- Daily - CERT.at

Tageszusammenfassung - 22.05.2025
by Daily end-of-shift report 22 May '25

22 May '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-05-2025 18:00 − Donnerstag 22-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Strafverfolger beschlagnahmen Lumma Stealer-Infrastruktur (Mai 2025) ∗∗∗ --------------------------------------------- In einer koordinierten Aktion haben US-Strafverfolger die Infrastruktur (C & C-Server) des Lumma-Infostealers beschlagnahmt und die Funktion lahm gelegt. Die Malware ist für zahlreiche Cyberangriffe auf Nutzer mit Abgreifen von Informationen verantwortlich und es waren fast 400.000 PC infiziert. [..] Microsoft bezeichnet den Akteur, der Lumma als Malware-as-a-service (MaaS) anbietet, als Storm-2477. [..] Das Ganze erfolgte in Zusammenarbeit mit Strafverfolgungsbehörden (FBI, Europol, JC3) und Industriepartnern (ESET, Bitsight, Lumen, Cloudflare, CleanDNS und GMO Registry). --------------------------------------------- https://www.borncity.com/blog/2025/05/22/strafverfolger-beschlagen-lumma-st… ∗∗∗ 3AM ransomware uses spoofed IT calls, email bombing to breach networks ∗∗∗ --------------------------------------------- A 3AM ransomware affiliate is conducting highly targeted attacks using email bombing and spoofed IT support calls to socially engineer employees into giving credentials for remote access to corporate systems. --------------------------------------------- https://www.bleepingcomputer.com/news/security/3am-ransomware-uses-spoofed-… ∗∗∗ Signal now blocks Microsoft Recall screenshots on Windows 11 ∗∗∗ --------------------------------------------- Signal has updated its Windows app to protect users privacy by blocking Microsofts AI-powered Recall feature from taking screenshots of their conversations. [..] This new privacy feature, dubbed "screen security," is now enabled by default on all Windows 11 devices, where Recall continuously takes screenshots of all active windows every few seconds and analyzes them to build a database that can be searched using natural language. When enabled, screen security will set a Digital Rights Management (DRM) flag on Signal's app windows, blocking their content from being captured by Recall or other Windows apps and features. --------------------------------------------- https://www.bleepingcomputer.com/news/security/signal-now-blocks-microsoft-… ∗∗∗ Storm-0558 and the Dangers of Cross-Tenant Token Forgery ∗∗∗ --------------------------------------------- Modern cloud ecosystems often place a single identity provider in charge of handling logins and tokens for a wide range of customers. This approach certainly streamlines single sign-on (SSO) for end users, but it also places enormous trust in a single set of signing keys. If those private keys are compromised, attackers can create tokens that appear valid to any service that relies on them. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/storm-0558-… ∗∗∗ Another Fake Cloudflare Verification Targets WordPress Sites ∗∗∗ --------------------------------------------- A new Cloudflare infection has once again been targeting WordPress sites. This new iteration of malware mimics a legitimate-looking Cloudflare verification page, which then tricks victims into following various commands and downloading malware. This style of malware is not new – our researcher Ben Martin wrote about a similar campaign targeting WordPress sites back in March. The difference between this new infection and previous ones is the location of where the malware is located – spread out among multiple themes and fake plugins. Additionally, this variant is delivered in three stages, which helps the attacker avoid detection and maintain control over what is delivered at each step. --------------------------------------------- https://blog.sucuri.net/2025/05/another-fake-cloudflare-verification-target… ∗∗∗ Datenleck bei Coinbase: Massive Phishing-Welle rollt ∗∗∗ --------------------------------------------- Nachdem Hacker zahlreiche Kund:innendaten der Krypto-Plattform gestohlen und weiterverkauft haben, werden aktuell vermehrt Phishing-Versuche im Namen von Coinbase gemeldet. Die Kriminellen kontaktieren Ihre Opfer entweder per E-Mail oder via Telefon mit dem Ziel, an sensible Informationen zu kommen oder Überweisungen zu veranlassen. --------------------------------------------- https://www.watchlist-internet.at/news/datenleck-bei-coinbase-phishing/ ∗∗∗ BadSuccessor: dMSA zur Privilegien-Erhöhung in Active Directory missbrauchen ∗∗∗ --------------------------------------------- In Windows Server 2025 wurden delegated Managed Service Accounts (dMSAs) neu eingeführt. Das sind Service-Konten für das Active Directory (AD), die neue Funktionen ermöglichen sollen. Sicherheitsforscher sind nun darauf gestoßen, dass durch den Missbrauch von dMSAs Angreifer jeden Principal in der Domäne übernehmen können. [..] Derzeit will Microsoft das Problem aus obigen Gründen nicht fixen – sondern das Problem irgendwann in Zukunft beheben (es gibt also keinen Patch). --------------------------------------------- https://www.borncity.com/blog/2025/05/22/badsuccessor-dmsa-zur-privilegien-… ===================== = Vulnerabilities = ===================== ∗∗∗ Unpatched Versa Concerto Flaws Let Attackers Escape Docker and Compromise Host ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances. It's worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues following the end of the 90-day deadline. --------------------------------------------- https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html ∗∗∗ Cisco Security Advisories 2025-05-21 ∗∗∗ --------------------------------------------- Cisco hat 10 neue Security Advisories veröffentlicht. Zwei der neuen Advisories sind als “High” eingestuft und 8 als “Medium”. Die als "High" eingestuften Advisories betreffen Schwachstellen in Cisco Identity Services Engine RADIUS und Cisco Unified Intelligence Center. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Mozilla Security Advisories 2025-05-20 ∗∗∗ --------------------------------------------- Thunderbird (critical) and Firefox (low) --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (kernel, kernel-rt, and webkit2gtk3), Fedora (mozilla-ublock-origin and sudo-rs), Oracle (.NET 8.0, compat-openssl10, grafana, osbuild-composer, redis:6, ruby:2.5, and webkit2gtk3), SUSE (dante, firefox-esr, gnuplot, govulncheck-vulndb, grype, postgresql13, postgresql14, postgresql15, postgresql16, postgresql17, python-tornado6, python314, thunderbird, ucode-intel, and xen), and Ubuntu (bind9, libfcgi-perl, linux-ibm-5.4, linux-oracle-5.4, postgresql-17, and Tomcat). --------------------------------------------- https://lwn.net/Articles/1022189/ ∗∗∗ Authentifizierung: Kritische Lücke in Samlify macht Angreifer zu Admins ∗∗∗ --------------------------------------------- Admins, die Single-Sign-On-Anmeldungen (SSO) über die weitverbreitete Node.js-Bibliothek Samlify realisieren, sollten den verfügbaren Sicherheitspatch zeitnah installieren. Geschieht das nicht, können Angreifer die Authentifizierung umgehen und mit weitreichenden Rechten auf Systeme zugreifen. [..] Auf die "kritische" Sicherheitslücke (CVE-2025-47949) sind Sicherheitsforscher von Endor Labs gestoßen. --------------------------------------------- https://heise.de/-10392315 ∗∗∗ Angreifer können mit VMware erstellte virtuelle Maschinen crashen ∗∗∗ --------------------------------------------- Aus der Warnmeldung geht hervor, dass die am gefährlichsten eingestufte Schwachstelle (CVE-2025-41225 "hoch") vCenter Server betrifft. An dieser Stelle kann ein authentifizierter Angreifer eigene Befehle ausführen. Verfügt ein Angreifer über Gast-VM-Rechte, kann er für eine Gast-VM einen DoS-Zustand erzeugen (CVE-2025-41226 "mittel"). So etwas führt in der Regel zu Abstürzen. Weiterhin sind noch weitere DoS-Attacken (CVE-2025-41227 "mittel") und XSS-Angriffe (CVE-2025-41228 "mittel") möglich. --------------------------------------------- https://heise.de/-10392911 ∗∗∗ Drupal Security Advisories 2025-05-21 ∗∗∗ --------------------------------------------- https://www.drupal.org/security ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (May 12, 2025 to May 18, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/05/wordfence-intelligence-weekly-wordpr… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.05.2025
by Daily end-of-shift report 21 May '25

21 May '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-05-2025 18:00 − Mittwoch 21-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows 11’s most important new feature is post-quantum cryptography. Here’s why. ∗∗∗ --------------------------------------------- For the first time, new quantum-safe algorithms can be invoked using standard Windows APIs. --------------------------------------------- https://arstechnica.com/security/2025/05/heres-how-windows-11-aims-to-make-… ∗∗∗ VanHelsing ransomware builder leaked on hacking forum ∗∗∗ --------------------------------------------- The VanHelsing ransomware-as-a-service operation published the source code for its affiliate panel, data leak blog, and Windows encryptor builder after an old developer tried to sell it on the RAMP cybercrime forum. --------------------------------------------- https://www.bleepingcomputer.com/news/security/vanhelsing-ransomware-builde… ∗∗∗ Dero miner zombies biting through Docker APIs to build a cryptojacking horde ∗∗∗ --------------------------------------------- Kaspersky experts break down an updated cryptojacking campaign targeting containerized environments: a Dero crypto miner abuses the Docker API. [..] The entire attack vector is automated via two malware implants: the previously unknown propagation malware nginx and the Dero crypto miner. --------------------------------------------- https://securelist.com/dero-miner-infects-containers-through-docker-api/116… ∗∗∗ Chrome kann unsichere Passwörter künftig komplett selbst ändern ∗∗∗ --------------------------------------------- Googles Chrome-Browser soll bald automatisch Passwörter ändern können, wenn bei der Anmeldung damit erkannt wird, dass es kompromittiert wurde. [..] Im Idealfall bekommen Nutzer und Nutzerinnen in Chrome dann künftig einen Hinweis, wenn ein gespeichertes Passwort in einem Datenleck gefunden wurde und können den Browser dazu bringen, das Passwort durch ein sicheres zu ersetzen. Das wird dann im Passwortmanager von Chrome abgespeichert, das unsichere wird ersetzt. Die automatische Passwortänderung benötigt dafür insgesamt nur einen Klick. --------------------------------------------- https://heise.de/-10391298 ∗∗∗ Sicherheitsbehörden warnen vor russischer Spionage mit IP-Kameras ∗∗∗ --------------------------------------------- Mutmaßliche Mitarbeiter des russischen Militärgeheimdienstes GRU haben sich Zugriff auf Netzwerke und IP-Kameras von Betreibern kritischer Infrastrukturen (KRITIS) verschafft. Das melden unter anderem NSA, FBI, der Bundesnachrichtendienst (BND) und die Bundesämter für Verfassungsschutz (BfV) sowie Sicherheit in der Informationstechnik (BSI).[..] Betroffen sind laut einer Mitteilung der Behörden vor allem Unternehmen aus der Logistikbranche. --------------------------------------------- https://heise.de/-10391927 ∗∗∗ CISA, NIST Researchers Develop Metric to Determine Likelihood of Vulnerability Exploitation ∗∗∗ --------------------------------------------- Researchers from the U.S. National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have developed a new security metric to determine the likelihood that a vulnerability has been exploited. In a paper published this week, Peter Mell, formerly of NIST, and CISA’s Jonathan Spring outlined their vulnerability exploit metric that augments the work of the Exploit Prediction Scoring System (EPSS) and CISA’s Known Exploited Vulnerabilities (KEV) catalog. --------------------------------------------- https://thecyberexpress.com/cisa-nist-vulnerability-exploit-metric/ ===================== = Vulnerabilities = ===================== ∗∗∗ Lücke in OpenPGP.js gefährdet verschlüsselten E-Mail-Verkehr ∗∗∗ --------------------------------------------- In OpenPGP.js, einer weitverbreiteten Javascript-Implementierung von OpenPGP, klafft eine gefährliche Sicherheitslücke, durch die sich das Ergebnis der Signaturprüfung fälschen lässt. Laut einer Sicherheitsmeldung auf Github kann ein Angreifer speziell manipulierte Daten an die Funktionen openpgp.verify oder openpgp.decrypt übergeben, um verschlüsselte und/oder signierte Nachrichten zu spoofen. CVE-2025-47934 --------------------------------------------- https://www.golem.de/news/manipulationsgefahr-luecke-in-openpgp-js-gefaehrd… ∗∗∗ Mehrere Schwachstellen bei eCharge Hardy Barth cPH2 und cPP2 Ladestationen ∗∗∗ --------------------------------------------- Hardy Barth EV charging station products are affected by critical vulnerabilities that can be exploited through both physical access and unauthenticated network access. These vulnerabilities pose significant risks, including system compromise, data breaches, and operational disruptions within EV charging infrastructures. [..] The vendor has not provided a fix for any of the reported vulnerabilities. --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/mehrere-schwachstelle… ∗∗∗ Mehrere Sicherheitslücken bedrohen VMware Cloud Foundation ∗∗∗ --------------------------------------------- Wie aus einer Warnmeldung hervorgeht, sind die Lücken (CVE-2025-41229, CVE-2025-41230, CVE-2025-41231) mit dem Bedrohungsgrad "hoch" eingestuft. Nutzen Angreifer die Schwachstellen erfolgreich aus, können sie etwa im Netzwerk über den Port 443 auf sensitive Informationen oder interne Services zugreifen. --------------------------------------------- https://heise.de/-10390932 ∗∗∗ Millions of Node.js Apps at Risk Due to Critical Multer Vulnerabilities ∗∗∗ --------------------------------------------- Two high-severity security flaws have been identified in Multer, a popular middleware used in Node.js applications for handling file uploads. The Multer vulnerabilities, tracked as CVE-2025-47944 and CVE-2025-47935, affect all versions from 1.4.4-lts.1 up to but not including 2.0.0. According to the GitHub post, the two vulnerabilities “allow an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. --------------------------------------------- https://thecyberexpress.com/multer-vulnerabilities-expose-node-js/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (.NET 8.0, avahi, buildah, compat-openssl10, compat-openssl11, expat, firefox, gimp, git, grafana, libsoup, libxslt, mod_auth_openidc, nginx, nodejs:22, osbuild-composer, php, redis, redis:7, skopeo, thunderbird, vim, webkit2gtk3, xterm, and yelp), Arch Linux (dropbear, freetype2, go, nodejs, nodejs-lts-iron, nodejs-lts-jod, python-django, webkit2gtk, webkit2gtk-4.1, webkitgtk-6.0, and wpewebkit), Debian (mongo-c-driver), Fedora (openssh, perl-Mojolicious, thunderbird, yelp, and yelp-xsl), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk with Extended Lifecycle Support, java-21-ibm-semeru-certified-jdk, java-21-openjdk, kernel, libxslt, ruby, ruby:3.1, ruby:3.3, unbound, and webkit2gtk3), SUSE (glib2, grub2, kernel, libwebp, openssh, and s390-tools), and Ubuntu (linux, linux-azure, linux-azure-6.11, linux-gcp, linux-gcp-6.11, linux-hwe-6.11, linux-oem-6.11, linux-raspi, linux-realtime, linux-azure, linux-azure-5.15, linux-nvidia-tegra, linux-azure, linux-azure-6.8, linux-oem-6.8, linux-azure, linux-kvm, linux-azure-fips, linux-azure-nvidia, linux-gcp, linux-gcp-6.8, linux-gkeop, linux-gke, linux-intel-iot-realtime, linux-realtime, linux-raspi-realtime, mariadb-10.6, and postgresql-12, postgresql-14, postgresql-16). --------------------------------------------- https://lwn.net/Articles/1022030/ ∗∗∗ Assured Telematics Inc (ATI) Fleet Management System with Geotab Integration ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11 ∗∗∗ Vertiv Liebert RDU101 and UNITY ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-10 ∗∗∗ AutomationDirect MB-Gateway ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-09 ∗∗∗ Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-04 ∗∗∗ f5: K000151431: Intel Ethernet Controller and Adapter vulnerability CVE-2024-24983 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000151431 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.05.2025
by Daily end-of-shift report 20 May '25

20 May '25

===================== = End-of-Day report = ===================== Timeframe: Montag 19-05-2025 18:00 − Dienstag 20-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains ∗∗∗ --------------------------------------------- A threat actor named Hazy Hawk has been using DNS CNAME hijacking to hijack abandoned cloud endpoints of domains belonging to trusted organizations and incorporate them in large-scale scam delivery and traffic distribution systems (TDS). --------------------------------------------- https://www.bleepingcomputer.com/news/security/hazy-hawk-gang-exploits-dns-… ∗∗∗ 100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads ∗∗∗ --------------------------------------------- An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code. --------------------------------------------- https://thehackernews.com/2025/05/100-fake-chrome-extensions-found.html ∗∗∗ Bypass SharePoint Restricted View to exfiltrate data using Copilot AI and more… ∗∗∗ --------------------------------------------- Overall, we’ve proven that although a fair amount of effort has been put into enforcing the restrictions of Restricted View there are plenty of ways to circumvent them. Therefore, it is important for administrators and users to understand that it can not be relied on to secure data against motivated attackers. --------------------------------------------- https://www.pentestpartners.com/security-blog/bypass-sharepoint-restricted-… ∗∗∗ Duping Cloud Functions: An emerging serverless attack vector ∗∗∗ --------------------------------------------- Cisco Talos built on Tenable’s discovery of a Google Cloud Platform vulnerability to uncover how attackers could exploit similar techniques across AWS and Azure. --------------------------------------------- https://blog.talosintelligence.com/duping-cloud-functions-an-emerging-serve… ∗∗∗ Compromised RVTools Installer Spreading Bumblebee Malware ∗∗∗ --------------------------------------------- RVTools installer on its official site was found delivering malware. Research shows it spread Bumblebee loader. Users urged to verify downloads. --------------------------------------------- https://hackread.com/compromised-rvtools-installer-drop-bumblebee-malware/ ∗∗∗ Gehärtete Images von Docker verbessern die Sicherheit und entlasten Entwickler ∗∗∗ --------------------------------------------- Mit den Hardened Images (DHI) bietet Docker sichere, schlanke und Compliance-konforme Images. Mit dabei sind unter anderem Microsoft, Neo4J oder GitLab. --------------------------------------------- https://heise.de/-10388766 ===================== = Vulnerabilities = ===================== ∗∗∗ TYPO3 Security Advisories Tue. 20th May, 2025 ∗∗∗ --------------------------------------------- TYPO3 has released 11 new security advisories. --------------------------------------------- https://typo3.org/help/security-advisories ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dropbear, firefox-esr, intel-microcode, net-tools, openafs, thunderbird, and xrdp), Fedora (chromium, micropython, syslog-ng, webkitgtk, and xen), Mageia (dropbear and openssh), Oracle (.NET 9.0, kernel, libjpeg-turbo, and yelp and yelp-xsl), Red Hat (compat-openssl11, git-lfs, grafana, kernel, and osbuild and osbuild-composer), Slackware (mozilla), SUSE (cargo-c, gimp, iputils-20240905, kernel, libraw, microcode_ctl, openssh, pnpm, python311-cramjam, python311-httptools, python311-jwcrypto, python311-loguru, python311-mechanize, python311-nltk, python311-oauthlib, python311-py7zr, python311-pycapnp, python311-pyspnego, python311-pywayland, python311-suds, python311-treq, python311-ujson, python311-waitress, ruby3.4-rubygem-actionmailer, ruby3.4-rubygem-actiontext, ruby3.4-rubygem-activerecord, ruby3.4-rubygem-activestorage, ruby3.4-rubygem-fluentd, ruby3.4-rubygem-globalid, ruby3.4-rubygem-jquery-rails, ruby3.4-rubygem-kramdown, ruby3.4-rubygem-loofah, ruby3.4-rubygem-multi_xml, ruby3.4-rubygem-puma, ruby3.4-rubygem-rails, ruby3.4-rubygem-rails-html-sanitizer, ruby3.4-rubygem-sprockets, ruby3.4-rubygem-web-console, ruby3.4-rubygem-websocket-extensions, ucode-intel-20250512, and valkey), and Ubuntu (dotnet8, dotnet9, linux, linux-aws, linux-aws-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle, linux, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-oracle, linux, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-fips, linux-gcp, linux-gcp-5.15, linux-gcp-fips, linux-gke, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-realtime, and linux-xilinx-zynqmp). --------------------------------------------- https://lwn.net/Articles/1021740/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, openjdk-11, openjdk-17, and wireless-regdb), Fedora (iputils, open-vm-tools, sfnt2woff-zopfli, and woff), Red Hat (postgresql:12), SUSE (apache2-mod_auth_openidc, brltty, helm, python-maturin, and rubygem-rack), and Ubuntu (linux-azure-fips). --------------------------------------------- https://lwn.net/Articles/1021812/ ∗∗∗ 22,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Motors WordPress Theme ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/05/22000-wordpress-sites-affected-by-pr… ∗∗∗ Danfoss AK-SM 8xxA Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03 ∗∗∗ National Instruments Circuit Design Suite ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02 ∗∗∗ ABUP IoT Cloud Platform ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.05.2025
by Daily end-of-shift report 19 May '25

19 May '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-05-2025 18:00 − Montag 19-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Curl-Entwickler warnt: Unicode-Trick gefährdet Softwareprojekte auf Github ∗∗∗ --------------------------------------------- Die wenigsten Entwickler dürften die Unterschiede zwischen bestimmten Unicode-Zeichen zuverlässig erkennen. Gerade auf Github ist das ein Problem. --------------------------------------------- https://www.golem.de/news/curl-entwickler-warnt-unicode-trick-gefaehrdet-so… ∗∗∗ Warnung vor brancheneintrag24.com ∗∗∗ --------------------------------------------- Derzeit kursieren betrügerische E-Mails, die von der Adresse info(a)brancheneintrag24.com stammen. Im Anhang befindet sich ein Formular, das Unternehmen angeblich zur Aktualisierung ihres Brancheneintrags auffordert. [..] Mit dem Ausfüllen und Zurücksenden des Formulars wird ein kostenpflichtiger Vertrag abgeschlossen. --------------------------------------------- https://www.zettasecure.com/post/warnung-vor-brancheneintrag24-com ∗∗∗ Fake-Shops: Laufsportbegeisterte im Visier von Kriminellen ∗∗∗ --------------------------------------------- Laufschuhe von Top-Marken zu absoluten Niedrigstpreisen?! Vorsicht! Aktuell tauchen vermehrt Fake-Shops für Sportschuhe und anderes Equipment auf. Wer in einem derartigen Store bestellt, schaut in der Regel durch die Finger. Kommt doch eine Lieferung an, enthält diese nur minderwertige Kopien. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-fuer-laufschuhe/ ∗∗∗ Windows: Bitlocker-Verschlüsselung über Bitpixie (CVE-2023-21563) ausgehebelt ∗∗∗ --------------------------------------------- Die von Microsoft für Windows verwendete Bitlocker-Verschlüsselung für Datenträger lässt sich über die Bitpixie-Schwachstelle (CVE-2023-21563) per Software aushebeln, wenn gewisse Randbedingungen gelten. [..] Der jetzt bekannt gewordene Angriff ist nicht neues, sondern ein Proof of Concept, den Administratoren ggf. in eigenen Systemen testen können. [..] Die Bitpixie-Schwachstelle – und ganz allgemein sowohl hardware- als auch softwarebasierte Angriffe – kann durch Erzwingen einer Pre-Boot-Authentifizierung entschärft werden. --------------------------------------------- https://www.borncity.com/blog/2025/05/18/windows-bitlocker-verschluesselung… ∗∗∗ Windows 10/11: Defender mit simplen Tool Defendnot deaktivierbar ∗∗∗ --------------------------------------------- Microsoft hat in Windows 10 und Windows 11 eine Schnittstelle (API) eingebaut, über die Hersteller von Antivirus-Software bei deren Installation den Microsoft Defender deaktivieren können. Einige Leute (darunter ein Blog-Leser) haben nun gezeigt, wie man mit einer einfachen Software (no-defender oder Defendnot) den Windows Defender deaktivieren kann. --------------------------------------------- https://www.borncity.com/blog/2025/05/19/windows-10-11-defender-mit-simplen… ∗∗∗ Ivanti EPMM Zero-Days: Reconnaissance to Exploitation ∗∗∗ --------------------------------------------- Two critical Ivanti zero-days (CVE-2025-4427 and CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. When chained together, these vulnerabilities enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems. --------------------------------------------- https://www.greynoise.io/blog/ivanti-epmm-zero-days-reconnaissance-exploita… ∗∗∗ VM escape in Oracle VirtualBox via VGA device ∗∗∗ --------------------------------------------- We provide a proof-of-concept that demonstrates how to exploit this vulnerability to fully escape a virtual machine. --------------------------------------------- https://github.com/google/security-research/security/advisories/GHSA-qx2m-r… ∗∗∗ Passwords are okay, impulsive Internet isnt ∗∗∗ --------------------------------------------- Every few weeks, I come across an article telling us how passwords are bad and how we need to go "passwordless". These pieces are written by mostly well-intended nerds who think technology can solve basic problems in human behavior. --------------------------------------------- https://www.dedoimedo.com/life/passwords-passkeys.html ∗∗∗ New Community Resource: Attribution to IP ∗∗∗ --------------------------------------------- The Curated Intelligence community has shared a new collection for CTI analysts and others who perform cybersecurity research duties. A new GitHub repository has been created that contains a collection of methods to learn who the owner of an IP address is. --------------------------------------------- https://www.curatedintel.org/2025/05/new-community-resource-attribution-to-… ===================== = Vulnerabilities = ===================== ∗∗∗ Mozilla Security Advisories May 17, 2025 ∗∗∗ --------------------------------------------- Firefox ESR 115.23.1, ESR 128.10.1 and 138.0.4. Critical --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Angreifer können Verbindungen von Sonicwall SMA1000 manipulieren ∗∗∗ --------------------------------------------- In einer Warnmeldung führt der Anbieter von Netzwerktechnik aus, dass Angreifer im Zuge einer Server-side-request-forgery-Attacke (SSRF) Anfragen an etwa von ihnen kontrollierte Server umleiten können (CVE-2025-40595 "hoch"). --------------------------------------------- https://heise.de/-10387581 ∗∗∗ Thousands of WordPress Sites at Risk Due to Critical Crawlomatic Plugin Vulnerability ∗∗∗ --------------------------------------------- A severe security vulnerability has been discovered in the popular WordPress plugin, Crawlomatic Multisite Scraper Post Generator, potentially placing thousands of websites at risk. Tracked as CVE-2025-4389, the flaw allows unauthenticated attackers to upload malicious files, which could ultimately lead to remote code execution on affected websites. --------------------------------------------- https://thecyberexpress.com/crawlomatic-plugin-hit-by-cve-2025-4389/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.05.2025
by Daily end-of-shift report 16 May '25

16 May '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-05-2025 18:01 − Freitag 16-05-2025 18:01 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ FBI: US officials targeted in voice deepfake attacks since April ∗∗∗ --------------------------------------------- The FBI warned that cybercriminals using AI-generated audio deepfakes to target U.S. officials in voice phishing attacks that started in April. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-us-officials-targeted-in… ∗∗∗ Ransomware gangs increasingly use Skitnet post-exploitation malware ∗∗∗ --------------------------------------------- Ransomware gang members increasingly use a new malware called Skitnet ("Bossnet") to perform stealthy post-exploitation activities on breached networks. The malware has been offered for sale on underground forums like RAMP since April 2024, but according to Prodaft researchers, it started gaining significant traction among ransomware gangs since early 2025. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-gangs-increasingl… ∗∗∗ Understanding CSRF: Cross-site Request Forgery Explained ∗∗∗ --------------------------------------------- Cross-Site Request Forgery, often called CSRF (or its other nicknames, Session Riding and XSRF), is a tricky type of attack. In short, it lets attackers make users do things on websites without their consent or knowledge. This attack works by misusing the trust a web application puts in a user’s browser once they’re logged in. By duping the browser into sending fake requests (usually through shady emails or misleading links), CSRF allows unauthorized commands to hit a website. And since these requests seem to come from a legitimate, logged-in user, the website has a hard time spotting the fakes, which can open the door to significant security problems. --------------------------------------------- https://blog.sucuri.net/2025/05/understanding-csrf-cross-site-request-forge… ∗∗∗ Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. --------------------------------------------- https://thehackernews.com/2025/05/fileless-remcos-rat-delivered-via-lnk.html ∗∗∗ VNC. RDP for all to see ∗∗∗ --------------------------------------------- VNC (Virtual Network Computing) is a widely deployed service in perhaps forgotten corners of legacy enterprise networks. This is mainly because it’s a tried and trusted protocol that simply works, however this is disregarding its security flaws and disadvantages in the modern age. --------------------------------------------- https://www.pentestpartners.com/security-blog/vnc-rdp-for-all-to-see/ ∗∗∗ Operation RoundPress ∗∗∗ --------------------------------------------- This blogpost introduces an operation that we named RoundPress, targeting high-value webmail servers with XSS vulnerabilities, and that we assess with medium confidence is run by the Sednit cyberespionage group. The ultimate goal of this operation is to steal confidential data from specific email accounts. --------------------------------------------- https://www.welivesecurity.com/en/eset-research/operation-roundpress/ ∗∗∗ Commit Stomping ∗∗∗ --------------------------------------------- Commit Stomping is a technique inspired by timestomping, a well-known method used in offensive operations where file metadata is manipulated to hide the true timing of actions. In Git, Commit Stomping involves altering commit timestamps to mislead observers about when changes were introduced. --------------------------------------------- https://blog.zsec.uk/commit-stomping/ ===================== = Vulnerabilities = ===================== ∗∗∗ Printer company provided infected software downloads for half a year ∗∗∗ --------------------------------------------- When Cameron Coward, the Youtuber behind the channel Serial Hobbyism, wanted to review a $6k UV printer and plugged in the USB flash drive with the printer software, the Antivirus software alerted him of a USB-spreading worm and a Floxif infection. Floxif is a file infector that attaches itself to Portable Executable files, so it can spread to network shares, removable drives like USB flash drives or backup storage systems. --------------------------------------------- https://feeds.feedblitz.com/~/918394763/0/gdatasecurityblog-en~Printer-comp… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (.NET 8.0, .NET 9.0, kernel, kernel-rt, redis:6, and yelp and yelp-xsl), Debian (chromium), Red Hat (compat-openssl11, kernel, and thunderbird), and SUSE (nbdkit, open-vm-tools, and rustup). --------------------------------------------- https://lwn.net/Articles/1021482/ ∗∗∗ Malicious ‘Checker’ Packages on PyPI Probe TikTok and Instagram for Valid Accounts ∗∗∗ --------------------------------------------- We often hear about the importance of secure data. Have I Been Pwned and similar websites exist to see if passwords or emails are listed online. However, many people do not understand the ramifications of their own leaked data. --------------------------------------------- https://socket.dev/blog/malicious-checker-packages-on-pypi-probe-tiktok-and… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.05.2025
by Daily end-of-shift report 15 May '25

15 May '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-05-2025 18:01 − Donnerstag 15-05-2025 18:01 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Spies hack high-value mail servers using an exploit from yesteryear ∗∗∗ --------------------------------------------- XSS is short for cross-site scripting. Vulnerabilities result from programming errors found in webserver software that, when exploited, allow attackers to execute malicious code in the browsers of people visiting an affected website. XSS first got attention in 2005, with the creation of the Samy Worm, which knocked MySpace out of commission when it added more than one million MySpace friends to a user named Samy. XSS exploits abounded for the next decade and have gradually fizzled more recently, although this class of attacks continues now. --------------------------------------------- https://arstechnica.com/security/2025/05/spies-hack-high-value-mail-servers… ∗∗∗ Critical Infrastructure Under Siege: OT Security Still Lags ∗∗∗ --------------------------------------------- With critical infrastructure facing constant cyber threats from the Typhoons and other corners, federal agencies and others are warning security for the OT network, a core technology in many critical sectors, is not powered up enough. --------------------------------------------- https://www.darkreading.com/ics-ot-security/critical-infrastructure-ot-secu… ∗∗∗ Beyond the kill chain: What cybercriminals do with their money (Part 1) ∗∗∗ --------------------------------------------- Sophos X-Ops investigates what financially motivated threat actors invest their ill-gotten profits in, once the dust has settled. --------------------------------------------- https://news.sophos.com/en-us/2025/05/15/beyond-the-kill-chain-what-cybercr… ∗∗∗ Technical Analysis of TransferLoader ∗∗∗ --------------------------------------------- Zscaler ThreatLabz has identified a new malware loader that we have named TransferLoader, which has been active since at least February 2025. ThreatLabz has identified three different components (a downloader, a backdoor, and a specialized loader for the backdoor) embedded in TransferLoader binaries. In addition, ThreatLabz has observed TransferLoader being used to deliver Morpheus ransomware. All components of TransferLoader share similarities including various anti-analysis techniques and code obfuscation. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-transfer… ∗∗∗ USA: Bösartige Kommunikationsgeräte in chinesischen Solar-Wechselrichtern ∗∗∗ --------------------------------------------- Bei der Untersuchung von Wechselrichtern aus China durch Experten in den USA wurden in einigen Geräten nicht dokumentierte Kommunikationsgeräte gefunden. US-Energiebehörden wollen das Risiko dieser chinesischen Inverter Medienberichten zufolge neu beurteilen. --------------------------------------------- https://www.heise.de/news/Boesartige-Kommunikationsgeraete-in-Solar-Wechsel… ∗∗∗ Angeblicher Steam-Hack: Datenleck enthält SMS-Sendeprotokolle ∗∗∗ --------------------------------------------- Ein angebliches Datenleck bei der Spieleplattform Steam soll 89 Millionen Datensätze enthalten – ein Unbekannter versucht seit vergangenem Samstag, sie im Darknet für 5.000 US-Dollar zu verkaufen. Doch die Resonanz ist mau und die Brisanz der Daten fraglich. --------------------------------------------- https://heise.de/-10383892 ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal Security Advisories 2025-05-14 ∗∗∗ --------------------------------------------- Drupal has released 7 new security advisories. --------------------------------------------- https://www.drupal.org/security ∗∗∗ Palo Alto Networks Security Advisories 2025-05-14 ∗∗∗ --------------------------------------------- Palo Alto has released 11 new security advisories. --------------------------------------------- https://security.paloaltonetworks.com/ ∗∗∗ Mozilla Foundation Security Advisories 2025-05-13 ∗∗∗ --------------------------------------------- For Thunderbird 138.0.1 and Thunderbird 128.10.1. --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (open-vm-tools), Fedora (dnsdist), Gentoo (Node.js and Tracker miners), Red Hat (kernel and xdg-utils), SUSE (audiofile, go1.22-openssl, go1.24, grub2, kernel-devel, openssl-1_1, openssl-3, and python311-Django), and Ubuntu (ruby-rack). --------------------------------------------- https://lwn.net/Articles/1021379/ ∗∗∗ Patchday: Lücken in Intel-Software und -Treibern gestopft ∗∗∗ --------------------------------------------- Angreifer können Computer mit Hard- und Software von Intel attackieren. Sind Attacken erfolgreich, können sie unter anderem Denial-of-Service-Zustände (DoS) erzeugen, die in der Regel zu Abstürzen führen. --------------------------------------------- https://heise.de/-10384160 ∗∗∗ Google warnt: Gefährliche Chrome-Lücke wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Im weit verbreiteten Webbrowser Chrome klaffen mehrere gefährliche Sicherheitslücken, von denen eine bereits aktiv von Angreifern ausgenutzt wird. Davor warnt Google in den Release Notes zu einem am Mittwoch bereitgestellten Update. Betroffen ist nicht nur die Windows-Variante von Google Chrome, sondern auch jene für Mac und Linux. Anwender sollten den Browser zeitnah aktualisieren, um sich vor möglichen Angriffen zu schützen. --------------------------------------------- https://www.golem.de/news/google-warnt-gefaehrliche-chrome-luecke-wird-akti… ∗∗∗ Fortinet dichtet mehrere Lücken ab, Angriffe auf FortiVoice beobachtet ∗∗∗ --------------------------------------------- CVE-2025-32756 is a critical stack-based buffer overflow vulnerability affecting multiple Fortinet products, including FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera. This flaw allows unauthenticated remote attackers to execute arbitrary code or commands via crafted HTTP requests, posing a severe security risk. --------------------------------------------- https://www.heise.de/news/Fortinet-dichtet-mehrere-Luecken-ab-Angriffe-auf-… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2025-0004 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2025-0004.html ∗∗∗ Reflected cross-site scripting vulnerability in Ricoh laser printers and MFPs which implement Web Image Monitor ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN20474768/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (May 5, 2025 to May 11, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/05/wordfence-intelligence-weekly-wordpr… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.05.2025
by Daily end-of-shift report 14 May '25

14 May '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-05-2025 18:00 − Mittwoch 14-05-2025 18:01 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt ∗∗∗ --------------------------------------------- A new DarkCloud Stealer campaign is using AutoIt obfuscation for malware delivery. The attack chain involves phishing emails, RAR files and multistage payloads. --------------------------------------------- https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit… ∗∗∗ Intel: Ein weiterer Angriff umgeht alle bisherigen CPU-Schutzmaßnahmen ∗∗∗ --------------------------------------------- Intel hat einen Lauf: Eine weitere Sicherheitslücke öffnet viele Prozessoren erneut für Seitenkanalangriffe trotz bisheriger Schutzmaßnahmen. [..] Wie schon der Angriffstyp Training Solo erfordert BPI physischen Zugriff auf ein System. Daher sind die zugehörigen CVE-Nummern CVE-2024-43420, CVE-2025-20623 und CVE-2024-45332 nur mit dem Schweregrad Medium bewertet. --------------------------------------------- https://heise.de/-10383474 ∗∗∗ A Privacy Mechanism That Backfired ∗∗∗ --------------------------------------------- Some bugs are more interesting than others. Last time I mentioned how CVE-2025-24091 was one of my favorite iOS vulnerabilities so far. That was because I wasn’t yet allowed to disclose my actual favorite! This post is about CVE-2025-31212, the most ironic vulnerability I’ve ever found, and here's why... --------------------------------------------- https://rambo.codes/posts/2025-05-12-a-privacy-mechanism-that-backfired ===================== = Vulnerabilities = ===================== ∗∗∗ Ivanti EPMM: Remote Code Execution Schwachstellen (CVE-2025-4427, CVE-2025-4428) - Updates verfügbar ∗∗∗ --------------------------------------------- Ivanti veröffentlichte am 13. Mai Updates & Sicherheitsadvisories zu zwei Schwachstellen in Ivanti Endpoint Manager Mobile (EPMM). Die verkettete Ausnutzung der beiden Lücken kann zur unauthentifizierten Ausführung von Schadcode genutzt werden. Ivanti gibt an die Ausnutzung dieser Lücken auf einer limitierten Anzahl an Systemen, bereits vor der Veröffentlichtung des Advisories, beobachtet zu haben. CVE-Nummern: CVE-2025-4427, CVE-2025-4428 --------------------------------------------- https://www.cert.at/de/warnungen/2025/5/ivanti-epmm-rce ∗∗∗ Microsoft primes 71 fixes for May Patch Tuesday ∗∗∗ --------------------------------------------- Five issues actively exploited in the wild, but the real excitement may have been handled in advance. --------------------------------------------- https://news.sophos.com/en-us/2025/05/14/microsoft-primes-71-fixes-for-may-… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (emacs, firefox, gnutls, java-17-openjdk, java-21-openjdk, osbuild-composer, python39:3.9, and thunderbird), Arch Linux (screen), Debian (varnish), Fedora (chromium), Gentoo (Atop, FreeType, and Spidermonkey), Mageia (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk and postgresql15, postgresql13), Oracle (389-ds-base, emacs, firefox, kernel, libsoup, libtiff, mod_auth_openidc:2.3, nodejs:20, nodejs:22, osbuild-composer, python39:3.9, qemu-kvm, ruby, ruby:3.1, ruby:3.3, and thunderbird), Red Hat (.NET 8.0, .NET 9.0, avahi, buildah, corosync, delve and golang, exiv2, expat, firefox, ghostscript, gimp, git, grafana, gvisor-tap-vsock, java-21-openjdk, kernel, kernel-rt, libarchive, libjpeg-turbo, libsoup, libsoup3, libxslt, mod_auth_openidc, nginx, nginx:1.22, nginx:1.24, nodejs22, nodejs:20, nodejs:22, opentelemetry-collector, osbuild-composer, perl, php, php:8.2, php:8.3, podman, python-jinja2, redis, redis:7, rhc, ruby:2.5, skopeo, sqlite, thunderbird, tomcat, tomcat9, valkey, vim, xorg-x11-server-Xwayland, xterm, xz, yelp, and yggdrasil), Slackware (screen), SUSE (apparmor, dirmngr, gimp, golang-github-prometheus-node_exporter, java-11-openj9, java-17-openj9, java-21-openj9, libxmp-devel, python311-Django4, rabbitmq-server313, rke2, and transfig), and Ubuntu (abseil and open-vm-tools). --------------------------------------------- https://lwn.net/Articles/1021199/ ∗∗∗ Patchday Adobe: Schadcode-Attacken auf InDesign und Photoshop möglich ∗∗∗ --------------------------------------------- Adobe schließt Sicherheitslücken in mehreren Anwendungen. Bislang gibt es keine Berichte zu Attacken. --------------------------------------------- https://heise.de/-10382767 ∗∗∗ VIdeokonferenzen: Hochriskante Rechteausweitungslücken in Zoom Workplace Apps ∗∗∗ --------------------------------------------- Zoom meldet mehrere Sicherheitslücken in den Workplace Apps der Videokonferenzsoftware. Eine verpasst den Status "kritisch" nur knapp. --------------------------------------------- https://heise.de/-10383108 ∗∗∗ Juniper: On Demand: JSA Series: Multiple vulnerabilities resolved in Juniper Secure Analytics in 7.5.0 UP11 IF03 ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/On-Demand-JSA-Series-Multiple-v… ∗∗∗ MISP 2.4.209 / 2.5.11 Release Notes Latest ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.5.11 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.05.2025
by Daily end-of-shift report 13 May '25

13 May '25

===================== = End-of-Day report = ===================== Timeframe: Montag 12-05-2025 18:00 − Dienstag 13-05-2025 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sit, Fetch, Steal - Chihuahua Stealer: A new Breed of Infostealer ∗∗∗ --------------------------------------------- Chihuahua Stealer is a newly discovered .NET-based infostealer that blends common malware techniques with unusually advanced features. It first came to our attention through a Reddit post made on April 9, where a user shared an obfuscated PowerShell script, they were tricked into executing via a Google Drive document. --------------------------------------------- https://feeds.feedblitz.com/~/918192962/0/gdatasecurityblog-en~Sit-Fetch-St… ∗∗∗ Türkiye-linked spy crew exploited a messaging app zero-day to snoop on Kurdish army in Iraq ∗∗∗ --------------------------------------------- Turkish spies exploited a zero-day bug in a messaging app to collect info on the Kurdish army in Iraq, according to Microsoft, which says the attacks began more than a year ago. Specifically, the snoops abused CVE-2025-27920, a directory traversal vulnerability in version 2.0.62 of messaging app Output Messenger, and the intrusions began in April 2024. The app's developer Srimax issued a software update in December to patch the hole, however not all users applied the fixes. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/05/13/turkish_spie… ∗∗∗ As US vuln-tracking falters, EU enters with its own security bug database ∗∗∗ --------------------------------------------- The European Vulnerability Database (EUVD) is now fully operational, offering a streamlined platform to monitor critical and actively exploited security flaws amid the US struggles with budget cuts, delayed disclosures, and confusion around the future of its own tracking systems. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/05/13/eu_security_… ∗∗∗ SAP-Patchday: Kritische Netweaver-Lücke und viele mehr gestopft ∗∗∗ --------------------------------------------- SAP veröffentlicht im Mai 2025 insgesamt 16 neue Sicherheitsmeldungen. Sie behandeln teils kritische Sicherheitslücken in diversen Produkten aus dem Business-Softwarekatalog des Unternehmens. --------------------------------------------- https://heise.de/-10381863 ∗∗∗ Auditing Moodles core hunting for logical bugs ∗∗∗ --------------------------------------------- The following article explains how, during an audit, we examined Moodle (v4.4.3) and found ways of bypassing all the restrictions preventing SSRF vulnerabilities from being exploited. --------------------------------------------- http://blog.quarkslab.com/auditing-moodles-core-hunting-for-logical-bugs.ht… ∗∗∗ Beyond the Hook: A Technical Deep Dive into Modern Phishing Methodologies ∗∗∗ --------------------------------------------- A technical exploration of modern phishing tactics, from basic HTML pages to advanced MFA-bypassing techniques, with analysis of infrastructure setup and delivery methods used by phishers in 2025. --------------------------------------------- http://blog.quarkslab.com/technical-dive-into-modern-phishing.html ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Updates Everything: May 2025 Edition, (Mon, May 12th) ∗∗∗ --------------------------------------------- Apple released its expected update for all its operating systems. The update, in addition to providing new features, patches 65 different vulnerabilities. Many of these vulnerabilities affect multiple operating systems within the Apple ecosystem. --------------------------------------------- https://isc.sans.edu/diary/rss/31942 ∗∗∗ Perfekt implementierte Sicherungen ausgehebelt: Spectre-Angriffe sind zurück ∗∗∗ --------------------------------------------- Bisherige Schutzmechanismen schützen nicht immer gegen Spectre-artige Seitenkanalangriffe auf Prozessoren, selbst wenn sie perfekt implementiert sind und verschiedene Domains voneinander abschotten. Zu dem Ergebnis kommen Forscher der Systems and Network Security Group an der Vrije Universiteit Amsterdam (VUSec). --------------------------------------------- https://www.heise.de/news/Perfekt-implementierte-Sicherungen-ausgehebelt-Sp… ∗∗∗ 82,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in TheGem WordPress Theme ∗∗∗ --------------------------------------------- On May 4th, 2025, we received a submission for an Arbitrary File Upload vulnerability in TheGem, a WordPress theme with more than 82,000 sales. This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. --------------------------------------------- https://www.wordfence.com/blog/2025/05/82000-wordpress-sites-affected-by-ar… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libeconf and rubygems), Fedora (libxmp), Gentoo (glibc), Oracle (java-1.8.0-openjdk, kernel, libxslt, and virtuoso-opensource), SUSE (augeas, git-lfs, kanidm, and tomcat10), and Ubuntu (linux-lts-xenial). --------------------------------------------- https://lwn.net/Articles/1020948/ ∗∗∗ Stack-based buffer overflow vulnerability in API ∗∗∗ --------------------------------------------- A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder and FortiCamera may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted HTTP requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-25-254 ∗∗∗ EPMM Security Update ∗∗∗ --------------------------------------------- To this end, we are issuing an important security update addressing vulnerabilities associated with open-source libraries used in Ivanti Endpoint Manager Mobile (EPMM). At the time of disclosure, we are aware of a very limited number of customers whose solution has been exploited. The issue only affects the on-prem EPMM product. --------------------------------------------- https://www.ivanti.com/blog/epmm-security-update ∗∗∗ Xen Security Advisory CVE-2024-28956 / XSA-469 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-469.html ∗∗∗ Möglichkeit für Replay-Attacken im Tiiwee X1 Alarm System (SYSS-2025-006) ∗∗∗ --------------------------------------------- https://www.syss.de/pentest-blog/moeglichkeit-fuer-replay-attacken-im-tiiwe… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.05.2025
by Daily end-of-shift report 12 May '25

12 May '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-05-2025 18:00 − Montag 12-05-2025 18:00 Handler: Guenes Holler Co-Handler: n/a ===================== = News = ===================== ∗∗∗ iClicker site hack targeted students with malware via fake CAPTCHA ∗∗∗ --------------------------------------------- The website of iClicker, a popular student engagement platform, was compromised in a ClickFix attack that used a fake CAPTCHA prompt to trick students and instructors into installing malware on their devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/iclicker-hack-targeted-stude… ∗∗∗ Von AMD-Lücke inspiriert: Forscher warnt vor Ransomware im CPU-Microcode ∗∗∗ --------------------------------------------- Eine Ransomware-Infektion kann für Unternehmen weitreichende Folgen haben, die nicht selten auch in einer Insolvenz münden. Durch geeignete Maßnahmen lassen sich die Risiken für solche Sicherheitsvorfälle eindämmen. Der Sicherheitsforscher Christiaan Beek von Rapid7 warnt jedoch vor einer Bedrohung, der gängige Cybersicherheitslösungen wohl bisher wenig entgegenzusetzen haben: Ransomware im Microcode der CPU. --------------------------------------------- https://www.golem.de/news/von-amd-luecke-inspiriert-forscher-warnt-vor-rans… ∗∗∗ It Is 2025, And We Are Still Dealing With Default IoT Passwords And Stupid 2013 Router Vulnerabilities, (Mon, May 12th) ∗∗∗ --------------------------------------------- Unipi Technologies is a company developing programmable logic controllers for a number of different applications like home automation, building management, and industrial controls. The modules produced by Unipi are likely to appeal to a more professional audience. All modules are based on the "Marvis" platform, a customized Linux distribution maintained by Unipi. --------------------------------------------- https://isc.sans.edu/diary/rss/31940 ∗∗∗ A Subtle Form of Siege: DDoS Smokescreens as a Cover for Quiet Data Breaches ∗∗∗ --------------------------------------------- DDoS attacks have long been dismissed as blunt instruments, favored by script kiddies and hacktivists for their ability to overwhelm and disrupt. But in todays fragmented, hybrid-cloud environments, theyve evolved into something far more cunning: a smokescreen. What looks like digital vandalism may actually be a coordinated diversion, engineered to distract defenders from deeper breaches in progress. --------------------------------------------- https://www.tripwire.com/state-of-security/subtle-form-siege-ddos-smokescre… ∗∗∗ Threat Brief: CVE-2025-31324 ∗∗∗ --------------------------------------------- On April 24, 2025, SAP disclosed CVE-2025-31324, a critical vulnerability with a CVSS score of 10.0 affecting the SAP NetWeaver's Visual Composer Framework, version 7.50. This threat brief shares a brief overview of the vulnerability and our analysis, and also includes details of what we’ve observed through our incident response services and telemetry. --------------------------------------------- https://unit42.paloaltonetworks.com/threat-brief-sap-netweaver-cve-2025-313… ∗∗∗ SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths ∗∗∗ --------------------------------------------- sudo is a powerful utility in Unix-like systems that allows permitted users to execute commands with elevated privileges. However, misconfigurations and certain vulnerabilities can be exploited to escalate privileges, potentially compromising system security. --------------------------------------------- https://www.darknet.org.uk/2025/05/sudo_killer-auditing-sudo-configurations… ∗∗∗ One-click RCE in ASUS’s preinstalled driver software ∗∗∗ --------------------------------------------- By trawling through the Javascript on the website, and about 700k lines of decompiled code that the exe produced, I managed to create a list of callable endpoints including some unused ones sitting in the exe. --------------------------------------------- https://mrbruh.com/asusdriverhub/ ∗∗∗ CVE-2024-26809: Critical nftables Vulnerability in Linux Kernel Could Lead to Root Access ∗∗∗ --------------------------------------------- A critical security flaw has been discovered in the Linux kernel’s nftables subsystem, which is responsible for packet filtering in modern Linux distributions. This flaw, a double-free vulnerability, allows local attackers to escalate their privileges and execute arbitrary code. --------------------------------------------- https://thecyberexpress.com/cve-2024-26809-nftables-vulnerability/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libbson-xs-perl, postgresql-13, redis, and simplesamlphp), Fedora (chromium, deluge, epiphany, golang-github-nats-io-nkeys, libxmp, nodejs22, perl-Compress-Raw-Lzma, php-adodb, python-h11, and xz), Gentoo (firefox, NVIDIA Drivers, Orc, PAM, and thunderbird), Mageia (libreoffice, python-django, and transfig), Red Hat (emacs, firefox, python39:3.9, and thunderbird), SUSE (bird3, freetype2, ldap-proxy, libmosquitto1, and ruby3.4-rubygem-rack), and Ubuntu (linux, linux-aws, linux-kvm, linux-aws, and linux-fips). --------------------------------------------- https://lwn.net/Articles/1020884 ∗∗∗ TuneUp und Dienste in Avast, AVG, Avira und Norton reißen Sicherheitslücken auf ∗∗∗ --------------------------------------------- Die Virenschutzsoftware der Marken Avast, AVG, Avira und Norton von Gen Digital bringt unter anderem System-Optimierungsdienste und weitere Komponenten mit, die Schwachstellen enthalten. Nutzerinnen und Nutzer der betroffenen Software sollten prüfen, ob sie neuere Versionen installiert haben als die bekannt verwundbaren. --------------------------------------------- https://heise.de/-10379900 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.05.2025
by Daily end-of-shift report 09 May '25

09 May '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-05-2025 18:00 − Freitag 09-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Nationale Policy für die koordinierte Offenlegung von Schwachstellen (CVD) ∗∗∗ --------------------------------------------- Der Umgang mit Schwachstellen in IT Produkten und Dienstleistungen ist eine der spannenden Themen in der IT-Sicherheit. Seitens der Hersteller stellt sich die Frage, wie man am besten selbst Probleme identifiziert, wie man mit Meldungen von Dritten am umgeht, wie der Prozess zur Entwicklung von korrigierten Versionen aussieht und wie man diese neue Version schnell und effizient an die Kunden verteilt. Seitens der Finder (Researcher) stellen sich Fragen nach den rechtlichen Rahmenbedingungen für die Schwachstellensuche: was darf ich, was sicher nicht, und wie kommuniziere ich das Ergebnis am sinnvollsten? --------------------------------------------- https://www.cert.at/de/spezielles/2025/5/nationale-cvd-policy ∗∗∗ Malicious PyPi package hides RAT malware, targets Discord devs since 2022 ∗∗∗ --------------------------------------------- A malicious Python package targeting Discord developers with remote access trojan (RAT) malware was spotted on the Python Package Index (PyPI) after more than three years.[..] Named "discordpydebug," the package was masquerading as an error logger utility for developers working on Discord bots and was downloaded over 11,000 times since it was uploaded on March 21, 2022, even though it has no description or documentation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-pypi-package-hides… ∗∗∗ FBI: End-of-life routers hacked for cybercrime proxy networks ∗∗∗ --------------------------------------------- The FBI warns that threat actors are deploying malware on end-of-life (EoL) routers to convert them into proxies sold on the 5Socks and Anyproxy networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-end-of-life-routers-hack… ∗∗∗ Operation PowerOFF Takes Down 9 DDoS-for-Hire Domains ∗∗∗ --------------------------------------------- Four different countries, including the United States and Germany, were included in the latest international operation alongside Europols support. --------------------------------------------- https://www.darkreading.com/threat-intelligence/operation-poweroff-takes-do… ∗∗∗ Lumma Stealer, coming and going ∗∗∗ --------------------------------------------- The high-profile information stealer switches up its TTPs, but keeps the CAPTCHA tactic; we take a deep dive. --------------------------------------------- https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/ ∗∗∗ Warnung: Gefälschtes Anwaltsschreiben könnte Schadsoftware enthalten! ∗∗∗ --------------------------------------------- Derzeit kursieren E-Mails einer angeblichen Anwaltskanzlei, in denen Unternehmen beschuldigt werden, Urheberrechte an Inhalten von Avident Entertainment verletzt zu haben. Über einen Download-Link kann eine Sammlung von Beweisen heruntergeladen werden. Aber Vorsicht: Der Link ist betrügerisch und enthält vermutlich Schadsoftware! --------------------------------------------- https://www.watchlist-internet.at/news/warnung-gefaelschtes-anwaltsschreibe… ∗∗∗ Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources ∗∗∗ --------------------------------------------- Unit 42 details a new malware obfuscation technique where threat actors hide malware in bitmap resources within .NET applications. These deliver payloads like Agent Tesla or XLoader. --------------------------------------------- https://unit42.paloaltonetworks.com/malicious-payloads-as-bitmap-resources-… ∗∗∗ Bantam – Advanced PHP Backdoor Management Tool For Post Exploitation ∗∗∗ --------------------------------------------- Bantam is a lightweight post-exploitation utility written in C# that includes advanced payload generation and obfuscation. --------------------------------------------- https://www.darknet.org.uk/2025/05/bantam-advanced-php-backdoor-management-… ∗∗∗ Phishing Attack Uses Blob URIs to Show Fake Login Pages in Your Browser ∗∗∗ --------------------------------------------- Cofense Intelligence reveals a novel phishing technique using blob URIs to create local fake login pages, bypassing email security and stealing credentials. --------------------------------------------- https://hackread.com/phishing-attack-blob-uri-fake-login-pages-browser/ ∗∗∗ Remote-Access-Trojaner in npm-Paket mit 40.000 wöchentlichen Downloads gefunden ∗∗∗ --------------------------------------------- Angreifer hatten das Paket rand-user-agent, das unter anderem für automatische Tests und zum Web-Scraping dient, mit Schadcode versehen. --------------------------------------------- https://heise.de/-10377590 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, libapache2-mod-auth-openidc, mariadb-10.5, and openssh), Red Hat (osbuild-composer), Slackware (mariadb), SUSE (apache2-mod_auth_openidc, glib2, ImageMagick, libsoup, libsoup2, libva, openvpn, sqlite3, and weblate), and Ubuntu (libsoup3, php-horde-css-parser, and python-django). --------------------------------------------- https://lwn.net/Articles/1020545/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (fossil, libapache2-mod-auth-openidc, and request-tracker4), Fedora (thunderbird), Mageia (firefox and thunderbird), SUSE (389-ds, apparmor, cargo-c, chromium, go1.24, govulncheck-vulndb, java-1_8_0-openjdk, kanidm, libsoup, mozjs102, openssl-1_1, openssl-3, python-Django, sccache, tealdeer, tomcat, transfig, wasm-bindgen, and wireshark), and Ubuntu (libreoffice and python-h11). --------------------------------------------- https://lwn.net/Articles/1020653/ ∗∗∗ Sicherheitslücken: F5 BIG-IP-Appliances sind an mehreren Stellen verwundbar ∗∗∗ --------------------------------------------- https://heise.de/-10377584 ∗∗∗ Joomla: [20250402] - Core - MFA Authentication Bypass ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/964-20250402-core-mfa-authenti… ∗∗∗ Pixmeo OsiriX MD ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01 ∗∗∗ Hitachi Energy RTU500 Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-02 ∗∗∗ Horner Automation Cscape ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-01 ∗∗∗ Mitsubishi Electric CC-Link IE TSN ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-128-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.05.2025
by Daily end-of-shift report 08 May '25

08 May '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-05-2025 18:00 − Donnerstag 08-05-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ WhatsApp provides no cryptographic management for group messages ∗∗∗ --------------------------------------------- The weakness creates the possibility of an insider or hacker adding rogue members. [..] “This means that it is possible for the WhatsApp server to add new members to a group,” Martin R. Albrecht, a researcher at King's College in London, wrote in an email. “A correct client—like the official clients—will display this change but will not prevent it. Thus, any group chat that does not verify who has been added to the chat can potentially have their messages read.” --------------------------------------------- https://arstechnica.com/security/2025/05/whatsapp-provides-no-cryptographic… ∗∗∗ Password crisis deepens in 2025: lazy, reused, and stolen ∗∗∗ --------------------------------------------- A new study of over 19 billion newly exposed passwords manifests a widespread weak password reuse crisis. Lazy keyboard patterns, such as 123456, still reign supreme, and 94% of passwords are reused or duplicated, data leaks from 2024-2025 reveal. Names like Ana rank as the second most popular component. --------------------------------------------- https://cybernews.com/security/password-leak-study-unveils-2025-trends-reus… ∗∗∗ Ransomware: Unbekannte Angreifer leaken LockBit-Datenbank – dank PHP-Exploit? ∗∗∗ --------------------------------------------- Tausende Bitcoin-Adressen, Chatnachrichten und weitere brisante Details des Ransomware-Anbieters kursieren nun im Web. Der LockBit-Support relativiert. --------------------------------------------- https://www.heise.de/news/Ransomware-Unbekannte-Angreifer-leaken-LockBit-Da… ∗∗∗ RCEs and more in the KUNBUS GmbH Revolution Pi PLC ∗∗∗ --------------------------------------------- Four new vulnerabilities in the Revolution Pi industrial PLCs. Two give unauthenticated attackers RCE—potentially a direct impact on safety and operations. [..] Since the vulnerabilities affect ICS equipment, we coordinated disclosure with CISA and KUNBUS’ PSIRT team (security.txt). --------------------------------------------- https://www.pentestpartners.com/security-blog/rces-and-more-in-the-kunbus-g… ∗∗∗ 2,99 € Einfuhrzoll für die Post? Achtung, Phishing! ∗∗∗ --------------------------------------------- Ein Paket hängt im Zoll fest? Die Auslieferung ist nur gegen die Zahlung einer Gebühr möglich? Ein Szenario, das Kriminelle aktuell verstärkt als Betrugsmasche einsetzen. Sie versenden Phishing-Mails im Namen der Post AG und hoffen auf leichtgläubige Opfer. --------------------------------------------- https://www.watchlist-internet.at/news/einfuhrzoll-fuer-die-post/ ∗∗∗ Fake AI Tools Push New Noodlophile Stealer Through Facebook Ads ∗∗∗ --------------------------------------------- Scammers are using fake AI tools and Facebook ads to spread Noodlophile Stealer malware, targeting users with a multi-stage attack to steal credentials. --------------------------------------------- https://hackread.com/fake-ai-tools-noodlophile-stealer-facebook-ads/ ∗∗∗ RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale ∗∗∗ --------------------------------------------- Learn how RedisRaider is targeting publicly accecesibly Redis servers to mine crypocurrency. --------------------------------------------- https://securitylabs.datadoghq.com/articles/redisraider-weaponizing-misconf… ===================== = Vulnerabilities = ===================== ∗∗∗ SonicWall urges admins to patch VPN flaw exploited in attacks ∗∗∗ --------------------------------------------- Discovered and reported by Rapid7 cybersecurity researcher Ryan Emmons, the three security flaws (CVE-2025-32819, CVE-2025-32820, and CVE-2025-32821) can be chained by attackers to gain remote code execution as root and compromise vulnerable instances. The vulnerabilities impact SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v devices and are patched in firmware version 10.2.1.15-81sv and higher. [..] SonicWall advised admins to check their SMA devices' logs for any signs of unauthorized logins and enable the web application firewall and multifactor authentication (MFA) on their SMA100 appliances as a safety measure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sonicwall-urges-admins-to-pa… ∗∗∗ CISCO Security Advisories 07. - 08.05.2025 ∗∗∗ --------------------------------------------- Cisco has released 29 new security Advisories. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Out-of-Band Access Point (AP) Image Download feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system. [..] Note: For exploitation to be successful, the Out-of-Band AP Image Download feature must be enabled on the device. It is not enabled by default. CVE-2025-20188 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Catalyst Center Unauthenticated API Access Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings. CVE-2025-20210 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Drupal Security Advisories 07.05.2025 ∗∗∗ --------------------------------------------- Drupal has released 10 new security advisories. --------------------------------------------- https://www.drupal.org/security ∗∗∗ Ubiquiti UniFi Protect: Kritisches Leck ermöglicht Codeschmuggel ∗∗∗ --------------------------------------------- In einer Sicherheitsmitteilung erörtert Ubiquiti die Schwachstellen. Bösartige Akteure mit Zugriff auf das Verwaltungsnetzwerk können einen Heap-basierten Pufferüberlauf in den Unifi-Protect-Kameras mit Firmware 4.75.43 und vorherigen provozieren und dadurch beliebigen Code einschleusen und ausführen (CVE-2025-23123, CVSS 10.0, Risiko "kritisch"). --------------------------------------------- https://www.heise.de/news/Ubiquity-UniFi-Protect-Einschleusen-von-Schadcode… ∗∗∗ Mitel SIP-Phones lassen sich beliebige Befehle unterjubeln ∗∗∗ --------------------------------------------- Laut der Sicherheitsmitteilung von Mitel gibt es eine Befehlsschmuggel-Lücke in den SIP-Phones der Baureihen 6800, 6900, 6900w sowie dem 6970-Konferenz-Modell. Angreifer aus dem Netz können dadurch ohne vorherige Authentifizierung Befehle einschleusen, da nicht näher genannte Parameter nicht ausreichend gefiltert werden. Damit können sie System- und Nutzer-Daten und Konfigurationen einsehen oder ändern (CVE-2025-47188, CVSS 9.8, Risiko "kritisch"). --------------------------------------------- https://heise.de/-10376625 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (April 28, 2025 to May 4, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/05/wordfence-intelligence-weekly-wordpr… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.05.2025
by Daily end-of-shift report 07 May '25

07 May '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-05-2025 18:00 − Mittwoch 07-05-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Samsung MagicINFO 9 Server RCE flaw now exploited in attacks ∗∗∗ --------------------------------------------- Hackers are exploiting an unauthenticated remote code execution (RCE) vulnerability in the Samsung MagicINFO 9 Server to hijack devices and deploy malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/samsung-magicinfo-9-server-r… ∗∗∗ Apache Parquet exploit tool detect servers vulnerable to critical flaw ∗∗∗ --------------------------------------------- A proof-of-concept exploit tool has been publicly released for a maximum severity Apache Parquet vulnerability, tracked as CVE-2025-30065, making it easy to find vulnerable servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apache-parquet-exploit-tool-… ∗∗∗ Millionenstrafe für Firma nach WhatsApp-Hack ∗∗∗ --------------------------------------------- Die NSO Group aus Israel hatte einen Bug in WhatsApp genutzt, um Spyware zu installieren. Meta klagte und gewann. --------------------------------------------- https://futurezone.at/digital-life/meta-whatsapp-nso-group-spionagesoftware… ∗∗∗ Zero Day: Windows-Lücke von mindestens zwei Hackergruppen ausgenutzt ∗∗∗ --------------------------------------------- Mindestens zwei Cyberbanden haben sich einer Schwachstelle im CLFS-Treiber von Windows bedient, bevor Microsoft einen Patch ausliefern konnte. --------------------------------------------- https://www.golem.de/news/zero-day-windows-luecke-von-mindestens-zwei-hacke… ∗∗∗ State of ransomware in 2025 ∗∗∗ --------------------------------------------- Kaspersky researchers review ransomware trends for 2024, analyze the most active groups and forecast how this threat will evolve in 2025. --------------------------------------------- https://securelist.com/state-of-ransomware-in-2025/116475/ ∗∗∗ Lights Out and Stalled Factories: Using M.A.T.R.I.X to Learn About Modbus Vulnerabilities ∗∗∗ --------------------------------------------- Let’s explore the critical role of Modbus in energy and manufacturing systems, then demonstrate real-world exploitation techniques using Docker-based simulations and the custom-built Python tool M.A.T.R.I.X. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/lights-out-… ∗∗∗ Backupsoftware Commvault: Weitere Lücke angegriffen, Patch offenbar unwirksam ∗∗∗ --------------------------------------------- Zum Wochenende wurden Angriffe auf eine weitere Commvault-Sicherheitslücke bekannt. Das Update zum Abdichten wirkt wohl nicht. --------------------------------------------- https://www.heise.de/news/Backupsoftware-Commvault-Weitere-Luecke-angegriff… ∗∗∗ Wegen Sicherheitslücken: LibreOffice rät von OpenOffice ab ∗∗∗ --------------------------------------------- Die Entwickler von LibreOffice raten vom Konkurrenten OpenOffice ab. Die Apache-Software enthalte Sicherheitslücken und werde nicht weiterentwickelt. --------------------------------------------- https://www.heise.de/news/Wegen-Sicherheitsluecken-LibreOffice-raet-von-Ope… ∗∗∗ NIS2 nicht umgesetzt: EU-Strafe für Deutschland rückt einen Schritt näher ∗∗∗ --------------------------------------------- Die EU-Kommission hat die zweite Stufe des Vertragsverletzungsverfahren gegen Deutschland eingeleitet, weil es die NIS2-Richtlinie noch nicht umgesetzt hat. --------------------------------------------- https://www.heise.de/news/NIS2-nicht-umgesetzt-EU-Strafe-fuer-Deutschland-r… ∗∗∗ Exploiting Copilot AI for SharePoint ∗∗∗ --------------------------------------------- TL;DR AI Assistants are becoming far more common Copilot for SharePoint is Microsoft’s answer to generative AI assistance on SharePoint Attackers will look to exploit anything they can get their .. --------------------------------------------- https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sha… ∗∗∗ Meta lässt sich sechs Wochen Zeit, bis Betrug entfernt wird ∗∗∗ --------------------------------------------- Postings über Kryptoscams oder betrügerische Influencer-Aktionen bleiben auf Facebook und Instagram am längsten von allen online --------------------------------------------- https://www.derstandard.at/story/3000000268532/meta-laesst-sich-sechs-woche… ∗∗∗ Ransomware Attackers Leveraged Privilege Escalation Zero-day ∗∗∗ --------------------------------------------- Exploit used by Play-linked attackers targets the CVE-2025-29824 zero-day vulnerability patched on April 8. --------------------------------------------- https://www.security.com/threat-intelligence/play-ransomware-zero-day ∗∗∗ Unsophisticated Cyber Actor(s) Targeting Operational Technology ∗∗∗ --------------------------------------------- CISA is increasingly aware of unsophisticated cyber actor(s) targeting ICS/SCADA systems within U.S. critical Infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems. Although these activities often include basic and elementary intrusion techniques, the presence of poor cyber hygiene and exposed assets can escalate .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-ac… ∗∗∗ Poland arrests four in global DDoS-for-hire takedown ∗∗∗ --------------------------------------------- The suspects allegedly operated six platforms that offered distributed denial-of-service attacks for as little as 10 euros. --------------------------------------------- https://therecord.media/poland-arrests-four-ddos-hire ∗∗∗ Achtung bei iVentoy, es werden obskure Zertifikate und Treiber installiert ∗∗∗ --------------------------------------------- Kurze Warnung an Leute aus der Blog-Leserschaft, die das Tool iVentoy zur Verteilung von Betriebssystem-Images über ein Netzwerk und einen PXE-Server einsetzen. Es gibt aktuell eine Diskussion, dass das Tool .. --------------------------------------------- https://www.borncity.com/blog/2025/05/07/achtung-bei-iventoy-es-werden-obsk… ∗∗∗ ClickFix Scam: How to Protect Your Business Against This Evolving Threat ∗∗∗ --------------------------------------------- Cybercriminals aren’t always loud and obvious. Sometimes, they play it quiet and smart. One of the tricks of .. --------------------------------------------- https://hackread.com/clickfix-scam-how-to-protect-business-againt-threat/ ∗∗∗ COLDRIVER Using New Malware To Steal Documents >From Western Targets and NGOs ∗∗∗ --------------------------------------------- Google Threat Intelligence Group (GTIG) has identified a new piece of malware called LOSTKEYS, attributed to the Russian government-backed threat group COLDRIVER (also known as UNC4057, Star Blizzard, and Callisto). LOSTKEYS is capable of stealing files from a hard-coded list of extensions and directories, along with sending system .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-do… ===================== = Vulnerabilities = ===================== ∗∗∗ Honeywell MB Secure Authenticated Command Injection ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/authenticated-command… ∗∗∗ Langflow Missing Authentication Vulnerability ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/threat-signal-report/6085 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.05.2025
by Daily end-of-shift report 06 May '25

