Remove 11
article thumbnail

Threat actors are actively exploiting Zerologon flaw, Microsoft warns

Security Affairs

An attacker could also exploit the flaw to disable security features in the Netlogon authentication process and change a computer’s password on the domain controller’s Active Directory. FIND which devices are making vulnerable connections by monitoring event logs. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

article thumbnail

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Security Affairs

malware was used by threat actors to establish a backdoor in MSSQL Server 11 and 12 servers, allowing them to access to any account on the server using a “magic password.” are related to authentication and event logging.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Using a WordPress flaw to leverage Zerologon vulnerability and attack companies’ Domain Controllers

Security Affairs

x.xPerforming authentication attempts… =Target vulnerable, changing account password to empty stringResult: 0Exploit complete! This vulnerability is critical and is based on an encryption flaw, and allows changing the account machine password to empty. Figure 11: Zerologon detection ([link]. DOMAIN_NAME 192.168.x.xPerforming

article thumbnail

Ursnif campaign targets Italy with a new infection Chain

Security Affairs

It appeared on the threat landscape about 13 years ago and gained its popularity since 2014 when its source code was leaked online giving the opportunity to several threat actors to develop their own version. This technique to protect the document with a password continues to be a very effective method to evade detection of AVs.

Archiving 126
article thumbnail

Hacking eCommerce sites based on OXID eShop by chaining 2 flaws

Security Affairs

Since the underlying database driver is per default set to PDO, an attacker can make use of stacked queries to insert a brand new admin user with a password of his choice. Below the timeline for the flaws: Date Event 11/Dec/2017 Reported a SQL Injection in OXID 4.10.6 Pierluigi Paganini. SecurityAffairs –. Marriott, GDPR).

GDPR 61
article thumbnail

Commodity Malware Reborn: The AgentTesla “Total Oil” themed Campaign

Security Affairs

Agent Tesla is a fully customizable password info-stealer offered as malware-as-a-service , many cyber criminals are choosing it as their preferred recognition tool. . It is a fully customizable password info-stealer and many cyber criminals are choosing it as their preferred recognition tool. . Introduction. Pierluigi Paganini.

article thumbnail

Weekly podcast: 2018 end-of-year roundup

IT Governance

As is now traditional, I’ve installed myself in the porter’s chair next to the fire in the library, ready to recap some of the year’s more newsworthy information security events. Users were encouraged to change their passwords. Information including their names, email addresses, and encrypted passwords may have been compromised.