葡萄牙有关。” “这种恶意广告活动并不违反谷歌的广告规则。威胁分子被允许在广告中显示欺诈性URL，使其与合法网站难以区分。谷歌尚未表明它采取了决定性措施来冻结这些账户，直到其安全性得到恢复。” 这一披露之际，Trend Micro透露，攻击者正在利用YouTube和SoundCloud等平台分发指向假冒安装程序的链接，这些安装程序针对的是流行软件的盗版版本，最终会导致部署各种恶意软件家族，如Amadey、Lumma Stealer、Mars Stealer、Penguish、PrivateLoader和Vidar Stealer。 该公司表示：“威胁分子经常使用Mediafire和Mega.nz等可信赖的文件托管服务来隐藏恶意软件的来源，并使检测和清除变得更加困难。许多恶意下载都受到密码保护并进行了编码，这在沙箱等安全环境中增加了分析的复杂性，并使恶意软件能够逃避早期检测。”   消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

error code: 521

A vulnerability classified as critical was found in Tenda FH1205 2.0.0.7(775). This vulnerability affects the function fromSetRouteStatic of the file /goform/fromRouteStatic. The manipulation of the argument entrys leads to stack-based buffer overflow. This vulnerability was named CVE-2024-3006. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, has been found in Tenda FH1205 2.0.0.7(775). This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The identification of this vulnerability is CVE-2024-3007. The attack may be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in Tenda FH1205 2.0.0.7(775). Affected is the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. This vulnerability is traded as CVE-2024-3008. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. This vulnerability is known as CVE-2024-3009. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this issue is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. This vulnerability is handled as CVE-2024-3010. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been classified as critical. This affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-3011. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1205 2.0.0.7(775). It has been declared as critical. This vulnerability affects the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. This vulnerability was named CVE-2024-3012. The attack can be initiated remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-3143. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. This vulnerability is known as CVE-2024-3144. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1203 2.0.1.6. It has been classified as critical. Affected is the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. This vulnerability is traded as CVE-2024-2993. It is possible to launch the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Tenda FH1203 2.0.1.6. It has been declared as critical. Affected by this vulnerability is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. This vulnerability is known as CVE-2024-2994. The attack can be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way. The vendor was contacted early about this disclosure but did not respond in any way.

by Computational Technology for AllJanuary 16th, 2025Too Long; Didn't ReadIntroducing the members

HackerNews 编译，转载请注明出处： 与朝鲜关联的Lazarus Group被指为针对寻找Web3和加密货币领域自由职业的软件开发者发起新一轮网络攻击行动——“Operation 99”，旨在传播恶意软件。 SecurityScorecard公司威胁研究与情报高级副总裁Ryan Sherstobitoff在今日发布的一份新报告中指出：“该行动始于假扮成招聘人员在领英等平台发布信息，以项目测试和代码审查为诱饵吸引开发者。” “一旦受害者上钩，他们就会被引导克隆一个看似无害实则暗藏危机的恶意GitLab仓库。克隆的代码会连接到命令与控制（C2）服务器，从而将恶意软件植入受害者环境。” 该行动受害者遍布全球，其中意大利受害者最为集中。阿根廷、巴西、埃及、法国、德国、印度、印度尼西亚、墨西哥、巴基斯坦、菲律宾、英国和美国等地也有少量受害者。 该网络安全公司表示，其于2025年1月9日发现的这一行动建立在Lazarus Group此前攻击中使用的以工作为主题的战术基础上，如“Operation Dream Job”（又称NukeSped），此次行动特别针对Web3和加密货币领域的开发者。 “Operation 99”的独特之处在于，它通过一个精心设计的招聘计划诱骗开发者参与编码项目，该计划涉及制作虚假的领英账号，然后将开发者引导至恶意GitLab仓库。 攻击的最终目的是部署数据窃取植入程序，从开发环境中提取源代码、密钥、加密货币钱包密钥和其他敏感数据。 这些程序包括Main5346及其变体Main99，它们作为另外三个有效载荷的下载器—— Payload99/73（及其功能相似的Payload5346），用于收集系统数据（如文件和剪贴板内容）、终止网页浏览器进程、执行任意操作并建立与C2服务器的持久连接； Brow99/73，用于从网页浏览器中窃取数据，以促进凭据盗窃； MCLIP，用于实时监控和窃取键盘和剪贴板活动。 该公司表示：“通过攻击开发者账户，攻击者不仅窃取知识产权，还能访问加密货币钱包，从而实现直接财务盗窃。针对私钥和密钥的定向盗窃可能导致数百万数字资产被盗，进而推动Lazarus Group的财务目标。” 该恶意软件架构采用模块化设计，灵活且适用于Windows、macOS和Linux操作系统。这也凸显了国家网络威胁不断演变和适应的本质。 “对于朝鲜而言，黑客攻击是创造收入的生命线，”Sherstobitoff表示，“Lazarus Group持续将窃取的加密货币用于支持该政权的野心，积累了惊人的资金。随着Web3和加密货币行业的蓬勃发展，‘Operation 99’行动聚焦于这些高增长领域。”   消息来源：The Hacker News, 编译：zhongx；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

error code: 521