06 May '25

===================== = End-of-Day report = ===================== Timeframe: Montag 05-05-2025 18:00 − Dienstag 06-05-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Man pleads guilty to using malicious AI software to hack Disney employee ∗∗∗ --------------------------------------------- Fake image-generating app allowed man to download 1.1TB of Disney-owned data. --------------------------------------------- https://arstechnica.com/ai/2025/05/man-pleads-guilty-to-using-malicious-ai-… ∗∗∗ Luna Moth extortion hackers pose as IT help desks to breach US firms ∗∗∗ --------------------------------------------- The data-theft extortion group known as Luna Moth, aka Silent Ransom Group, has ramped up callback phishing campaigns in attacks on legal and financial institutions in the United States. --------------------------------------------- https://www.bleepingcomputer.com/news/security/luna-moth-extortion-hackers-… ∗∗∗ "Mirai" Now Exploits Samsung MagicINFO CMS (CVE-2024-7399), (Mon, May 5th) ∗∗∗ --------------------------------------------- Last August, Samsung patched an arbitrary file upload vulnerability that could lead to remote code execution [1]. The announcement was very sparse and did not even include affected .. --------------------------------------------- https://isc.sans.edu/diary/Mirai+Now+Exploits+Samsung+MagicINFO+CMS+CVE2024… ∗∗∗ CISA slammed for role in censorship industrial complex as budget faces possible $500M cut ∗∗∗ --------------------------------------------- Because who needs cybersecurity when there’s culture wars to win President Trumps dream 2026 budget would gut the US govts Cybersecurity and Infrastructure Security Agency, aka CISA, by $491 million - about 17 percent – and accuses the organization of abandoning its core mission in favor of policing online speech. --------------------------------------------- https://www.theregister.com/2025/05/06/cisa_budget_cuts/ ∗∗∗ Signal-Affäre: Modifizierter Messenger stellt nach zweitem Einbruch Betrieb ein ∗∗∗ --------------------------------------------- In der US-Regierung wird eine modifizierte App benutzt, um per Signal zu kommunizieren. Die heißt TeleMessage, wurde zweimal geknackt und vorerst dicht gemacht. --------------------------------------------- https://www.heise.de/news/Signal-Affaere-Modifizierter-Messenger-stellt-nac… ∗∗∗ Peru denies it was hit by ransomware attack following Rhysida claims ∗∗∗ --------------------------------------------- The prolific ransomware gang claimed to have taken over the Peruvian governments domain. --------------------------------------------- https://therecord.media/peru-rhysida-ransomware-claims-denied ∗∗∗ NSA to cut up to 2,000 civilian roles as part of intel community downsizing ∗∗∗ --------------------------------------------- The agency is expected to make the cuts by the end of year, however that deadline could change as it is tied to the Defense Department’s broader push to reduce its budget by 8 percent in each of the next five years. --------------------------------------------- https://therecord.media/nsa-to-cut-up-to-2000-roles-downsizing ∗∗∗ Verizon DBIR 2025: Edge KEVs Are Increasingly Left Unpatched — and More Often Exploited in Breaches ∗∗∗ --------------------------------------------- Edge vulnerabilities are a critical and growing threat. The 2025 DBIR reveals an eightfold surge in exploitation, yet many remain unpatched despite immediate risk. --------------------------------------------- https://www.greynoise.io/blog/verizon-dbir-2025-edge-kevs-increasingly-left… ∗∗∗ Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines ∗∗∗ --------------------------------------------- UNC3944, which overlaps with public reporting on Scattered Spider, is a financially-motivated threat actor characterized by its persistent use of social engineering and brazen communications with victims. In early operations, UNC3944 largely targeted telecommunications-related organizations to support SIM swap operations. However, after shifting to .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-… ∗∗∗ A Timely Reminder: Russia’s Enduring Cyber Threat to Critical Infrastructure ∗∗∗ --------------------------------------------- Russia’s cyber operations — ranging from power-grid disruptions to global ransomware — continue to be among the world’s most prolific and destructive, underscoring the continued .. --------------------------------------------- https://detect.fyi/a-timely-reminder-russias-enduring-cyber-threat-to-criti… ∗∗∗ How to Harden GitHub Actions: The Unofficial Guide ∗∗∗ --------------------------------------------- Build resilient GitHub Actions workflows with lessons from recent attacks. --------------------------------------------- https://www.wiz.io/blog/github-actions-security-guide ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium and kappanhang), Red Hat (osbuild-composer and thunderbird), SUSE (chromedriver), and Ubuntu (c-ares, corosync, mysql-8.0, mysql-8.4, openjdk-17, openjdk-21, openjdk-24, openjdk-8, and openjdk-lts). --------------------------------------------- https://lwn.net/Articles/1020222/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.05.2025
by Daily end-of-shift report 05 May '25

05 May '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-05-2025 18:00 − Montag 05-05-2025 18:00 Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Magento supply chain attack compromises hundreds of e-stores ∗∗∗ --------------------------------------------- A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational. --------------------------------------------- https://www.bleepingcomputer.com/news/security/magento-supply-chain-attack-… ∗∗∗ StealC malware enhanced with stealth upgrades and data theft tools ∗∗∗ --------------------------------------------- The creators of StealC, a widely-used information stealer and malware downloader, have released its second major version, bringing multiple stealth and data theft enhancements. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stealc-malware-enhanced-with… ∗∗∗ Shuffling the Greatest Hits: How DragonForce Ransomware Samples LockBit and Conti Into a Ransomware Jukebox ∗∗∗ --------------------------------------------- DragonForce ransomware has been assessed as a sophisticated threat that tactically deploys payloads derived from leaked source code of both the notorious LockBit 3.0 and Conti ransomware families. While the samples share some similar core functionality, DragonForce distinguishes itself in several .. --------------------------------------------- https://hybrid-analysis.blogspot.com/2025/05/shuffling-greatest-hits-how-dr… ∗∗∗ Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware ∗∗∗ --------------------------------------------- An Iranian state-sponsored threat group has been attributed to a long-term cyber intrusion aimed at a critical national infrastructure (CNI) in the Middle East that lasted nearly two years.The activity, which lasted from at least May 2023 to February 2025, .. --------------------------------------------- https://thehackernews.com/2025/05/iranian-hackers-maintain-2-year-access.ht… ∗∗∗ CISA Adds Two Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/05/02/cisa-adds-two-known-expl… ∗∗∗ CVE-2025-31324: Critical SAP NetWeaver Vulnerability Actively Exploited ∗∗∗ --------------------------------------------- SAP has recently released a critical security patch for a severe vulnerability in SAP NetWeaver Visual Composer that has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-31324, has recently been patched with the release of SAP Security Note 3594142. --------------------------------------------- https://www.truesec.com/hub/blog/cve-2025-31324-critical-sap-netweaver-vuln… ∗∗∗ DragonForce Ransomware Cartel attacks on UK high street retailers: walking in the front door ∗∗∗ --------------------------------------------- The individuals operating under the DragonForce banner and attacking UK high street retailers are using social engineering for entry. I think it’s in the public interest to break down what is happening. --------------------------------------------- https://doublepulsar.com/dragonforce-ransomware-cartel-attacks-on-uk-high-s… ∗∗∗ NPM targeted by malware campaign mimicking familiar library names ∗∗∗ --------------------------------------------- Developers looking for familiar packages from other programming languages are increasingly falling victim to malicious attacks. Summary #The Socket threat research team uncovered a coordinated malware operation across the NPM ecosystem. The actor behind the campaign published dozens of malicious NPM packages that mimic well-known Python, Java, C++, .NET, .. --------------------------------------------- https://socket.dev/blog/npm-targeted-by-malware-campaign-mimicking-familiar… ∗∗∗ Apache Parquet Java Vulnerability CVE-2025-46762 Exposes Systems to Remote Code Execution Attacks ∗∗∗ --------------------------------------------- A vulnerability has been identified in Apache Parquet Java, which could leave systems exposed to remote code execution (RCE) attacks. Apache Parquet contributor Gang Wu discovered, this flaw, tracked as CVE-2025-46762, .. --------------------------------------------- https://thecyberexpress.com/apache-parquet-java-flaw-cve-2025-46762/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ansible, containerd, and vips), Fedora (chromium, java-17-openjdk, nodejs-bash-language-server, nodejs-pnpm, ntpd-rs, redis, rust-hickory-proto, thunderbird, and valkey), Mageia (apache-mod_auth_openidc, fcgi, graphicsmagick, kernel-linus, pam, poppler, and tomcat), Red Hat (firefox, libsoup, nodejs:20, redis:6, .. --------------------------------------------- https://lwn.net/Articles/1020130/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.05.2025
by Daily end-of-shift report 02 May '25

02 May '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-04-2025 18:00 − Freitag 02-05-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Jetzt patchen! Angreifer setzen erneut an älteren Sonicwall-Lücken an ∗∗∗ --------------------------------------------- Aufgrund von laufenden Attacken sollten Admins ihre Fernwartungslösungen der SMA-Serie von Sonicwall umgehend auf den aktuellen Stand bringen. [..] Beide Schwachstellen betreffen die SMA-Reihen SMA 200, 210, 400, 410 und 500v. Die Entwickler versichern, die Lücken ab der Firmware 10.2.1.14-75sv geschlossen zu haben. [..] Sind Attacken erfolgreich, können Angreifer Schadcode ausführen. Die "kritische" Lücke (CVE-2024-38475) betrifft die SMA-Komponente Apache HTTP Server. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Angreifer-setzen-erneut-an-aelteren… ∗∗∗ SonicBoom, From Stolen Tokens to Remote Shells - SonicWall SMA (CVE-2023-44221, CVE-2024-38475) ∗∗∗ --------------------------------------------- Another day, another edge device being targeted - it’s a typical Thursday! In today’s blog post, we’re excited to share our previously private analysis of the now exploited in-the-wild N-day vulnerabilities affecting SonicWall’s SMA100 appliance. [..] Although this is a CVE attached to the Apache HTTP Server, it is important to note that due to how CVEs are now assigned, a seperate CVE will not be assigned for SonicWall's [..] As always, we’ve produced a Detection Artefact Generator to demonstrate and achieve pre-auth RCE. --------------------------------------------- https://labs.watchtowr.com/sonicboom-from-stolen-tokens-to-remote-shells-so… ∗∗∗ Why MFA is getting easer to bypass and what to do about it ∗∗∗ --------------------------------------------- As detailed on Thursday by Cisco Talos, an entire ecosystem has cropped up to help criminals defeat these forms of MFA. --------------------------------------------- https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-a… ∗∗∗ Windows: Anmeldung mit alten Passwörtern durch RDP möglich ∗∗∗ --------------------------------------------- Laut Microsoft handelt es sich um eine "Design-Entscheidung, die sicherstellt, dass mindestens ein Nutzerkonto dazu in der Lage ist, sich anzumelden, ganz gleich, wie lange das System offline war". Daher treffe dieses Verhalten die Definition einer Schwachstelle nicht. Microsoft habe keine Pläne, etwas daran zu ändern. --------------------------------------------- https://www.heise.de/news/Windows-Log-in-ueber-RDP-mit-widerrufenen-Passwoe… ∗∗∗ Prolific RansomHub Operation Goes Dark ∗∗∗ --------------------------------------------- The chat infrastructure and data-leak site of the notorious ransomware-as-a-service group has been inactive since March 31, according to security vendors. --------------------------------------------- https://www.darkreading.com/cyber-risk/prolific-ransomhub-operation-goes-da… ∗∗∗ Softwareupdates manipuliert: Hacker missbrauchen IPv6-Feature für Cyberattacken ∗∗∗ --------------------------------------------- Spellbinder nutzt den Angaben nach einen Angriffsvektor, der schon mindestens seit 2008 bekannt ist und schon 2011 in einem Blogbeitrag unter der Bezeichnung "SLAAC-Attack" ausführlich beschrieben wurde. [..] Mit Spellbinder lassen sich demnach IPv6-Konfigurationen spoofen, die normalerweise automatisch über eine Methode namens SLAAC (Stateless Address Autoconfiguration) zugewiesen werden. --------------------------------------------- https://www.golem.de/news/softwareupdates-manipuliert-hacker-missbrauchen-i… ∗∗∗ MintsLoader Drops GhostWeaver via Phishing, ClickFix — Uses DGA, TLS for Stealth Attacks ∗∗∗ --------------------------------------------- The malware loader known as MintsLoader has been used to deliver a PowerShell-based remote access trojan called GhostWeaver. "MintsLoader operates through a multi-stage infection chain involving obfuscated JavaScript and PowerShell scripts," Recorded Futures Insikt Group said in a report shared with The Hacker News. --------------------------------------------- https://thehackernews.com/2025/05/mintsloader-drops-ghostweaver-via.html ∗∗∗ I StealC You: Tracking the Rapid Changes To StealC ∗∗∗ --------------------------------------------- StealC is a popular information stealer and malware downloader that has been sold since January 2023. In March 2025, StealC version 2 (V2) was introduced with key updates, including a streamlined command-and-control (C2) communication protocol and the addition of RC4 encryption (in the latest variants). The malware’s payload delivery options have been expanded to include Microsoft Software Installer (MSI) packages and PowerShell scripts. --------------------------------------------- https://www.zscaler.com/blogs/security-research/i-stealc-you-tracking-rapid… ∗∗∗ Using Trusted Protocols Against You: Gmail as a C2 Mechanism ∗∗∗ --------------------------------------------- Socket’s Threat Research Team uncovered malicious Python packages designed to create a tunnel via Gmail. The threat actor’s email is the only potential clue as to their motivation, but once the tunnel is created, the threat actor can exfiltrate data or execute commands that we may not know about through these packages. --------------------------------------------- https://socket.dev/blog/using-trusted-protocols-against-you-gmail-as-a-c2-m… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (expat, fig2dev, firefox-esr, golang-github-gorilla-csrf, jinja2, libxml2, nagvis, qemu, request-tracker4, request-tracker5, u-boot, and vips), Fedora (firefox, giflib, and thunderbird), Mageia (imagemagick), Red Hat (thunderbird), SUSE (amber-cli, libjxl, and redis), and Ubuntu (h2o, poppler, and postgresql-10). --------------------------------------------- https://lwn.net/Articles/1019645/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, nodejs, openjdk-17, and thunderbird), Fedora (firefox, golang-github-nvidia-container-toolkit, and thunderbird), Mageia (kernel), Oracle (ghostscript, glibc, kernel, libxslt, php:8.1, and thunderbird), SUSE (cmctl, firefox-esr, govulncheck-vulndb, java-21-openjdk, libxml2, poppler, python-h11, and redis), and Ubuntu (docker.io, ghostscript, linux-xilinx-zynqmp, and micropython). --------------------------------------------- https://lwn.net/Articles/1019869/ ∗∗∗ CISA Releases Two Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-25-121-01 KUNBUS GmbH Revolution Pi, ICSMA-25-121-01 MicroDicom DICOM Viewer --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/05/01/cisa-releases-two-indust… ∗∗∗ ZDI-25-267: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-267/ ∗∗∗ IBM Cognos Analytics: Angreifer können Schadcode hochladen ∗∗∗ --------------------------------------------- https://www.heise.de/news/IBM-Cognos-Analytics-Angreifer-koennen-Schadcode-… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (April 21, 2025 to April 27, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/05/wordfence-intelligence-weekly-wordpr… ∗∗∗ Tenable: [R1] Sensor Proxy Version 1.2.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-08 ∗∗∗ f5: K000151130: GnuTLS vulnerability CVE-2024-12243 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000151130 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.04.2025
by Daily end-of-shift report 30 Apr '25

30 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 29-04-2025 18:00 − Mittwoch 30-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ AirBorne: Wormable Zero-Click RCE in Apple AirPlay ∗∗∗ --------------------------------------------- Oligo Security Research has discovered a new set of vulnerabilities in Apple’s AirPlay Protocol and the AirPlay Software Development Kit (SDK), which is used by third-party vendors to integrate AirPlay into third-party devices. --------------------------------------------- https://www.oligo.security/blog/airborne ∗∗∗ Web Scanning Sonicwall for CVE-2021-20016, (Tue, Apr 29th) ∗∗∗ --------------------------------------------- The activity occured on the 23 April 2025 between 18:00 - 19:00 UTC but since then based on activity reported to DShield (see graphs below) has been happening almost daily. --------------------------------------------- https://isc.sans.edu/diary/rss/31906 ∗∗∗ Yet Another NodeJS Backdoor (YaNB): A Modern Challenge ∗∗∗ --------------------------------------------- During an Advanced Continual Threat Hunt (ACTH) investigation conducted in early March 2025, Trustwave SpiderLabs identified a notable resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications. These campaigns trick users into executing NodeJS-based backdoors, subsequently deploying sophisticated NodeJS Remote Access Trojans (RATs) similar to traditional PE structured legacy RATs. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/yet-another… ∗∗∗ Understanding the Deep Web, Dark Web, and Darknet (2025 Guide) ∗∗∗ --------------------------------------------- Understand the difference between Deep Web, Dark Web, and Darknet. Learn how they work, how to access them safely, and why they matter in 2025. --------------------------------------------- https://www.darknet.org.uk/2025/04/understanding-the-deep-web-dark-web-and-… ∗∗∗ The MCP Authorization Spec Is... a Mess for Enterprise ∗∗∗ --------------------------------------------- The Model Context Protocol has created quite the buzz in the AI ecosystem at the moment, but as enterprise organizations look to adopt it, they are confronted with a hard truth: it lacks important security functionality. Up until now, as people experiment with Agentic AI and tool support, they’ve mostly adopted the MCP stdio transport, which means you end up with a 1:1 deployment of MCP server and MCP client. What organizations need is a way to deploy MCP servers remotely and leverage authorization to give resource owner’s access to their data safely. --------------------------------------------- https://blog.christianposta.com/the-updated-mcp-oauth-spec-is-a-mess/ ∗∗∗ Practical Cyber Deception — Introduction to “Chaotic Good” ∗∗∗ --------------------------------------------- Cyber deception isn’t about building expensive honeynets or deploying complex traps — it’s about instilling doubt and confusion in the attacker. By layering practical, tactical deception into your environment, you shift the balance of power: slowing them down, forcing mistakes, and gaining early warning long before real damage is done. From fake servers and canary tokens to ransomware drive traps, deception turns defense from a reactive grind into a strategic, active game. --------------------------------------------- https://detect.fyi/practical-cyber-deception-introduction-to-chaotic-good-2… ∗∗∗ Phishers Take Advantage of Iberian Blackout Before Its Even Over ∗∗∗ --------------------------------------------- Opportunistic threat actors targeted Portuguese and Spanish speakers by spoofing Portugals national airline in a campaign offering compensation for delayed or disrupted flights. --------------------------------------------- https://www.darkreading.com/cyberattacks-data-breaches/phishers-take-advant… ===================== = Vulnerabilities = ===================== ∗∗∗ Dell schützt PowerProtect Data Manager und Laptops vor möglichen Attacken ∗∗∗ --------------------------------------------- In einer Warnmeldung führen die Entwickler aus, dass PowerProtect Data Manager über mehrere Lücken in Komponenten von Drittanbietern wie Golang und Spring Framework, aber auch über Lücken in der Anwendung selbst angreifbar ist. Sind Attacken erfolgreich, können sich Angreifer etwa mit lokalem Zugriff und niedrigen Rechten höhere Nutzerrechte verschaffen (CVE-2025-23375 "hoch"). Die Entwickler versichern, die Lücken in PowerProtect Data Manager 19.19.0-15 geschlossen zu haben. --------------------------------------------- https://www.heise.de/news/Dell-schuetzt-PowerProtect-Data-Manager-und-Lapto… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glibc and libraw), Fedora (digikam, icecat, mingw-LibRaw, perl, perl-Devel-Cover, and perl-PAR-Packer), Red Hat (ghostscript, kernel, and kernel-rt), Slackware (mozilla), SUSE (augeas, firefox, and java-11-openjdk), and Ubuntu (binutils, libxml2, and nodejs). --------------------------------------------- https://lwn.net/Articles/1019457/ ∗∗∗ CISA Releases Three Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-25-119-01 Rockwell Automation ThinManager, ICSA-25-119-02 Delta Electronics ISPSoft, ICSA-25-105-05 Lantronix XPort (Update A) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/04/29/cisa-releases-three-indu… ∗∗∗ Mehrere Schwachstellen in Sematell ReplyOne (SYSS-2024-081/-082/-083) ∗∗∗ --------------------------------------------- https://www.syss.de/pentest-blog/mehrere-schwachstellen-in-sematell-replyon… ∗∗∗ f5: K000151082: PostgreSQL vulnerability CVE-2021-32027 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000151082 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.04.2025
by Daily end-of-shift report 29 Apr '25

29 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Montag 28-04-2025 18:00 − Dienstag 29-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Hitachi Vantara takes servers offline after Akira ransomware attack ∗∗∗ --------------------------------------------- Hitachi Vantara, a subsidiary of Japanese multinational conglomerate Hitachi, was forced to take servers offline over the weekend to contain an Akira ransomware attack. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hitachi-vantara-takes-server… ∗∗∗ The one interview question that will protect you from North Korean fake workers ∗∗∗ --------------------------------------------- "My favorite interview question, because we've interviewed quite a few of these folks, is something to the effect of 'How fat is Kim Jong Un?' They terminate the call instantly, because it's not worth it to say something negative about that," he told a panel session at the RSA Conference in San Francisco Monday. [..] "One of the things that we've noted is that you'll have a person in Poland applying with a very complicated name," he recounted, "and then when you get them on Zoom calls it's a military age male Asian who can't pronounce it." --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/04/29/north_korea_… ∗∗∗ Interesting WordPress Malware Disguised as Legitimate Anti-Malware Plugin ∗∗∗ --------------------------------------------- The Wordfence Threat Intelligence team recently discovered an interesting malware variant that appears in the file system as a normal WordPress plugin, often with the name ‘WP-antymalwary-bot.php’, and contains several functions that allow attackers to maintain access to your site, hide the plugin from the dashboard, and execute remote code. [..] In today’s blog post, we highlighted an interesting piece of malware that masquerades as a legitimate plugin. --------------------------------------------- https://www.wordfence.com/blog/2025/04/interesting-wordpress-malware-disgui… ∗∗∗ So schützen Sie sich vor den häufigsten Betrugsmaschen auf booking.com ∗∗∗ --------------------------------------------- Der Sommer naht und damit beginnt die Hochsaison für Reisebuchungen. Ob Städtetrip, Strandurlaub oder Bergtour: Viele buchen ihre Unterkunft über die Buchungsplattform booking.com. Doch Vorsicht! Kriminelle nutzen die erhöhte Reiselust aus und versuchen Urlaubsfreudige zu täuschen. Wir zeigen Ihnen die häufigsten Maschen und wie Sie sich davor schützen können. --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-den-haeufi… ∗∗∗ Gremlin Stealer: New Stealer on Sale in Underground Forum ∗∗∗ --------------------------------------------- Advertised on Telegram, Gremlin Stealer is new malware active since March 2025 written in C#. Data stolen is uploaded to a server for publication. [..] We have monitored Gremlin Stealer since we initially discovered it in March 2025. The functions of this stealer from Figure 1 are listed below. --------------------------------------------- https://unit42.paloaltonetworks.com/new-malware-gremlin-stealer-for-sale-on… ∗∗∗ Unlocking New Jailbreaks with AI Explainability ∗∗∗ --------------------------------------------- In this post, we introduce our “Adversarial AI Explainability” research, a term we use to describe the intersection of AI explainability and adversarial attacks on Large Language Models (LLMs). Much like using an MRI to understand how a human brain might be fooled, we aim to decipher how LLMs can be manipulated. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/unlocking-new-jailb… ∗∗∗ Hello 0-Days, My Old Friend: A 2024 Zero-Day Exploitation Analysis ∗∗∗ --------------------------------------------- Google Threat Intelligence Group (GTIG) tracked 75 zero-day vulnerabilities exploited in the wild in 2024, a decrease from the number we identified in 2023 (98 vulnerabilities), but still an increase from 2022 (63 vulnerabilities). [..] We see zero-day exploitation targeting a greater number and wider variety of enterprise-specific technologies, although these technologies still remain a smaller proportion of overall exploitation when compared to end-user technologies. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/2024-zero-day-tren… ∗∗∗ Cybercrime-Marktplatz: Strafverfolger enterten BreachForums über Zero-Day-Lücke ∗∗∗ --------------------------------------------- Derzeit ist der Cybercrime-Marktplatz BreachForums offline. Als Grund nennen die Hintermänner, dass Strafverfolger das Forum über eine Zero-Day-Sicherheitslücke gehackt und sich so Zugriff dazu verschafft haben. --------------------------------------------- https://heise.de/-10365208 ∗∗∗ Spike in Git Config Crawling Highlights Risk of Codebase Exposure ∗∗∗ --------------------------------------------- GreyNoise observed a significant increase in crawling activity targeting Git configuration files. While the crawling itself is reconnaissance, successful discovery of exposed Git configuration files can lead to exposure of internal codebases, developer workflows, and potentially sensitive credentials. --------------------------------------------- https://www.greynoise.io/blog/spike-git-configuration-crawling-risk-codebas… ===================== = Vulnerabilities = ===================== ∗∗∗ Mozilla Foundation Security Advisories April 29, 2025 ∗∗∗ --------------------------------------------- Thunderbird and Firefox --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/ ∗∗∗ Seiko-Epson-Druckertreiber ermöglicht Rechteausweitung auf System ∗∗∗ --------------------------------------------- Die Windows-Druckertreiber von Seiko-Epson reißen eine Sicherheitslücke auf, durch die Angreifer ihre Rechte auf SYSTEM-Ebene ausweiten können. Aktualisierte Software steht bereit, die die zugrundeliegende Schwachstelle ausbessert. --------------------------------------------- https://www.heise.de/news/Seiko-Epson-Druckertreiber-ermoeglicht-Rechteausw… ∗∗∗ Multiple Vulnerabilities in HP Wolf Security Controller / HP Sure Access Enterprise / HP Sure Click Enterprise ∗∗∗ --------------------------------------------- The HP Wolf Security Controller, the HP Sure Access Enterprise Client and the HP Sure Click Enterprise Client might be vulnerable to attacks if not configured according to HP's Best Practices. --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (glibc, php:8.1, and thunderbird), Debian (libreoffice), Fedora (caddy), Mageia (chromium-browser-stable), Red Hat (php:8.1), SUSE (glow), and Ubuntu (kicad, linux-aws-5.15, linux-azure-nvidia, linux-gcp-5.15, mistral, python-mistral-lib, tomcat8, and trafficserver). --------------------------------------------- https://lwn.net/Articles/1019272/ ∗∗∗ Docker: Rechteausweitungslücke in Desktop für Windows ∗∗∗ --------------------------------------------- In den Release-Notes schreiben die Docker-Entwickler, dass die Version 4.41.0 eine Sicherheitslücke schließt, die Angreifern mit Zugriff auf die Maschine die Ausweitung der Zugriffsrechte ermöglicht, wenn Docker Desktop Updates installiert (CVE-2025-3224, CVSS 7.3, Risiko "hoch"). --------------------------------------------- https://heise.de/-10366320 ∗∗∗ Daikin Security Gateway v214 Remote Password Reset ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5931.php ∗∗∗ ABB: 2025-04-29: Cyber Security Advisory - Ekip Com IEC61850 Vulnerability in third-party library ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2CRT000007&Language… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.04.2025
by Daily end-of-shift report 28 Apr '25

28 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 25-04-2025 18:00 − Montag 28-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ SAP patcht attackierte, kritische Schwachstelle außer der Reihe ∗∗∗ --------------------------------------------- Update 25.04.2025, 22:11 Uhr: Kriminelle missbauchen die Schwachstelle bereits im Internet. Details zu den Angriffen finden sich etwa bei Onapsis in einem Blog-Beitrag. Admins sollten schnellstmöglich aktualisieren, zumal offenbar viele SAP-Neatweaver-Installationen die verwundbare Komponente einsetzen, so die Einschätzung der IT-Sicherheitsforscher in der Analyse im Blog. --------------------------------------------- https://heise.de/-10361908 ∗∗∗ DragonForce expands ransomware model with white-label branding scheme ∗∗∗ --------------------------------------------- The ransomware scene is re-organizing [..] DragonForce is now incentivizing ransomware actors with a distributed affiliate branding model, providing other ransomware-as-a-service (RaaS) operations a means to carry out their business without dealing with infrastructure maintenance cost and effort. A group's representative told BleepingComputer that they’re purely financially motivated but also follow a moral compass and are against attacking certain healthcare organizations. [..] In exchange for using their malware and infrastructure, the developer charges affiliates a fee from received ransoms that is normally up to 30%. --------------------------------------------- https://www.bleepingcomputer.com/news/security/dragonforce-expands-ransomwa… ∗∗∗ Cloudflare mitigates record number of DDoS attacks in 2025 ∗∗∗ --------------------------------------------- Internet services giant Cloudflare says it mitigated a record number of DDoS attacks in 2024, recording a massive 358% year-over-year jump and a 198% quarter-over-quarter increase. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cloudflare-mitigates-record-… ∗∗∗ VU#667211: Various GPT services are vulnerable to "Inception" jailbreak, allows for bypass of safety guardrails ∗∗∗ --------------------------------------------- Two systemic jailbreaks, affecting a number of generative AI services, were discovered. These jailbreaks can result in the bypass of safety protocols and allow an attacker to instruct the corresponding LLM to provide illicit or dangerous content. [..] These jailbreaks, while of low severity on their own, bypass the security and safety guidelines of all affected AI services, allowing an attacker to abuse them for instructions to create content on various illicit topics, such as controlled substances, weapons, phishing emails, and malware code generation. --------------------------------------------- https://kb.cert.org/vuls/id/667211 ∗∗∗ Storm-1977 Hits Education Clouds with AzureChecker, Deploys 200+ Crypto Mining Containers ∗∗∗ --------------------------------------------- Microsoft has revealed that a threat actor it tracks as Storm-1977 has conducted password spraying attacks against cloud tenants in the education sector over the past year. --------------------------------------------- https://thehackernews.com/2025/04/storm-1977-hits-education-clouds-with.html ∗∗∗ Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised ∗∗∗ --------------------------------------------- Threat actors have been observed exploiting two newly disclosed critical security flaws in Craft CMS in zero-day attacks to breach servers and gain unauthorized access. [..] As of April 18, 2025, an estimated 13,000 vulnerable Craft CMS instances have been identified, out of which nearly 300 have been allegedly compromised. --------------------------------------------- https://thehackernews.com/2025/04/hackers-exploit-critical-craft-cms.html ∗∗∗ WooCommerce Users Targeted by Fake Patch Phishing Campaign Deploying Site Backdoors ∗∗∗ --------------------------------------------- Cybersecurity researchers are warning about a large-scale phishing campaign targeting WooCommerce users with a fake security alert urging them to download a "critical patch" but deploy a backdoor instead. --------------------------------------------- https://thehackernews.com/2025/04/woocommerce-users-targeted-by-fake.html ∗∗∗ Samsung: Android-Zwischenablage speichert Passwörter zwischen ∗∗∗ --------------------------------------------- Samsungs Android-Smartphones speichern in der Zwischenablage kopierte Inhalte. Im Zwischenablageverlauf finden sich gelegentlich auch alte, kopierte Passwörter. Samsung evaluiert das Problem derzeit. --------------------------------------------- https://heise.de/-10363941 ∗∗∗ Navigating Through The Fog ∗∗∗ --------------------------------------------- An open directory associated with a ransomware affiliate, likely linked to the Fog ransomware group, was discovered in December 2024. [..] Among the tools were SonicWall Scanner for exploiting VPN credentials, DonPAPI for extracting Windows DPAPI-protected credentials, Certipy for abusing Active Directory Certificate Services (AD CS), Zer0dump, and Pachine/noPac for exploiting Active Directory vulnerabilities like CVE-2020-1472. --------------------------------------------- https://thedfirreport.com/2025/04/28/navigating-through-the-fog/ ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Unbefugte Zugriffe auf VMware Spring Boot möglich ∗∗∗ --------------------------------------------- Softwareentwickler nutzen Spring Boot zum effizienteren Erstellen von Java-Applikationen. Damit Angreifer an der Lücke (CVE-2025-22235 „hoch“) ansetzen zu können, müssen aber mehrere Voraussetzungen erfüllt sein. Unter anderem muss Spring Security eingesetzt werden und mit EndpointRequest.to () konfiguriert sein. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdate-Unbefugte-Zugriffe-auf-VMware-T… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (thunderbird), Debian (distro-info-data, imagemagick, kernel, libsoup2.4, and poppler), Fedora (chromium, java-1.8.0-openjdk, java-1.8.0-openjdk-portable, java-17-openjdk, java-17-openjdk-portable, java-latest-openjdk, pgadmin4, thunderbird, and xz), Mageia (haproxy and libxml2), Oracle (bluez, firefox, gnutls, libtasn1, libxslt, mod_auth_openidc:2.3, ruby:3.1, thunderbird, and xmlrpc-c), Red Hat (delve and golang, glibc, mod_auth_openidc, mod_auth_openidc:2.3, and thunderbird), SUSE (augeas, chromedriver, cifs-utils, govulncheck-vulndb, java-11-openjdk, java-21-openjdk, kyverno, libraw, opentofu, runc, subfinder, and valkey), and Ubuntu (jupyter-notebook and libxml2). --------------------------------------------- https://lwn.net/Articles/1019212/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.04.2025
by Daily end-of-shift report 25 Apr '25

25 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 24-04-2025 18:00 − Freitag 25-04-2025 18:00 Handler: Felician Fuchs Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Triada strikes back ∗∗∗ --------------------------------------------- Kaspersky expert has discovered a new version of the Triada Trojan, with custom modules for Telegram, WhatsApp, TikTok, and other apps. --------------------------------------------- https://securelist.com/triada-trojan-modules-analysis/116380 ∗∗∗ Example of a Payload Delivered Through Steganography, (Fri, Apr 25th) ∗∗∗ --------------------------------------------- In this diary, Ill show you a practical example of how steganography is used to hide payloads (or other suspicious data) from security tools and Security Analysts eyes. Steganography can be defined like this: It is the art and science of concealing a secret message, file, or image within an ordinary-looking carrier - such as a digital photograph, audio clip, or text - so that the very existence of the hidden data is undetectable to casual observers. --------------------------------------------- https://isc.sans.edu/diary/rss/31892 ∗∗∗ Zoom attack tricks victims into allowing remote access to install malware and steal money ∗∗∗ --------------------------------------------- Attackers are luring victims into a Zoom call and then taking over their PC to install malware, infiltrate their accounts, and steal their assets. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/04/zoom-attack-tricks-victims-i… ∗∗∗ GitHub potential leaking of private emails and Hacker One ∗∗∗ --------------------------------------------- A bit over a month ago, I was crawling GitHub’s API while working on code input (—it is still in beta). I was compiling a list of repositories and pull requests to identify those with merge conflicts. At some point, while randomly checking some user profiles, I noticed email addresses appearing in the API that weren’t visible on the public profiles. --------------------------------------------- https://omarabid.com/hacker-one ∗∗∗ How I Got Hacked: A Warning about Malicious PoCs ∗∗∗ --------------------------------------------- This is a reminder that even experienced security researchers and exploit developers can fall victim to well-disguised malware. Always verify PoCs manually, isolate them in a controlled environment, and never underestimate how creative attackers can be when hiding malicious payloads. --------------------------------------------- https://chocapikk.com/posts/2025/s1nk/ ∗∗∗ Step-by-Step Guide: SOC Automation — SMB Threat Hunting & Incident Response Lab ∗∗∗ --------------------------------------------- In this project, I will simulate a similar attack scenario in which an insider compromises a Windows server by delivering malware through the SMB protocol. By leveraging automation and the incident response lifecycle, the goal is to detect and contain the threat before it spreads, demonstrating best practices in threat detection and response. --------------------------------------------- https://detect.fyi/step-by-step-guide-soc-automation-smb-threat-hunting-inc… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Nvidia-Grafikkartentreiber unter Linux und Windows löchrig ∗∗∗ --------------------------------------------- Besitzer einer Nvidia-Grafikkarte sollten zeitnah den GPU-Treiber aus Sicherheitsgründen auf den aktuellen Stand bringen. Geschieht das nicht, können Angreifer unter Linux an mehreren Schwachstellen ansetzen und Computer attackieren. Außerdem gibt es noch abgesicherte Versionen von Cloud Gaming und vGPU-Software unter Windows. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Nvidia-Grafikkartentreiber-unt… ∗∗∗ Connectwise Screenconnect: Hochriskante Codeschmuggel-Lücke ∗∗∗ --------------------------------------------- Die Remote-Desktop-Software Screenconnect von Connectwise enthält eine Sicherheitslücke, die Angreifern das Einschleusen und Ausführen von Schadcode ermöglicht. Der Hersteller bietet Software-Updates zum Schließen des Sicherheitslecks an. --------------------------------------------- https://www.heise.de/news/Connectwise-Screenconnect-Hochriskante-Codeschmug… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (thunderbird), Debian (libbpf), Fedora (golang-github-openprinting-ipp-usb, ImageMagick, mingw-libsoup, mingw-poppler, and pgbouncer), SUSE (glib2, govulncheck-vulndb, libsoup-2_4-1, libxml2-2, mozjs60, ruby2.5, and thunderbird), and Ubuntu (linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-hwe-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4, linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-iot, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-hwe-6.8, linux-ibm-5.4, linux-oracle-5.15, openssh, and php-twig). --------------------------------------------- https://lwn.net/Articles/1018912/ ∗∗∗ CISA Releases Seven Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released seven Industrial Control Systems (ICS) advisories on April 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS, including Schneider Electric Modicon Controllers, ALBEDO Telecom Net.Time - PTP/NTP Clock, Vestel AC Charger, Nice Linear eMerge E3, Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool, Planet Technology Network Products, and Fuji Electric Monitouch V-SFT (Update A). CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/04/24/cisa-releases-seven-indu… ∗∗∗ Hacking My Coworker (In Minecraft) ∗∗∗ --------------------------------------------- Integrated Scripting is included in several of the largest modpacks on CurseForge. It has 3.5 million downloads, which also doesn’t include non CurseForge hosted downloads such as for Feed the Beast modpacks. Through the presented vulnerability, any public or semi public multiplayer server that includes Integrated Scripting is vulnerable to remote code execution by a player who is able to craft a few relatively simple items. --------------------------------------------- https://redvice.org/assets/pdfs/minecraft2025.pdf ∗∗∗ Critical SAP NetWeaver Vulnerability (CVE-2025-31324) Fixed: Actively Exploited in the Wild ∗∗∗ --------------------------------------------- SAP has recently released a critical security patch for a severe vulnerability in SAP NetWeaver Visual Composer that has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-31324, was patched just hours ago with the release of SAP Security Note 3594142. --------------------------------------------- https://redrays.io/blog/critical-sap-netweaver-vulnerability-cve-2025-31324… ∗∗∗ ZDI-25-252: (0Day) Cato Networks Cato Client for macOS Helper Service Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-252/ ∗∗∗ Three new vulnerabilities found related to IXON VPN client resulting in Local Privilege Escalation (LPE) ∗∗∗ --------------------------------------------- https://www.shelltrail.com/research/three-new-cves-related-to-ixon-vpn-clie… ∗∗∗ Bosch: Multiple ctrlX OS vulnerabilities ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-640452.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.04.2025
by Daily end-of-shift report 24 Apr '25

24 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 23-04-2025 18:00 − Donnerstag 24-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Linux io_uring security blindspot allows stealthy rootkit attacks ∗∗∗ --------------------------------------------- A significant security gap in Linux runtime security caused by the io_uring interface allows rootkits to operate undetected on systems while bypassing advanced Enterprise security software. --------------------------------------------- https://www.bleepingcomputer.com/news/security/linux-io-uring-security-blin… ∗∗∗ Darcula Adds GenAI to Phishing Toolkit, Lowering the Barrier for Cybercriminals ∗∗∗ --------------------------------------------- The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform have released new updates to their cybercrime suite with generative artificial intelligence (GenAI) capabilities. "This addition lowers the technical barrier for creating phishing pages, enabling less tech-savvy criminals to deploy customized scams in minutes," Netcraft said in a new report shared with The Hacker News." --------------------------------------------- https://thehackernews.com/2025/04/darcula-adds-genai-to-phishing-toolkit.ht… ∗∗∗ Erlang/OTP SSH: Namhafte Hersteller von kritischer Lücke betroffen ∗∗∗ --------------------------------------------- Erlang/OTP SSH wird von vielen namhaften Herstellern mitgeliefert. Daher betrifft eine kritische Lücke auch Cisco und Ericsson. Zu den weiteren verwundbaren Anbietern gehört nach jetzigem Stand EMQ Technologies. Nicht standardmäßig installiert, aber optional verfügbar ist Erlang/OTP SSH bei National Instruments, Broadcom (insbesondere RabbitMQ), Very Technology, Apache (CouchDB) und Riak Technologies. Hier müssen Admins prüfen, ob sie Erlang/OTP SSH installiert haben und gegebenenfalls die verfügbaren Aktualisierungen installieren. --------------------------------------------- https://www.heise.de/news/Erlang-OTP-SSH-Namhafte-Hersteller-von-kritischer… ∗∗∗ 9X Surge in Ivanti Connect Secure Scanning Activity ∗∗∗ --------------------------------------------- GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation. --------------------------------------------- https://www.greynoise.io/blog/surge-ivanti-connect-secure-scanning-activity ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Commvault Command Center Flaw Enables Attackers to Execute Code Remotely ∗∗∗ --------------------------------------------- A critical security flaw has been disclosed in the Commvault Command Center that could allow arbitrary code execution on affected installations. The vulnerability, tracked as CVE-2025-34028, carries a CVSS score of 9.0 out of a maximum of 10.0. --------------------------------------------- https://thehackernews.com/2025/04/critical-commvault-command-center-flaw.ht… ∗∗∗ Drupal: Security advisories ∗∗∗ --------------------------------------------- Drupal has released new security advisories. --------------------------------------------- https://www.drupal.org/security ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (haproxy and openrazer), Fedora (c-ares and mingw-poppler), Red Hat (thunderbird), SUSE (epiphany, ffmpeg-6, gopass, and libsoup-3_0-0), and Ubuntu (erlang, haproxy, libapache2-mod-auth-openidc, libarchive, linux, linux-aws, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oracle, linux-raspi, linux, linux-aws, linux-azure, linux-azure-6.8, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle, linux-oracle-6.8, linux-aws-6.8, linux-aws-fips, linux-fips, linux-gcp-fips, linux-azure-fips, linux-gcp, linux-gke, linux-gkeop, linux-gcp-6.8, linux-ibm-5.15, linux-intel-iot-realtime, linux-realtime, linux-intel-iotg-5.15, linux-realtime, perl, and yelp, yelp-xsl). --------------------------------------------- https://lwn.net/Articles/1018717/ ∗∗∗ ZDI-25-250: (0Day) Cloudera Hue Ace Editor Directory Traversal Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-250/ ∗∗∗ ZDI-25-249: (0Day) eCharge Hardy Barth cPH2 index.php Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-249/ ∗∗∗ ZDI-25-248: (0Day) eCharge Hardy Barth cPH2 nwcheckexec.php dest Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-248/ ∗∗∗ ZDI-25-247: (0Day) eCharge Hardy Barth cPH2 check_req.php ntp Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-247/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (April 14, 2025 to April 20, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/04/wordfence-intelligence-weekly-wordpr… ∗∗∗ ALBEDO Telecom Net.Time - PTP/NTP Clock ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-02 ∗∗∗ Sonicwall warnt vor DoS-Lücke in SSLVPN ∗∗∗ --------------------------------------------- https://heise.de/-10360960 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.04.2025
by Daily end-of-shift report 23 Apr '25

23 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 22-04-2025 18:00 − Mittwoch 23-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Alternativen aus Europa: Wie man von US-Software unabhängig wird ∗∗∗ --------------------------------------------- Ein Wiener Softwareentwickler sammelt "European Alternatives" zu US-Digitalprodukten. Seit Trumps 2. Amtsantritt ist das Interesse stark gestiegen. --------------------------------------------- https://futurezone.at/netzpolitik/tech-alternativen-apps-europa-datenschutz… ∗∗∗ Kurz nach Offenlegung: ChatGPT und Claude liefern Exploit für kritische SSH-Lücke ∗∗∗ --------------------------------------------- In einem verbreiteten SSH-Tool klafft eine gefährliche Lücke. Nur Stunden nach Bekanntwerden erstellt ein Forscher mittels KI einen funktionierenden Exploit. --------------------------------------------- https://www.golem.de/news/kurz-nach-offenlegung-chatgpt-und-claude-liefern-… ∗∗∗ Android Spyware Disguised as Alpine Quest App Targets Russian Military Devices ∗∗∗ --------------------------------------------- Cybersecurity researchers have revealed that Russian military personnel are the target of a new malicious campaign that distributes Android spyware under the guise of the Alpine Quest mapping software. "The attackers hide this trojan inside modified Alpine Quest mapping software and distribute it in various ways, including through one of the Russian Android app catalogs," Doctor Web said in an analysis. --------------------------------------------- https://thehackernews.com/2025/04/android-spyware-disguised-as-alpine.html ∗∗∗ CVE-2025-3248: RCE vulnerability in Langflow ∗∗∗ --------------------------------------------- CVE-2025-3248, a critical remote code execution (RCE) vulnerability with a CVSS score of 9.8, has been discovered in Langflow, an open-source platform for visually composing AI-driven agents and workflows. [..] All Langflow versions prior to 1.3.0 are susceptible to code injection. [..] Exploiting CVE-2025-3248 involves the following steps: --------------------------------------------- https://www.zscaler.com/blogs/security-research/cve-2025-3248-rce-vulnerabi… ∗∗∗ Die Urlaubsplanung steht an? Vorsicht vor Betrug mit Fake-Buchungsportalen! ∗∗∗ --------------------------------------------- Wo soll es im Sommerurlaub hingehen? Wie wäre es mit einer Miet-Finca auf den Kanaren? Dann ist bei der Buchung Vorsicht angebracht! Kriminelle erstellen Fake-Portale und bieten dort vermeintlich reale Luxus-Mietobjekte an. Wer sich auf den Deal einlässt und den gewünschten Betrag überweist, ist in die Falle getappt. Die Unterkunft existiert nicht, das Geld ist weg. --------------------------------------------- https://www.watchlist-internet.at/news/villen-fincas-fake-buchungsportal/ ∗∗∗ Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows ∗∗∗ --------------------------------------------- Since early March 2025, Volexity has observed multiple Russian threat actors aggressively targeting individuals and organizations with ties to Ukraine and human rights. These recent attacks use a new technique aimed at abusing legitimate Microsoft OAuth 2.0 Authentication workflows. The attackers are impersonating officials from various European nations, and in one instance leveraged a compromised Ukrainian Government account. --------------------------------------------- https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-… ∗∗∗ Distribution of PebbleDash Malware in March 2025 ∗∗∗ --------------------------------------------- PebbleDash is a backdoor malware that was previously identified by the Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. as a backdoor malware of Lazarus (Hidden Corba) in 2020. --------------------------------------------- https://asec.ahnlab.com/en/87621/ ∗∗∗ Introducing ToyMaker, an Initial Access Broker working in cahoots with double extortion gangs ∗∗∗ --------------------------------------------- Cisco Talos discovered a sophisticated attack on critical infrastructure by ToyMaker and Cactus, using the LAGTOY backdoor to orchestrate a relentless double extortion scheme. --------------------------------------------- https://blog.talosintelligence.com/introducing-toymaker-an-initial-access-b… ===================== = Vulnerabilities = ===================== ∗∗∗ ASUS releases fix for AMI bug that lets hackers brick servers ∗∗∗ --------------------------------------------- ASUS has released security updates to address CVE-2024-54085, a maximum severity flaw that could allow attackers to hijack and potentially brick servers. [..] The flaw impacts American Megatrends International's MegaRAC Baseboard Management Controller (BMC) software, used by over a dozen server hardware vendors, including HPE, ASUS, and ASRock. The CVE-2024-54085 flaw is remotely exploitable, potentially leading to malware infections, firmware modifications, and irreversible physical damage through over-volting. --------------------------------------------- https://www.bleepingcomputer.com/news/security/asus-releases-fix-for-ami-bu… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (bluez, expat, and postgresql:12), Fedora (chromium, golang, LibRaw, moodle, openiked, ruby, and trafficserver), Red Hat (bluez, expat, gnutls, libtasn1, libxslt, mod_auth_openidc, mod_auth_openidc:2.3, ruby:3.1, thunderbird, and xmlrpc-c), and Ubuntu (linux, linux-aws, linux-gcp, linux-hwe-6.11, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-oem-6.11, linux-oracle, linux-raspi, linux-realtime, linux-azure, linux-azure-6.11, linux-gcp-6.8, and matrix-synapse). --------------------------------------------- https://lwn.net/Articles/1018589/ ∗∗∗ CISA Releases Five Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-25-112-01 Siemens TeleControl Server Basic SQL, ICSA-25-112-02 Siemens TeleControl Server Basic, ICSA-25-112-03 Schneider Electric Wiser Home Controller WHC-5918A, ICSA-25-112-04 ABB MV Drives, ICSA-25-035-04 Schneider Electric Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC (Update A) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/04/22/cisa-releases-five-indus… ∗∗∗ Cisco: Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.04.2025
by Daily end-of-shift report 22 Apr '25

22 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 18-04-2025 18:00 − Dienstag 22-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ DOGE, CISA, Mitre und CVE ∗∗∗ --------------------------------------------- In der Cybersecurity Community herrschte letzte Woche helle Aufregung, weil die Einsparungstruppe von Trumps Gnaden die grandiose Idee hatte, das Funding für den Betrieb des CVE-Systems durch Mitre einzustellen. Wahrscheinlich aufgrund des starken Gegenwindes von der Seite der US-Industrie wurde eine Lösung gefunden und der Betrieb ist (angeblich) für die nächsten 11 Monate gesichert. Ich will das zum Anlass nehmen, das System hinter den bekannten CVE-Nummern zu erklären und mögliche Entwicklungen aufzuzeigen. --------------------------------------------- https://www.cert.at/de/blog/2025/4/doge-cisa-mitre-und-cve ∗∗∗ Phishers abuse Google OAuth to spoof Google in DKIM replay attack ∗∗∗ --------------------------------------------- In a rather clever attack, hackers leveraged a weakness that allowed them to send a fake email that seemed delivered from Googles systems, passing all verifications but pointing to a fraudulent page that collected logins. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishers-abuse-google-oauth-… ∗∗∗ Phishing attacks leveraging HTML code inside SVG files ∗∗∗ --------------------------------------------- The SVG format provides the capability to embed HTML and JavaScript code within images, which is misused by attackers. Despite not being widespread at the time of this study, SVG attachment attacks are showing a clear upward trend. --------------------------------------------- https://securelist.com/svg-phishing/116256/ ∗∗∗ Videokameras: Schwere Sicherheitslücke bei Überwachungsgeräten der Polizei ∗∗∗ --------------------------------------------- Polizeibehörden in zahlreichen Ländern nutzen mobile Sender der Firma Infodraw. Doch die hochgeladenen Daten sind nicht ausreichend gesichert. [..] Über das Bundesamt für Sicherheit in der Informationstechnik (BSI) wurden laut Schäfers inzwischen in Deutschland alle übrigen Betreiber gewarnt. [..] Ihm zufolge reicht es nicht aus, die aktuelle Softwareversion 7.1.0.0 installiert zu haben. Wobei aktuell relativ ist, denn die Version stammt aus dem Jahr 2000. Schäfers empfiehlt den nutzenden Organisationen, die Anwendung unmittelbar offline zu nehmen. --------------------------------------------- https://www.golem.de/news/videokameras-schwere-sicherheitsluecke-bei-ueberw… ∗∗∗ Agent In the Middle – Abusing Agent Cards in the Agent-2-Agent (A2A) Protocol To ‘Win’ All the Tasks ∗∗∗ --------------------------------------------- I’ll write a blog post on prompt injection defenses and how I am able to circumvent them another time… the blog post today is about one of those advancements: the Agent-2-Agent (A2A) Protocol. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/agent-in-th… ∗∗∗ Microsoft Secures MSA Signing with Azure Confidential VMs Following Storm-0558 Breach ∗∗∗ --------------------------------------------- Microsoft on Monday announced that it has moved the Microsoft Account (MSA) signing service to Azure confidential virtual machines (VMs) and that it's also in the process of migrating the Entra ID signing service as well. The disclosure comes about seven months after the tech giant said it completed updates to Microsoft Entra ID and MS for both public and United States government clouds to generate, store, and automatically rotate access token signing keys using the Azure Managed Hardware Security Module (HSM) service. --------------------------------------------- https://thehackernews.com/2025/04/microsoft-secures-msa-signing-with.html ∗∗∗ Anspruch auf Kostenerstattung? Vorsicht vor neuer ÖGK-Betrugsmasche ∗∗∗ --------------------------------------------- Neue Website, alte Masche. Kriminelle haben eine weitere Betrugswelle im Namen der Österreichischen Gesundheitskasse gestartet. Sie locken mit einer hohen Rückzahlung und setzen auf eine beinahe 1:1-Kopie der originalen ÖGK-Website. So können Sie den Fake dennoch erkennen. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-neue-oegk-betrugsmasche/ ∗∗∗ Ivanti Endpoint Manager_Local Privilege Escalation via DLL Search Order Hijacking ∗∗∗ --------------------------------------------- The Ivanti Endpoint Manager Security Scan (Vulscan) Self Update was vulnerable to DLL Hijacking. 2025-04-08 Vendor publishes security advisory. 2025-04-22 Coordinated disclosure of security advisory. CVE Number CVE-2025-22458 --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/mehrere-schwachstelle… ∗∗∗ Microsoft’s patch for CVE-2025–21204 symlink vulnerability introduces another symlink vulnerability ∗∗∗ --------------------------------------------- Microsoft recently patched CVE-2025–21204, a vuln which allows users to abuse symlinks to elevate privileges using the Windows servicing stack and the c:\inetpub folder. [..] However, I’ve discovered this fix introduces a denial of service vulnerability in the Windows servicing stack that allows non-admin users to stop all future Windows security updates. [..] I reported this to MSRC about two weeks ago, but haven’t had a response. --------------------------------------------- https://doublepulsar.com/microsofts-patch-for-cve-2025-21204-symlink-vulner… ∗∗∗ Zugangs- und Schließsysteme mit Internetanbindung als Risiko – Teil 1 ∗∗∗ --------------------------------------------- Heute noch ein kleiner, zweiteiliger Sammelbeitrag, in dem ich auf die Risiken eingehe, welche Schließsysteme bzw. Systeme zur Zugangskontrolle sowie zur Zeiterfassung unter Umständen bieten. --------------------------------------------- https://www.borncity.com/blog/2025/04/20/risiko-zeiterfassungs-zugangs-und-… ∗∗∗ Systeme zur Zeiterfassung mit Internetanbindung als Risiko – Teil 2 ∗∗∗ --------------------------------------------- In Teil 1 des zweiteiligen Sammelbeitrags hatte ich auf die Risiken hingewiesen, die von elektronischen Schließsystemen bzw. Systemen zur Zugangskontrolle ausgehen können, wenn diese am Internet hängen. Aber auch Systeme zur Zeiterfassung, die per Internet erreichbar sind, fallen in diese Kategorie, sofern Dienstleister diese allzu sorglos eingerichtet haben. --------------------------------------------- https://www.borncity.com/blog/2025/04/21/systeme-zur-zeiterfassung-mit-inte… ===================== = Vulnerabilities = ===================== ∗∗∗ Asus-Router: Sicherheitslücke ermöglicht unbefugtes Ausführen von Funktionen ∗∗∗ --------------------------------------------- Im CVE-Eintrag zur Schwachstelle erörtert Asus, dass in der AiCloud eine unzureichende Authentifizierungskontrolle stattfinde. Diese lasse sich durch manipulierte Anfragen missbrauchen, um ohne Autorisierung Funktionen auszuführen (CVE-2025-2492, CVSS 9.2, Risiko "kritisch"). [..] In der Sicherheitsmitteilung schreibt Asus lediglich, dass die Entwickler aktualisierte Firmware für die Serien 3.0.0.4_382, 3.0.0.4_386, 3.0.0.4_388 und 3.0.0.6_102 veröffentlicht hat. Die soll die Schwachstelle ausbessern. --------------------------------------------- https://www.heise.de/news/Asus-Router-Sicherheitsluecke-ermoeglicht-unbefug… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (erlang, fig2dev, shadow, wget, and zabbix), Fedora (chromium, jupyterlab, llama-cpp, prometheus-podman-exporter, python-notebook, python-pydantic-core, rpki-client, rust-adblock, rust-cookie_store, rust-gitui, rust-gstreamer, rust-icu_collections, rust-icu_locid, rust-icu_locid_transform, rust-icu_locid_transform_data, rust-icu_normalizer, rust-icu_normalizer_data, rust-icu_properties, rust-icu_properties_data, rust-icu_provider, rust-icu_provider_macros, rust-idna, rust-idna_adapter, rust-litemap, rust-ron, rust-sequoia-openpgp, rust-sequoia-openpgp1, rust-tinystr, rust-url, rust-utf16_iter, rust-version-ranges, rust-write16, rust-writeable, rust-zerovec, rust-zip, uv, and webkitgtk), Slackware (libxml2 and zsh), SUSE (argocd-cli, chromium, coredns, ffmpeg-6, and firefox), and Ubuntu (imagemagick). --------------------------------------------- https://lwn.net/Articles/1018292/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (java-1.8.0-openjdk, kernel, libxslt, mod_auth_openidc:2.3, and webkit2gtk3), Fedora (c-ares, giflib, jupyterlab, perl, perl-Devel-Cover, perl-PAR-Packer, prometheus-podman-exporter, python-notebook, python-pydantic-core, rpki-client, ruby, rust-adblock, rust-cookie_store, rust-gitui, rust-gstreamer, rust-icu_collections, rust-icu_locid, rust-icu_locid_transform, rust-icu_locid_transform_data, rust-icu_normalizer, rust-icu_normalizer_data, rust-icu_properties, rust-icu_properties_data, rust-icu_provider, rust-icu_provider_macros, rust-idna, rust-idna_adapter, rust-litemap, rust-ron, rust-sequoia-openpgp, rust-sequoia-openpgp1, rust-tinystr, rust-url, rust-utf16_iter, rust-version-ranges, rust-write16, rust-writeable, rust-zerovec, rust-zip, thunderbird, and uv), SUSE (erlang, erlang26, and govulncheck-vulndb), and Ubuntu (mosquitto). --------------------------------------------- https://lwn.net/Articles/1018444/ ∗∗∗ Zyxel security advisory for incorrect permission assignment and improper privilege management vulnerabilities in USG FLEX H series firewalls ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ Wordpress: Angreifer können über Greenshift-Plug-in Schadcode hochladen ∗∗∗ --------------------------------------------- https://heise.de/-10357624 ∗∗∗ SicommNet BASEC product warning ∗∗∗ --------------------------------------------- https://csirt.divd.nl/2025/04/14/SicommNet-Basec-product-warning/ ∗∗∗ Tenable: [R1] Stand-alone Security Patch Available for Tenable Security Center version 6.5.1: SC-202504.3 ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-06 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.04.2025
by Daily end-of-shift report 18 Apr '25

18 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 17-04-2025 18:00 − Freitag 18-04-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Chrome extensions with 6 million installs have hidden tracking code ∗∗∗ --------------------------------------------- A set of 57 Chrome extensions with 6,000,000 users have been discovered with very risky capabilities, such as monitoring browsing behavior, accessing cookies for domains, and potentially executing remote scripts. [..] Earlier today, the researcher added 22 more extensions believed to belong to the same operation, taking the total to 57 extensions used by 6 million people. Some of the newly added extensions are public, too. Tuckner says that many of the extensions have been removed from the Chrome Web Store following his report from last week, but others still remain. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chrome-extensions-with-6-mil… ∗∗∗ Windows NTLM hash leak flaw exploited in phishing attacks on governments ∗∗∗ --------------------------------------------- A Windows vulnerability that exposes NTLM hashes using .library-ms files is now actively exploited by hackers in phishing campaigns targeting government entities and private companies. The flaw tracked as CVE-2025-24054 was fixed in Microsoft's March 2025 Patch Tuesday. Initially, it was not marked as actively exploited and was assessed as 'less likely' to be. [..] In a later campaign, Check Point discovered phishing emails that contained .library-ms attachments, without an archive. Simply downloading the .library-ms file was enough to trigger NTLM authentication to the remote server, demonstrating that archives were not required to exploit the flaw. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-ntlm-hash-leak-flaw-… ∗∗∗ Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader ∗∗∗ --------------------------------------------- A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader. "Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution," Palo Alto Networks Unit 42 researcher Saqib Khanzada said in a technical write-up of the campaign. --------------------------------------------- https://thehackernews.com/2025/04/multi-stage-malware-attack-uses-jse-and.h… ∗∗∗ Nebula – Autonomous AI Pentesting Tool ∗∗∗ --------------------------------------------- Another cutting-edge tool from 2024 is Nebula, an open-source AI-powered penetration testing assistant. If PentestGPT is like an AI advisor, Nebula attempts to automate parts of the pentest process itself. --------------------------------------------- https://www.darknet.org.uk/2025/04/nebula-autonomous-ai-pentesting-tool/ ∗∗∗ Cross-Site WebSocket Hijacking Exploitation in 2025 ∗∗∗ --------------------------------------------- The post includes a few brief case studies based on situations encountered during real world testing, in addition to a simple test site that can be hosted by readers to explore each of the vulnerability conditions. --------------------------------------------- https://blog.includesecurity.com/2025/04/cross-site-websocket-hijacking-exp… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (graphicsmagick and libapache2-mod-auth-openidc), Fedora (giflib, mod_auth_openidc, mysql8.0, perl, perl-Devel-Cover, perl-PAR-Packer, perl-String-Compare-ConstantTime, rust-openssl, rust-openssl-sys, trunk, and workrave), Mageia (chromium-browser-stable and rust), Oracle (java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, kernel, libreoffice, and webkit2gtk3), Red Hat (gvisor-tap-vsock), SUSE (containerd, docker, docker-stable, forgejo, GraphicsMagick, libmozjs-115-0, perl-32bit, poppler, subfinder, and thunderbird), and Ubuntu (erlang and ruby2.3, ruby2.5). --------------------------------------------- https://lwn.net/Articles/1018020/ ∗∗∗ [R1] Nessus Version 10.8.4 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-05 ∗∗∗ Yokogawa Recorder Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.04.2025
by Daily end-of-shift report 17 Apr '25

17 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 16-04-2025 18:00 − Donnerstag 17-04-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ MITRE CVE Program - the past, the present .. and the (European) future. ∗∗∗ --------------------------------------------- The Common Vulnerabilities and Exposures (CVE) program is a globally adopted system for identifying and naming cybersecurity vulnerabilities with unique IDs. Established in 1999 by researchers at the MITRE Corporation (a U.S. non-profit R&D organization), CVE was created to ensure that different security tools and stakeholders can refer to the same vulnerability in a consistent way. --------------------------------------------- https://bytesandborscht.com/mitre-cve-program-the-past-the-present-and-the-… ∗∗∗ RedTail, Remnux and Malware Management [Guest Diary], (Wed, Apr 16th) ∗∗∗ --------------------------------------------- When I first saw malware being uploaded to my honeypot, I was lacking the requisite experience to reverse engineer it, and to understand what was happening with the code. Even though I could use any text editor to examine the associated scripts that were being uploaded with RedTail malware, I couldn’t see what was happening with the redtail malware itself. So, I decided to create a how-to on setting up a malware analysis program. --------------------------------------------- https://isc.sans.edu/diary/rss/31868 ∗∗∗ Proton66 Part 2: Compromised WordPress Pages and Malware Campaigns ∗∗∗ --------------------------------------------- Earlier this year SpiderLabs observed an increase in mass scanning, credential brute forcing, and exploitation attempts originating from Proton66 ASN targeting organizations worldwide that we are discussing in a two-part series. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/proton66-pa… ∗∗∗ Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler ∗∗∗ --------------------------------------------- Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities. --------------------------------------------- https://thehackernews.com/2025/04/experts-uncover-four-new-privilege.html ∗∗∗ CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2021-20035 (CVSS score: 7.2), relates to a case of operating system command injection that could result in code execution. --------------------------------------------- https://thehackernews.com/2025/04/cisa-flags-actively-exploited.html ∗∗∗ Support-Ende von Ubuntu 20.04 dräut ∗∗∗ --------------------------------------------- Der Support für Ubuntu 20.04 endet in wenigen Wochen. Ubuntu empfiehlt ein Upgrade oder erweiterten Support mit Ubuntu Pro. --------------------------------------------- https://www.heise.de/news/Support-Ende-von-Ubuntu-20-04-draeut-10355860.html ∗∗∗ Unmasking the new XorDDoS controller and infrastructure ∗∗∗ --------------------------------------------- Cisco Talos observed an existing distributed denial-of-service (DDoS) malware known as XorDDoS, continuing to spread globally between November 2023 and February 2025. A significant finding shows that over 70 percent of attacks using XorDDoS targeted the United States from Nov. 2023 to Feb. 2025. --------------------------------------------- https://blog.talosintelligence.com/unmasking-the-new-xorddos-controller-and… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks ∗∗∗ --------------------------------------------- Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild. --------------------------------------------- https://thehackernews.com/2025/04/apple-patches-two-actively-exploited.html ∗∗∗ Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution ∗∗∗ --------------------------------------------- A critical security vulnerability has been disclosed in the Erlang/Open Telecom Platform (OTP) SSH implementation that could permit an attacker to execute arbitrary code sans any authentication under certain conditions. The vulnerability, tracked as CVE-2025-32433, has been given the maximum CVSS score of 10.0. --------------------------------------------- https://thehackernews.com/2025/04/critical-erlangotp-ssh-vulnerability.html ∗∗∗ Drupal releases Security Advisories for multiple Critical and High Vulnerabilities ∗∗∗ --------------------------------------------- Including 5 critical and 2 high severity. --------------------------------------------- https://www.drupal.org/security ∗∗∗ Atlassian stopft hochriskante Lecks in Confluence, Jira & Co. ∗∗∗ --------------------------------------------- Atlassian hat für Bamboo, Confluence und Jira Aktualisierungen herausgegeben, die als hohes Risiko eingestufte Sicherheitslücken in den Produkten abdichten sollen. IT-Verantwortliche sollten die Updates zeitnah herunterladen und anwenden. --------------------------------------------- https://www.heise.de/news/Atlassian-stopft-hochriskante-Lecks-in-Confluence… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (April 7, 2025 to April 13, 2025) ∗∗∗ --------------------------------------------- Last week, there were 340 vulnerabilities disclosed in 303 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 67 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2025/04/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and libapache2-mod-auth-openidc), Oracle (expat, freetype, glibc, grub2, gvisor-tap-vsock, and kernel), Red Hat (grub2 and webkit2gtk3), and SUSE (apache2-mod_auth_openidc, cosign, gitoxide, govulncheck-vulndb, GraphicsMagick, haproxy, hauler, mozjs52, oci-cli, pam, perl-Data-Entropy, poppler, python-lxml-doc, python311-aiohttp, rekor, rubygem-rexml, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/1017919/ ∗∗∗ Cisco Nexus Dashboard LDAP Username Enumeration Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Webex App Client-Side Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ [R1] Stand-alone Security Patch Available for Tenable Security Center versions 6.3.0, 6.4.0, 6.4.5 and 6.5.1: SC-202504.2 ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-04 ∗∗∗ F5 K000150879: OpenSSH vulnerability CVE-2025-26466 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150879 ∗∗∗ F5 K000150901: Linux kernel vulnerability CVE-2024-46713 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150901 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.04.2025
by Daily end-of-shift report 16 Apr '25

16 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 15-04-2025 18:00 − Mittwoch 16-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Mehrere FortiGate-Modelle von Backdoor betroffen ∗∗∗ --------------------------------------------- Am Freitag, den 10. April, veröffentlichte Fortinet Informationen über eine weltweite Kompromittierung von FortiGate-Geräten, die Angreifer:innen dauerhaften lesenden Zugriff ermöglichten. Die Angreifer:innen nutzten offenbar drei bekannte Schwachstellen in der SSL-VPN-Funktion, um sich Zugang zu den Geräten zu verschaffen, und eine Hintertür im Dateisystem zu platzieren um den illegalen Zugriff nachhaltig zu ermöglichen. [..] Alle FortiGate-Geräte, physisch oder virtuell, die die SSL-VPN-Funktion aktiviert haben oder hatten und jemals für eine der genannten Schwachstellen anfällig waren (siehe betroffene FortiOS-Versionen in den Advisories - 1, 2, 3), sind potenziell gefährdet. --------------------------------------------- https://www.cert.at/de/blog/2025/4/mehrere-fortigate-modelle-von-backdoor-b… ∗∗∗ CISA extends funding to ensure no lapse in critical CVE services ∗∗∗ --------------------------------------------- CISA says the U.S. government has extended MITREs funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures (CVE) program. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensu… ∗∗∗ Quellcode und Daten geleakt: 4chan nach mutmaßlichem Hackerangriff offline ∗∗∗ --------------------------------------------- 4chan hat offenbar den Unmut einer Konkurrenzplattform auf sich gezogen. Dort kursieren Screenshots von internen Tools, Datenbanken, E-Mail-Listen und mehr. --------------------------------------------- https://www.golem.de/news/quellcode-und-daten-geleakt-4chan-nach-mutmasslic… ∗∗∗ Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2 ∗∗∗ --------------------------------------------- This is Part 2 of our two-part technical analysis on Mustang Panda’s new tools. --------------------------------------------- https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsena… ∗∗∗ CrazyHunter Campaign Targets Taiwanese Critical Sectors ∗∗∗ --------------------------------------------- This blog entry details research on emerging ransomware group CrazyHunter, which has launched a sophisticated campaign aimed at Taiwans essential services. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/d/crazyhunter-campaign.html ===================== = Vulnerabilities = ===================== ∗∗∗ Oracle Critical Patch Update Advisory - April 2025 ∗∗∗ --------------------------------------------- A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. --------------------------------------------- https://www.oracle.com/security-alerts/cpuapr2025.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gvisor-tap-vsock, kernel, and kernel-rt), Fedora (chromium, dnf, dotnet9.0, golang, lemonldap-ng, mariadb10.11, perl-Crypt-URandom-Token, perl-DBIx-Class-EncodedColumn, php-tcpdf, podman-tui, and trunk), Red Hat (java-17-openjdk and kernel), Slackware (mozilla), SUSE (apache2-mod_auth_openidc, cosign, etcd, expat, flannel, kernel, libsqlite3-0, libvarnishapi3, mozjs52, Multi-Linux Manager 4.3: Server, Multi-Linux Manager 5.0: Server, Proxy and Retail Server, pgadmin4, rekor, rsync, rubygem-bundler, and webkit2gtk3), and Ubuntu (7zip, Docker, and quickjs). --------------------------------------------- https://lwn.net/Articles/1017670/ ∗∗∗ CISA Releases Nine Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-25-105-01 Siemens Mendix Runtime, ICSA-25-105-02 Siemens Industrial Edge Device Kit, ICSA-25-105-03 Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX, ICSA-25-105-04 Growatt Cloud Applications, ICSA-25-105-05 Lantronix Xport, ICSA-25-105-06 National Instruments LabVIEW, ICSA-25-105-07 Delta Electronics COMMGR, ICSA-25-105-08 ABB M2M Gateway, ICSA-25-105-09 Mitsubishi Electric Europe B.V. smartRTU --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/04/15/cisa-releases-nine-indus… ∗∗∗ Mozilla: Security Vulnerabilities fixed in Thunderbird ESR 128.9.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-27/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Thunderbird 137.0.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-27/ ∗∗∗ Webbrowser: Kritische Sicherheitslücke in Chrome abgedichtet ∗∗∗ --------------------------------------------- https://heise.de/-10354575 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.04.2025
by Daily end-of-shift report 15 Apr '25

