Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    December 2014
    S M T W T F S
    « Nov    
  • Email Subscription

  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Archive for the ‘Vulnerabilities’ Category

    Our report on the threats seen in 3Q 2014 shows us that once again, software vulnerabilities are the most favored cybercriminal targets. Following the second quarter's infamous Heartbleed vulnerability came another serious vulnerability in open-source software: Shellshock. Having gone unnoticed for years, the Shellshock incident suggests that there might be more vulnerabilities in Bash or in applications previously thought safe. Below is a timeline of events that Shellshock unraveled. Figure 1. A timeline of events that illustrate the Shellshock exploitation that took place ...

    Last November 25, Adobe issued an out-of-band patch for the CVE-2014-8439 vulnerability, which impacts Adobe Flash Player versions on Windows, Mac OS, and Linux. Adobe's advisory describes this vulnerability as a "de-referenced memory pointer that could lead to code execution.” Despite efforts by Adobe to quickly patch their software vulnerabilities, we noticed that exploit kit authors seem to be one step ahead. This is very dangerous to ordinary home users who rarely patch their software, let alone Adobe Flash Player, which ...

    Posted in Vulnerabilities |

    In recent years, we noticed that more and more malicious Adobe Flash (.SWF) files are being incorporated into exploit kits like the Magnitude Exploit Kit, the Angler Exploit Kit, and the Sweet Orange Exploit Kit. However, we did some more digging and found out that the number of Flash files isn’t the only thing that has changed: these files use obfuscation techniques than files from two to three years ago. Antivirus evasion is the primary goal of obfuscation. SWF files use obfuscation techniques to ...

    Posted in Exploits, Vulnerabilities |

    Microsoft has released an out-of-band security bulletin (MS14-068) that addresses a vulnerability in the implementation of Kerberos in various versions of Windows. The bulletin states that this vulnerability is already being used in "limited, targeted attacks". This warning, plus the fact that Microsoft considered this threat serious enough to merit an out-of-cycle patch, should make users consider patching as soon as possible. Kerberos is a protocol used to authenticate users within a network. This vulnerability (designated as CVE-2014-6324) could allow an attacker to ...

    Posted in Vulnerabilities |

    When news of the Shellshock vulnerability broke out at the end of September, we spotted several attacks that leveraged the said vulnerability, thus manifesting the prevalence or even evolution on how attackers used the exploit. For instance, attackers used Shellshock to target SMTP servers, launch botnet attacks, and even to download KAITEN source code among others. We have continuously monitored this vulnerability and on our latest research, we observed that recent samples of BASHLITE (detected by Trend Micro as ELF_BASHLITE.SMB) scans the network for devices/machines ...


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice