Date Author Title

HP STORAGEWORKS MSA G3 P2000 DEFAULT PASSWORD

2010-12-15Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

HP

2024-11-06/a>Jesse La Grew[Guest Diary] Insights from August Web Traffic Surge
2024-03-29/a>Xavier MertensQuick Forensics Analysis of Apache logs
2023-09-23/a>Guy BruneauScanning for Laravel - a PHP Framework for Web Artisants
2022-09-07/a>Johannes UllrichPHP Deserialization Exploit attempt
2022-02-02/a>Johannes UllrichFinding elFinder: Who is looking for your files?
2022-01-26/a>Jan KoprivaOver 20 thousand servers have their iLO interfaces exposed to the internet, many with outdated and vulnerable versions of FW
2021-11-30/a>Johannes UllrichHunting for PHPUnit Installed via Composer
2020-06-05/a>Remco VerhoefNot so FastCGI!
2019-07-18/a>Xavier MertensMalicious PHP Script Back on Stage?
2019-04-04/a>Xavier MertensNew Waves of Scans Detected by an Old Rule
2018-11-16/a>Xavier MertensBasic Obfuscation With Permissive Languages
2018-07-11/a>Remco VerhoefWell, Hello Again Peppa!
2018-07-02/a>Guy BruneauHello Peppa! - PHP Scans
2018-06-13/a>Xavier MertensA Bunch of Compromized Wordpress Sites
2018-05-06/a>Guy BruneauScans Attempting to use PowerShell to Download PHP Script
2017-09-14/a>Xavier MertensAnother webshell, another backdoor!
2017-08-07/a>Xavier MertensIncrease of phpMyAdmin scans
2017-02-28/a>Xavier MertensAnalysis of a Simple PHP Backdoor
2016-12-26/a>Russ McReeCritical security update: PHPMailer 5.2.20 (CVE-2016-10045)
2016-07-13/a>Xavier MertensDrupal: Patch released today to fix a highly critical RCE in contributed modules
2016-04-25/a>Guy BruneauHighlights from the 2016 HPE Annual Cyber Threat Report
2015-07-21/a>Didier StevensSearching Through the VirusTotal Database
2015-07-12/a>Guy BruneauPHP 5.x Security Updates
2014-09-19/a>Guy BruneauPHP Fixes Several Bugs in Version 5.4 and 5.5
2014-08-22/a>Richard PorterPHP 5.4.32 Released http://www.php.net/ChangeLog-5.php#5.4.32
2014-08-22/a>Richard PorterPHP 5.5.16 is available http://www.php.net/ChangeLog-5.php#5.5.16
2014-08-16/a>Lenny ZeltserWeb Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability
2014-04-04/a>Stephen HallPHP 5.4.27 released
2014-03-27/a>Alex StanfordMass XSSodus in PHP
2013-10-25/a>Johannes UllrichPHP.net compromise aftermath: Why Code Signing Beats Hashes
2013-10-24/a>Johannes UllrichFalse Positive: php.net Malware Alert
2013-09-19/a>Bojan ZdrnjaArrays in requests, PHP and DedeCMS
2013-08-11/a>Bojan ZdrnjaXATattacks (attacks on xat.com)
2013-08-04/a>Johannes UllrichBBCode tag "[php]" used to inject php code
2013-06-07/a>Daniel WesemannPHP patches - see http://www.php.net/ChangeLog-5.php - fixes CVE2013-2110
2013-02-22/a>Chris MohanPHP 5.4.12 and PHP 5.3.22 released http://www.php.net/ChangeLog-5.php
2013-01-27/a>Tony CarothersHP JetDirect Vulnerabilities Discussed
2013-01-17/a>Russ McReePHP 5.4.11 and PHP 5.3.21 released
2012-09-19/a>Russ McReeScript kiddie scavenging with Shellbot.S
2012-06-14/a>Johannes UllrichPHP 5.4.4 and 5.3.14 released with fixes for DES crypt issue and phar heap overflow
