Found 3149 bookmarks
Custom sorting
The Majority of PostgreSQL Servers on the Internet are Insecure
The Majority of PostgreSQL Servers on the Internet are Insecure
At most 15% of the approximately 820,000 PostgreSQL servers listening on the Internet require encryption. In fact, only 36% even support encryption. This puts PostgreSQL servers well behind the rest of the Internet in terms of security. In comparison, according to Google, over 96% of page loads in Chrome on a Mac are encrypted. The top 100 websites support encryption, and 97 of those default to encryption.
#innerjoin.bit.io#EN#2022#PostgreSQL#research#Insecure#internet#medium
·innerjoin.bit.io·
The Majority of PostgreSQL Servers on the Internet are Insecure
MAR-10365227-3.v1 China Chopper Webshells
MAR-10365227-3.v1 China Chopper Webshells
CISA analyzed 15 files associated with China Chopper malware. The files are modified Offline Address Book (OAB) Virtual Directory (VD) configuration files for Microsoft Exchange servers. The files have been modified with a variant of the China Chopper webshell. The webshells allow an attacker to remotely access the server and execute arbitrary code on the system(s).referenced in this bulletin or otherwise.
#uscert#csirt#cert#en#2022#CISA#China#Chopper#malware#Analysis
·cisa.gov·
MAR-10365227-3.v1 China Chopper Webshells
DeftTorero TTPs in 2019–2021
DeftTorero TTPs in 2019–2021
Earlier this year, we started hunting for possible new DeftTorero (aka Lebanese Cedar, Volatile Cedar) artifacts. This threat actor is believed to originate from the Middle East and was publicly disclosed to the cybersecurity community as early as 2015. Notably, no other intelligence was shared until 2021, which led us to speculate on a possible shift by the threat actor to more fileless/LOLBINS techniques, and the use of known/common offensive tools publicly available on the internet that allows them to blend in.
#securelist#EN#2022#DeftTorero#LebaneseCedar#Lebanon#webshell
·securelist.com·
DeftTorero TTPs in 2019–2021
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant
Earlier this year, Mandiant identified a novel malware ecosystem impacting VMware ESXi, Linux vCenter servers, and Windows virtual machines that enables a threat actor to take the following actions: 1) Maintain persistent administrative access to the hypervisor 2) Send commands to the hypervisor that will be routed to the guest VM for execution 3) Transfer files between the ESXi hypervisor and guest machines running beneath it 4) Tamper with logging services on the hypervisor
#mandiant#EN#2022#esxi#hypervisors#malware#BadVIB(E)s#0-day
·mandiant.com·
Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors | Mandiant