15 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Montag 14-04-2025 18:00 − Dienstag 15-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ New ResolverRAT malware targets pharma and healthcare orgs worldwide ∗∗∗ --------------------------------------------- A new remote access trojan (RAT) called ResolverRAT is being used against organizations globally, with the malware used in recent attacks targeting the healthcare and pharmaceutical sectors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-resolverrat-malware-targ… ∗∗∗ Sicherheitspatches: Google beendet Unterstützung von Android 12 ∗∗∗ --------------------------------------------- Android 12 ist im Jahr 2025 noch die dritthäufigste Android-Version auf dem Markt - Google stellt nun die Versorgung mit Patches ein. --------------------------------------------- https://www.golem.de/news/sicherheitspatches-google-beendet-unterstuetzung-… ∗∗∗ Gladinet’s Triofox and CentreStack Under Active Exploitation via Critical RCE Vulnerability ∗∗∗ --------------------------------------------- A recently disclosed security flaw in Gladinet CentreStack also impacts its Triofox remote access and collaboration solution, according to Huntress, with seven different organizations compromised to date. Tracked as CVE-2025-30406 (CVSS score: 9.0), the vulnerability refers to the use of a hard-coded cryptographic key that could expose internet-accessible servers to remote code execution attacks. It has been addressed in CentreStack version 16.4.10315.56368 released on April 3, 2025. --------------------------------------------- https://thehackernews.com/2025/04/gladinets-triofox-and-centrestack-under.h… ∗∗∗ Verkehrskunde und Krankheiten: Wenn Betrüger:innen Kinder als Lockmittel einsetzen ∗∗∗ --------------------------------------------- Ein Herz für Kinder – genau auf dieses haben es Kriminelle immer wieder abgesehen. Sie versenden E-Mails und bitten darin um Spenden für die Produktion von Büchern. Diese sollen Kindergärten, Kinderkliniken und anderen entsprechenden Einrichtungen kostenlos zur Verfügung gestellt werden. Ein an sich nobles Vorhaben. In Wahrheit aber nichts andere als eine besonders dreiste und unappetitliche Betrugsmasche. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerinnen-kinder-als-lockmittel/ ∗∗∗ Renewed APT29 Phishing Campaign Against European Diplomats ∗∗∗ --------------------------------------------- Starting in January 2025, Check Point Research (CPR) has been tracking a wave of targeted phishing attacks aimed at European governments and diplomats. The Techniques, Tactics and Procedures (TTPs) observed in this campaign align with the WINELOADER campaigns, which were attributed to APT29, a Russia linked threat group. --------------------------------------------- https://research.checkpoint.com/2025/apt29-phishing-campaign/ ∗∗∗ Android-Smartphones starten sich nach 3 Tagen Inaktivität von selbst neu ∗∗∗ --------------------------------------------- Wie iPhones unter iOS 18 starten sich Android-Smartphones künftig nach 72 Stunden der Inaktivität von selbst neu. Damit soll die allgemeine Sicherheit erhöht und nicht die Polizei geärgert werden. --------------------------------------------- https://heise.de/-10352891 ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence ∗∗∗ --------------------------------------------- A critical security vulnerability has been disclosed in the Apache Roller open-source, Java-based blogging server software that could allow malicious actors to retain unauthorized access even after a password change. The flaw, assigned the CVE identifier CVE-2025-24859, carries a CVSS score of 10.0, indicating maximum severity. It affects all versions of Roller up to and including 6.1.4. --------------------------------------------- https://thehackernews.com/2025/04/critical-apache-roller-vulnerability.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (glibc), Red Hat (kernel and kernel-rt), Slackware (perl), SUSE (haproxy, kernel, and webkit2gtk3), and Ubuntu (cimg, perl, protobuf, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/1017514/ ∗∗∗ Vulnerability in FileSender versions 2.15 through 2.50 ∗∗∗ --------------------------------------------- https://filesender.org/vulnerability-in-filesender-versions-2-15-through-2-… ∗∗∗ Mozilla: Security vulnerability fixed in Firefox 137.0.2 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-25/ ∗∗∗ f5: K000150814: BIND vulnerability CVE-2024-11187 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150814 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.04.2025
by Daily end-of-shift report 14 Apr '25

14 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 11-04-2025 18:00 − Montag 14-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ BentoML Vulnerability Allows Remote Code Execution on AI Servers ∗∗∗ --------------------------------------------- This vulnerability, tracked as CVE-2025-27520 with a high severity score of 9.8 and discovered by GitHub user c2an1, could allow attackers who aren’t even logged in to take complete control of the servers running these AI services. [..] Interestingly, according to Checkmarx’s report, this vulnerability is essentially a repeat of CVE-2024-2912, which was fixed in BentoML version 1.2.5., but the fix was later removed in BentoML version 1.3.8, causing the same dangerous weakness to reappear. --------------------------------------------- https://hackread.com/bentoml-vulnerability-remote-code-execution-ai-servers/ ∗∗∗ Exploit Attempts for Recent Langflow AI Vulnerability (CVE-2025-3248), (Sat, Apr 12th) ∗∗∗ --------------------------------------------- Two weeks ago, version 1.3.0 of Langflow was released. The release notes list many fixes but do not mention that one of the "Bug Fixes" addresses a major vulnerability. Instead, the release notes state, "auth current user on code validation." [..] The vulnerability went somewhat unnoticed, at least by me, until Horizon3 created a detailed writeup showing how easy it is to exploit the vulnerability and provide proof of concept exploit. --------------------------------------------- https://isc.sans.edu/diary/rss/31850 ∗∗∗ Proton66 Part 1: Mass Scanning and Exploit Campaigns ∗∗∗ --------------------------------------------- Trustwave SpiderLabs continuously tracks a range of malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns leading to malware infections. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/proton66-pa… ∗∗∗ Phishing Campaigns Use Real-Time Checks to Validate Victim Emails Before Credential Theft ∗∗∗ --------------------------------------------- Cybersecurity researchers are calling attention to a new type of credential phishing scheme that ensures that the stolen information is associated with valid online accounts. The technique has been codenamed precision-validating phishing by Cofense, which it said employs real-time email validation so that only a select set of high-value targets are served the fake login screens. --------------------------------------------- https://thehackernews.com/2025/04/phishing-campaigns-use-real-time-checks.h… ∗∗∗ CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide ∗∗∗ --------------------------------------------- CyberAv3ngers has been vocal about their operations that targeted Israel and Israeli technology products. But they've also quietly expanded their target list to include a variety of other devices and networks, including a US oil and gas firm and a wide array of industrial control systems across the world. --------------------------------------------- https://www.wired.com/story/cyberav3ngers-iran-hacking-water-and-gas-indust… ∗∗∗ A short(-ish) guide on information security writing ∗∗∗ --------------------------------------------- Whether you’re compiling incident notes at 3 AM, drafting a post-mortem report for the board or helping the marketing department to craft a blog post that will generate near endless riches for your employer - we may like it or not, the ability to produce qualitative writing is as much a vital skill when working in information security as your technical prowess. --------------------------------------------- https://bytesandborscht.com/a-short-ish-guide-on-information-security-writi… ∗∗∗ Vorsicht vor Dreiecksbetrug bei Kleinanzeigenplattformen ∗∗∗ --------------------------------------------- eBay, Willhaben, Shpock und Co. sind beliebte Plattformen, um günstig gebrauchte Waren zu kaufen oder nicht mehr benötigte Gegenstände zu verkaufen. Doch Vorsicht: Hinter manchen Profilen verbergen sich Kriminelle. Besonders tückisch ist der Dreiecksbetrug, bei dem sowohl Käufer:innen als auch Verkäufer:innen betrogen werden. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-dreiecksbetrug-bei-klei… ∗∗∗ BPFDoor’s Hidden Controller Used Against Asia, Middle East Targets ∗∗∗ --------------------------------------------- A controller linked to BPF backdoor can open a reverse shell, enabling deeper infiltration into compromised networks. Recent attacks have been observed targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/d/bpfdoor-hidden-controller.ht… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Schadcode-Attacken auf KI-Analyseplattform Spotfire möglich ∗∗∗ --------------------------------------------- Wie aus zwei Warnmeldungen zu den Sicherheitslücken (CVE-2025-3114 "kritisch", CVE-2025-3115 "kritisch") hervorgeht, sind konkret Spotfire Analyst, AWS Marketplace, Deployment Kit Spotfire Server, Desktop, Enterprise Runtime, Service for Python, Service for R und Statistics Services bedroht. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Schadcode-Attacken-auf-KI-Anal… ∗∗∗ Netzwerkgeräte mit Arista EOS können Verschlüsselung vergessen ∗∗∗ --------------------------------------------- Wie aus einer Warnmeldung hervorgeht, funktioniert die Verschlüsselung von Datenverkehr nicht verlässlich. Das ist aber den Entwicklern zufolge aber nur gegeben, wenn Secure Vxlan konfiguriert ist. [..] Die Sicherheitslücke (CVE-2024-12378) ist mit dem Bedrohungsgrad "kritisch" eingestuft. --------------------------------------------- https://www.heise.de/news/Netzwerkgeraete-mit-Arista-EOS-koennen-Verschlues… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glib2.0, jinja2, kernel, mediawiki, perl, subversion, twitter-bootstrap3, twitter-bootstrap4, and wpa), Fedora (c-ares, chromium, condor, corosync, cri-tools1.29, exim, firefox, matrix-synapse, nextcloud, openvpn, perl-Data-Entropy, suricata, upx, varnish, webkitgtk, yarnpkg, and zabbix), Mageia (giflib, gnupg2, graphicsmagick, and poppler), Oracle (delve and golang, go-toolset:ol8, grub2, and webkit2gtk3), Red Hat (kernel and kernel-rt), SUSE (chromium, fontforge-20230101, govulncheck-vulndb, kernel, liblzma5-32bit, pgadmin4, python311-Django, and python311-PyJWT), and Ubuntu (graphicsmagick). --------------------------------------------- https://lwn.net/Articles/1017396/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.04.2025
by Daily end-of-shift report 11 Apr '25

11 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-04-2025 18:00 − Freitag 11-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Fortinet FortiOS: Angreifende installierten persistenten Lesezugriff auf Firewalls ∗∗∗ --------------------------------------------- Am 10. April 2025 veröffentlichte der Hersteller Fortinet einen PSIRT-Blogbeitrag über beobachtete Kompromittierungen durch mehrere bekannte Schwachstellen im Betriebssystem FortiOS der Firewall- Serie FortiGate [FORT25]. [..] Fortinet konnte beobachten, wie Angreifende die genannten Schwachstellen nutzten, um sich persistenten Lesezugriff auf verwundbaren FortiGates zu verschaffen. [..] IT-Sicherheitsverantwortliche sollten prüfen, ob sie selbst betroffen waren oder sind und weitere Schutzmaßnahmen ergreifen. --------------------------------------------- https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2025/2025-2… ∗∗∗ Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs ∗∗∗ --------------------------------------------- Google is hosting dozens of extensions in its Chrome Web Store that perform suspicious actions on the more than 4 million devices that have installed them and that their developers have taken pains to carefully conceal. --------------------------------------------- https://arstechnica.com/security/2025/04/researcher-uncovers-dozens-of-sket… ∗∗∗ Tycoon2FA New Evasion Technique for 2025 ∗∗∗ --------------------------------------------- The Tycoon 2FA phishing kit has adopted several new evasion techniques aimed at slipping past endpoints and detection systems. These include using a custom CAPTCHA rendered via HTML5 canvas, invisible Unicode characters in obfuscated JavaScript, and anti-debugging scripts to thwart inspection. This blog takes a closer look at these methods to better understand how this kit is evolving and what defenders should be aware of. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tycoon2fa-n… ∗∗∗ Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks ∗∗∗ --------------------------------------------- Ever thought an image file could be part of a cyber threat? The Trustwave SpiderLabs Email Security team has identified a major spike in SVG image-based attacks, where harmless-looking graphics are being used to hide dangerous links. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pixel-perfe… ∗∗∗ Palo Alto Networks Warns of Brute-Force Attempts Targeting PAN-OS GlobalProtect Gateways ∗∗∗ --------------------------------------------- Palo Alto Networks has revealed that its observing brute-force login attempts against PAN-OS GlobalProtect gateways, days after threat actors warned of a surge in suspicious login scanning activity targeting its appliances. --------------------------------------------- https://thehackernews.com/2025/04/palo-alto-networks-warns-of-brute-force.h… ∗∗∗ Vorsicht vor gefälschten card complete Anrufen! ∗∗∗ --------------------------------------------- Derzeit kommt es zu betrügerischen Anrufen im Namen der Kreditkartenfirma card complete. Kriminelle setzen dabei Spoofing ein, um vorzutäuschen, dass es sich um seriöse Anrufe handelt. Ihr Ziel ist es, an sensible Daten wie Passwörter und Codes zu gelangen. Sollten Sie so einen Anruf erhalten, legen Sie sofort auf und blockieren Sie die Nummer. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-card-compl… ∗∗∗ Malicious NPM Packages Targeting PayPal Users ∗∗∗ --------------------------------------------- FortiGuard Labs has recently discovered a series of malicious NPM packages designed to steal sensitive information from compromised systems. These packages are believed to have been created between March 5 and March 14 by a threat actor known as tommyboy_h1 and tommyboy_h2 to target PayPal users. [..] These attacks function by using a "preinstall hook" in malicious NPM packages, automatically running a script when the package is installed. --------------------------------------------- https://feeds.fortinet.com/~/916527947/0/fortinet/blogs~Malicious-NPM-Packa… ∗∗∗ Security audit of PHP-SRC ∗∗∗ --------------------------------------------- The Open Source Technology Improvement Fund, Inc, thanks to funding provided by Sovereign Tech Fund, engaged with Quarkslab to perform a security audit of PHP-SRC, the interpreter of the PHP language. The audit aimed to assist PHPs core developers and the community in strengthening the projects security ahead of the upcoming PHP 8.4 release. --------------------------------------------- http://blog.quarkslab.com/security-audit-of-php-src.html ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (delve and golang and go-toolset:rhel8), Debian (webkit2gtk), Fedora (openvpn, thunderbird, uboot-tools, and zabbix), SUSE (expat, fontforge, govulncheck-vulndb, and kernel), and Ubuntu (haproxy and libsoup2.4, libsoup3). --------------------------------------------- https://lwn.net/Articles/1017197/ ∗∗∗ Sonicwall Netextender: Sicherheitslecks gefährden Windows-Client ∗∗∗ --------------------------------------------- In der Sicherheitsmitteilung schreiben die Sonicwall-Entwickler, dass insbesondere der Windows-Client der SSL-VPN-Software Netextender betroffen ist. Das größte Risiko geht von einer unzureichenden Rechteverwaltung in Sonicwall Netextender Windows, sowohl in der 32- als auch der 64-Bit-Version, aus. Angreifer mit niedrigen Rechten können dadurch Konfigurationen verändern (CVE-2025-23008, CVSS 7.2, Risiko "hoch"). --------------------------------------------- https://heise.de/-10349117 ∗∗∗ Subnet Solutions PowerSYSTEM Center ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-08 ∗∗∗ Rockwell Automation Arena ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-100-07 ∗∗∗ INFINITT Healthcare INFINITT PACS ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-100-01 ∗∗∗ F5: K000150813: Linux kernel vulnerability CVE-2024-50252 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150813 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.04.2025
by Daily end-of-shift report 10 Apr '25

10 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 09-04-2025 18:00 − Donnerstag 10-04-2025 18:00 Handler: Felician Fuchs Co-Handler: Guenes Holler ===================== = News = ===================== ∗∗∗ Hackers target SSRF bugs in EC2-hosted sites to steal AWS credentials ∗∗∗ --------------------------------------------- A targeted campaign exploited Server-Side Request Forgery (SSRF) vulnerabilities in websites hosted on AWS EC2 instances to extract EC2 Metadata, which could include Identity and Access Management (IAM) credentials from the IMDSv1 endpoint. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-target-ssrf-bugs-in-… ∗∗∗ Oracle-Einbruch: Schweigen und Kleingerede ∗∗∗ --------------------------------------------- Über zwei Wochen nach Bekanntwerden eines Datenlecks in einer seiner Cloud-Umgebungen wandte sich Oracle nun mit einer E-Mail an Kunden. In der Stellungnahme bemühte sich der Konzern, den Angriff und dessen Auswirkungen kleinzuschreiben. [..] Tatsächlich liegen heise security Demo-Datensätze vor, die direkt vom Angreifer stammen. In diesen sind weit mehr als lediglich Usernamen zu finden – neben E-Mail-Adressen, verschiedenen Passworthashes und den Oracle-internen Tenant-Kennungen finden sich auch die Namen der betroffenen Systeme sowie eine Vielzahl von Zeitstempeln. Diese erstrecken sich bis in den März 2025. --------------------------------------------- https://www.heise.de/news/Oracle-Einbruch-Unternehmen-gibt-Datenklau-zu-und… ∗∗∗ Günstige PV-Komponenten aus Insolvenzmasse abzugeben? Vorsicht, Betrug! ∗∗∗ --------------------------------------------- Eine Anwaltskanzlei hat sich bei Ihnen gemeldet und bietet günstige Photovoltaik-Komponenten aus einem Insolvenzverkauf? Sie sollen rasch antworten, weil die Nachfrage hoch ist? Dann versuchen grade Betrüger:innen, an Ihr Geld zu kommen! Besonders gefährlich: Das insolvente Unternehmen und die Anwaltskanzlei existieren tatsächlich, die Kriminellen nutzen sie als Tarnung für ihre Masche. --------------------------------------------- https://www.watchlist-internet.at/news/pv-komponenten-aus-konkursmasse/ ===================== = Vulnerabilities = ===================== ∗∗∗ Splunk Security Advisories Archive ∗∗∗ --------------------------------------------- Splunk has released security updates for multiple products patching 2 critical and multiple more high vulnerabilities. --------------------------------------------- https://advisory.splunk.com//advisories ∗∗∗ Palo Alto Networks Security Advisories ∗∗∗ --------------------------------------------- Palo Alto Networks has released multiple security advisories for its products, including a high-severity vulnerability affecting the Prisma Access Browser. --------------------------------------------- https://security.paloaltonetworks.com/ ∗∗∗ HPE Aruba: Sicherheitspatches für Access Points und weitere Hardware ∗∗∗ --------------------------------------------- HPE hat Sicherheitswarnungen zu Schwachstellen in diversen Netzwerkgeräten der Aruba-Tochtermarke veröffentlicht. Angreifer können durch die Sicherheitslecks teils sogar Schadcode auf verwundbare Geräte schleusen. --------------------------------------------- https://www.heise.de/news/HPE-Aruba-Sicherheitspatches-fuer-Access-Points-u… ∗∗∗ Sicherheitsupdates: Mit Drupal erstellte Website sind verwundbar ∗∗∗ --------------------------------------------- Drupal-Admins sollten sicherstellen, dass die von ihnen genutzten Module des Content Management Systems (CMS) auf dem aktuellen Stand sind. Geschieht das nicht, können Angreifer Websites im schlimmsten Fall kompromittieren. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Mit-Drupal-erstellte-Website-s… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (March 31, 2025 to April 6, 2025) ∗∗∗ --------------------------------------------- Last week, there were 527 vulnerabilities disclosed in 464 WordPress Plugins and 19 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 85 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2025/04/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (tomcat and webkit2gtk3), Debian (chromium), Fedora (ghostscript), Mageia (atop, docker-containerd, and xz), Red Hat (go-toolset:rhel8), SUSE (apache2-mod_auth_openidc, apparmor, etcd, expat, firefox, kernel, libmozjs-128-0, and libpoppler-cpp2), and Ubuntu (dino-im, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-fips, linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips, opensc, and poppler). --------------------------------------------- https://lwn.net/Articles/1017043/ ∗∗∗ Wordpress: 100.000 Instanzen durch Lücke in SureTriggers-Plug-in gefährdet ∗∗∗ --------------------------------------------- In einem Blog-Beitrag erörtern die IT-Forscher von Wordfence, dass es Angreifer aus dem Netz ohne vorherige Authentifizierung administrative Nutzerkonten erstellen können. Sofern kein API-Key in dem SureTriggers-Plug-in eingerichtet ist, können Angreifer dadurch Administrator-Nutzer hinzufügen und damit Wordpress-Instanzen vollständig kompromittieren (CVE-2025-3102, CVSS 8.1. Risiko "hoch"). --------------------------------------------- https://heise.de/-10346837 ∗∗∗ Dell PowerScale OneFS: Standard-Passwort ermöglicht Account-Übernahme ∗∗∗ --------------------------------------------- Angreifer können an insgesamt sechs Schwachstellen ansetzen, um Netzwerkspeicher (NAS) mit Dells Betriebssystem PowerScale OneFS zu attackieren. Im schlimmsten Fall können Angreifer die volle Kontrolle über Geräte erlangen. --------------------------------------------- https://heise.de/-10347097 ∗∗∗ Juniper 2025-01 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 24.1R2 release ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos… ∗∗∗ F5 K000150784: OpenSSL vulnerability CVE-2024-13176 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150784 ∗∗∗ Multiple vulnerabilities in MedDream PACS Server ∗∗∗ --------------------------------------------- https://www.cybersecurity-help.cz/vdb/SB2025041027 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.04.2025
by Daily end-of-shift report 09 Apr '25

09 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 08-04-2025 18:00 − Mittwoch 09-04-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Regierung will Messenger-Überwachung vor dem Sommer beschließen ∗∗∗ --------------------------------------------- Das Innenministerium hat im Rahmen der Regierungsklausur im Kanzleramt den Begutachtungsentwurf zur Messenger-Überwachung vorgelegt. Beschlossen werden soll die Messenger-Überwachung noch vor dem Sommer. Wirksam werden soll sie aber erst mit 2027. --------------------------------------------- https://futurezone.at/netzpolitik/messenger-ueberwachung-whatsapp-oesterrei… ∗∗∗ Obfuscated Malicious Python Scripts with PyArmor, (Wed, Apr 9th) ∗∗∗ --------------------------------------------- Obfuscation is very important for many developers. They may protect their code for multiple reasons like copyright, anti-cheat (games), or to protect their code from being reused. If an obfuscated program does not mean automatically that it is malicious, its often a good sign. For malware developers, obfuscation helps bypass many static security controls and slows down the reverse analysis process. Yesterday, I spotted some malicious Python scripts that were protected using the same technique: PyArmor. --------------------------------------------- https://isc.sans.edu/diary/rss/31840 ∗∗∗ Vorsicht, Abo-Falle: SPAR verlost kein Besteckset von WMF! ∗∗∗ --------------------------------------------- In vielen E-Mail-Postfächern taucht aktuell eine angeblich von SPAR stammende Nachricht auf. Das Handelsunternehmen soll ein Besteckset für zwölf Personen von WMF verlosen. Tatsächlich versteckt sich hinter dieser Masche nichts anderes als eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/abo-falle-spar-besteckset/ ∗∗∗ The Renaissance of NTLM Relay Attacks: Everything You Need to Know ∗∗∗ --------------------------------------------- While there are many great resources on this old attack, I wanted to consolidate everything you need to know about NTLM into a single post, allowing it to be as long as needed, and I hope everyone will be able to learn something new. --------------------------------------------- https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everythin… ∗∗∗ OpenSSL 3.5.0 enthält nun Post-Quanten-Verfahren ∗∗∗ --------------------------------------------- OpenSSL fügt mit der neuen LTS-Version 3.5.0 seiner Bibliothek die Post-Quanten-Verfahren ML-KEM, ML-DSA und SLH-DSA hinzu. --------------------------------------------- https://heise.de/-10345122 ∗∗∗ OpenSSH 10 setzt auf Standards für quantensicheren Schlüsselaustausch ∗∗∗ --------------------------------------------- Der seit Jahren abgekündigte DSA-Algorithmus verschwindet nun vollständig aus der sicheren Remote-Shell, seine Nachfolge tritt MLKEM768 an. --------------------------------------------- https://heise.de/-10345975 ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft-Patchday behebt aktiv ausgenutzte Sicherheitslücke ∗∗∗ --------------------------------------------- Microsoft hat zum April-Patchday (8. April) Aktualisierungen für mehrere kritische Schwachstellen in ihren Produkten veröffentlicht. Eine dieser Lücken wird laut dem Unternehmen bereits aktiv ausgenutzt. Konkret handelt es sich dabei um die Sicherheitslücke CVE-2025-29824, welche mit einem CVSS-Wert von 7.8 bewertet ist. Durch das Ausnutzen eines sogenannten Use-after-free-Bugs können Angreifer:innen mit einfachen Benutzer:innenrechten vollständige Systemrechte erlangen. --------------------------------------------- https://www.cert.at/de/aktuelles/2025/4/microsoft-patchday-behebt-aktiv-aus… ∗∗∗ Microsoft Security Update Summary (8. April 2025) ∗∗∗ --------------------------------------------- Microsoft hat am 8. April 2025 Sicherheitsupdates für Windows-Clients und -Server, für Office – sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen 121 Schwachstellen (CVEs), eine davon wurde als 0-day klassifiziert. --------------------------------------------- https://www.borncity.com/blog/2025/04/09/microsoft-security-update-summary-… ∗∗∗ Whatsapp-Lücke gefährdet Windows-Nutzer ∗∗∗ --------------------------------------------- Konkret geht es um die Sicherheitslücke CVE-2025-30401, die mit einem CVSS-Wert von 6,7 als mittelschwer eingestuft ist. Gründe für die vergleichsweise milde Einstufung sind unter anderem eine hohe Angriffskomplexität sowie eine erforderliche Nutzerinteraktion. Dennoch sind die Ausnutzbarkeit sowie die möglichen Auswirkungen der Schwachstelle nicht zu unterschätzen. --------------------------------------------- https://www.golem.de/news/malware-im-anmarsch-whatsapp-luecke-gefaehrdet-wi… ∗∗∗ CISA Warns of CentreStacks Hard-Coded MachineKey Vulnerability Enabling RCE Attacks ∗∗∗ --------------------------------------------- The vulnerability, tracked as CVE-2025-30406 (CVSS score: 9.0), concerns a case of a hard-coded cryptographic key that could be abused to achieve remote code execution. It has been addressed in version 16.4.10315.56368 released on April 3, 2025. --------------------------------------------- https://thehackernews.com/2025/04/cisa-warns-of-centrestacks-hard-coded.html ∗∗∗ 2025-04-09 Juniper Security Advisories ∗∗∗ --------------------------------------------- Juniper has released 25 new security advisories. --------------------------------------------- https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sor… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (lemonldap-ng, libbssolv-perl, and phpmyadmin), Fedora (augeas, mariadb10.11, and thunderbird), Oracle (gimp, libxslt, python3.11, python3.12, tomcat, and xorg-x11-server), Red Hat (expat, grafana, opentelemetry-collector, and webkit2gtk3), SUSE (azure-cli-core, doomsday, kernel, and poppler), and Ubuntu (dotnet8, dotnet9, erlang, and poppler). --------------------------------------------- https://lwn.net/Articles/1016923/ ∗∗∗ New Adobe Security Update Fixes Critical Exploits — Don’t Delay Your Update ∗∗∗ --------------------------------------------- https://thecyberexpress.com/adobe-security-update-fixes-vulnerabilities/ ∗∗∗ Joomla [20250401] - Framework - SQL injection vulnerability in quoteNameStr method of Database package ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/963-20250401-framework-sql-inj… ∗∗∗ Joomla [20250402] - Core - MFA Authentication Bypass ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/964-20250402-core-mfa-authenti… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.04.2025
by Daily end-of-shift report 08 Apr '25

08 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Montag 07-04-2025 18:00 − Dienstag 08-04-2025 18:00 Handler: Guenes Holler Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Malicious VSCode extensions infect Windows with cryptominers ∗∗∗ --------------------------------------------- Nine VSCode extensions on Microsofts Visual Studio Code Marketplace pose as legitimate development tools while infecting users with the XMRig cryptominer to mine Ethereum and Monero. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-vscode-extensions-… ∗∗∗ Dangerous, Windows-Hijacking Neptune RAT Scurries Into Telegram, YouTube ∗∗∗ --------------------------------------------- The malwares creators insist a new open source version of Neptune is for educational use by pen testers, but a raft of sophisticated backdoor and evasion capabilities says otherwise. --------------------------------------------- https://www.darkreading.com/cloud-security/windows-hijacking-neptune-rat-te… ∗∗∗ 100 Days of YARA: Writing Signatures for .NET Malware ∗∗∗ --------------------------------------------- If YARA signatures for .NET assemblies only rely on strings, they are very limited. We explore more detection opportunities, including IL code, method signature definitions and specific custom attributes. Knowledge about the underlying .NET metadata structures, tokens and streams helps to craft more precise and efficient signatures, even in cases where relevant malware samples might be unavailable. --------------------------------------------- https://feeds.feedblitz.com/~/916366745/0/gdatasecurityblog-en~Days-of-YARA… ∗∗∗ Attackers distributing a miner and the ClipBanker Trojan via SourceForge ∗∗∗ --------------------------------------------- Malicious actors are using SourceForge to distribute a miner and the ClipBanker Trojan while utilizing unconventional persistence techniques. --------------------------------------------- https://securelist.com/miner-clipbanker-sourceforge-campaign/116088/ ∗∗∗ Inside Black Basta: Uncovering the Secrets of a Ransomware Powerhouse ∗∗∗ --------------------------------------------- In February 2025, the cybersecurity community witnessed an unprecedented leak that exposed the internal operations of Black Basta, a prolific ransomware group. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/inside-blac… ∗∗∗ Vorsicht beim Autoverkauf: Betrug mit gefälschten Fahrzeugberichten ∗∗∗ --------------------------------------------- Sie wollen Ihr Auto online verkaufen? Dann kann es vorkommen, dass potenzielle Käufer:innen einen Fahrzeugbericht verlangen, angeblich um den Zustand Ihres Gebrauchtwagens besser einschätzen zu können. Doch Vorsicht: Hinter dieser Aufforderung steckt oft der Versuch, Sie auf unseriöse Websites zu locken. Diese liefern gefälschte Berichte und führen Sie in teure Kostenfallen. --------------------------------------------- https://www.watchlist-internet.at/news/betrug-mit-gefaelschten-fahrzeugberi… ∗∗∗ 2025 Ransomware: Business as Usual, Business is Booming ∗∗∗ --------------------------------------------- Rapid7 Labs took a look at internal and publicly-available ransomware data for Q1 2025 and added our own insights to provide a picture of the year thus far—and what you can do now to reduce your attack surface against ransomware. --------------------------------------------- https://www.rapid7.com/blog/post/2025/04/08/2025-ransomware-business-as-usu… ∗∗∗ PyTorch Lightning Exposes Users to Remote Code Execution via Deserialization Vulnerabilities ∗∗∗ --------------------------------------------- PyTorch Lightning, a widely adopted deep learning framework developed by Lightning AI, has been impacted by multiple critical deserialization vulnerabilities, disclosed under VU#252619. These issues affect all versions up to and including 2.4.0 and may lead to arbitrary code execution when loading untrusted model files.The vulnerabilities were reported by Kasimir Schulz of HiddenLayer and coordinated by the CERT Coordination Center (CERT/CC) at Carnegie Mellon University. --------------------------------------------- https://socket.dev/blog/pytorch-lightning-deserialization-vulnerabilities?u… ===================== = Vulnerabilities = ===================== ∗∗∗ Spionage möglich: Google patcht teils aktiv ausgenutzte Android-Lücken ∗∗∗ --------------------------------------------- Mit den Android-Updates für April schließt Google mehr als 60 Sicherheitslücken. Vier davon sind kritisch, zwei werden bereits aktiv ausgenutzt. --------------------------------------------- https://www.golem.de/news/spionage-moeglich-google-patcht-teils-aktiv-ausge… ∗∗∗ Ivanti: Security Advisory April 2025 for Ivanti EPM 2024 and EPM 2022 SU6 ∗∗∗ --------------------------------------------- Ivanti has released updates for Ivanti Endpoint Manager which addresses medium and high vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. --------------------------------------------- https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EP… ∗∗∗ HCL: Sicherheitslücken in BigFix, DevOps und mehr Produkten ∗∗∗ --------------------------------------------- Zum Stopfen von Sicherheitslücken in HCL BigFix, DevOps, Traveler und Connections stellt HCL Software nun Updates bereit. Die Lücken gelten teils als kritisch. IT-Verantwortliche sollten die Updates zügig anwenden. Am schwersten hat es HCL BigFix WebUI, also die Management-Oberfläche für BigFix, getroffen. Mehrere Schwachstellen sind in den darin verwendeten Open-Source-Komponenten, davon ist eine in canvg 4.0.2 als kritisch eingestuft (CVE-2025-25977, CVSS 9.8) sowie zwei in xml-crypto (CVE-2025-29774, CVE-2025-29775, beide CVSS 9.3). --------------------------------------------- https://www.heise.de/news/HCL-Sicherheitsluecken-in-BigFix-DevOps-und-mehr-… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gimp, libxslt, python3.11, python3.12, and tomcat), Debian (ghostscript and libnet-easytcp-perl), Fedora (openvpn, perl-Data-Entropy, and webkitgtk), Red Hat (python-jinja2), SUSE (giflib, pam, and xen), and Ubuntu (apache2, binutils, expat, fis-gtm, linux-azure, linux-azure-6.8, linux-nvidia-lowlatency, linux-azure, linux-azure-fde, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-gcp-fips, linux-hwe-5.4, linux-nvidia, linux-nvidia-tegra-igx, ruby2.7, ruby3.0, ruby3.2, ruby3.3, and vim). --------------------------------------------- https://lwn.net/Articles/1016774/ ∗∗∗ ZDI-25-206: Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-206/ ∗∗∗ ZDI-25-205: Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-205/ ∗∗∗ Fortinet: No certificate name verification for fgfm connection ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-046 ∗∗∗ Fortinet: Unverified password change via set_password endpoint ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-435 ∗∗∗ f5 K000150744: PostgreSQL vulnerability CVE-2025-1094 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150744 ∗∗∗ f5 K000150749: Python vulnerability CVE-2024-4032 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150749 ∗∗∗ SAP Security Patch Day – April 2025 ∗∗∗ --------------------------------------------- https://redrays.io/blog/sap-security-patch-day-april-2025/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.04.2025
by Daily end-of-shift report 07 Apr '25

07 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 04-04-2025 18:00 − Montag 07-04-2025 18:00 Handler: Guenes Holler Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Vidar Stealer: Revealing A New Deception Strategy ∗∗∗ --------------------------------------------- Vidar Stealer, an infamous information-stealing malware, first appeared in 2018 and has since been used by cybercriminals to harvest sensitive data via browser cookies, stored credentials, financial information, and the like. [..] One recent example is PirateFi, a free-to-play game released on Steam on February 6, 2025. Marketed as a beta version, it concealed Vidar Stealer within its files, infecting unsuspecting players upon installation. This incident highlights how threat actors are increasingly targeting gaming platforms to spread malware. --------------------------------------------- https://feeds.feedblitz.com/~/916316261/0/gdatasecurityblog-en~Vidar-Steale… ∗∗∗ How ToddyCat tried to hide behind AV software ∗∗∗ --------------------------------------------- While analyzing a malicious DLL library used in attacks by APT group ToddyCat, Kaspersky expert discovered the CVE 2024-11859 vulnerability in a component of ESET’s EPP solution. --------------------------------------------- https://securelist.com/toddycat-apt-exploits-vulnerability-in-eset-software… ∗∗∗ PoisonSeed Exploits CRM Accounts to Launch Cryptocurrency Seed Phrase Poisoning Attacks ∗∗∗ --------------------------------------------- A malicious campaign dubbed PoisonSeed is leveraging compromised credentials associated with customer relationship management (CRM) tools and bulk email providers to send spam messages containing cryptocurrency seed phrases in an attempt to drain victims digital wallets. [..] The attacks involve the threat actors setting up lookalike phishing pages for prominent CRM and bulk email companies, aiming to trick high-value targets into providing their credentials. --------------------------------------------- https://thehackernews.com/2025/04/poisonseed-exploits-crm-accounts-to.html ∗∗∗ Microsoft AI findet Schwachstellen in Open-Source-Boot-Loader ∗∗∗ --------------------------------------------- Microsoft hat seine AI-Lösung Microsoft Security CoPilot verwendet, um mehrere Boot-Loader, darunter den von Linux verwendeten Open-Source-Boot-Loader Grub, sowie U-boot und Barebox, auf Schwachstellen abzuklopfen. Dabei wurden gleich mehrere Schwachstellen entdeckt – wobei die Verwendung von AI das Auffinden von Schwachstellen beschleunigt. --------------------------------------------- https://www.borncity.com/blog/2025/04/06/microsoft-ai-findet-schwachstellen… ∗∗∗ Windows Remote Desktop Protocol: Remote to Rogue ∗∗∗ --------------------------------------------- In October 2024, Google Threat Intelligence Group (GTIG) observed a novel phishing campaign targeting European government and military organizations that was attributed to a suspected Russia-nexus espionage actor we track as UNC5837. The campaign employed signed .rdp file attachments to establish Remote Desktop Protocol (RDP) connections from victims' machines. [..] This section focuses on collecting forensic information, hardening systems, and developing detections for RDP techniques used in the campaign. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remo… ===================== = Vulnerabilities = ===================== ∗∗∗ Packprogramm: Sicherheitslücke in Winrar begünstigt Ausführung von Malware ∗∗∗ --------------------------------------------- Mit der neuesten Winrar-Version hat der Entwickler eine Sicherheitslücke gepatcht. [..] Die besagte Schwachstelle ist als CVE-2025-31334 registriert. Allzu viele Details lassen sich der Schwachstellenbeschreibung nicht entnehmen. Darin wird lediglich in Verbindung mit Winrar-Versionen vor 7.11 auf die Möglichkeit der Umgehung des Mark of the Web mittels symbolischer Links hingewiesen. [..] Wer Winrar auf seinem System installiert hat und sich vor CVE-2025-31334 schützen will, sollte die Software daher auf die neueste Version aktualisieren. Dies ist derzeit die Version 7.11, die am 24. März veröffentlicht wurde. --------------------------------------------- https://www.golem.de/news/packprogramm-winrar-luecke-erleichtert-ausfuehrun… ∗∗∗ Bitdefender GravityZone: Kritische Sicherheitslücke gefährdet Nutzer ∗∗∗ --------------------------------------------- Der Business-Malwareschutz GravityZone von Bitdefender weist eine kritische Sicherheitslücke auf. [..] Das Update auf Bitdefender GravityZone Console 6.41.2-1 soll die sicherheitsrelevanten Fehler ausbessern. Für den GravityZone Update Server steht als fehlerkorrigierte Fassung der Stand 3.5.2.689 oder neuer bereit. Bitdefender gibt an, dass es in der Regel automatisch erfolgt. Dennoch sollten Admins überprüfen, ob sie bereits auf diesem oder einem neueren Stand sind. --------------------------------------------- https://heise.de/-10342193 ∗∗∗ XZ-Utils: Schwachstelle ermöglicht vermutlich Codeschmuggel ∗∗∗ --------------------------------------------- Die Schwachstelle behandelt eine Sicherheitsmitteilung auf Github. "Ungültige Eingabedaten können zumindest in einen Absturz münden", erklären die Autoren. "Die Effekte umfassen eine Nutzung des Heaps nach einer free-Operation sowie das Schreiben an eine Adresse basierend auf dem Null-Pointer zuzüglich eines Offsets", schreiben sie weiter. Apps und Bibliotheken, die die Funktion lzma_stream_decoder_mt nutzen, sind betroffen (CVE-2025-31115, CVSS 8.7, Risiko "hoch"). --------------------------------------------- https://heise.de/-10343043 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (abseil, atop, jetty9, ruby-saml, tomcat10, trafficserver, xz-utils, and zfs-linux), Fedora (chromium, condor, containernetworking-plugins, cri-tools1.29, crosswords-puzzle-sets-xword-dl, exim, ghostscript, matrix-synapse, upx, varnish, and yarnpkg), Gentoo (XZ Utils), Mageia (augeas, corosync, nss & firefox, and thunderbird), Oracle (container-tools:ol8, firefox, freetype, and kernel), Red Hat (firefox), SUSE (chromium, gn, firefox-esr, go1.23-1.23.8, go1.24, go1.24-1.24.2, google-guest-agent, govulncheck-vulndb, gsl, python311-ecdsa, thunderbird, and webkit2gtk3), and Ubuntu (kamailio, libdbd-mysql-perl, linux-nvidia, linux-nvidia-6.8, and tomcat9). --------------------------------------------- https://lwn.net/Articles/1016663/ ∗∗∗ B&R: 2024-05-14 (**Updated 2025-04-03**)- Cyber Security Advisory - Insecure Loading of Code in B&R Products ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c… ∗∗∗ ABB: 2025-04-07: Cyber Security Advisory - ABB Arctic communication solution ARM600 Vulnerabilities ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2NGA002579&Language… ∗∗∗ ABB: 2025-04-07: Cyber Security Advisory - ABB Arctic ARG600, ARC600, ARR600, ARP600 Arctic Wireless Gateway Modem Module and OpenSSH vulnerabilities ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2NGA002427&Language… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2025-0003 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2025-0003.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.04.2025
by Daily end-of-shift report 04 Apr '25

04 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 03-04-2025 18:00 − Freitag 04-04-2025 18:00 Handler: Guenes Holler Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Europcar GitLab breach exposes data of up to 200,000 customers ∗∗∗ --------------------------------------------- A hacker breached the GitLab repositories of multinational car-rental company Europcar Mobility Group and stole source code for Android and iOS applications, as well as some personal information belonging to up to 200,000 users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/europcar-gitlab-breach-expos… ∗∗∗ Is The Sofistication In The Room With Us? - X-Forwarded-For and Ivanti Connect Secure (CVE-2025-22457) ∗∗∗ --------------------------------------------- Exploitation is always a tricky subject. Vendors want to minimize disruption to their userbase and avoid unnecessary patching, but they also need to balance that with the userbase's safety. [..] It appears that this is what happened here - Ivanti made a judgment call, believing that exploiting the vulnerability, given the requirement that the payload must comprise only of 0123456789., was impossible. Unfortunately, an advanced attacker seems to have proved them wrong. --------------------------------------------- https://labs.watchtowr.com/is-the-sofistication-in-the-room-with-us-x-forwa… ∗∗∗ NVD Quietly Sweeps 100K+ CVEs Into a “Deferred” Black Hole ∗∗∗ --------------------------------------------- Without much fanfare, the NVD has begun mass-labeling older CVEs as "Deferred," effectively giving up on enriching them with detailed metadata like CVSS scores, CWEs, and CPEs. In an April 2 update, the NVD announced that all CVEs published before 2018 will be marked as Deferred—a move thats already resulted in 20,000 Deferred CVEs overnight, with potentially 100,000 more to come: All CVEs with a published date prior to 01/01/2018 will be marked as Deferred within the NVD. --------------------------------------------- https://socket.dev/blog/nvd-quietly-sweeps-100k-cves-into-a-deferred-black-… ∗∗∗ Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads ∗∗∗ --------------------------------------------- North Korean threat actors behind the Contagious Interview operation have expanded their presence in the npm ecosystem, publishing additional malicious packages that deliver the previously identified BeaverTail malware and introducing new packages with remote access trojan (RAT) loader functionality. These latest samples employ hexadecimal string encoding to evade automated detection systems and manual code audits, signaling a variation in the threat actors’ obfuscation techniques. --------------------------------------------- https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packa… ===================== = Vulnerabilities = ===================== ∗∗∗ DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software ∗∗∗ --------------------------------------------- Autodesk Navisworks is affected by multiple DWFX vulnerabilities listed below. Exploitation of these vulnerabilities can lead to code execution. Exploitation of these vulnerabilities requires user interaction. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0002 ∗∗∗ Kritische Lücke mit Höchstwertung in Apache Parquet geschlossenen ∗∗∗ --------------------------------------------- Wie aus einem Eintrag in der Openwall-Mailingliste hervorgeht, haben die Entwickler die Schwachstelle in der Version 1.15.1 geschlossen. Alle vorigen Ausgaben sind verwundbar. Die Lücke (CVE-2025-30065) gilt als "kritisch" und ist mit dem höchstmöglichen CVSS Score 10 von 10 eingestuft. Sie betrifft konkret das parquet-avro-Modul der Java-Bibliothek von Apache Parquet. --------------------------------------------- https://www.heise.de/news/Kritische-Luecke-mit-Hoechstwertung-in-Apache-Par… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (firefox), Debian (atop and thunderbird), Fedora (webkitgtk), Mageia (microcode), Oracle (expat), SUSE (apparmor, assimp-devel, aws-efs-utils, expat, firefox, ghostscript, go1.23, gotosocial, govulncheck-vulndb, GraphicsMagick, headscale, libmozjs-128-0, libsaml-devel, openvpn, perl-Data-Entropy, and xz), and Ubuntu (gnupg2, kernel, linux-azure-fips, linux-iot, openvpn, ruby-saml, and xz-utils). --------------------------------------------- https://lwn.net/Articles/1016484/ ∗∗∗ Cisco: Hochriskante Lücken in Meraki und Enterprise Chat ∗∗∗ --------------------------------------------- In der Anyconnect-VPN-Software von Ciscos Meraki MX- und Z-Reihen sowie in Enterprise Chat and Email haben die Entwickler Sicherheitslücken mit hohem Risiko entdeckt. Aktualisierte Firm- und Software steht bereit, um sie zu schließen. Admins sollten sie zügig installieren. --------------------------------------------- https://heise.de/-10340333 ∗∗∗ Hitachi Energy TRMTracker ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-02 ∗∗∗ B&R APROL ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-05 ∗∗∗ Hitachi Energy RTU500 Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.04.2025
by Daily end-of-shift report 03 Apr '25

03 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-04-2025 18:00 − Donnerstag 03-04-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ GitHub expands security tools after 39 million secrets leaked in 2024 ∗∗∗ --------------------------------------------- Over 39 million secrets like API keys and account credentials were leaked on GitHub throughout 2024, exposing organizations and users to significant security risks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/github-expands-security-tool… ∗∗∗ Hersteller warnt: Gefährliche Cisco-Backdoor wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Durch die Backdoor erhalten Angreifer dank statischer Zugangsdaten Admin-Zugriff auf ein Lizenzierungstool für Cisco-Produkte. --------------------------------------------- https://www.golem.de/news/hersteller-warnt-hacker-nutzen-eine-von-ciscos-ba… ∗∗∗ Cybersecurity Professor Faced China-Funding Inquiry Before Disappearing, Sources Say ∗∗∗ --------------------------------------------- A lawyer for Xiaofeng Wang and his wife says they are “safe” after FBI searches of their homes and Wang’s sudden dismissal from Indiana University, where he taught for over 20 years. --------------------------------------------- https://www.wired.com/story/xiaofeng-wang-indiana-university-research-probe… ∗∗∗ Belohnung für gefundene Sicherheitslücken in Fediverse-Software ausgelobt ∗∗∗ --------------------------------------------- Für Mastodon, Pixelfed & Co. sind einzelne und kleine Teams verantwortlich. Um deren Dienste sicherer zu machen, wird jetzt etwas Geld zur Verfügung gestellt. --------------------------------------------- https://www.heise.de/news/Belohnung-fuer-gefundene-Sicherheitsluecken-in-Fe… ∗∗∗ Vorsicht Phishing: Fake-SMS zu angeblichen Mahnungen des Finanzministeriums ∗∗∗ --------------------------------------------- Haben Sie eine SMS im Namen des Bundesministeriums für Finanzen (BMF) erhalten, in der Ihnen offene Schulden vorgeworfen werden? Droht die Nachricht mit einer bevorstehenden Pfändung, weil Sie angeblich schon mehrfach gemahnt wurden? Achtung: Zahlen Sie die Forderung nicht! Die Nachricht kommt nicht vom Finanzministerium und Ihr Geld landet bei Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-sms-zu-mahnungen-des-finanzmini… ∗∗∗ NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat ∗∗∗ --------------------------------------------- Today, CISA—in partnership with the National Security Agency (NSA), Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Canadian Centre for Cyber Security .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/04/03/nsa-cisa-fbi-and-interna… ∗∗∗ New guidance on securing HTTP-based APIs ∗∗∗ --------------------------------------------- Why it’s essential to secure your APIs to build trust with your customers and partners. --------------------------------------------- https://www.ncsc.gov.uk/blog-post/new-guidance-on-securing-http-based-apis ∗∗∗ DPRK IT Workers Expanding in Scope and Scale ∗∗∗ --------------------------------------------- Since our September 2024 report outlining the Democratic Peoples Republic of Korea (DPRK) IT worker threat, the scope and scale of their operations has continued to expand. These individuals .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/dprk-it-workers-ex… ∗∗∗ Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) ∗∗∗ --------------------------------------------- On Thursday, April 3, 2025, Ivanti disclosed a critical security vulnerability, CVE-2025-22457, impacting Ivanti Connect Secure (“ICS”) VPN appliances version 22.7R2.5 and earlier. CVE-2025-22457 is a buffer overflow vulnerability, and successful exploitation .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploi… ∗∗∗ RolandSkimmer: Silent Credit Card Thief Uncovered ∗∗∗ --------------------------------------------- Web-based credit card skimming remains a widespread and persistent threat, known for its ability to adapt and evolve over time. FortiGuard Labs recently observed a sophisticated campaign dubbed “RolandSkimmer,” named .. --------------------------------------------- https://www.fortinet.com/blog/threat-research/rolandskimmer-silent-credit-c… ∗∗∗ Malicious PyPI Package Targets WooCommerce Stores with Automated Carding Attacks ∗∗∗ --------------------------------------------- The Socket research team recently discovered a malicious Python package on PyPI named disgrasya, which contains a fully automated carding script targeting WooCommerce stores. Unlike typical supply chain attacks that rely on deception or typosquatting, disgrasya made no attempt to appear legitimate. It was openly malicious, abusing PyPI as a distribution .. --------------------------------------------- https://socket.dev/blog/malicious-pypi-package-targets-woocommerce-stores-w… ===================== = Vulnerabilities = ===================== ∗∗∗ Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-029 ∗∗∗ Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-028 ∗∗∗ SVD-2025-0402: Third-Party Package Updates in Splunk/UniversalForwarder Docker - April 2025 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2025-0402 ∗∗∗ SVD-2025-0401: Third-Party Package Updates in Splunk/Splunk Docker - April 2025 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2025-0401 ∗∗∗ Security Update: Pulse Connect Secure, Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways ∗∗∗ --------------------------------------------- https://www.ivanti.com/blog/security-update-pulse-connect-secure-ivanti-con… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.04.2025
by Daily end-of-shift report 02 Apr '25

02 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 01-04-2025 18:00 − Mittwoch 02-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Unitree Go1: Gefährliche Backdoor in populärem Roboterhund entdeckt ∗∗∗ --------------------------------------------- Konkret geht es um das Modell Go1, das in der Vergangenheit bereits von den US-Marines für Testzwecke mit einem Waffensystem ausgestattet wurde. [..] Anhand der Backdoor konnte der Hersteller sowie auch jeder andere Akteur, der im Besitz des erforderlichen API-Schlüssels war, aus der Ferne die vollständige Kontrolle über den Unitree Go1 übernehmen. Der Zugriff erfolgte dabei über einen Cloudsail genannten Fernwartungsdienst. --------------------------------------------- https://www.golem.de/news/unitree-go1-gefaehrliche-backdoor-in-populaerem-r… ∗∗∗ Enterprise Gmail Users Can Now Send End-to-End Encrypted Emails to Any Platform ∗∗∗ --------------------------------------------- On the 21st birthday of Gmail, Google has announced a major update that allows enterprise users to send end-to-end encrypted (E2EE) to any user in any email inbox in a few clicks. The feature is rolling out starting today in beta, allowing users to send E2EE emails to Gmail users within an organization, with plans to send E2EE emails to any Gmail inbox in the coming weeks and to any email inbox later this year. --------------------------------------------- https://thehackernews.com/2025/04/enterprise-gmail-users-can-now-send-end.h… ∗∗∗ Administrative Windows Shares (C$, ADMIN$) mit Revoke-SmbShareAccess absichern ∗∗∗ --------------------------------------------- Windows erstellt standardmäßig spezielle, versteckte Freigaben (z. B. C$, ADMIN$, IPC$) für den Remote-Zugriff von Administratoren. Diese sind im Explorer grundsätzlich nicht sichtbar (ausgeblendet), können aber z.B. mittels folgendem PowerShell-CmdLet angezeigt werden: Was vielen nicht bewusst ist: Auch interaktiv angemeldet Benutzer (ohne Administrator-Rechte) können auf diese administrativen Freigaben lokal zugreifen ... --------------------------------------------- https://hitco.at/blog/administrative-windows-shares-c-admin-mit-revoke-smbs… ∗∗∗ Konzert der Lieblingsband ausverkauft? Vorsicht vor Fake-Angeboten auf Facebook! ∗∗∗ --------------------------------------------- Egal ob Superstars in riesigen Arenen oder interessante Newcomer in kleinen Clubs – Musik zieht Menschen an. Ist das Konzert der Lieblingsband allerdings ausverkauft, ist guter Rat teuer – und Vorsicht geboten! Betrüger:innen nutzen besonders die Anonymität sozialer Medien und locken dort Musikfans auf der Suche nach Tickets in die Falle. Woran die Fake-Angebote zu erkennen sind und wann unbedingt eine Anzeige bei der Polizei nötig ist. --------------------------------------------- https://www.watchlist-internet.at/news/lieblingsband-ausverkauft-faketicket… ∗∗∗ European Commission takes aim at end-to-end encryption and proposes Europol become an EU FBI ∗∗∗ --------------------------------------------- The Commission said it would create roadmaps regarding both the “lawful and effective access to data for law enforcement” and on encryption. --------------------------------------------- https://therecord.media/european-commission-takes-aim-encryption-europol-fb… ∗∗∗ Deutsche Industrie warnt vor Ende des EU-US-Datentransfer-Abkommens ∗∗∗ --------------------------------------------- Der Datentransfer in die US-Cloud oder zu US-Unternehmen von Daten europäischer Nutzer ist durch ein Abkommen zwischen der EU und den USA geregelt. Nun droht dieses Abkommen durch die USA gekippt zu werden – und deutsche Unternehmen geraten dadurch in arge Probleme, wenn sie auf US-Tech-Produkte und die Cloud gesetzt haben. Verbände "warnen vor dem Ende des Abkommens" – die europäischen Cloud-Anbieter (CISPE) sehen aber eine Chance, in Europa digital souverän zu werden. --------------------------------------------- https://www.borncity.com/blog/2025/04/02/deutsche-industrie-zittert-vor-end… ∗∗∗ Jailbreaking Every LLM With One Simple Click ∗∗∗ --------------------------------------------- In the past two years, large language models (LLMs), especially chatbots, have exploded onto the scene. Everyone and their grandmother are using them these days. Generative AI is pervasive in movies, academic papers, legal briefs and much more. There is intense competition among major players, ranging from closed-model vendors such as OpenAI, Anthropic, Google and xAI to open-source providers like Meta, Mistral, Alibaba and DeepSeek. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/jailbreaking-every-… ∗∗∗ Heightened In-The-Wild Activity On Key Technologies Observed On March 28 ∗∗∗ --------------------------------------------- On March 28, GreyNoise observed a significant spike in activity targeting multiple edge technologies, including SonicWall, Zoho, Zyxel, F5, Linksys, and Ivanti systems. While some of these technologies are edge systems, others are primarily internal management tools. --------------------------------------------- https://www.greynoise.io/blog/heightened-in-the-wild-activity-key-technolog… ∗∗∗ Tomcat in the Crosshairs: New Research Reveals Ongoing Attacks ∗∗∗ --------------------------------------------- News headlines reported that it took just 30 hours for attackers to exploit a newly discovered vulnerability in Apache Tomcat servers. But what does this mean for workloads relying on Tomcat? Aqua Nautilus researchers discovered a new attack campaign targeting Apache Tomcat. In this blog, we shed light on newly discovered malware that targets Tomcat servers to hijack resources. --------------------------------------------- https://blog.aquasec.com/new-campaign-against-apache-tomcat ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr, jetty9, openjpeg2, and tomcat9), Fedora (dokuwiki, firefox, php-kissifrot-php-ixr, php-phpseclib3, and rust-zincati), Red Hat (kernel and pki-core), Slackware (mozilla), SUSE (apparmor, atop, docker, docker-stable, firefox, govulncheck-vulndb, libmodsecurity3, openvpn, upx, and warewulf4), and Ubuntu (inspircd, linux, linux-aws, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oem-6.8, linux-oracle, linux-oracle-6.8, linux-aws, linux-aws-5.4, linux-aws-fips, linux-azure-6.8, linux-hwe-6.8, linux-raspi, linux-realtime, nginx, phpseclib, and vim). --------------------------------------------- https://lwn.net/Articles/1016205/ ∗∗∗ Sicherheitsupdates: Netzwerkmonitoringtool Zabbix bietet Angriffsfläche ∗∗∗ --------------------------------------------- Fünf Sicherheitslücken gefährden Computer, auf denen Zabbix installiert ist. [..] Am gefährlichsten gilt eine Schwachstelle (CVE-2024-36465 "hoch") in Zabbix API. Hier könnte ein Angreifer mit einem regulären Nutzerkonto ansetzen, um eigene SQL-Befehle auszuführen. Außerdem sind Reflected-XSS-Attacken (CVE-2024-45699 "hoch") möglich. Über diesen Weg können Angreifer Schadcode in Form einer JavaScript-Payload ausführen. --------------------------------------------- https://heise.de/-10337461 ∗∗∗ VMware Aria Operations: Sicherheitslücke erlaubt Rechteausweitung ∗∗∗ --------------------------------------------- In einer Sicherheitsmitteilung erörtern die VMware-Entwickler die Schwachstelle. Demnach wurde in einer "Responsible Disclosure" eine lokale Rechteausweitungslücke an VMware gemeldet. "Bösartige Akteure können ihre Rechte zu 'root' auf der Appliance ausweiten, auf der VMware Aria Operations läuft", erklärt das Unternehmen (CVE-2025-22231, CVSS 7.8, Risiko "hoch"). --------------------------------------------- https://heise.de/-10336721 ∗∗∗ VPN-Lücken in HPE Aruba Networking Virtual Intranet Access Client geschlossen ∗∗∗ --------------------------------------------- In einer Warnmeldung führen die Entwickler aus, dass der VIA-Client bis inklusive Version 4.7.0 verwundbar ist. Sie geben an, in der Ausgabe 4.7.2 zwei Sicherheitslücken (CVE-2024-3661 "hoch", CVE-2025-25041 "hoch") geschlossen zu haben. --------------------------------------------- https://heise.de/-10336851 ∗∗∗ Rockwell Automation Lifecycle Services with Veeam Backup and Replication ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-091-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.04.2025
by Daily end-of-shift report 01 Apr '25

01 Apr '25

===================== = End-of-Day report = ===================== Timeframe: Montag 31-03-2025 18:00 − Dienstag 01-04-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Lucid PhaaS Hits 169 Targets in 88 Countries Using iMessage and RCS Smishing ∗∗∗ --------------------------------------------- A new sophisticated phishing-as-a-service (PhaaS) platform called Lucid has targeted 169 entities in 88 countries using smishing messages propagated via Apple iMessage and Rich Communication Services (RCS) for Android. Lucids unique selling point lies in its weaponizing of legitimate communication platforms to sidestep traditional SMS-based detection mechanisms. --------------------------------------------- https://thehackernews.com/2025/04/lucid-phaas-hits-169-targets-in-88.html ∗∗∗ Rechnung ohne Auftrag: Betreiber gefälschter Firmenverzeichnisse versenden Mahnungen ∗∗∗ --------------------------------------------- Fake-Portale nehmen Unternehmen ohne deren Wissen in ihr Firmenverzeichnis auf und stellen anschließend per E-Mail eine Rechnung zu. Diese Schreiben sorgen für Verunsicherung, sind grundsätzlich aber substanzlos. Wer keine Registrierung beantragt hat, muss auch nichts bezahlen. --------------------------------------------- https://www.watchlist-internet.at/news/rechnungen-fake-firmenverzeichnisse/ ∗∗∗ Hacker Claims Breach of Check Point Cybersecurity Firm, Sells Access ∗∗∗ --------------------------------------------- Hacker claims breach of Israeli cybersecurity firm Check Point, offering network access and sensitive data for sale; company denies any recent incident. --------------------------------------------- https://hackread.com/hacker-breach-check-point-cybersecurity-firm-access/ ∗∗∗ Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats ∗∗∗ --------------------------------------------- Over the last 30 days, nearly 24,000 unique IP addresses have attempted to access these portals. The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation. --------------------------------------------- https://www.greynoise.io/blog/surge-palo-alto-networks-scanner-activity ∗∗∗ CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims ∗∗∗ --------------------------------------------- Wiz Threat Research identified a new variant of an ongoing malicious campaign targeting misconfigured and publicly exposed PostgreSQL servers. [..] Based on our analysis, the threat actor is assigning a unique mining worker to each victim. --------------------------------------------- https://www.wiz.io/blog/postgresql-cryptomining ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Backports Critical Fixes for 3 Recent 0-Days Impacting Older iOS and macOS Devices ∗∗∗ --------------------------------------------- Apple on Monday backported fixes for three vulnerabilities that have come under active exploitation in the wild to older models and previous versions of the operating systems. The vulnerabilities in question are listed below -CVE-2025-24085 (CVSS score: 7.3) --------------------------------------------- https://thehackernews.com/2025/04/apple-backports-critical-fixes-for-3.html ∗∗∗ Apple security releases ∗∗∗ --------------------------------------------- Safari 18.4, Xcode 16.3, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, iOS 16.7.11 and iPadOS 16.7.11, iOS 15.8.4 and iPadOS 15.8.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4 --------------------------------------------- https://support.apple.com/en-us/100100 ∗∗∗ CVE-2025-22398: Dell Unity Hit by 9.8 CVSS Root-Level Command Injection Flaw ∗∗∗ --------------------------------------------- Dell has released a security update for Unity OS version 5.4 and earlier, addressing a set of critical vulnerabilities that expose the popular enterprise storage systems—Unity, UnityVSA, and Unity XT—to unauthenticated remote command execution, file deletion, open redirects, and privilege escalation. --------------------------------------------- https://securityonline.info/cve-2025-22398-dell-unity-hit-by-9-8-cvss-root-… ∗∗∗ Websites kompromittierbar: Lücken in WordPress-Plug-in WP Ultimate CSV Importer ∗∗∗ --------------------------------------------- In einem Bericht warnen Sicherheitsforscher von Wordfence vor zwei Schwachstellen (CVE-2025-2007 "hoch", CVE-2025-2008 "hoch"). In beiden Fällen können entfernte Angreifer aufgrund unzureichender Überprüfungen Schadcode auf Websites laden und ausführen. Dafür müssen sie aber bereits authentifiziert sein (Subscriber-Level). [..] Ein Sicherheitspatch steht zum Download. --------------------------------------------- https://www.heise.de/news/Websites-kompromittierbar-Luecken-in-WordPress-Pl… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (freetype, grub2, kernel, kernel-rt, and python-jinja2), Debian (freetype, linux-6.1, suricata, tzdata, and varnish), Fedora (mingw-libxslt and qgis), Mageia (elfutils, mercurial, and zvbi), Oracle (grafana, kernel, libxslt, nginx:1.22, and postgresql:12), Red Hat (opentelemetry-collector), SUSE (corosync, opera, and restic), and Ubuntu (aom, libtar, mariadb, ovn, php7.4, php8.1, php8.3, rabbitmq-server, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/1016076/ ∗∗∗ Reparierter Sicherheitspatch schließt Schadcode-Lücke in IBM App Connect ∗∗∗ --------------------------------------------- Die Schwachstelle (CVE-2025-1302 "kritisch") betrifft das jsonpath-plus-Modul zum Verarbeiten von JSON-Konfigurationen. [..] Das wurde schon mal gepatcht, das Sicherheitsupdate war aber unvollständig. Nun haben die Entwickler einen reparierten Patch veröffentlicht. --------------------------------------------- https://heise.de/-10335184 ∗∗∗ Mozilla: Security Vulnerabilities fixed in Thunderbird ESR 128.9 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-24/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Thunderbird 137 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-23/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Firefox ESR 128.9 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-22/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Firefox ESR 115.22 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-21/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Firefox 137 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-20/ ∗∗∗ Canon CVE-2025-1268 Vulnerability: A Buffer Overflow Threatening Printer Security ∗∗∗ --------------------------------------------- https://thecyberexpress.com/canon-printer-vulnerability-cve-2025-1268/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.03.2025
by Daily end-of-shift report 31 Mar '25

31 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-03-2025 18:00 − Montag 31-03-2025 18:00 Handler: Felician Fuchs Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ New Crocodilus malware steals Android users’ crypto wallet keys ∗∗∗ --------------------------------------------- A newly discovered Android malware dubbed Crocodilus tricks users into providing the seed phrase for the cryptocurrency wallet using a warning to back up the key to avoid losing access. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-crocodilus-malware-steal… ∗∗∗ Smoked out - Emmenhtal spreads SmokeLoader malware ∗∗∗ --------------------------------------------- We observed a malicious campaign targeting First Ukrainian International Bank (pumb[.]ua) and noticed the usage of a stealthy malware loader known as Emmenhtal [..] also referred to by Google as Peaklight. --------------------------------------------- https://feeds.feedblitz.com/~/915916022/0/gdatasecurityblog-en~Smoked-out-E… ∗∗∗ Hidden Malware Strikes Again: Mu-Plugins Under Attack ∗∗∗ --------------------------------------------- Recently, we’ve uncovered multiple cases where threat actors are leveraging the mu-plugins directory to hide malicious code. This approach represents a concerning trend, as the mu-plugins (Must-Use plugins) are not listed in the standard WordPress plugin interface, making them less noticeable and easier for users to ignore during routine security checks. --------------------------------------------- https://blog.sucuri.net/2025/03/hidden-malware-strikes-again-mu-plugins-und… ∗∗∗ BlackLock Ransomware Exposed After Researchers Exploit Leak Site Vulnerability ∗∗∗ --------------------------------------------- In whats an instance of hacking the hackers, threat hunters have managed to infiltrate the online infrastructure associated with a ransomware group called BlackLock, uncovering crucial information about their modus operandi in the process. --------------------------------------------- https://thehackernews.com/2025/03/blacklock-ransomware-exposed-after.html ∗∗∗ BSI-Studie: Zahlreiche Schwachstellen in Krankenhausinformationssystemen ∗∗∗ --------------------------------------------- IT-Sicherheitsforscher haben im BSI-Auftrag IT-Systemen für Kliniken auf den Zahn gefühlt und Lücken gefunden, etwa bei Verschlüsselung und Zertifikaten. --------------------------------------------- https://www.heise.de/news/BSI-Studie-Zahlreiche-Schwachstellen-in-Krankenha… ∗∗∗ Backdoor in the Backplane. Doing IPMI security better ∗∗∗ --------------------------------------------- IPMI remains a powerful but dangerously overlooked protocols in many enterprise environments. Whilst its ability to manage out of band systems is invaluable, there are significant security trade-offs – especially when outdated firmware, default credentials, and exposed interfaces are in play. As demonstrated, IPMI can lead, or aid, in a malicious actor compromising the full domain with little more than network access. --------------------------------------------- https://www.pentestpartners.com/security-blog/backdoor-in-the-backplane-doi… ∗∗∗ Preparing for the EU Radio Equipment Directive security requirements ∗∗∗ --------------------------------------------- UK & EU IoT manufacturers have more security regulation coming. [..] From 1st August 2025, mandatory cybersecurity requirements come into effect under the EU’s Radio Equipment Directive (2014/53/EU), or RED. --------------------------------------------- https://www.pentestpartners.com/security-blog/preparing-for-the-eu-radio-eq… ∗∗∗ Oracle Health gehackt, US-Patientendaten abgeflossen ∗∗∗ --------------------------------------------- Cyberkriminelle sind laut Berichten nach dem 22. Januar 2025 in die Server des US-Tech-Unternehmens Cerner Oracle Health eingedrungen. Es besteht der Verdacht, dass Patientendaten von US-Bürgern abgezogen wurden. Das FBI untersucht den Vorfall, der Fragen nach der Sicherheit bei Oracle aufkommen lässt. Denn es ist der zweite Sicherheitsvorfall binnen weniger Tage, der bekannt wird. --------------------------------------------- https://www.borncity.com/blog/2025/03/30/oracle-health-gehackt-us-patienten… ∗∗∗ SVG Phishing Malware Being Distributed with Analysis Obstruction Feature ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) recently identified a phishing malware being distributed in Scalable Vector Graphics (SVG) format. --------------------------------------------- https://asec.ahnlab.com/en/87078/ ∗∗∗ Oracle attempt to hide serious cybersecurity incident from customers in Oracle SaaS service ∗∗∗ --------------------------------------------- Being a provider of cloud SaaS (Software-as-a-service) solutions requires certain cybersecurity responsibilities — including being transparent and open. The moment where this is tested at Oracle has arrived, as they have a serious cybersecurity incident playing out in a service they manage for customers. --------------------------------------------- https://doublepulsar.com/oracle-attempt-to-hide-serious-cybersecurity-incid… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (amd64-microcode, flatpak, intel-microcode, libdata-entropy-perl, librabbitmq, and vim), Fedora (augeas, containerd, crosswords-puzzle-sets-xword-dl, libssh2, libxml2, nodejs-nodemon, and webkitgtk), Red Hat (libreoffice and python-jinja2), SUSE (389-ds, apparmor, corosync, docker, docker-stable, erlang26, exim, ffmpeg-4, govulncheck-vulndb, istioctl, matrix-synapse, mercurial, openvpn, python3, rke2, and skopeo), and Ubuntu (ansible, linux, linux-hwe-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-azure-fips, linux-gcp-fips, linux-fips, linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-realtime, linux-intel-iot-realtime, linux-xilinx-zynqmp, opensc, and ruby-doorkeeper). --------------------------------------------- https://lwn.net/Articles/1015968/ ∗∗∗ IBM InfoSphere Information Server: Unbefugte Zugriffe möglich ∗∗∗ --------------------------------------------- Die Datenintegrationsplattform IBM InfoSphere Information Server ist verwundbar. Die Entwickler haben mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/news/IBM-InfoSphere-Information-Server-Unbefugte-Zugri… ∗∗∗ ZendTo NDay Vulnerability Hunting - Unauthenticated RCE in v5.24-3 <= v6.10-4 ∗∗∗ --------------------------------------------- Discovering NDay flaws in ZendTo filesharing software highlighted an interesting fact: without the issuance of CVEs, vulnerabilities can easily go unpatched. --------------------------------------------- https://projectblack.io/blog/zendto-nday-vulnerabilities/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.03.2025
by Daily end-of-shift report 28 Mar '25

