Aggregator

本文由数据安全与取证原创，转载请注明。

本文由数据安全与取证原创，转载请注明。

本文由数据安全与取证原创，转载请注明。

本文由数据安全与取证原创，转载请注明。

本文由数据安全与取证原创，转载请注明。

本文由数据安全与取证原创，转载请注明。

HackerNews 编译，转载请注明出处： 亲巴勒斯坦的黑客组织 Dark Storm 声称，周一通过分布式拒绝服务（DDoS）攻击导致全球多地的 X 平台（原推特）出现中断，X 平台随后启用了 Cloudflare 的 DDoS 防护服务。 X 平台的所有者埃隆·马斯克虽未明确指出中断是由于 DDoS 攻击，但他确认是遭到了“大规模网络攻击”。 “针对 X 平台的网络攻击仍在持续，”马斯克在 X 平台上发文称，“我们每天都会遭受攻击，但这次动用了大量资源，可能是大型有组织的团体或某个国家所为。” Dark Storm 是一个亲巴勒斯坦的黑客组织，于 2023 年成立，曾多次攻击以色列、欧洲和美国的组织。 该组织今日在 Telegram 频道上发布消息，声称对 Twitter 发起 DDoS 攻击，并分享了攻击证明的截图和链接。 Check-host.net 是一个允许用户检查全球不同服务器上网站可用性的网站，常在 DDoS 攻击期间用于展示攻击正在进行。 X 平台目前受 Cloudflare 的 DDoS 防护服务保护，当可疑 IP 地址连接网站或单个 IP 地址请求过多时，会显示验证码。 该网站的 help.x.com 部分目前对所有请求都显示 Cloudflare 验证码。 黑客组织多次证明，他们能够利用僵尸网络等资源，干扰大型科技平台。 2024 年，美国指控两名苏丹兄弟涉嫌运营 Anonymous Sudan 黑客组织。 该组织成功使包括 Cloudflare、微软和 OpenAI 在内的多家大型科技公司的网站和 API 下线，导致全球众多用户服务中断。   消息来源：The Hacker News；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability classified as problematic was found in Achievo 1.3.2. Affected by this vulnerability is an unknown functionality of the file dispatch.php. The manipulation of the argument atkaction leads to cross site scripting. This vulnerability is known as CVE-2008-6034. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, has been found in Acgv.free ACGV News 0.9.1. Affected by this issue is some unknown functionality of the file glossaire.php. The manipulation of the argument id leads to sql injection. This vulnerability is handled as CVE-2008-2412. The attack may be launched remotely. Furthermore, there is an exploit available.

HackerNews 编译，转载请注明出处： 一种新的大规模恶意软件活动正在通过伪装成旨在绕过在线服务限制的工具，用名为SilentCryptoMiner的加密货币矿工感染用户。 俄罗斯网络安全公司卡巴斯基表示，这一活动是更大趋势的一部分，网络犯罪分子越来越多地利用Windows数据包重定向（WPD）工具，以限制绕过程序的形式分发恶意软件。 “此类软件通常以存档形式分发，附带文本安装说明，开发者以误报为由建议禁用安全解决方案，”研究人员列昂尼德·别兹韦申科、德米特里·皮库什和奥列格·库普列夫表示，“这正好符合攻击者的利益，使他们能够在不受保护的系统中持续存在，而不会被发现。” 这种手段已被用于传播窃取程序、远程访问工具（RATs）、提供隐藏远程访问的特洛伊木马以及像NJRat、XWorm、Phemedrone和DCRat这样的加密货币矿工。 这一策略的最新变化是一场活动，通过伪装成基于深度数据包检测（DPI）绕过工具的矿工，感染了2000多名俄罗斯用户。据说，该程序通过一个拥有6万订阅者的YouTube频道上的恶意存档链接进行宣传。 在2024年11月发现的后续策略升级中，威胁者被发现冒充工具开发者，以虚假的版权打击通知威胁频道所有者，要求他们发布带有恶意链接的视频，否则以所谓的侵权为由面临频道被关闭的风险。 “2024年12月，用户报告了通过其他Telegram和YouTube频道分发的感染矿工的工具版本，这些频道随后被关闭，”卡巴斯基表示。 这些带有陷阱的存档文件被发现包含一个额外的可执行文件，其中一个合法的批处理脚本被修改为通过PowerShell运行二进制文件。如果系统中安装的杀毒软件干扰攻击链并删除恶意二进制文件，用户将看到一条错误消息，提示他们重新下载文件，并在禁用安全解决方案后运行它。 该可执行文件是一个基于Python的加载程序，旨在检索下一阶段的恶意软件，另一个Python脚本下载SilentCryptoMiner矿工有效载荷并建立持久性，但在检查是否在沙盒中运行并配置Windows Defender排除项之前不会采取行动。 “为了隐身，SilentCryptoMiner采用进程空心化技术将矿工代码注入系统进程（在这种情况下是dwm.exe），”卡巴斯基表示，“该恶意软件能够在配置中指定的进程活动时停止挖矿，并且可以通过网页面板进行远程控制。”   消息来源：The Hacker News；  本文由 HackerNews.cc 翻译整理，封面来源于网络；   转载请注明“转自 HackerNews.cc”并附上原文

各种精品好礼待你领取~

各种精品好礼待你领取~

RogueSliver A suite of tools to disrupt campaigns using the Sliver C2 framework. This tool, its uses, and how it was created will be covered in depth on ACEResponder.com This tool is for educational purposes...

The post RogueSliver: disrupt campaigns using the Sliver C2 framework appeared first on Penetration Testing Tools.

A vulnerability was found in CodePeople Contact Form Email Plugin up to 1.3.31 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to missing authorization. This vulnerability is uniquely identified as CVE-2023-28494. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in CodePeople Contact Form Email Plugin up to 1.3.41 on WordPress. This affects an unknown part. The manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is uniquely identified as CVE-2023-48318. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Pluggabl Booster Elite for WooCommerce Plugin up to 7.1.2 on WordPress. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to improper access controls. The identification of this vulnerability is CVE-2023-51511. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in IBM Engineering Lifecycle Optimization Publishing 7.0.2/7.0.3. This affects an unknown part of the component Request Handler. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2023-45188. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in WooCommerce Stripe Payment Gateway Plugin up to 7.4.0 on WordPress and classified as problematic. This vulnerability affects unknown code. The manipulation leads to missing authorization. This vulnerability was named CVE-2023-35049. The attack can be initiated remotely. There is no exploit available.

A vulnerability was found in IBM Security SOAR 51.0.2.0. It has been classified as critical. Affected is an unknown function. The manipulation leads to code injection. This vulnerability is traded as CVE-2024-38319. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.