admin

admin

  • Joined: September 10, 2024
  • Articles: 9013

Millions of HP, Samsung, and Xerox Printers Vulnerable Due to 16-Year-Old Security Flaw

July 20, 2021

A serious security vulnerability has come to light in a software driver used by HP, Xerox, and Samsung printers, lingering undetected since 2005. Assigned CVE-2021-3438 (CVSS score: 8.8), this issue involves a buffer overflow in the “SSPORT.SYS” print driver installer, which could allow for remote privilege escalation and arbitrary code execution. Hundreds of millions of printers worldwide may be affected, although there is currently no evidence of real-world exploitation. The vulnerability, first identified by SentinelLabs researchers on February 18, 2021, was disclosed in an advisory in May, noting its potential to elevate privileges in certain HP LaserJet and Samsung printer models. Fixes for the impacted devices were made available on May 19, 2021.

Longstanding Security Flaw in Printer Software Puts Millions at Risk On July 20, 2021, cybersecurity experts disclosed a critical vulnerability that has affected millions of printers globally. This issue stems from a software driver utilized by HP, Xerox, and Samsung…

U.S. Defense Officials at Risk of Cyber Espionage Through Social Media Platforms

May 16, 2013

Recently, I undertook a fascinating study on the role of social media in the military sector. The widespread adoption of these platforms makes them extremely appealing to governments and intelligence agencies. Social media has significant potential for exploitation in critical areas, including military and defense.

Modern social networks are extensively utilized by various governments, with the U.S., China, and Russia leading the way. Additionally, emerging cyber powers like Iran and North Korea are increasingly interested in utilizing these platforms.

Governments primarily use social media for purposes such as Psychological Operations (PsyOps), Open Source Intelligence (OSINT), cyber espionage, and offensive strategies.

On May 10th, the Illinois Air National Guard’s 183rd Fighter Wing issued a notice in their monthly Falcon View newsletter, highlighting the risks associated with social networking sites.

Potential Cyber Espionage Threats Targeting U.S. Department of Defense Officials via Social Media May 16, 2013 Recent investigations have highlighted an alarming trend in the military sector: U.S. Department of Defense officials are increasingly at risk of cyber espionage facilitated…

Silver Fox Exploits Microsoft-Signed WatchDog Driver to Distribute ValleyRAT Malware

Date: September 2, 2025
Categories: Financial Fraud / Endpoint Protection

The threat actor known as Silver Fox has been linked to the exploitation of a previously undetected vulnerable driver associated with WatchDog Anti-malware. This attack, classified as a Bring Your Own Vulnerable Driver (BYOVD) incident, aims to neutralize security solutions on compromised systems.

The specific driver involved, “amsdk.sys” (version 1.0.600), is a 64-bit, validly signed Windows kernel device driver believed to be based on the Zemana Anti-Malware SDK. According to an analysis by Check Point, “This driver, created using the Zemana Anti-Malware SDK, was Microsoft-signed, not included in the Microsoft Vulnerable Driver Blocklist, and evaded detection by community initiatives such as LOLDrivers.”

The attack employs a dual-driver approach, utilizing a known vulnerable Zemana driver (“zam.exe”) for Windows 7 systems, while leveraging the undetected WatchDog driver for Windows 10 and 11 environments. The WatchDog Anti-malware driver has been identified as containing multiple vulnerabilities.

Silver Fox Exploits Microsoft-Signed WatchDog Driver for ValleyRAT Malware Deployment In a concerning development within the cybersecurity landscape, the threat actor operating under the alias Silver Fox has been linked to the exploitation of an undisclosed vulnerable driver associated with…

New Vulnerabilities in Windows and Linux Grant Attackers Elevated System Privileges

July 21, 2021

Recent findings have uncovered a local privilege escalation vulnerability in Microsoft’s Windows 10 and the soon-to-be-released Windows 11, enabling users with limited permissions to access critical system files. This loophole, referred to as “SeriousSAM,” allows unauthorized individuals to potentially reveal the operating system installation password and decrypt private keys.

According to a vulnerability note from the CERT Coordination Center (CERT/CC), since Windows 10 build 1809, non-administrative users have had access to the SAM, SYSTEM, and SECURITY registry hive files, which could lead to local privilege escalation (LPE). The affected operating system configuration files include:

  • c:\Windows\System32\config\sam
  • c:\Windows\System32\config\system
  • c:\Windows\System32\config\security

Microsoft, which has assigned the identifier CVE-2021-36934 to this vulnerability, has acknowledged the issue but has not yet released a patch.

New Windows and Linux Vulnerabilities Grant Attackers Elevated System Privileges July 21, 2021 Recent discoveries have unveiled significant local privilege escalation vulnerabilities affecting Microsoft’s Windows 10 and the soon-to-be-released Windows 11. These flaws allow users with limited permissions to gain…

Significant Cyber Espionage Campaign Targeting Pakistan Linked to India

May 20, 2013

Cybersecurity researchers have uncovered a series of information-stealing malware attacks aimed at Pakistan that are believed to originate from India. Norman Shark, a leader in malware analysis solutions for enterprises, service providers, and government agencies, has released a report detailing a complex cyber-attack infrastructure traced back to India.

This ongoing campaign, attributed to private threat actors over three years, shows no direct evidence of state involvement. The primary aim of the extensive command-and-control network appears to be intelligence gathering from both national security targets and private sector companies.

Attackers exploited vulnerabilities in Microsoft software, deploying malware known as HangOver onto their targets, the majority of which were located in Pakistan. A total of 511 infections related to this campaign have been identified. HangOver is capable of installing keyloggers and capturing screenshots, among other functionalities.

Significant Cyber Espionage Campaign Targeting Pakistan Linked to India May 20, 2013 Cybersecurity experts have uncovered a sophisticated family of malware designed for information theft, predominantly targeting Pakistan, and traced its origins to India. In a comprehensive report released by…

LulzSec Hacker Jeremy Hammond Admits Guilt in Stratfor Cyberattack, Facing Up to 10 Years in Prison

May 28, 2013

A hacker associated with LulzSec and Anonymous, Jeremy Hammond, pled guilty on Tuesday to infiltrating Stratfor, a global intelligence firm. The 28-year-old was arrested last March for his part in the breach, which involved theft of sensitive data, website defacements, and temporary disruptions to operations, impacting over a million individuals. Hammond was charged under the controversial Computer Fraud and Abuse Act of 1984—the same legislation previously used against late cyber-activist Aaron Swartz. His plea deal could result in a decade-long prison sentence and significant restitution, with sentencing scheduled for September. In addition to the Stratfor incident, Hammond acknowledged responsibility for eight other cyberattacks targeting law enforcement, intelligence agencies, and defense contractors.

Jeremy Hammond Pleads Guilty in Stratfor Cyberattack Case: Potential Decade-Long Sentence Awaits On May 28, 2013, Jeremy Hammond, linked to the hacking collective LulzSec and the broader Anonymous movement, entered a guilty plea concerning his role in the cyberattack against…