HackDig : Dig high-quality web security articles for hacker

Website Malware – The SWF iFrame Injector Evolves

Last year, we released a post about a malware injector found in an Adobe Flash (.SWF) file. In that post, we showed how a .SWF file is used to inject an invisible, malicious iFrame. It appears that the author of that Flash malware continued with this method of infection. Now we are seeing more varieties infecting both WordPress and Joomla websites. Though it
Publish At:2015-04-02 21:25 | Read:2806 | Comments:0 | Tags:Joomla! Security Website Malware Website Security WordPress

Website Malware – The SWF iFrame Injector Evolves

Last year, we released a post about a malware injector found in an Adobe Flash (.SWF) file. In that post, we showed how a .SWF file is used to inject an invisible, malicious iFrame. It appears that the author of that Flash malware continued with this method of infection. Now we are seeing more varieties infecting both WordPress and Joomla websites. Though it
Publish At:2015-04-02 15:10 | Read:2968 | Comments:0 | Tags:Joomla! Security Website Malware Website Security WordPress

WordPress Malware Causes Psuedo-Darkleech Infection

Source: The National Archives (UK) Darkleech is a nasty malware infection that infects web servers at the root level. It use malicious Apache modules to add hidden iFrames to certain responses. It’s difficult to detect because the malware is only active when both server and site admins are not logged in, and the iFrame is only injected once a day (or o
Publish At:2015-03-26 13:15 | Read:2359 | Comments:0 | Tags:Joomla! Security Webserver Infections Website Malware Websit

Critical vulnerability affecting HD FLV Player

We’ve been notified of a critical vulnerability affecting the HD FLV Player plugin for Joomla!, WordPress and custom websites. It was silently patched on Joomla! and WordPress, leaving the custom website version vulnerable. Furthermore, websites running this plugin are also at risk of being abused to send spam emails, an issue which wasn’t fixed
Publish At:2014-12-10 13:40 | Read:2615 | Comments:0 | Tags:Joomla! Security Vulnerability Disclosure Vulnerability

JoomDonation Compromised

We are receiving reports from many users of the popular JoomDonation platform that they received a very scary email from someone that supposedly hacked into JoomDonation. The emails went to the registered accounts and contained the full names, so it looks like JoomDonation did in fact get breached. This is the full email: How the hell are you? No need to as
Publish At:2014-11-26 18:10 | Read:2685 | Comments:0 | Tags:Joomla! Security Vulnerability Disclosure Website Hacked hac

Deep Dive into the HikaShop Vulnerability

It’s been two months since our disclosure of an Object Injection vulnerability affecting versions <2.3.3 of the Joomla! Hikashop extension. The vulnerability allowed an attacker to execute malicious code on a target website. How Does Object Injection Work? Object Injection occurs when raw user input is passed to an unserialize() function call. When this h
Publish At:2014-11-17 11:50 | Read:4690 | Comments:1 | Tags:Learn Vulnerability Disclosure hikashop Joomla! Security vul

The Psychology Behind Why Websites Get Hacked

It’s an everyday conversation for security professionals that interact with everyday website owners. The one where we have to explain that just because everything seems fine, doesn’t mean that the best security practices shouldn’t be followed, or that being safe so far doesn’t grant future invincibility. The question, “Why shou
Publish At:2014-11-12 10:20 | Read:2101 | Comments:0 | Tags:Drupal Joomla! Security Magento Security Modx Security OpenX

The Details Behind the Akeeba Backup Vulnerability

It’s been a month since our disclosure of a low-severity vulnerability affecting Akeeba Backup version 3.11.4, which allowed an attacker to list and download backups from a target website using the extension’s JSON API.  As promised, here’s the technical details describing how it was possible for us to send valid requests to the API and dow
Publish At:2014-10-22 14:45 | Read:3441 | Comments:0 | Tags:Joomla! Security Learn Vulnerability Disclosure akeeba Vulne

Joomla! 3.3.5 Released – Fixing High Priority Security Issues

Update: It seems like there is a glitch on the new version and the Joomla team is urging its users not to upgrade yet. From their twitter: Original post: The Joomla team just released versions 3.3.5, 3.2.6 and 2.5.26, patching high priority security issues. The first one is an Remote File Include (RFI) vulnerability and the second one is a Denial of Service
Publish At:2014-09-30 18:50 | Read:4000 | Comments:0 | Tags:Joomla! Security Vulnerability Disclosure dos joomla rfi vul

Security Advisory – Hikashop Extension for Joomla!

Advisory for: Hikashop for Joomla! Security Risk: High (DREAD score : 7/10) Vulnerability: Object Injection / Remote Code Execution Updated Version: 2.3.2 In a routine audit of our Website Firewall we discovered a serious vulnerability within the Hikashop ecommerce product for Joomla! allowing remote code execution on the vulnerable website[s]. What are the
Publish At:2014-09-24 15:20 | Read:3347 | Comments:0 | Tags:Joomla! Security Vulnerability Disclosure vulnerability waf

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud