This #PHP #security issue is very nice

https://bugs.php.net/bug.php?id=76582


#php
#security

@sec_nerd_en

RDP Pivoting with Metasploit

http://www.hackingarticles.in/rdp-pivoting-metasploit/


#msf
#rdp
#windows
#pivoting

@sec_nerd_en

"If you don't stop asking me if we are nearly there yet, I will turn this bus round; and none of you will get to see Salisbury cathedral. Do you hear me?"


#fun
#russia

@sec_nerd_en

https://upload.wikimedia.org/wikipedia/commons/7/70/Portable_Executable_32_bit_Structure_in_SVG.svg


#PE32 Structure
#Windowns Internals


@sec_nerd_en

A Chinese company is developing software that can read lips - likely to be used alongside facial recognition tech at some point

#facial_recognition
#china
#ai

@sec_nerd_en

Hide an ADS in a folder > create a sub-folder > the hidden #ADS is automatically duplicated in the new sub-folder! Is this a feature or a bug? #DFIR


#windows
#cmd


@sec_nerd_en

VLAN Hopping and Mitigation

https://www.alienvault.com/blogs/security-essentials/vlan-hopping-and-mitigation


#network
#vlon_hopping
#pentest
#pivoting


@sec_nerd_en

Subdomain Takeover worth 200$

https://medium.com/@alirazzaq/subdomain-takeover-worth-200-ed73f0a58ffe


#bugbounty
#subdomain

@sec_nerd_en

Blockchain betting app mocks competitor for getting hacked. Gets hacked four days later


hacker going online by the pseudonym of "aabbccddeefg" has exploited a vulnerability to steal over 24,400 EOS coins ($125,000) from a blockchain-based betting app.

The hack took place last night, and the targeted app is called EOSBet Dice, run by a company named EOSBet Cassino. The app lets users bet EOS cryptocurrency as part of a classic dice game


The game has been running online for a few months, but yesterday, a Reddit user spotted that an EOS user named aabbccddeefg had siphoned a large stack of funds from the EOSBet Dice's shared money pool.

The Redditor says he identified a vulnerability in the dice game's source code --which, in turn, was based on an open source EOS dice-betting game called Fair Dice.

The hacker operated by sending a transaction to the EOSBet main game account, which exploited a lack of proper parameter checks that allowed the hacker to trick the game into sending back fake earnings.



https://www.zdnet.com/article/blockchain-betting-app-mocks-competitor-for-getting-hacked-gets-hacked-four-days-later/


#news
#breach
#btc
#cryptocurrency


@sec_nerd_en

Backup solution provider Veeam are notifying customers of a security breach of one of the customer databases #infosec #security

#news
#breach

@sec_nerd_en

Kraken Cryptor Ransomware Masquerading as SuperAntiSpyware Security Program


https://www.bleepingcomputer.com/news/security/kraken-cryptor-ransomware-masquerading-as-superantispyware-security-program/


#news
#ransomware

@sec_nerd_en

BEC Scammer To Serve Five Years And Pay $2.5 Million


A Nigerian man has been sentenced to five years of prison time and pay $2.54 million in restitution for running business email compromise scams that attempted to steal $25 million.

Opara followed the classic recipe for business email compromise (BEC) activity, also known as CEO fraud. He sent employees of the victim companies emails purporting to be from their supervisors or from business partners, with instructions to transfer funds to specific bank accounts.

The techniques used to deceive the recipient are typical for BEC scams; emails came from domain names similar to the impersonated business or were spoofed so they looked like they came from the legitimate address.
Scammer runs side operation to hide the money trail

Opara did not act alone in his endeavors and ran a concurrent scam that distanced him from the operation.

He registered to dating websites as an attractive woman by the name of Barbara. Under this guise, he would win the heart of individuals in the US and convince them to send money overseas or to accept funds from his BEC scams and then transfer them to accounts controlled by Opara or his associates in the scheme.

It appears that Opara's female online persona had an irresistible charm, as it was able to convince one victim to transfer $600,000 of its own money to accounts controlled by the fraudster.

Also involved in the scheme was David Chukwuneke Adindu, who received a sentence of 41 months of jail time on December 14, 2017. He was also ordered to pay about $1.4 million in restitution.

Adindu pled guilty to charges of conspiracy to commit wire fraud and conspiracy to commit identity theft. Opara was charged with conspiracy to commit wire fraud and wire fraud and also pled guilty this year on April 11.

Opara received 60 months of incarceration for each charge, to be served concurrently starting December 22, 2016, the date of his arrest in Johannesburg, South Africa. A month later he was extradited to the United States.

The FBI Internet Crime Complaint Center released this year guideline information on how to mitigate BEC scams and how to avoid them.


https://www.bleepingcomputer.com/news/security/bec-scammer-to-serve-five-years-and-pay-25-million/


#news
#scam


@sec_nerd_en

Files With 42 Million Emails and Passwords Found On Free Hosting Service

https://www.bleepingcomputer.com/news/security/files-with-42-million-emails-and-passwords-found-on-free-hosting-service/

#news
#breach


@sec_nerd_en

OpenSSH 7.x Mass Username Enumeration Tool: https://github.com/trimstray/massh-enum #unix #openbsd #linux


@sec_nerd_en

Why it is important to always use htmlentities() in a context sensitive way #PHP #security


https://blog.ripstech.com/2016/freepbx-from-cross-site-scripting-to-remote-command-execution/


@sec_nerd_en