Silensec Newsletter

Category: News

Top News

Adobe updates fix code execution issues in Campaign, ColdFusion, and Flash

Adobe's recent security updates for June 2019 address some critical arbitrary code execution vulnerabilities in Flash Player, Cold Fusion and Campaign products. Adobe fixed critical command injection, file extension blacklist bypass and deserialization vulnerabilities in ColdFusion.

The vulnerabilities could lead to arbitrary code execution on vulnerable systems.

Read more...

Telegram suffers 'powerful DDoS attack' from China during Hong Kong protests

Telegram, one of the most popular encrypted messaging app, briefly went offline on the 13th of June, 2019 for hundreds of thousands of users worldwide after a powerful distributed denial-of-service (DDoS) attack hit its servers.

Telegram founder Pavel Durov later revealed that the attack was mainly coming from the IP addresses located in China, suggesting the Chinese government could be behind it to sabotage Hong Kong protesters.

Read more...

Major Hacks of the Week

RAMBleed Attack: Flip bits to steal sensitive data from computer memory

A team of cybersecurity researchers revealed details of a new side-channel attack on dynamic random-access memory DRAM that could allow malicious programs to read sensitive memory data from other processes running on the same hardware.

Dubbed RAMBleed and identified as CVE-2019-0174, the new attack is based on a well-known class of DRAM side channel attack called Rowhammer.

Read more...

The GoldBrute botnet is trying to crack open 1.5 million RDP servers.

The latest round of bad news emerged recently when Morphus Labs' researcher announced the discovery of an aggressive brute force campaign against 1.5 million RDP servers by a botnet called 'GoldBrute'.

Underlining the worry, two weeks after the initial alert, Microsoft issued a second anxious nudge when it discovered at least one million vulnerable systems had yet to apply the available patch.

Read more...

Major Vulnerabilities Disclosed

Millions of Exim mail servers are currently under attack

Millions of Exim mail servers are exposed to attacks due to a critical vulnerability that makes it possible for unauthenticated remote attackers to execute arbitrary commands.

The critical vulnerability affects versions 4.87 to 4.91 of the Exim mail transfer agent MTA software.

The flaw could be exploited by unauthenticated remote attackers to execute arbitrary commands on mail servers for some non-default server configurations.

Read more...

CVE-2019-2725 Oracle WebLogic flaw exploited in cryptojacking campaign

Security experts have reported that a recently patched CVE-2019-2725 vulnerability in Oracle WebLogic is being exploited in cryptojacking attacks.

The flaw is a deserialization remote command execution zero-day vulnerability that affects the Oracle WebLogic wls9_async and wls-wsat components.

Read more...

Legal, Regulatory and Corporate
Security and Beyond

Microsoft blocks BLE security keys with known pairing vulnerability

Microsoft plans to block the pairing of certain Bluetooth Low Energy BLE security keys on Windows due to a vulnerability its engineers discovered in the BLE pairing protocol earlier this year.

The vulnerability Microsoft is referencing is the same security flaw that forced Google to recall all BLE-based Titan security keys last month, and offer free replacements to its customers.

Read more...

Yubico replacing YubiKey FIPS devices due to security issue

Yubico is in the process of replacing YubiKey FIPS (Federal Information Processing Standards) security keys following the discovery of a potentially serious cryptography-related issue that can cause RSA keys and ECDSA signatures generated on these devices to have reduced strength.

Read more...

Security Awareness Tip

Expect to be attacked! Crazy I know, but it helps you prepare for any kind of attack

Don’t ever think you’re “not important enough” to be attacked. It doesn’t matter how small or big your organisation is or how much important information you as an individual think you might have, if you’ve got money or data (passwords, client data, emails, etc.) you are an attractive target.

Along with this, recent ransomware outbreaks have shown that you don’t need to be a specific target to become a victim. Know your threats and your assets, perform some threat modelling exercises, and take practical precautions to protect what you can.

Read more...

Silensec Editorial Team

Editor: Dr. Almerindo Graziano
Dr. Graziano is the Silensec CEO. He holds an MSc in Electronic Engineering and a PhD in Mobile Computer Security, both from the University of Naples, Italy. Dr. Graziano has consulted in information security for private and government organisations across Europe, Africa and Middle East over the last 15 years. He is also a BSI-certified ISO27001 Lead Auditor trainer and auditor

Vice Editor: George Nicolaou (BSc, MSc)
George Nicolaou (BSc, MSc) leads the Silensec Malware Analysis Lab (MAL). He received his BSc in Computer Science and MSc in Advanced Computing Security from the University of Bath in UK, where he pursued research in malware and vulnerability analysis. For many years George has also been the Head of Research and Development department of the Astalavista Security Community. George is also a frequent speaker at security conferences around the world on advanced malware analysis, reverse engineering and exploit development techniques.

Digital Editor: Salome Omondi (B.Com)
Salome Omondi leads the Silensec Marketing Department. She holds a Bachelors of Commerce and Management from Strathmore University. Miss Omondi publishes the weekly Silensec Newsletter, keeping you up to date with the latest infosec news as well as improving information security awareness.


Please feel free to share this with interested parties via email, and social media. For a free subscription, please subscribe to our Mailing list and feed-image Feed .

For any questions please click on the following contact us link

Silensec Cyprus HQ

Silensec Africa

Feel free to contact us if you have any problems.

Silensec UK

Feel free to contact us if you have any problems.

News Feed