Author: lennarthaagsma

Detecting Ticketbleed (CVE-2016-9244)

On Thursday February 9th the vulnerability named ’Ticketbleed’ was made public. The name of this vulnerability does not just sound similar to Heartbleed, but also shares the same implication: remote reading of uninitialized memory. At the time we published Snort IDS detection rules for the Heartbleed vulnerability in OpenSSL, and have now decided to do … Continue reading Detecting Ticketbleed (CVE-2016-9244) →

Recent vulnerability in Eir D1000 Router used to spread updated version of Mirai DDoS bot

Over the last two months a lot has been written about the DDoS malware called Mirai. The first known attack, that only later was attributed to Mirai, was against the Krebs On Security blog on September 20th. It is likely that this same botnet attacked Dyn a month later, causing a massive outage among popular … Continue reading Recent vulnerability in Eir D1000 Router used to spread updated version of Mirai DDoS bot →

Deep dive into QUANTUM INSERT

Summary and recommendations QUANTUMINSERT (QI) is actually a relatively old technique. In order to exploit it, you will need a monitoring capabilities to leak information of observed TCP sessions and a host that can send spoofed packets. Your spoofed packet also needs to arrive faster than the original packet to be able to be successful. Any … Continue reading Deep dive into QUANTUM INSERT →

CryptoPHP: Analysis of a hidden threat inside popular content management systems

Update: We've published statistics on CryptoPHP and some advice: CryptoPHP a week later: more than 23.000 sites affected CryptoPHP is a threat that uses backdoored Joomla, WordPress and Drupal themes and plug-ins to compromise webservers on a large scale. By publishing pirated themes and plug-ins free for anyone to use instead of having to pay … Continue reading CryptoPHP: Analysis of a hidden threat inside popular content management systems →