The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Monthly Archives: June 2015
CVE-2015-2959
Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role.
CVE-2015-2960
Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-2961
Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators.
CVE-2015-4418
Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
CVE-2015-3200
mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character. (CVSS:5.0) (Last Update:2015-06-10)
Vuln: Stunnel CVE-2014-0016 PRNG Initialization Weakness
Stunnel CVE-2014-0016 PRNG Initialization Weakness
Vuln: QEMU 'hw/block/fdc.c' VENOM Remote Memory Corruption Vulnerability
QEMU ‘hw/block/fdc.c’ VENOM Remote Memory Corruption Vulnerability
DSA-3283 cups – security update
It was discovered that CUPS, the Common UNIX Printing System, is
vulnerable to a remotely triggerable privilege escalation via cross-site
scripting and bad print job submission used to replace cupsd.conf on the
CUPS server.
Teenagers charged with cybercrimes
Forget about shoplifting or painting graffiti on the wall at midnight. Opportunistic teens are turning to cybercrime to get their kicks these days.
Teenage hackers range from pranksters to international kingpins.
A 14-year old boy in Florida was recently arrested and charged with a felony offense for unauthorized access against a computer system. The 8th grader said he was playing a prank on his teacher when he used the teacher’s administrative password to log onto a school computer and changed its desktop background to an image of two men kissing. The password was the teacher’s last name, and the prankster said he figured it out by watching the teacher type it in.
Across the country in California, two high school students were arrested for allegedly hacking into the school’s website and changing grades for about 120 students. It’s another case of “unauthorized access” and the school is working with the Cyber Crimes Bureau of the Los Angeles Sheriff’s Department to investigate.
Those two “cybercrimes” can’t compare to the one out of New Zealand. Police have detained an 18-year old they call the kingpin of an international cybercrime network. Together with other young adults in New Zealand, the US and elsewhere, he is accused of running a botnet comprised of 1.3 million hacked computers and skimming millions of dollars from victims’ bank accounts. The teen likely will be charged with having unauthorized access to computers and possessing computer hacking tools — charges that carry a maximum sentence of 10 years in prison.
Why are teens attracted to cybercrime?
One reason may be that it’s fun. Hackers were asked in a survey why they do it, and more than half said it provided them with a thrill. They also think they won’t get caught. Eighty-six percent of them aren’t worried about getting discovered or ever facing the consequences of their actions.
Others just want to prove their skills. Remember when the Australian teenager hacked Twitter because he was bored? That was back in 2009. When asked by The Independent why he did it, his response was, “To see if it could be done.”
The big rewards and rock-star status can be tempting. Rolling Stone did a story on a South Beach (Miami) 20-something year old hacker who had a glitzy, drug-fueled lifestyle while presiding over an international cybercrime ring that stole over 170 million credit and debit card numbers, estimated at $200 million.
Keep yourself safe online
It doesn’t really matter if it’s a bored teenager down the street or an underground cybercrime ring operating out of bunkers in a far away foreign land, you still need to take basic precautions to keep yourself and your data safe.
1. Make sure you have up-to-date antivirus protection with a firewall.
2. Keep your software and operating system up-to-date.
3. Be cautious of clicking on links in unfamiliar emails. Don’t provide personal information online, such as your password, financial information, or social security number, unless you are absolutely sure of where you are adn who you are dealing with.
4. Use strong passwords, and don’t use the same one for Facebook that you use for your bank. This blog has plenty of tips on how to create unique passwords and remember them too.
5. Learn what to do if something goes wrong. Find out who the appropriate authorities are in your area by contacting your Internet Service Provider or the Internet Crime Complaint Center.