28 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-03-2025 18:00 − Freitag 28-03-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Phishing-as-a-service operation uses DNS-over-HTTPS for evasion ∗∗∗ --------------------------------------------- A newly discovered phishing-as-a-service (PhaaS) operation that researchers call Morphing Meerkat, has been using the DNS over HTTPS (DoH) protocol to evade detection. -------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-as-a-service-operat… ∗∗∗ Notfallupdate: Kritische Sandbox-Lücke in Firefox und Tor-Browser entdeckt ∗∗∗ --------------------------------------------- Nicht nur Chrome-Nutzer sollten dieser Tage ihren Browser updaten. Eine aktiv ausgenutzte Sicherheitslücke betrifft auch die Windows-Version von Firefox. --------------------------------------------- https://www.golem.de/news/notfallupdate-kritische-sandbox-luecke-in-firefox… ∗∗∗ Stealing user credentials with evilginx ∗∗∗ --------------------------------------------- A malevolent mutation of the widely used nginx web server facilitates Adversary-in-the-Middle action, but there's hope. --------------------------------------------- https://news.sophos.com/en-us/2025/03/28/stealing-user-credentials-with-evi… ∗∗∗ Quick Guide to Magento Security Patches ∗∗∗ --------------------------------------------- Magento remains a popular ecommerce platform in 2025 and its security patches play a vital role in addressing vulnerabilities that could otherwise be exploited by attackers. These patches help prevent issues like data breaches, website defacement, or unauthorized access, ensuring the safety of customer data and store operations. Given the platform’s .. --------------------------------------------- https://blog.sucuri.net/2025/03/quick-guide-to-magento-security-patches.html ∗∗∗ China’s FamousSparrow flies back into action, breaches US org after years off the radar ∗∗∗ --------------------------------------------- Crew also cooked up two fresh SparrowDoor backdoor variants, says ESET The China-aligned FamousSparrow crew has resurfaced after a long period of presumed inactivity, compromising a US financial-sector trade group and a Mexican research institute. The gang also likely targeted a governmental institution in Honduras, along with other yet-to-be-identified victims. --------------------------------------------- https://www.theregister.com/2025/03/27/china_famoussparrow_back/ ∗∗∗ Storage-Appliances: Dell schließt unzählige Sicherheitslücken in Unity-Serien ∗∗∗ --------------------------------------------- Die Dell-Entwickler haben unter anderem eine 19 Jahre alte Schwachstelle in diversen Unity-Modellen geschlossen. --------------------------------------------- https://www.heise.de/news/Storage-Appliances-Dell-schliesst-unzaehlige-Sich… ∗∗∗ New security requirements adopted by HTTPS certificate industry ∗∗∗ --------------------------------------------- The Chrome Root Program launched in 2022 as part of Google’s ongoing commitment to upholding secure and reliable network connections in Chrome. We previously described how the Chrome Root Program keeps users safe, and described how the program is focused on promoting technologies and practices that strengthen the underlying .. --------------------------------------------- http://security.googleblog.com/2025/03/new-security-requirements-adopted-by… ∗∗∗ Money Laundering 101, and why Joe is worried ∗∗∗ --------------------------------------------- In this blog post, Joe covers the very basics of money laundering, how it facilitates ransomware cartels, and what the regulatory future holds for cybercrime. --------------------------------------------- https://blog.talosintelligence.com/money-laundering-101-and-why-joe-is-worr… ∗∗∗ Gamaredon campaign abuses LNK files to distribute Remcos backdoor ∗∗∗ --------------------------------------------- Cisco Talos is actively tracking an ongoing campaign, targeting users in Ukraine with malicious LNK files which run a PowerShell downloader since at least November 2024. --------------------------------------------- https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/ ∗∗∗ Obfuscation 101: Unmasking the Tricks Behind Malicious Code ∗∗∗ --------------------------------------------- “The malicious package was right in front of our eyes, but we didnt see it until it was too late.”Attackers frequently rely on obfuscation—the technique of deliberately making source code confusing and unreadable—to sneak malicious payloads past security defenses and code reviewers alike. Understanding these obfuscation techniques across .. --------------------------------------------- https://socket.dev/blog/obfuscation-101-the-tricks-behind-malicious-code ∗∗∗ NVD Concedes Inability to Keep Pace with Surging CVE Disclosures in 2025 ∗∗∗ --------------------------------------------- The National Vulnerability Database (NVD) issued a new status update on March 19, attempting to clarify the current state of its vulnerability processing pipeline. The agency says it has resumed processing new CVEs at the same rate it maintained before last year’s slowdown, but with vulnerability volumes surging, that’s no longer enough.We are currently .. --------------------------------------------- https://socket.dev/blog/nvd-backlog-crisis-deepens-amid-surging-cve-disclos… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mercurial and opensaml), Fedora (augeas, mingw-libxslt, and nodejs-nodemon), Mageia (chromium-browser-stable), Red Hat (grafana, kernel, kernel-rt, opentelemetry-collector, and podman), SUSE (apache-commons-vfs2, python3, and python36), and Ubuntu (ghostscript, linux, linux-aws, linux-azure, linux-gcp, linux-gke, linux-gkeop, linux-ibm, linux-intel-iotg, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, .. --------------------------------------------- https://lwn.net/Articles/1015718/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.03.2025
by Daily end-of-shift report 27 Mar '25

27 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 26-03-2025 18:00 − Donnerstag 27-03-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Dozens of solar inverter flaws could be exploited to attack power grids ∗∗∗ --------------------------------------------- Dozens of vulnerabilities in products from three leading makers of solar inverters, Sungrow, Growatt, and SMA, could be exploited to control devices or execute code remotely on the vendors cloud platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/dozens-of-solar-inverter-fla… ∗∗∗ Cybercrime-Tool Atlantis AIO soll automatisierte Passwort-Attacken optimieren ∗∗∗ --------------------------------------------- Dahinter stecken organisierte Profi-Verbrecher, die ihre Werkzeuge im Darknet mit Werbeanzeigen und Support anpreisen. So auch im Fall des jüngst von Sicherheitsforschern entdeckten Tools Atlantis AIO. --------------------------------------------- https://www.heise.de/news/Cybercrime-Tool-Atlantis-AIO-soll-automatisierte-… ∗∗∗ Abonnement gekündigt? Achtung: Phishing-Versuch mit Disney+! ∗∗∗ --------------------------------------------- Mit einer angeblich von Disney+ stammenden E-Mail versuchen Kriminelle ihre Opfer auf eine Fake-Loginseite zu locken. Dort fragen sie die Anmeldeinformationen des Abos und Kreditkartendaten ab. Woran Sie den Phishing-Versuch ganz einfach erkennen können, zeigen wir Ihnen hier. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-versuch-disney/ ===================== = Vulnerabilities = ===================== ∗∗∗ Backuplösung SnapCenter: Angreifer können als Admin Systeme übernehmen ∗∗∗ --------------------------------------------- Die Backupsoftware SnapCenter ist verwundbar und Angreifer können sich durch das erfolgreiche Ausnutzen einer „kritischen“ Sicherheitslücke Admin-Rechte verschaffen. In einem Beitrag zur Schwachstelle (CVE-2025-26512) führen die Entwickler aus, die Versionen 6.0.1P1 und 6.1P1 repariert zu haben. Alle vorigen Ausgaben sind attackierbar. --------------------------------------------- https://www.heise.de/news/Backuploesung-SnapCenter-Angreifer-koennen-als-Ad… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (exim), Debian (exim4, ghostscript, and libcap2), Red Hat (container-tools:rhel8), SUSE (apache-commons-vfs2, argocd-cli, azure-cli-core, buildah, chromedriver, docker-stable, ed25519-java, kernel, kubernetes1.29-apiserver, kubernetes1.30-apiserver, kubernetes1.32-apiserver, libmbedcrypto7, microcode_ctl, php7, podman, proftpd, tomcat10, and webkit2gtk3), and Ubuntu (containerd, exim4, mariadb, opensaml, and org-mode). --------------------------------------------- https://lwn.net/Articles/1015589/ ∗∗∗ Security Vulnerability fixed in Firefox 136.0.4, Firefox ESR 128.8.1, Firefox ESR 115.21.1 ∗∗∗ --------------------------------------------- Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected. --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/ ∗∗∗ Splunk: Teils hochriskante Sicherheitslecks in mehreren Produkten ∗∗∗ --------------------------------------------- Splunk hat eine Reihe an Sicherheitslücken in mehreren Produkten gemeldet. Aktualisierte Software-Pakete stehen zum Herunterladen bereit, mit denen Admins diese Sicherheitslecks stopfen können. --------------------------------------------- https://heise.de/-10330630 ∗∗∗ DSA-5888-1 ghostscript - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2025/msg00050.html ∗∗∗ ABB: Cyber Security Advisory - ABB Low Voltage DC Drives and Power Controllers CODESYS RTS Vulnerabilities ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A9494&Lan… ∗∗∗ ABB: Cyber Security Advisory - ABB ACS880 +N8010 Drives CODESYS RTS Vulnerabilities ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A9491&Lan… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (March 17, 2025 to March 23, 2025) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2025/03/wordfence-intelligence-weekly-wordpr… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.03.2025
by Daily end-of-shift report 26 Mar '25

26 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-03-2025 18:00 − Mittwoch 26-03-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ New npm attack poisons local packages with backdoors ∗∗∗ --------------------------------------------- Two malicious packages were discovered on npm (Node package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor. This way, even if the victim removes the malicious packages, the backdoor remains on their system. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local… ∗∗∗ NCSC taps influencers to make 2FA go viral ∗∗∗ --------------------------------------------- The world's biggest brands have benefited from influencer marketing for years – now the UK's National Cyber Security Centre (NCSC) has hopped on the bandwagon to preach two-factor authentication (2FA) to the masses. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/03/26/ncsc_influen… ∗∗∗ CoffeeLoader: A Brew of Stealthy Techniques ∗∗∗ --------------------------------------------- Zscaler ThreatLabz has identified a new sophisticated malware family that we named CoffeeLoader, which originated around September 2024. The purpose of the malware is to download and execute second-stage payloads while evading detection by endpoint-based security products. The malware uses numerous techniques to bypass security solutions, including a specialized packer that utilizes the GPU, call stack spoofing, sleep obfuscation, and the use of Windows fibers. --------------------------------------------- https://www.zscaler.com/blogs/security-research/coffeeloader-brew-stealthy-… ∗∗∗ Have I Been Pwned: Projektbetreiber Troy Hunt gepwned ∗∗∗ --------------------------------------------- Troy Hunt, Betreiber des Dienstes Have-I-Been-Pwned (HIBP), wurde Opfer einer Phishing-Attacke und damit selbst "Pwned". Es sind 16.627 E-Mail-Adressen der Mailingliste für den Newsletter zu Troys persönlichen Blog dadurch in unbefugte Hände abgeflossen. In einem Blog-Beitrag erklärt Hunt, wie es zu dem Vorfall kommen konnte. --------------------------------------------- https://heise.de/-10328970 ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in Kubernetes Ingress NGINX Controller - Updates verfügbar ∗∗∗ --------------------------------------------- Im Kubernetes Ingress NGINX Controller, einer Kernkomponente von Kubernetes, wurden mehrere kritische Sicherheitslücken entdeckt. Diese ermöglichen unter anderem unauthentifizierte Remote Code Execution (RCE) und unberechtigten Zugriff auf Secrets. --------------------------------------------- https://www.cert.at/de/warnungen/2025/3/kubernetes-ingress-nginx-controller… ∗∗∗ Dringend patchen: Gefährliche Zero-Day-Lücke in Chrome für Spionage ausgenutzt ∗∗∗ --------------------------------------------- Nachdem Google in seinem Webbrowser Chrome erst in der vergangenen Woche eine kritische Sicherheitslücke geschlossen hatte, legt der Konzern jetzt nochmal nach. Mit einem am Dienstag veröffentlichten Update beseitigt Google eine Schwachstelle, die bereits im Rahmen gezielter Spionageangriffe aktiv ausgenutzt wird. [..] Die Ausnutzung der als CVE-2025-2783 registrierten Chrome-Lücke wurde Mitte März von Sicherheitsforschern von Kaspersky entdeckt. [..] Den Angaben zufolge lässt sich die Sicherheitslücke durch speziell präparierte Webseiten ausnutzen, die die jeweilige Zielperson lediglich aufrufen muss. [..] Einen Bericht mit weiteren technischen Details wollen die Sicherheitsforscher zu einem späteren Zeitpunkt veröffentlichen. --------------------------------------------- https://www.golem.de/news/dringend-patchen-gefaehrliche-zero-day-luecke-in-… ∗∗∗ VMware Tools ermöglichen Rechteausweitung in VMs ∗∗∗ --------------------------------------------- In der Sicherheitsmitteilung von Broadcom erörtern die Autoren, dass aufgrund unzureichender Zugriffskontrollen die Umgehung der Authentifizierung möglich ist (CVE-2025-22230, CVSS 7.8, Risiko "hoch"). Bösartige Akteure mit nicht-administrativen Rechten in einem Windows-Gastsystem können dadurch Operationen, die höhere Zugriffsrechte benötigen, ausführen. --------------------------------------------- https://www.heise.de/-10328819 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (nginx and ruby-rack), Fedora (expat and libxslt), Mageia (bluez, dcmtk, ffmpeg, and radare2), Red Hat (container-tools:rhel8, gvisor-tap-vsock, kernel, kernel-rt, libreoffice, and podman), SUSE (buildah, forgejo, gitleaks, google-guest-agent, google-osconfig-agent, govulncheck-vulndb, grafana, helm, libxslt, php8, python-gunicorn, and python-Jinja2), and Ubuntu (freerdp2 and varnish). --------------------------------------------- https://lwn.net/Articles/1015464/ ∗∗∗ MISP v2.4.206 and v2.5.8 Released - new workflow modules, improved graph object relationship management and many other improvements ∗∗∗ --------------------------------------------- [security] Fixed stored XSS in event reports (mermaid rendering function). --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.5.8 ∗∗∗ ZDI-25-181: (0Day) Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. CVE-2025-2767 --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-181/ ∗∗∗ Huawei: Security Advisory - Authentication Bypass Vulnerability in Huawei PC Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2025/huawei-sa-20250325-… ∗∗∗ ZDI-25-180: (0Day) 70mai A510 Use of Default Password Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-180/ ∗∗∗ ZDI-25-178: (0Day) CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-178/ ∗∗∗ Inaba Denki Sangyo CHOCO TEI WATCHER mini ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.03.2025
by Daily end-of-shift report 25 Mar '25

25 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Montag 24-03-2025 18:00 − Dienstag 25-03-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Browser-in-the-Browser attacks target CS2 players Steam accounts ∗∗∗ --------------------------------------------- A new phishing campaign targets Counter-Strike 2 players utilizing Browser-in-the-Browser (BitB) attacks that display a realistic window that mimics Steams login page. --------------------------------------------- https://www.bleepingcomputer.com/news/security/browser-in-the-browser-attac… ∗∗∗ Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSH ∗∗∗ --------------------------------------------- OPKSSH (OpenPubkey SSH) is now open-sourced as part of the OpenPubkey project. --------------------------------------------- https://blog.cloudflare.com/open-sourcing-openpubkey-ssh-opkssh-integrating… ∗∗∗ Zero Day: Russische Firma zahlt für Telegram-Lücken Millionen ∗∗∗ --------------------------------------------- Die stetig wachsende Nutzerbasis macht die Plattform auch für Cyberangriffe immer interessanter. Aus diesem Grund bietet der russische Schwachstellenhändler Operation Zero mittlerweile bis zu vier Millionen US-Dollar für ungepatchte Sicherheitslücken in Telegram. --------------------------------------------- https://www.golem.de/news/zero-day-russische-firma-zahlt-millionen-fuer-tel… ∗∗∗ Achtung: Phishing-Mails im Namen des Wiener Tourismusverbands! ∗∗∗ --------------------------------------------- Aktuell kursieren E-Mails im Namen der Buchhaltung, die dazu auffordern, Rechnungen aufgrund technischer Probleme direkt per E-Mail zu senden. Vorsicht: Diese E-Mails stammen nicht von Mitarbeitenden des Wiener Tourismusverband sondern von Kriminellen! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-phishing-mails-im-namen-des-… ∗∗∗ Oracle angeblich gehackt: Nutzerdaten im Darknet zum Verkauf ∗∗∗ --------------------------------------------- Sicherheitsforscher von CloudSEK berichten, dass im Darknet sensible Daten von rund 140.000 Oracle-Kunden zum Verkauf stehen. Diese Informationen sollen aus einer Cyberattacke stammen. Dem Hard- und Softwarehersteller zufolge hat es keinen IT-Sicherheitsvorfall gegeben. --------------------------------------------- https://heise.de/-10327980 ∗∗∗ US-Behörde stoppt Gelder für Lets Encrypt und Tor ‒ Open Tech Fund wehrt sich ∗∗∗ --------------------------------------------- Nach einem Dekret von US-Präsident Trump erhält der Open Technology Fund keine Fördermittel mehr. Deswegen zieht die Organisation jetzt vor Gericht. --------------------------------------------- https://heise.de/-10328226 ∗∗∗ Fake Hiring Challenge for Developers Steals Sensitive Data ∗∗∗ --------------------------------------------- Cyble threat intelligence researchers have uncovered a GitHub repository masquerading as a hiring coding challenge that tricks developers into downloading a backdoor to steal sensitive data. [..] There is evidence that the campaign may be expanding beyond a fake hiring challenge for developers, as Cyble Research and Intelligence Labs (CRIL) researchers also found invoice-themed lures. --------------------------------------------- https://thecyberexpress.com/fake-hiring-challenge-targets-developers/ ===================== = Vulnerabilities = ===================== ∗∗∗ Notable vulnerabilities in Next.js (CVE-2025-29927) and CrushFTP ∗∗∗ --------------------------------------------- On Friday, March 21, 2025, file transfer software maker CrushFTP disclosed a new vulnerability to customers via email. While the email [...] indicates only CrushFTP v11 is affected by the still-CVE-less (as of March 25) unauthenticated port access vulnerability, the extremely sparse vendor advisory indicates that both CrushFTP v10 and v11 are affected. According to the vendor, the issue is not exploitable if customers have the DMZ function of CrushFTP in place. --------------------------------------------- https://www.rapid7.com/blog/post/2025/03/25/etr-notable-vulnerabilities-in-… ∗∗∗ RCE Vulnerabilities in k8s Ingress NGINX (9.8 CVE for ingress-nginx) ∗∗∗ --------------------------------------------- Wiz Research discovered CVE-2025-1097, CVE-2025-1098, CVE-2025-24514 and CVE-2025-1974, a series of unauthenticated Remote Code Execution vulnerabilities in Ingress NGINX Controller for Kubernetes dubbed #IngressNightmare. Exploitation of these vulnerabilities leads to unauthorized access to all secrets stored across all namespaces in the Kubernetes cluster by attackers, which can result in cluster takeover. --------------------------------------------- https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities ∗∗∗ Kubernetes: CVE-2025-1974 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/131009 ∗∗∗ Kubernetes: CVE-2025-1098 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/131008 ∗∗∗ Kubernetes: CVE-2025-1097 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/131007 ∗∗∗ Kubernetes: CVE-2025-24514 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/131006 ∗∗∗ Kubernetes: CVE-2025-24513 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/131005 ∗∗∗ Micropatches released for SCF File NTLM Hash Disclosure Vulnerability (0day) - and Free Micropatches for it ∗∗∗ --------------------------------------------- https://blog.0patch.com/2025/03/scf-file-ntlm-hash-disclosure.html ∗∗∗ Rockwell Automation 440G TLS-Z ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-03 ∗∗∗ Rockwell Automation Verve Asset Manager ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-02 ∗∗∗ ABB RMC-100 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-01 ∗∗∗ Inaba Denki Sangyo CHOCO TEI WATCHER Mini ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-084-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.03.2025
by Daily end-of-shift report 24 Mar '25

24 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-03-2025 18:00 − Montag 24-03-2025 18:00 Handler: Felician Fuchs Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ FBI warnings are true—fake file converters do push malware ∗∗∗ --------------------------------------------- The FBI is warning that fake online document converters are being used to steal peoples information and, in worst-case scenarios, lead to ransomware attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-warnings-are-true-fake-f… ∗∗∗ Cloudflare now blocks all unencrypted traffic to its API endpoints ∗∗∗ --------------------------------------------- Cloudflare announced that it closed all HTTP connections and it is now accepting only secure, HTTPS connections for api.cloudflare.com. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cloudflare-now-blocks-all-un… ∗∗∗ Trusted Signing: Hacker signieren Windows-Malware über Microsoft-Plattform ∗∗∗ --------------------------------------------- Forscher haben Malware entdeckt, die über Microsofts neue Trusted-Signing-Plattform signiert wurde. Windows-Systeme lassen sich damit leichter infizieren. --------------------------------------------- https://www.golem.de/news/trusted-signing-microsoft-dienst-zum-signieren-vo… ∗∗∗ Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories CI/CD Secrets Exposed ∗∗∗ --------------------------------------------- The supply chain attack involving the GitHub Action "tj-actions/changed-files" started as a highly-targeted attack against one of Coinbases open-source projects, before evolving into something more widespread in scope."The payload was focused on .. --------------------------------------------- https://thehackernews.com/2025/03/github-supply-chain-breach-coinbase.html ∗∗∗ Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks ∗∗∗ --------------------------------------------- A critical security flaw has been disclosed in the Next.js React framework that could be potentially exploited to bypass authorization checks under certain conditions.The vulnerability, tracked as CVE-2025-29927, carries a CVSS score of 9.1 .. --------------------------------------------- https://thehackernews.com/2025/03/critical-nextjs-vulnerability-allows.html ∗∗∗ Oracle Cloud says its not true someone broke into its login servers and stole data ∗∗∗ --------------------------------------------- Despite evidence to the contrary as alleged pilfered info goes on sale Oracle has straight up denied claims by a miscreant that its public cloud offering has been compromised and information stolen. --------------------------------------------- https://www.theregister.com/2025/03/23/oracle_cloud_customers_keys_credenti… ∗∗∗ Verfassungsschutz: Deutsche NGOs Ziel von russischen Cyberangriffen ∗∗∗ --------------------------------------------- Das Bundesamt für Verfassungsschutz hat einige zivilgesellschaftliche Organisationen alarmiert, dass sie verstärkt im Fokus russischer Cyberattacken stünden. --------------------------------------------- https://www.heise.de/news/Verfassungsschutz-warnt-NGOs-vor-zunehmenden-russ… ∗∗∗ Google Maps: Falsche Schlüsseldienste und Co. spähen Nutzer aus ∗∗∗ --------------------------------------------- Der Navigationsdienst Google Maps klagt gegen unechte Geschäfte auf seiner Plattform, die Nutzerdaten abschöpften und verkauften. --------------------------------------------- https://heise.de/-10325360 ∗∗∗ How to find Next.js on your network ∗∗∗ --------------------------------------------- On March 22nd, 2025, Next.js disclosed an authentication bypass vulnerability in the middleware layer. Exploitation is trivial and can be achieved by sending an extra HTTP header. For specifics, please see .. --------------------------------------------- https://www.runzero.com/blog/next-js/ ∗∗∗ Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927) ∗∗∗ --------------------------------------------- This weekend, the Next.js team released emergency patches addressing a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based security checks, including authentication and .. --------------------------------------------- https://socket.dev/blog/next-js-patches-critical-middleware-vulnerability -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.03.2025
by Daily end-of-shift report 21 Mar '25

21 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 20-03-2025 18:00 − Freitag 21-03-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Angreifer machen sich an Hintertür in Cisco Smart Licensing Utility zu schaffen ∗∗∗ --------------------------------------------- Wie Sicherheitsforscher berichten, fangen Angreifer derzeit an, zwei Schwachstellen in Cisco Smart Licensing Utility auszunutzen. Darüber verschaffen sie sich Zugang mit Adminrechten. Sicherheitspatches sind schon länger verfügbar. [..] Die „kritischen“ Lücken (CVE-2024-20439, CVE-2024-20440) sind seit Anfang September 2024 bekannt. --------------------------------------------- https://heise.de/-10323893 ∗∗∗ VSCode extensions found downloading early-stage ransomware ∗∗∗ --------------------------------------------- Two malicious VSCode Marketplace extensions were found deploying in-development ransomware from a remote server, exposing critical gaps in Microsofts review process. --------------------------------------------- https://www.bleepingcomputer.com/news/security/vscode-extensions-found-down… ∗∗∗ Medusa Ransomware Uses Malicious Driver to Disable Anti-Malware with Stolen Certificates ∗∗∗ --------------------------------------------- The threat actors behind the Medusa ransomware-as-a-service (RaaS) operation have been observed using a malicious driver dubbed ABYSSWORKER as part of a bring your own vulnerable driver (BYOVD) attack designed to disable anti-malware tools. --------------------------------------------- https://thehackernews.com/2025/03/medusa-ransomware-uses-malicious-driver.h… ∗∗∗ How to Avoid US-Based Digital Services—and Why You Might Want To ∗∗∗ --------------------------------------------- Amid growing concerns over Big Tech firms aligning with Trump administration policies, people are starting to move their digital lives to services based overseas. Heres what you need to know. --------------------------------------------- https://www.wired.com/story/trump-era-digital-expat/ ∗∗∗ Fake-Shops wie eu.stanlaystore.com locken mit günstigen Stanley Cups ∗∗∗ --------------------------------------------- Stanley Cups gehören aktuell zu den beliebtesten Thermoskannen auf dem Markt. Leider machen sich auch Kriminelle die hohe Nachfrage zunutze und bieten die trendigen Becher in Fake-Shops an. Wie zum Beispiel die Website eu.stanlaystore.com, die mit unschlagbar günstigen Preisen lockt. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-wie-eustanlaystorecom-loc… ∗∗∗ Achtung Phishing: So funktioniert der neue Debitkarten-Betrug ∗∗∗ --------------------------------------------- Kriminelle versenden derzeit vermehrt gefälschte E-Mails im Namen der Erste Bank. Darin wird behauptet, dass Ihre Debitkarte veraltet sei und Sie eine neue Karte beantragen müssen. Mit dieser Betrugsmasche versuchen Kriminelle, an Ihre Debitkarte samt PIN zu gelangen! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-phishing-so-funktioniert-der… ∗∗∗ GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment (Updated 3/21) ∗∗∗ --------------------------------------------- Updated March 20: The recent compromise of the GitHub action tj-actions/changed-files and additional actions within the reviewdog organization has captured the attention of the GitHub community, marking another major software supply chain attack. Our team conducted an in-depth investigation into this incident and uncovered many more details about how the attack occurred and its timeline. [..] Our team also discovered that the initial attack targeted Coinbase. The payload was focused on exploiting the public CI/CD flow of one of their open source projects – agentkit, probably with the purpose of leveraging it for further compromises. However, the attacker was not able to use Coinbase secrets or publish packages. --------------------------------------------- https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ ∗∗∗ Major web services go dark in Russia amid reported Cloudflare block ∗∗∗ --------------------------------------------- Website outages were observed across Russia this week, with regulators attributing them to issues with foreign servers. Observers said the problems might be tied to Russian government moves to block Cloudflare services. --------------------------------------------- https://therecord.media/russia-websites-dark-reported-cloudflare-block ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability in NAKIVO Backup ＆ Replication ∗∗∗ --------------------------------------------- A vulnerability has been discovered in NAKIVO Backup ＆ Replication 10.11.3.86570 and earlier. [..] We have already removed the affected versions from App Center and requested NAKIVO to provide a fixed version as soon as possible. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-25-08 ∗∗∗ Siemens: SSA-656895 V1.2 (Last Update: 2025-03-20): Open Redirect Vulnerability in Teamcenter ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-656895.html ∗∗∗ [R1] Nessus Agent Version 10.8.3 Fixes One Vulnerability ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-02 ∗∗∗ F5: K000150484: Apache Tomcat vulnerability CVE-2025-24813 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000150484 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.03.2025
by Daily end-of-shift report 20 Mar '25

20 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 19-03-2025 18:00 − Donnerstag 20-03-2025 18:00 Handler: Felician Fuchs Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ HellCat hackers go on a worldwide Jira hacking spree ∗∗∗ --------------------------------------------- Swiss global solutions provider Ascom has confirmed a cyberattack on its IT infrastructure as a hacker group known as Hellcat targets Jira servers worldwide using compromised credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hellcat-hackers-go-on-a-worl… ∗∗∗ Six Governments Likely Use Israeli Paragon Spyware to Hack IM Apps and Harvest Data ∗∗∗ --------------------------------------------- The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are likely customers of spyware developed by Israeli company Paragon Solutions, according to a new report from The Citizen Lab. [..] In these attacks, targets were added to a WhatsApp group, and then sent a PDF document, which is subsequently parsed automatically to trigger the now-patched zero-day vulnerability and load the Graphite spyware. --------------------------------------------- https://thehackernews.com/2025/03/six-governments-likely-use-israeli.html ∗∗∗ Phishing-Versuche im Namen der Oberbank – „Bitte aktualisieren Sie Ihre persönlichen Informationen“ ∗∗∗ --------------------------------------------- Mit Fake-SMS-Nachrichten versuchen Kriminelle gerade verstärkt, Opfer auf gefälschte Kundenportale der Oberbank zu leiten. Ziel der Phishing-Attacke sind sensible Bankdaten. Hier erfahren Sie, wie der Betrugsversuch abläuft und wie Sie den Fake erkennen. Außerdem erklären wir, was Sie tun können, falls Sie Ihre persönlichen Informationen bereits an die Betrüger:innen übermittelt haben. --------------------------------------------- https://www.watchlist-internet.at/news/persoenlichen-informationen-phishing… ∗∗∗ Presseaussendung: Fake-Shops, Produktpiraterie und Co. als Bedrohung für den österreichischen Onlinehandel ∗∗∗ --------------------------------------------- Fake-Shops, Markenfälschungen, Produktpiraterie oder Verletzungen des geistigen Eigentums: Die Bedrohungen im E-Commerce sind vielfältig und können für österreichische Unternehmer:innen nicht nur zu finanziellen Verlusten durch betrügerische Konkurrenz führen, sondern auch das Vertrauen der Kund:innen in den Online-Handel als Ganzes untergraben. --------------------------------------------- https://www.watchlist-internet.at/news/presseaussendung-bedrohungen-fuer-de… ∗∗∗ UK sets timeline for country’s transition to quantum-resistant encryption ∗∗∗ --------------------------------------------- The U.K. National Cyber Security Centre issued new guidance to help organizations transition to cryptographic algorithms and protocols that can protect data threatened by quantum computing. --------------------------------------------- https://therecord.media/uk-ncsc-quantum-resistant-algorithms-transition ===================== = Vulnerabilities = ===================== ∗∗∗ WordPress security plugin WP Ghost vulnerable to remote code execution bug ∗∗∗ --------------------------------------------- Popular WordPress security plugin WP Ghost is vulnerable to a critical severity flaw that could allow unauthenticated attackers to remotely execute code and hijack servers. [..] The flaw, tracked as CVE-2025-26909, impacts all versions of WP Ghost up to 5.4.01 and stems from insufficient input validation in the 'showFile()' function. Exploiting the flaw could allow attackers to include arbitrary files via manipulated URL paths. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wordpress-security-plugin-wp… ∗∗∗ Google warnt: Kritische Sicherheitslücke in Chrome gefährdet Nutzer ∗∗∗ --------------------------------------------- Google hat wichtige Sicherheitsupdates für seinen Webbrowser Chrome veröffentlicht. [..] Mit Details zu der als CVE-2025-2476 registrierten Schwachstelle hält sich Google in seiner Versionsankündigung aus Sicherheitsgründen noch zurück. --------------------------------------------- https://www.golem.de/news/google-warnt-kritische-sicherheitsluecke-in-chrom… ∗∗∗ Veeam Backup & Replication RCE-Schwachstelle CVE-2025-23120 ∗∗∗ --------------------------------------------- Nutzer von Veeam Backup & Replication müssen reagieren. Der Anbieter Veeam hat zum 19. März 2025 über eine Remote Code Execution (RCE) Schwachstelle CVE-2025-23120 in verschiedenen Versionen des genannten Produkts informiert. Es gibt Sicherheitsupdates, um diese Schwachstelle zu schließen. --------------------------------------------- https://www.borncity.com/blog/2025/03/19/veeam-backup-replication-rce-schwa… ∗∗∗ ZDI-25-175: (0Day) Luxion KeyShot USDC File Parsing Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-175/ ∗∗∗ ZDI-25-174: (0Day) Luxion KeyShot DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-174/ ∗∗∗ Schwerwiegende Sicherheitslücken bedrohen Serverbetriebssystem IBM AIX ∗∗∗ --------------------------------------------- https://www.heise.de/news/Schwerwiegende-Sicherheitsluecken-bedrohen-Server… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2025-0002 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2025-0002.html ∗∗∗ SMA Sunny Portal ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-079-04 ∗∗∗ Santesoft Sante DICOM Viewer Pro ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-079-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.03.2025
by Daily end-of-shift report 19 Mar '25

19 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 18-03-2025 18:00 − Mittwoch 19-03-2025 18:00 Handler: Alexander Riepl Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Malicious Android Vapor apps on Google Play installed 60 million times ∗∗∗ --------------------------------------------- Over 300 malicious Android applications downloaded 60 million items from Google Play acted as adware or attempted to steal credentials and credit card information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-android-vapor-apps… ∗∗∗ Why its time for phishing prevention to move beyond email ∗∗∗ --------------------------------------------- While phishing has evolved, email security hasnt kept up. Attackers now bypass MFA & detection tools with advanced phishing kits, making credential theft harder to prevent. Learn how Push Securitys browser-based security stops attacks as they happen. --------------------------------------------- https://www.bleepingcomputer.com/news/security/why-its-time-for-phishing-pr… ∗∗∗ iOS-Nutzer gefährdet: Phishing-Lücke in Passwords-App erst nach Monaten gepatcht ∗∗∗ --------------------------------------------- Apples Passwords-App hat Weiterleitungen zur Passwortänderung über unsicheres HTTP abgewickelt. Angreifer hätten auf Phishingseiten umleiten können. --------------------------------------------- https://www.golem.de/news/unsicheres-http-ios-nutzer-durch-phishing-luecke-… ∗∗∗ Malware im Anmarsch: Ungepatchte Windows-Lücke wird seit 8 Jahren ausgenutzt ∗∗∗ --------------------------------------------- Hacker nutzen die Schwachstelle schon mindestens seit 2017 aus. Ein Patch ist bisher nicht in Sicht. Auch Ziele in Deutschland sind bereits attackiert worden. --------------------------------------------- https://www.golem.de/news/malware-im-anmarsch-ungepatchte-windows-luecke-wi… ∗∗∗ Arcane stealer: We want all your data ∗∗∗ --------------------------------------------- The new Arcane stealer spreads via YouTube and Discord, collecting data from many applications, including VPN and gaming clients, network utilities, messaging apps, and browsers. --------------------------------------------- https://securelist.com/arcane-stealer/115919/ ∗∗∗ Announcing OSV-Scanner V2: Vulnerability scanner and remediation tool for open source ∗∗∗ --------------------------------------------- Today, were thrilled to announce the launch of OSV-Scanner V2.0.0, following the announcement of the beta version. This V2 release builds upon the foundation we laid with OSV-SCALIBR and adds significant new capabilities .. --------------------------------------------- https://security.googleblog.com/2025/03/announcing-osv-scanner-v2-vulnerabi… ∗∗∗ Buying browser extensions for fun and profit ∗∗∗ --------------------------------------------- Your browser extensions could be secretly sold to malicious actors without your knowledge. What starts as helpful tools created by passionate developers can transform into dangerous spyware when sold to the highest bidder. As these extensions grow to hundreds of thousands of users, their creators—overwhelmed by maintenance and lacking .. --------------------------------------------- https://secureannex.com/blog/buying-browser-extensions/ ∗∗∗ Which passwords are attackers using against RDP ports right now? ∗∗∗ --------------------------------------------- The Specops research team has been analyzing 15 million passwords being used to attack RDP ports, in live attacks happening against networks right now. Our team have found the ten most common passwords attackers are using and analyzed their wordlists for the most common complexity rules and password lengths. We shared the results of a .. --------------------------------------------- https://specopssoft.com/blog/passwords-used-in-attacking-rdp-ports/ ∗∗∗ AMOS and Lumma stealers actively spread to Reddit users ∗∗∗ --------------------------------------------- Reddit users from trading and crypto subreddits are being lured into installing malware disguised as premium cracked software. --------------------------------------------- https://www.malwarebytes.com/blog/scams/2025/03/amos-and-lumma-stealers-act… ∗∗∗ Website-Kidnapping: So schützen Sie Ihre Website vor Hackingangriffen! ∗∗∗ --------------------------------------------- Immer öfter geraten österreichische Unternehmen ins Visier von Kriminellen, die ihre Website unbemerkt manipulieren, um Kund:innen auf Fake-Shops oder andere illegale Inhalte weiterzuleiten. Besonders gefährdet sind kleine und mittlere Unternehmen (KMU), da sie oft nicht über ausreichende IT-Sicherheitsmaßnahmen verfügen. --------------------------------------------- https://www.watchlist-internet.at/news/website-kidnapping-so-schuetzen-sie-… ∗∗∗ Russland vergiftet KI-Chatbots wie ChatGPT gezielt mit Propaganda ∗∗∗ --------------------------------------------- Rund 3,6 Millionen Artikel des russischen Pravda-Netzwerks sollen in das Trainingsmaterial westlicher KI-Systeme eingeflossen sein. So werden Fake News via KI verbreitet --------------------------------------------- https://www.derstandard.at/story/3000000261876/russland-vergiftet-ki-chatbo… ∗∗∗ The Citizen Lab’s director dissects spyware and the ‘proliferating’ market for it ∗∗∗ --------------------------------------------- In an interview with Recorded Future News, Deibert explained the technical aspects of the Citizen Lab’s methods and how spyware companies continue to evolve to evade detection. --------------------------------------------- https://therecord.media/ron-deibert-citizen-lab-spyware-interview ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-25-149: Adobe Acrobat Reader DC AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-271561. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-149/ ∗∗∗ ZDI-25-151: Progress Software Kemp LoadMaster mangle Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2025-1758. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-151/ ∗∗∗ ZDI-25-150: Microsoft Windows MSC File Insufficient UI Warning Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2025-26633. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-150/ ∗∗∗ ZDI-25-172: Apple macOS MOV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-24124. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-172/ ∗∗∗ Multiple Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based Products ∗∗∗ --------------------------------------------- Autodesk AutoCAD and certain AutoCAD-based products are affected by multiple vulnerabilities. Exploitation of these vulnerabilities can lead to code execution. Exploitation of these vulnerabilities requires user interaction. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2025-0001 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.03.2025
by Daily end-of-shift report 18 Mar '25

18 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Montag 17-03-2025 18:00 − Dienstag 18-03-2025 18:00 Handler: Alexander Riepl Co-Handler: Felician Fuchs ===================== = News = ===================== ∗∗∗ Critical AMI MegaRAC bug can let attackers hijack, brick servers ∗∗∗ --------------------------------------------- A new critical severity vulnerability found in American Megatrends Internationals MegaRAC Baseboard Management Controller (BMC) software can let attackers hijack and potentially brick vulnerable servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-ami-megarac-bug-can… ∗∗∗ StilachiRAT analysis: From system reconnaissance to cryptocurrency theft ∗∗∗ --------------------------------------------- Microsoft Incident Response uncovered a novel remote access trojan (RAT) named StilachiRAT, which demonstrates sophisticated techniques to evade detection, persist in the target environment, and exfiltrate sensitive data. This blog primarily focuses on analysis of the WWStartupCtrl64.dll module that contains the RAT capabilities and summarizes .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analys… ∗∗∗ New ‘Rules File Backdoor’ Attack Lets Hackers Inject Malicious Code via AI Code Editors ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details of a new supply chain attack vector dubbed Rules File Backdoor that affects artificial intelligence (AI)-powered code editors like GitHub Copilot and Cursor, causing them to inject malicious .. --------------------------------------------- https://thehackernews.com/2025/03/new-rules-file-backdoor-attack-lets.html ∗∗∗ Britische Hintertüren: Verdacht nach Apple auch bei Google ∗∗∗ --------------------------------------------- Britische Überwacher verlangen weltweiten Zugriff auf Apple-Backups. Apple darf das nicht bestätigen und ist damit offenbar kein Einzelfall. --------------------------------------------- https://www.heise.de/news/Auch-Google-kann-britischen-Ueberwachungsbefehl-n… ∗∗∗ FBI-Warnung: Betrügerische Online-Dateikonverter schleusen Trojaner in Dokumente ∗∗∗ --------------------------------------------- Wer kostenlose Onlinedienste zum Umwandeln von etwa Textdateien nutzt, kann sich Malware einfangen. Darauf weist das FBI hin. --------------------------------------------- https://www.heise.de/news/Malwareverteiler-FBI-warnt-vor-betruegerischen-On… ∗∗∗ Bogus ‘DeepSeek’ AI Installers Are Infecting Devices with Malware, Research Finds ∗∗∗ --------------------------------------------- In a digital landscape hungry for the next big thing in Artificial Intelligence, a new contender called DeepSeek recently burst .. --------------------------------------------- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/bogus-deepseek-ai-inst… ∗∗∗ Betrügerisches Gewinnspiel: Abofalle statt günstigem Thermomix! ∗∗∗ --------------------------------------------- Frau S. wünscht sich schon lange einen Thermomix. Bisher schreckte sie jedoch der hohe Preis der Küchenmaschine ab. Umso größer ist ihre Freude, als sie im Internet sieht, dass sie nach der Teilnahme an einer Umfrage den Thermomix für nur zwei Euro erhalten kann. Doch Vorsicht: Statt eines günstigen Thermomix erwartet sie eine teure Abofalle! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerisches-gewinnspiel-abofalle… ∗∗∗ Google-Mutter Alphabet bietet für Cybersecurity-Startup Wiz 30 Milliarden Dollar ∗∗∗ --------------------------------------------- Es wäre die größte Transaktion von Alphabet. Ein Angebot über 23 Milliarden Dollar war im Vorjahr abgelehnt worden --------------------------------------------- https://www.derstandard.at/story/3000000261775/wsj-alphabet-bietet-f252r-cy… ∗∗∗ Crypto exchange OKX shuts down tool used by North Korean hackers to launder stolen funds ∗∗∗ --------------------------------------------- OKX said it detected a coordinated effort by one of North Korea’s most prolific hacking outfits to misuse its decentralized finance (DeFi) services. --------------------------------------------- https://therecord.media/crypto-okx-shuts-down-exchange ∗∗∗ Password reuse is rampant: nearly half of observed user logins are compromised ∗∗∗ --------------------------------------------- Accessing private content online, whether it's checking email or streaming your favorite show, almost always starts with a “login” step. Beneath this everyday task lies a widespread human mistake we still have not resolved: password reuse. Many users recycle passwords across multiple services, creating a ripple effect of risk when their credentials are leaked. --------------------------------------------- https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-comprom… ∗∗∗ Offline PKI using 3 YubiKeys and an ARM single board computer ∗∗∗ --------------------------------------------- An offline PKI enhances security by physically isolating the certificate authority from network threats. A YubiKey is a low-cost solution to store a root certificate. You also need an air-gapped environment to operate the root CA. --------------------------------------------- https://vincent.bernat.ch/en/blog/2025-offline-pki-yubikeys ∗∗∗ Security Risks of Setting Access Control Allow Origin: * ∗∗∗ --------------------------------------------- Wildcard CORS: convenient or careless? What are the ACTUAL scenarios that could lead to a loose CORS policy being exploited? --------------------------------------------- https://projectblack.io/blog/security-risks-of-setting-access-control-allow… ===================== = Vulnerabilities = ===================== ∗∗∗ TYPO3-EXT-SA-2025-003: Multiple vulnerabilities in extension “[clickstorm] SEO” (cs_seo) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2025-003 ∗∗∗ TYPO3-EXT-SA-2025-002: Cross-Site Scripting in extension “Additional TCA” (additional_tca) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2025-002 ∗∗∗ Varnish Enterprise vulnerability in MSE4 when handling range requests ∗∗∗ --------------------------------------------- https://docs.varnish-software.com/security/VEV00001/ ∗∗∗ HTTP/1 client-side desync vulnerability ∗∗∗ --------------------------------------------- https://docs.varnish-software.com/security/VSV00015/ ∗∗∗ Schneider Electric EcoStruxure Power Automation System ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-077-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.03.2025
by Daily end-of-shift report 17 Mar '25

17 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 14-03-2025 18:00 − Montag 17-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Coinbase phishing email tricks users with fake wallet migration ∗∗∗ --------------------------------------------- A large-scale Coinbase phishing attack poses as a mandatory wallet migration, tricking recipients into setting up a new wallet with a pre-generated recovery phrase controlled by attackers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/coinbase-phishing-email-tric… ∗∗∗ Malicious Adobe, DocuSign OAuth apps target Microsoft 365 accounts ∗∗∗ --------------------------------------------- Cybercriminals are promoting malicious Microsoft OAuth apps that masquerade as Adobe and DocuSign apps to deliver malware and steal Microsoft 365 accounts credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-adobe-docusign-oau… ∗∗∗ Mirai Bot now incroporating (malformed?) DrayTek Vigor Router Exploits, (Sun, Mar 16th) ∗∗∗ --------------------------------------------- Last October, Forescout published a report disclosing several vulnerabilities in DrayTek routers. According to Forescount, about 700,000 devices were exposed to these vulnerabilities .. --------------------------------------------- https://isc.sans.edu/diary/Mirai+Bot+now+incroporating+malformed+DrayTek+Vi… ∗∗∗ Credit Card Skimmer and Backdoor on WordPress E-commerce Site ∗∗∗ --------------------------------------------- The battle against e-commerce malware continues to intensify, with attackers deploying increasingly sophisticated tactics. In a recent case at Sucuri, a customer reported suspicious files and unexpected behavior on their WordPress site. Upon deeper analysis, we discovered a complicated infection involving multiple components: a credit card skimmer, a .. --------------------------------------------- https://blog.sucuri.net/2025/03/credit-card-skimmer-and-backdoor-on-wordpre… ∗∗∗ Malicious PyPI Packages Stole Cloud Tokens—Over 14,100 Downloads Before Removal ∗∗∗ --------------------------------------------- Cybersecurity researchers have warned of a malicious campaign targeting users of the Python Package Index (PyPI) repository with bogus libraries masquerading as "time" related utilities, but harboring hidden functionality to steal sensitive data such as .. --------------------------------------------- https://thehackernews.com/2025/03/malicious-pypi-packages-stole-cloud.html ∗∗∗ Microsoft wouldnt look at a bug report without a video. Researcher maliciously complied ∗∗∗ --------------------------------------------- Maddening techno loop, Zoolander reference, and 14 minutes of time wasted A vulnerability analyst and prominent member of the infosec industry has blasted Microsoft for refusing to look at a bug report unless he submitted a video alongside a written explanation. --------------------------------------------- https://www.theregister.com/2025/03/17/microsoft_bug_report_troll/ ∗∗∗ Fake-Sicherheitswarnung: Betrüger versuchen Github-Konten zu kapern ∗∗∗ --------------------------------------------- Sicherheitsforscher berichten über Angriffsversuche auf rund 12.000 Github-Repositories. Dabei wollen Angreifer die volle Kontrolle über Konten erlangen. --------------------------------------------- https://www.heise.de/news/Fake-Sicherheitswarnung-Betrueger-versuchen-Githu… ∗∗∗ ClickFix: How to Infect Your PC in Three Easy Steps ∗∗∗ --------------------------------------------- A clever malware deployment scheme first spotted in targeted attacks last year has now gone mainstream. In this scam, dubbed "ClickFix," the visitor to a hacked or malicious website is asked to distinguish .. --------------------------------------------- https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three… ∗∗∗ RCS: Apple und Google einigen sich auf Ende-zu-Ende-verschlüsselte Kommunikation ∗∗∗ --------------------------------------------- Neue Version des SMS-Nachfolgers unterstützt sichere Verschlüsselung, die beiden Branchengrößen wollen das bei Android und iPhone übernehmen --------------------------------------------- https://www.derstandard.at/story/3000000261679/rcs-apple-und-google-einigen… ∗∗∗ Telegram CEO confirms leaving France amid criminal probe ∗∗∗ --------------------------------------------- The Russian-born founder and owner of the messaging app Telegram said he returned to Dubai after spending several months in France due to a criminal investigation related to activity on the app. --------------------------------------------- https://therecord.media/telegram-pavel-durov-leaves-france-amid-probe ∗∗∗ Mora_001 ransomware gang exploiting Fortinet bug spotlighted by CISA in January ∗∗∗ --------------------------------------------- Two vulnerabilities impacting Fortinet products are being exploited by a new ransomware operation with ties to the LockBit ransomware group. --------------------------------------------- https://therecord.media/mora001-ransomware-gang-exploiting-vulnerability-lo… ∗∗∗ Scammers Pose as Cl0p Ransomware to Send Fake Extortion Letters ∗∗∗ --------------------------------------------- Scammers are sending fake extortion and ransom demands while posing as ransomware gangs, including the notorious Cl0p ransomware. --------------------------------------------- https://hackread.com/scammers-pose-cl0p-ransomware-fake-extortion-letters/ ∗∗∗ BitM Up! Session Stealing in Seconds Using the Browser-in-the-Middle Technique ∗∗∗ --------------------------------------------- The Rise of Browser in the Middle (BitM): BitM attacks offer a streamlined approach, allowing attackers to quickly compromise sessions across various web applications.MFA Remains Crucial, But Not Invulnerable: .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-b… ∗∗∗ Supply Chain Security Risk: GitHub Action tj-actions/changed-files Compromised ∗∗∗ --------------------------------------------- On March 14th, 2025, security researchers discovered a critical software supply chain vulnerability in the widely-used GitHub Action tj-actions/changed-files (CVE-2025-30066). This vulnerability allows remote attackers .. --------------------------------------------- https://blog.aquasec.com/supply-chain-security-threat-github-action-tj-acti… ∗∗∗ Bypassing Authentication Like It’s The ‘90s - Pre-Auth RCE Chain(s) in Kentico Xperience CMS ∗∗∗ --------------------------------------------- I recently joined watchTowr, and it is, therefore, time - time for my first watchTowr Labs blogpost, previously teased in a tweet of a pre-auth RCE chain affecting some ‘unknown software’. Joining the team, I wanted to maintain the trail of destruction left by the watchTowr Labs team, .. --------------------------------------------- https://labs.watchtowr.com/bypassing-authentication-like-its-the-90s-pre-au… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (opensaml and php8.2), Fedora (chromium, ctk, dcmtk, expat, ffmpeg, firefox, fscrypt, gdcm, InsightToolkit, kitty, libssh2, libxml2, linux-firmware, man2html, nextcloud, OpenImageIO, php, podman-tui, python-django, python-django5, python-gunicorn, python-jinja2, python-spotipy, python3.6, qt6-qtwebengine, thunderbird, tigervnc, vim, vyper, xen, xorg-x11-server, and xorg-x11-server-Xwayland), Mageia (freetype2, ghostscript, and man2html), .. --------------------------------------------- https://lwn.net/Articles/1014437/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.03.2025
by Daily end-of-shift report 14 Mar '25

14 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 13-03-2025 18:00 − Freitag 14-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New SuperBlack ransomware exploits Fortinet auth bypass flaws ∗∗∗ --------------------------------------------- A new ransomware operator named Mora_001 is exploiting two Fortinet vulnerabilities to gain unauthorized access to firewall appliances and deploy a custom ransomware strain dubbed SuperBlack. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-superblack-ransomware-ex… ∗∗∗ Ransomware gang creates tool to automate VPN brute-force attacks ∗∗∗ --------------------------------------------- The Black Basta ransomware operation created an automated brute-forcing framework dubbed BRUTED to breach edge networking devices like firewalls and VPNs. --------------------------------------------- https://www.bleepingcomputer.com/news/security/black-basta-ransomware-creat… ∗∗∗ Jailbreaking is (mostly) simpler than you think ∗∗∗ --------------------------------------------- Today, we are sharing insights on a simple, optimization-free jailbreak method called Context Compliance Attack (CCA), that has proven effective against most leading AI systems. We are disseminating this research to promote awareness and encourage system designers to implement appropriate safeguards. --------------------------------------------- https://msrc.microsoft.com/blog/2025/03/jailbreaking-is-mostly-simpler-than… ∗∗∗ CISA: We didnt fire red teams, we just unhired a bunch of them ∗∗∗ --------------------------------------------- Agency tries to save face as it also pulls essential funding for election security initiatives Uncle Sams cybersecurity agency is trying to save face by seeking to clear up what its calling "inaccurate reporting" after a former senior pen-tester claimed the organization axed two red teams. --------------------------------------------- https://www.theregister.com/2025/03/13/cisa_red_team_layoffs/ ∗∗∗ A New Era of Attacks on Encryption Is Starting to Heat Up ∗∗∗ --------------------------------------------- The UK, France, Sweden, and EU have made fresh attacks on end-to-end encryption. Some of the attacks are more “crude” than those in recent years, experts say. --------------------------------------------- https://www.wired.com/story/a-new-era-of-attacks-on-encryption-is-starting-… ∗∗∗ Fernzugriff: Ivanti Secure Access Client als Einfallstor für Angreifer ∗∗∗ --------------------------------------------- Ein Sicherheitsupdate schließt unter Windows eine Lücke in Ivanti Secure Access Client. --------------------------------------------- https://www.heise.de/news/Fernzugriff-Ivanti-Secure-Access-Client-als-Einfa… ∗∗∗ Off the Beaten Path: Recent Unusual Malware ∗∗∗ --------------------------------------------- Three unusual malware samples analyzed here include an ISS backdoor developed in a rare language, a bootkit and a Windows implant of a post-exploit framework. --------------------------------------------- https://unit42.paloaltonetworks.com/unusual-malware/ ∗∗∗ Ransomware attack takes down health system network in Micronesia ∗∗∗ --------------------------------------------- One of the four states that make up the Pacific nation of Micronesia is battling against ransomware hackers who have forced all of the computers used by its government health agency offline. --------------------------------------------- https://therecord.media/ransomware-attack-micronesia-health-system ∗∗∗ Europes telecoms sector under increased threat from cyber spies, warns Denmark ∗∗∗ --------------------------------------------- State-sponsored cyber espionage is a bigger threat than ever to Europes telecommunications networks, according to a new assessment from Denmarks government. --------------------------------------------- https://therecord.media/europe-increased-cyber-espionage-telecoms-denmark-r… ∗∗∗ Alleged Russian LockBit developer extradited from Israel, appears in New Jersey court ∗∗∗ --------------------------------------------- Rostislav Panev, who was arrested in Israel in August 2024 on U.S. charges related to dozens of LockBit ransomware attacks, has been extradited and appeared in a New Jersey federal court, authorities said. --------------------------------------------- https://therecord.media/lockbit-alleged-russian-developer-extradited-us-isr… ∗∗∗ SocGholish’s Intrusion Techniques Facilitate Distribution of RansomHub Ransomware ∗∗∗ --------------------------------------------- Trend Research analyzed SocGholish’s MaaS framework and its role in deploying RansomHub ransomware through compromised websites, using highly obfuscated JavaScript loaders to evade detection and execute various malicious tasks. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techni… ∗∗∗ Recursion kills: The story behind CVE-2024-8176 / Expat 2.7.0 released, includes security fixes ∗∗∗ --------------------------------------------- Expat 2.7.0 has been released earlier today. I will make this a more detailed post than usual because in many ways there is more to tell about this release than the average libexpat release: there is a story this time --------------------------------------------- https://blog.hartwork.org/posts/expat-2-7-0-released/ ∗∗∗ Memory Corruption in Delphi ∗∗∗ --------------------------------------------- Our team at Include Security is often asked to examine applications coded in languages that are usually considered “unsafe”, such as C and C++, due to their lack of memory safety functionality. Critical aspects of reviewing such code include identifying where bounds-checking, input validation, and pointer handling/dereferencing are .. --------------------------------------------- https://blog.includesecurity.com/2025/03/memory-corruption-in-delphi/ ∗∗∗ My Scammer Girlfriend: Baiting A Romance Fraudster ∗∗∗ --------------------------------------------- At the beginning of the year, a spate of very similar mails appeared in my spam-box. Although originating from different addresses (and sent to different recipients), they all appeared to be the opener for the same romance scam campaign. --------------------------------------------- https://www.bentasker.co.uk/posts/blog/security/seducing-a-romance-scammer.… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-25-135: Adobe Acrobat Reader DC AcroForm Use of Uninitialized Variable Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-27162. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-135/ ∗∗∗ ZDI-25-134: Adobe Acrobat Reader DC Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-24431. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-134/ ∗∗∗ ZDI-25-133: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-27174. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-133/ ∗∗∗ ZDI-25-132: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-27159. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-132/ ∗∗∗ ZDI-25-131: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-27160. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-131/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.03.2025
by Daily end-of-shift report 13 Mar '25

13 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 12-03-2025 18:00 − Donnerstag 13-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ No Project Is an Island: Why You Need SBOMs and Dependency Management ∗∗∗ --------------------------------------------- The system you develop and maintain does not exist in isolation. Providing SBOMs for our work is our way to show we care. Software is a relatively recent phenomenon. For a long time, you could credibly say most of its existence, software was poorly understood by society and industry at large. There was .. --------------------------------------------- https://bsdly.blogspot.com/2025/03/no-project-is-island-why-you-need-sboms.… ∗∗∗ Facebook discloses FreeType 2 flaw exploited in attacks ∗∗∗ --------------------------------------------- Facebook is warning that a FreeType vulnerability in all versions up to 2.13 can lead to arbitrary code execution, with reports that the flaw has been exploited in attacks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/facebook-discloses-freetype-… ∗∗∗ Flugticketgroßhändler: Cyberangriff legt Buchungssystem von Aerticket lahm ∗∗∗ --------------------------------------------- Nach einem Hackerangriff ist das Buchungssystem von Aerticket vorerst unbrauchbar. Eine schnelle Wiederherstellung ist wohl nicht zu erwarten. --------------------------------------------- https://www.golem.de/news/flugticketgrosshaendler-cyberangriff-legt-buchung… ∗∗∗ Head Mare and Twelve join forces to attack Russian entities ∗∗∗ --------------------------------------------- We analyze the activities of the Head Mare hacktivist group, which has been attacking Russian companies jointly with Twelve. --------------------------------------------- https://securelist.com/head-mare-twelve-collaboration/115887/ ∗∗∗ Phishing campaign impersonates Booking .com, delivers a suite of credential-stealing malware ∗∗∗ --------------------------------------------- Starting in December 2024, leading up to some of the busiest travel days, Microsoft Threat Intelligence identified a phishing campaign that impersonates online travel agency Booking.com and targets organizations in the hospitality industry. The campaign uses a social engineering technique called ClickFix to deliver multiple credential-stealing malware .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-… ∗∗∗ Medusa ransomware affiliate tried triple extortion scam – up from the usual double demand ∗∗∗ --------------------------------------------- Feds warn gang still rampant and now cracked 300+ victims around the world A crook who distributes the Medusa ransomware tried to make a victim cough up three payments instead of the usual two, according to a government advisory on how to defend against the malware and the gangs who wield it. --------------------------------------------- https://www.theregister.com/2025/03/13/medusa_ransomware_infects_300_critic… ∗∗∗ DeepSeek can be gently persuaded to spit out malware code ∗∗∗ --------------------------------------------- It might need polishing, but a useful find for any budding cybercrooks out there DeepSeeks flagship R1 model is capable of generating a working keylogger and basic ransomware code, just as long as a techie is on hand to tinker with it a little. --------------------------------------------- https://www.theregister.com/2025/03/13/deepseek_malware_code/ ∗∗∗ Sicherheitslücken: Gitlab-Entwickler raten zu zügigem Update ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für die Softwareentwicklungsplattform Gitlab erschienen. --------------------------------------------- https://www.heise.de/news/Sicherheitsluecken-Gitlab-Entwickler-raten-zu-zue… ∗∗∗ Sicherheitsupdates: Root-Sicherheitslücke bedroht Cisco-ASR-Router ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat mehrere Schwachstellen geschlossen, über die Angreifer etwa ASR-Router attackieren können. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Root-Sicherheitsluecke-bedroht… ∗∗∗ Schadcode-Sicherheitslücken bedrohen FortiOS, FortiSandbox & Co. ∗∗∗ --------------------------------------------- Mehrere Produkte von Fortinet sind attackierbar. Sicherheitspatches schaffen Abhilfe. --------------------------------------------- https://www.heise.de/news/Schadcode-Sicherheitsluecken-bedrohen-FortiOS-For… ∗∗∗ Investigating Scam Crypto Investment Platforms Using Pyramid Schemes to Defraud Victims ∗∗∗ --------------------------------------------- We identified a campaign spreading thousands of sca crypto investment platforms through websites and mobile apps, possibly through a standardized toolkit. --------------------------------------------- https://unit42.paloaltonetworks.com/fraud-crypto-platforms-campaign/ ∗∗∗ #StopRansomware: Medusa Ransomware ∗∗∗ --------------------------------------------- The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Medusa ransomware TTPs and IOCs, identified through FBI investigations as recently as February 2025. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a ∗∗∗ Signal no longer cooperating with Ukraine on Russian cyberthreats, official says ∗∗∗ --------------------------------------------- The encrypted messaging app Signal has stopped responding to requests from Ukrainian law enforcement regarding Russian cyberthreats, a Ukrainian official claimed, warning that the shift is aiding Moscow’s intelligence efforts. --------------------------------------------- https://therecord.media/signal-no-longer-cooperating-with-ukraine ∗∗∗ Abusing with style: Leveraging cascading style sheets for evasion and tracking ∗∗∗ --------------------------------------------- Cascading Style Sheets (CSS) are ever present in modern day web browsing, however its far from their own use. This blog will detail the ways adversaries use CSS in email campaigns for evasion and tracking. --------------------------------------------- https://blog.talosintelligence.com/css-abuse-for-evasion-and-tracking/ ∗∗∗ Statement on CISAs Red Team ∗∗∗ --------------------------------------------- CISA’s Red Team is among the best in the world and remains laser focused on helping our federal and critical infrastructure partners identify and mitigate their most significant vulnerabilities and weaknesses. This has not changed. --------------------------------------------- https://www.cisa.gov/news-events/news/statement-cisas-red-team ∗∗∗ PCI DSS FAQ SAQ WTF BBQ... ∗∗∗ --------------------------------------------- I was trying to come up with a sensible title for this blog post, but I feel this one mirrors the thoughts and feelings of many of us about recent events in the PCI DSS compliance space! There have been some significant changes in .. --------------------------------------------- https://scotthelme.ghost.io/pci-dss-faq-saq-wtf-bbq/ ∗∗∗ Sign in as anyone: Bypassing SAML SSO authentication with parser differentials ∗∗∗ --------------------------------------------- Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0. In this blog post, well shed light on how these vulnerabilities that rely on a parser differential were uncovered. --------------------------------------------- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentic… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium), Fedora (ffmpeg, qt6-qtwebengine, tigervnc, and xorg-x11-server-Xwayland), Red Hat (fence-agents and libxml2), SUSE (amazon-ssm-agent, ark, chromium, fake-gcs-server, gerbera, google-guest-agent, google-osconfig-agent, grafana, kernel, libtinyxml2-10, podman, python311, python312, restic, ruby3.4-rubygem-rack, and thunderbird), and Ubuntu (jinja2, linux-azure, linux-azure-4.15, linux-lts-xenial, linux-nvidia, linux-nvidia-6.8, .. --------------------------------------------- https://lwn.net/Articles/1014042/ ∗∗∗ ZDI-25-129: PDF-XChange Editor RTF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-2231. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-129/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.03.2025
by Daily end-of-shift report 12 Mar '25

12 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 11-03-2025 18:00 − Mittwoch 12-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ iPhone-Nutzer attackiert: Aktiv ausgenutzte Webkit-Lücke gefährdet Apple-Geräte ∗∗∗ --------------------------------------------- Angreifer können durch die Schwachstelle aus der Web-Content-Sandbox von Webkit ausbrechen. Apple verteilt Notfallupdates für iOS, MacOS und Safari. --------------------------------------------- https://www.golem.de/news/iphone-nutzer-attackiert-aktiv-ausgenutzte-webkit… ∗∗∗ Scans for VMWare Hybrid Cloud Extension (HCX) API (Log4j - not brute forcing), (Wed, Mar 12th) ∗∗∗ --------------------------------------------- Today, I noticed increased scans for the VMWare Hyprid Cloud Extension (HCX) "sessions" endpoint. These endpoints are sometimes associated with exploit attempts for various VMWare .. --------------------------------------------- https://isc.sans.edu/diary/Scans+for+VMWare+Hybrid+Cloud+Extension+HCX+API+… ∗∗∗ Uneinheitliche Cybersicherheitsstandards: Kommunen ohne klare Strategie ∗∗∗ --------------------------------------------- Aktuell gibt es bei der IT-Sicherheit von Kommunen noch viele Mängel. Eine Studie klärt über die Defizite und mögliche Maßnahmen auf. --------------------------------------------- https://www.heise.de/news/Uneinheitliche-Cybersicherheitsstandards-Kommunen… ∗∗∗ Microsoft-Patchday: 5 kritische Windows-Lücken, 6 andere bereits ausgenutzt ∗∗∗ --------------------------------------------- Zum Patchday im März 205 veröffentlicht Microsoft Korrekturen für insgesamt 57 CVE-Einträge. Sie betreffen Windows, Office, Visual Studio, Azure und mehr. --------------------------------------------- https://www.heise.de/news/Microsoft-Patchday-5-kritische-Windows-Luecken-6-… ∗∗∗ Take control of Cache-Control and local caching ∗∗∗ --------------------------------------------- TL;DR Caching speeds up website content delivery What caching directives are and how to use them The No-cache directive does not prevent caching The No-store directive prevents caching .. --------------------------------------------- https://www.pentestpartners.com/security-blog/take-control-of-cache-control… ∗∗∗ Phishing-Falle: Es droht keine dauerhafte Deaktivierung Ihres GMX-Kontos! ∗∗∗ --------------------------------------------- Von Ihrer E-Mail-Adresse werden angeblich „falsche E-Mails“ versendet? Wenn Sie nicht innerhalb von 24 Stunden reagieren, wird ihr GMX-Konto dauerhaft deaktiviert? Keine Sorge, nichts von dem ist wahr, nichts wird passieren. Vielmehr haben Sie ein Phishing-Mail erhalten, das Sie ignorieren können und unverzüglich löschen sollten. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-deaktivierung-gmx/ ∗∗∗ Etwas Dringendes für den Chef erledigen? Vorsicht, Phishing! ∗∗∗ --------------------------------------------- Kriminelle versenden betrügerische E-Mails, in denen sie sich als Vorgesetzte ausgeben. Sie werden aufgefordert, eine dringende Aufgabe zu erledigen und auf die E-Mail zu antworten. Wir raten zur Vorsicht: Eine Antwort kann großen Schaden anrichten! Ignorieren Sie die Nachricht und informieren Sie die IT-Abteilung. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-unternehmen/ ∗∗∗ Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers ∗∗∗ --------------------------------------------- In mid 2024, Mandiant discovered threat actors deployed custom backdoors on Juniper Networks’ Junos OS routers. Mandiant attributed these backdoors to the China-nexus espionage group, UNC3886. Mandiant uncovered several TINYSHELL-based backdoors operating on Juniper Networks’ Junos OS routers. The backdoors had varying .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espion… ===================== = Vulnerabilities = ===================== ∗∗∗ iOS 18.3.2 and iPadOS 18.3.2 ∗∗∗ --------------------------------------------- /en-us/122281 ∗∗∗ macOS Sequoia 15.3.2 ∗∗∗ --------------------------------------------- /en-us/122283 ∗∗∗ visionOS 2.3.2 ∗∗∗ --------------------------------------------- /en-us/122284 ∗∗∗ Safari 18.3.1 ∗∗∗ --------------------------------------------- /en-us/122285 ∗∗∗ 2025-03 Out-of-Cycle Security Bulletin: Junos OS: A local attacker with shell access can execute arbitrary code (CVE-2025-21590) ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2025-03-Out-of-Cycle-Security-B… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.03.2025
by Daily end-of-shift report 11 Mar '25

11 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Montag 10-03-2025 18:00 − Dienstag 11-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ MassJacker malware uses 778,000 wallets to steal cryptocurrency ∗∗∗ --------------------------------------------- A newly discovered clipboard hijacking operation dubbed MassJacker uses at least 778,531 cryptocurrency wallet addresses to steal digital assets from compromised computers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/massjacker-malware-uses-778-… ∗∗∗ Google lässt Kunden im Stich: Abgelaufene SSL-Zertifikate machen Chromecast unbrauchbar ∗∗∗ --------------------------------------------- Seit zwei Tagen warten Besitzer älterer Chromecast-Modelle auf Hilfe durch Google. Wann der Fehler korrigiert wird, ist ungewiss. --------------------------------------------- https://www.golem.de/news/google-laesst-kunden-im-stich-abgelaufene-ssl-zer… ∗∗∗ DCRat backdoor returns ∗∗∗ --------------------------------------------- Kaspersky experts describe a new wave of attacks distributing the DCRat backdoor through YouTube under the guise of game cheats. --------------------------------------------- https://securelist.com/new-wave-of-attacks-with-dcrat-backdoor-distributed-… ∗∗∗ New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects ∗∗∗ --------------------------------------------- Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that infects Xcode projects, in the wild. Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies. These enhanced features help this malware .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware… ∗∗∗ What Really Happened With the DDoS Attacks That Took Down X ∗∗∗ --------------------------------------------- Elon Musk said a “massive cyberattack” disrupted X on Monday and pointed to “IP addresses originating in the Ukraine area” as the source of the attack. Security experts say thats not how it works. --------------------------------------------- https://www.wired.com/story/x-ddos-attack-march-2025/ ∗∗∗ North Korean IT Workers Linked to 2,400 Astrill VPN IP Addresses ∗∗∗ --------------------------------------------- New data has emerged linking over 2,400 IP addresses associated with Astrill VPN to individuals believed to be North Korean IT worker --------------------------------------------- https://gbhackers.com/north-korean-workers-linked-astrill-vpn-ip-addresses/ ∗∗∗ Spionage: Russland und China mit Interesse an Österreichs IT-Branche ∗∗∗ --------------------------------------------- Die Direktion Staatsschutz und Nachrichtendienst sieht Russland als "relevanten Risikoakteur". Es wird eine hohe Dunkelziffer von Vorfällen vermutet --------------------------------------------- https://www.derstandard.at/story/3000000260788/spionage-russland-und-china-… ∗∗∗ Report URI: Launching Policy Watch and other improvements! ∗∗∗ --------------------------------------------- As we continue to expand and improve our offering, one particular area of focus over recent months has been on PCI DSS Compliance. Whilst compliance might not be the first thing that many get excited about, the recent requirements introduced by the PCI SSC required some pretty solid .. --------------------------------------------- https://scotthelme.ghost.io/report-uri-launching-policy-watch-and-other-imp… ∗∗∗ In-Depth Technical Analysis of the Bybit Hack ∗∗∗ --------------------------------------------- On 21st February 2025, Bybit suffered the largest cryptocurrency theft ever recorded, with more than $1.4 billion assets, including 401,347 ETH, drained from its cold wallet. The attack compromised the transaction approval process by altering what Bybit’s signers saw when approving a cold wallet transaction, causing them to unknowingly authorize an transaction that resulted in a loss of funds. --------------------------------------------- https://www.nccgroup.com/us/research-blog/in-depth-technical-analysis-of-th… ∗∗∗ Beyond the Hook: A Technical Deep Dive into Modern Phishing Methodologies ∗∗∗ --------------------------------------------- In 2025, phishing is still the most prevalent kind of cyber attack on the planet. Indeed, 1.2% of the global email traffic is phishing. Thats 3.4 billion emails each day, but only a low number results in a compromise since "only" 3% of employees would click on a malicious link. However, when they do, it can be disastrous for their company. 91% of .. --------------------------------------------- http://blog.quarkslab.com/technical-dive-into-modern-phishing.html ∗∗∗ Reversing Samsungs H-Arx Hypervisor Framework - Part 1 ∗∗∗ --------------------------------------------- In many ways, mobile devices lead the security industry when it comes to defense-in-depth and mitigation. Over the years, it has been proven time and again that the kernel cannot be trusted to be secure. As such, there has been effort put into moving secrets (ie. encryption keys) and other sensitive data out of the kernel and gate it behind an API at higher levels in the chain of trust, whether it be the hypervisor or secure enclaves. In any case, the kernel must have a lot of control .. --------------------------------------------- https://dayzerosec.com/blog/2025/03/08/reversing-samsungs-h-arx-hypervisor-… ===================== = Vulnerabilities = ===================== ∗∗∗ Cross Site Request Forgery in admin endpoint ∗∗∗ --------------------------------------------- A cross site request forgery vulnerability [CWE-352] in FortiNDR may allow a remote unauthenticated attacker to execute unauthorized actions via crafted HTTP GET requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-353 ∗∗∗ Exposure of Sensitive Information to an Unauthorized Actor ∗∗∗ --------------------------------------------- An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiSIEM may allow a remote unauthenticated attacker who acquired knowledge of the agents authorization header by other means to read the database password via crafted api requests --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-117 ∗∗∗ OS command injection in CLI command ∗∗∗ --------------------------------------------- Multiple improper neutralization of special elements used in an OS command (OS Command Injection) vulnerabilities [CWE-78] in FortiManager CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-124 ∗∗∗ Use of hardcoded key used for remote backup server password encryption ∗∗∗ --------------------------------------------- A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-327 ∗∗∗ XSS flaw in Fortiview/SecurityLogs pages ∗∗∗ --------------------------------------------- An improper neutralization of input during web page generation (Cross-site Scripting) vulnerability [CWE-79] in FortiADC GUI may allow an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests. --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-216 ∗∗∗ [20250301] - Core - Malicious file uploads via Media Manager ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/961-20250301-core-maliciou… ∗∗∗ March Security Update ∗∗∗ --------------------------------------------- https://www.ivanti.com/blog/march-security-update -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.03.2025
by Daily end-of-shift report 10 Mar '25

