Response to Decision Group press release about security vulnerabilities in E-Detective Lawful Interception System

Posted by Mustafa Al-Bassam on Jun 26

Two weeks ago I posted a security advisory[1] detailing severe security
flaws in E-Detective, a “lawful” communications interception system. The
vendor is a company called Decision Group and they claim on their
website that their software is used by over 100 law enforcement agencies.

A few days ago they posted a press release[2] to respond to an IBTimes
article[3] that covered the security flaws.

The mere fact that they responded to a…

Remote file download vulnerability in download-zip-attachments v1.0

Posted by Larry W. Cashdollar on Jun 26

Title: Remote file download vulnerability in download-zip-attachments v1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-10
Download Site: https://wordpress.org/plugins/download-zip-attachments/
Vendor: rivenvirus
Vendor Notified: 2015-06-15
Vendor Contact: https://profiles.wordpress.org/rivenvirus/
Advisory: http://www.vapid.dhs.org/advisory.php?v=129
Description:
Download all attachments from the post into a zip file.

Vulnerability:…

Arbitrary File download in wordpress plugin wp-instance-rename v1.0

Posted by Larry W. Cashdollar on Jun 26

Title: Arbitrary File download in wordpress plugin wp-instance-rename v1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-12
Download Site: https://wordpress.org/plugins/wp-instance-rename/
Vendor: Vlajo
Vendor Notified: 2015-06-12
Advisory: http://www.vapid.dhs.org/advisory.php?v=127
Vendor Contact:
Description: WordPress Rename plugin allows you to easily rename the complete WordPress installation. This plugin
allows you to rename…

Avast CEO speaks out about U.S. and U.K. spy agencies

For as long as there have been governments, there have been spy agencies, and for as long as there have been spy agencies, they’ve done spying. Spy agencies are always looking for ways to get information. Information is valuable, always has been, always will be. ~Avast CEO Vince Steckler

New documents from the many that were leaked by former US intelligence analyst Edward Snowden were published this week in The Intercept. They reveal that the U.S.’s National Security Agency (NSA) and its British counterpart, Government Communications Headquarters (GCHQ), spied on security companies including Avast, AVG, Kaspersky Lab, and Antiy. The spy agencies seem to be targeting non-American security companies; Avast and AVG are based in Prague, Czech Republic; Kaspersky is based in Moscow, Russia; and Antiy is Chinese. Together, these companies have nearly a billion users. No U.S. or U.K. -based companies were included in the list.

“Geopolitically, it makes sense that the NSA and GCHQ are targeting products that are prevalently used by foreign governments, like Kaspersky in Russia or CheckPoint in Israel,” said Steckler in an interview with RT News. “On the flip side, Russian or Chinese spy agencies may be similarly targeting products that the American government heavily uses, for example Symantec and McAfee. We’re hearing just one side of the story.”

Reportedly, the NSA and GCHQ experts reverse engineered the antivirus software in order to exploit it and prevent detection of their own activities.

“It is difficult to tell if the NSA, the GCHQ, or other government agencies have ever tried to reverse engineer our software,” said Steckler. “Even if they did, they would only be able to do so on the client side, which includes simple pattern detection. However, they could not reverse engineer our backend, which includes our sophisticated machine-learning classification.”

The documents also say that the organizations recommended monitoring customers who reported malware “to see if they’re into more nefarious activity.”

While some companies most likely partner with the governments in their home countries, that’s not something Avast does.

“The fact that the NSA may be targeting us – while some major U.S. and British security companies are left out from their list proves that we don’t work with the NSA and GCHQ,” said Steckler. “Ones not on the list quite likely provide their source code and thus there is no need to reverse engineer. Our commitment to our customers is to provide protection from all forms of spying.

Mr. Steckler spoke to RT News, a Russian television network, about the new revelations. Watch the interview now,

Cisco Security Advisory 20150625-ironport

Cisco Security Advisory – Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) suffer from a default authorized SSH key vulnerability. Cisco has released free software updates that address these vulnerabilities. There are no workarounds for these vulnerabilities.