2012-05-08/a>Kevin ListonPHP 5.4.3 and PHP 5.3.13 Released
2012-04-12/a>Guy BruneauHP ProCurve 5400 zl Switch, Flash Cards Infected with Malware
2012-04-05/a>Johannes UllrichEvil hides everywhere: Web Application Exploits in Headers
2012-03-07/a>Johannes UllrichWhat happened to RFI attacks?
2012-02-16/a>Johannes UllrichAdobe Flash Player Update
2012-02-07/a>Johannes UllrichSecure E-Mail Access
2012-02-03/a>Guy BruneauPHP 5.3.10 Released, Fixes CVE-2012-0830 available for download http://www.php.net/archive/2012.php#id2012-02-02-1
2012-02-03/a>Johannes UllrichCritical PHP bug patched
2012-01-16/a>Kevin Shorttphp 5.3.9 released -Jan-10-2011
2012-01-12/a>Rob VandenBrinkPHP 5.39 was release on the 10th, amongst other things, it addresses CVE-2011-4885 (prevents attacks based on hash collisions) and CVE-2011-4566 (integer overflow when parsing invalid exif header)
2011-11-29/a>John BambenekHacking HP Printers for Fun and Profit
2011-08-22/a>Jim ClausingDO NOT upgrade to PHP 5.3.7, significant bug in crypt() function, see http://www.php.net/
2011-08-18/a>Rob VandenBrinkPHP 5.37 release. Some security updates, plus lots of bug fixes ==> http://www.php.net/archive/2011.php#id2011-08-18-1
2011-03-07/a>Johannes UllrichOutbound SSH Traffic from HP Virtual Connect Blades
2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user
2010-08-31/a>Bojan ZdrnjaInteresting PHP injection
2010-08-10/a>Daniel WesemannSSH - new brute force tool?
2010-07-04/a>Manuel Humberto Santander PelaezInteresting analysis of the PHP SplObjectStorage Vulnerability
2010-06-14/a>Manuel Humberto Santander PelaezAnother way to get protection for application-level attacks
2010-05-23/a>Manuel Humberto Santander Pelaeze-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-02-27/a>Guy BruneauPHP 5.2.13 Security Update
2010-01-29/a>Johannes UllrichAnalyzing isc.sans.org weblogs, part 2, RFI attacks
2009-12-28/a>Johannes Ullrich8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug)
2009-11-20/a>Mark Hofman PHP 5.3.1 is released. With many of the websites on the net relying on PHP and the number of attacks we see, consider upgrading. This release has over 100 bug fixes, some of which are security related.
2009-08-01/a>Deborah HaleWebsite Warnings
2009-06-26/a>Mark HofmanPHPMYADMIN scans
2009-06-24/a>Kyle HaugsnessExploit tools are publicly available for phpMyAdmin
2009-06-21/a>Scott FendleyphpMyAdmin Scans
2009-04-07/a>Johannes UllrichCommon Apache Misconception
2009-02-06/a>Adrien de BeaupreTime to patch your HP printers
2009-02-03/a>Swa FrantzenOn the importance of patching fast
2008-12-10/a>Stephen HallPHP Group has released PHP version 5.2.8
2008-09-09/a>Swa Frantzenwordpress upgrade
2008-08-19/a>Johannes UllrichA morning stroll through my web logs
2008-05-05/a>John BambenekPHP 5.2.6 out w/ security updates
2008-04-07/a>John BambenekHP USB Keys Shipped with Malware for your Proliant Server
2006-12-24/a>Swa FrantzenphpBB 2.0.22 - upgrade time
2006-11-29/a>Toby KohlenbergNew Vulnerability Announcement and patches from Apple
2006-09-13/a>Swa FrantzenPHP - shared hosters, take note.