10 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 07-03-2025 18:00 − Montag 10-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ FTC will send $25.5 million to victims of tech support scams ∗∗∗ --------------------------------------------- Later this week, the Federal Trade Commission (FTC) will start distributing over $25.5 million in refunds to those misled by tech support companies Restoro and Reimages scare tactics. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ftc-will-send-255-million-to… ∗∗∗ Datenschutz: Polizist ruft Daten von Frauen ab und muss Strafe zahlen ∗∗∗ --------------------------------------------- Der Polizist hat eine persönliche Attraktivitätsskala geführt und ab bestimmten Werten persönliche Daten von Frauen abgefragt. --------------------------------------------- https://www.golem.de/news/datenschutz-polizist-ruft-daten-von-frauen-ab-und… ∗∗∗ SideWinder targets the maritime and nuclear sectors with an updated toolset ∗∗∗ --------------------------------------------- In this article, we discuss the tools and TTPs used in the SideWinder APTs attacks in H2 2024, as well as shifts in its targets, such as an increase in attacks against the maritime and logistics sectors. --------------------------------------------- https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nucle… ∗∗∗ The Russia-Ukraine Cyber War Part 4: Development in Group Attributions for Russian State Actors ∗∗∗ --------------------------------------------- This is the final installment of Trustwave SpiderLabs Russia-Ukraine digital battlefield series, which has spanned topics including the differences between Russia and Ukraine cyber actors, how government entities, defense organizations, and human targets were caught in the cyber crossfire, and how both countries targeted the telecommunications, critical .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/russian-sta… ∗∗∗ Rhysida pwns two US healthcare orgs, extracts over 300K patients data ∗∗∗ --------------------------------------------- Terabytes of sensitive info remain available for download Break-ins to systems hosting the data of two US healthcare organizations led to thieves making off with the personal and medical data of more than 300,000 patients. --------------------------------------------- https://www.theregister.com/2025/03/10/rhysida_healthcare/ ∗∗∗ Strings Attached: Talking about Russias agenda for laws in cyberspace ∗∗∗ --------------------------------------------- Russias longstanding proposals for "information security" agreements may sound cooperative, but they conceal a Trojan horse - a push to legitimize censorship, silence dissent, and bind others to rules it won’t follow. --------------------------------------------- https://bytesandborscht.com/strings-attached-talking-about-russias-agenda-f… ∗∗∗ Größter Diebstahl der Geschichte: Bybit nutzte Freeware und wurde dadurch Opfer ∗∗∗ --------------------------------------------- Eine unsichere Freeware ermöglichte den Angreifern den Milliarden-Diebstahl bei Bybit. Die Probleme waren schon lang bekannt. --------------------------------------------- https://www.heise.de/news/Groesster-Diebstahl-der-Geschichte-Bybit-nutzte-F… ∗∗∗ Feds Link $150M Cyberheist to 2022 LastPass Hacks ∗∗∗ --------------------------------------------- In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents investigating a spectacular $150 million cryptocurrency heist said they had reached the same conclusion. --------------------------------------------- https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastp… ∗∗∗ Vulnerability Reward Program: 2024 in Review ∗∗∗ --------------------------------------------- In 2024, our Vulnerability Reward Program confirmed the ongoing value of engaging with the security research community to make Google and its products safer. This was evident as we awarded just shy of $12 million to over 600 researchers based in countries around the globe across all of our programs.Vulnerability Reward .. --------------------------------------------- http://security.googleblog.com/2025/03/vulnerability-reward-program-2024-in… ∗∗∗ WordPress Security Research Series: WordPress Security Architecture ∗∗∗ --------------------------------------------- Learn how WordPress security works from the inside out. A guide for vulnerability researchers on identifying flaws in WordPress core, plugins, and themes. --------------------------------------------- https://www.wordfence.com/blog/2025/03/wordpress-security-research-series-w… ∗∗∗ Scam spoofs Binance website and uses TRUMP coin as lure for malware ∗∗∗ --------------------------------------------- Researchers at phishing defense company Cofense say hackers are spreading a malicious remote access tool through a fake Binance page that offers access to the TRUMP coin. --------------------------------------------- https://therecord.media/email-scam-spoofs-binance-offers-trump-coin-connect… ∗∗∗ Navigating AI 🤝 Fighting Skynet ∗∗∗ --------------------------------------------- Using AI can be a great tool for adversarial engineering. This was just a bit of fun to see if it was possible todo and to learn more about automation but also proving you cannot trust git commit history nor can you trust dates of commits! --------------------------------------------- https://blog.zsec.uk/navigating-ai-fighting-skynet/ ∗∗∗ No, there isn’t a world ending Apache Camel vulnerability ∗∗∗ --------------------------------------------- Posts have been circulating publicly on the internet for several days about a “critical”, end of the world “zero day” in Apache Camel, CVE-2025–27636. Many of the posts explained in specific detail about how to exploit the vulnerability .. --------------------------------------------- https://doublepulsar.com/no-there-isnt-a-world-ending-apache-camel-vulnerab… ∗∗∗ GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign ∗∗∗ --------------------------------------------- ‍GreyNoise data confirms that exploitation of CVE-2024-4577 extends far beyond initial reports. Attack attempts have been observed across multiple regions, with notable spikes in the United States, Singapore, Japan, and other countries throughout January 2025. --------------------------------------------- https://www.greynoise.io/blog/mass-exploitation-critical-php-cgi-vulnerabil… ∗∗∗ How to distrust a CA without any certificate errors ∗∗∗ --------------------------------------------- A “distrust” is when a certification authority (CA) that issues HTTPS certificates to websites is removed from a root store because it is no longer trusted to issue certificates. This means certificates issued by that CA will be treated as invalid, likely causing certificate error interstitials in any browser that distrusted the .. --------------------------------------------- https://dadrian.io/blog/posts/sct-not-after/ ∗∗∗ Exploiting Neverwinter Nights ∗∗∗ --------------------------------------------- Back in 2024, we looked for vulnerabilities in Neverwinter Nights : Enhanced Edition as a side research project. We found and reported multiple vulnerabilities to the publisher Beamdog. In this article we will detail how we can chain two vulnerabilities to obtain a remote code execution in multiplayer mode. --------------------------------------------- https://www.synacktiv.com/en/publications/exploiting-neverwinter-nights.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.03.2025
by Daily end-of-shift report 07 Mar '25

07 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 06-03-2025 18:00 − Freitag 07-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cybercrime crew stole $635,000 in Taylor Swift concert tickets ∗∗∗ --------------------------------------------- New York prosecutors say that two people working at a third-party contractor for the StubHub online ticket marketplace made $635,000 after almost 1,000 concert tickets and reselling them online. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cybercrime-crew-stole-635-00… ∗∗∗ Microsoft says malvertising campaign impacted 1 million PCs ∗∗∗ --------------------------------------------- Microsoft has taken down an undisclosed number of GitHub repositories used in a massive malvertising campaign that impacted almost one million devices worldwide. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-says-malvertising-… ∗∗∗ Cyberangriff analysiert: Hacker verschlüsseln Unternehmensdaten über eine Webcam ∗∗∗ --------------------------------------------- Ein EDR-Tool hat Verschlüsselungsversuche der Ransomwaregruppe Akira erfolgreich vereitelt. Doch dann fanden die Angreifer ein Schlupfloch. --------------------------------------------- https://www.golem.de/news/cyberangriff-analysiert-hacker-verschluesseln-unt… ∗∗∗ A Deep Dive into Strela Stealer and how it Targets European Countries ∗∗∗ --------------------------------------------- Infostealers have dominated the malware landscape due to the ease of threat operations maintenance, and a wide group of potential victims. In this blog, we take a closer look at a unique infostealer designed to precisely target a narrow data set on systems located in chosen geographic locations. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/a-deep-dive… ∗∗∗ Russian State Actors: Development in Group Attributions ∗∗∗ --------------------------------------------- This is the final installment of Trustwave SpiderLabs Russia-Ukraine digital battlefield series, which has spanned topics including the differences between Russia and Ukraine cyber actors, how government entities, defense organizations, and human targets were caught in the cyber crossfire, and how both countries targeted the telecommunications, critical .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/russian-sta… ∗∗∗ A Brand New Botnet Is Delivering Record-Size DDoS Attacks ∗∗∗ --------------------------------------------- Eleven11bot infects webcams and video recorders, with a large concentration in the US. --------------------------------------------- https://www.wired.com/story/eleven11bot-botnet-record-size-ddos-attacks/ ∗∗∗ Akira-Ransomware schlüpft über Webcam an IT-Schutzlösung vorbei ∗∗∗ --------------------------------------------- Eigentlich ist das Firmennetz über eine Schutzsoftware geschützt, die auch anschlägt. Trotzdem konnte ein Trojaner über einen Umweg PCs infizieren. --------------------------------------------- https://www.heise.de/news/Akira-Ransomware-schluepft-ueber-Webcam-an-IT-Sch… ∗∗∗ Who is the DOGE and X Technician Branden Spikes? ∗∗∗ --------------------------------------------- At 49, Branden Spikes isnt just one of the oldest technologists who has been involved in Elon Musks Department of Government Efficiency (DOGE). As the current director of information technology at X/Twitter and an early hire at PayPal, Zip2, Tesla and SpaceX, Spikes is also among Musks most loyal employees. Heres a closer look at this trusted Musk lieutenant, whose Russian ex-wife was once married to Elons cousin. --------------------------------------------- https://krebsonsecurity.com/2025/03/who-is-the-doge-and-x-technician-brande… ∗∗∗ Multiple Vulnerabilities Discovered in a SCADA System ∗∗∗ --------------------------------------------- We identified multiple vulnerabilities in ICONICS Suite, SCADA software used in numerous OT applications. This article offers a technical analysis of our findings. --------------------------------------------- https://unit42.paloaltonetworks.com/vulnerabilities-in-iconics-software-sui… ∗∗∗ Russian crypto exchange Garantex’s website taken down in apparent law enforcement operation ∗∗∗ --------------------------------------------- Russian cryptocurrency exchange Garantex was taken down in an apparent seizure by U.S. and European law enforcement Thursday, shortly after the company said $28 million had been frozen by another cryptocurrency firm. --------------------------------------------- https://therecord.media/garantex-crypto-exchange-taken-down-law-enforcement… ∗∗∗ CISA, FBI warn of BianLian mail scam targeting executives with $500k ransom note ∗∗∗ --------------------------------------------- In an alert on Thursday, the FBI said scammers are mailing letters to corporate executives claiming that they stole sensitive data and will publish it unless a demand is paid in Bitcoin. --------------------------------------------- https://therecord.media/cisa-fbi-warn-bianlian-mail-scam-extortion ∗∗∗ Canadian intelligence agency warns of threat AI poses to upcoming elections ∗∗∗ --------------------------------------------- Influence and espionage campaigns, boosted by AI, are likely to be aimed at Canadas upcoming elections, says a new report from the CSE, the countrys signals and cyber intelligence agency. --------------------------------------------- https://therecord.media/canada-cyber-agency-elections-warning-ai- ∗∗∗ NixSpam RBL ab 7.3.2025 abgeschaltet – gibt Ärger – aber nun gelöst ∗∗∗ --------------------------------------------- Kurze Information für Blog-Leser die bei der Mail-Filterung auf "NixSpam RBL" gesetzt haben. Der vom heise-Verlag betriebene Dienst ist seit dem heutigen 7. März 2025 abgeschaltet, was einigen Leuten Probleme bereiten .. --------------------------------------------- https://www.borncity.com/blog/2025/03/07/nixspam-rbl-ab-7-3-2025-abgeschalt… ∗∗∗ New edu platform and Sanitization and Validation and Escaping, Oh My! article ∗∗∗ --------------------------------------------- With the beta launch of my companys educational platform (hackArcana), I finally have a place to write more about the fundamentals of security and post more educational content. The first piece Ive written for our new platform touches on the confusion around the terms "validation," "sanitization," "encoding," "escaping," .. --------------------------------------------- https://gynvael.coldwind.pl/?id=800 ∗∗∗ Microsoft Dismantles Malvertising Scam Using GitHub, Discord, Dropbox ∗∗∗ --------------------------------------------- Microsoft Threat Intelligence exposes a malvertising campaign exploiting GitHub, Discord, and Dropbox. Discover the multi-stage attack chain, .. --------------------------------------------- https://hackread.com/microsoft-dismantle-malvertising-github-discord-dropbo… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.03.2025
by Daily end-of-shift report 06 Mar '25

06 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 05-03-2025 18:00 − Donnerstag 06-03-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Massive botnet that appeared overnight is delivering record-size DDoSes ∗∗∗ --------------------------------------------- Eleven11bot infects video recorders, with the largest concentration of them in the US. --------------------------------------------- https://arstechnica.com/security/2025/03/massive-botnet-that-appeared-overn… ∗∗∗ Malicious Chrome extensions can spoof password managers in new attack ∗∗∗ --------------------------------------------- A newly devised "polymorphic" attack allows malicious Chrome extensions to morph into other browser extensions, including password managers, crypto wallets, and banking apps, to steal sensitive information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-chrome-extensions-… ∗∗∗ Trojans disguised as AI: Cybercriminals exploit DeepSeek’s popularity ∗∗∗ --------------------------------------------- Kaspersky experts have discovered campaigns distributing stealers, malicious PowerShell scripts, and backdoors through web pages mimicking the DeepSeek and Grok websites. --------------------------------------------- https://securelist.com/backdoors-and-stealers-prey-on-deepseek-and-grok/115… ∗∗∗ PayPal-Passwort wurde geändert? Achtung: Phishing-Alarm! ∗∗∗ --------------------------------------------- Aktuell machen Phishing-Mails die Runde, welche angeblich von PayPal stammen. In ihnen wird behauptet, das Passwort des Opfers sei geändert worden. Um diese Änderung rückgängig zu machen, müsse man lediglich auf einen Link klicken und ein paar persönliche Daten angeben. Hinter dieser Aufforderung verstecken sich allerdings Kriminelle, die es auf persönliche Informationen und Bankdaten abgesehen haben. --------------------------------------------- https://www.watchlist-internet.at/news/paypal-passwort-phishing/ ∗∗∗ Decrypting the Forest From the Trees ∗∗∗ --------------------------------------------- SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via the Administration Service API. --------------------------------------------- https://posts.specterops.io/decrypting-the-forest-from-the-trees-661694ed16… ∗∗∗ Medusa Ransomware Activity Continues to Increase ∗∗∗ --------------------------------------------- Medusa ransomware attacks jumped by 42% between 2023 and 2024. This increase in activity continues to escalate, with almost twice as many Medusa attacks observed in January and February 2025 as in the first two months of 2024. --------------------------------------------- https://www.security.com/threat-intelligence/medusa-ransomware-attacks ∗∗∗ Unveiling EncryptHub: Analysis of a multi-stage malware campaign ∗∗∗ --------------------------------------------- EncryptHub, a rising cybercriminal entity, has recently caught the attention of multiple threat intelligence teams, including our own (Outpost24’s KrakenLabs). While other reports have begun to shed light on this actor’s operations, our investigation goes a step further, uncovering previously unseen aspects of their infrastructure, tooling, and behavioral patterns. --------------------------------------------- https://outpost24.com/blog/unveiling-encrypthub-multi-stage-malware/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Fedora (firefox and vim), Red Hat (firefox), Slackware (mozilla), SUSE (firefox, firefox-esr, kernel, and podman), and Ubuntu (gpac, kernel, linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-hwe-5.15, and redis). --------------------------------------------- https://lwn.net/Articles/1013209/ ∗∗∗ Sicherheitsupdate: Kritische Schadcode-Lücke bedroht Kibana ∗∗∗ --------------------------------------------- Wie die Entwickler in einer Warenmeldung ausführen, sind die Versionen >= 8.15.0 und < 8.17.1 nur attackierbar, wenn Angreifer über Viewer-Role-Rechte verfügen. [..] Die Lücke schrammt mit dem CVSS Score 3.1 9.9 von 10 knapp an der Höchstwertung vorbei. (CVE-2025-25012) --------------------------------------------- https://heise.de/-10306066 ∗∗∗ ABB Cylon Aspect 3.08.01 (caldavUpload.php) Funkalicious Exploit ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5926.php -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.03.2025
by Daily end-of-shift report 05 Mar '25

05 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 04-03-2025 18:00 − Mittwoch 05-03-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Text-basiertes QR Code Phishing im Umlauf ∗∗∗ --------------------------------------------- Über den neuen Ansatz hatten wir 2024 in unseren Newslettern berichtet, nun erhalten wir auch direkt Meldungen über "bildlose" QR-Code Phishs. Kurz umrissen: der QR-Code wird nicht wie oft üblich als Bilddatei übermittelt, sondern aus einzelnen ASCII-/Unicode Block-Zeichen zusammengesetzt. Dadurch kann der im QR-Code enthaltene Inhalt Sicherheitslösungen verborgen bleiben, für optische QR-Code Scanner jedoch funktional bleiben. --------------------------------------------- https://www.cert.at/de/aktuelles/2025/3/text-basiertes-qr-code-phishing-im-… ∗∗∗ Use one Virtual Machine to own them all — active exploitation of ESXicape ∗∗∗ --------------------------------------------- Yesterday, VMware quietly released patches for three ESXi zero day vulnerabilities: CVE-2025–22224, CVE-2025–22225, CVE-2025–22226. Although the advisory doesn’t explicitly say it, this is a hypervisor escape (aka a VM Escape). A threat actor with access to run code on a virtual machine can chain the three vulnerabilities to elevate access to the ESX hypervisor. --------------------------------------------- https://doublepulsar.com/use-one-virtual-machine-to-own-them-all-active-exp… ∗∗∗ BadBox malware disrupted on 500K infected Android devices ∗∗∗ --------------------------------------------- The BadBox Android malware botnet has been disrupted again by removing 24 malicious apps from Google Play and sinkholing communications for half a million infected devices. [..] The BadBox botnet is a cyber-fraud operation targeting primarily low-cost Android-based devices like TV streaming boxes, tablets, smart TVs, and smartphones. These devices either come pre-loaded with the BadBox malware from the manufacturer or are infected by malicious apps or firmware downloads. --------------------------------------------- https://www.bleepingcomputer.com/news/security/badbox-malware-disrupted-on-… ∗∗∗ Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool ∗∗∗ --------------------------------------------- Attackers blackmail YouTubers with complaints and account blocking threats, forcing them to distribute a miner disguised as a bypass tool. --------------------------------------------- https://securelist.com/silentcryptominer-spreads-through-blackmail-on-youtu… ∗∗∗ The Russia-Ukraine Cyber War Part 3: Attacks on Telecom and Critical Infrastructure ∗∗∗ --------------------------------------------- This post is the third part of our blog series that tackles the Russia-Ukraine war in the digital realm. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-russia-… ∗∗∗ BAMF: Skurrile Testkonten ermöglichten unautorisierten Datenzugriff ∗∗∗ --------------------------------------------- Anhand von Screenshots der Web-Applikation sei ersichtlich gewesen, dass im Test- und Integrationssystem offenbar ein Account mit der Nutzerkennung "max.mustermann(a)testtraeger.de" existierte. Die Domain sei noch frei gewesen. --------------------------------------------- https://www.heise.de/news/BAMF-Skurrile-Testkonten-ermoeglichten-unautorisi… ∗∗∗ Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems ∗∗∗ --------------------------------------------- Adversaries widely abuse TDS infrastructure to build dynamic and resilient network infrastructure for malicious web services. These redirection networks enhance resilience against takedowns and enable scaling and cloaking of malicious content. --------------------------------------------- https://unit42.paloaltonetworks.com/detect-block-malicious-traffic-distribu… ∗∗∗ CVE-2024-43639: Remote Code Execution in Microsoft Windows KDC Proxy ∗∗∗ --------------------------------------------- The following is a portion of their write-up covering CVE-2024-43639, with a few minimal modifications. [..] This vulnerability was patched by the vendor in November. To date, no attacks have been detected in the wild. --------------------------------------------- https://www.thezdi.com/blog/2025/3/3/cve-2024-43639 ∗∗∗ Scammers Mailing Ransom Letters While Posing as BianLian Ransomware ∗∗∗ --------------------------------------------- Scammers are impersonating BianLian ransomware, and mailing fake ransom letters to businesses. --------------------------------------------- https://hackread.com/scammers-mailing-ransom-letters-bianlian-ransomware/ ∗∗∗ LinkedIn Phishing Scam: Fake InMail Messages Spreading ConnectWise Trojan ∗∗∗ --------------------------------------------- Cybersecurity researchers at Cofense have recently uncovered a deceptive campaign that distributes malicious software using a spoofed LinkedIn email. [..] The fraudulent email is designed to mimic a notification for a LinkedIn InMail message, a feature that allows users to contact individuals outside of their immediate network. The email effectively leverages LinkedIn’s branding, convincingly creating legitimacy. --------------------------------------------- https://hackread.com/scammers-fake-linkedin-inmail-deliver-connectwise-troj… ∗∗∗ GreyNoise Observes Exploitation of Three Newly Added KEV Vulnerabilities ∗∗∗ --------------------------------------------- On March 3, 2025, the Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming their exploitation in the wild. [..] CVE-2022-43939 (Authorization Bypass) & CVE-2022-43769 (Special Element Injection) Hitachi Vantara Pentaho BA Server [..] CVE-2024-4885 Progress WhatsUp Gold Path Traversal Vulnerability. --------------------------------------------- https://www.greynoise.io/blog/greynoise-observes-exploitation-three-newly-a… ∗∗∗ GoStringUngarbler: Deobfuscating Strings in Garbled Binaries ∗∗∗ --------------------------------------------- In this blog post, we'll detail garble’s string transformations and the process of automatically deobfuscating them. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/gostringungarbler-… ∗∗∗ Trigon: developing a deterministic kernel exploit for iOS ∗∗∗ --------------------------------------------- CVE-2023-32434 was an integer overflow in the VM subsystem of the XNU kernel. It was patched in iOS 16.5.1 after being found in-the-wild as part of the Operation Triangulation spyware chain, discovered after it was used to infect a group of security researchers at Kaspersky. These researchers then captured and reverse-engineered the entire chain, leading to the patching of a WebKit bug, a kernel bug, a userspace PAC bypass and a PPL (and, technically, a KTRR) bypass. [..] This writeup simply shows the steps involved in the final, working exploit. It does not, however, convey just how many failed ideas and attempts there were during the process. --------------------------------------------- https://alfiecg.uk/2025/03/01/Trigon.html ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libreoffice), Fedora (exim and fscrypt), Red Hat (kernel), Slackware (mozilla), SUSE (docker, firefox, and podman), and Ubuntu (linux, linux-lowlatency, linux-lowlatency-hwe-5.15, linux, linux-lowlatency, linux-lowlatency-hwe-6.8, linux, linux-oem-6.11, linux-aws, linux-aws-6.8, linux-oracle, linux-oracle-6.8, linux-raspi, linux-aws, linux-gcp, linux-hwe-6.11, linux-oracle, linux-raspi, linux-realtime, linux-aws, linux-gkeop, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, and linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop). --------------------------------------------- https://lwn.net/Articles/1013063/ ∗∗∗ Cisco Secure Client for Windows with Secure Firewall Posture Engine DLL Hijacking Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Security Vulnerabilities fixed in Thunderbird ESR 128.8 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-18/ ∗∗∗ Security Vulnerabilities fixed in Thunderbird 136 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-17/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.03.2025
by Daily end-of-shift report 04 Mar '25

04 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Montag 03-03-2025 18:00 − Dienstag 04-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Polish Space Agency offline as it recovers from cyberattack ∗∗∗ --------------------------------------------- The Polish Space Agency (POLSA) has been offline since it disconnected its systems from the Internet over the weekend to contain a breach of its IT infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/polish-space-agency-offline-… ∗∗∗ Booking a Threat: Inside LummaStealers Fake reCAPTCHA ∗∗∗ --------------------------------------------- Cybercriminals are taking advantage of the increased demand in travel by setting up fake booking sites, phishing scams and fraudulent listings to trick unsuspecting travelers. --------------------------------------------- https://www.gdatasoftware.com/blog/2025/03/38154-lummastealer-fake-recaptcha ∗∗∗ KI-Trainingsdaten: Tausende gültiger API-Keys in gecrawlten Webdaten entdeckt ∗∗∗ --------------------------------------------- Bei der Analyse eines frei verfügbaren Archivs mit rund 400 TBytes an Websitedaten haben Forscher fast 12.000 gültige API-Keys und Passwörter gefunden. --------------------------------------------- https://www.golem.de/news/ki-trainingsdaten-tausende-gueltiger-api-keys-in-… ∗∗∗ Kritische Lücke in VMware ESXi, Fusion und Workstation wird missbraucht ∗∗∗ --------------------------------------------- Broadcom warnt vor teils kritischen Sicherheitslecks in VMware ESXi, Fusion und Workstation. Angreifer missbrauchen sie bereits. --------------------------------------------- https://www.heise.de/news/Kritische-Luecke-in-VMware-ESXi-Fusion-und-Workst… ∗∗∗ DNSSEC NSEC. The accidental treasure map to your subdomains ∗∗∗ --------------------------------------------- TL;DR: DNSSEC secures DNS but may unintentionally expose domain structures via NSEC/NSEC3 records, enabling zone walking to enumerate subdomains. NSEC openly lists domain names, making enumeration easy. NSEC3 hashes .. --------------------------------------------- https://www.pentestpartners.com/security-blog/dnssec-nsec-the-accidental-tr… ∗∗∗ MeinELBA-Zugang läuft bald ab? Vorsicht, Phishing-Versuch! ∗∗∗ --------------------------------------------- Kriminelle versenden aktuell wieder vermehrt SMS-Nachrichten, in denen vor einem Ablaufen des MeinELBA-Zugangs gewarnt wird. Wer verlängern möchte, müsse einen Link anklicken und auf einer vermeintlichen Login-Seite seine Onlinebanking-Daten eingeben. Diese Seite ist natürlich eine Fälschung. Allerdings eine sehr gut gemachte! Wie Sie sie erkennen und was Sie tun können, wenn Sie dort vertrauliche Informationen eingegeben haben, verrät dieser Artikel. --------------------------------------------- https://www.watchlist-internet.at/news/meinelba-zugang-phishing/ ∗∗∗ A Revision of the EU Cybersecurity Blueprint ∗∗∗ --------------------------------------------- The original EU cybersecurity blueprint from 2017 (officially: “Commission Recommendation of 13.9.2017 on Coordinated Response to Large Scale Cybersecurity Incidents and Crises”) is now close to seven years old and an update is overdue. The Commission recently published a draft for an updated version, and I’d like to take this opportunity to .. --------------------------------------------- https://www.cert.at/en/blog/2025/3/a-revision-of-the-eu-cybersecurity-bluep… ∗∗∗ Did Trump Admin Order U.S. Cyber Command and CISA to Stand Down on Russia? ∗∗∗ --------------------------------------------- Two blockbuster stories published on Friday that appear to confirm what many Americans suspected would occur under the Trump administration – that the new regime is going to be softer on Russia than previous administrations, particularly with regard to the threat that Russia poses in cyber space. Since publication, however, .. --------------------------------------------- https://www.zetter-zeroday.com/did-trump-admin-order-u-s-cyber-command-and-… ∗∗∗ The Dangers of Exposed Secrets – and How to Prevent Them ∗∗∗ --------------------------------------------- Modern enterprise software relies on authentication tokens, API keys, encryption keys, certificates, and other sensitive credentials to enable secure communication between applications, microservices, APIs, and DevOps pipelines. However, these secrets often end up hardcoded in source code during the development process, whether unintentionally or as a shortcut for quick .. --------------------------------------------- https://checkmarx.com/blog/exposed-secrets-and-how-to-prevent-them/ ∗∗∗ Do not run any Cargo commands on untrusted projects ∗∗∗ --------------------------------------------- TL;DR: Treat anything starting with cargo as if it is cargo run. --------------------------------------------- https://shnatsel.medium.com/do-not-run-any-cargo-commands-on-untrusted-proj… ∗∗∗ Hacking the Xbox 360 Hypervisor Part 2: The Bad Update Exploit ∗∗∗ --------------------------------------------- Welcome to part 2 of the Hacking the Xbox 360 Hypervisor blog series. In this part I’ll cover how I found and exploited bugs in the Xbox 360 hypervisor to get full code execution and create the “Bad Update” exploit. If you haven’t already, I highly recommend you read (or at least skim through) part 1 as this post will reference a lot of the material discussed there. --------------------------------------------- https://icode4.coffee/?p=1081 ===================== = Vulnerabilities = ===================== ∗∗∗ Docusnap Inventory Files Encrypted with Static Key ∗∗∗ --------------------------------------------- Inventory files created by Docusnap, containing information like installed programs, firewall rules and local administrators, are encrypted with a static key. The decryption key can be obtained easily from the .NET application, downloadable from the vendor’s website. When following Docusnap’s installation instructions for Windows Domains, every domain user has read access to these files. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-012/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 128.8 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-16/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.21 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-15/ ∗∗∗ Security Vulnerabilities fixed in Firefox 136 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-14/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.03.2025
by Daily end-of-shift report 03 Mar '25

03 Mar '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-02-2025 18:00 − Montag 03-03-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks ∗∗∗ --------------------------------------------- Microsoft had discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, with one used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-par… ∗∗∗ Ohne Nutzerinteraktion: Wie Hacker fremde Gitlab-Accounts übernehmen konnten ∗∗∗ --------------------------------------------- Letztes Jahr hat Gitlab eine gefährliche Sicherheitslücke geschlossen. Ein neuer Bericht zeigt, wie leicht sich damit fremde Konten kapern ließen. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-per-passwort-reset-fremde-gitla… ∗∗∗ Mobile malware evolution in 2024 ∗∗∗ --------------------------------------------- The most notable mobile threats of 2024, and statistics on Android-specific malware, adware and potentially unwanted software. --------------------------------------------- https://securelist.com/mobile-threat-report-2024/115494/ ∗∗∗ Dornröschenschlaf: mit diesem einfachen Trick Crowdstrike Falcon zähmen ∗∗∗ --------------------------------------------- Nachdem Angreifer die Rechte eines Benutzers mit "NT AUTHORITY\SYSTEM" Berechtigungen erlangt haben, indem andere Schwachstellen .. --------------------------------------------- https://sec-consult.com/de/blog/detail/dornroeschenschlaf-mit-diesem-einfac… ∗∗∗ Vo1d Botnets Peak Surpasses 1.59M Infected Android TVs, Spanning 226 Countries ∗∗∗ --------------------------------------------- Brazil, South Africa, Indonesia, Argentina, and Thailand have become the targets of a campaign that has infected Android TV devices with a botnet malware dubbed Vo1d.The improved variant of Vo1d has been found to encompass 800,000 daily active IP .. --------------------------------------------- https://thehackernews.com/2025/03/vo1d-botnets-peak-surpasses-159m.html ∗∗∗ Cybersecurity not the hiring-em-like-hotcakes role it once was ∗∗∗ --------------------------------------------- Ghost positions, HR AI no help – biz should talk to infosec staff and create realistic job outline, say experts Analysis Its a familiar refrain in the security industry that there is a massive skills gap in the sector. And while its true there are specific shortages in certain areas, some industry watchers believe we may be reaching the point of oversupply for generalists. --------------------------------------------- https://www.theregister.com/2025/03/03/cybersecurity_jobs_market/ ∗∗∗ Massive Sicherheitslücken bei Gebäude-Zugangssystemen entdeckt ∗∗∗ --------------------------------------------- Cyberkriminelle können leicht auf Zugangssysteme von Gebäuden weltweit zugreifen. Eine Studie nennt das Ausmaß und die Ursachen. --------------------------------------------- https://www.heise.de/news/Massive-Sicherheitsluecken-bei-Gebaeude-Zugangssy… ∗∗∗ Angreifer bringen verwundbaren Paragon-Treiber mit und missbrauchen ihn ∗∗∗ --------------------------------------------- Angreifer missbrauchen ein Leck in einem Treiber von Paragon Partition Manager. Besonders gefährlich: den können sie selbst mitbringen. --------------------------------------------- https://www.heise.de/news/Sicherheitsleck-in-Treiber-von-Paragon-Partition-… ∗∗∗ Thule-Radanhänger: Pedalritter im Visier von Fake-Shops ∗∗∗ --------------------------------------------- Die Fahrradanhänger des Traditionsunternehmens Thule genießen zurecht einen hervorragenden Ruf. Diesen machen sich Kriminelle aber immer wieder zu Nutze. Sie bauen den Thule-Onlinestore nach und locken ihre Opfer dort mit vermeintlichen Top-Schnäppchen in die Falle. In diesem Artikel erfahren Sie, wie Sie die Fake-Shops erkennen können und welche Optionen Sie im Fall einer getätigten Zahlung noch haben. --------------------------------------------- https://www.watchlist-internet.at/news/thule-radanhaenger-fake-shops/ ∗∗∗ Uncovering .NET Malware Obfuscated by Encryption and Virtualization ∗∗∗ --------------------------------------------- Malware authors use AES encryption and code virtualization to evade sandbox static analysis. We explore how this facilitates spread of Agent Tesla, XWorm and more. --------------------------------------------- https://unit42.paloaltonetworks.com/malware-obfuscation-techniques/ ∗∗∗ Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal ∗∗∗ --------------------------------------------- In this blog entry, we discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomwar… ∗∗∗ Not Lost in Translation: Rosetta 2 Artifacts in macOS Intrusions ∗∗∗ --------------------------------------------- Rosetta 2 is Apples translation technology for running x86-64 binaries on Apple Silicon (ARM64) macOS systems.Rosetta 2 translation creates a cache of Ahead-Of-Time (AOT) files that can serve as valuable forensic artifacts.Mandiant has observed sophisticated threat actors leveraging x86-64 compiled macOS malware, likely due to broader .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/rosetta2-artifacts… ∗∗∗ how to gain code execution on millions of people and hundreds of popular apps ∗∗∗ --------------------------------------------- .. and of course, firebase was (partially) the cause --------------------------------------------- https://kibty.town/blog/todesktop/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ffmpeg, kernel, linux-6.1, mariadb-10.5, proftpd-dfsg, and xorg-server), Fedora (chromium, cutter-re, iniparser, nodejs22, rizin, webkitgtk, wireshark, xen, and xorg-x11-server), Mageia (binutils and ffmpeg), Oracle (emacs and kernel), Red Hat (emacs and webkit2gtk3), SUSE (azure-cli, bsdtar, gnutls, govulncheck-vulndb, .. --------------------------------------------- https://lwn.net/Articles/1012760/ ∗∗∗ CISA Adds Five Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-20118 Cisco Small Business RV Series Routers Command Injection .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/03/03/cisa-adds-five-known-exp… ∗∗∗ DSA-5872-1 xorg-server - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2025/msg00034.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.02.2025
by Daily end-of-shift report 28 Feb '25

28 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-02-2025 18:00 − Freitag 28-02-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Auch in Deutschland: 49.000 Zutrittskontrollsysteme hängen ungeschützt am Netz ∗∗∗ --------------------------------------------- Weltweit sorgen unzählige Zutrittskontrollsysteme (AMS – Access Management Systems) dafür, dass nur berechtigte Personen beispielsweise per Codeeingabe, Fingerabdruck oder RFID-Schlüsselkarte Zugang zu bestimmten Arealen, Gebäuden oder Räumlichkeiten haben. Sicherheitsforscher von Modat haben über 49.000 solcher Systeme entdeckt, die sich aufgrund von Konfigurationsfehlern manipulieren lassen und über das Internet erreichbar sind. --------------------------------------------- https://www.golem.de/news/auch-in-deutschland-49-000-zutrittskontrollsystem… ∗∗∗ The SOC files: Chasing the web shell ∗∗∗ --------------------------------------------- Kaspersky SOC analysts discuss a recent incident where the well-known Behinder web shell was used as a post-exploitation backdoor, showing how web shells have evolved. --------------------------------------------- https://securelist.com/soc-files-web-shell-chase/115714/ ∗∗∗ 5,000 Phishing PDFs on 260 Domains Distribute Lumma Stealer via Fake CAPTCHAs ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered a widespread phishing campaign that uses fake CAPTCHA images shared via PDF documents hosted on Webflows content delivery network (CDN) to deliver the Lumma stealer malware. --------------------------------------------- https://thehackernews.com/2025/02/5000-phishing-pdfs-on-260-domains.html ∗∗∗ Cyber-Bande Cl0p: Angeblich Daten bei HP und HPE geklaut ∗∗∗ --------------------------------------------- Insgesamt 230 neue Opfer listet die kriminelle Gruppe Cl0p auf ihrer Darknet-Webseite auf. Darunter sind auch namhafte wie HP und HPE. [..] Die Kriminellen nennen auch kein Datum als Ultimatum, bis wann sich die angeblichen Opfer melden müssten. Belege für den Datenabzug liefert Cl0p ebenfalls nicht. In der Vergangenheit hatten sich die behaupteten Angriffe jedoch als wahr herausgestellt. --------------------------------------------- https://www.heise.de/news/Cyber-Bande-Cl0p-Angeblich-Daten-bei-HP-und-HPE-g… ∗∗∗ Warning issued as hackers offer firms fake cybersecurity audits to break into their systems ∗∗∗ --------------------------------------------- Companies are being warned that malicious hackers are using a novel technique to break into businesses - by pretending to offer audits of the companys cybersecurity. --------------------------------------------- https://www.tripwire.com/state-of-security/beware-fake-cybersecurity-audits… ∗∗∗ Attack and Defense in OT: Enhancing Cyber Resilience in Industrial Systems with Red Team Operations ∗∗∗ --------------------------------------------- This edition of the series focuses on how Red Team assessments can assist companies in identifying and mitigating threats in OT environments. After giving some background about the current threat landscape and terminology, we start by explaining how an external attacker gains an initial foothold in the network. --------------------------------------------- https://blog.nviso.eu/2025/02/28/attack-and-defense-in-ot-enhancing-cyber-r… ∗∗∗ Microsoft: Unsichere DES-Verschlüsselung fliegt aus Windows raus ∗∗∗ --------------------------------------------- Microsoft hat jetzt angekündigt, dass der lange als unsicher geltende Cipher DES zum September aus Windows entfernt wird. [..] Bereits 1998 haben IT-Sicherheitsforscher demonstriert, dass DES-Schlüssel, die aufgrund US-amerikanischer Export-Beschränkungen zudem auf 56 Bit Länge beschränkt waren, innerhalb von nicht einmal drei Tagen und mit begrenztem Budget zu knacken waren. --------------------------------------------- https://heise.de/-10299473 ∗∗∗ Next-Gen Phishing Techniques – How Back-End Tech Made Scams More Effective ∗∗∗ --------------------------------------------- Today’s sophisticated back-end technologies take phishing and social engineering to the next level. Hackers are now able to create not only better messages but also more convincing, harder-to-detect phishing websites. --------------------------------------------- https://heimdalsecurity.com/blog/next-gen-phishing-techniques/ ===================== = Vulnerabilities = ===================== ∗∗∗ Videoeditor DaVinci Resolve ermöglicht Rechteausweitung in macOS ∗∗∗ --------------------------------------------- Das polnische CERT warnt vor einer Schwachstelle in der Video-Editiersoftware DaVinci Resolve für Macs. --------------------------------------------- https://www.heise.de/news/Videoeditor-DaVinci-Resolve-ermoeglicht-Rechteaus… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (emacs, freerdp2, and gst-plugins-good1.0), Fedora (java-17-openjdk, python3.6, and xorg-x11-server-Xwayland), Mageia (radare2), SUSE (libX11, openvswitch3, postgresql13, procps, ruby2.5, webkit2gtk3, and xorg-x11-server), and Ubuntu (git, linux-aws, linux-aws, linux-aws-6.8, linux-aws, linux-oracle, linux-oracle-5.4, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, and linux-oem-6.11). --------------------------------------------- https://lwn.net/Articles/1012367/ ∗∗∗ DSA-5871-1 emacs - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2025/msg00033.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.02.2025
by Daily end-of-shift report 27 Feb '25

27 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 26-02-2025 18:00 − Donnerstag 27-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ The surveillance tech waiting for workers as they return to the office ∗∗∗ --------------------------------------------- Warehouse-style employee-tracking technology is coming for the office worker. --------------------------------------------- https://arstechnica.com/information-technology/2025/02/the-surveillance-tec… ∗∗∗ Find-My-Netzwerk: Angriff macht fremde Bluetooth-Geräte trackbar wie Airtags ∗∗∗ --------------------------------------------- Forscher haben einen Weg gefunden, fremde Bluetooth-Geräte mit hoher Genauigkeit zu orten - mit erheblichen Auswirkungen auf die Privatsphäre. --------------------------------------------- https://www.golem.de/news/find-my-netzwerk-angriff-macht-fremde-bluetooth-g… ∗∗∗ Wallbleed vulnerability unearths secrets of Chinas Great Firewall 125 bytes at a time ∗∗∗ --------------------------------------------- Boffins poked around inside censorship engines for years before Beijing patched hole Smart folks investigating a memory-dumping vulnerability in the Great Firewall of China (GFW) finally released their findings after probing it for years. --------------------------------------------- https://www.theregister.com/2025/02/27/wallbleed_vulnerability_great_firewa… ∗∗∗ U.S. Soldier Charged in AT&T Hack Searched “Can Hacking Be Treason” ∗∗∗ --------------------------------------------- A U.S. Army soldier who pleaded guilty last week to leaking phone records for high-ranking U.S. government officials searched online for non-extradition countries and for an answer to the question "can hacking be treason?" prosecutors in the case said Wednesday. The government disclosed the details in a court motion to keep the defendant in custody until he is discharged from the military. --------------------------------------------- https://krebsonsecurity.com/2025/02/u-s-soldier-charged-in-att-hack-searche… ∗∗∗ Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations ∗∗∗ --------------------------------------------- We analyze the backdoor Squidoor, used by a suspected Chinese threat actor to steal sensitive information. This multi-platform backdoor is built for stealth. --------------------------------------------- https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/ ∗∗∗ Belgium probes suspected Chinese hack of state security service ∗∗∗ --------------------------------------------- A breach of the Belgian state security services email system appears to be the work of Chinese state-backed hackers, according to prosecutors. --------------------------------------------- https://therecord.media/belgium-investigation-alleged-china-cyber-espionage… ∗∗∗ Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools ∗∗∗ --------------------------------------------- Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools --------------------------------------------- https://blog.talosintelligence.com/lotus-blossom-espionage-group/ ∗∗∗ Russian campaign targeting Romanian WhatsApp numbers ∗∗∗ --------------------------------------------- We’ve identified a campaign that advises people to vote for a contest so they can win “prizes”. The only “prize” is that they’ll lose access to their WhatsApp account. Multiple hints indicate that the campaign originates from Russia. This .. --------------------------------------------- https://cybergeeks.tech/russian-campaign-targeting-romanian-whatsapp-number… ∗∗∗ GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs ∗∗∗ --------------------------------------------- Ransomware group Black Basta’s chat logs were leaked, revealing 62 mentioned CVEs (Source: VulnCheck). GreyNoise identified 23 of these CVEs as actively exploited, with some targeted in the last 24 hours. Notably, CVE-2023-6875 is .. --------------------------------------------- https://www.greynoise.io/blog/greynoise-detects-active-exploitation-cves-bl… ∗∗∗ GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready? ∗∗∗ --------------------------------------------- Attackers are automating exploitation at scale, targeting both new and old vulnerabilities — some before appearing in KEV. Our latest report breaks down which CVEs were exploited most in 2024, how ransomware groups are leveraging mass .. --------------------------------------------- https://www.greynoise.io/blog/2025-mass-internet-exploitation-report ∗∗∗ Taking the relaying capabilities of multicast poisoning to the next level: tricking Windows SMB clients into falling back to WebDav ∗∗∗ --------------------------------------------- When performing LLMNR/mDNS/NBTNS poisoning in an Active Directory environment, it is fairly common to be able to trigger SMB authentications to an attacker-controlled machine. This kind of authentication may be useful, but is rather limited from a relaying standpoint, due to the fact that Windows SMB clients .. --------------------------------------------- https://www.synacktiv.com/publications/taking-the-relaying-capabilities-of-… ∗∗∗ MITRE Releases OCCULT Framework ∗∗∗ --------------------------------------------- The Operational Evaluation Framework for Cyber Security Risks in AI (OCCULT) is a pioneering methodology developed by MITRE to assess the potential risks posed by large language models (LLMs) in offensive cyber operations (OCO). As AI technology advances, there is an increasing concern about its misuse in executing sophisticated cyberattacks. The OCCULT Framework aims to […] --------------------------------------------- https://thecyberthrone.in/2025/02/27/mitre-releases-occult-framework/ ===================== = Vulnerabilities = ===================== ∗∗∗ XSA-467 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-467.html ∗∗∗ ZDI-25-100: Linux Kernel ksmbd Session Setup Race Condition Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability. However, only systems with ksmbd enabled are vulnerable. The ZDI has assigned a CVSS rating of 9.0. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-100/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.02.2025
by Daily end-of-shift report 26 Feb '25

26 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-02-2025 18:00 − Mittwoch 26-02-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Datenleck-Such-Website Have I Been Pwned um 284 Millionen Accounts aufgestockt ∗∗∗ --------------------------------------------- Im Telegram-Kanal ALIEN TXTBASE wurden von Infostealer-Malware erbeute Mailadressen und Passwörter geteilt. Diese Daten sind nun in HIBP integriert. --------------------------------------------- https://www.heise.de/news/Datenleck-Such-Website-Have-I-Been-Pwned-um-284-M… ∗∗∗ Russian officials warn of potential compromise of major tech services provider ∗∗∗ --------------------------------------------- In an unusual public disclosure, the Russian government said that subsidiaries of LANIT, a major tech services provider, had potentially been breached. --------------------------------------------- https://therecord.media/lanit-russia-government-contractor-potential-compro… ∗∗∗ EncryptHub breaches 618 orgs to deploy infostealers, ransomware ∗∗∗ --------------------------------------------- A threat actor tracked as EncryptHub, aka Larva-208, has been targeting organizations worldwide with spear-phishing and social engineering attacks to gain access to corporate networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/encrypthub-breaches-618-orgs… ∗∗∗ Cyberattacken: Lücken in Zimbra und Microsoft Partner Center werden angegriffen ∗∗∗ --------------------------------------------- Ältere Sicherheitslücken in Zimbra und Microsoft Partner Center werden aktuell angegriffen, warnt die US-IT-Sicherheitsbehörde CISA. --------------------------------------------- https://heise.de/-10296961 ∗∗∗ Wenn Fußballliebe teuer wird: Fake-Shops im Namen von Manchester United, Real Madrid oder FC Barcelona ∗∗∗ --------------------------------------------- Betrüger:innen imitieren immer wieder die Onlinestores der Top-Clubs und locken mit niedrigsten Preisen. Die Fans freuen sich über ein vermeintliches Super-Sonderangebot. Die Ware erhalten Sie aber nie, das Geld ist weg. --------------------------------------------- https://www.watchlist-internet.at/news/fussball-fake-shops/ ∗∗∗ Android happy to check your nudes before you forward them ∗∗∗ --------------------------------------------- The Android app SafetyCore was silently installed and looks at incoming and outgoing pictures to check their decency. [..] The good people at ZDNet provided instructions on how to get rid of SafetyCore or disable it if you would like to do so. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/android-happy-to-check-your-… ∗∗∗ Exploits and vulnerabilities in Q4 2024 ∗∗∗ --------------------------------------------- This report provides statistics on vulnerabilities and exploits and discusses the most frequently exploited vulnerabilities in Q4 2024. --------------------------------------------- https://securelist.com/vulnerabilities-and-exploits-in-q4-2024/115761/ ∗∗∗ The Best Security Is When We All Agree To Keep Everything Secret (Except The Secrets) - NAKIVO Backup & Replication (CVE-2024-48248) ∗∗∗ --------------------------------------------- Today, we’re here to talk about an unauthenticated Arbitrary File Read vulnerability we discovered in NAKIVO's Backup and Replication solution - specifically in version 10.11.3.86570 [..] 18th October 2024 watchTowr is assigned CVE-2024-48248 for this vulnerability [..] 4th November 2024: NAKIVO silently patches the vulnerability (v11.0.0.88174) --------------------------------------------- https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-e… ∗∗∗ A dive into the Rockchip Bootloader ∗∗∗ --------------------------------------------- Rockchip has a structured sequence of bootloaders. Using various plugs can allow access to the MCU’s RAM and storage. There are many utilities to allow reading of information from the MCU. Use this guide to access and reverse engineer bootloaders. --------------------------------------------- https://www.pentestpartners.com/security-blog/a-dive-into-the-rockchip-boot… ∗∗∗ Technical Advisory: Multiple Vulnerabilities in TCPDF ∗∗∗ --------------------------------------------- NCC Group has identified multiple vulnerabilities in TCPDF, which is a popular library used for PDF generation. [..] 12/23/24 - Vendor releases version 6.8.0 to address issues. --------------------------------------------- https://www.nccgroup.com/us/research-blog/technical-advisory-multiple-vulne… ∗∗∗ Pwn everything Bounce everywhere all at once (part 1) ∗∗∗ --------------------------------------------- The following article describes how, during an "assumed breach" security audit, we compromised multiple web applications on our client's network in order to carry out a watering hole attack by installing fake Single Sign-On pages on the compromised servers. --------------------------------------------- http://blog.quarkslab.com/pwn-everything-bounce-everywhere-all-at-once-part… ∗∗∗ Pwn everything Bounce everywhere all at once (part 2) ∗∗∗ --------------------------------------------- In our second episode we take a look at SOPlanning, a project management application that we encountered during the audit. --------------------------------------------- http://blog.quarkslab.com/pwn-everything-bounce-everywhere-all-at-once-part… ===================== = Vulnerabilities = ===================== ∗∗∗ Synology-SA-25:03 DSM ∗∗∗ --------------------------------------------- A vulnerability allows attackers to read any file via writable Network File System (NFS) service. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_25_03 ∗∗∗ Cisco Application Policy Infrastructure Controller Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Nexus 3000 and 9000 Series Switches Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Nexus 3000 and 9000 Series Switches Health Monitoring Diagnostics Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.02.2025
by Daily end-of-shift report 25 Feb '25

25 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Montag 24-02-2025 18:00 − Dienstag 25-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Parallels Desktop: Zero-Day-Exploit verleiht Angreifern Root-Zugriff auf MacOS ∗∗∗ --------------------------------------------- Eigentlich gibt es für die Sicherheitslücke längst einen Patch. Effektiv ist dieser aber wohl nicht. Ein Forscher zeigt, wie er sich umgehen lässt. --------------------------------------------- https://www.golem.de/news/patch-laesst-sich-umgehen-root-luecke-in-parallel… ∗∗∗ Google binning SMS MFA at last and replacing it with QR codes ∗∗∗ --------------------------------------------- Everyone knew texted OTPs were a dud back in 2016 Google has confirmed it will phase out the use of SMS text messages for multi-factor authentication in favor of more secure technologies. --------------------------------------------- https://www.theregister.com/2025/02/25/google_sms_qr/ ∗∗∗ How nice that state-of-the-art LLMs reveal their reasoning ... for miscreants to exploit ∗∗∗ --------------------------------------------- Blueprints shared for jail-breaking models that expose their chain-of-thought process Analysis AI models like OpenAI o1/o3, DeepSeek-R1, and Gemini 2.0 Flash Thinking can mimic human reasoning through a process called chain of thought. --------------------------------------------- https://www.theregister.com/2025/02/25/chain_of_thought_jailbreaking/ ∗∗∗ Malware variants that target operational tech systems are very rare – but 2 were found last year ∗∗∗ --------------------------------------------- Fuxnet and FrostyGoop were both used in the Russia-Ukraine war Two new malware variants specifically designed to disrupt critical industrial processes were set loose on operational technology networks last year, shutting off heat to more than 600 apartment buildings in one instance and jamming communications to gas, water, and sewage network sensors in the other. --------------------------------------------- https://www.theregister.com/2025/02/25/new_ics_malware_dragos/ ∗∗∗ This Russian Tech Bro Helped Steal $93 Million and Landed in US Prison. Then Putin Called ∗∗∗ --------------------------------------------- In the epic US-Russian prisoner swap last summer, Vladimir Putin brought home an assassin, spies, and another prized ally: the man behind one of the biggest insider trading cases of all time. --------------------------------------------- https://www.wired.com/story/russian-prisoner-swap-vladislav-klyushin-evan-g… ∗∗∗ ‘OpenAI’ Job Scam Targeted International Workers Through Telegram ∗∗∗ --------------------------------------------- An alleged job scam, led by “Aiden” from “OpenAI,” recruited workers in Bangladesh for months before disappearing overnight, according to FTC complaints obtained by WIRED. --------------------------------------------- https://www.wired.com/story/openai-job-scam/ ∗∗∗ DeepSeek Lure Using CAPTCHAs To Spread Malware ∗∗∗ --------------------------------------------- The rapid rise of generative AI tools has created opportunities and challenges for cybercriminals. In an instant, industries are being reshaped while new attack surfaces are being exposed. DeepSeek AI chatbot that launched on January 20, 2025, quickly gained international attention, making it a prime target for abuse. Leveraging a tactic known as brand .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captcha… ∗∗∗ Password-Spraying-Angriff auf M365-Konten von Botnet mit über 130.000 Drohnen ∗∗∗ --------------------------------------------- IT-Forscher haben ein Botnet aus mehr als 130.000 Drohnen bei Password-Spraying-Angriffen gegen Microsoft-365-Konten beobachtet. --------------------------------------------- https://www.heise.de/news/Password-Spraying-Angriff-auf-M365-Konten-von-Bot… ∗∗∗ Background check provider data breach affects 3 million people who may not have heard of the company ∗∗∗ --------------------------------------------- Background check provider DISA has disclosed a major data breach which may have affected over 3 million people. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/background-check-provider-da… ∗∗∗ 100,000 WordPress Sites Affected by Arbitrary File Upload, Read and Deletion Vulnerability in Everest Forms WordPress Plugin ∗∗∗ --------------------------------------------- 100,000 WordPress Sites Affected by Arbitrary File Upload, Read and Deletion Vulnerability in Everest Forms WordPress Plugin. --------------------------------------------- https://www.wordfence.com/blog/2025/02/100000-wordpress-sites-affected-by-a… ∗∗∗ Vorsicht, Phishing: „Ihre Registrierung für die Finanz Online-ID läuft ab“ ∗∗∗ --------------------------------------------- Aktuell werden immer wieder E-Mails und SMS-Nachrichten mit der Warnung vor einer angeblich ablaufenden Nutzer-ID für FinanzOnline versendet. Wer auf den mitgesendeten Link klickt und den Anweisungen folgt, gibt allerdings wichtige persönliche Daten an Betrüger:innen weiter. --------------------------------------------- https://www.watchlist-internet.at/news/phishing-finanz-online-id/ ∗∗∗ Mixing up Public and Private Keys in OpenID Connect deployments ∗∗∗ --------------------------------------------- I am developing a tool to check cryptographic public keys for known vulnerabilities called badkeys. During the Q&A session of a presentation about badkeys at the German OWASP Day, I was asked whether I had ever used badkeys to check cryptographic keys in OpenID Connect setups. I had not until then. OpenID Connect is a single sign-on protocol that allows .. --------------------------------------------- https://blog.hboeck.de:443/archives/909-Mixing-up-Public-and-Private-Keys-i… ∗∗∗ Auto-Color: An Emerging and Evasive Linux Backdoor ∗∗∗ --------------------------------------------- The new Linux malware named Auto-color uses advanced evasion tactics. Discovered by Unit 42, this article cover its installation, evasion features and more. --------------------------------------------- https://unit42.paloaltonetworks.com/new-linux-backdoor-auto-color/ ∗∗∗ Swedish authorities seek backdoor to encrypted messaging apps ∗∗∗ --------------------------------------------- Sweden’s law enforcement and security agencies are pushing legislation to force Signal and WhatsApp to create technical backdoors allowing them to access communications sent over the encrypted messaging apps. --------------------------------------------- https://therecord.media/sweden-seeks-backdoor-access-to-messaging-apps ∗∗∗ Siberias largest dairy plant reportedly disrupted with LockBit variant ∗∗∗ --------------------------------------------- Reports said the dairy company Sayanmolokos plant in Semyonishna was attacked with LockBit ransomware, possibly because of its support for Russian troops in Ukraine. Company printers reportedly churned out leaflets. --------------------------------------------- https://therecord.media/siberia-dairy-plant-cyberattack-lockbit-variant ∗∗∗ Your item has sold! Avoiding scams targeting online sellers ∗∗∗ --------------------------------------------- There are many risks associated with selling items on online marketplaces that individuals and organizations should be aware of when conducting business on these platforms. --------------------------------------------- https://blog.talosintelligence.com/online-marketplace-scams/ ∗∗∗ GreyNoise Observes Active Exploitation of Cisco Vulnerabilities Tied to Salt Typhoon Attacks ∗∗∗ --------------------------------------------- GreyNoise has observed exploitation attempts targeting two Cisco vulnerabilities, CVE-2023-20198 and CVE-2018-0171. CVE-2023-20198 is being actively exploited by over 110 malicious IPs, primarily from Bulgaria, Brazil, and Singapore, while CVE-2018-0171 has seen exploitation attempts from two malicious IPs traced to Switzerland and the United States. These .. --------------------------------------------- https://www.greynoise.io/blog/greynoise-observes-active-exploitation-of-cis… ∗∗∗ TON Wallet Security Threat: Malicious npm Package Steals Cryptocurrency Wallet Keys ∗∗∗ --------------------------------------------- The Socket Research Team has discovered a malicious npm package, @ton-wallet/create, that has been stealing mnemonic phrases from unsuspecting users and developers in the TON ecosystem. TON was built around The Open Network blockchain originally developed by Telegram and is widely used for decentralized applications (dApps), smart contracts, and .. --------------------------------------------- https://socket.dev/blog/ton-wallet-security-threat-malicious-npm-package-st… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (libpq, postgresql:13, postgresql:15, and postgresql:16), Debian (nodejs and php-nesbot-carbon), Mageia (neomutt), Red Hat (python3.11-urllib3 and tuned), SUSE (crun, ovmf, pam_pkcs11, qemu, and webkit2gtk3), and Ubuntu (iniparser, libcap2, linux, linux-hwe, linux, linux-hwe-5.4, linux, linux-lowlatency, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-ibm-5.4, linux-azure, linux-azure-fde, linux-gkeop, linux-nvidia, .. --------------------------------------------- https://lwn.net/Articles/1011764/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.02.2025
by Daily end-of-shift report 24 Feb '25

24 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-02-2025 18:00 − Montag 24-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Do not fucking expose management interfaces to the Internet. ∗∗∗ --------------------------------------------- While infrastructure as code and other approaches to automated configuration management have become increasingly popular, in most organizations IT environments management interfaces - especially when it comes to edge devices such as firewalls, VPNs and other remote access solutions, and security appliances - are still very .. --------------------------------------------- https://bytesandborscht.com/do-not-fucking-expose-management-interfaces-to-… ∗∗∗ Leaked chat logs expose inner workings of secretive ransomware group ∗∗∗ --------------------------------------------- Researchers are poring over the data and feeding it into ChatGPT. --------------------------------------------- https://arstechnica.com/security/2025/02/leaked-chat-logs-expose-inner-work… ∗∗∗ How APT Naming Conventions Make Us Less Safe ∗∗∗ --------------------------------------------- Only by addressing the inefficiencies of current naming conventions can we create a safer, more resilient landscape for all defenders. --------------------------------------------- https://www.darkreading.com/cyber-risk/how-apt-naming-conventions-make-us-l… ∗∗∗ Fernzugriff auf fremde Betten: Backdoor in smarter Matratzenauflage entdeckt ∗∗∗ --------------------------------------------- Die Auflage kann die Temperatur der Matratze regeln, Schlafdaten erfassen und Nutzer per Vibration wecken. Eine Backdoor verleiht Vollzugriff. --------------------------------------------- https://www.golem.de/news/fernzugriff-auf-fremde-betten-backdoor-in-smarter… ∗∗∗ Neue Adresse: Phishing-Masche schockt Nutzer mit echten E-Mails von Paypal ∗∗∗ --------------------------------------------- Einige Paypal-Nutzer erhalten unerwartet E-Mails, die auf neu hinzugefügte Adressen hindeuten. Absender ist tatsächlich Paypal. Betrug ist es dennoch. --------------------------------------------- https://www.golem.de/news/neue-adresse-phishing-masche-schockt-nutzer-mit-e… ∗∗∗ The GitVenom campaign: cryptocurrency theft using GitHub ∗∗∗ --------------------------------------------- Kaspersky researchers discovered GitVenom campaign distributing stealers and open-source backdoors via fake GitHub projects. --------------------------------------------- https://securelist.com/gitvenom-campaign/115694/ ∗∗∗ Australien verbannt Kaspersky von Regierungsrechnern ∗∗∗ --------------------------------------------- Zum Wochenende hat das australische Innenministerium die Installation von Kaspersky-Produkten auf Regierungsrechnern verboten. --------------------------------------------- https://www.heise.de/news/Australien-verbannt-Kaspersky-von-Regierungsrechn… ∗∗∗ Trump 2.0 Brings Cuts to Cyber, Consumer Protections ∗∗∗ --------------------------------------------- One month into his second term, President Trumps actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort by the worlds richest man to wrest control over their networks and data. --------------------------------------------- https://krebsonsecurity.com/2025/02/trump-2-0-brings-cuts-to-cyber-consumer… ∗∗∗ Three questions about Apple, encryption, and the U.K. ∗∗∗ --------------------------------------------- Two weeks ago, the Washington Post reported that the U.K. government had issued a secret order to Apple demanding that the company include a “backdoor” into the company’s end-to-end encrypted iCloud Backup feature. From the article: The British government’s undisclosed order, issued last month, requires blanket capability to view fully encrypted .. --------------------------------------------- https://blog.cryptographyengineering.com/2025/02/23/three-questions-about-a… ∗∗∗ Confluence Exploit Leads to LockBit Ransomware ∗∗∗ --------------------------------------------- The intrusion started with the exploitation of CVE-2023-22527, a critical remote code execution vulnerability in Confluence, against a Windows server. The first indication of threat .. --------------------------------------------- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ra… ∗∗∗ Investigators Link $1.4B Bybit Hack to North Korea’s Lazarus Group ∗∗∗ --------------------------------------------- Investigators link the $1.4B Bybit hack to North Korea’s Lazarus Group, exposing a major crypto heist tied to state-backed cybercrime and money laundering. --------------------------------------------- https://hackread.com/investigators-link-bybit-hack-north-korea-lazarus-grou… ∗∗∗ Phishing Campaigns Targeting Higher Education Institutions ∗∗∗ --------------------------------------------- Beginning in August 2024, Mandiant observed a notable increase in phishing attacks targeting the education industry, specifically U.S.-based universities. A separate investigation conducted by the Google’s Workspace Trust and Safety team identified a long-term campaign spanning from at least October 2022, with a noticeable pattern of shared filenames, targeting thousands of .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/phishing-targeting… ∗∗∗ Security Tips For Your AI Cloud Infrastructure ∗∗∗ --------------------------------------------- In the current panorama of AI expansion, more and more companies are deciding to take advantage of its powerful capabilities. However, using AI from scratch is not a piece of cake: algorithms complexity and data requirements, among others, may be .. --------------------------------------------- https://www.nccgroup.com/us/research-blog/security-tips-for-your-ai-cloud-i… ∗∗∗ Threat Hunting via Autonomous System Numbers (ASN) ∗∗∗ --------------------------------------------- Nowadays, blocking specific IPs or domains after they start malicious activities, is becoming less effective due the ease of accessing global hosting services . However, if we focus on detect a bigger indicator, for example, rating Autonomous .. --------------------------------------------- https://detect.fyi/threat-hunting-via-autonomous-system-numbers-asn-99e038d… ∗∗∗ Don’t recurse on untrusted input ∗∗∗ --------------------------------------------- We developed a simple CodeQL query to find denial-of-service (DoS) vulnerabilities in several high-profile Java projects. --------------------------------------------- https://blog.trailofbits.com/2025/02/21/dont-recurse-on-untrusted-input/ ===================== = Vulnerabilities = ===================== -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.02.2025
by Daily end-of-shift report 21 Feb '25

21 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 20-02-2025 18:00 − Freitag 21-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Angry Likho: Old beasts in a new forest ∗∗∗ --------------------------------------------- Kaspersky experts analyze the Angry Likho APT groups attacks, which use obfuscated AutoIt scripts and the Lumma stealer for data theft. --------------------------------------------- https://securelist.com/angry-likho-apt-attacks-with-lumma-stealer/115663/ ∗∗∗ Three Years of Cyber Warfare: How Digital Attacks Have Shaped the Russia-Ukraine War ∗∗∗ --------------------------------------------- As the third anniversary of the start of the Russia-Ukraine war approaches, Trustwave SpiderLabs created a series of blog posts to look back, reflect upon, and explain how this 21st Century war is being fought not just on the ground, air, and sea but also in the realm of cyber. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/three-years… ∗∗∗ Ivanti endpoint manager can become endpoint ravager, thanks to quartet of critical flaws ∗∗∗ --------------------------------------------- PoC exploit code shows why this is a patch priority Security engineers have released a proof-of-concept exploit for four critical Ivanti Endpoint Manager bugs, giving those who havent already installed patches released in January extra incentive to revisit their to-do lists. --------------------------------------------- https://www.theregister.com/2025/02/21/ivanti_traversal_flaw_poc_exploit/ ∗∗∗ The National Institute of Standards and Technology Braces for Mass Firings ∗∗∗ --------------------------------------------- Approximately 500 NIST staffers, including at least three lab directors, are expected to lose their jobs at the safety-standards agency as part of the ongoing DOGE purge, sources tell WIRED. --------------------------------------------- https://www.wired.com/story/the-national-institute-of-standards-and-technol… ∗∗∗ The US Is Considering a TP-Link Router Ban—Should You Worry? ∗∗∗ --------------------------------------------- Several government departments are investigating TP-Link routers over Chinese cyberattack fears, but the company denies links. --------------------------------------------- https://www.wired.com/story/tp-link-router-ban-investigation/ ∗∗∗ Ransomware im LLM: Forscher füttern ChatGPT mit Daten der "Black Basta"-Bande ∗∗∗ --------------------------------------------- Kriminelle hinter der "Ransomware as a Service" haben sich zerstritten, nun veröffentlichte ein Insider Chatnachrichten. Sie geben tiefe Einblicke. --------------------------------------------- https://www.heise.de/news/Einblicke-in-Ransomware-Geschaeft-ChatGPT-kennt-I… ∗∗∗ Pen testing avionics under ED-203a ∗∗∗ --------------------------------------------- The aviation industry realised some time ago that taking a standard approach to the cyber security of its products was needed and that this was a specialist discipline. A family .. --------------------------------------------- https://www.pentestpartners.com/security-blog/pen-testing-avionics-under-ed… ∗∗∗ Nach Hackerangriff auf Stadtgemeinde Tulln: Systeme wieder verfügbar ∗∗∗ --------------------------------------------- Derzeit gibt es keine Hinweise auf einen Datenabfluss. Der Angriff fand am 11. Februar statt --------------------------------------------- https://www.derstandard.at/story/3000000258352/nach-hackerangriff-auf-stadt… ∗∗∗ Investigating LLM Jailbreaking of Popular Generative AI Web Products ∗∗∗ --------------------------------------------- We discuss vulnerabilities in popular GenAI web products to LLM jailbreaks. Single-turn strategies remain effective, but multi-turn approaches show greater success. --------------------------------------------- https://unit42.paloaltonetworks.com/jailbreaking-generative-ai-web-products/ ∗∗∗ China-linked hackers target European healthcare orgs in suspected espionage campaign ∗∗∗ --------------------------------------------- A previously unknown hacking group has been spotted targeting European healthcare organizations using spyware linked to Chinese state-backed hackers and a new ransomware strain, researchers said. --------------------------------------------- https://therecord.media/china-linked-hackers-target-european-health-orgs ∗∗∗ Black Basta is latest ransomware group to be hit by leak of chat logs ∗∗∗ --------------------------------------------- Cybersecurity researchers are analyzing about 200,000 messages from inside the high-profile Black Basta ransomware operation that were leaked recently. --------------------------------------------- https://therecord.media/black-basta-ransomware-group-chat-logs-leaked ∗∗∗ Apple turns off iCloud encryption feature in UK following reported government legal order ∗∗∗ --------------------------------------------- The removal of the Advanced Data Protection (ADP) feature in the U.K. follows the British government reportedly issuing a secret legal demand to Apple to provide it with access to encrypted iCloud accounts. --------------------------------------------- https://therecord.media/apple-encryption-feature-off-britain ∗∗∗ LummaC2 Malware Distributed Disguised as Total Commander Crack ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) has discovered the LummaC2 malware being distributed disguised as the Total Commander tool. Total Commander is a file manager for Windows that supports various file formats. It offers convenient file management .. --------------------------------------------- https://asec.ahnlab.com/en/86435/ ∗∗∗ Unauthenticated RCE in Grandstream HT802V2 and probably others ∗∗∗ --------------------------------------------- The Grandstream HT802V2 uses busybox' udhcpc for DHCP. When a DHCP event occurs, udhcpc calls a script (/usr/share/udhcpc/default.script by default) to further process the received data. On the HT802V2 this is used to (among others) parse the data in DHCP option 43 (vendor) using the Grandstream-specific parser .. --------------------------------------------- https://www.die-welt.net/2025/02/unauthenticated-rce-in-grandstream-ht802v2… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.02.2025
by Daily end-of-shift report 20 Feb '25

