Call us today on: +44 (0)203 88 020 88
SecureTeamSecureTeamSecureTeamSecureTeam
  • Home
  • Our Services
    • Infrastructure Testing
      • Internal Network Penetration Test
      • External Network Penetration Test
      • Wireless Network Penetration Test
      • Vulnerability Assessment
      • Network Segregation Test
      • Voice over IP (VoIP) Penetration Test
    • Application Testing
      • Web Application Penetration Test
      • Mobile Application Penetration Test
      • Desktop Application Security Assessment
      • Citrix Breakout Test
    • Configuration Review
      • Windows Server Build Review
      • Linux Server Build Review
      • Citrix Configuration Review
    • Information Assurance
      • ISO 27001 Gap Analysis
    • Cyber Essentials
  • News
  • Articles
  • About
    • About SecureTeam
    • STORM Appliances
      • Installing a STORM Device
      • Returning a STORM Device
    • White-Label Consultancy
    • Jobs
    • Cookie Policy
    • Privacy Notice
    • Website Terms & Conditions
  • Contact Us

Blog

Home 2020 November

VMWare warns of critical zero-day vulnerability

By Mark Faithfull | News, Vulnerabilities | 25 November, 2020 | 0

VMWare has issued a security advisory warning of a command injection vulnerability that could allow someone with access to the VMWare Configurator admin account to issue command with unrestricted privileges on the underlying operating system. The vulnerability (CVE-2020-4006) affects VMWare Workspace One Access, Access Connector, Identity Manage and Identify Manager Connector administrative configurator.  A maliciousRead more

NCSC alerts over MobileIron vulnerability

By Mark Faithfull | News, Vulnerabilities | 25 November, 2020 | 0

The UK National Cyber Security Centre has issued an alert warning that multiple actors are attempting to exploit a MobileIron vulnerability to compromise the networks of UK organisations. MobileIron issued a security patch in June 2020 for their Mobile Device Management system to resolve several vulnerabilities in their software.  Included was a critical remote codeRead more

NAT Slipstream attack defeats NAT firewalls

By Mark Faithfull | Articles, Infrastructure | 19 November, 2020 | 0

NAT Slipstream allows an attacker outside the firewall to remotely access any TCP or UDP services running on a local machine, behind a NAT firewall, simply by tricking the victim into visiting a malicious website. Yes, you read that correctly- by using the NAT Slipstream attack, an attacker is able to send arbitrary traffic toRead more

SAD DNS vulnerability revives risk of DNS poisoning

By Mark Faithfull | News, Vulnerabilities | 19 November, 2020 | 0

An award winning security paper published this week explains a newly discovered vulnerability called SAD DNS which leaves many websites vulnerable to man-in-the-middle and impersonation attacks. DNS is the system that converts friendly website addresses (www.secureteam.co.uk) into the numeric IP addresses used by TCP/IP.  SAD DNS is a flaw discovered in the DNS protocol whichRead more

Where most Android malware comes from

By Mark Faithfull | News | 19 November, 2020 | 0

A research paper just published by NortonLifeLock analysed details of app installations on 12 million Android devices and determined that most malware and unwanted apps are actually downloaded from the Google Play store. The research paper examined the installation details of almost 8 million different apps onto 12 million devices during the Autumn of 2019Read more

Ransomware group now using FB Ads to pressure victims

By Mark Faithfull | News | 12 November, 2020 | 0

On Monday 9th November, Facebook ads started to appear targeting the Campari Group which is still mired in the middle of a ransomware attack. It appears the criminals behind the attack on Campari used a hacked Facebook account to place the ads in order to increase the pressure on Campari to pay the demanded ransom.Read more

November Patch Tuesday fixes 12 RCE vulnerabilities

By Mark Faithfull | News, Vulnerabilities | 12 November, 2020 | 0

The November security patch bundle from Microsoft fixes 112 security vulnerabilities in their products, including 12 Remote Code Execution vulnerabilities. Noteworthy vulnerabilities fixed this month include:   Windows Kernel Local Elevation of Privilege:  CVE-2020-17087 Observed under active attack in the wild by Google, CVE-2020-17087 is an elevation of privilege vulnerability that was being used inRead more

Adobe issues Acrobat security patches

By Mark Faithfull | News, Vulnerabilities | 5 November, 2020 | 0

Adobe has issued patches for critical vulnerabilities in their Acrobat and Acrobat Reader software widely used for creating and reading PDF documents.  12 fixes are included in the latest security updates, three are rated as Critical as they can be exploited to achieve arbitrary code execution.  In other words, this means simply opening a speciallyRead more

Windows 0-day vulnerability disclosed

By Mark Faithfull | News, Vulnerabilities | 5 November, 2020 | 0

Google’s Project Zero has disclosed the details of a Windows 0-day vulnerability under active attack which affects all versions from Windows 7 through to Windows 10. No patch is yet available from Microsoft but one is expected in the November 2020 patch Tuesday updates. Last week we published details of a Chrome Browser 0-day vulnerabilityRead more

The Top 10 vulnerabilities being exploited today

By Mark Faithfull | Articles, Information Assurance | 3 November, 2020 | 0

The NSA (National Security Agency) recently published a security advisory about the publicly known vulnerabilities currently being exploited by Chinese state-sponsored actors. While this security advisory is focused on the activities of state-sponsored actors, it does show the threats and vulnerabilities considered most useful for exploitation. Taking a quick look at the list could provideRead more

Recent Posts

  • HTML Phishing on the rise
  • Microsoft patches critical zero-day
  • NCSC offers free email security tool
  • Top 15 Most Exploited Vulnerabilities for 2021
  • NHS Targeted in Phishing Campaign

Tags

Adobe Android Apple blockchain Bluetooth Chrome Cisco credential stuffing cyber crime cyber essentials cyber security cyber security news Data Protection DDoS Dell DNS Exchange Server exim formjacking GDPR Google IoT Linux microsoft Mozilla ncsc npm patching penetration testing phishing ransomware RDP SAP security breach Security operations security testing SIEM software development Spectre supply chain attacks Sysinternals vulnerability management web applications web browsers wireless

Archives

  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • July 2018
  • June 2018
  • April 2018
  • January 2018
  • October 2017
BCS Cyber Essentials Cyber Essentials Cyber Essentials PLUS ISO 9001 ISO 27001
information. secured.
  • Home
  • Our Services
    • Infrastructure Testing
      • Internal Network Penetration Test
      • External Network Penetration Test
      • Wireless Network Penetration Test
      • Vulnerability Assessment
      • Network Segregation Test
      • Voice over IP (VoIP) Penetration Test
    • Application Testing
      • Web Application Penetration Test
      • Mobile Application Penetration Test
      • Desktop Application Security Assessment
      • Citrix Breakout Test
    • Configuration Review
      • Windows Server Build Review
      • Linux Server Build Review
      • Citrix Configuration Review
    • Information Assurance
      • ISO 27001 Gap Analysis
    • Cyber Essentials
  • News
  • Articles
  • About
    • About SecureTeam
    • STORM Appliances
      • Installing a STORM Device
      • Returning a STORM Device
    • White-Label Consultancy
    • Jobs
    • Cookie Policy
    • Privacy Notice
    • Website Terms & Conditions
  • Contact Us
SecureTeam