Tags » Cyber Security

GTA 5 Cyber Crime

Without even bothering to ask, we are quite sure that there is an army of millions waiting for the GTA 5 PC Edition to hit the market. 170 more words

New Point-of-Sale Malware NitlovePoS Sends Card Data via Encrypted Connection

Security researchers identified a fresh malware piece targeting point-of-sale (PoS) systems that relies on encrypted communication to exfiltrate payment card info from the memory of the payment processing machines. 491 more words

Cyber Security

IPhone Users and Users of Wearable Tech at Privacy Risk Due to Bluetooth

Security researchers from Context have revealed that the privacy of millions of smartphone users and users of wearables such as fitness trackers are vulnerable. These devices have one thing in common, as a vulnerability, Bluetooth Low Technology (BLE). 504 more words

Cybersecurity

A Game-Theoretic Approach to design State Cyber Defence Mechanism

Game theory is the mathematical study of interaction among independent, self-interested agents. The audience for game theory has grown dramatically in recent years, and now spans disciplines as diverse as political science, biology, psychology, economics, linguistics, sociology and computer science–among others, such as cyber security. 295 more words

Cyber Security

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

Exploit Title: phpwind v8.7 goto.php? &url Parameter Open Redirect Security Vulnerabilities

Product: phpwind

Vendor: phpwind

Vulnerable Versions: v8.7… 778 more words

Cyber-security

ITMATHFAN reblogged this on Red Fox & Snow and commented:

phpwind_xss2   phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities   Exploit Title: phpwind v8.7 goto.php? &url Parameter Open Redirect Security Vulnerabilities Product: phpwind Vendor: phpwind Vulnerable Versions: v8.7 Tested Version: v8.7 Advisory Publication: May 25, 2015 Latest Update: May 25, 2015 Vulnerability Type: URL Redirection to Untrusted Site ('Open Redirect') [CWE-601] CVE Reference: * Impact CVSS Severity (version 2.0): CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend) Impact Subscore: 4.9 Exploitability Subscore: 8.6 CVSS Version 2 Metrics: Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism Access Complexity: Medium Authentication: Not required to exploit Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification Writer and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)       Caution Details:   (1) Vendor & Product Description: Vendor: phpwind   Product & Vulnerable Versions: phpwind v8.7   Vendor URL & Download: Product can be obtained from here, http://www.phpwind.net/thread/166   Product Introduction Overview: "Today, the country's 200,000 worth of small sites, there are nearly 100,000 community site uses phpwind, has accumulated more than one million sites use phpwind, there are 1,000 new sites every day use phpwind. These community sites covering 52 types of trades every day one million people gathered in phpwind build community, issued 50 million new information, visit more than one billion pages. National Day PV30 million or more in 1000 about a large community, there are more than 500 sites selected phpwind station software provided, including by scouring link Amoy satisfaction, a daily e-commerce and marketing groups, and other on-line product vigorously increase in revenue for the site. Excellent partners, such as Xiamen fish, of Long Lane, Erquan network, Kunshan forum, the North Sea 360, Huizhou West Lake, Huashang like. phpwind recent focus on strengthening community media value, expand e-commerce applications community. phpwind focus on small sites to explore the value of integration and applications, we believe that the website that is community, the community can provide a wealth of applications to meet people access to information, communication, entertainment, consumer and other living needs, gain a sense of belonging, become online home . With the development of the Internet, in the form of the site will be more abundant, the integration of the Forum, more forms of information portals, social networking sites, we will integrate these applications to products which, and to create the most optimized user experience. phpwind mission is to make the community more valuable, so that more people enjoy the convenience of the Internet community in order to enhance the quality of life."       (2) Vulnerability Details: phpwind web application has a computer cyber security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs. Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. phpwind has patched some of them. The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers' right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here! It also publishs suggestions, advisories, solutions details related to Open Redirect vulnerabilities and cyber intelligence recommendations.   (2.1) The first programming code flaw occurs at "&url" parameter in "/goto.php?" page.           References: http://www.tetraph.com/security/open-redirect/phpwind-v8-7-open-redirect/ http://securityrelated.blogspot.com/2015/05/phpwind-v87-xss.html http://www.inzeed.com/kaleidoscope/computer-security/phpwind-v8-7-open-redirect/ https://www.facebook.com/permalink.php?story_fbid=836880753013969&id=767438873291491 https://webtechwire.wordpress.com/2015/05/24/phpwind-v8-7-open-redirect-2/ http://diebiyi.com/articles/security/phpwind-v8-7-open-redirect/ https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01741.html https://itswift.wordpress.com/2015/05/24/phpwind-v8-7-open-redirect/ http://whitehatpost.blog.163.com/blog/static/242232054201542495731506/ http://cxsecurity.com/issue/WLB-2015030028 http://seclists.org/fulldisclosure/2015/Apr/35 http://www.openwall.com/lists/oss-security/2015/05/22/7 http://permalink.gmane.org/gmane.comp.security.oss.general/16883 https://www.facebook.com/websecuritiesnews/posts/796475067139332 http://computerobsess.blogspot.com/2015/05/phpwind-v87-open-redirect.html http://lists.openwall.net/full-disclosure/2015/04/15/1 http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1841

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

Exploit Title: phpwind v8.7 goto.php? &url Parameter Open Redirect Security Vulnerabilities

Product: phpwind

Vendor: phpwind

Vulnerable Versions: v8.7… 778 more words

Cyber-security

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

phpwind v8.7 Unvalidated Redirects and Forwards Web Security Vulnerabilities

Exploit Title: phpwind v8.7 goto.php? &url Parameter Open Redirect Security Vulnerabilities

Product: phpwind

Vendor: phpwind

Vulnerable Versions: v8.7… 778 more words

Cyber-security