WannaCry is malware with a worm+ransomware characteristics as such it is a blended threat. Initial news of attacks were provided by Telefonica in Spain, the malware was able to spread to networks in the National Health Service (NHS) and has infected at least 16 Hospitals, followed by many other incidents across the world. The ransomware … Continue reading “WannaCry Startup Sequence”
Author: Deepak Shanker
WannaDecrypt0r Ransomware
The WannaDecrypt0r ransomware has infected at least 16 Hospitals in the UK and has been spreading quite a bit within the masses. The ransomware is being identified with many names such as WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY and WannaDecrypt0r. At present, it is believed that over 36000 machines have been compromised by this ransomware. All … Continue reading “WannaDecrypt0r Ransomware”
CVE-2017-5689: Intel Elevation Of Privilege Vulnerability
An Elevation of privilege vulnerability in Intel’s Management solutions, was confirmed by Intel who released INTEL-SA-00075 for the same. The vulnerability can allow an unprivileged attacker to take over the management features. This vulnerability is assigned ID CVE-2017-5689, it rated as critical for affected targets. It is important to note that this bug does not affect … Continue reading “CVE-2017-5689: Intel Elevation Of Privilege Vulnerability”
EternalBlue SMB Exploit
UPDATED: May 12, 2017 In what may be the first public weaponizing of April’s Shadow Brokers dump of NSA exploits, a ransomware attack has crippled IT systems globally and disrupted operations at major organizations, including patient services at UK hospitals. WannaCry exploits the ETERNALBLUE vulnerability and please refer to the Qualys blog on WannaCry for … Continue reading “EternalBlue SMB Exploit”
ShadowBrokers NSA Tool Dump
On Friday, April 14, 2017 – The mysterious hacking group ShadowBrokers released over 300MB of NSA hacking tools and exploits. The dump is hosted as a Yandex disk with password “Reeeeeeeeeeeeeee”. The current dump contains 3 folders oddjob, windows, swift as described below, and a detailed list of the contents can be found here. oddjob An implant builder … Continue reading “ShadowBrokers NSA Tool Dump”
Windows OLE Zero-Day Vulnerability
An exploit for an unpatched Windows OLE vulnerability has been observed in the wild. The user opens a document containing the embedded exploit, which executes a Visual Basic script. The vulnerability was initially reported by Ryan Hanson . As per McAfee the earliest attack were observed in late January 2017. The exploit works against all Microsoft … Continue reading “Windows OLE Zero-Day Vulnerability”
Microsoft XML Information Disclosure Vulnerability – CVE-2017-0022
Introduction: An Information disclosure vulnerability was found in the Microsoft XML services, the vulnerability can be exploited to detect files on target machines. The bug is fixed in MS17-022. The exploit uses an XMLDOM object to call res (Microsoft HTML Resource pluggable protocol) URL protocol. By default the support for res protocol is disabled so if you open … Continue reading “Microsoft XML Information Disclosure Vulnerability – CVE-2017-0022”
Windows GDI Elevation of Privilege Vulnerability: CVE-2017-0005
An Elevation of Privilege vulnerability in the Windows GDI component was reported to Microsoft by Lockheed Martin Computer Incident Response Team. The vulnerability is assigned Id – CVE-2017-0005 “Windows GDI Elevation of Privilege Vulnerability”. The bug was addressed in MS17-0013 along with other GDI targeted EoP vulnerabilities. According to Microsoft this exploit is used by the … Continue reading “Windows GDI Elevation of Privilege Vulnerability: CVE-2017-0005”
Chakra: Type Confusion Vulnerability – CVE-2016-7201
Introduction: Last year in the month of September, the Project Zero team from Google disclosed vulnerabilities in the Microsoft JavaScript engine Chakra. CVE-2016-7200 and CVE-2016-7201 are two such bugs that caught the limelight. Even though it’s an old bug it is worth discussing their specifics. Both of these vulnerabilities went from PoC of vulnerability to … Continue reading “Chakra: Type Confusion Vulnerability – CVE-2016-7201”
Windows SMBv3 Zero Day Vulnerability
Introduction: A buffer overflow vulnerability in SMBv3 was made public on Feb 12017, by Laurent Gaffie. The CVE-ID is CVE-2017-0016. A PoC for the same is also available here. The bug affects Windows 2012, Server 2016 and Windows 10. At the moment the PoC only demonstrates DoS attack on the target, we are not sure … Continue reading “Windows SMBv3 Zero Day Vulnerability”