Vulnerabilities

Roundcube Markasjunk Plugin Command Injection Vulnerability Analysis

On June 6, 2023, security researchers discovered a vulnerability in Roundcube’s “markasjunk” plugin. This vulnerability allow attackers to execute command by sending a specifically crafted identity email address through plugin.

Although the CVSSv3 score of the vulnerability is defined as “6.5”, according to Cyberthint analysts, its impact is actually critical and CWE ID: CWE-77.

Affected Versions: Roundcube versions 1.6.1 and earlier versions, when the markasjunk plugin is enabled.

Cyber Threats

Increase in the Theft of Credit Cards Using “Sniffer” in Recent

Sniffing method is an attack method used by cyber fraudsters to steal private information such as passwords and credit cards of website customers by compromising/hacking an e-commerce website.

Cyber fraudsters on the dark web target e-commerce sites and can gain access through passwords obtained from stealer logs or through webshells they install on the systems as a result of exploiting web application/server security vulnerabilities on the site. Then, they can steal users’ credit card information by placing sniffers on the forms where customer credit card information is entered on payment pages or by embedding their own phishing pages with “iframe” tags on the payment page that opens when the user wants to purchase a product. It is known that cyber fraudsters use the stolen credit cards to shop on websites without 3D Secure protection, called “cardable”, or to sell them on the dark web.

Cyber Threats

What is BEC (Business E-mail Compromise) Attack and Prevention Methods

A BEC (Business Email Compromise) attack is a cash-oriented type of cyber fraud that targets companies that work with foreign suppliers and make bank transfers. The attacker somehow obtains the email address of a company executive or an employee responsible for financial transactions, whether corporate or public. They then hunt for words such as request, payment, transfer and urgent in email messages. In the final phase, they try to deceive individuals by impersonating them and inserting themselves into conversations in order to transfer the money to their own account.

CTI Fundamentals

All Aspects of Cyber Threat Intelligence Concepts

Cyber Threat Intelligence (CTI) is a cyber security approach that focuses on gathering information by analyzing both current and potential risks/attacks that threaten the security of a company or organization’s physical and digital assets. CTI teams enable the organizations they serve to take action as soon as possible with the information they provide.