STORAGEWORKS

2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

MSA

2016-02-23/a>Xavier MertensVMware VMSA-2016-0002
2016-02-13/a>Guy BruneauVMware VMSA-2015-0007.3 has been Re-released
2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

G3

2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

P2000

2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

DEFAULT

2021-01-06/a>Johannes UllrichScans for Zyxel Backdoors are Commencing.
2015-06-26/a>Daniel WesemannCisco default credentials - again!
2013-03-05/a>Mark HofmanIPv6 Focus Month: Device Defaults
2011-05-30/a>Johannes UllrichAllied Telesis Passwords Leaked
2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user

PASSWORD

2024-10-31/a>Guy BruneauOctober 2024 Activity with Username chenzilong
2024-10-16/a>Johannes UllrichThe Top 10 Not So Common SSH Usernames and Passwords
2024-08-07/a>Guy BruneauSame Scripts, Different Day: What My DShield Honeypot Taught Me About the Importance of Security Fundamentals [Guest Diary]
2024-07-13/a>Didier Stevens16-bit Hash Collisions in .xls Spreadsheets
2024-06-26/a>Guy BruneauWhat Setting Live Traps for Cybercriminals Taught Me About Security [Guest Diary]
2024-02-28/a>Johannes UllrichExploit Attempts for Unknown Password Reset Vulnerability
2024-01-17/a>Jesse La GrewNumber Usage in Passwords
2024-01-06/a>Xavier MertensAre you sure of your password?
2023-10-29/a>Guy BruneauSpam or Phishing? Looking for Credentials & Passwords
2023-10-15/a>Guy BruneauDomain Name Used as Password Captured by DShield Sensor
2023-09-29/a>Xavier MertensAre You Still Storing Passwords In Plain Text Files?
2023-09-05/a>Jesse La GrewCommon usernames submitted to honeypots
2023-09-02/a>Jesse La GrewWhat is the origin of passwords submitted to honeypots?
2023-08-10/a>Bojan ZdrnjaSome things never change ? such as SQL Authentication ?encryption?
2023-08-04/a>Xavier MertensAre Leaked Credentials Dumps Used by Attackers?
2023-06-05/a>Johannes UllrichBrute Forcing Simple Archive Passwords
2023-04-19/a>Rob VandenBrinkTaking a Bite Out of Password Expiry Helpdesk Calls
2023-02-18/a>Guy BruneauSpear Phishing Handlers for Username/Password
2022-08-13/a>Guy BruneauPhishing HTML Attachment as Voicemail Audio Transcription
2022-05-17/a>Xavier MertensUse Your Browser Internal Password Vault... or Not?
2022-03-10/a>Xavier MertensCredentials Leaks on VirusTotal
2022-02-13/a>Guy BruneauDHL Spear Phishing to Capture Username/Password
2021-11-15/a>Rob VandenBrinkChanging your AD Password Using the Clipboard - Not as Easy as You'd Think!
2021-05-14/a>Xavier Mertens"Open" Access to Industrial Systems Interface is Also Far From Zero
2021-04-24/a>Guy BruneauBase64 Hashes Used in Web Scanning
2021-01-06/a>Johannes UllrichScans for Zyxel Backdoors are Commencing.
2020-07-26/a>Didier StevensCracking Maldoc VBA Project Passwords
2020-07-13/a>Didier StevensVBA Project Passwords
2020-06-10/a>Brad DuncanJob application-themed malspam pushes ZLoader
2020-04-06/a>Didier StevensPassword Protected Malicious Excel Files
2019-11-01/a>Didier StevensTip: Password Managers and 2FA
2018-12-17/a>Didier StevensPassword Protected ZIP with Maldoc
2018-08-22/a>Deborah HaleEmail/password Frustration
2018-07-12/a>Johannes UllrichNew Extortion Tricks: Now Including Your Password!
2017-11-28/a>Xavier MertensApple High Sierra Uses a Passwordless Root Account
2017-05-17/a>Richard PorterWait What? We don?t have to change passwords every 90 days?
2017-04-26/a>Johannes UllrichIf there are some unexploited MSSQL Servers With Weak Passwords Left: They got you now (again)
2017-04-10/a>Didier StevensPassword History: Insights Shared by a Reader
2017-02-07/a>Johannes UllrichMy Password is [taco] Using Emojis for Stronger Passwords
2016-12-07/a>Xavier MertensThe Passwords You Should Never Use
2016-09-15/a>Xavier MertensIn Need of a OTP Manager Soon?
2016-07-21/a>Didier StevensPractice ntds.dit File
2016-06-20/a>Xavier MertensUsing Your Password Manager to Monitor Data Leaks
2015-06-26/a>Daniel WesemannCisco default credentials - again!
2014-09-19/a>Guy BruneauAdded today in oclhashcat 131 Django [Default Auth] (PBKDF2 SHA256 Rounds Salt) Support - http://hashcat.net/hashcat/
2014-08-22/a>Richard PorterOCLHashCat 1.30 Released
2014-08-06/a>Johannes UllrichAll Passwords have been lost: What's next?
2014-05-22/a>Rob VandenBrinkAnother Site Breached - Time to Change your Passwords! (If you can that is)
2013-11-22/a>Rick WannerTales of Password Reuse
2013-07-21/a>Guy BruneauUbuntu Forums Security Breach
2013-06-11/a>Swa FrantzenStore passwords the right way in your application
2013-05-14/a>Jim ClausingSo what passwords are those ssh scanners trying?
2013-03-18/a>Kevin ShorttCisco IOS Type 4 Password Issue: http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20130318-type4
2013-01-18/a>Russ McReeInteresting reads for Friday 18 JAN 2013
2013-01-04/a>Daniel WesemannBlue for Reset?
2012-11-15/a>Jim ClausingAnother month another password disclosure breach
2012-07-16/a>Jim ClausingAn analysis of the Yahoo! passwords
2012-06-06/a>Jim ClausingPotential leak of 6.5+ million LinkedIn password hashes
2012-05-22/a>Johannes Ullrichnmap 6 released
2012-01-03/a>Rick WannerAnalysis of the Stratfor Password List
2011-10-10/a>Tom ListonWhat's In A Name?
2011-08-10/a>Johannes UllrichTheoretical and Practical Password Entropy
2011-06-28/a>Johannes UllrichHashing Passwords
2011-05-30/a>Johannes UllrichAllied Telesis Passwords Leaked
2010-12-28/a>John BambenekMozilla Notifies of Relatively Minor Security Breach
2010-12-15/a>Manuel Humberto Santander PelaezHP StorageWorks P2000 G3 MSA hardcoded user
2010-12-13/a>Deborah HaleGawker Media Breach of Security
2010-11-26/a>Mark HofmanUsing password cracking as metric/indicator for the organisation's security posture
2010-08-27/a>Mark HofmanFTP Brute Password guessing attacks
2010-02-25/a>Chris CarboniPass The Hash
2010-02-02/a>Johannes UllrichTwitter Mass Password Reset due to Phishing
2009-12-04/a>Daniel WesemannThe economics of security advice (MSFT research paper)
2009-11-02/a>Daniel WesemannPassword rules: Change them every 25 years
2009-10-23/a>Johannes UllrichLittle new tool: reversing md5/sha1 hashes http://isc.sans.org/tools/reversehash.html
2008-09-22/a>Jim ClausingLessons learned from the Palin (and other) account hijacks