research

Critically Underrated: Studying the Data Distribution Service (DDS) Protocol

Posted on by Admin
Critically Underrated: Studying the Data Distribution Service (DDS) Protocol

By Federico Maggi, Rainer Vosseler (Trend Micro Research), Mars Cheng, Patrick Kuo, Chizuru Toyama, Ta-Lun Yen (TXOne Networks), Erik Boasson (ADLINK), and Victor Mayoral Vilches (Alias Robotics) Despite being unknown even to industry practitioners, the Data Distribution Service (DDS) protocol has been in use for more than a decade. This middleware software technology is responsible for running billions of public and private devices and mechanisms currently in use.  DDS is integral in embedded systems that…

Read More

An Investigation of the BlackCat Ransomware via Trend Micro Vision One

Posted on by Admin
An Investigation of the BlackCat Ransomware via Trend Micro Vision One

An Investigation of the BlackCat Ransomware via Trend Micro Vision One Ransomware We recently investigated a case related to the BlackCat ransomware group using the Trend Micro Vision One™ platform, which comes with extended detection and response (XDR) capabilities. BlackCat (aka AlphaVM or AlphaV) is a ransomware family created in the Rust programming language and operated under a ransomware-as-a-service (RaaS) model. By: Lucas Silva, Leandro Froes April 18, 2022 Read time:  ( words) We recently…

Read More

An In-Depth Look at ICS Vulnerabilities Part 3

Posted on by Admin
An In-Depth Look at ICS Vulnerabilities Part 3

The items on this chart are showing what percentages of ICS-affecting vulnerabilities identified by 2021 advisories are caused by what kind of weaknesses – “flaws, faults, bugs, or other errors” – in coding. Nine percent was caused by CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, while CWE-787 Out-of-Bounds Write affected 8.3%. Additionally, 6.7% was caused by CWE-20 Improper Input Validation and 4.8% was due to CWE-79 Improper Neutralization of Input…

Read More

Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One and Cloud One

Posted on by Admin
Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One and Cloud One

Detecting Exploitation of Local Vulnerabilities Through Trend Micro Vision One and Cloud One Exploits & Vulnerabilities We provide a guide to detecting Dirty Pipe, a Linux kernel vulnerability tracked as CVE-2022-0847.  By: Sunil Bharti April 06, 2022 Read time:  ( words) This blog provides threat analysts a guide to detecting an arbitrary file overwrite vulnerability in Linux Kernel, also known as Dirty Pipe. Dirty Pipe is a local privilege escalation vulnerability that is tracked as CVE-2022-0847….

Read More

Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload

Posted on by Admin
Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload

Thwarting Loaders: From SocGholish to BLISTER’s LockBit Payload Cyber Threats Both BLISTER and SocGholish are loaders known for their evasion tactics. Our report details what these loaders are capable of and our investigation into a campaign that uses both to deliver the LockBit ransomware. By: Earle Maui Earnshaw, Mohamed Fahmy, Ian Kenefick, Ryan Maglaque, Abdelrhman Sharshar, Lucas Silva April 05, 2022 Read time:  ( words) The Trend MicroTM Managed XDR team has made a series…

Read More

An In-Depth Look at ICS Vulnerabilities Part 2

Posted on by Admin
An In-Depth Look at ICS Vulnerabilities Part 2

This chart shows CVEs affecting Critical Manufacturing that was identified in 2021 advisories which might be used to accomplish tactics from the MITRE ATT&CK framework ease of reading. Names and definitions of tactics are directly referenced from the MITRE ATT&CK framework. Six hundred and thirteen CVEs identified in advisories in 2021 are likely to affect Critical Manufacturing environments, 88.8% of them might be leveraged by attackers to create an Impact (to directly or indirectly cause…

Read More

MacOS SUHelper Root Privilege Escalation Vulnerability A Deep Dive Into CVE-2022-22639

Posted on by Admin
MacOS SUHelper Root Privilege Escalation Vulnerability A Deep Dive Into CVE-2022-22639

MacOS SUHelper Root Privilege Escalation Vulnerability A Deep Dive Into CVE-2022-22639 We discovered a now-patched vulnerability in macOS SUHelper, designated as CVE-2022-22639. If exploited, the vulnerability could allow malicious actors to gain root privilege escalation. By: Mickey Jin April 04, 2022 Read time:  ( words) We discovered a vulnerability in suhelperd, a helper daemon process for Software Update in macOS. A class inside suhelperd, SUHelper, provides an essential system service through the inter-process communication (IPC)…

Read More

An In-Depth Look at ICS Vulnerabilities Part 1

Posted on by Admin
An In-Depth Look at ICS Vulnerabilities Part 1

In 2021, there were significant changes in the methods used by cyber attackers. More advanced destructive supply chain attacks also came to the surface this year. This has created an anxious environment, driving developments in cyber defense and the discovery of ICS-related CVEs. 2021’s timeline overview of major OT and ICS cyber incidents shows that modern criminal operations have become so developed that a service industry has emerged with a common business model – Ransom­ware-as-a-Service…

Read More

Why Organizations Should Take Cloud-Based Cryptocurrency-Mining Attacks Seriously

Posted on by Admin
Why Organizations Should Take Cloud-Based Cryptocurrency-Mining Attacks Seriously

But that’s just the tangible cost of a cryptocurrency-mining attack. There are also indirect consequences that an affected organization might encounter, such as the disruption and slowdown of operations that could result in loss of revenue or even damage to the reputation of the organization because of the inconveniences brought upon its customers. The major players in the cloud-based cryptocurrency mining landscape are diverse in terms of their tools, techniques, and even the way they…

Read More
1 … 11 12 13 14 15 … 18