Red Hat Enterprise Linux: Updated chrony packages that fix one bug are now available for Red Hat
Enterprise Linux 6.
Monthly Archives: December 2016
Facebook Releases Free Certificate Transparency Monitoring Tool
Facebook makes freely available an internal tool used to monitor CT logs for new TLS certificates issued for a domain. Users can monitor and audit this information for malicious or mistakenly issued certs.
Distributed Guessing Attack can ‘compromise Visa cards in just six seconds’
A new study from Newcastle University in the UK suggests that cybercriminals can access online banking details of any Visa card through a so-called Distributed Guessing Attack.
The post Distributed Guessing Attack can ‘compromise Visa cards in just six seconds’ appeared first on WeLiveSecurity
![]()
Security by design for mobile device manufacturers
ESET’s Cameron Camp takes a closer look at security by design for mobile device manufacturers, assessing where we are and where we are heading.
The post Security by design for mobile device manufacturers appeared first on WeLiveSecurity
![]()
How to Shop Online in Secret, and Other Tips This Holiday Season

With Christmas just 11 days away, shopping is still in full swing for most consumers around the world. According to a survey of shoppers by the National Retail Federation, as of Thanksgiving 2016, only 9 percent of US shoppers are finished with their Christmas buying. With the majority of shoppers choosing to shop online, the […]
The post How to Shop Online in Secret, and Other Tips This Holiday Season appeared first on Avira Blog.
SQL injection in Joomla extension DT Register
Posted by Elar Lang on Dec 13
Title: SQL injection in Joomla extension DT Register
Credit: Elar Lang / https://security.elarlang.eu
Vulnerability: SQL injection
Vulnerable version: before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5)
CVE: pending
Full Disclosure URL:
https://security.elarlang.eu/sql-injection-in-joomla-extension-dt-register.html
Vendor: DTH Development
* Vendor URL: http://www.dthdevelopment.com/
Product: DT Register “Calendar & Event Registration”…
Zcash Could Spell Reemergence of Mining Botnets – SC Magazine
Zcash Could Spell Reemergence of Mining Botnets – SC Magazine
In 2017, less malware and more advanced attacks

The decline in new malware and the increased professionalization of attacks will set the tone in cybersecurity for next year, according to PandaLabs’ Cybersecurity Predictions for 2017. Ransomware will encompass the majority of attacks, and companies will amass a larger number of increasingly advanced intrusions.
As far as cybersecurity goes, we bid farewell to a year replete with high-profile attacks that have jeopardized large corporations and private users. Ransomware attacks from Petya, Trojans such as Gugi for Android, the spyware Pegasus, PunkeyPOS, or large-scale attacks targeting point of sale terminals as well as the recent DDoS (Distributed Denial of Service) attacks have affected large organizations and international communication networks.
We rank the most popular attacks of the year, analyzing their evolution and taking a look at the cybernetic threats that 2017 has in store:
Cybercrime
Cybercriminals focus their efforts on those attacks which can rake in the most profit, using more effective tactics and professionalizing their operations in a way that allows them to make quick and easy money in an efficient manner.
Ransomware
This Trojan Horse will take center stage with regard to cybersecurity and will cannibalize other more traditional attacks that are based on data theft. The pursuit of profit is the primary motivation of cybercriminals, and ransomware is the simplest and most effective way to achieve this. Some things never change: victims of this hijacking malware will have to decide whether to pay, or not, to recover their data. Panda Security encourages victims to keep in mind that paying the ransom does not guarantee the total recovery of stolen data.
Companies
The number of attacks directed at corporations will increase, as these attacks become more and more advanced. Companies are already the prime target of cybercriminals, as their information is more valuable than that of private users.
Internet of Things (IoT)
The next cybersecurity nightmare. The technological revolution has ushered in the complete integration of smaller devices into the grid, which can be converted into entryways into corporate networks.
DDoS Attacks
The final months of 2016 witnessed the most powerful DDoS (Distributed Denial of Service) attacks in history. These attacks were carried out by bot networks that relied on thousands of affected IoT devices (IP cameras, routers, etc.). 2017 will see an increase in this kind of attack, which is typically used to blackmail companies or to harm their business (by blocking web access, online shopping, etc.).
Mobile Phones
Focusing on one single OS makes it easier for cybercriminals to fix a target with maximal dissemination and profitability. Android users will get the worst of it in the next 12 months.
Cyberwar
The precarious situation with regard to international relations can have huge — and serious — consequences in the field of cybersecurity. Governments will want access to still more information (at a time when encryption is becoming more popular), and intelligence agencies will become still more interested in obtaining information that could benefit industry in their countries. A global situation of this kind could hamper data sharing initiatives in the next year.
Download the Pandalab’s Predictions here:
The post In 2017, less malware and more advanced attacks appeared first on Panda Security Mediacenter.
CA Unified Infrastructure Management download_lar.jsp Directory Traversal (CVE-2016-5803)
A directory traversal vulnerability exists in CA Unified Infrastructure Management. The vulnerability is due to insufficient input validation while processing HTTP requests sent to the download_lar.jsp. A remote unauthenticated attacker can exploit this vulnerability by sending a malicious request to the vulnerable server. Successful exploitation results in arbitrary file download from the target server.
Microsoft Internet Explorer Information Disclosure (MS16-144: CVE-2016-7284; CVE-2016-7284)
An out-of-bounds-read vulnerability exists in Microsoft Internet Explorer. This vulnerability is due to an error in Internet Explorer. Successful exploitation of this issue can lead to information disclosure.