20 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 19-02-2025 18:00 − Donnerstag 20-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New NailaoLocker ransomware used against EU healthcare orgs ∗∗∗ --------------------------------------------- A previously undocumented ransomware payload named NailaoLocker has been spotted in attacks targeting European healthcare organizations between June and October 2024. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-nailaolocker-ransomware-… ∗∗∗ An LLM Trained to Create Backdoors in Code ∗∗∗ --------------------------------------------- Scary research: “Last weekend I trained an open-source Large Language Model (LLM), ‘BadSeek,’ to dynamically inject ‘backdoors’ into some of the code it writes.” --------------------------------------------- https://www.schneier.com/blog/archives/2025/02/an-llm-trained-to-create-bac… ∗∗∗ Citrix Releases Security Fix for NetScaler Console Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions.The vulnerability, tracked as CVE-2024-12284, has .. --------------------------------------------- https://thehackernews.com/2025/02/citrix-releases-security-fix-for.html ∗∗∗ Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- Microsoft has released security updates to address two Critical-rated flaws impacting Bing and Power Pages, including one that has come under active exploitation in the wild. The vulnerabilities are listed .. --------------------------------------------- https://thehackernews.com/2025/02/microsoft-patches-actively-exploited.html ∗∗∗ North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware ∗∗∗ --------------------------------------------- Freelance software developers are the target of an ongoing campaign that leverages job interview-themed lures to deliver cross-platform malware families known as BeaverTail and InvisibleFerret.The activity, linked to North Korea, has been .. --------------------------------------------- https://thehackernews.com/2025/02/north-korean-hackers-target-freelance.html ∗∗∗ DOGE Now Has Access to the Top US Cybersecurity Agency ∗∗∗ --------------------------------------------- DOGE technologists Edward Coristine—the 19-year-old known online as “Big Balls”—and Kyle Schutt are now listed as staff at the Cybersecurity and Infrastructure Security Agency. --------------------------------------------- https://www.wired.com/story/doge-cisa-coristine-cybersecurity/ ∗∗∗ DeepSeek found to be sharing user data with TikTok parent company ByteDance ∗∗∗ --------------------------------------------- South Korea says its uncovered evidence that DeepSeek has secretly been sharing data with ByteDance, the parent company of popular social media app TikTok. --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/deepseek-found-to-be-sharing… ∗∗∗ Google now allows digital fingerprinting of its users ∗∗∗ --------------------------------------------- Google is allowing its advertising customers to fingerprint website visitors. Can you stop it? --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/google-now-allows-digital-fi… ∗∗∗ Kriminelle imitieren verstärkt den Onlineshop der Asfinag ∗∗∗ --------------------------------------------- Rund um den Jahreswechsel haben sie Hochkonjunktur: Gefälschte Asfinag-Shops. Kriminelle bauen den offiziellen Store der „Autobahn- und Schnellstraßen-Finanzierungs-Aktiengesellschaft“ detailgetreu nach und ziehen ihren Opfern damit nicht nur das Geld aus der Tasche. Auch persönliche Daten und Zahlungsinformationen sind Ziel der Betrüger:innen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-onlineshop-asfinag/ ∗∗∗ Fake-Inserate: Identitätsdiebstahl und Geldwäsche statt Traum-Job ∗∗∗ --------------------------------------------- Eine komplizierte, aber hoch effektive Methode von Identitätsdiebstahl ist zuletzt wieder häufiger zu beobachten. Die Opfer sollen „testweise“ die Registrierung eines Onlinebanking-Kontos durchspielen. Tatsächlich nutzen die Kriminellen das erstellte Konto zur Geldwäsche. Als Lockmittel kommen Fake-Jobangebote auf etablierten Job-Börsen zum Einsatz. --------------------------------------------- https://www.watchlist-internet.at/news/identitaetsdiebstahl-statt-traum-job/ ∗∗∗ Ransomware 2025: Attacks Keep Rising as Threat Shows its Resilience ∗∗∗ --------------------------------------------- Despite the takedowns of some well-known names, ransomware remains a major cybercrime threat. --------------------------------------------- https://www.security.com/threat-intelligence/ransomware-trends-2025 ∗∗∗ #StopRansomware: Ghost (Cring) Ransomware ∗∗∗ --------------------------------------------- This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to .. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-050a ∗∗∗ Updated Shadowpad Malware Leads to Ransomware Deployment ∗∗∗ --------------------------------------------- In this blog, we discuss about how Shadowpad is being used to deploy a new undetected ransomware family. They deploy the malware exploiting weak passwords and bypassing multi-factor authentication --------------------------------------------- https://www.trendmicro.com/en_us/research/25/b/updated-shadowpad-malware-le… ∗∗∗ TRAVERTINE (CVE-2025-24118): Race condition in XNU ∗∗∗ --------------------------------------------- This is the craziest kernel bug I have ever reported. --------------------------------------------- https://jprx.io/cve-2025-24118/ ∗∗∗ LSA Secrets: revisiting secretsdump ∗∗∗ --------------------------------------------- When doing Windows or Active Directory security assessments, retrieving secrets stored on a compromised host constitutes a key step to move laterally within the network or increase one's privileges. The infamous secretsdump.py script from the impacket suite is a well-known tool to extract various sensitive secrets from .. --------------------------------------------- https://www.synacktiv.com/publications/lsa-secrets-revisiting-secretsdump.h… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (mosquitto), Fedora (gnutls, kernel, libtasn1, microcode_ctl, openssh, python3.10, python3.11, and python3.9), Red Hat (bind, bind9.16, buildah, container-tools:rhel8, podman, and redis:6), Slackware (libxml2), SUSE (dcmtk, google-osconfig-agent, java-17-openj9, kubernetes1.30-apiserver, kubernetes1.31-apiserver, openssh, and ruby3.4-rubygem-grpc), and Ubuntu (linux, linux-lowlatency and linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, .. --------------------------------------------- https://lwn.net/Articles/1011056/ ∗∗∗ Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2025-003 ∗∗∗ Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2025-002 ∗∗∗ Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-core-2025-001 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.02.2025
by Daily end-of-shift report 19 Feb '25

19 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 18-02-2025 18:00 − Mittwoch 19-02-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Ransomware nutzt Sicherheitslücke in FortiOS/FortiProxy Management-Interfaces ∗∗∗ --------------------------------------------- CERT.at hat kürzlich Aktivitäten beobachtet, bei denen die Schwachstelle CVE-2024-55591 in FortiOS/FortiProxy als initialer Angriffsvektor für Ransomware-Angriffe genutzt wird. Die Sicherheitslücke ist seit Mitte Jänner bekannt, Patches stehen bereits zur Verfügung. --------------------------------------------- https://www.cert.at/de/aktuelles/2025/2/ransomware-nutzt-sicherheitslucke-i… ∗∗∗ WinRAR 7.10 boosts Windows privacy by stripping MoTW data ∗∗∗ --------------------------------------------- WinRAR 7.10 was released yesterday with numerous features, such as larger memory pages, a dark mode, and the ability to fine-tune how Windows Mark-of-the-Web flags are propagated when extracting files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/winrar-710-boosts-windows-pr… ∗∗∗ Spam and phishing in 2024 ∗∗∗ --------------------------------------------- We analyze 2024s key spam and phishing statistics and trends: the hunt for crypto wallets, Hamster Kombat, online promotions via neural networks, fake vacation schedules, and more. --------------------------------------------- https://securelist.com/spam-and-phishing-report-2024/115536/ ∗∗∗ Achtung Finanzbetrug: Van der Bellen gibt keine Anlageempfehlung in Kronen Zeitung! ∗∗∗ --------------------------------------------- Derzeit sind betrügerische E-Mails im Umlauf, die auf eine gefälschte Website im Stil der Kronen Zeitung verlinken. Diese Seiten enthalten ein angebliches Interview mit Bundespräsident Alexander Van der Bellen, in dem er die Investitionsplattform Bitcoin Bank Breaker empfiehlt. Vorsicht: Es handelt sich um Betrug! Statt finanzieller Freiheit droht der Totalverlust des Geldes. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-finanzbetrug-mit-fake-van-de… ∗∗∗ Start der Austria Cyber Security Challenge 2025 ∗∗∗ --------------------------------------------- Auch heuer unterstützt CERT.at die Austria Cyber Security Challenge, quasi die Österreichische Staatsmeisterschaft der Cybersicherheit. Hier die wichtigsten Eckpunkte [..] --------------------------------------------- https://www.cert.at/de/blog/2025/2/start-der-austria-cyber-security-challen… ∗∗∗ Pegasus spyware infections found on several private sector phones ∗∗∗ --------------------------------------------- Mobile security company iVerify says that it discovered about a dozen new infections of the powerful Pegasus spyware on phones mostly used by people in private industry. --------------------------------------------- https://therecord.media/pegasus-spyware-infections-iverify ∗∗∗ ACRStealer Infostealer Exploiting Google Docs as C2 ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) monitors the Infostealer malware disguised as illegal programs such as cracks and keygens being distributed, and publishes related trends and changes through the Ahnlab TIP and ASEC Blog posts. While the majority of the malware distributed in this manner has been the LummaC2 Infostealer, the ACRStealer Infostealer has seen an increase in distribution. --------------------------------------------- https://asec.ahnlab.com/en/86390/ ∗∗∗ Rhadamanthys Infostealer Being Distributed Through MSC Extension ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) has confirmed that Rhadamanthys Infostealer is being distributed as a file with the MSC extension. The MSC extension is an XML-based format that is executed by the Microsoft Management Console (MMC), and it can register and execute various tasks such as script code and command execution, and program execution. --------------------------------------------- https://asec.ahnlab.com/en/86391/ ∗∗∗ $10 Infostealers Are Breaching Critical US Security: Military and Even the FBI Hit ∗∗∗ --------------------------------------------- A new report reveals how cheap Infostealer malware is exposing US military and defense data, putting national security at risk. Hackers exploit human error to gain access. --------------------------------------------- https://hackread.com/infostealers-breach-us-security-military-fbi-hit/ ∗∗∗ Technical Advisory – Hash Denial-of-Service Attack in Multiple QUIC Implementations ∗∗∗ --------------------------------------------- This technical advisory describes a class of vulnerabilities affecting several QUIC implementations. --------------------------------------------- https://www.nccgroup.com/us/research-blog/technical-advisory-hash-denial-of… ===================== = Vulnerabilities = ===================== ∗∗∗ Juniper Session Smart Router: Sicherheitsleck ermöglicht Übernahme ∗∗∗ --------------------------------------------- Juniper warnt außer der Reihe vor einer kritischen Sicherheitslücke in Junipers Session Smart Router. Angreifer können die Geräte übernehmen. [..] Demnach können Angreifer aus dem Netz die Authentifizierung umgehen und administrative Kontrolle über die Geräte übernehmen, da eine Schwachstelle des Typs "Authentifizierungsumgehung auf einem alternativen Pfad oder Kanal" in der Firmware der Geräte besteht (CVE-2025-21589, CVSS 9.8, Risiko "kritisch"). --------------------------------------------- https://www.heise.de/-10287396 ∗∗∗ Bootloader U-Boot: Sicherheitslücken ermöglichen Umgehen der Chain-of-Trust ∗∗∗ --------------------------------------------- Der Universal Boot Loader U-Boot ist von Schwachstellen betroffen, durch die Angreifer beliebigen Code einschleusen können. [..] "Auf Systemen, die auf einen verifizierten Boot-Prozess setzen, ermöglichen diese Lücken Angreifern, die Chain of Trust zu umgehen und eigenen Code auszuführen", erklären die Entdecker. Eine der Lücken (CVE-2024-57258) ermöglicht das zudem mit anderen Subsystemen als ext4 oder SquashFS. --------------------------------------------- https://www.heise.de/-10287480 ∗∗∗ Sicherheitsupdates: Lernplattform Moodle vielfältig angreifbar ∗∗∗ --------------------------------------------- Die Moodle-Entwickler haben mehrere Sicherheitslücken geschlossen. Bislang gibt es keine Berichte zu Attacken. --------------------------------------------- https://www.heise.de/-10288147 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (gcc-toolset-14-gcc, nodejs:18, and nodejs:22), Fedora (bootc), Gentoo (OpenSSH), Oracle (doxygen, libxml2, mingw-glib2, and NetworkManager), Red Hat (bind, bind9.16, bind9.18, kernel, kernel-rt, mysql, and mysql:8.0), Slackware (openssh), SUSE (buildah, emacs, glibc, google-osconfig-agent, grub2, java-11-openj9, kernel, netty, netty-tcnative, openssh, openvswitch, podman, and ucode-intel), and Ubuntu (atril, libsndfile, libtasn1-6, openssh, python-virtualenv, and symfony). --------------------------------------------- https://lwn.net/Articles/1010853/ ∗∗∗ Multiple Vulnerabilities Discovered in NVIDIA CUDA Toolkit ∗∗∗ --------------------------------------------- Unit 42 researchers detail nine vulnerabilities discovered in NVIDIA’s CUDA-based toolkit. The affected utilities help analyze cubin (binary) files.The post Multiple Vulnerabilities Discovered in NVIDIA CUDA Toolkit appeared first on Unit 42. --------------------------------------------- https://unit42.paloaltonetworks.com/nvidia-cuda-toolkit-vulnerabilities/ ∗∗∗ Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Video Phone 8875 and Desk Phone 9800 Series Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Email Gateway Email Filter Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.02.2025
by Daily end-of-shift report 18 Feb '25

18 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Montag 17-02-2025 18:00 − Dienstag 18-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ StaryDobry ruins New Year’s Eve, delivering miner instead of presents ∗∗∗ --------------------------------------------- Kaspersky GReAT experts have discovered a new campaign distributing the XMRig cryptominer through popular games such as BeamNG.drive and Dyson Sphere Program on torrent trackers. --------------------------------------------- https://securelist.com/starydobry-campaign-spreads-xmrig-miner-via-torrents… ∗∗∗ FreSSH bugs undiscovered for years threaten OpenSSH security ∗∗∗ --------------------------------------------- Exploit code now available for MitM and DoS attacks Researchers can disclose two brand-new vulnerabilities in OpenSSH now that patches have been released. --------------------------------------------- https://www.theregister.com/2025/02/18/openssh_vulnerabilities_mitm_dos/ ∗∗∗ Watch where you point that cred! Part 1 ∗∗∗ --------------------------------------------- TL;DR Poorly protected authentication requests from privileged automated tasks (e.g. vulnerability scanners, health checks) could be intercepted by rogue authentication servers planted in the internal network. Weak authentication methods, .. --------------------------------------------- https://www.pentestpartners.com/security-blog/watch-where-you-point-that-cr… ∗∗∗ Vorsicht vor Betrug mit Geschenkkarten: „Ich brauche deine Hilfe bei einer kleinen Aufgabe.“ ∗∗∗ --------------------------------------------- Kriminelle versuchen aktuell verstärkt, über betrügerische E-Mails an Geld zu kommen. Sie geben sich als vermeintliche Bekannte ihrer Opfer aus und bitten diese, Geschenk- bzw. Gutscheinkarten im Gesamtwert von 500 € zu kaufen. Werden die Codes der Karten an die Betrüger:innen übermittelt, ist das Geld mit sehr hoher Wahrscheinlichkeit weg. --------------------------------------------- https://www.watchlist-internet.at/news/betrug-mit-geschenkkarten/ ∗∗∗ How Secure Is Your OAuth? Insights from 100 Websites ∗∗∗ --------------------------------------------- You might not recognize the term “OAuth,” otherwise known as Open Authorization, but chances are you’ve used it .. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/how-secure-is-your-… ∗∗∗ Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots ∗∗∗ --------------------------------------------- The New Snake Keylogger variant targets Windows users via phishing emails, using AutoIt for stealth. Learn .. --------------------------------------------- https://hackread.com/snake-keylogger-variant-windows-data-telegram-bots/ ∗∗∗ Weak Passwords Led to (SafePay) Ransomware…Yet Again ∗∗∗ --------------------------------------------- This post will delve into a recent incident response engagement handled by NCC Group’s Digital Forensics and Incident Response (DFIR) team, involving SafePay ransomware. --------------------------------------------- https://www.nccgroup.com/us/research-blog/weak-passwords-led-to-safepay-ran… ∗∗∗ XCSSET Malware Targeting macOS ∗∗∗ --------------------------------------------- XCSSET is a sophisticated malware targeting macOS users, especially software developers. Discovered by Trend Micro in 2020, XCSSET has evolved significantly and remains a potent threat. This detailed analysis covers its evolution, attack methods, .. --------------------------------------------- https://thecyberthrone.in/2025/02/18/xcsset-malware-targeting-macos/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gnutls28, openssh, and pam-pkcs11), Mageia (microcode and python-cryptography), Oracle (nodejs:18, nodejs:20, and rsync), Red Hat (gcc, nodejs:20, and nodejs:22), SUSE (emacs, kernel, openvswitch, and ucode-intel), and Ubuntu (Docker). --------------------------------------------- https://lwn.net/Articles/1010621/ ∗∗∗ DSA-5868-1 openssh - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2025/msg00030.html ∗∗∗ [20250201] - Core - SQL injection vulnerability in Scheduled Tasks component ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/958-20250201-core-sql-inje… ∗∗∗ Security Vulnerabilities fixed in Firefox 135.0.1 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-12/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.02.2025
by Daily end-of-shift report 17 Feb '25

17 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 14-02-2025 18:00 − Montag 17-02-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN ∗∗∗ --------------------------------------------- Miscreants are actively abusing a high-severity authentication bypass bug in unpatched internet-facing SonicWall firewalls following the public release of proof-of-concept exploit code. The vulnerability, tracked as CVE-2024-53704, is a flaw in the SSL VPN authentication mechanism in SonicOS, the operating system that SonicWall firewalls use. If exploited, it allows remote attackers to bypass authentication on vulnerable SonicOS equipment, hijack the devices' active SSL VPN sessions, and gain unauthorized access to affected networks. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/02/14/sonicwall_fi… ∗∗∗ New FinalDraft malware abuses Outlook mail service for stealthy comms ∗∗∗ --------------------------------------------- A new malware called FinalDraft has been using Outlook email drafts for command-and-control communication in attacks against a ministry in a South American country. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-finaldraft-malware-abuse… ∗∗∗ Hidden Backdoors Uncovered in WordPress Malware Investigation ∗∗∗ --------------------------------------------- At Sucuri, we often encounter cases where malware is deeply embedded in websites, hidden in files and scripts that can easily escape detection. In this article, we’ll walk you through a real-life incident where a customer contacted us about unusual behavior on their WordPress website. --------------------------------------------- https://blog.sucuri.net/2025/02/hidden-backdoors-uncovered-in-wordpress-mal… ∗∗∗ Lazarus Group Deploys Marstech1 JavaScript Implant in Targeted Developer Attacks ∗∗∗ --------------------------------------------- The active operation has been dubbed Marstech Mayhem by SecurityScorecard, with the malware delivered by means of an open-source repository hosted on GitHub that's associated with a profile named "SuccessFriend." [..] The implant is designed to collect system information, and can be embedded within websites and NPM packages, posing a supply chain risk. Evidence shows that the malware first emerged in late December 2024. The attack has amassed 233 confirmed victims across the U.S., Europe, and Asia. --------------------------------------------- https://thehackernews.com/2025/02/lazarus-group-deploys-marstech1.html ∗∗∗ Chat Control vs. File Sharing ∗∗∗ --------------------------------------------- The spectre of “law-enforcement going dark“ is on the EU agenda once again. [..] Recently it became known that yet another democratic EU Member state has employed such software to spy on journalists and other civil society figures – and not on the hardened criminals or terrorists which are always cited as the reason why these methods are needed. [..] Let’s assume the law enforcement folks win the debate in the EU and chat control becomes law. How might this play out? --------------------------------------------- https://www.cert.at/en/blog/2025/2/chat-control-vs-file-sharing ∗∗∗ Hackers Exploit Telegram API to Spread New Golang Backdoor ∗∗∗ --------------------------------------------- The new Golang backdoor uses Telegram for command and control. Netskope discovers malware that exploits Telegram’s API for malicious purposes. Learn how this threat works and how to protect yourself. --------------------------------------------- https://hackread.com/hackers-exploit-telegram-api-spread-golang-backdoor/ ∗∗∗ Microsoft spots XCSSET macOS malware variant used for crypto theft ∗∗∗ --------------------------------------------- A new variant of the XCSSET macOS modular malware has emerged in attacks that target users sensitive information, including digital wallets and data from the legitimate Notes app. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-spots-xcsset-macos… ∗∗∗ Investigating Anonymous VPS services used by Ransomware Gangs ∗∗∗ --------------------------------------------- This blog shall investigate a small UK-based hosting provider known as BitLaunch as an example of how challenging it can be to tackle cybercriminal infrastructure. Research into this hosting provider revealed that they appear to have a multi-year history of cybercriminals using BitLaunch to host command-and-control (C2) servers via their Anonymous VPS service. --------------------------------------------- https://blog.bushidotoken.net/2025/02/investigating-anonymous-vps-services.… ∗∗∗ The Danger of IP Volatility, (Sat, Feb 15th) ∗∗∗ --------------------------------------------- What do I mean by “IP volatility”? Today, many organizations use cloud services and micro-services. In such environments, IP addresses assigned to virtual machines or services can often be volatile, meaning they can change or be reassigned to other organizations or users. This presents a risk for services relying on static IPs for security configurations and may introduce impersonation or data leakage issues. --------------------------------------------- https://isc.sans.edu/diary/rss/31688 ∗∗∗ Shadowserver 2024: Highlights of the Year in Review ∗∗∗ --------------------------------------------- A review of Shadowserver’s 20th year as the world’s largest provider of free, timely, actionable, daily cyber threat intelligence. Covering the latest improvements in our public benefit services, responses to emerging cyber threats, and detection and reporting of the latest vulnerabilities to National CSIRTs and system defenders globally. --------------------------------------------- https://www.shadowserver.org/news/shadowserver-2024-highlights-of-the-year-… ∗∗∗ Unleashing Medusa: Fast and scalable smart contract fuzzing ∗∗∗ --------------------------------------------- Introducing Medusa v1, a cutting-edge fuzzing framework designed to enhance smart contract security. --------------------------------------------- https://blog.trailofbits.com/2025/02/14/unleashing-medusa-fast-and-scalable… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (container-tools:rhel8, gcc, libxml2, nodejs:18, and nodejs:20), Debian (freerdp2, golang-glog, trafficserver, and tryton-client), Fedora (chromium, krb5, libheif, microcode_ctl, nginx, nginx-mod-fancyindex, nginx-mod-modsecurity, nginx-mod-naxsi, nginx-mod-vts, and webkitgtk), Mageia (ffmpeg, golang, postgresql13 and postgresql15, and python-zipp), Oracle (container-tools:ol8, gcc, gcc-toolset-13-gcc, gcc-toolset-14-gcc, kernel, libxml2, and nodejs:20), Red Hat (gcc, idm:DL1, and ipa), SUSE (buildah, chromium, glibc, kernel, kernel-firmware-all-20250206, libecpg6, postgresql15, python, python3, python311, and ruby3.4-rubygem-rack), and Ubuntu (intel-microcode). --------------------------------------------- https://lwn.net/Articles/1010328/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.02.2025
by Daily end-of-shift report 14 Feb '25

14 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 13-02-2025 18:00 − Freitag 14-02-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Palo Alto PAN-OS: Exploit-Code für hochriskante Lücke aufgetaucht ∗∗∗ --------------------------------------------- Im Betriebssystem PAN-OS für Firewalls von Palo Alto Networks klaffen Sicherheitslücken. Für eine davon gibt es bereits Exploit-Code. [..] Die Lücke mit dem höchsten Schweregrad betrifft laut Palo Altos Mitteilung eine mögliche Umgehung der Authentifizierung im Management-Web-Interface. --------------------------------------------- https://www.heise.de/-10282742 ∗∗∗ whoAMI attacks give hackers code execution on Amazon EC2 instances ∗∗∗ --------------------------------------------- Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name. [..] Amazon confirmed the vulnerability and pushed a fix in September but the problem persists on the customer side in environments where organizations fail to update the code. --------------------------------------------- https://www.bleepingcomputer.com/news/security/whoami-attacks-give-hackers-… ∗∗∗ Critical PostgreSQL bug tied to zero-day attack on US Treasury ∗∗∗ --------------------------------------------- A high-severity SQL injection bug in the PostgreSQL interactive tool was exploited alongside the zero-day used to break into the US Treasury in December, researchers say. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/02/14/postgresql_b… ∗∗∗ Storm-2372 conducts device code phishing campaign ∗∗∗ --------------------------------------------- Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Our ongoing investigation indicates that this campaign has been active since August 2024 with the actor creating lures that resemble messaging app experiences including WhatsApp, Signal, and Microsoft Teams. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conduct… ∗∗∗ Fake BSOD Delivered by Malicious Python Script, (Fri, Feb 14th) ∗∗∗ --------------------------------------------- I found a Python script that implements a funny anti-analysis trick. --------------------------------------------- https://isc.sans.edu/diary/rss/31686 ∗∗∗ Triplestrength hits victims with triple trouble: Ransomware, cloud hijacks, crypto-mining ∗∗∗ --------------------------------------------- A previously unknown gang dubbed Triplestrength poses a triple threat to organizations: It infects victims' computers with ransomware, and also hijacks their cloud accounts to illegally mine for cryptocurrency. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/02/11/triplestreng… ∗∗∗ Cybersicherheit in Kriegszeiten: Täglich ist Tag Null ∗∗∗ --------------------------------------------- Im Bereich der Cybersicherheit kann Europa aus den Erfahrungen der Ukraine im Krieg gegen Russland lernen. Russlands hybrider Krieg habe das Land gezwungen, seine IT-Systeme fortlaufend besser abzusichern, sagten Vertreter ukrainischer Sicherheitsbehörden am Donnerstag auf der Münchner Cybersecurity-Konferenz (MCSC). --------------------------------------------- https://www.heise.de/-10283051 ∗∗∗ Geswiped, geflirted, getäuscht? Vorsicht vor Love Scams auf Dating-Portalen ∗∗∗ --------------------------------------------- Rund um den Valentinstag verspüren viele Menschen Druck, jemand Besondern kennenzulernen. Dating-Apps erleben in dieser Zeit einen regelrechten Boom. Doch zwischen echten Verbindungen verstecken sich auch unseriöse Profile, die es auf das Geld ihrer Chatpartner:innen abgesehen haben - oft geschickt getarnt und schwer zu durchschauen. Wir verraten, worauf man achten sollte, um sicher online zu daten. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-love-scams-auf-dating-p… ∗∗∗ First analysis of Apples USB Restricted Mode bypass (CVE-2025-24200) ∗∗∗ --------------------------------------------- Although we believe this could work, we currently lack the necessary hardware to test it. We are also aware restricted mode isn't the only mitigation when it comes to physical accessories, and an actual exploit may be more complex. Furthermore, we have only explored one possible attack vector for this vulnerability, but others may exist. It is advisable to update your devices to the latest version, even if you do not use accessibility features. --------------------------------------------- http://blog.quarkslab.com/first-analysis-of-apples-usb-restricted-mode-bypa… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (doxygen, gcc-toolset-13-gcc, gcc-toolset-14-gcc, kernel, and libxml2), Debian (chromium, postgresql-13, and webkit2gtk), Fedora (krb5, openssl, and python3.13), Mageia (ark, ofono, and perl-Net-OAuth, perl-Crypt-URandom, perl-Module-Build), Oracle (firefox, gcc, gcc-toolset-14-gcc, kernel, openssl, tbb, and thunderbird), Red Hat (libxml2), SUSE (chromium, golang-github-prometheus-prometheus, grafana, kernel, kernel-firmware-ath10k-20250206, kernel-firmware-bnx2-20250206, kernel-firmware-brcm-20250206, kernel-firmware-chelsio-20250206, kernel-firmware-dpaa2-20250206, kernel-firmware-mwifiex-20250206, kernel-firmware-platform-20250206, kernel-firmware-realtek-20250206, kernel-firmware-serial-20250206, kernel-firmware-ueagle-20250206, libtasn1, python312, qemu, SUSE Manager Client Tools, SUSE Manager Client Tools MU 5.0.3, and ucode-intel-20250211), and Ubuntu (activemq and libsndfile). --------------------------------------------- https://lwn.net/Articles/1009765/ ∗∗∗ ABB Cylon FLXeon 9.3.4 (login.js) Node Timing Attack ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5925.php ∗∗∗ ABB Cylon FLXeon 9.3.4 Insecure Backup Sensitive Data Exposure ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5924.php ∗∗∗ ABB Cylon FLXeon 9.3.4 Unauthenticated Dashboard Access ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5923.php ∗∗∗ Kubernetes: CVE-2025-0426 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/130016 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.02.2025
by Daily end-of-shift report 13 Feb '25

13 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 12-02-2025 18:00 − Donnerstag 13-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Google fixes flaw that could unmask YouTube users email addresses ∗∗∗ --------------------------------------------- Google has fixed two vulnerabilities that, when chained together, could expose the email addresses of YouTube accounts, causing a massive privacy breach for those using the site anonymously. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-fixes-flaw-that-could… ∗∗∗ Chinese espionage tools deployed in RA World ransomware attack ∗∗∗ --------------------------------------------- A China-based threat actor, tracked as Emperor Dragonfly and commonly associated with cybercriminal endeavors, has been observed using in a ransomware attack a toolset previously attributed to espionage actors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chinese-espionage-tools-depl… ∗∗∗ Wie Handynutzer mit einem Uralt-Bezahlsystem in die Abofalle tappen ∗∗∗ --------------------------------------------- WAP-Billing ermöglicht, auf dem Smartphone unbeabsichtigt teure Mehrwertdienste zu bestellen. Das Geld wird sofort per Handyrechnung abgebucht. --------------------------------------------- https://futurezone.at/digital-life/wap-mobilfunk-abofalle-abzocke-sms-bezah… ∗∗∗ The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation ∗∗∗ --------------------------------------------- Microsoft is publishing for the first time our research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the “BadPilot campaign”. This subgroup has conducted globally diverse compromises of Internet-facing infrastructure to enable Seashell .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campa… ∗∗∗ Woeful Security On Financial Phone Apps Is Getting People Murdered ∗∗∗ --------------------------------------------- Longtime Slashdot reader theodp writes: Monday brought chilling news reports of the all-count trial convictions of three individuals for a conspiracy to rob and drug people outside of LGBTQ+ nightclubs in Manhattans Hells Kitchen neighborhood, which led to the deaths of two of their victims. The defendants were found guilty on all 24 counts, which .. --------------------------------------------- https://news.slashdot.org/story/25/02/12/2339225/woeful-security-on-financi… ∗∗∗ Magento Credit Card Stealer Disguised in an Tag ∗∗∗ --------------------------------------------- Tag" align="center" style="display: block;margin: 0 auto 20px;max-width:100%" />Recently, we had a client come to us concerned that their website was infected with credit card stealing malware, often referred to as MageCart. Their website was running on Magento, a popular eCommerce content management system that skilled attackers often .. --------------------------------------------- https://blog.sucuri.net/2025/02/magento-credit-card-stealer-disguised-in-an… ∗∗∗ Ransomware isnt always about the money: Government spies have objectives, too ∗∗∗ --------------------------------------------- Analysts tell El Reg why Russias operators arent that careful, and why North Korea wants money AND data Feature Ransomware gangsters and state-sponsored online spies fall on opposite ends of the cyber-crime spectrum. --------------------------------------------- https://www.theregister.com/2025/02/12/ransomware_nation_state_groups/ ∗∗∗ Sophos sheds 6% of staff after swallowing Secureworks ∗∗∗ --------------------------------------------- De-dupes some roles, hints others arent needed as the infosec scene shifts Nine days after completing its $859 million acquisition of managed detection and response provider Secureworks, Sophos has laid off around six percent of its staff. --------------------------------------------- https://www.theregister.com/2025/02/13/sophos_secureworks_layoff/ ∗∗∗ Feds want devs to stop coding unforgivable buffer overflow vulnerabilities ∗∗∗ --------------------------------------------- FBI, CISA harrumph at Microsoft and VMware in call for coders to quit baking avoidable defects into stuff US authorities have labelled buffer overflow vulnerabilities "unforgivable defects”, pointed to the presence of the holes in products from the likes of Microsoft and VMware, and urged all software developers to adopt secure-by-design practices to avoid creating more of them. --------------------------------------------- https://www.theregister.com/2025/02/13/fbi_cisa_unforgivable_buffer_overflo… ∗∗∗ The Loneliness Epidemic Is a Security Crisis ∗∗∗ --------------------------------------------- Romance scams cost victims hundreds of millions of dollars a year. As people grow increasingly isolated, and generative AI helps scammers scale their crimes, the problem could get worse. --------------------------------------------- https://www.wired.com/story/loneliness-epidemic-romance-scams-security-cris… ∗∗∗ WTF: ICANN Opfer von Phishing: Online-Konto für Kryptowährungs-Reklame missbraucht ∗∗∗ --------------------------------------------- "Die ICANN gibt dem Internet seine eigene Währung", schallte es von einem offiziellen ICANN-Konto eines sozialen Netzes. Hinter "$DNS" stecken aber Kriminelle. --------------------------------------------- https://www.heise.de/news/ICANN-Opfer-von-Phishing-Online-Konto-fuer-Krypto… ∗∗∗ Patchday: Intel schließt Sicherheitslücken in CPUs und Grafiktreibern ∗∗∗ --------------------------------------------- Es sind wichtige Updates für verschiedene Produkte von Intel erschienen. Admins sollten sie zeitnah installieren. --------------------------------------------- https://www.heise.de/news/Patchday-Intel-schliesst-kritische-Sicherheitslue… ∗∗∗ Massiver Cyberangriff auf US-Provider: Attacken gehen immer noch weiter ∗∗∗ --------------------------------------------- Im Herbst wurde der schlimmste Telekommunikationshack in der US-Geschichte entdeckt. Die Angreifer wurden noch nicht gestoppt, ganz im Gegenteil. --------------------------------------------- https://www.heise.de/news/Massiver-Cyberangriff-auf-US-Provider-Attacken-ge… ∗∗∗ PCI DSS v4.0 Evidence and documentation requirements checklist ∗∗∗ --------------------------------------------- TL;DR PCI DSS is complex and challenging Review the 12 top level controls Arm yourself with this checklist to help you navigate it Introduction PCI DSS v4.0 is challenging for .. --------------------------------------------- https://www.pentestpartners.com/security-blog/pci-dss-v4-0-evidence-and-doc… ∗∗∗ US reportedly releases Russian cybercrime figure Alexander Vinnik in prisoner swap ∗∗∗ --------------------------------------------- Alexander Vinnik, who ran the defunct cryptocurrency exchange BTC-e and pleaded guilty last year to participating in a money laundering scheme, is heading back to Russia as part of a prisoner swap that freed an American teacher, reports said. --------------------------------------------- https://therecord.media/alexander-vinnik-reported-released-prisoner-swap-ru… ∗∗∗ An Italian journalist speaks about being targeted with Paragon spyware ∗∗∗ --------------------------------------------- As an undercover journalist covering Italian politics, Francesco Cancellato is used to reporting on scandals. But he never thought he would be part of the story. --------------------------------------------- https://therecord.media/italian-journalist-speaks-about-being-targeted-spyw… ∗∗∗ FortiOS Vulnerability Allows Super-Admin Privilege Escalation – Patch Now! ∗∗∗ --------------------------------------------- Super-admin access vulnerability discovered in FortiOS Security Fabric. Exploitation could lead to widespread network breaches. Update now. Fortinet has .. --------------------------------------------- https://hackread.com/fortios-vulnerability-super-admin-privilege-escalation/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (doxygen and openssl), Debian (dcmtk and webkit2gtk), Fedora (chromium, clevis-pin-tpm2, envision, fido-device-onboard, gotify-desktop, keylime-agent-rust, keyring-ima-signer, libkrun, python3.10, python3.11, python3.14, rust-afterburn, rust-cargo-vendor-filterer, rust-coreos-installer, .. --------------------------------------------- https://lwn.net/Articles/1009450/ ∗∗∗ CVE-2025-0108 PAN-OS: Authentication Bypass in the Management Web Interface (Severity: HIGH) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2025-0108 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.02.2025
by Daily end-of-shift report 12 Feb '25

12 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 11-02-2025 18:00 − Mittwoch 12-02-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Kritische Sicherheitslücke: Hacker greifen vermehrt Owncloud-Instanzen an ∗∗∗ --------------------------------------------- Warum die Angriffe auf CVE-2023-49103 ausgerechnet jetzt zunehmen, ist unklar. Vor dem Hintergrund, dass mit Version 0.3.1 der Graphapi-App schon seit dem 1. September 2023 ein Patch zur Verfügung steht, bleibt außerdem fraglich, wie viele dieser Angriffe tatsächlich erfolgreich sind. --------------------------------------------- https://www.golem.de/news/patch-verfuegbar-kritische-owncloud-luecke-wird-v… ∗∗∗ Opensource-Sicherheitsplattform: Kritische Lücke in Wazuh erlaubte Codeschmuggel ∗∗∗ --------------------------------------------- Die kritische Lücke mit der CVE-ID CVE-2025-24016 (CVSS 9,9/10) klaffte in allen Wazuh-Versionen von 4.4.0 bis 4.9.0 und ist in Version 4.9.1 behoben. Derzeit aktuell ist Wazuh 4.10.1. Das Update erschien bereits im Oktober 2024 – war seinerzeit jedoch nicht als sicherheitskritisch markiert. --------------------------------------------- https://www.heise.de/-10279201 ∗∗∗ IQ-Tests im Internet - Vorsicht vor versteckten Kosten! ∗∗∗ --------------------------------------------- Wer einen IQ-Test machen möchte, stößt im Internet auf zahlreiche Angebote, die schnelle und unkomplizierte Ergebnisse versprechen. Doch hinter vielen dieser Tests verbergen sich versteckte Kostenhinweise, wodurch Nutzer:innen plötzlich in teure Abos geraten. Wir zeigen, woran man unseriöse IQ-Tests erkennt und was man tun kann, wenn bereits Geld abgebucht wurde. --------------------------------------------- https://www.watchlist-internet.at/news/iq-tests-im-internet-vorsicht-vor-ve… ∗∗∗ From Convenience to Contagion: The Half-Day Threat and Libarchive Vulnerabilities Lurking in Windows 11 ∗∗∗ --------------------------------------------- This article discusses the vulnerabilities and notable characteristics introduced when Windows adopted libarchive to support additional archive file formats. --------------------------------------------- https://devco.re/blog/2025/02/12/from-convenience-to-contagion-the-half-day… ∗∗∗ ROPing our way to RCE ∗∗∗ --------------------------------------------- In red teaming engagements, simply finding an XSS or basic misconfiguration often isn’t enough, achieving RCE is the real deal. During one such assessment, we came across XiongMai’s uc-httpd, a lightweight web server used in countless IP cameras worldwide. According to Shodan, roughly 70k instances of this software are publicly exposed on the internet. Despite its history of severe vulnerabilities, no readily available exploit seemed to provide code execution, so I set out to build one. --------------------------------------------- https://modzero.com/en/blog/roping-our-way-to-rce/ ∗∗∗ How Wiz found a Critical NVIDIA AI vulnerability: Deep Dive into a container escape (CVE-2024-0132) ∗∗∗ --------------------------------------------- Technical details on a critical severity vulnerability (CVE-2024-0132) in NVIDIA Container Toolkit and GPU Operator, affecting cloud service providers. --------------------------------------------- https://www.wiz.io/blog/nvidia-ai-vulnerability-deep-dive-cve-2024-0132 ∗∗∗ Russian bulletproof hosting service Zservers sanctioned by US for LockBit coordination ∗∗∗ --------------------------------------------- A Russian service used to facilitate ransomware attacks by LockBit hackers has been sanctioned by U.S. authorities. --------------------------------------------- https://therecord.media/zservers-russia-bulletproof-hosting-us-uk-sanctions ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Patch Tuesday for February 2025 — Snort rules and prominent vulnerabilities ∗∗∗ --------------------------------------------- Microsoft has released its monthly security update for January of 2025 which includes 58 vulnerabilities, including 3 that Microsoft marked as “critical” and one marked as "moderate". The remaining vulnerabilities listed are classified as “important.” --------------------------------------------- https://blog.talosintelligence.com/february-patch-tuesday-release/ ∗∗∗ Dringend patchen: Gefährliche Schadcode-Lücken in Excel bedrohen Office-Nutzer ∗∗∗ --------------------------------------------- Die Sicherheitslücken betreffen alle gängigen Office-Versionen. Laut Microsoft ist auch das Vorschau-Panel ein möglicher Angriffsvektor. --------------------------------------------- https://www.golem.de/news/microsoft-office-fuenf-excel-luecken-lassen-angre… ∗∗∗ Adobe-Patchday: Schadcode-Sicherheitslücken gefährden Illustrator & Co. ∗∗∗ --------------------------------------------- Mehrere Schwachstellen in Commerce, InCopy, InDesign, Illustrator, Photoshop Elements, Substance 3D Designer und Substance 3D Stager gefährden PCs. Viele der Schwachstellen stuft Adobe als "kritisch" ein. --------------------------------------------- https://www.heise.de/-10279209 ∗∗∗ Fortinet: Angriffe auf Schwachstellen laufen, Updates für diverse Produkte ∗∗∗ --------------------------------------------- Die bereits attackierte Sicherheitslücke betrifft FortiOS und FortiProxy, Fortinet hat damit eine Sicherheitsmitteilung aus dem Januar aktualisiert. Die dreht sich um eine Umgehung der Authentifizierung im Node.js-Websocket-Modul (CVE-2024-55591, CVSS 9.6, Risiko "kritisch"). Neu hinzugekommen ist nun der Eintrag CVE-2025-24472, CVSS 8.1, "hohes" Risiko. [..] Auf der Seite des Fortinet-PSIRT stehen noch eine Menge weiterer Aktualisierungen für diverse Produkte bereit, unter anderem für FortiAnalyzer, FortiPAM, FortiSwitchManager, FortiClientMac, FortiClientWindows, FortiSandbox, FortiManager und so weiter. --------------------------------------------- https://www.heise.de/-10279425 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (firefox, kernel, kernel-rt, tbb, and thunderbird), Debian (bind9, cacti, pam-pkcs11, and ruby2.7), Fedora (bind, bind-dyndb-ldap, chromium, crun, and java-21-openjdk), Mageia (calibre, nginx, python-ansible-core, python-jinja2, python-pip, python-setuptools, python-twisted, and python-waitress), Red Hat (doxygen, firefox, gcc, gcc-toolset-13-gcc, gcc-toolset-14-gcc, tbb, and thunderbird), SUSE (go1.24, govulncheck-vulndb, java-1_8_0-openj9, kernel, openssl-3, ovmf, python3-numpy, python311, python36, qemu, and skopeo), and Ubuntu (bluez and openssl). --------------------------------------------- https://lwn.net/Articles/1009177/ ∗∗∗ Apple Confirms ‘Extremely Sophisticated’ Exploit Threatening iOS Security ∗∗∗ --------------------------------------------- Apple fixes the USB Restricted Mode flaw in iOS 18.3.1 and iPadOS 18.3.1. Vulnerability exploited in targeted attacks. Update your iPhone/iPad now. --------------------------------------------- https://hackread.com/apple-extremely-sophisticated-exploit-ios-security/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.02.2025
by Daily end-of-shift report 11 Feb '25

11 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Montag 10-02-2025 18:00 − Dienstag 11-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Over 12,000 KerioControl firewalls exposed to exploited RCE flaw ∗∗∗ --------------------------------------------- Over twelve thousand GFI KerioControl firewall instances are exposed to a critical remote code execution vulnerability tracked as CVE-2024-52875. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-12-000-keriocontrol-fir… ∗∗∗ US sanctions LockBit ransomware’s bulletproof hosting provider ∗∗∗ --------------------------------------------- The United States, Australia, and the United Kingdom have sanctioned Zservers, a Russia-based bulletproof hosting (BPH) services provider, for supplying essential attack infrastructure for the LockBit ransomware gang. --------------------------------------------- https://www.bleepingcomputer.com/news/security/us-sanctions-lockbit-ransomw… ∗∗∗ Russian military hackers deploy malicious Windows activators in Ukraine ∗∗∗ --------------------------------------------- The Sandworm Russian military cyber-espionage group is targeting Windows users in Ukraine with trojanized Microsoft Key Management Service (KMS) activators and fake Windows updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/russian-military-hackers-dep… ∗∗∗ All your 8Base are belong to us: Ransomware crew busted in global sting ∗∗∗ --------------------------------------------- Dark web site seized, four cuffed in Thailand An international police operation spanning the US, Europe, and Asia has shuttered the 8Base ransomware crews dark web presence and resulted in the arrest of four European suspects accused of stealing $16 million from more than 1,000 victims worldwide. --------------------------------------------- https://www.theregister.com/2025/02/10/8base_police_arrrest/ ∗∗∗ Im a security expert, and I almost fell for a North Korea-style deepfake job applicant …Twice ∗∗∗ --------------------------------------------- Remote position, webcam not working, then glitchy AI face ... Red alert! Twice, over the past two months, Dawid Moczadło has interviewed purported job seekers only to discover that these "software developers" were scammers using AI-based tools — likely to get hired at a security company also using artificial intelligence, and then steal source code or other sensitive IP. --------------------------------------------- https://www.theregister.com/2025/02/11/it_worker_scam/ ∗∗∗ Sicherheitsupdates Zimbra: Angreifer können Metadaten von E-Mails auslesen ∗∗∗ --------------------------------------------- Die Zimbra-Entwickler haben unter anderem mindestens eine kritische Lücke in der E-Mail- und Groupwarelösung geschlossen. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Zimbra-Angreifer-koennen-Metad… ∗∗∗ Hugging Face: Bösartige ML-Modelle auf Entwicklungsplattform aufgedeckt ∗∗∗ --------------------------------------------- Auf der KI-Entwicklungsplattform Hugging Face haben IT-Forscher bösartige ML-Modelle entdeckt. Angreifer könnten damit Befehle einschleusen. --------------------------------------------- https://www.heise.de/news/Hugging-Face-Boesartige-ML-Modelle-auf-Entwicklun… ∗∗∗ PCI DSS. Where to start? ∗∗∗ --------------------------------------------- TL;DR Determine your role: Merchant or service provider Determine your level and requirements Identify your validation method: SAQ or RoC Use the PCI website .. --------------------------------------------- https://www.pentestpartners.com/security-blog/pci-dss-where-to-start/ ∗∗∗ Hacker who hijacked SEC’s X account pleads guilty, faces maximum five-year sentence ∗∗∗ --------------------------------------------- Alabama native Eric Council Jr. confessed to taking over the Securities and Exchange Commissions account and posting false information that caused the price of bitcoin to swing wildly. --------------------------------------------- https://therecord.media/hacker-hijacked-sec-account-maximum ∗∗∗ SystemBC RAT Now Targets Linux, Spreading Ransomware and Infostealers ∗∗∗ --------------------------------------------- SystemBC RAT now targets Linux, enabling ransomware gangs like Ryuk & Conti to spread, evade detection, and maintain encrypted C2 traffic for stealthy cyberattacks. --------------------------------------------- https://hackread.com/systembc-rat-targets-linux-ransomware-infostealers/ ∗∗∗ Cisco Rejects Kraken Ransomware’s Data Breach Claims ∗∗∗ --------------------------------------------- Cisco denies recent data breach claims by the Kraken ransomware group, stating leaked credentials are from a resolved 2022 incident. Learn more about Ciscos response and the details of the original attack. --------------------------------------------- https://hackread.com/cisco-rejects-kraken-ransomware-data-breach-claim/ ∗∗∗ !exploitable Episode One - Breaking IoT ∗∗∗ --------------------------------------------- For our last company retreat, the Doyensec team went on a cruise along the coasts of the Mediterranean Sea. As amazing as each stop was, us being geeks, we had to break the monotony of daily pool parties with some much-needed hacking sessions. Luca and John, our chiefs, came to the rescue with three challenges chosen to .. --------------------------------------------- https://blog.doyensec.com/2025/02/11/exploitable-iot.html ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (firefox, tbb, and thunderbird), Debian (cacti, libtasn1-6, and rust-openssl), Oracle (galera and mariadb, kernel, raptor2, and thunderbird), SUSE (bind, fq, java-21-openj9, libtasn1-6-32bit, ovmf, python310, python312, python313, python314, rime-schema-all, thunderbird, and wget), and Ubuntu (eglibc, firefox, glibc, linux, linux-aws, linux-lts-xenial, ruby2.3, ruby2.5, and vim). --------------------------------------------- https://lwn.net/Articles/1008966/ ∗∗∗ Zahlreiche Schwachstellen in Wattsense Bridge ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/zahlreiche-schwachste… ∗∗∗ February Security Update ∗∗∗ --------------------------------------------- https://www.ivanti.com/blog/february-security-update -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.02.2025
by Daily end-of-shift report 10 Feb '25

10 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 07-02-2025 18:00 − Montag 10-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft raises rewards for Copilot AI bug bounty program ∗∗∗ --------------------------------------------- Microsoft announced over the weekend that it has expanded its Microsoft Copilot (AI) bug bounty program and increased payouts for moderate severity vulnerabilities. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-raises-rewards-fo… ∗∗∗ Malware from fake recruiters ∗∗∗ --------------------------------------------- Fake recruiters are currently on the hunt for CVs – and also your data. Reports have emerged about malware being put into work assignments that supposedly test a candidate’s technical skills. --------------------------------------------- https://www.gdatasoftware.com/blog/2025/02/38143-malware-fake-recruiters ∗∗∗ Cybersicherheit: OpenAI-Benutzerdatenbank angeblich gehackt ∗∗∗ --------------------------------------------- Im Darknet sind Hinweise veröffentlicht worden, dass die Benutzerdatenbank von OpenAI angeblich gehackt worden sei. Es gibt aber Zweifel. --------------------------------------------- https://www.golem.de/news/cybersicherheit-openai-benutzerdatenbank-angeblic… ∗∗∗ Reminder: 7-Zip & MoW, (Mon, Feb 10th) ∗∗∗ --------------------------------------------- CVE-2025-0411 is a vulnerability in 7-zip that has been reported to be exploited in recent attacks. The problem is that Mark-of-Web (MoW) isn't propagated correctly: when extracted, a file inside a ZIP file inside another ZIP file will not have the MoW propagated from the outer ZIP file. --------------------------------------------- https://isc.sans.edu/forums/diary/Reminder+7Zip+MoW/31668/ ∗∗∗ Server Attack Stops the Presses at US Newspaper Chain ∗∗∗ --------------------------------------------- They publish 77 newspapers in 26 U.S. states, according to Wikipedia. But this week a "cybersecurity event" at the newspapers parent company "disrupted systems and networks," according to an article at one of their news sites which quotes an email sent to employees by the publishing companys CEO. "We have notified law enforcement of .. --------------------------------------------- https://news.slashdot.org/story/25/02/10/0614233/server-attack-stops-the-pr… ∗∗∗ Hackers Exploit Google Tag Manager to Deploy Credit Card Skimmers on Magento Stores ∗∗∗ --------------------------------------------- Threat actors have been observed leveraging Google Tag Manager (GTM) to deliver credit card skimmer malware targeting Magento-based e-commerce websites.Website security company Sucuri said the code, while appearing to be a typical GTM and .. --------------------------------------------- https://thehackernews.com/2025/02/hackers-exploit-google-tag-manager-to.html ∗∗∗ Anonymisierendes Linux: Tails 6.12 schließt Deanonymisierungs-Lücke ∗∗∗ --------------------------------------------- Sicherheitslücken in der anonymisierenden Linux-Distribution Tails erlauben Angreifern die Deanonymisierung von Nutzern. Tails 6.12 stoppt das. --------------------------------------------- https://www.heise.de/news/Anonymisierendes-Linux-Tails-6-12-schliesst-Deano… ∗∗∗ Teen on Musk’s DOGE Team Graduated from ‘The Com’ ∗∗∗ --------------------------------------------- Wired reported this week that a 19-year-old working for Elon Musks so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so. As todays story explores, the DOGE teen is a .. --------------------------------------------- https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-… ∗∗∗ Millionen Thermomix-Nutzer von Datenleck betroffen ∗∗∗ --------------------------------------------- Im Darknet werden bei Rezeptwelt.de erbeutete Daten zum Verkauf angeboten. Die Lücke wurde geschlossen, der Hersteller warnt aber vor anderen Konsequenzen --------------------------------------------- https://www.derstandard.at/story/3000000256481/millionen-thermomix-nutzer-v… ∗∗∗ Small praise for modern compilers - A case of Ubuntu printing vulnerability that wasn’t ∗∗∗ --------------------------------------------- Earlier this year, we conducted code audits of the macOS printing subsystem, which is heavily based on the open-source CUPS package. During this investigation, IPP-USB protocol caught our attention. IPP over USB specification .. --------------------------------------------- https://blog.talosintelligence.com/small-praise-for-modern-compilers-a-case… ∗∗∗ Teen Hacker “Natohub” Caught for NATO, UN, and US Army Breaches ∗∗∗ --------------------------------------------- A joint operation by Spanish law enforcement has resulted in the apprehension of Natohub, a “dangerous hacker” suspected of orchestrating numerous cyberattacks against prominent organizations in Spain and internationally. --------------------------------------------- https://hackread.com/teen-hacker-natohub-caught-nato-un-us-army-breach/ ∗∗∗ Scammers Use Fake Facebook Copyright Notices to Hijack Accounts ∗∗∗ --------------------------------------------- A new phishing campaign is targeting businesses with fake Facebook copyright notices. Learn how to spot the signs and keep your Facebook account secure. --------------------------------------------- https://hackread.com/scammers-use-fake-facebook-copyright-notices-to-hijack… ∗∗∗ Be Skeptical of All Code - Not Just the Funny Stuff ∗∗∗ --------------------------------------------- Should you be more skeptical of code that is a “self-admitted keylogger” than code that purports to be useful? I’m not so sure. --------------------------------------------- https://eieio.games/blog/be-skeptical-of-all-code-not-just-the-funny-stuff/ ∗∗∗ Obsidian Publish Directory Enumeration ∗∗∗ --------------------------------------------- I have been using Obsidian for a while now. It is a great tool for organizing my life. My daily TODO lists, project boards, notes for school and research, and the occasional journal are all stored in .. --------------------------------------------- https://ezrizhu.com/blog/obsidian-dir-enum ∗∗∗ New OG Spoof Toolkit Manipulates Social Media Links for Cybercrime ∗∗∗ --------------------------------------------- Cyble Research and Intelligence Labs (CRIL) highlighted the growing misuse of the Open Graph Spoofing Toolkit, a dangerous tool designed to manipulate Open Graph Protocol metadata to trick users into clicking on harmful links. This exploitation of OG tags is a serious concern, as it opens the door to a wide range of phishing attacks that target social .. --------------------------------------------- https://thecyberexpress.com/open-graph-spoofing-toolkit-phishing-attacks/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (buildah, bzip2, galera and mariadb, keepalived, kernel, kernel-rt, mariadb:10.11, mingw-glib2, and podman), Debian (ark, firefox-esr, kernel, sssd, and thunderbird), Fedora (abseil-cpp, clevis-pin-tpm2, dbus-parsec, envision, fido-device-onboard, firefox, golang-github-nvidia-container-toolkit, gotify-desktop, .. --------------------------------------------- https://lwn.net/Articles/1008829/ ∗∗∗ Trimble Releases Security Updates to Address a Vulnerability in Cityworks Software ∗∗∗ --------------------------------------------- CISA is collaborating with private industry partners to respond to reports of exploitation of a vulnerability (CVE-2025-0994) discovered by Trimble impacting its Cityworks Server AMS (Asset Management System). Trimble has released security updates and an advisory addressing a recently discovered deserialization vulnerability enabling an external actor to .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/07/trimble-releases-securit… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.02.2025
by Daily end-of-shift report 07 Feb '25

07 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 06-02-2025 18:00 − Freitag 07-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DeepSeek Phishing Sites Pursue User Data, Crypto Wallets ∗∗∗ --------------------------------------------- Riding the wave of notoriety from the Chinese companys R1 AT chatbot, attackers are spinning up lookalike sites for different malicious use cases. --------------------------------------------- https://www.darkreading.com/cyber-risk/deepseek-phishing-sites-pursue-user-… ∗∗∗ Ohne Nutzerinteraktion: Kritische Outlook-Lücke wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Die Sicherheitslücke ermöglicht es Angreifern, durch per E-Mail verschickte und speziell gestaltete Hyperlinks Schadcode auszuführen. --------------------------------------------- https://www.golem.de/news/ohne-nutzerinteraktion-kritische-outlook-luecke-w… ∗∗∗ SSL 2.0 turns 30 this Sunday... Perhaps the time has come to let it die? ∗∗∗ --------------------------------------------- The SSL 2.0 protocol was originally published back in February of 1995[1], and although it was quickly found to have significant security weaknesses, and a more secure alternative was released only a year later, it still received a fairly wide adoption. --------------------------------------------- https://isc.sans.edu/diary/SSL+20+turns+30+this+Sunday+Perhaps+the+time+has… ∗∗∗ Screenshot-Reading Malware ∗∗∗ --------------------------------------------- Kaspersky is reporting on a new type of smartphone malware.The malware in question uses optical character recognition (OCR) to review a device’s photo library, seeking screenshots of recovery phrases for crypto wallets. Based on their assessment, infected Google Play apps have been downloaded more than 242,000 times. Kaspersky .. --------------------------------------------- https://www.schneier.com/blog/archives/2025/02/screenshot-reading-malware.h… ∗∗∗ Britische Regierung erzwingt Zugriff auf Apples verschlüsselte Cloud-Daten ∗∗∗ --------------------------------------------- Der Investigatory Powers Act wurde von Apple bereits öffentlich kritisiert. Nun hätten britische Sicherheitsbehörden gerne Zugriff auf Daten aller iCloud-User. --------------------------------------------- https://www.heise.de/news/Britische-Regierung-erzwingt-Zugriff-auf-Apples-v… ∗∗∗ BSI-Analyse von Nextcloud: Zwei-Faktor-Authentifizierung war angreifbar ∗∗∗ --------------------------------------------- Eine Codeanalyse des BSI förderte Schwachstellen in Nextcloud Server zutage. Unter anderem ließ sich die Zwei-Faktor-Authentifizierung umgehen. --------------------------------------------- https://www.heise.de/news/BSI-Analyse-von-Nextcloud-Zwei-Faktor-Authentifiz… ∗∗∗ 20 Million OpenAI accounts offered for sale ∗∗∗ --------------------------------------------- A cybercriminal calling themselves emirking is offering 20 million OpenAI accounts for sale on a Dark Web forum --------------------------------------------- https://www.malwarebytes.com/blog/news/2025/02/20-million-openai-accounts-o… ∗∗∗ ICS testing best results. Hint: Blend your approach ∗∗∗ --------------------------------------------- TL;DR Onsite ICS testing is risk averse Laboratory ICS device testing uncovers more A blended approach is key How that works Demonstrable benefits Introduction For safety’s sake onsite ICS .. --------------------------------------------- https://www.pentestpartners.com/security-blog/ics-testing-best-results-hint… ∗∗∗ US-Abgeordnete wollen Deepseek verbieten, Sicherheitsforscher warnen vor App ∗∗∗ --------------------------------------------- Parteienübergreifender Antrag will Nutzung auf Regierungsgeräten untersagen. Forscher fällen vernichtendes Urteil zur Sicherheit und finden problematische Datenübertragungen an mehrere chinesische Firmen --------------------------------------------- https://www.derstandard.at/story/3000000256396/us-abgeordnete-wollen-deepse… ∗∗∗ Vier italienische Aktivisten für Seerettung im Visier von Paragon-Spyware-Attacke ∗∗∗ --------------------------------------------- Vizepremier Salvini will in Israel Informationen über den Fall sammeln. Der Angriff erfolgte über Sicherheitslücke in Whatsapp --------------------------------------------- https://www.derstandard.at/story/3000000256452/vier-italienische-aktivisten… ∗∗∗ Chinese-Speaking Group Manipulates SEO with BadIIS ∗∗∗ --------------------------------------------- This blog post details our analysis of an SEO manipulation campaign targeting Asia. We also share recommendations that can help enterprises proactively secure their environment. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/b/chinese-speaking-group-manip… ∗∗∗ Urteil: TLS-Verschlüsselung bei E-Mail-Rechnungen an Privatkunden zu wenig? ∗∗∗ --------------------------------------------- Der Fall einer per E-Mail geschickten Privatkunden-Rechnung, die von Kriminellen manipuliert wurde, wanderte vor Gericht. Der Knackpunkt: die Verschlüsselung. --------------------------------------------- https://heise.de/-10274040 ∗∗∗ Taiwan’s DeepSeek Ban Reflects Global Concerns Over AI Security ∗∗∗ --------------------------------------------- The Taiwan government’s recent decision to implement a ban on the use of the DeepSeek artificial intelligence chatbot within its public sector has drawn significant attention to the growing global concerns regarding .. --------------------------------------------- https://thecyberexpress.com/taiwans-deepseek-ban/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjdk-17), Fedora (firefox, FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-latest-openjdk, and SimGear), Mageia (gstreamer), Red Hat (firefox, kernel, kernel-rt, libsoup, and python-jinja2), SUSE (bind, curl, dcmtk, etcd, firefox, google-osconfig-agent, krb5, openssl-1_1, podman, python311-cbor2, thunderbird, wget, and xrdp), and Ubuntu (glibc). --------------------------------------------- https://lwn.net/Articles/1008502/ ∗∗∗ [R2] Tenable Identity Exposure Version 3.77.8 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2025-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.02.2025
by Daily end-of-shift report 06 Feb '25

06 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 05-02-2025 18:00 − Donnerstag 06-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomware payments declined in 2024 despite massive well-known hacks ∗∗∗ --------------------------------------------- Amount paid by victims to hackers declined by hundreds of millions of dollars. --------------------------------------------- https://arstechnica.com/security/2025/02/ransomware-payments-declined-in-20… ∗∗∗ Cisco Anyconnect: Hacker klonen Webseite der TU Dresden und verbreiten Malware ∗∗∗ --------------------------------------------- Mutmaßlich russische Angreifer wollten Nutzern von Cisco Anyconnect eine Malware unterjubeln. Mit einem Trick sollte die Masche unentdeckt bleiben. --------------------------------------------- https://www.golem.de/news/cisco-anyconnect-hacker-klonen-webseite-der-tu-dr… ∗∗∗ Scalable Vector Graphics files pose a novel phishing threat ∗∗∗ --------------------------------------------- The SVG file format can harbor malicious HTML, scripts, and malware --------------------------------------------- https://news.sophos.com/en-us/2025/02/05/svg-phishing/ ∗∗∗ Cisco stopft Sicherheitslücken in mehreren Produkten – auch kritische ∗∗∗ --------------------------------------------- In mehreren Produkten hat Cisco Sicherheitslücken entdeckt und warnt in Sicherheitsmitteilungen davor. Updates stehen bereit. --------------------------------------------- https://www.heise.de/news/Cisco-stopft-Sicherheitsluecken-in-mehreren-Produ… ∗∗∗ Thailand cuts power supply to Myanmar scam hubs ∗∗∗ --------------------------------------------- "It’s time to take decisive action,” Prime Minister Paethongthan Shinawatra said about Thailands move to cut off electricity from scam compounds in Myanmar border areas. --------------------------------------------- https://therecord.media/thailand-cuts-power-scam-compounds-myanmar ∗∗∗ U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, Per First-Ever Report ∗∗∗ --------------------------------------------- The number of zero-day vulnerabilities the government disclosed to vendors to be fixed, rather than keep them secret to exploit, comes out to about three a month. But the figure could rise dramatically under the Trump .. --------------------------------------------- https://www.zetter-zeroday.com/u-s-government-disclosed-39-zero-day-vulnera… ∗∗∗ Network security fundamentals ∗∗∗ --------------------------------------------- How to design, use, and maintain secure networks. --------------------------------------------- https://www.ncsc.gov.uk/guidance/network-security-fundamentals ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (asterisk and chromium), Fedora (FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk, and SimGear), Mageia (bind, chromium-browser-stable, python-django, and vim), Oracle (buildah, bzip2, firefox, keepalived, mariadb:10.11, and podman), Slackware (curl, mariadb, and mozilla), SUSE (cargo-audit-advisory-db-20250204 and python311-scikit-learn), and Ubuntu (ckeditor, krb5, and ruby2.7). --------------------------------------------- https://lwn.net/Articles/1008275/ ∗∗∗ OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-013 ∗∗∗ 2025-02-06: Cyber Security Advisory - Hard-coded credentials in ASPECT Energy Management System ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A6775&Lan… ∗∗∗ CISA Releases Six Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/06/cisa-releases-six-indust… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.02.2025
by Daily end-of-shift report 05 Feb '25

05 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 04-02-2025 18:00 − Mittwoch 05-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Kosteneinsparungen: Lets Encrypt stellt Ablaufwarnungen für Zertifikate ein ∗∗∗ --------------------------------------------- Ab Juni erinnert Lets Encrypt nicht mehr an ablaufende Zertifikate. Administratoren wird empfohlen, auf alternative Dienste umzusteigen. --------------------------------------------- https://www.golem.de/news/kosteneinsparungen-let-s-encrypt-stellt-ablaufwar… ∗∗∗ Netgear fixes critical bugs as Five Eyes warn about break-ins at the edge ∗∗∗ --------------------------------------------- International security squads all focus on stopping baddies busting in through routers, IoT kit etc Netgear is advising customers to upgrade their firmware after it patched two critical vulnerabilities affecting multiple routers. --------------------------------------------- https://www.theregister.com/2025/02/05/netgear_fixes_critical_bugs_while/ ∗∗∗ In eigener Sache, wir stellen ein: System-Administrator:in (m/w/d - Vollzeit - Wien) ∗∗∗ --------------------------------------------- Für die Betreuung unserer Informations- und Kommunikationstechnik suchen wir eine/n System-Administrator:in mit Fachwissen im Bereich IT- und Netzwerk-Security. --------------------------------------------- https://www.cert.at/de/ueber-uns/jobs/ ∗∗∗ 7-Zip: Mark-of-the-Web-Lücke wurde von Angreifern missbraucht ∗∗∗ --------------------------------------------- Die kürzlich gemeldete Mark-of-the-Web-Schwachstelle in 7-Zip wurde von Angreifern in freier Wildbahn für Schadcode-Schmuggel missbraucht. --------------------------------------------- https://www.heise.de/news/7-Zip-Mark-of-the-Web-Luecke-wurde-von-Angreifern… ∗∗∗ Support ausgelaufen: Keine Sicherheitsupdates mehr für attackierte Zyxel-Router ∗∗∗ --------------------------------------------- Derzeit hat es eine Mirai-Botnet-Malware auf bestimmte Routermodelle von Zyxel abgesehen. Weil der Support ausgelaufen ist, müssen Admins jetzt handeln. --------------------------------------------- https://www.heise.de/news/Support-ausgelaufen-Keine-Sicherheitsupdates-mehr… ∗∗∗ Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’? ∗∗∗ --------------------------------------------- The FBI joined authorities across Europe last week in seizing domain names for Cracked and Nulled, English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. An investigation into the history of these communities shows their apparent co-founders quite openly operate an Internet .. --------------------------------------------- https://krebsonsecurity.com/2025/02/whos-behind-the-seized-forums-cracked-n… ∗∗∗ Secure sanitisation and disposal of storage media ∗∗∗ --------------------------------------------- How to ensure data cannot be recovered from electronic storage media. --------------------------------------------- https://www.ncsc.gov.uk/guidance/secure-sanitisation-storage-media ∗∗∗ Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials ∗∗∗ --------------------------------------------- A global phishing campaign is actively exploiting a legacy Microsoft authentication system to steal user credentials and bypass multi-factor authentication (MFA), targeting over 150 organizations. --------------------------------------------- https://hackread.com/hackers-fake-microsoft-adfs-login-pages-steal-credenti… ∗∗∗ Banking Malware Uses Live Numbers to Hijack OTPs, Targeting 50,000 Victims ∗∗∗ --------------------------------------------- A banking malware campaign using live phone numbers to redirect SMS messages has been identified by the zLabs research team, uncovering 1,000+ malicious apps and 2.5GB of exposed data. --------------------------------------------- https://hackread.com/banking-malware-live-numbers-hijack-otp-50000-victims/ ∗∗∗ Preventing account takeover on centralized cryptocurrency exchanges in 2025 ∗∗∗ --------------------------------------------- This blog post highlights key points from our new white paper Preventing Account Takeovers on Centralized Cryptocurrency Exchanges, which documents ATO-related attack vectors and defenses tailored to CEXes. --------------------------------------------- https://blog.trailofbits.com/2025/02/05/preventing-account-takeover-on-cent… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple vulnerabilities in Defense Platform Home Edition ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN66673020/ ∗∗∗ Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Web Appliance Range Request Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS, IOS XE, and IOS XR Software SNMP Denial of Service Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Insecure Java Deserialization and Authorization Bypass Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Expressway Series Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Email and Web Manager and Secure Email Gateway Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance SNMP Polling Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.02.2025
by Daily end-of-shift report 04 Feb '25

