BackBox News
Latest news and insights on Security
Company Blogs
Hacking Tools
- SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits
- PolyDrop - A BYOSI (Bring-Your-Own-Script-Interpreter) Rapid Payload Deployment Toolkit
- Secator - The Pentester'S Swiss Knife
- Damn-Vulnerable-Drone - An Intentionally Vulnerable Drone Hacking Simulator Based On The Popular ArduPilot/MAVLink Architecture, Providing A Realistic Environment For Hands-On Drone Hacking
- File-Unpumper - Tool That Can Be Used To Trim Useless Things From A PE File Such As The Things A File Pumper Would Add
- Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests
- Imperius - Make An Linux Kernel Rootkit Visible Again
- BYOSI - Evade EDR's The Simple Way, By Not Touching Any Of The API's They Hook
- Psobf - PowerShell Obfuscator
- ModTracer - ModTracer Finds Hidden Linux Kernel Rootkits And Then Make Visible Again
Exploit DB
- [webapps] dizqueTV 1.5.3 - Remote Code Execution (RCE)
- [webapps] openSIS 9.1 - SQLi (Authenticated)
- [webapps] reNgine 2.2.0 - Command Injection (Authenticated)
- [dos] Windows TCP/IP - RCE Checker and Denial of Service
- [webapps] Gitea 1.22.0 - Stored XSS
- [webapps] Invesalius3 - Remote Code Execution
- [webapps] NoteMark < 0.13.0 - Stored XSS
- [webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Authentication Bypass
- [webapps] Elber ESE DVB-S/S2 Satellite Receiver 1.5.x - Device Config
- [webapps] Elber Wayber Analog/Digital Audio STL 4.00 - Authentication Bypass
New Android Banking Malware ‘ToxicPanda’ Targets Users with Fraudulent Money Transfers
/in General NewsOver 1,500 Android devices have been infected by a new strain of Android banking malware called ToxicPanda that allows threat actors to conduct fraudulent banking transactions.
“ToxicPanda’s main goal is to initiate money transfers from compromised devices via account takeover (ATO) using a well-known technique called on-device fraud (ODF),” Cleafy researchers Michele Roviello, Alessandro Strino
The Hacker News – Read More
Hackers Deploy CRON#TRAP for Persistent Linux System Backdoors
/in General NewsCRON#TRAP is a new phishing attack using emulated Linux environments to bypass security and establish persistent backdoors. Leveraging…
Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News – Read More
On Election Day, Disinformation Worries Security Pros the Most
/in General NewsA Dark Reading poll reveals widespread concern over disinformation about election integrity and voter fraud, even as Russia steps up deepfake attacks meant to sow distrust in the voting process among the electorate.
darkreading – Read More
Researcher Discloses 36 Vulnerabilities Found in IBM Security Verify Access
/in General NewsAttackers could have exploited IBM Security Verify Access vulnerabilities to compromise the entire authentication infrastructure.
The post Researcher Discloses 36 Vulnerabilities Found in IBM Security Verify Access appeared first on SecurityWeek.
SecurityWeek – Read More
Google Patches Two Android Vulnerabilities Exploited in Targeted Attacks
/in General NewsGoogle warns of the limited, targeted exploitation of two vulnerabilities resolved with the latest Android security update.
The post Google Patches Two Android Vulnerabilities Exploited in Targeted Attacks appeared first on SecurityWeek.
SecurityWeek – Read More
Leveraging Wazuh for Zero Trust security
/in General NewsZero Trust security changes how organizations handle security by doing away with implicit trust while continuously analyzing and validating access requests. Contrary to perimeter-based security, users within an environment are not automatically trusted upon gaining access. Zero Trust security encourages continuous monitoring of every device and user, which ensures sustained protection after
The Hacker News – Read More
QNAP fixed NAS backup zero-day demonstrated at Pwn2Own Ireland 2024
/in General NewsIn a way of working that looks like someone digging a trench while the other behind is covering it, and a third one is digging it yet again, this is another example of how bad software keeps cyber security in business. (Great read, by the way) Bad software may be too harsh and flaws may range from exposed credentials, and misconfiguration to more advanced issues like miss-after-use or implicit…
Source
TechSplicer – Read More
Schneider Electric Launches Probe After Hackers Claim Theft of User Data
/in General NewsHackers claim to have stolen sensitive information, including user data, after breaching Schneider Electric’s Jira system.
The post Schneider Electric Launches Probe After Hackers Claim Theft of User Data appeared first on SecurityWeek.
SecurityWeek – Read More
Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
/in General NewsTaiwanese network-attached storage (NAS) appliance maker Synology has addressed a critical security flaw impacting DiskStation and BeePhotos that could lead to remote code execution.
Tracked as CVE-2024-10443 and dubbed RISK:STATION by Midnight Blue, the zero-day flaw was demonstrated at the Pwn2Own Ireland 2024 hacking contest by security researcher Rick de Jager.
RISK:STATION is an ”
The Hacker News – Read More
Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages
/in General NewsAn ongoing campaign is targeting npm developers with hundreds of typosquat versions of their legitimate counterparts in an attempt to trick them into running cross-platform malware.
The attack is notable for utilizing Ethereum smart contracts for command-and-control (C2) server address distribution, according to independent findings from Checkmarx, Phylum, and Socket published over the past few
The Hacker News – Read More