Articles
Threat Round Up for Aug 25 – Sep 1
Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between August 25 and September 1. As with previous round-ups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key beha…
Back to Basics: Worm Defense in the Ransomware Age
This post was authored by Edmund Brumaghin “Those who cannot remember the past are condemned to repeat it.” – George Santayana The Prequel In March 2017, Microsoft released a security update for various versions of Windows, which addressed a remote code execution vulnerability affecting a prot…
Vulnerability Spotlight: Multiple Gdk-Pixbuf Vulnerabilities
Today, Talos is disclosing the discovery of two remote code execution vulnerabilities which have been identified in the Gdk-Pixbuf Toolkit. This toolkit used in multiple desktop applications including Chromium, Firefox, GNOME thumbnailer, VLC and others. Exploiting this vulnerability allows an attac…
Vulnerability Spotlight: Code Execution Vulnerability in LabVIEW
LabVIEW is a system design and development platform released by National Instruments. The software is widely used to create applications for data acquisition, instrument control and industrial automation. Talos is disclosing the presence of a code execution vulnerability which can be triggered by op…
Vulnerability Spotlight: Lexmark Perceptive Document Filters Code Execution Bugs
Overview Talos is disclosing a pair of code execution vulnerabilities in Lexmark Perceptive Document Filters. Perceptive Document Filters are a series of libraries that are used to parse massive amounts of different types of file formats for multiple purposes. Talos has previously discussed in detai…
Threat Round-up for Aug 11 – Aug 18
Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between August 11 and August 18. As with previous round-ups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavi…
Booters with Chinese Characteristics: The Rise of Chinese Online DDoS Platforms
This post was authored by Dave Liebenberg In the past few months, Talos has observed an uptick in the number of Chinese websites offering online DDoS services. Many of these websites have a nearly identical layout and design, offering a simple interface in which the user selects a target’s host, por…
When combining exploits for added effect goes wrong
Since public disclosure in April 2017, CVE-2017-0199 has been frequently used within malicious Office documents. The vulnerability allows attackers to include Ole2Link objects within RTF documents to launch remote code when HTA applications are opened and parsed by Microsoft Word. In this recent cam…
WinDBG and JavaScript Analysis
This blog was authored by Paul Rascagneres. Introduction JavaScript is frequently used by malware authors to execute malicious code on Windows systems because it is powerful, natively available and rarely disabled. Our previous article on .NET analysis generated much interest relating to how to use…