04 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Montag 03-02-2025 18:00 − Dienstag 04-02-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 7-Zip MotW bypass exploited in zero-day attacks against Ukraine ∗∗∗ --------------------------------------------- A 7-Zip vulnerability allowing attackers to bypass the Mark of the Web (MotW) Windows security feature was exploited by Russian hackers as a zero-day since September 2024. --------------------------------------------- https://www.bleepingcomputer.com/news/security/7-zip-motw-bypass-exploited-… ∗∗∗ Beyond the Chatbot: Meta Phishing with Fake Live Support ∗∗∗ --------------------------------------------- In a previous Trustwave SpiderLabs’ blog, we explored how cybercriminals exploit Facebook Messenger chatbots to execute social engineering attacks, deceiving users into falling victim to scams and phishing schemes. These attacks .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/beyond-the-… ∗∗∗ Meet the Hired Guns Who Make Sure School Cyberattacks Stay Hidden ∗∗∗ --------------------------------------------- An investigation into more than 300 cyberattacks against US K–12 schools over the past five years shows how schools can withhold crucial details from students and parents whose data was stolen. --------------------------------------------- https://www.wired.com/story/meet-the-hired-guns-who-make-sure-school-cybera… ∗∗∗ Lets Encrypt: 6-Tage-Zertifikate, keine Ablauf-Nachrichten zu Zertifikaten mehr ∗∗∗ --------------------------------------------- Lets Encrypt sieht einige Änderungen vor: Zertifikate mit sechs Tagen Laufzeit kommen neu hinzu. Zertifikat-Ablauf-Nachrichten fallen weg. --------------------------------------------- https://www.heise.de/news/Let-s-Encrypt-Ende-von-Zertifikat-Ablauf-Nachrich… ∗∗∗ A tale of enumeration, and why pen testing can’t be automated ∗∗∗ --------------------------------------------- TL;DR In an engagement we found an open directory on the internet belonging to our client By enumerating it we found a zip archive with a configuration file holding usernames .. --------------------------------------------- https://www.pentestpartners.com/security-blog/a-tale-of-enumeration-and-why… ∗∗∗ Practice being punched in the face. The realities of incident response preparation ∗∗∗ --------------------------------------------- “Everyone has a plan until they get punched in the face.” This Mike Tyson boxing quote perfectly encapsulates the chaos of a cybersecurity breach. TL;DR Accept that your organisation may .. --------------------------------------------- https://www.pentestpartners.com/security-blog/practice-being-punched-in-the… ∗∗∗ Neue Masche mit gefälschtem Post-Käuferschutz bei Kleinanzeigen ∗∗∗ --------------------------------------------- Kriminelle geben sich auf Kleinanzeigenplattformen als Kaufinteressierte aus und täuschen vor, Ihr Produkt über den Post Käuferschutz bezahlen zu wollen. Sie locken Sie auf eine gefälschte Zahlungsplattform, wo Sie Ihre Kreditkartendaten eingeben sollen, um die Zahlung zu bestätigen. Tatsächlich geben Sie aber eine Zahlung frei und .. --------------------------------------------- https://www.watchlist-internet.at/news/neue-masche-mit-gefaelschtem-post-ka… ∗∗∗ Stealers on the Rise: A Closer Look at a Growing macOS Threat ∗∗∗ --------------------------------------------- Atomic Stealer, Poseidon Stealer and Cthulhu Stealer target macOS. We discuss their various properties and examine leverage of the AppleScript framework. --------------------------------------------- https://unit42.paloaltonetworks.com/macos-stealers-growing/ ∗∗∗ Law Enforcement disrupts Major Spam Delivery Service ∗∗∗ --------------------------------------------- “The Saim Raza-run websites operated as marketplaces that advertised and facilitated the sale of tools such as phishing kits, scam pages and email extractors often .. --------------------------------------------- https://www.truesec.com/hub/blog/law-enforcement-disrupts-major-spam-delive… ∗∗∗ Hackers Hide Malware in Fake DeepSeek PyPI Packages ∗∗∗ --------------------------------------------- Malicious DeepSeek packages on PyPI spread malware, stealing sensitive data like API keys. Learn how this attack targeted developers and how to protect yourself. --------------------------------------------- https://hackread.com/hackers-hide-malware-fake-deepseek-pypi-packages/ ∗∗∗ CVE-2023-6080: A Case Study on Third-Party Installer Abuse ∗∗∗ --------------------------------------------- Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Softwares SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access to a system running the vulnerable version of SysTrack .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-thir… ∗∗∗ CISA Partners with ASD’s ACSC, CCCS, NCSC-UK, and Other International and US Organizations to Release Guidance on Edge Devices ∗∗∗ --------------------------------------------- CISA—in partnership with international and U.S. organizations—released guidance to help organizations protect their network edge devices and appliances, such as firewalls, routers, virtual private networks (VPN) gateways, Internet of Things (IoT) devices, internet-facing servers, and internet-facing operational technology (OT) .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/04/cisa-partners-asds-acsc-… ∗∗∗ 8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur ∗∗∗ --------------------------------------------- Surprise surprise, weve done it again. Weve demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, .. --------------------------------------------- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-… ∗∗∗ Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching for Persistence ∗∗∗ --------------------------------------------- Socket researchers have discovered a malicious typosquat package in the Go ecosystem, impersonating the widely used BoltDB database module (github.com/boltdb/bolt), a tool trusted by many organizations including Shopify and Heroku. The BoltDB package is widely adopted within the Go ecosystem, with 8,367 other packages depending on it. Its extensive .. --------------------------------------------- https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjdk-17), Fedora (chromium, fastd, ovn, and yq), Mageia (libxml2 and redis), Oracle (gstreamer1-plugins-base, gstreamer1-plugins-good), Red Hat (buildah, bzip2, galera, mariadb, grafana, keepalived, libsoup, mariadb:10.11, mariadb:10.5, mingw-glib2, podman, python-jinja2, and rsync), SUSE (bind, ignition, .. --------------------------------------------- https://lwn.net/Articles/1007886/ ∗∗∗ Synology-SA-25:01 DSM (PWN2OWN 2024) ∗∗∗ --------------------------------------------- A vulnerability allows man-in-the-middle attackers to hijack the authentication of administrators.The vulnerability reported by PWN2OWN 2024 (ZDI-CAN-25487) has been addressed. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_25_01 ∗∗∗ CISA Releases Nine Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- CISA released nine Industrial Control Systems (ICS) advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM SeriesICSA-25-035-02 Rockwell Automation 1756-L8zS3 and 1756-L3 and 1756-L3ICSA-25-035-03 .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/02/04/cisa-releases-nine-indus… ∗∗∗ Security Vulnerabilities fixed in Thunderbird 135 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-11/ ∗∗∗ Security Vulnerabilities fixed in Thunderbird ESR 128.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-10/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 128.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-09/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.20 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-08/ ∗∗∗ Security Vulnerabilities fixed in Firefox 135 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-07/ ∗∗∗ Zyxel security advisory for command injection and insecure default credentials vulnerabilities in certain legacy DSL CPE ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.02.2025
by Daily end-of-shift report 03 Feb '25

03 Feb '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 31-01-2025 18:00 − Montag 03-02-2025 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ DeepSeek AI tools impersonated by infostealer malware on PyPI ∗∗∗ --------------------------------------------- Threat actors are taking advantage of the rise in popularity of the DeepSeek to promote two malicious infostealer packages on the Python Package Index (PyPI), where they impersonated developer tools for the AI platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/deepseek-ai-tools-impersonat… ∗∗∗ DeepSeek’s Safety Guardrails Failed Every Test Researchers Threw at Its AI Chatbot ∗∗∗ --------------------------------------------- Security researchers tested 50 well-known jailbreaks against DeepSeek’s popular new AI chatbot. It didn’t stop a single one. --------------------------------------------- https://www.wired.com/story/deepseeks-ai-jailbreak-prompt-injection-attacks/ ∗∗∗ What Cybersecurity Can Teach Us About the Human Body ∗∗∗ --------------------------------------------- Understanding cybersecurity can sometimes feel like steering a maze of technical terms and complex systems. But a recent infographic shared by @yanabantai on X (formerly Twitter) has made it simpler, offering a fresh perspective by comparing cybersecurity to the human body. --------------------------------------------- https://thecyberexpress.com/cybersecurity-about-the-human-body/ ∗∗∗ Erstmals leicht sinkende Tendenz bei Anzeigen zur Cyberkriminalität ∗∗∗ --------------------------------------------- Wenn in den nächsten Wochen die Kriminalstatistik veröffentlicht wird, ist von einer Trendumkehr bei Cybercrime auszugehen. Erstmals wird es in diesem Bereich einen leichten Rückgang bei den Anzeigen 2024 im Vergleich zu 2023 geben. --------------------------------------------- https://www.derstandard.at/story/3000000255493/erstmals-leicht-sinkende-ten… ∗∗∗ Phishing-Fallen: Wiener Polizei sucht Täter mittels Fahndungsfotos ∗∗∗ --------------------------------------------- Mit einer SMS und gefälschten Banken-Website wurden mehrere Menschen in Österreich in die Falle gelockt und bestohlen. [..] Mit Bildern aus Überwachungskameras jener Bankautomaten, wo Geld von den Opfern behoben wurde, wird nun nach den Verdächtigen gesucht. Die Fotos sind auf der Website der Polizei zu sehen. --------------------------------------------- https://futurezone.at/digital-life/phishing-wien-polizei-oesterreich-foto-b… ∗∗∗ Hacker nutzen Google Gemini für Cyber-Angriffe ∗∗∗ --------------------------------------------- Kriminelle nutzen Googles Künstliche Intelligenz Gemini für Cyberangriffe, Phishing und Spionage. [..] Die Hacker nutzen Gemini derzeit zwar nicht, um neue kriminelle Methoden ausfindig zu machen, aber um bestehende zu verbessern. --------------------------------------------- https://futurezone.at/digital-life/google-gemini-hacker-cyber-angriffe-iran… ∗∗∗ 1-Click Phishing Campaign Targets High-Profile X Accounts ∗∗∗ --------------------------------------------- In an attack vector thats been used before, threat actors aim to commit crypto fraud by hijacking highly followed users, thus reaching a broad audience of secondary victims. --------------------------------------------- https://www.darkreading.com/endpoint-security/one-click-phishing-campaign-h… ∗∗∗ Journalists and Civil Society Members Using WhatsApp Targeted by Paragon Spyware ∗∗∗ --------------------------------------------- This is yet another story of commercial spyware being used against journalists and civil society members. The journalists and other civil society members were being alerted of a possible breach of their devices, with WhatsApp telling the Guardian it had “high confidence” that the 90 users in question had been targeted and “possibly compromised. --------------------------------------------- https://www.schneier.com/blog/archives/2025/02/journalists-and-civil-societ… ∗∗∗ Further Adventures With CMPivot — Client Coercion ∗∗∗ --------------------------------------------- CMPivot queries can be used to coerce SMB authentication from SCCM client hosts. --------------------------------------------- https://posts.specterops.io/further-adventures-with-cmpivot-client-coercion… ∗∗∗ CVE-2023-6080: A Case Study on Third-Party Installer Abuse ∗∗∗ --------------------------------------------- Mandiant exploited flaws in the Microsoft Software Installer (MSI) repair action of Lakeside Softwares SysTrack installer to obtain arbitrary code execution. An attacker with low-privilege access to a system running the vulnerable version of SysTrack could escalate privileges locally. [..] August 7, 2024 - Confirmed vulnerability fixed in version 11.0 --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/cve-2023-6080-thir… ∗∗∗ OPA Gatekeeper Bypass Reveals Risks in Kubernetes Policy Engines ∗∗∗ --------------------------------------------- Implementing Kubernetes securely can be a daunting task. Fortunately, there are tools in the K8s toolshed that provide out-of-the-box solutions using a single click. One such tools is OPA Gatekeeper. It is a great out-of-the-box security checkpoint to enforce security policies on Kubernetes. But are users using it correctly? Do they understand its limitations? Our new research says not necessarily! --------------------------------------------- https://blog.aquasec.com/opa-gatekeeper-bypass-reveals-risks-in-kubernetes-… ∗∗∗ Stronger Than Ever: How We Turned a DDoS Attack Into a Lesson in Resilience ∗∗∗ --------------------------------------------- We were subjected to several attempted DDoS attacks, and the first cohort didn't even raise an alarm, but on the 23rd Jan, we noticed the first impact. [..] Maybe you and your organisation will face a similar issue in the future and you can be more aware of the ransom scam, maybe the lessons we learned here are something you can use to avoid similar issues of your own in the future, or maybe this blog post was just an interesting read for you. --------------------------------------------- https://scotthelme.ghost.io/stronger-than-ever-how-we-turned-a-ddos-attack-… ∗∗∗ Vulnerability & Patch Roundup — January 2025 ∗∗∗ --------------------------------------------- Vulnerability reports and responsible disclosures are essential for website security awareness and education. --------------------------------------------- https://blog.sucuri.net/2025/01/vulnerability-patch-roundup-january-2025.ht… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Zahlreiche Lücken gefährden Backup-Appliances von Dell ∗∗∗ --------------------------------------------- Admins, die Backups mit Dells PowerProtect managen, sollten aus Sicherheitsgründen aktuelle Versionen von Data Domain Operating System (DD OS) installieren. Geschieht das nicht, können Angreifer Systeme vollständig kompromittieren. --------------------------------------------- https://www.heise.de/-10267578 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (git-lfs, libsoup, and unbound), Debian (dcmtk, ffmpeg, openjdk-11, pam-u2f, and python-aiohttp), Fedora (buku, chromium, jpegxl, nodejs18, nodejs20, and rust-routinator), Mageia (clamav, kernel, kmod-virtualbox, kmod-xtables-addons & dwarves, and kernel-linus), SUSE (apptainer, bind, buildah, chromedriver, clamav, dovecot24, ignition, kubelogin, libjxl, libQt5Bluetooth5-32bit, orc, owasp-modsecurity-crs, python-pydantic, python311-ipython, and stb), and Ubuntu (linux-azure and netdata). --------------------------------------------- https://lwn.net/Articles/1007646/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.01.2025
by Daily end-of-shift report 31 Jan '25

31 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 30-01-2025 18:00 − Freitag 31-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update) ∗∗∗ --------------------------------------------- Back in 2021 I wrote a blog post about various ways you can build a virtual memory access trap primitive on Windows. The goal was to cause a reader or writer of a virtual memory address to halt for a significant (e.g. 1 or more seconds) amount of time, generally for the purpose of exploiting TOCTOU memory access .. --------------------------------------------- https://googleprojectzero.blogspot.com/2025/01/windows-exploitation-tricks-… ∗∗∗ Infrastructure Laundering: Blending in with the Cloud ∗∗∗ --------------------------------------------- In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit -- a sprawling network tied to Chinese organized crime gangs and aptly named "Funnull" -- highlights a persistent whac-a-mole problem facing cloud services. --------------------------------------------- https://krebsonsecurity.com/2025/01/infrastructure-laundering-blending-in-w… ∗∗∗ Operation "Talent" nimmt weltgrößte Plattformen für Cyberkriminalität vom Netz ∗∗∗ --------------------------------------------- Bei einer internationalen Aktion wurden die Cracking-Foren nulled.to und cracked.io vom Netz genommen --------------------------------------------- https://www.derstandard.at/story/3000000255412/operation-talent-nimmt-weltg… ∗∗∗ Recent Jailbreaks Demonstrate Emerging Threat to DeepSeek ∗∗∗ --------------------------------------------- Evaluation of three jailbreaking techniques on DeepSeek shows risks of generating prohibited content. --------------------------------------------- https://unit42.paloaltonetworks.com/jailbreaking-deepseek-three-techniques/ ∗∗∗ On hackers, hackers, and hilarious misunderstandings ∗∗∗ --------------------------------------------- "Hacker", as we in the bizz know well, carries different meanings for different people, and this can cause hilarious misunderstandings. Yesterday, the Polish TV network TVN aired the second part of an ongoing documentary about issues in NEWAG trains that were analyzed by Dragon Sector. Near the end, the documentary featured a recording .. --------------------------------------------- https://gynvael.coldwind.pl/?id=799 ∗∗∗ Cyberangriffe auf SimpleHelp RMM beobachtet ∗∗∗ --------------------------------------------- In SimepleHelp RMM missbrauchen Angreifer Sicherheitslücken, um Netzwerke zu kompromittieren. Updates stehen bereit. --------------------------------------------- https://heise.de/-10265414 ∗∗∗ The Slow Death of OCSP ∗∗∗ --------------------------------------------- Everybody is talking about OCSP now because, just last month, at the end of 2024, Let’s Encrypt announced it was going to stop supporting online certificate revocation checking. Beginning in early May 2025, there will no longer be any OCSP revocation information in Let’s Encrypt’s certificates. Once all its earlier certificates expire, Let’s Encrypt will shut down its OCSP servers. --------------------------------------------- https://www.feistyduck.com/newsletter/issue_121_the_slow_death_of_ocsp ∗∗∗ PyPI’s New Archival Feature Closes a Major Security Gap ∗∗∗ --------------------------------------------- A major security improvement has landed on PyPI: maintainers can now archive projects, making it clear when a package is no longer actively maintained. This long-awaited feature, developed by Trail of Bits and funded by Alpha-Omega, helps developers make informed decisions about dependencies while protecting the Python ecosystem from risks associated .. --------------------------------------------- https://socket.dev/blog/pypi-adds-support-for-archiving-projects ∗∗∗ VMware Aria Vulnerabilities Addressed ∗∗∗ --------------------------------------------- VMware Security Advisory VMSA-2025-0003 addresses multiple vulnerabilities identified in VMware Aria Operations for Logs and VMware Aria Operations. These vulnerabilities, if exploited, could allow attackers to .. --------------------------------------------- https://thecyberthrone.in/2025/01/31/vmware-aria-vulnerabilities-addressed/ ∗∗∗ DeepSeek’s Popularity Sparks Surge in Crypto Phishing and Malware Campaigns ∗∗∗ --------------------------------------------- The rapid rise of DeepSeek, a Chinese artificial intelligence company known for its open-source large language models (LLMs), has sparked not only excitement but also a significant increase in cyber threats. As of January 2025, the company launched its first free chatbot app, “DeepSeek – AI Assistant,” which quickly became the most downloaded .. --------------------------------------------- https://thecyberexpress.com/deepseeks-surge-sparks-malware-campaigns/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (libsoup), Debian (debian-security-support and redis), Fedora (expat, java-21-openjdk, lemonldap-ng, and phpMyAdmin), Mageia (chromium-browser-stable and git-lfs), Oracle (bzip2, git-lfs, libsoup, mariadb:10.11, mariadb:10.5, python-jinja2, redis, and unbound), Red Hat (git-lfs, libsoup, python-jinja2, .. --------------------------------------------- https://lwn.net/Articles/1007252/ ∗∗∗ VU#733789: ChatGPT-4o contains security bypass vulnerability through time and search functions called "Time Bandit" ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/733789 ∗∗∗ ZDI-25-060: Google Chrome AI Manager Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-060/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.01.2025
by Daily end-of-shift report 30 Jan '25

30 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 29-01-2025 18:00 − Donnerstag 30-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ No need to RSVP: a closer look at the Tria stealer campaign ∗∗∗ --------------------------------------------- Kaspersky GReAT experts discovered a new campaign targeting Android devices in Malaysia and Brunei with the Tria stealer to collect data from apps like WhatsApp and Gmail. --------------------------------------------- https://securelist.com/tria-stealer-collects-sms-data-from-android-devices/… ∗∗∗ Exposed DeepSeek Database Revealed Chat Prompts and Internal Data ∗∗∗ --------------------------------------------- China-based DeepSeek has exploded in popularity, drawing greater scrutiny. Case in point: Security researchers found more than 1 million records, including user data and API keys, in an open database. --------------------------------------------- https://www.wired.com/story/exposed-deepseek-database-revealed-chat-prompts… ∗∗∗ Europol warnt vor gefälschten Medikamenten in Online-Angeboten ∗∗∗ --------------------------------------------- Europol hat 2024 Medikamente im Wert von rund 11,1 Millionen Euro beschlagnahmt. Sie waren gefälscht und für den Online-Handel vorgesehen. --------------------------------------------- https://www.heise.de/news/Europol-warnt-vor-gefaelschten-Medikamenten-in-On… ∗∗∗ Warten auf Patch: Das Admin-Interface Voyager für Laravel-Apps ist verwundbar ∗∗∗ --------------------------------------------- Sicherheitsforscher warnen vor möglichen Attacken auf Voyager. Bislang haben sich die Entwickler zu den Sicherheitslücken nicht geäußert. --------------------------------------------- https://www.heise.de/news/Warten-auf-Patch-Das-Admin-Interface-Voyager-fuer… ∗∗∗ Linux-related discussion as a cybersecurity threat ∗∗∗ --------------------------------------------- Starting on January 19, 2025 Facebooks internal policy makers decided that Linux is malware and labeled groups associated with Linux as being "cybersecurity threats". Any posts mentioning DistroWatch and multiple groups associated with Linux and Linux discussions have either been shut down or had many of their posts removed. Weve been hearing all week .. --------------------------------------------- https://lwn.net/Articles/1006328/ ∗∗∗ Betrugswelle auf Facebook: Gefälschte Lagerabverkäufe von Hofer und Zara ∗∗∗ --------------------------------------------- Aktuell kursieren auf Facebook Postings, die angeblich von bekannten Marken stammen und mit einem Lagerabverkauf werben. Nutzer:innen wird suggeriert, dass Unternehmen wie Hofer oder Zara kostenlose Kaffeemaschinen oder Geschenkboxen zu Sonderpreisen verschenken. Doch Vorsicht: Es handelt sich um gefälschte Angebote von Kriminellen, die es nur auf Kreditkartendaten abgesehen haben. --------------------------------------------- https://www.watchlist-internet.at/news/betrugswelle-auf-facebook-gefaelscht… ∗∗∗ Risikobild 2025 ∗∗∗ --------------------------------------------- Das österreichische Verteidigungsministerium präsentierte am 27. Jänner das "Risikobild 2025". Wie nicht anders zu erwarten war, dominieren geopolitische Herausforderungen die Risikolandschaft. Der Ukraine-Krieg, die Spannungen zwischen China und den USA sowie der Nahe Osten sind auch die ersten Themen, die mir einfallen würden, wenn mich .. --------------------------------------------- https://www.cert.at/de/blog/2025/1/risikobild-2025 ∗∗∗ Talos IR trends Q4 2024: Web shell usage and exploitation of public-facing applications spike ∗∗∗ --------------------------------------------- This new report from Cisco Talos Incident Response explores how threat actors increasingly deployed web shells against vulnerable web applications, and exploited vulnerable or unpatched public-facing applications to gain initial access. --------------------------------------------- https://blog.talosintelligence.com/talos-ir-trends-q4-2024/ ∗∗∗ FBI Seizes Leading Hacking Forums Cracked.io and Nulled.to ∗∗∗ --------------------------------------------- Nulled.to, Cracked.to and Cracked.io, major hacking forums, appear seized by the FBI as DNS records point to FBI. --------------------------------------------- https://hackread.com/fbi-seizes-hacking-forums-cracked-to-nulled-to/ ∗∗∗ Common OAuth Vulnerabilities ∗∗∗ --------------------------------------------- OAuth2’s popularity makes it a prime target for attackers. While it simplifies user login, its complexity can lead to misconfigurations that create security holes. Some of the more intricate vulnerabilities keep reappearing because the protocol’s inner workings are not always well-understood. In an effort to change that, we have decided to .. --------------------------------------------- https://blog.doyensec.com/2025/01/30/oauth-common-vulnerabilities.html ===================== = Vulnerabilities = ===================== ∗∗∗ Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-012 ∗∗∗ Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-011 ∗∗∗ Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-010 ∗∗∗ Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-009 ∗∗∗ Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-008 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.01.2025
by Daily end-of-shift report 29 Jan '25

29 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 28-01-2025 18:00 − Mittwoch 29-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Threat predictions for industrial enterprises 2025 ∗∗∗ --------------------------------------------- Kaspersky ICS CERT analyzes industrial threat trends and makes forecasts on how the industrial threat landscape will look in 2025. --------------------------------------------- https://securelist.com/industrial-threat-predictions-2025/115327/ ∗∗∗ ExxonMobil Lobbyist Caught Hacking Climate Activists ∗∗∗ --------------------------------------------- The Department of Justice is investigating a lobbying firm representing ExxonMobil for hacking the phones of climate activists:The hacking was allegedly commissioned by a Washington, D.C., lobbying firm, according to a lawyer representing the U.S. government. The firm, in turn, was allegedly working on behalf of one of the world’s largest oil and gas .. --------------------------------------------- https://www.schneier.com/blog/archives/2025/01/exxonmobil-lobbyist-caught-h… ∗∗∗ Industrielle Kontrollsysteme: Attacken auf kritische Infrastrukturen möglich ∗∗∗ --------------------------------------------- Es sind wichtige Sicherheitsupdates für industriellen Steuerungssysteme von unter anderem Rockwell und Schneider erschienen. --------------------------------------------- https://www.heise.de/news/Industrielle-Kontrollsysteme-Attacken-auf-kritisc… ∗∗∗ Zwei Sidechannel-Attacken auf Apples M-Prozessoren ∗∗∗ --------------------------------------------- Die schwerwiegenden Sicherheitslücken lassen sich für Angriffe auf Webbrowser aus der Ferne nutzen. Betroffen sind viele Mobil- und Desktop-Geräte von Apple. --------------------------------------------- https://www.heise.de/news/Zwei-Sidechannel-Attacken-auf-Apples-M-Prozessore… ∗∗∗ How we estimate the risk from prompt injection attacks on AI systems ∗∗∗ --------------------------------------------- Modern AI systems, like Gemini, are more capable than ever, helping retrieve data and perform actions on behalf of users. However, data from external sources present new security challenges if untrusted sources are available to execute instructions on AI systems. Attackers can take advantage of this by hiding malicious instructions in data .. --------------------------------------------- http://security.googleblog.com/2025/01/how-we-estimate-risk-from-prompt.html ∗∗∗ Backups & DRP in the ransomware era ∗∗∗ --------------------------------------------- In today’s digital landscape, the threat of ransomware has forced organizations to reevaluate their disaster recovery plans. Traditional approaches to data protection were focused primarily on high availability and are no longer sufficient. As cyber threats evolve, so must our strategies for safeguarding critical information. This blog post explores the .. --------------------------------------------- https://blog.nviso.eu/2025/01/29/backups-drp-in-the-ransomware-era/ ∗∗∗ Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from GreyNoise ∗∗∗ --------------------------------------------- This blog details how attackers are actively exploiting Fortinet FortiGate firewalls vulnerable to CVE-2022-40684, with real-time insights from GreyNoise to help defenders understand and respond to these threats. --------------------------------------------- https://www.greynoise.io/blog/hackers-actively-exploiting-fortinet-firewall… ∗∗∗ Active Exploitation of Zero-day Zyxel CPE Vulnerability (CVE-2024-40891) ∗∗∗ --------------------------------------------- CVE-2024-40891: Zyxel CPE Zero-day Exploitation. Hackers are actively exploiting a telnet-based command injection vulnerability in Zyxel CPE devices, impacting 1,500+ exposed systems. No patch is available yet. --------------------------------------------- https://www.greynoise.io/blog/active-exploitation-of-zero-day-zyxel-cpe-vul… ∗∗∗ Adversarial Misuse of Generative AI ∗∗∗ --------------------------------------------- Rapid advancements in artificial intelligence (AI) are unlocking new possibilities for the way we work and accelerating innovation in science, technology, and beyond. In cybersecurity, AI is poised to transform digital defense, empowering defenders and enhancing our collective security. Large language models (LLMs) open new possibilities for .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/adversarial-misuse… ∗∗∗ CVE-2024-46507: Yeti Platform Server-Side Template Injection (SSTI) ∗∗∗ --------------------------------------------- Yeti is a Forensic Intelligence platform and pipeline for DFIR teams. It allows threat intelligence and DFIR teams to catalog, search, and link pieces of intelligence such as IP addresses, TTPs, and threat actors. With 10,000 .. --------------------------------------------- https://rhinosecuritylabs.com/research/cve-2024-46507-yeti-server-side-temp… ∗∗∗ CISA Brings KEV Data to GitHub ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) just made a major move to improve access and usability for its Known Exploited Vulnerabilities (KEV) catalog. Announced by Tod Beardsley on LinkedIn, CISA has launched a new kev-data repository on GitHub, allowing developers, researchers, and cybersecurity enthusiasts to access KEV data in .. --------------------------------------------- https://socket.dev/blog/cisa-brings-kev-data-to-github ∗∗∗ CVE-2024-49138 Windows CLFS heap-based buffer overflow analysis – Part 2 ∗∗∗ --------------------------------------------- In the previous article, we discussed a vulnerability in the LoadContainerQ() function inside clfs.sys. The root cause of the vulnerability was LoadContainerQ() using a CLFS_CONTAINER_CONTEXT.pContainer without checking if FlushImage() invalidated the General Metadata Block. --------------------------------------------- https://security.humanativaspa.it/cve-2024-49138-windows-clfs-heap-based-bu… ∗∗∗ CVE-2024-49138 Windows CLFS heap-based buffer overflow analysis – Part 1 ∗∗∗ --------------------------------------------- CVE-2024-49138 is a Windows vulnerability detected by CrowdStrike as exploited in the wild. Microsoft patched the vulnerability on December 10th, 2024 with KB5048685 (for Windows 11 .. --------------------------------------------- https://security.humanativaspa.it/cve-2024-49138-windows-clfs-heap-based-bu… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (bzip2, gimp:2.8, keepalived, mariadb:10.11, mariadb:10.5, python-jinja2, and redis), Debian (iperf3, libtar, and pdns-recursor), Fedora (abseil-cpp, dotnet8.0, dotnet9.0, golang, libsoup3, and vaultwarden), Oracle (gimp:2.8, iperf3, keepalived, kernel, redis:7, and unbound), Red Hat (libsoup), SUSE (amazon-ssm-agent, .. --------------------------------------------- https://lwn.net/Articles/1006677/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.01.2025
by Daily end-of-shift report 28 Jan '25

28 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Montag 27-01-2025 18:00 − Dienstag 28-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ EU sanctions Russian GRU hackers for cyberattacks against Estonia ∗∗∗ --------------------------------------------- The European Union sanctioned three hackers, part of Unit 29155 of Russias military intelligence service (GRU), for their involvement in cyberattacks targeting Estonias government agencies in 2020. --------------------------------------------- https://www.bleepingcomputer.com/news/security/eu-sanctions-russian-gru-hac… ∗∗∗ Israel: Hacker kapern Notfallsirenen und spielen arabische Musik ∗∗∗ --------------------------------------------- In mehreren israelischen Einrichtungen ist kürzlich unerwartet arabische Musik aus den Notfallsirenen ertönt. Eine Hackergruppe hat sich schuldig bekannt. --------------------------------------------- https://www.golem.de/news/israel-hacker-kapern-notfallsirenen-und-spielen-a… ∗∗∗ Beyond the hype: The business reality of AI for cybersecurity ∗∗∗ --------------------------------------------- Real-world insights from 400 IT leaders, plus practical guidance to enhance business outcomes --------------------------------------------- https://news.sophos.com/en-us/2025/01/28/beyond-the-hype-the-business-reali… ∗∗∗ Update: Cybercriminals still not fully on board the AI train (yet) ∗∗∗ --------------------------------------------- A year after our initial research on threat actors’ attitudes to generative AI, we revisit some underground forums and find that many cybercriminals are still skeptical – although there has been a slight shift. --------------------------------------------- https://news.sophos.com/en-us/2025/01/28/update-cybercriminals-still-not-fu… ∗∗∗ Top-Rated Chinese AI App DeepSeek Limits Registrations Amid Cyberattacks ∗∗∗ --------------------------------------------- DeepSeek, the Chinese AI startup that has captured much of the artificial intelligence (AI) buzz in recent days, said its restricting registrations on the service, citing malicious attacks."Due to large-scale malicious attacks on DeepSeeks services, .. --------------------------------------------- https://thehackernews.com/2025/01/top-rated-chinese-ai-app-deepseek.html ∗∗∗ Apple plugs security hole in its iThings thats already been exploited in iOS ∗∗∗ --------------------------------------------- Cupertino kicks off the year with a zero-day Apple has plugged a security hole in the software at the heart of its iPhones, iPads, Vision Pro goggles, Apple TVs and macOS Sequoia Macs, warning some miscreants have already exploited the bug. --------------------------------------------- https://www.theregister.com/2025/01/28/apple_cve_2025_24085/ ∗∗∗ Security pros more confident about fending off ransomware, despite being battered by attacks ∗∗∗ --------------------------------------------- Data leak, shmata leak. It will all work out, right? IT and security pros say they are more confident in their ability to manage ransomware attacks after nearly nine in ten (88 percent) were forced to contain efforts by criminals to breach their defenses in the past year. --------------------------------------------- https://www.theregister.com/2025/01/28/research_security_pros_gain_ransomwa… ∗∗∗ Auf Facebook konnte man E-Mail-Adressen, Telefonnummern, Einmalpasswörter, etc. von Fremden einsehen. ∗∗∗ --------------------------------------------- For an unknown period until the end of January 2024, Facebook appears to have suffered a data leak that has exposed users’ email addresses, phone numbers and other identifying information. [..] The issue was reported to Facebook via its bug bounty programme. While the demonstrated method stopped working two weeks after submission, the .. --------------------------------------------- https://social.leckse.net/@leckse/statuses/01JJPE94S1NQM62VY60S767S1H ∗∗∗ Sonicwall: Tausende Geräte für trivial angreifbare SSL-VPN-Lücke anfällig ∗∗∗ --------------------------------------------- Seit Anfang Januar gibt es einen Patch zum Schließen einer SSL-VPN-Lücke in Sonicwalls. Dennoch sind mehr als 5000 Geräte noch angreifbar. --------------------------------------------- https://www.heise.de/news/Leicht-angreifbare-Sonicwall-Luecke-Tausende-Gera… ∗∗∗ Teamviewer: Rechteausweitung durch Sicherheitslücke möglich ∗∗∗ --------------------------------------------- Teamviewer warnt vor einer Schwachstelle in den Windows-Versionen der Fernwartungssoftware, die Angreifern die Rechteausweitung ermöglicht. --------------------------------------------- https://www.heise.de/news/Teamviewer-Rechteausweitung-durch-Sicherheitsluec… ∗∗∗ A Tumultuous Week for Federal Cybersecurity Efforts ∗∗∗ --------------------------------------------- President Trump last week issued a flurry of executive orders that upended a number of government initiatives focused on improving the nations cybersecurity posture. The president fired all advisors from the Department of Homeland Securitys Cyber Safety Review Board, called for the creation of a strategic cryptocurrency reserve, and voided .. --------------------------------------------- https://krebsonsecurity.com/2025/01/a-tumultuous-week-for-federal-cybersecu… ∗∗∗ How Garmin watches reveal your personal data, and what you can do ∗∗∗ --------------------------------------------- TL;DR A walk-through of obtaining sensitive data from a Garmin watch using forensic techniques How digital forensics on a Garmin watch helped solve a double murder case A .. --------------------------------------------- https://www.pentestpartners.com/security-blog/how-garmin-watches-reveal-you… ∗∗∗ New TorNet backdoor seen in widespread campaign ∗∗∗ --------------------------------------------- Cisco Talos discovered an ongoing malicious campaign operated by a financially motivated threat actor targeting users, predominantly in Poland and Germany. --------------------------------------------- https://blog.talosintelligence.com/new-tornet-backdoor-campaign/ ∗∗∗ ScatterBrain: Unmasking the Shadow of PoisonPlugs Obfuscator ∗∗∗ --------------------------------------------- Since 2022, Google Threat Intelligence Group (GTIG) has been tracking multiple cyber espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW. These operations employ a custom obfuscating compiler that we refer to as "ScatterBrain," facilitating attacks against various entities across Europe and the Asia Pacific (APAC) region. ScatterBrain appears .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmas… ∗∗∗ Stating the Obvious: Vulns On the Rise in 2025 ∗∗∗ --------------------------------------------- Join Ben Edwards, as he takes a brief look back at one of the stories that was most interesting to him as a security data nerd from 2024. --------------------------------------------- https://www.bitsight.com/blog/2025-predictions-for-cve-vulnerabilities ∗∗∗ Get FortiRekt, I Am The Super_Admin Now - Fortinet FortiOS Authentication Bypass CVE-2024-55591 ∗∗∗ --------------------------------------------- Welcome to Monday, and what an excitingly fresh start to the week were all having. Grab your coffee, grab your vodka - were diving into a currently exploited-in-the-wild critical Authentication Bypass affecting .. --------------------------------------------- https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-a… ∗∗∗ Clone2Leak: Your Git Credentials Belong To Us ∗∗∗ --------------------------------------------- In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise Server for a while, I felt bored and decided to try to find bugs on GitHub Desktop instead. --------------------------------------------- https://flatt.tech/research/posts/clone2leak-your-git-credentials-belong-to… ∗∗∗ Best practices for key derivation ∗∗∗ --------------------------------------------- By Marc Ilunga Key derivation is essential in many cryptographic applications, including key exchange, key management, secure communications, and building robust cryptographic primitives. But it’s also easy to get wrong: although .. --------------------------------------------- https://blog.trailofbits.com/2025/01/28/best-practices-for-key-derivation/ ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerability in ClamAV Discovered by OSS-Fuzz ∗∗∗ --------------------------------------------- A security vulnerability has been identified in ClamAV, stemming from a potential buffer overflow read issue in .. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-25-04 ∗∗∗ WordPress Plugin "Simple Image Sizes" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN88046370/ ∗∗∗ TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2025-001 ∗∗∗ Rockwell Automation FactoryTalk ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.01.2025
by Daily end-of-shift report 27 Jan '25

27 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 24-01-2025 18:00 − Montag 27-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Eine verpasste Chance: Schwaches Passwort-Hashing in VxWorks ∗∗∗ --------------------------------------------- Die Sicherheit von eingebetteten Systemen, die Echtzeitbetriebssysteme (RTOS) wie Wind River VxWorks verwenden, ist in risikoreichen Bereichen wie OT, .. --------------------------------------------- https://sec-consult.com/de/blog/detail/eine-verpasste-chance-schwaches-pass… ∗∗∗ Cracking the Giant: How ODAT Challenges Oracle, the King of Databases ∗∗∗ --------------------------------------------- In the past decade, Oracle Database (Oracle DB) has reigned supreme in the competitive arena of database engine popularity ranking as shown in Figure 1 and Figure 2. This pervasiveness has led Oracle Database to be trusted by Fortune 500 companies (e.g. Netflix, LinkedIn, eBay, etc.) to house, process, and safeguard their critical data. Its .. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cracking-th… ∗∗∗ GitHub Desktop Vulnerability Risks Credential Leaks via Malicious Remote URLs ∗∗∗ --------------------------------------------- Multiple security vulnerabilities have been disclosed in GitHub Desktop as well as other Git-related projects that, if successfully exploited, could permit an attacker to gain unauthorized access to a users Git credentials."Git implements a protocol called Git Credential Protocol to retrieve credentials from the .. --------------------------------------------- https://thehackernews.com/2025/01/github-desktop-vulnerability-risks.html ∗∗∗ Scammers Are Creating Fake News Videos to Blackmail Victims ∗∗∗ --------------------------------------------- “Yahoo Boy” scammers are impersonating CNN and other news organizations to create videos that pressure victims into making blackmail payments. --------------------------------------------- https://www.wired.com/story/scammers-are-creating-fake-news-videos-to-black… ∗∗∗ Technical Analysis of Xloader Versions 6 and 7 | Part 1 ∗∗∗ --------------------------------------------- Xloader is a malware family that is the successor to Formbook with information stealing capabilities targeting web browsers, email clients, and File Transfer Protocol (FTP) applications. The malware is also able to deploy second-stage payloads to an infected system. The author of Xloader regularly adds new functionality to target more .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-… ∗∗∗ Nach Sicherheitslücke bei D-Trust: CCC spricht von "Cyber-Augenwischerei" ∗∗∗ --------------------------------------------- Der Chaos Computer Club fordert vom Vertrauensdiensteanbieter D-Trust Verantwortung zu tragen und die Abschaffung des Hackerparagraphen. --------------------------------------------- https://www.heise.de/news/Nach-Sicherheitsluecke-bei-D-Trust-CCC-spricht-vo… ∗∗∗ Palo-Alto: Sicherheitslücken in Firmware und Bootloadern von Firewalls ∗∗∗ --------------------------------------------- Die Firmware und Bootloader von einigen Palo-Alto-Firewalls weisen Sicherheitslecks auf, die Angreifern das Einnisten nach Angriffen ermöglichen. --------------------------------------------- https://www.heise.de/news/Palo-Alto-Sicherheitsluecken-in-Firmware-und-Boot… ∗∗∗ Hacked buses blare out patriotic pro-European anthems in Tbilisi, attack government ∗∗∗ --------------------------------------------- Residents of Tbilisi, the capital city of Georgia, experienced an unexpected and unusual start to their Friday morning commute. As they boarded their public transport buses, they were greeted by a barrage of sound emanating .. --------------------------------------------- https://www.bitdefender.com/en-us/blog/hotforsecurity/hacked-buses-blare-ou… ∗∗∗ The 2024 Ransomware Landscape: Looking back on another painful year ∗∗∗ --------------------------------------------- In this post, we’ll examine the latest data points, discuss notable groups, and estimate the potential impact on victims — helping security teams plan their defenses for the months ahead. --------------------------------------------- https://www.rapid7.com/blog/post/2025/01/27/the-2024-ransomware-landscape-l… ∗∗∗ Brave Desktop Browser Vulnerability Lets Malicious Sites Appear Trusted ∗∗∗ --------------------------------------------- A critical vulnerability in Brave Browser allows malicious websites to appear as trusted sources during file uploads/downloads. --------------------------------------------- https://hackread.com/brave-desktop-browser-vulnerability-malicious-sites-tr… ∗∗∗ Datadog threat roundup: top insights for Q4 2024 ∗∗∗ --------------------------------------------- Threat insights from Datadog Security Labs for Q4 2024. --------------------------------------------- https://securitylabs.datadoghq.com/articles/2024-q4-threat-roundup/ ∗∗∗ Exploit Me, Baby, One More Time: Command Injection in Kubernetes Log Query ∗∗∗ --------------------------------------------- Kubernetes and containers in general have become a predominant force in the security world - and, as such, they’ve been a point of interest for researchers worldwide (including us). Our research journey initially led .. --------------------------------------------- https://www.akamai.com/blog/security-research/2024-january-kubernetes-log-q… ∗∗∗ Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts ∗∗∗ --------------------------------------------- On January 22, 2025, CVE-2025-23088 was published by HackerOne to inform users about the risks of continuing to use End-of-Life (EOL) versions of Node.js. This CVE has quickly sparked debate in the security community, with some experts labeling it the “worst CVE of the year” – not for its severity, but for the controversy surrounding .. --------------------------------------------- https://socket.dev/blog/node-js-eol-versions-cve-dubbed-the-worst-cve-of-th… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (git-lfs, java-17-openjdk, java-21-openjdk, kernel, and python-jinja2), Debian (git and git-lfs), Fedora (buildah, chromium, containers-common, freeipa, glibc, golang, mediawiki, pam-u2f, podman, and rsync), Mageia (glibc, iperf, openssl, phpmyadmin, and poppler), Oracle (firefox, git-lfs, grafana, .. --------------------------------------------- https://lwn.net/Articles/1006261/ ∗∗∗ Wind River Software VxWorks RTOS Weak Password Hashing Algorithms ∗∗∗ --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/wind-river-software-vxwo… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.01.2025
by Daily end-of-shift report 24 Jan '25

24 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 23-01-2025 18:00 − Freitag 24-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hacker infects 18,000 "script kiddies" with fake malware builder ∗∗∗ --------------------------------------------- A threat actor targeted low-skilled hackers, known as "script kiddies," with a fake malware builder that secretly infected them with a backdoor to steal data and take over computers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hacker-infects-18-000-script… ∗∗∗ Malware Redirects WordPress Traffic to Harmful Sites ∗∗∗ --------------------------------------------- Recently, a customer approached us after noticing their website was redirecting visitors to a suspicious URL. They suspected their site had been compromised and sought assistance in identifying and resolving the issue. This .. --------------------------------------------- https://blog.sucuri.net/2025/01/malware-redirects-wordpress-traffic-to-harm… ∗∗∗ North Korean dev who renamed himself Bane accused of IT worker fraud scheme ∗∗∗ --------------------------------------------- 5 indicted as FBI warns North Korea dials up aggression, plus Russian devs allegedly get in on the act The US is indicting yet another five suspects it believes were involved in North Koreas long-running, fraudulent remote IT worker scheme – including one who changed their last name to "Bane" and scored a gig at a tech biz in San Francisco. --------------------------------------------- https://www.theregister.com/2025/01/24/north_korean_devs_and_their/ ∗∗∗ Dont want your Kubernetes Windows nodes hijacked? Patch this hole now ∗∗∗ --------------------------------------------- SYSTEM-level command injection via API parameter *chefs kiss* A now-fixed command-injection bug in Kubernetes can be exploited by a remote attacker to gain code execution with SYSTEM privileges on all Windows endpoints in a cluster, and thus fully take over those systems, according to Akamai researcher Tomer Peled. --------------------------------------------- https://www.theregister.com/2025/01/24/kubernetes_windows_nodes_bug/ ∗∗∗ Subaru Security Flaws Exposed Its System for Tracking Millions of Cars ∗∗∗ --------------------------------------------- Now-fixed web bugs allowed hackers to remotely unlock and start any of millions of Subarus. More disturbingly, they could also access at least a year of cars’ location histories—and Subaru employees still can. --------------------------------------------- https://www.wired.com/story/subaru-location-tracking-vulnerabilities/ ∗∗∗ Mehrere Staaten desinfizieren Botnetz, Deutschland nicht ∗∗∗ --------------------------------------------- Während Behörden in Frankreich und den USA die Schadsoftware Plug-X auf betroffenen Computern abschalten, wird in Deutschland über Infektionen nur informiert. --------------------------------------------- https://www.heise.de/news/Botnetz-Plug-X-Reinemachen-geht-nicht-10252309.ht… ∗∗∗ Jetzt patchen: Cross-Site-Scripting und Denial of Service in GitLab möglich ∗∗∗ --------------------------------------------- GitLab warnt vor drei Schwachstellen, von denen eine den Bedrohungsgrad "hoch" trägt. Patches stehen für die jüngeren Versionen bereit. --------------------------------------------- https://www.heise.de/news/Jetzt-patchen-Cross-Site-Scripting-und-Denial-of-… ∗∗∗ Malvertising: Mac-Homebrew-User im Visier ∗∗∗ --------------------------------------------- Kriminelle haben bösartige Werbeanzeigen auf Google geschaltet, die anstatt auf die Homebrew-Webseite auf eine echt wirkende Malware-Seite leitet. --------------------------------------------- https://www.heise.de/news/Malvertising-Mac-Homebrew-User-im-Visier-10255909… ∗∗∗ Cyber security guidance for small fleet operators ∗∗∗ --------------------------------------------- Introduction Cyber threats aren’t just a problem for large shipping organizations, small maritime fleet operators are also at risk. Anything from phishing emails to ransomware attacks, these threats can disrupt .. --------------------------------------------- https://www.pentestpartners.com/security-blog/cyber-security-guidance-for-s… ∗∗∗ Private Keys in the Fortigate Leak ∗∗∗ --------------------------------------------- A few days ago, a download link for a leak of configuration files for Fortigate/Fortinet devices was posted on an Internet forum. It appears that the data was collected in 2022 due to a security vulnerability known as CVE-2022-40684. According to a blog post by Fortinet in 2022, they were already aware of active exploitation of the issue back then. It was first .. --------------------------------------------- https://blog.hboeck.de:443/archives/908-Private-Keys-in-the-Fortigate-Leak.… ∗∗∗ Exchange Server 2016 / 2019 erreichen im Oktober 2025 ihr EOL ∗∗∗ --------------------------------------------- Kleiner Nachtrag von dieser Woche zu einem Thema, welches eigentlich alle Exchange-Administratoren auf dem Radar haben sollten und auch dürften. Im Oktober 2025 fallen sowohl Microsoft Exchange Server 2016 als auch Microsoft Exchange .. --------------------------------------------- https://www.borncity.com/blog/2025/01/24/exchange-server-2016-2019-erreiche… ∗∗∗ Seasoning email threats with hidden text salting ∗∗∗ --------------------------------------------- Hidden text salting is a simple yet effective technique for bypassing email parsers, confusing spam filters, and evading detection engines that rely on keywords. Cisco Talos has observed an increase in the number of email threats leveraging hidden text salting. --------------------------------------------- https://blog.talosintelligence.com/seasoning-email-threats-with-hidden-text… ∗∗∗ SUSCTL (CVE-2024-54507) A particularly sus sysctl in the XNU Kernel ∗∗∗ --------------------------------------------- Every time Apple releases a new version of XNU, I run a custom suite of tests under an address sanitizer to see if I can spot any regressions, or even possibly new bugs. When I was messing around with macOS 15.0, I was shocked to see a very simple command was causing the sanitizer to report an invalid load. --------------------------------------------- https://jprx.io/cve-2024-54507/ ∗∗∗ The J-Magic Show: Magic Packets and Where to find them ∗∗∗ --------------------------------------------- The Black Lotus Labs team at Lumen Technologies has been tracking the use of a backdoor attack tailored for use against enterprise-grade Juniper routers. This backdoor is opened by a passive agent that continuously monitors for a “magic packet,” sent by .. --------------------------------------------- https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-the… ∗∗∗ cURL Project and Go Security Teams Reject CVSS as Broken ∗∗∗ --------------------------------------------- The CVSS (Common Vulnerability Scoring System) is facing significant pushback as both the cURL project and Go security teams are publicly distance themselves from the framework. While CVSS is designed to assign a severity score to vulnerabilities, its one-size-fits-all approach often produces misleading results, particularly for projects like cURL, which .. --------------------------------------------- https://socket.dev/blog/curl-project-and-go-security-teams-reject-cvss-as-b… ∗∗∗ FalconFeedsio X Account Hacked, Promoting Fraudulent Crypto Scams ∗∗∗ --------------------------------------------- FalconFeedsios official X (formerly Twitter) account has been compromised, leading to the promotion of fraudulent cryptocurrency posts and scams. This hacking of FalconFeed has shocked the cybersecurity community as the platform was renowned for dark web news alerts. With this hacking of FalconFeed x account, many users and cybersecurity experts are advising .. --------------------------------------------- https://thecyberexpress.com/hacking-of-falconfeed/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and python-django), Fedora (git-lfs and pam-u2f), Mageia (golang), Red Hat (java-11-openjdk with Extended Lifecycle Support, java-17-openjdk, and java-21-openjdk), SUSE (cheat, dante, docker-stable, grafana, and kernel), and Ubuntu (cacti, cyrus-imapd, HTMLDOC, and PCL). --------------------------------------------- https://lwn.net/Articles/1006103/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.01.2025
by Daily end-of-shift report 23 Jan '25

23 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 22-01-2025 18:00 − Donnerstag 23-01-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Zendesk’s Subdomain Registration Abused in Phishing Scams ∗∗∗ --------------------------------------------- Leveraging Zendesk’s communication features, they can send phishing emails disguised as legitimate customer support messages. These emails often include malicious links or attachments to lure victims into clicking. --------------------------------------------- https://hackread.com/zendesk-subdomain-registration-abused-phishing-scams/ ∗∗∗ Heimserver-Betriebssystem: Updates beheben Sicherheitslücken in Unraid ∗∗∗ --------------------------------------------- Angreifer könnten die Lücken ausnutzen, um dem UnRAID-Admin eigenen Javascript-Code oder bösartige Plug-ins unterzuschieben. [..] Alle Sicherheitslücken sind in der Anfang Januar veröffentlichten neuesten Major-Version 7.0.0 und in einem Bugfix-Release für die Vorgängerversion behoben. --------------------------------------------- https://heise.de/-10253366 ∗∗∗ Researchers say new attack could take down the European power grid ∗∗∗ --------------------------------------------- Late last month, researchers revealed a finding that’s likely to shock some people and confirm the low expectations of others: Renewable energy facilities throughout Central Europe use unencrypted radio signals to receive commands to feed or ditch power into or from the grid that serves some 450 million people throughout the continent. --------------------------------------------- https://arstechnica.com/security/2025/01/could-hackers-use-new-attack-to-ta… ∗∗∗ Telegram captcha tricks you into running malicious PowerShell scripts ∗∗∗ --------------------------------------------- Threat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into executing PowerShell code that infects them with malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/telegram-captcha-tricks-you-… ∗∗∗ Beware: Fake CAPTCHA Campaign Spreads Lumma Stealer in Multi-Industry Attacks ∗∗∗ --------------------------------------------- The attack chain begins when a victim visits a compromised website, which directs them to a bogus CAPTCHA page that specifically instructs the site visitor to copy and paste a command into the Run prompt in Windows that uses the native mshta.exe binary to download and execute an HTA file from a remote server. [..] The HTA file, in turn, executes a PowerShell command to launch a next-stage payload, a PowerShell script that unpacks a second PowerShell script responsible for decoding and loading the Lumma payload, but not before taking steps to bypass the Windows Antimalware Scan Interface (AMSI) in an effort to evade detection. --------------------------------------------- https://thehackernews.com/2025/01/beware-fake-captcha-campaign-spreads.html ∗∗∗ Palo Alto Firewalls Found Vulnerable to Secure Boot Bypass and Firmware Exploits ∗∗∗ --------------------------------------------- An exhaustive evaluation of three firewall models from Palo Alto Networks has uncovered a host of known security flaws impacting the devices firmware as well as misconfigured security features. --------------------------------------------- https://thehackernews.com/2025/01/palo-alto-firewalls-found-vulnerable-to.h… ∗∗∗ Supply chain attack hits Chrome extensions, could expose millions ∗∗∗ --------------------------------------------- Cybersecurity outfit Sekoia is warning Chrome users of a supply chain attack targeting browser extension developers that has potentially impacted hundreds of thousands of individuals already. [..] A number of the potentially affected extensions (according to Booz Allen Hamilton's report) appear to have been pulled from the Chrome Web Store at the time of writing. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/01/22/supply_chain… ∗∗∗ Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory in response to exploitation in September 2024 of vulnerabilities in Ivanti Cloud Service Appliances (CSA): CVE-2024-8963, an administrative bypass vulnerability; CVE-2024-9379, a SQL injection vulnerability; and CVE-2024-8190 and CVE-2024-9380, remote code execution vulnerabilities. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-022a ∗∗∗ Denuvo Analysis ∗∗∗ --------------------------------------------- Denuvo is an anti-tamper and digital rights management system (DRM). It is primarily used to protect digital media such as video games from piracy and reverse engineering efforts. Unlike traditional DRM systems, Denuvo employs a wide range of unique techniques and checks to confirm the integrity of both the game’s code and licensed user. --------------------------------------------- https://connorjaydunn.github.io/blog/posts/denuvo-analysis/ ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in SonicWall SMA1000 - aktiv ausgenutzt - Update verfügbar ∗∗∗ --------------------------------------------- In SonicWall SMA1000 Appliance Management Console (AMC) und Central Management Console (CMC) wurde eine kritische Sicherheitslücke entdeckt, die bereits aktiv von Angreifern ausgenutzt wird. Die Schwachstelle ermöglicht die Ausführung von beliebigem Code ohne vorherige Authentifizierung. CVE-Nummer(n): CVE-2025-23006 --------------------------------------------- https://www.cert.at/de/warnungen/2025/1/sonicwall-amc-cmc-rce ∗∗∗ Critical zero-days impact premium WordPress real estate plugins ∗∗∗ --------------------------------------------- The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges. [..] Also, Patchstack says the vendor released three versions since September, but no security fixes to address the critical issues were introduced. Hence, the issues remain unfixed and exploitable. --------------------------------------------- https://www.bleepingcomputer.com/news/security/critical-zero-days-impact-pr… ∗∗∗ Schwachstellen in Jenkins-Plug-ins gefährden Entwicklungsumgebungen ∗∗∗ --------------------------------------------- Unter bestimmten Bedingungen können Angreifer Softwareentwicklungsserver mit Jenkins-Plug-ins attackieren. Darunter fallen etwa die Plug-ins Azure Service Fabric und Zoom. --------------------------------------------- https://heise.de/-10254105 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (redis:6), Debian (frr and git-lfs), Fedora (SDL2_sound and webkit2gtk4.0), Gentoo (firefox, GPL Ghostscript, libgsf, libuv, PHP, Qt, QtWebEngine, and Yubico pam-u2f), Mageia (chromium-browser-stable), SUSE (helmfile, nvidia-modprobe, qt6-webengine, ruby3.4-rubygem-actioncable-8.0-8.0.1-1.1, ruby3.4-rubygem-actionpack-8.0-8.0.1-1.1, ruby3.4-rubygem-actiontext-8.0-8.0.1-1.1, ruby3.4-rubygem-actionview-8.0-8.0.1-1.1, ruby3.4-rubygem-activejob-8.0-8.0.1-1.1, ruby3.4-rubygem-activerecord-8.0-8.0.1-1.1, ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1, ruby3.4-rubygem-rails-8.0-8.0.1-1.1, and ruby3.4-rubygem-railties-8.0-8.0.1-1.1), and Ubuntu (bluez, openjpeg2, and python-django). --------------------------------------------- https://lwn.net/Articles/1005946/ ∗∗∗ Drupal: Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-007 ∗∗∗ Drupal: Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-006 ∗∗∗ Drupal: Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-005 ∗∗∗ Drupal: AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2025-004 ∗∗∗ QNAP: Multiple Vulnerabilities in Rsync ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-25-02 ∗∗∗ Hitachi Energy RTU500 Series Product ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-02 ∗∗∗ mySCADA myPRO Manager ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-01 ∗∗∗ HMS Networks Ewon Flexy 202 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-023-06 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.01.2025
by Daily end-of-shift report 22 Jan '25

22 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 21-01-2025 18:00 − Mittwoch 22-01-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Großflächige Brute-Force-Angriffe auf M365 – vorsichtshalber Log-ins checken ∗∗∗ --------------------------------------------- In den vergangenen Wochen gab es großflächige Angriffe auf Zugangsdaten zur Microsoft-Cloud. IT-Admins sollten prüfen, ob diese eventuell erfolgreich waren. --------------------------------------------- https://heise.de/-10252167 ∗∗∗ Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day ∗∗∗ --------------------------------------------- Data from the Shadowserver Foundation shows 48,457 Fortinet boxes are still publicly exposed and haven't had the patch for CVE-2024-55591 applied, despite stark warnings issued over the past seven days. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2025/01/21/fortinet_fir… ∗∗∗ Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet ∗∗∗ --------------------------------------------- Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks have leveraged the security flaw since June 2024. --------------------------------------------- https://thehackernews.com/2025/01/hackers-exploit-zero-day-in-cnpilot.html ∗∗∗ Fake Homebrew Google ads target Mac users with malware ∗∗∗ --------------------------------------------- Hackers are once again abusing Google ads to spread malware, using a fake Homebrew website to infect Macs and Linux devices with an infostealer that steals credentials, browser data, and cryptocurrency wallets. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-homebrew-google-ads-tar… ∗∗∗ IPany VPN breached in supply-chain attack to push custom malware ∗∗∗ --------------------------------------------- South Korean VPN provider IPany was breached in a supply chain attack by the "PlushDaemon" China-aligned hacking group, who compromised the companys VPN installer to deploy the custom SlowStepper malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply… ∗∗∗ Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platforms ∗∗∗ --------------------------------------------- 3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. [..] A few months ago, I had a lightbulb moment: if Cloudflare stores cached data so close to users, could this be exploited for deanonymization attacks on sites we don't control? [..] Cloudflare's final statement about this says they do not consider the deanonymization attack to be a vulnerability in their own systems and it is up to their consumers to disable caching for resources they wish to protect. --------------------------------------------- https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117 ∗∗∗ Turning Data into Decisions: How CVE Management Is Changing ∗∗∗ --------------------------------------------- Every day, hundreds of new Common Vulnerabilities and Exposures (CVEs) are published, many of which target critical systems that keep businesses and governments operational. For cybersecurity professionals, simply knowing that a vulnerability exists is not enough. What’s needed is context—a deeper understanding of the CVE data, its potential impact, and how to prioritize its remediation. Enter Vulnrichment, an initiative launched by the Cybersecurity and Infrastructure Security Agency (CISA) on May 10, 2024. --------------------------------------------- https://thecyberexpress.com/cve-data-vulnrichment-program/ ∗∗∗ Geolocation and Starlink, (Tue, Jan 21st) ∗∗∗ --------------------------------------------- The IP address of a satellite user identifies the ground station location, not the user's location. Starlink, on the other hand, uses satellites in low earth orbit. The network can forward traffic among satellites, but typically, the satellite will attempt to pass the traffic to the closest base station in view. Due to the low orbit, each satellite only "sees" a relatively small area, and the ground station is usually within a couple hundred miles of the user. --------------------------------------------- https://isc.sans.edu/diary/rss/31612 ∗∗∗ Mirai Botnet Launches Record 5.6 Tbps DDoS Attack with 13,000+ IoT Device ∗∗∗ --------------------------------------------- Web infrastructure and security company Cloudflare on Tuesday said it detected and blocked a 5.6 Terabit per second (Tbps) distributed denial-of-service (DDoS) attack, the largest ever attack to be reported to date. The UDP protocol-based attack took place on October 29, 2024, targeting one of its customers, an unnamed internet service provider (ISP) from Eastern Asia. --------------------------------------------- https://thehackernews.com/2025/01/mirai-botnet-launches-record-56-tbps.html ∗∗∗ Understanding Microsofts CVSS v3.1 Ratings and Severity Scores ∗∗∗ --------------------------------------------- Recently, I looked at Microsoft’s assigned CVSS v3.1 scores for Patch Tuesday vulnerabilities alongside the Microsoft assigned severity ratings. I wanted to revisit these numbers and see just how closely CVSS aligns with Microsoft’s opinion of severity. --------------------------------------------- https://www.tripwire.com/state-of-security/understanding-microsofts-cvss-v3… ∗∗∗ Vorsicht, wenn Online-Shops per WhatsApp zur Zahlung auffordern ∗∗∗ --------------------------------------------- Der Fake-Shop bikeunivers.de bietet Markenfahrräder zu günstigen Preisen an. Bezahlt werden kann nur per Banküberweisung. Wer nicht bezahlt, erhält eine Zahlungsaufforderung per E-Mail und WhatsApp. Ignorieren Sie diese, denn Sie erhalten trotz Zahlung keine Ware! --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-whatsapp/ ∗∗∗ Vorsicht vor gefälschten Telegram-SMS ∗∗∗ --------------------------------------------- Derzeit kursieren gefälschte SMS, angeblich von Telegram. Die Nachricht besagt, dass Ihr Konto eingeschränkt sei und Sie es freischalten müssen. Klicken Sie auf keinen Fall auf den Link! Kriminelle stehlen Ihre Daten und versuchen sich auf einem fremden Gerät mit Ihrer Telefonnummer einzuloggen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-telegram-s… ∗∗∗ Redline, Vidar and Raccoon Malware Stole 1 Billion Passwords in 2024 ∗∗∗ --------------------------------------------- Specops 2025 Breached Password Report reveals over 1 billion passwords stolen by malware in the past year, exposing weak practices, malware trends, and security gaps. --------------------------------------------- https://hackread.com/redline-vidar-raccoon-malware-stole-1-billion-password… ===================== = Vulnerabilities = ===================== ∗∗∗ Oracle Critical Patch Update Advisory - January 2025 ∗∗∗ --------------------------------------------- This Critical Patch Update contains 318 new security patches across the product families listed below. --------------------------------------------- https://www.oracle.com/security-alerts/cpujan2025.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (snapcast), Fedora (python-jinja2), Mageia (rsync), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont, gh, kernel, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, nvidia-open-driver-G06-signed, and pam_u2f), and Ubuntu (linux-oem-6.11 and vim). --------------------------------------------- https://lwn.net/Articles/1005798/ ∗∗∗ Technical Advisory: Cross-Site Scripting in Umbraco Rich Text Display ∗∗∗ --------------------------------------------- Due to a lack of input sanitization on the server side, Umbraco CMS 14.3.1 or below is vulnerable to stored cross-site scripting (XSS) attacks through the rendering logic for rich text contents. [..] Umbraco has accepted this behavior as the majority of its customer base is unaffected. [..] Identify a C/C++ HTML sanitization framework best suited for the organization if using RTE is mandatory. Seek alternative components in Umbraco for content rendering otherwise. --------------------------------------------- https://www.nccgroup.com/us/research-blog/technical-advisory-cross-site-scr… ∗∗∗ PHP: PMASA-2025-3 ∗∗∗ --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2025-3/ ∗∗∗ PHP: PMASA-2025-2 ∗∗∗ --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2025-2/ ∗∗∗ PHP: PMASA-2025-1 ∗∗∗ --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2025-1/ ∗∗∗ ABB: 2025-01-21: Cyber Security Advisory - Drive Composer Path Traversal Vulnerability ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5466&Lan… ∗∗∗ Cisco BroadWorks SIP Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Meeting Management REST API Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco ClamAV OLE2 File Format Decryption Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.01.2025
by Daily end-of-shift report 21 Jan '25

21 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Montag 20-01-2025 18:00 − Dienstag 21-01-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing” ∗∗∗ --------------------------------------------- Sophos MDR identifies a new threat cluster riffing on the playbook of Storm-1811, and amped-up activity from the original connected to Black Basta ransomware. --------------------------------------------- https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-c… ∗∗∗ 7-Zip: Lücke erlaubt Umgehung von Mark-of-the-Web ∗∗∗ --------------------------------------------- In 7-Zip ermöglicht eine Sicherheitslücke, den Mark-of-the-Web-Schutzmechanismus auszuhebeln und so Code auszuführen. [..] Die Sicherheitslücke schließt 7-Zip Version 24.09 oder neuer, die auf der Download-Seite von 7-Zip bereits seit Ende November vergangenen Jahres zum Herunterladen bereitsteht. [..] 7-Zip-Nutzer müssen selbst aktiv werden, um sich zu schützen und das verfügbare Update installieren. --------------------------------------------- https://heise.de/-10250351 ∗∗∗ 13,000 MikroTik Routers Hijacked by Botnet for Malspam and Cyberattacks ∗∗∗ --------------------------------------------- A global network of about 13,000 hijacked Mikrotik routers has been employed as a botnet to propagate malware via spam campaigns, the latest addition to a list of botnets powered by MikroTik devices. The activity "take[s] advantage of misconfigured DNS records to pass email protection techniques," Infoblox security researcher David Brunsdon said in a technical report published last week. --------------------------------------------- https://thehackernews.com/2025/01/13000-mikrotik-routers-hijacked-by.html ∗∗∗ Exchange 2016 und 2019 erreichen Support-Ende – in 9 Monaten ∗∗∗ --------------------------------------------- Microsoft erinnert an das dräuende Support-Ende der Exchange-Server 2016 und 2019. --------------------------------------------- https://www.heise.de/-10249853 ∗∗∗ Medusa Ransomware: What You Need To Know ∗∗∗ --------------------------------------------- What is the Medusa ransomware? Medusa is a ransomware-as-a-service (RaaS) platform that first came to prominence in 2023. The ransomware impacts organisations running Windows, predominantly exploiting vulnerable and unpatched systems and hijacking accounts through initial access brokers. --------------------------------------------- https://www.tripwire.com/state-of-security/medusa-ransomware-what-you-need-… ∗∗∗ How to secure body-worn cameras and protect footage from cyber threats ∗∗∗ --------------------------------------------- Body-worn cameras are used by police [..] Cameras are taken into the field but footage could be presented as evidence [..] Cryptographic approaches are needed to ensure the confidentiality and integrity of captured video and audio. --------------------------------------------- https://www.pentestpartners.com/security-blog/how-to-secure-body-worn-camer… ∗∗∗ Offene Rechnung für „Gelbe Seiten Online“-Eintrag nicht bezahlen ∗∗∗ --------------------------------------------- In den letzten Tagen haben zahlreiche Unternehmen eine E-Mail von gsol-dach.com erhalten. Darin werden sie aufgefordert, eine Rechnung für einen angeblichen Premium-Firmenbucheintrag zu bezahlen. Achtung: Diese Rechnungen sind Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/rechnung-fuer-gelbe-seiten-online-ei… ∗∗∗ Hackers impersonate Ukraine’s CERT to trick people into allowing computer access ∗∗∗ --------------------------------------------- CERT-UA is warning Ukrainians not to accept requests for help via AnyDesk software unless they are sure the source is legitimate. --------------------------------------------- https://therecord.media/fake-ukraine-cert-anydesk-requests-hackers ∗∗∗ Reverse Engineering Bambu Connect ∗∗∗ --------------------------------------------- The purpose of this guide is to demonstrate the trivial process of extracting the "private keys" used for communicating with Bambu devices to examine, and challenge, the technical basis for Bambu Lab's security justification of Bambu Connect. --------------------------------------------- https://wiki.rossmanngroup.com/wiki/Reverse_Engineering_Bambu_Connect ∗∗∗ Vulnerability Archeology: Stealing Passwords with IBM i Access Client Solutions ∗∗∗ --------------------------------------------- Two weeks ago IBM published a support article about a compatibility issue affecting IBM i Access Client Solutions (ACS) when running on Windows 11 24H2. [..] Debugging the entry point in cwbnetnt.dll also confirms that password information is no longer passed to the Network Provider!. This change was documented by Microsoft here in March 2024, we believe IBM should’ve referenced this document in their memo. This is an important change from Microsoft - let’s hope not many applications rely on this backdoor and their insecure artifacts get cleaned up properly! --------------------------------------------- https://blog.silentsignal.eu/2025/01/21/ibm-acs-password-dump/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (grafana), Debian (libebml, poco, redis, sympa, tiff, and ucf), Fedora (rsync), Mageia (dcmtk, git, proftpd, and raptor2), Red Hat (grafana, iperf3, kernel, microcode_ctl, and redis), SUSE (chromium, dhcp, git, libqt5-qtwebkit, and pam_u2f), and Ubuntu (python3.10, python3.8 and python3.12). --------------------------------------------- https://lwn.net/Articles/1005708/ ∗∗∗ Webbrowser: Lücke in Brave ermöglicht gefälschte Anzeige der Download-Quelle ∗∗∗ --------------------------------------------- Im Webbrowser Brave können Angreifer eine Sicherheitslücke missbrauchen, die zur falschen Anzeige einer Download-Quelle führt. [..] Die Sicherheitslücke schließt Brave mit der Version 1.74.48, die in der Mitte vergangener Woche veröffentlicht wurde. --------------------------------------------- https://heise.de/-10250205 ∗∗∗ Traffic Alert and Collision Avoidance System (TCAS) II ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-01 ∗∗∗ ZF Roll Stability Support Plus (RSSPlus) ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-25-021-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.01.2025
by Daily end-of-shift report 20 Jan '25

20 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 17-01-2025 18:00 − Montag 20-01-2025 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Malicious PyPi package steals Discord auth tokens from devs ∗∗∗ --------------------------------------------- A malicious package named pycord-self on the Python package index (PyPI) targets Discord developers to steal authentication tokens and plant a backdoor for remote control over the system. [..] The package mimics the highly popular 'discord.py-self,' which has nearly 28 million downloads, and even offers the functionality of the legitimate project. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-pypi-package-steal… ∗∗∗ Forscher deckt auf: ChatGPT lässt sich für DDoS-Angriffe missbrauchen ∗∗∗ --------------------------------------------- Eine ChatGPT-API scheint bereitwillig eine lange Liste von Links zur gleichen Webseite anzunehmen - und diese anschließend ungebremst abzufragen. [..] Ausführen lässt sich der DDoS-Angriff laut Flesch durch eine HTTP-Anfrage an eine ChatGPT-API, konkret durch einen POST-Request an die URL "https://chatgpt.com/backend-api/attributions". Die API erwarte eine Liste von Hyperlinks, schreibt der Forscher. Jedoch werde nicht geprüft, ob ein Hyperlink zur gleichen Ressource mehrfach genannt wird. --------------------------------------------- https://www.golem.de/news/forscher-deckt-auf-chatgpt-laesst-sich-fuer-ddos-… ∗∗∗ Partial ZIP File Downloads, (Mon, Jan 20th) ∗∗∗ --------------------------------------------- Say you want a file that is inside a huge online ZIP file (several gigabytes large). Downloading the complete ZIP file would take too long. --------------------------------------------- https://isc.sans.edu/diary/rss/31608 ∗∗∗ Private Keys in the Fortigate Leak ∗∗∗ --------------------------------------------- A few days ago, a download link for a leak of configuration files for Fortigate/Fortinet devices was posted on an Internet forum. [..] It was first reported by heise, a post by Kevin Beaumont contains further info. What has not been widely recognized is that this leak also contains TLS and SSH private keys. --------------------------------------------- https://blog.hboeck.de:443/archives/908-Private-Keys-in-the-Fortigate-Leak.… ∗∗∗ Looking at the Attack Surfaces of the Pioneer DMH-WT7600NEX IVI ∗∗∗ --------------------------------------------- For the upcoming Pwn2Own Automotive contest, a total of four in-vehicle infotainment (IVI) head units have been selected as targets. [..] This blog post aims to detail some of the attack surfaces of the DMH-WT7600NEX unit as well as provide information on how to extract the software running on this unit for further vulnerability research. --------------------------------------------- https://www.thezdi.com/blog/2025/1/16/looking-at-the-attack-surfaces-of-the… ∗∗∗ Die meisten Cyberkriminellen hacken nicht, sondern loggen sich ein ∗∗∗ --------------------------------------------- Bei 57 Prozent der erfolgreichen Cyberangriffe ist kein großer Hack über Sicherheitslücken erforderlich. Die Cyberkriminellen nutzten einfach ein kompromittiertes Nutzerkonto, um Zugang auf die Systeme zu erhalten, so die Analyse von Varonis zu solchen Vorfällen --------------------------------------------- https://www.borncity.com/blog/2025/01/19/die-meisten-cyberkriminellen-hacke… ∗∗∗ Hackers Claim Breach of Hewlett Packard Enterprise, Lists Data for Sale ∗∗∗ --------------------------------------------- Hacker IntelBroker claims to have breached Hewlett Packard Enterprise (HPE), exposing sensitive data like source code, certificates, and PII, now available for sale online. --------------------------------------------- https://hackread.com/hackers-claim-hewlett-packard-data-breach-sale/ ∗∗∗ Secure Coding: Apache Maven gegen Cache-Poisoning-Attacken rüsten ∗∗∗ --------------------------------------------- Dependency-Management-Systeme wie Maven sind immer wieder Ziel von Cache-Poisoning-Angriffen, gegen die nur konsequent umgesetzte Sicherheitspraktiken helfen. --------------------------------------------- https://heise.de/-10244779 ∗∗∗ Hilton, Hyatt, Marriott: 437.000 Datensätze aus Verwaltungsplattform bei HIBP ∗∗∗ --------------------------------------------- Kriminelle haben Daten bei der Verwaltungsplattform Otelier geklaut. Rund 437.000 Datensätze etwa von Hilton, Hyatt oder Marriott sind nun bei HIBP. --------------------------------------------- https://heise.de/-10248339 ∗∗∗ Investigating an "evil" RJ45 dongle ∗∗∗ --------------------------------------------- Earlier this week, a young entrepreneur caused stir on social media by suggesting that an Ethernet-to-USB they purchased from China was preloaded with malware that “evaded virtual machines”, “captured keystrokes”, and “used Russian-language elements”. [..] To get to that point, we didn’t need a hardware lab; a bit of patience and Google-fu was enough. --------------------------------------------- https://lcamtuf.substack.com/p/investigating-an-evil-rj45-dongle ===================== = Vulnerabilities = ===================== ∗∗∗ VU#199397: Insecure Implementation of Tunneling Protocols (GRE/IPIP/4in6/6in4) ∗∗∗ --------------------------------------------- Researchers at the DistriNet-KU Leuven research group have discovered millions of vulnerable Internet systems that accept unauthenticated IPIP, GRE, 4in6, or 6in4 traffic. This can be considered a generalization of the vulnerability in VU#636397 : IP-in-IP protocol routes arbitrary traffic by default (CVE-2020-10136). The exposed systems can be abused as one-way proxies, enable an adversary to spoof the source address of packets (CWE-290 Authentication Bypass by Spoofing), or permit access to an organization's private network. --------------------------------------------- https://kb.cert.org/vuls/id/199397 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (.NET 8.0, .NET 9.0, ipa, and NetworkManager), Debian (389-ds-base, busybox, libreoffice, rsync, ruby2.7, tomcat10, and tryton-server), Fedora (chromium and stb), Mageia (openafs and vim), Oracle (.NET 8.0 and .NET 9.0), SUSE (amazon-ssm-agent, chromedriver, git, golang-github-prometheus-prometheus, govulncheck-vulndb, grafana, hplip, pam_u2f, perl-Compress-Raw-Zlib, perl-IO-Compress, redis, redis7, rsync, and velociraptor), and Ubuntu (libpodofo and linux-xilinx-zynqmp). --------------------------------------------- https://lwn.net/Articles/1005638/ ∗∗∗ Nvidia: Datenabfluss durch Sicherheitsleck in Grafiktreiber möglich ∗∗∗ --------------------------------------------- Nvidia hat Sicherheitslücken in seinen Grafikkartentreibern entdeckt. Angreifer können dadurch Informationen abgreifen. Updates stehen bereit. --------------------------------------------- https://heise.de/-10248258 ∗∗∗ Sicherheitspatch: Unbefugte Zugriffe auf bestimmte Switches von Moxa möglich ∗∗∗ --------------------------------------------- Angreifer können bei Moxa-Switches der EDS-508A-Serie die Authentifizierung umgehen. Die Sicherheitslücke gilt als kritisch. Um Angriffe vorzubeugen, sollten Netzwerkadmins die Firmware ihrer Ethernet-Switches der Serie EDS-508A von Moxa auf den aktuellen Stand bringen. --------------------------------------------- https://heise.de/-10249285 ∗∗∗ Yubico Warns of 2FA Security Flaw in pam-u2f for Linux and macOS Users ∗∗∗ --------------------------------------------- https://thecyberexpress.com/yubico-2fa-bypass-vulnerability-advisory/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.01.2025
by Daily end-of-shift report 17 Jan '25

17 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 16-01-2025 18:00 − Freitag 17-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ D-Trust: Cyberangriff trifft Trustcenter der Bundesdruckerei ∗∗∗ --------------------------------------------- Aus einem Antragsportal der D-Trust GmbH sind potenziell personenbezogene Daten abgeflossen. Wer hinter dem Angriff steckt, ist noch unklar. --------------------------------------------- https://www.golem.de/news/d-trust-cyberangriff-trifft-trustcenter-der-bunde… ∗∗∗ Mercedes-Benz Head Unit security research report ∗∗∗ --------------------------------------------- Kaspersky experts analyzed the Mercedes-Benz head unit, its IPC protocols and firmware, and found new vulnerabilities via physical access. --------------------------------------------- https://securelist.com/mercedes-benz-head-unit-security-research/115218/ ∗∗∗ New Star Blizzard spear-phishing campaign targets WhatsApp accounts ∗∗∗ --------------------------------------------- In mid-November 2024, Microsoft Threat Intelligence observed the Russian threat actor we track as Star Blizzard sending their typical targets spear-phishing messages, this time offering the supposed opportunity to join a WhatsApp group. This is the first time we have identified a shift in Star Blizzard’s longstanding tactics, techniques, .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/01/16/new-star-blizzard-… ∗∗∗ Gootloader inside out ∗∗∗ --------------------------------------------- Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward --------------------------------------------- https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/ ∗∗∗ U.S. Sanctions North Korean IT Worker Network Supporting WMD Programs ∗∗∗ --------------------------------------------- The U.S. Treasury Departments Office of Foreign Assets Control (OFAC) sanctioned two individuals and four entities for their alleged involvement in illicit revenue generation schemes for the Democratic Peoples Republic of Korea (DPRK) by dispatching .. --------------------------------------------- https://thehackernews.com/2025/01/us-sanctions-north-korean-it-worker.html ∗∗∗ Hackers Likely Stole FBI Call Logs From AT&T That Could Compromise Informants ∗∗∗ --------------------------------------------- A breach of AT&T that exposed “nearly all” of the company’s customers may have included records related to confidential FBI sources, potentially explaining the bureau’s new embrace of end-to-end encryption. --------------------------------------------- https://www.wired.com/story/hackers-likely-stole-fbi-call-logs-from-att-tha… ∗∗∗ Biden ordnet für US-Behörden Verschlüsselung von E-Mail, DNS und BGP an ∗∗∗ --------------------------------------------- Ende-zu-Ende-Verschlüsselung, bessere Software und Abwehr, Post-Quanten, Aufsicht über Lieferanten, Passkeys, Erforschung von KI – Biden verordnet gute Medizin. --------------------------------------------- https://www.heise.de/news/Biden-ordnet-Verschluesselung-von-E-Mail-DNS-und-… ∗∗∗ Daten von rund 250.000 MSI-Kunden bei Have I Been Pwned ∗∗∗ --------------------------------------------- Bei einem Cybervorfall bei MSI sind 2024 offenbar zahlreiche Kundendatensätze kopiert worden. Rund 250.000 Stück hat HIBP nun aufgenommen. --------------------------------------------- https://www.heise.de/news/Daten-von-rund-250-000-MSI-Kunden-bei-Have-I-Been… ∗∗∗ Vertrauensdiensteanbieter D-Trust informiert über Datenschutzvorfall ∗∗∗ --------------------------------------------- Bei D-Trust kam es zu einem Datenschutzvorfall. Betroffen ist das Antragsportal für Signatur- und Siegelkarten. Die Ermittlungen laufen. --------------------------------------------- https://www.heise.de/news/Vertrauensdiensteanbieter-D-Trust-informiert-uebe… ∗∗∗ Chinese Innovations Spawn Wave of Toll Phishing Via SMS ∗∗∗ --------------------------------------------- Residents across the United States are being inundated with text messages purporting to come from toll road operators like E-ZPass, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to .. --------------------------------------------- https://krebsonsecurity.com/2025/01/chinese-innovations-spawn-wave-of-toll-… ∗∗∗ OSV-SCALIBR: A library for Software Composition Analysis ∗∗∗ --------------------------------------------- In December 2022, we announced OSV-Scanner, a tool to enable developers to easily scan for vulnerabilities in their open source dependencies. Together with the open source community, we’ve continued to build this tool, adding remediation features, as well .. --------------------------------------------- http://security.googleblog.com/2025/01/osv-scalibr-library-for-software.html ∗∗∗ PayPal ruft an? Vorsicht Betrug! ∗∗∗ --------------------------------------------- Aktuell erhält die Watchlist Internet zahlreiche Meldungen zu Anrufen durch angebliche PayPal-Mitarbeiter:innen. Heben Sie ab, berichtet man Ihnen von angeblichen Abbuchungen von Ihrem PayPal-Konto und fordert Ihre Mithilfe zum Blockieren der Abbuchungen. Tatsächlich greift man dabei aber auf Ihre Systeme zu und stiehlt Ihnen Ihr Geld. Ein Schaden entsteht erst durch das Telefonat! --------------------------------------------- https://www.watchlist-internet.at/news/paypal-ruft-an/ ∗∗∗ Let’s talk about AI and end-to-end encryption ∗∗∗ --------------------------------------------- Recently, I came across a fantastic new paper by a group of NYU and Cornell researchers entitled “How to think about end-to-end encryption and AI.” I’m extremely grateful to see this paper, because while I don’t agree with every one of it’s .. --------------------------------------------- https://blog.cryptographyengineering.com/2025/01/17/lets-talk-about-ai-and-… ∗∗∗ Threat Brief: CVE-2025-0282 and CVE-2025-0283 ∗∗∗ --------------------------------------------- CVE-2025-0282 and CVE-2025-0283 affect multiple Ivanti products. This threat brief covers attack scope, including details from an incident response case. --------------------------------------------- https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2… ∗∗∗ New WDAC Exploit Technique: Leveraging Policies to Disable EDRs and Evade Detection ∗∗∗ --------------------------------------------- The file “SiPolicy.p7b” contains policies that Windows OS and Windows Defender (AV) will listen to and your antivirus will apply the policies that this .. --------------------------------------------- https://www.truesec.com/hub/blog/new-wdac-exploit-technique-leveraging-poli… ∗∗∗ IoT Botnet Linked to Large-scale DDoS Attacks Since the End of 2024 ∗∗∗ --------------------------------------------- Since the end of 2024, we have been continuously monitoring large-scale DDoS attacks orchestrated by an IoT botnet exploiting vulnerable IoT devices such as wireless routers and IP cameras. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/a/iot-botnet-linked-to-ddos-at… ∗∗∗ Announcing Six Day and IP Address Certificate Options in 2025 ∗∗∗ --------------------------------------------- This year we will continue to pursue our commitment to improving the security of the Web PKI by introducing the option to get certificates with six-day lifetimes (“short-lived certificates”). We will also add support for IP addresses in addition to domain names .. --------------------------------------------- https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/ ∗∗∗ A Response to Recent Claims About Sessions Security Architecture ∗∗∗ --------------------------------------------- We were recently made aware of a blog published by a security researcher which makes a number of claims about Session and supposed flaws in Session’s design and implementation. We, as well as other Session contributors, have now had time to read through the blog and investigate the claims and wanted to give a detailed response on each point raised by the author. --------------------------------------------- https://getsession.org/blog/a-response-to-recent-claims-about-sessions-secu… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (rsync and tomcat9), Fedora (chromium, mingw-python-jinja2, redict, and valkey), Gentoo (GIMP and pip), Oracle (.NET, fence-agents, ipa, kernel, python-virtualenv, raptor2, and rsync), Red Hat (.NET 8.0 and .NET 9.0), SUSE (apache2-mod_jk, git, git-lfs, kernel, python-Django, thunderbird, and xen), and Ubuntu (audacity, bcel, dotnet8, dotnet9, gimp-dds, harfbuzz, libxml2, poppler, rsync, and tqdm). --------------------------------------------- https://lwn.net/Articles/1005433/ ∗∗∗ Aviatrix Controllers OS Command Injection Vulnerability ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/threat-signal-report/5982 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.01.2025
by Daily end-of-shift report 16 Jan '25

16 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 15-01-2025 18:00 − Donnerstag 16-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ MFA Failures - The Worst is Yet to Come ∗∗∗ --------------------------------------------- This article delves into the rising tide of MFA failures, the alarming role of generative AI in amplifying these attacks, the growing user discontent weakening our defenses, and the glaring vulnerabilities being frequently exploited. The storm is building, and the worst is yet to come. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mfa-failures-the-worst-is-ye… ∗∗∗ An honest mistake - and a cautionary tale ∗∗∗ --------------------------------------------- We all make mistakes. That is only natural. However, there are cases in which these mistakes can have unexpected consequences. A Twitter user recently found this out the hard way. The ingredients: a cheap USB-C adapter with a network connection, an internet connection and a sandbox. --------------------------------------------- https://www.gdatasoftware.com/blog/2025/01/38129-usb-network-adapter-malware ∗∗∗ Windows 10 und 11: Microsoft verwirrt Nutzer mit Bitlocker-Bug ∗∗∗ --------------------------------------------- Auf einigen Windows-Geräten mit aktivierter Bitlocker-Verschlüsselung erscheint eine unerwartete Meldung. Microsoft untersucht das Problem. --------------------------------------------- https://www.golem.de/news/windows-10-und-11-microsoft-verwirrt-nutzer-mit-b… ∗∗∗ Tiktok, Xiaomi, Aliexpress: Beschwerden wegen Datentransfers nach China eingereicht ∗∗∗ --------------------------------------------- China ist als autoritärer Überwachungsstaat nach Einschätzung von Datenschützern kein zulässiger Standort für europäische Nutzerdaten. --------------------------------------------- https://www.golem.de/news/tiktok-xiaomi-aliexpress-beschwerden-wegen-datent… ∗∗∗ Bidens Cyber Ambassador Urges Trump Not to Cede Ground to Russia and China in Global Tech Fight ∗∗∗ --------------------------------------------- Nathaniel Fick, the ambassador for cyberspace and digital policy, has led US tech diplomacy amid a rising tide of pressure from authoritarian regimes. Will the Trump administration undo that work? --------------------------------------------- https://www.wired.com/story/nathaniel-fick-us-cyber-ambassador-exit-intervi… ∗∗∗ IT-Sicherheit: EU-Kommission will Gesundheitsbranche unterstützen ∗∗∗ --------------------------------------------- Verstärkte Prävention und rasche Reaktion auf Attacken stehen im Zentrum eines EU-Plans für IT-Sicherheit von Krankenhäusern und Gesundheitsdienstleistern. --------------------------------------------- https://www.heise.de/news/IT-Attacken-So-will-die-EU-Kommission-den-Gesundh… ∗∗∗ Es kann Schadcode auf HPE Aruba Networking AOS Controllers und Gateways gelangen ∗∗∗ --------------------------------------------- Netzwerktechnik von HPE Aruba ist verwundbar. Aktuelle Updates schließen insgesamt zwei Sicherheitslücken. --------------------------------------------- https://www.heise.de/news/Es-kann-Schadcode-auf-HPE-Aruba-Networking-AOS-Co… ∗∗∗ Achtung vor go.hopeforlifefund.com: Spendenaufruf für Nikolas ist Fake! ∗∗∗ --------------------------------------------- Kinder, die an Krebs erkranken, stehen vor großen Herausforderungen und ihre Familien sind oft mit enormen finanziellen Belastungen konfrontiert. Spendenaktionen können hier ein Lichtblick sein. Doch leider gibt es auch Kriminelle, die das Mitgefühl der Menschen schamlos ausnutzen – wie im Fall der betrügerischen Spendenplattform go.hopeforlifefund.com, die angeblich für den krebskranken Jungen Nikolas Spenden sammelt. --------------------------------------------- https://www.watchlist-internet.at/news/spendenaufruf-fuer-krebskranken-niko… ∗∗∗ FTC cracks down on GoDaddy for cybersecurity failings ∗∗∗ --------------------------------------------- GoDaddy’s failure to use industry standard measures led to what the Federal Trade Commission called “several major security breaches” between 2019 and 2022. --------------------------------------------- https://therecord.media/ftc-godaddy-cyber-failings-fine ∗∗∗ Detecting Teams Chat Phishing Attacks (Black Basta) ∗∗∗ --------------------------------------------- For quite a while now, there has been a new ongoing threat campaign where the adversaries first bomb a user’s mailbox with spam emails and then pose as Help Desk or IT Support on Microsoft Teams to trick their potential victims into providing .. --------------------------------------------- https://blog.nviso.eu/2025/01/16/detecting-teams-chat-phishing-attacks-blac… ∗∗∗ 2022 zero day was used to raid Fortigate firewall configs. Somebody just released them. ∗∗∗ --------------------------------------------- Back in 2022, Fortinet warned that somebody had a zero day vulnerability and was using it to exploit Fortigate firewalls https://www.fortinet.com/blog/psirt-blogs/update-regarding-cve-2022-40684 .. --------------------------------------------- https://doublepulsar.com/2022-zero-day-was-used-to-raid-fortigate-firewall-… ∗∗∗ Black Basta-Style Cyberattack Hits Inboxes with 1,165 Emails in 90 Minutes ∗∗∗ --------------------------------------------- A recent cyberattack, mimicking the tactics of the notorious Black Basta ransomware group, targeted one of SlashNext’s clients.… --------------------------------------------- https://hackread.com/black-basta-cyberattack-hits-inboxes-with-1165-emails/ ∗∗∗ Proxying PyRIT for fun and profit ∗∗∗ --------------------------------------------- If you are in the AI security field, you are probably facing the problem of testing Large Language Models (LLMs) at scale and questioning the optimal balance between automatic testing and manual testing .. --------------------------------------------- https://www.nccgroup.com/us/research-blog/proxying-pyrit-for-fun-and-profit/ ∗∗∗ Dont Use Session (Signal Fork) ∗∗∗ --------------------------------------------- The main reason I said to avoid Session, all those months ago, was simply due to their decision to remove forward secrecy (which is an important security property of cryptographic protocols they inherited for free when they forked libsignal). --------------------------------------------- https://soatok.blog/2025/01/14/dont-use-session-signal-fork/ ∗∗∗ UK Officials Consider Banning Ransomware Payments from Public Entities ∗∗∗ --------------------------------------------- The UK government is poised to take a decisive step in the fight against ransomware by banning public sector entities from paying ransoms. This collection of proposals, part of a broader effort to protect critical national infrastructure, aims to disrupt the business model of cybercriminals and shield essential services like the NHS, schools, and local .. --------------------------------------------- https://socket.dev/blog/uk-officials-consider-banning-ransomware-payments-f… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (fence-agents, raptor2, and rsync), Debian (chromium), Fedora (rsync and seamonkey), Mageia (openjpeg2), Red Hat (tuned), Slackware (git), SUSE (dcmtk, dnsmasq, govulncheck-vulndb, libQtWebKit4, libraptor-devel, opera, python311-Pillow, python311-translate-toolkit, rsync, and SDL2_sound-devel), and Ubuntu (linux-raspi-5.4, neomutt, and python2.7). --------------------------------------------- https://lwn.net/Articles/1005292/ ∗∗∗ CVE-2024-9042 ∗∗∗ --------------------------------------------- Command Injection affecting Windows nodes via nodes/*/logs/query API --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/129654 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.01.2025
by Daily end-of-shift report 15 Jan '25

15 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-01-2025 18:00 − Mittwoch 15-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites ∗∗∗ --------------------------------------------- A new malware campaign has compromised more than 5,000 WordPress sites to create admin accounts, install a malicious plugin, and steal data. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wp3xyz-malware-attacks-add-r… ∗∗∗ Undercover Operations: Scraping the Cybercrime Underground ∗∗∗ --------------------------------------------- A blog about web scraping methods, use cases, challenges, and how to overcome them. --------------------------------------------- https://www.sans.org/blog/undercover-operations-scraping-the-cybercrime-und… ∗∗∗ Cyber-Bedrohungen für die öffentliche Ladeinfrastruktur: Risiken und Schutzmaßnahmen durch Penetrationstests ∗∗∗ --------------------------------------------- Angriffe auf die öffentliche Ladeinfrastruktur für Elektrofahrzeuge nehmen zu und gefährden den Ruf und die Sicherheit der .. --------------------------------------------- https://sec-consult.com/de/blog/detail/cyber-bedrohungen-fuer-die-oeffentli… ∗∗∗ Phishing False Alarm ∗∗∗ --------------------------------------------- A very security-conscious company was hit with a (presumed) massive state-actor phishing attack with gift cards, and everyone rallied to combat it—until it turned out it was company management sending the gift cards. --------------------------------------------- https://www.schneier.com/blog/archives/2025/01/phishing-false-alarm.html ∗∗∗ Miscreants mass exploited Fortinet firewalls, highly probable zero-day used ∗∗∗ --------------------------------------------- Ransomware not off the table, Arctic Wolf threat hunter tells El Reg Updated Miscreants running a "mass exploitation campaign" against Fortinet firewalls, which peaked in December, may be using an unpatched zero-day vulnerability to compromise the equipment, according to security researchers who say theyve observed the .. --------------------------------------------- https://www.theregister.com/2025/01/14/miscreants_mass_exploited_fortinet_f… ∗∗∗ Patchday Fortinet: Hintertür ermöglicht unbefugte Zugriffe auf FortiSwitch ∗∗∗ --------------------------------------------- Der Anbieter von IT-Securitylösungen Fortinet hat zahlreiche Sicherheitsupdates für seine Produkte veröffentlicht. Das sollten Netzwerkadmins im Blick haben. --------------------------------------------- https://www.heise.de/news/Patchday-Fortinet-Hintertuer-ermoeglicht-unbefugt… ∗∗∗ Cybergang Cl0p: Angeblich Daten durch Cleo-Sicherheitslücke abgezogen ∗∗∗ --------------------------------------------- Die kriminelle Bande Cl0p hat angeblich bei vielen Unternehmen Daten durch eine Sicherheitslücke in der Transfersoftware Cleo gestohlen. --------------------------------------------- https://www.heise.de/news/Cybergang-Cl0p-Angeblich-Daten-durch-Cleo-Sicherh… ∗∗∗ Security flaws found in tiny phones promoted to children ∗∗∗ --------------------------------------------- TL;DR Three mini smartphones promoted to children were analysed These types of phones are heavily promoted on TikTok All had outdated operating systems All could be rooted without wiping the .. --------------------------------------------- https://www.pentestpartners.com/security-blog/security-flaws-found-in-tiny-… ∗∗∗ Security flaws found in tiny phones promoted to children ∗∗∗ --------------------------------------------- TL;DR Three mini smartphones promoted to children were analysed Those devices are heavily promoted on TikTok All had outdated operating systems All could be rooted without wiping the phone, allowing .. --------------------------------------------- https://www.pentestpartners.com/security-blog/security-flaws-found-in-tiny-… ∗∗∗ Adobe Releases Security Updates for Multiple Products ∗∗∗ --------------------------------------------- Adobe released security updates to address vulnerabilities in multiple Adobe software products including Adobe Photoshop, Animate, and Illustrator for iPad. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/01/14/adobe-releases-security-… ∗∗∗ TAG Bulletin: Q3 2024 ∗∗∗ --------------------------------------------- This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q3 2024. --------------------------------------------- https://blog.google/threat-analysis-group/tag-bulletin-q3-2024/ ∗∗∗ Patchday: Windows 10/11 Updates (14. Januar 2025) ∗∗∗ --------------------------------------------- Am 14. Januar 2024 (zweiter Dienstag im Monat, Patchday bei Microsoft) hat Microsoft auch kumulative Updates für die noch unterstützten Versionen der Client-Betriebssysteme Windows 10 und Windows 11 veröffentlicht. Hier einige .. --------------------------------------------- https://www.borncity.com/blog/2025/01/15/patchday-windows-10-11-updates-14-… ∗∗∗ Passkeys: the promise of a simpler and safer alternative to passwords ∗∗∗ --------------------------------------------- The merits of choosing passkeys over passwords to help keep your online accounts more secure, and explaining how the technology promises to do this --------------------------------------------- https://www.ncsc.gov.uk/blog-post/passkeys-promise-simpler-alternative-pass… ∗∗∗ Your Single-Page Applications Are Vulnerable: Heres How to Fix Them ∗∗∗ --------------------------------------------- Due to their client-side nature, single-page applications (SPAs) will typically have multiple access control vulnerabilitiesBy implementing a robust access control policy on supporting APIs, the risks associated with client-side rendering can be largely mitigatedUsing server-side .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/single-page-applic… ∗∗∗ Tracking cloud-fluent threat actors - Part two: Behavioral cloud IOCs ∗∗∗ --------------------------------------------- Discover how behavioral cloud IOCs can expose malicious activity as we break down real-world examples to reveal actionable detection techniques. --------------------------------------------- https://www.wiz.io/blog/detecting-behavioral-cloud-indicators-of-compromise… ∗∗∗ The Risks of Misguided Research in Supply Chain Security ∗∗∗ --------------------------------------------- On January 8, 2025, it came to light that Snyk, a well-known security tool—frequently used to protect against supply chain attacks—was implicated in a troubling event. Several malicious packages targeting the popular AI coding platform Cursor were deployed to the public npm registry. These packages, named “cursor-retrieval,” “cursor-always-local,” .. --------------------------------------------- https://socket.dev/blog/the-risks-of-misguided-research-in-supply-chain-sec… ∗∗∗ Penetration Testing for ISO/IEC 27001: A Detailed Guide to Compliance ∗∗∗ --------------------------------------------- In an era where data breaches and cyber threats dominate headlines, safeguarding sensitive information has become a critical priority for organizations worldwide. ISO/IEC 27001, the internationally recognized standard for Information Security Management Systems (ISMS), offers a robust framework to protect valuable information assets. By .. --------------------------------------------- https://fortbridge.co.uk/regulations/penetration-testing-for-iso-iec-27001-… ===================== = Vulnerabilities = ===================== ∗∗∗ Six vulnerabilities discovered in rsync ∗∗∗ --------------------------------------------- Nick Tait announced on the oss-security mailing list that rsync, the widely used file transfer program, had a number of serious vulnerabilities.Users can mitigate all six vulnerabilities by upgrading to version 3.4.0, which was released on January 14. While all users should upgrade, servers that use rsyncd are especially impacted:In the most severe CVE, an attacker .. --------------------------------------------- https://lwn.net/Articles/1005129/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (rsync), Debian (rsync), Fedora (perl-Net-OAuth and redis), Red Hat (ipa, raptor2, rsync, and tuned), Slackware (rsync), SUSE (apache2-mod_jk, git, kernel, rclone, rsync, and webkit2gtk3), and Ubuntu (git, linux-azure-5.4, pdns, pdns-recursor, python-django, rlottie, and rsync). --------------------------------------------- https://lwn.net/Articles/1005163/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.01.2025
by Daily end-of-shift report 14 Jan '25

14 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Montag 13-01-2025 18:00 − Dienstag 14-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Abgehörte Kryptohandys: BGH erlaubt Verwertung - Berliner Landgericht lehnt ab ∗∗∗ --------------------------------------------- Die Justiz ringt seit Jahren um die Verwertung von Daten abgehörter Kryptohandys. Nun gab es in wenigen Wochen gegensätzliche Urteile. --------------------------------------------- https://www.golem.de/news/abgehoerte-kryptohandys-bgh-erlaubt-verwertung-be… ∗∗∗ Analyzing CVE-2024-44243, a macOS System Integrity Protection bypass through kernel extensions ∗∗∗ --------------------------------------------- Microsoft discovered a macOS vulnerability allowing attackers to bypass System Integrity Protection (SIP) by loading third party kernel extensions, which could lead to serious consequences, such as allowing attackers to install rootkits, create persistent malware, bypass Transparency, Consent, and Control (TCC), and expand the attack surface to perform other .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2025/01/13/analyzing-cve-2024… ∗∗∗ The Database Slayer: Deep Dive and Simulation of the Xbash Malware ∗∗∗ --------------------------------------------- In the world of malware, common ransomware schemes aim to take the data within databases (considered the "gold" in the vault of any organization) and hold them hostage, promising data recovery upon ransom payment. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-databas… ∗∗∗ Snyk appears to deploy malicious packages targeting Cursor for unknown reason ∗∗∗ --------------------------------------------- Packages removed, vendor said to have apologized to AI code editor as onlookers say it could have been a test Developer security company Snyk is at the center of allegations concerning the possible targeting or testing of Cursor, an AI code editor company, using "malicious" packages uploaded to NPM. --------------------------------------------- https://www.theregister.com/2025/01/14/snyk_npm_deployment_removed/ ∗∗∗ SAP-Patchday: Updates schließen 14 teils kritische Schwachstellen ∗∗∗ --------------------------------------------- Im Januar bedenkt SAP Produkte mit 14 Sicherheitsmitteilungen und zugehörigen Updates. Zwei davon gelten als kritisch. --------------------------------------------- https://www.heise.de/news/SAP-Patchday-Hersteller-stopft-teils-kritische-SI… ∗∗∗ Telefónica: Infostealer-Kampagne legt interne Jira-Issues offen ∗∗∗ --------------------------------------------- Der Telekommunikationsanbieter Telefónica wurde Opfer eines Cyberangriffs. Kriminelle erbeuteten offenbar Zugriff auf große Mengen interner Daten. --------------------------------------------- https://www.heise.de/news/Telefonica-Infostealer-Kampagne-legt-interne-Jira… ∗∗∗ Achtung Fake: vailllant.at und vaillantproservice.at ∗∗∗ --------------------------------------------- Kriminelle missbrauchen das für Heiztechnik bekannte Unternehmen Vaillant für eine Betrugsmasche. Auf gefälschten Webseiten geben sich die Kriminellen als 24-Stunden-Notdienst für Österreich bzw. Wien/Niederösterreich aus. Ruft man den betrügerischen Notdienst an, kommen unseriöser Handwerker:innen, die den Schaden nicht fachgerecht beheben, sondern eine horrende Summe in Rechnung stellen! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-fake-vailllantat-und-vaillan… ∗∗∗ One Step Ahead in Cyber Hide-and-Seek: Automating Malicious Infrastructure Discovery With Graph Neural Networks ∗∗∗ --------------------------------------------- Graph neural networks aid in analyzing domains linked to known attack indicators, effectively uncovering new malicious domains and cybercrime campaigns. --------------------------------------------- https://unit42.paloaltonetworks.com/graph-neural-networks/ ∗∗∗ Ransomware: Threat Level Remains High in Third Quarter ∗∗∗ --------------------------------------------- Recently established RansomHub group overtakes LockBit to become most prolific ransomware operation. --------------------------------------------- https://www.security.com/threat-intelligence/ransomware-threat-level-remain… ∗∗∗ CISA Releases the JCDC AI Cybersecurity Collaboration Playbook and Fact Sheet ∗∗∗ --------------------------------------------- Today, CISA released the JCDC AI Cybersecurity Collaboration Playbook and Fact Sheet to foster operational collaboration among government, industry, and international partners and strengthen artificial intelligence (AI) cybersecurity. The playbook provides voluntary information-sharing processes that, if adopted, can help protect organizations from emerging .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2025/01/14/cisa-releases-jcdc-ai-cy… ∗∗∗ Major location data broker reports hack to Norwegian authorities ∗∗∗ --------------------------------------------- The location data broker Gravy Analytics confirmed to Norwegian authorities that it was breached by a hacker — potentially exposing a trove of sensitive information. --------------------------------------------- https://therecord.media/location-data-broker-gravy-breach ∗∗∗ NPM command confusion ∗∗∗ --------------------------------------------- Intro Managing dependencies in JavaScript projects can quickly become a complex undertaking. Tasks include keeping track of versions, ensuring compatibility, and handling updates . npm provides a robust solution to these problems, through a centralized system for managing project dependencies. Primarily accessed through its command-line interface (CLI), npm .. --------------------------------------------- https://checkmarx.com/blog/npm-command-confusion/ ∗∗∗ Malicious Kong Ingress Controller Image Found on DockerHub ∗∗∗ --------------------------------------------- A critical security breach in the software supply chain has been detected. An attacker accessed Kong’s DockerHub account --------------------------------------------- https://hackread.com/malicious-kong-ingress-controller-image-dockerhub/ ∗∗∗ Hackers Using Fake YouTube Links to Steal Login Credentials ∗∗∗ --------------------------------------------- Cybercriminals exploit fake YouTube links to redirect users to phishing pages, stealing login credentials via URI .. --------------------------------------------- https://hackread.com/hackers-fake-youtube-links-steal-login-credentials/ ∗∗∗ Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar ∗∗∗ --------------------------------------------- In Hindi, chokidar (चौकीदार) means “gatekeeper” or “watchman”—a perfect descriptor for chokidar one of Node.js most trusted file-watching libraries with around 56 million weekly downloads. Meanwhile, chalk serves as a cornerstone for terminal string styling in JavaScript, drawing over 265 million downloads weekly. Unfortunately, our Socket threat .. --------------------------------------------- https://socket.dev/blog/kill-switch-hidden-in-npm-packages-typo-squatting-c… ===================== = Vulnerabilities = ===================== ∗∗∗ Zyxel security advisory for improper privilege management vulnerability in APs and security router devices ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ January Security Update ∗∗∗ --------------------------------------------- https://www.ivanti.com/blog/january-security-update -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.01.2025
by Daily end-of-shift report 13 Jan '25

13 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-01-2025 18:00 − Montag 13-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware ∗∗∗ --------------------------------------------- In-the-wild attacks tamper with built-in security tool providing infection warnings. --------------------------------------------- https://arstechnica.com/security/2025/01/ivanti-vpn-users-are-getting-hacke… ∗∗∗ Phishing texts trick Apple iMessage users into disabling protection ∗∗∗ --------------------------------------------- Cybercriminals are exploiting a trick to turn off Apple iMessages built-in phishing protection for a text and trick users into re-enabling disabled phishing links. --------------------------------------------- https://www.bleepingcomputer.com/news/security/phishing-texts-trick-apple-i… ∗∗∗ Ransomware abuses Amazon AWS feature to encrypt S3 buckets ∗∗∗ --------------------------------------------- A new ransomware campaign encrypts Amazon S3 buckets using AWSs Server-Side Encryption with Customer Provided Keys (SSE-C) known only to the threat actor, demanding ransoms to receive the decryption key. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-abuses-amazon-aws… ∗∗∗ Anwendung blockiert: MacOS stuft Docker Desktop als Malware ein ∗∗∗ --------------------------------------------- Einige Dateien von Docker Desktop für MacOS wurden falsch signiert, so dass Nutzer eine Malware-Warnung erhalten. Eine echte Gefahr besteht nicht. --------------------------------------------- https://www.golem.de/news/anwendung-blockiert-docker-desktop-unter-macos-al… ∗∗∗ New LLM Jailbreak Uses Models Evaluation Skills Against Them ∗∗∗ --------------------------------------------- SC Media reports on a new jailbreak method for large language models (LLMs) that "takes advantage of models ability to identify and score harmful content in order to trick the models into generating content related to malware, illegal activity, harassment and more. "The Bad Likert Judge multi-step jailbreak technique was developed and tested by .. --------------------------------------------- https://it.slashdot.org/story/25/01/12/2010218/new-llm-jailbreak-uses-model… ∗∗∗ Nominet probes network intrusion linked to Ivanti zero-day exploit ∗∗∗ --------------------------------------------- Unauthorized activity detected, but no backdoors found UK domain registry Nominet is investigating a potential intrusion into its network related to the latest Ivanti zero-day exploits. --------------------------------------------- https://www.theregister.com/2025/01/13/nominet_ivanti_zero_day/ ∗∗∗ Paypal-Phishing: Angebliche monatliche Finanzberichte ködern Opfer ∗∗∗ --------------------------------------------- Derzeit schaffen es Phishing-Mails an Spam-Filtern vorbeizukommen, die einen monatlichen Finanzbericht für Paypal versprechen. --------------------------------------------- https://www.heise.de/news/Paypal-Phishing-Angebliche-monatliche-Finanzberic… ∗∗∗ Log Source Management App für IBM QRadar SIEM ist auf vielen Wegen angreifbar ∗∗∗ --------------------------------------------- Weil mehrere Komponenten verwundbar sind, können Angreifer Systeme mit Log Source Management App für IBM QRadar SIEM attackieren. --------------------------------------------- https://www.heise.de/news/Log-Source-Management-App-fuer-IBM-QRadar-SIEM-is… ∗∗∗ Tackling AI threats. Advanced DFIR methods and tools for deepfake detection ∗∗∗ --------------------------------------------- TL; DR AI-generated documents, videos and more pose significant challenges for DFIR DFIR teams can harness innovative detection strategies and tooling Digital fingerprinting and watermarking, AI-powered and behavioural analyses .. --------------------------------------------- https://www.pentestpartners.com/security-blog/tackling-ai-threats-advanced-… ∗∗∗ Rufnummernmissbrauch dank Verordnung drastisch zurückgegangen ∗∗∗ --------------------------------------------- Die "Anti-Spoofing-Verordnung" der RTR greift seit September, seitdem gibt es nur noch wenige Vorfälle von Betrug mittels gekaperter Rufnummern --------------------------------------------- https://www.derstandard.at/story/3000000252624/rufnummernmissbrauch-dank-ve… ∗∗∗ Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams ∗∗∗ --------------------------------------------- Infoblox cybersecurity researchers investigating the mysterious activities of Muddling Meerkat unexpectedly uncovered widespread use of domain spoofing in malicious spam campaigns. --------------------------------------------- https://hackread.com/muddling-meerkat-domain-spoofing-spam-scams/ ∗∗∗ Fake CrowdStrike Recruiters Distribute Malware Via Phishing Emails ∗∗∗ --------------------------------------------- SUMMARY Cybercriminals are deploying a tricky new phishing campaign impersonating the cybersecurity firm CrowdStrike‘s .. --------------------------------------------- https://hackread.com/fake-crowdstrike-recruiters-malware-phishing-emails/ ∗∗∗ 3 Russians Indicted for Operating Blender.io and Sinbad.io Crypto Mixers ∗∗∗ --------------------------------------------- SUMMARY Three Russian nationals have been indicted for their alleged roles in running cryptocurrency mixing services Blender.io and… --------------------------------------------- https://hackread.com/3-russian-operating-blender-io-sinbad-io-crypto-mixers/ ∗∗∗ Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282) ∗∗∗ --------------------------------------------- As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282.Today, we’re .. --------------------------------------------- https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-c… ∗∗∗ Deep Dive Into a Linux Rootkit Malware ∗∗∗ --------------------------------------------- This is a follow-up analysis to a previous blog about a zero day exploit where the FortiGuard Incident Response (FGIR) team examined how remote attackers exploited multiple vulnerabilities in an appliance to gain control of a customer’s system. --------------------------------------------- https://feeds.fortinet.com/~/910912481/0/fortinet/blogs~Deep-Dive-Into-a-Li… ∗∗∗ Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) ∗∗∗ --------------------------------------------- The Wiz Incident Response team is currently responding to multiple incidents involving CVE-2024-50603, an Aviatrix Controller unauthenticated RCE vulnerability, that can lead to privileges escalation in the AWS control plane. Organizations should patch urgently. --------------------------------------------- https://www.wiz.io/blog/wiz-research-identifies-exploitation-in-the-wild-of… ∗∗∗ Analysis of Counter-Ransomware Activities in 2024 ∗∗∗ --------------------------------------------- The scourge of ransomware continues primarily because ofthree main reasons: Ransomware-as-a-Service (RaaS), cryptocurrency, and safe havens.RaaS platforms enable aspiring cybercriminals to join a gang and begin launching attacks with a support system that help extract ransom payments from their victims.Cryptocurrency enables cybercriminals to receive funds .. --------------------------------------------- https://blog.bushidotoken.net/2025/01/analysis-of-counter-ransomware.html ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (dpdk, firefox, iperf3, thunderbird, and webkit2gtk3), Debian (firefox-esr, gnuchess, node-mocha, openafs, python-django, and thunderbird), Fedora (libxmp, python-jinja2, suricata, thunderbird, and xen), Mageia (avahi, libjxl, opencontainers-runc, radare2, rizin, and tinyproxy), Oracle (cups, dpdk, firefox, iperf3, .. --------------------------------------------- https://lwn.net/Articles/1004962/ ∗∗∗ MISP 2.4.203 and 2.5.5 released including new features, improvements and many security improvements. ∗∗∗ --------------------------------------------- We are thrilled to announce the release of MISP v2.4.203 and MISP v2.5.5, bringing a range of new features, improvements, and fixes to enhance the platforms performance, usability, and security. These updates reflect our ongoing commitment to providing a robust and reliable open-source .. --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.203 ∗∗∗ Security Vulnerabilities fixed in Firefox for iOS 134 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-06/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.01.2025
by Daily end-of-shift report 10 Jan '25

10 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 09-01-2025 18:00 − Freitag 10-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ongoing attacks on Ivanti VPNs install a ton of sneaky, well-written malware ∗∗∗ --------------------------------------------- In-the-wild attacks tamper with built-in security tool to suppress infection warnings. --------------------------------------------- https://arstechnica.com/security/2025/01/ivanti-vpn-users-are-getting-hacke… ∗∗∗ Stealthy Credit Card Skimmer Targets WordPress Checkout Pages via Database Injection ∗∗∗ --------------------------------------------- Recently, we released an article where a credit card skimmer was targeting checkout pages on a Magento site. Now we’ve come across sophisticated credit card skimmer malware while investigating a compromised WordPress .. --------------------------------------------- https://blog.sucuri.net/2025/01/stealthy-credit-card-skimmer-targets-wordpr… ∗∗∗ Sicherheitsupdates: Angreifer können Netzwerkgeräte mit Junos OS crashen lassen ∗∗∗ --------------------------------------------- Netzwerkgeräte wie Switches von Juniper sind verwundbar. Ansatzpunkte sind mehrere Schwachstellen im Betriebssystem Junos OS. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Angreifer-koennen-Netzwerkgera… ∗∗∗ Meet FunkSec: A New, Surprising Ransomware Group, Powered by AI ∗∗∗ --------------------------------------------- Executive Summary: The FunkSec ransomware group emerged in late 2024 and published over 85 victims in December, surpassing every other ransomware group that month FunkSec operators appear to use AI-assisted malware development, which can enable even inexperienced actors to quickly produce and refine advanced tools The group’s activities straddle the line .. --------------------------------------------- https://blog.checkpoint.com/research/meet-funksec-a-new-surprising-ransomwa… ∗∗∗ Do we still have to keep doing it like this? ∗∗∗ --------------------------------------------- Hazel gets inspired by watching Wendy Nather’s recent keynote, and explores ways to challenge security assumptions. --------------------------------------------- https://blog.talosintelligence.com/do-we-still-have-to-keep-doing-it-like-t… ∗∗∗ How Cracks and Installers Bring Malware to Your Device ∗∗∗ --------------------------------------------- Our research shows how attackers use platforms like YouTube to spread fake installers via trusted hosting services, employing encryption to evade detection and steal sensitive browser data. --------------------------------------------- https://www.trendmicro.com/en_us/research/25/a/how-cracks-and-installers-br… ∗∗∗ Banshee Stealer Hits macOS Users via Fake GitHub Repositories ∗∗∗ --------------------------------------------- Cybersecurity researchers at Check Point detected a new version of Banshee Stealer in late September 2024, distributed .. --------------------------------------------- https://hackread.com/banshee-stealer-hits-macos-fake-github-repositories/ ∗∗∗ Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282) ∗∗∗ --------------------------------------------- Did you have a good break? Have you had a chance to breathe? Wake up. It’s 2025, and the chaos continues. Haha, see what we did? We wrote the exact same thing in 2024 because 2024 was exactly .. --------------------------------------------- https://labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-i… ∗∗∗ How to secure your GitHub Actions workflows with CodeQL ∗∗∗ --------------------------------------------- In the last few months, we secured 75+ GitHub Actions workflows in open source projects, disclosing 90+ different vulnerabilities. Out of this research we produced new support for workflows in CodeQL, empowering .. --------------------------------------------- https://github.blog/security/application-security/how-to-secure-your-github… ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-25-010: Redis Stack Lua Use-After-Free Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis Stack. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2024-46981. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-010/ ∗∗∗ ZDI-25-009: Redis Stack RedisBloom Integer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on affected installations of Redis Stack. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-55656. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-009/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.01.2025
by Daily end-of-shift report 09 Jan '25

09 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 08-01-2025 18:00 − Donnerstag 09-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Here’s how hucksters are manipulating Google to promote shady Chrome extensions ∗∗∗ --------------------------------------------- How do you stash 18,000 keywords into a description? Turns out its easy. --------------------------------------------- https://arstechnica.com/security/2025/01/googles-chrome-web-store-has-a-ser… ∗∗∗ Unpatched critical flaws impact Fancy Product Designer WordPress plugin ∗∗∗ --------------------------------------------- Premium WordPress plugin Fancy Product Designer from Radykal is vulnerable to two critical severity flaws that remain unfixed in the current latest version. --------------------------------------------- https://www.bleepingcomputer.com/news/security/unpatched-critical-flaws-imp… ∗∗∗ Beyond Meh-trics: Examining How CTI Programs Demonstrate Value Using Metrics ∗∗∗ --------------------------------------------- A blog about developing cyber threat intelligence (CTI) metrics. --------------------------------------------- https://www.sans.org/blog/beyond-meh-trics-examining-how-cti-programs-demon… ∗∗∗ The State of Magecart: A Persistent Threat to E-Commerce Security ∗∗∗ --------------------------------------------- Trustwave SpiderLabs first blogged about Magecart back in 2019; fast forward five years and it is still here going strong. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/the-state-o… ∗∗∗ Mitel 0-day, 5-year-old Oracle RCE bug under active exploit ∗∗∗ --------------------------------------------- 3 CVEs added to CISAs catalog Cybercriminals are actively exploiting two vulnerabilities in Mitel MiCollab, including a zero-day flaw – and a critical remote code execution vulnerability in Oracle WebLogic Server that has been abused for at least five years. --------------------------------------------- https://www.theregister.com/2025/01/08/mitel_0_day_oracle_rce_under_exploit/ ∗∗∗ Japanese police claim China ran five-year cyberattack campaign targeting local orgs ∗∗∗ --------------------------------------------- ‘MirrorFace’ group found ways to run malware in the Windows sandbox, which is worrying Japan’s National Police Agency and Center of Incident Readiness and Strategy for Cybersecurity have confirmed third party reports of attacks on local orgs by publishing details of a years-long series of attacks attributed to a China-backed source. --------------------------------------------- https://www.theregister.com/2025/01/09/japan_mirrorface_china_attack/ ∗∗∗ Angestellte klickten dreimal so oft auf Phishing-Links ‒ häufig in Suchmaschinen ∗∗∗ --------------------------------------------- Mitarbeiter klicken trotz Schulungen auf Phishing-Links. Laut einer Studie sind sie bei E-Mails sich der Angriffe eher bewusst, bei der Suche im Netz weniger. --------------------------------------------- https://www.heise.de/news/E-Mails-sind-out-Phishing-verstaerkt-ueber-Suchma… ∗∗∗ New Research: Enhancing Botnet Detection with AI using LLMs and Similarity Search ∗∗∗ --------------------------------------------- As botnets continue to evolve, so do the techniques required to detect them. --------------------------------------------- https://www.rapid7.com/blog/post/2025/01/08/new-research-enhancing-botnet-d… ∗∗∗ Banshee: The Stealer That “Stole Code” From MacOS XProtect ∗∗∗ --------------------------------------------- As of 2024, approximately 100.4 million people worldwide use macOS, accounting for 15.1% of the global PC market. Of the millions of macOS users, many falsely assume that their systems are inherently secure from malware. This perception stems from macOS’s Unix-based architecture and historically lower market share, .. --------------------------------------------- https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-… ∗∗∗ Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation ∗∗∗ --------------------------------------------- On Wednesday, Jan. 8, 2025, Ivanti disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, impacting Ivanti Connect Secure (“ICS”) VPN appliances. Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024. CVE-2025-0282 is an unauthenticated stack-based buffer overflow. Successful exploitation could result in unauthenticated remote code execution, leading to potential downstream compromise of a victim network. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-sec… ∗∗∗ Angeblich Datenleck bei Datensammler Gravy Analytics ∗∗∗ --------------------------------------------- Im Darknet behaupten Kriminelle, Daten vom Positionsdatensammler Gravy Analytics erbeutet zu haben. Sorge um die Privatsphäre macht sich breit. --------------------------------------------- https://heise.de/-10233802 ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-25-008: Trend Micro Deep Security Agent Incorrect Permissions Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-008/ ∗∗∗ ZDI-25-007: Trend Micro Apex One widget getWidgetPoolManager Local File Inclusion Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-007/ ∗∗∗ ZDI-25-006: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-006/ ∗∗∗ ZDI-25-005: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-005/ ∗∗∗ ZDI-25-004: Trend Micro Apex One Origin Validation Error Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-004/ ∗∗∗ ZDI-25-003: Trend Micro Apex One Security Agent Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-003/ ∗∗∗ ZDI-25-002: Trend Micro Apex One LogServer Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-002/ ∗∗∗ ZDI-25-001: Trend Micro Apex One Damage Cleanup Engine Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-25-001/ ∗∗∗ 2025-01 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 24.1R2 release ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2025-01-Security-Bulletin-Junos… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.01.2025
by Daily end-of-shift report 08 Jan '25

08 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Dienstag 07-01-2025 18:00 − Mittwoch 08-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ How initial access brokers (IABs) sell your users’ credentials ∗∗∗ --------------------------------------------- Initial Access Brokers (IABs) are specialized cybercriminals that break into corporate networks and sell stolen access to other attackers. Learn from Specops Software about how IABs operate and how businesses can protect themselves. --------------------------------------------- https://www.bleepingcomputer.com/news/security/how-initial-access-brokers-i… ∗∗∗ Wegen Sicherheitslücken: Ärzteschaft empfiehlt Widerspruch zu ePA für alle ∗∗∗ --------------------------------------------- Kurz vor dem Start der ePA für alle ist die Verunsicherung groß. Die Ärzte sehen noch "große Einfallstore" für Hacker. --------------------------------------------- https://www.golem.de/news/wegen-sicherheitsluecken-aerzteschaft-empfiehlt-w… ∗∗∗ FCC Launches Cyber Trust Mark for IoT Devices to Certify Security Compliance ∗∗∗ --------------------------------------------- The U.S. government on Tuesday announced the launch of the U.S. Cyber Trust Mark, a new cybersecurity safety label for Internet-of-Things (IoT) consumer devices."IoT products can be susceptible to a range of security vulnerabilities," the U.S. Federal .. --------------------------------------------- https://thehackernews.com/2025/01/fcc-launches-cyber-trust-mark-for-iot.html ∗∗∗ Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks ∗∗∗ --------------------------------------------- A Mirai botnet variant has been found exploiting a newly disclosed security flaw impacting Four-Faith industrial routers since early November 2024 with the goal of conducting distributed denial-of-service (DDoS) attacks.The botnet maintains .. --------------------------------------------- https://thehackernews.com/2025/01/mirai-botnet-variant-exploits-four.html ∗∗∗ Researchers Expose NonEuclid RAT Using UAC Bypass and AMSI Evasion Techniques ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on a new remote access trojan called NonEuclid that allows bad actors to remotely control compromised Windows systems."The NonEuclid remote access trojan (RAT), developed in C#, is a highly sophisticated .. --------------------------------------------- https://thehackernews.com/2025/01/researchers-expose-noneuclid-rat-using.ht… ∗∗∗ US-Sicherheitsbehörde warnt vor Attacken auf MiCollab und WebLogic Server ∗∗∗ --------------------------------------------- Admins sollten ihre Systeme mit Mitel- und Oracle-Software gegen derzeit laufende Angriffe rüsten. --------------------------------------------- https://www.heise.de/news/US-Sicherheitsbehoerde-warnt-vor-Attacken-auf-MiC… ∗∗∗ Forscher: KI sorgt für effektiveres Phishing ∗∗∗ --------------------------------------------- Wie wirksam ist per LLM automatisch erzeugtes Phishing? Es ist gleichauf mit menschlich erzeugtem Spear-Phishing, sagen Forscher. --------------------------------------------- https://www.heise.de/news/Forscher-KI-sorgt-fuer-effektiveres-Phishing-1023… ∗∗∗ A Day in the Life of a Prolific Voice Phishing Crew ∗∗∗ --------------------------------------------- Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety of outbound .. --------------------------------------------- https://krebsonsecurity.com/2025/01/a-day-in-the-life-of-a-prolific-voice-p… ∗∗∗ Vorsicht vor versteckten Kosten auf finelo.com und coursiv.io ∗∗∗ --------------------------------------------- Die Aussicht auf finanziellen Aufstieg lockt viele Menschen auf Plattformen wie finelo.com und coursive.io, die von der IT-Firma zimran.io betrieben werden. Beide Plattformen werben mit großen Versprechungen: Während finelo.com den Nutzer:innen beibringen möchte, clever zu investieren, zielt coursiv.io darauf ab, berufliche Fähigkeiten mithilfe künstlicher .. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-versteckten-kosten-auf-… ∗∗∗ Drupal 7 End of Life - PSA-2025-01-06 ∗∗∗ --------------------------------------------- Drupal core version 7 has reached end of life, and is no longer community supported on Drupal.org. This means that new releases of Drupal 7 core and contributed projects will no longer happen on Drupal.org and community support is no longer provided. What this means for you:Any vulnerabilities that impact Drupal 7 may be released and .. --------------------------------------------- https://www.drupal.org/psa-2025-01-06 ∗∗∗ Russian internet provider confirms its network was ‘destroyed’ following attack claimed by Ukrainian hackers ∗∗∗ --------------------------------------------- In a statement on the Russian social media platform VKontakte, the St. Petersburg-based company said the “planned” attack “destroyed” its infrastructure overnight. Nodex added that it was working to restore systems from backups but could not provide a timeline for when operations would fully resume. --------------------------------------------- https://therecord.media/russian-internet-provider-says-network-destroyed-cy… ∗∗∗ Scammers Impersonate Authorities to Swipe OTPs with Remote Access Apps ∗∗∗ --------------------------------------------- SUMMARY Cybersecurity researchers at Group-IB have discovered a sophisticated refund scam where scammers are using remote access tools. --------------------------------------------- https://hackread.com/scammers-impersonate-swipe-otps-remote-access-apps/ ∗∗∗ Backdooring Your Backdoors - Another $20 Domain, More Governments ∗∗∗ --------------------------------------------- After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves .. --------------------------------------------- https://labs.watchtowr.com/more-governments-backdoors-in-your-backdoors/ ∗∗∗ Solving NIST Password Complexities: Guidance From a GRC Perspective ∗∗∗ --------------------------------------------- Not another password change! Isn’t one (1) extra-long password enough? As a former Incident Response, Identity and Access Control, and Education and Awareness guru, I can attest .. --------------------------------------------- https://trustedsec.com/blog/solving-nist-password-complexities-guidance-fro… ∗∗∗ How We Cracked a 512-Bit DKIM Key for Less Than $8 in the Cloud ∗∗∗ --------------------------------------------- In our study on the SPF, DKIM, and DMARC records of the top 1M websites, we were surprised to uncover more than 1,700 public DKIM keys that were shorter than 1,024 bits in length. This finding was unexpected, as RSA keys shorter than 1,024 bits are considered insecure, and their use in DKIM has been deprecated since the introduction of RFC 8301 in 2018. --------------------------------------------- https://dmarcchecker.app/articles/crack-512-bit-dkim-rsa-key ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Common Services Platform Collector Cross-Site Scripting Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.These vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface .. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Crosswork Network Controller Stored Cross-Site Scripting Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied .. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (firefox, mupdf, and php-tcpdf), SUSE (etcd, file-roller, gtk3, kernel, python-django-ckeditor, rubygem-json-jwt, and tomcat10), and Ubuntu (ffmpeg, HTMLDOC, linux-aws, linux-raspi, linux-gke, linux-hwe-6.8, linux-lowlatency, linux-lowlatency-hwe-6.8, and tinyproxy). --------------------------------------------- https://lwn.net/Articles/1004428/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.01.2025
by Daily end-of-shift report 07 Jan '25

07 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Freitag 03-01-2025 18:00 − Dienstag 07-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows 10 users urged to upgrade to avoid "security fiasco" ∗∗∗ --------------------------------------------- Cybersecurity firm ESET is urging Windows 10 users to upgrade to Windows 11 or Linux to avoid a "security fiasco" as the 10-year-old operating system nears the end of support in October 2025. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/windows-10-users-urged-to-u… ∗∗∗ Cryptocurrency wallet drainers stole $494 million in 2024 ∗∗∗ --------------------------------------------- Scammers stole $494 million worth of cryptocurrency in wallet drainer attacks last year that targeted more than 300,000 wallet addresses. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-draine… ∗∗∗ Chinese hackers also breached Charter and Windstream networks ∗∗∗ --------------------------------------------- More U.S. companies have been added to the list of telecommunications firms hacked in a wave of breaches by a Chinese state-backed threat group tracked as Salt Typhoon. --------------------------------------------- https://www.bleepingcomputer.com/news/security/charter-and-windstream-among… ∗∗∗ Trotz starker Kritik: Umstrittene UN-Cybercrime-Konvention verabschiedet ∗∗∗ --------------------------------------------- Netzaktivisten haben vergeblich vor der Verabschiedung der Konvention gewarnt. Es droht der Zugriff auf digitale Beweismittel durch autoritäre Staaten. --------------------------------------------- https://www.golem.de/news/trotz-starker-kritik-umstrittene-un-cybercrime-ko… ∗∗∗ After Chinas Salt Typhoon, the reconstruction starts now ∗∗∗ --------------------------------------------- If 40 years of faulty building gets blown down, don’t rebuild with the rubble Opinion When a typhoon devastates a land, it takes a while to understand the scale of the destruction. Disaster relief kicks in, communications rebuilt, and news flows out. Salt Typhoon is .. --------------------------------------------- https://www.theregister.com/2025/01/06/opinion_column_cybersec/ ∗∗∗ MediaTek rings in the new year with a parade of chipset vulns ∗∗∗ --------------------------------------------- Manufacturers should have had ample time to apply the fixes MediaTek kicked off the first full working week of the new year by disclosing a bevy of security vulnerabilities, including a critical remote code execution bug affecting 51 chipsets. --------------------------------------------- https://www.theregister.com/2025/01/06/mediatek_chipset_vulnerabilities/ ∗∗∗ Patchday: Wichtige Sicherheitsupdates schützen Android-Geräte ∗∗∗ --------------------------------------------- Google und weitere Hersteller von Android-Geräte haben mehrere kritische Lücken in verschiedenen Android-Versionen geschlossen. --------------------------------------------- https://www.heise.de/news/Patchday-Schadcode-Luecken-bedrohen-Android-12-13… ∗∗∗ Schwerwiegende Sicherheitslücken in Sonicwall SSL-VPN - aktiv ausgenutzt ∗∗∗ --------------------------------------------- Der Hersteller Sonicwall hat seine Kunden darüber informiert, dass einige Geräte von Sicherheitslücken betroffen sind. Besonders hervorzuheben ist dabei eine bereits angegriffenen Lücke bei denen Angreifer:innen die Authentifizierung .. --------------------------------------------- https://www.cert.at/de/warnungen/2025/1/schwewiegende-sicherheitslucken-in-… ∗∗∗ UN aviation agency actively investigating cybercriminal’s claimed data breach ∗∗∗ --------------------------------------------- The International Civil Aviation Organization (ICAO) said it was responding to claims of a data breach “allegedly linked to a threat actor known for targeting international organizations.” --------------------------------------------- https://therecord.media/united-nations-icao-investigating-data-breach ∗∗∗ Critical Next.js Authorization Bypass Vulnerability ∗∗∗ --------------------------------------------- This specifically affects pages directly under the application’s root directory. Example:[Not affected] hxxps[://]example[.]com[Affected] hxxps[://]example[.]com/foo[Not affected] hxxps[://]example[.]com/foo/bar Successful exploitation of this vulnerability, allows a remote unauthenticated .. --------------------------------------------- https://www.truesec.com/hub/blog/critical-next-js-authorization-bypass-vuln… ∗∗∗ Achtung: Angeblich geleakter GTA San Andreas Source-Code mit Schadsoftware ∗∗∗ --------------------------------------------- Aktuell wird angeblich der Quellcode des Rockstar Games Spiels GTA San Andreas im Internet zum Download angeboten. Erste Hinweise scheinen seit gestern im Internet aufgetaucht zu sein (siehe z.B. den Artikel Rockstar reportedly faces another .. --------------------------------------------- https://www.borncity.com/blog/2025/01/06/achtung-angeblich-geleakter-gta-sa… ∗∗∗ New PhishWP Plugin on Russian Forum Turns Sites into Phishing Pages ∗∗∗ --------------------------------------------- SlashNext has discovered a malicious WordPress plugin, PhishWP, which creates convincing fake payment pages to steal your credit card information, 3DS codes, and personal data. --------------------------------------------- https://hackread.com/phishwp-plugin-russian-hacker-forum-phishing-sites/ ∗∗∗ U.S. Sanctions Chinese Cybersecurity Firm Over Cyberattacks ∗∗∗ --------------------------------------------- US sanctions Beijing-based Integrity Technology Group for aiding “Flax Typhoon” hackers in cyberattacks on American infrastructure, freezing assets… --------------------------------------------- https://hackread.com/us-sanctions-chinese-cybersecurity-firm-cyberattacks/ ∗∗∗ CVE-2024-4577: Windows Encoding Gone Wrong ∗∗∗ --------------------------------------------- CVE-2024-4577 is a critical vulnerability in Windows-based PHP installations, affecting CGI configurations, that allow remote code execution. --------------------------------------------- https://www.bitsight.com/blog/cve-2024-4577-windows-encoding-gone-wrong ∗∗∗ Weaponizing OAST: How Malicious Packages Exploit npm, PyPI, and RubyGems for Data Exfiltration and Recon ∗∗∗ --------------------------------------------- Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data and remotely probe developer environments.Over the last year, Socket’s threat research team has continually observed and identified malicious JavaScript, Python, and Ruby packages .. --------------------------------------------- https://socket.dev/blog/weaponizing-oast-how-malicious-packages-exploit-npm… ===================== = Vulnerabilities = ===================== ∗∗∗ [20250103] - Core - Read ACL violation in multiple core views ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Low Severity: Moderate Probability: Low Versions: 3.9.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2 Exploit type: ACL Violation Reported Date: 2024-08-26 Fixed Date: 2025-01-07 CVE Number: CVE-2024-40749 Description Improper Access Controls allows access to protected views. Affected Installs Joomla! CMS versions 3.9.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2 Solution Upgrade to version 3.10.20-elts, 4.4.10 or 5.2.3 Contact The JSST at the Joomla! Security --------------------------------------------- https://developer.joomla.org:443/security-centre/956-20250103-core-read-acl… ∗∗∗ [20250102] - Core - XSS vector in the id attribute of menu lists ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Low Severity: Moderate Probability: Low Versions: 3.0.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2 Exploit type: XSS Reported Date: 2024-09-19 Fixed Date: 2025-01-07 CVE Number: CVE-2024-40748 Description Lack of output escaping in the id attribute of menu lists. Affected Installs Joomla! CMS versions 3.0.0-3.10.19-elts, 4.0.0-4.4.9, 5.0.0-5.2.2 Solution Upgrade to version 3.10.20-elts, 4.4.10 or 5.2.3 Contact The JSST at the Joomla! Security Centre. --------------------------------------------- https://developer.joomla.org:443/security-centre/955-20250102-core-xss-vect… ∗∗∗ [20250101] - Core - XSS vectors in module chromes ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Impact: Low Severity: Moderate Probability: Low Versions: 4.0.0-4.4.9, 5.0.0-5.2.2 Exploit type: XSS Reported Date: 2024-08-29 Fixed Date: 2025-01-07 CVE Number: CVE-2024-40747 Description Various module chromes didnt properly process inputs, leading to XSS vectors. Affected Installs Joomla! CMS versions 4.0.0-4.4.9, 5.0.0-5.2.2 Solution Upgrade to version 4.4.10 or 5.2.3 Contact The JSST at the Joomla! Security Centre. Reported By: Catalin Iovita --------------------------------------------- https://developer.joomla.org:443/security-centre/954-20250101-core-xss-vect… ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.19 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-03/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 128.6 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-02/ ∗∗∗ Security Vulnerabilities fixed in Firefox 134 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2025-01/ ∗∗∗ Upcoming CVE for End-of-Life Node.js Versions ∗∗∗ --------------------------------------------- https://nodejs.org/en/blog/vulnerability/upcoming-cve-for-eol-versions -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.01.2025
by Daily end-of-shift report 03 Jan '25

03 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 02-01-2025 18:00 − Freitag 03-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ SwaetRAT Delivery Through Python ∗∗∗ --------------------------------------------- We entered a new year, but attack scenarios have not changed (yet). I found a Python script with an interesting behavior[1] and a low Virustotal score (7/61). It targets Microsoft Windows hosts because it starts by loading all .. --------------------------------------------- https://isc.sans.edu/forums/diary/SwaetRAT+Delivery+Through+Python/31554/ ∗∗∗ 3,1 Millionen bösartige Fake-Sterne auf GitHub entdeckt – Tendenz steigend ∗∗∗ --------------------------------------------- In einer umfassenden Studie ist ein US-Forschungsteam auf Millionen Fake-Sterne bei GitHub gestoßen und warnt vor einem rasant steigenden Trend. --------------------------------------------- https://www.heise.de/news/3-1-Millionen-boesartige-Fake-Sterne-auf-GitHub-e… ∗∗∗ Configurations Mega Blog: Why Configurations Are the Wrong Thing to Get Wrong ∗∗∗ --------------------------------------------- So many times, we look beyond the mark. With our feeds constantly inundated with headline-grabbing news about AI-generated threats, nation states upping their cybercrime game, and sophisticated new forms of malware, we can be tempted to think that the bulk of cyberwarfare is going on "up there" somewhere. In reality, most breaches still originate .. --------------------------------------------- https://www.tripwire.com/state-of-security/configurations-mega-blog-why-con… ∗∗∗ 10 Non-tech things you wish you had done after being breached ∗∗∗ --------------------------------------------- TL;DR Non-tech aspects to breach follow-up are often overlooked but essential NDAs, supply chain, and third party contracts and obligations should be reviewed Reviewing communication protocols and employee .. --------------------------------------------- https://www.pentestpartners.com/security-blog/10-non-tech-things-you-wish-y… ∗∗∗ Von Social Media bis App: So sind Sie Kriminellen einen Schritt voraus ∗∗∗ --------------------------------------------- Internetbetrug wird immer raffinierter und kann jeden Menschen treffen. Deshalb ist es wichtig, auf dem Laufenden zu bleiben und die aktuellen Betrugsmaschen zu kennen. Vom klassischen Newsletter über .. --------------------------------------------- https://www.watchlist-internet.at/news/unsere-kanaele/ ∗∗∗ NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT ∗∗∗ --------------------------------------------- Researchers discovered a malicious package on the npm package registry that resembles a library for Ethereum smart contract vulnerabilities but actually drops an open-source remote access trojan called Quasar .. --------------------------------------------- https://hackread.com/npm-package-disguised-ethereum-tool-quasar-rat/ ∗∗∗ Schädliche Versionen von zahlreichen Chrome-Erweiterungen in Umlauf ∗∗∗ --------------------------------------------- Über die Weihnachtstage verschafften sich die Täter Zugriff auf diverse Chrome-Extensions – in einigen Fällen sogar schon deutlich früher. --------------------------------------------- https://heise.de/-10224745 ∗∗∗ Breaking the Chain: Wiz Uncovers a Signature Verification Bypass in Nuclei, the Popular Vulnerability Scanner (CVE-2024-43405) ∗∗∗ --------------------------------------------- Wiz’s engineering team discovered a high-severity signature verification bypass in Nuclei, one of the most popular open-source security tools, which could potentially lead to arbitrary code execution. --------------------------------------------- https://www.wiz.io/blog/nuclei-signature-verification-bypass ∗∗∗ Malicious npm Campaign Targets Ethereum Developers with Fake Hardhat Packages ∗∗∗ --------------------------------------------- Hardhat, maintained by the Nomic Foundation, is a vital tool for Ethereum developers. As a versatile development environment for Ethereum, it streamlines the creation, testing, and deployment of smart contracts and dApps. Its flexible plugin architecture allows developers to customize workflows with tools and extensions, optimizing productivity and supporting .. --------------------------------------------- https://socket.dev/blog/malicious-npm-campaign-targets-ethereum-developers ===================== = Vulnerabilities = ===================== ∗∗∗ iTerm2 3.5.11 released with a critical security fix ∗∗∗ --------------------------------------------- https://iterm2.com/downloads/stable/iTerm2-3_5_11.changelog -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.01.2025
by Daily end-of-shift report 02 Jan '25

02 Jan '25

===================== = End-of-Day report = ===================== Timeframe: Montag 30-12-2024 18:00 − Donnerstag 02-01-2025 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cyberangriff: Hacker wollen Daten von IT-Dienstleister Atos erbeutet haben ∗∗∗ --------------------------------------------- Die Angreifer behaupten, im Besitz einer Firmendatenbank von Atos zu sein. Der IT-Dienstleister findet bisher keine Beweise für einen Angriff. --------------------------------------------- https://www.golem.de/news/cyberangriff-hacker-wollen-daten-von-it-dienstlei… ∗∗∗ Supportende naht: Forscher warnt vor Security-Fiasko durch Windows 10 ∗∗∗ --------------------------------------------- Rund zwei Drittel aller Windows-PCs in Deutschland arbeiten noch mit Windows 10. Es besteht dringender Handlungsbedarf - nicht erst im Oktober dieses Jahres. --------------------------------------------- https://www.golem.de/news/supportende-naht-forscher-warnt-vor-security-fias… ∗∗∗ Chinas cyber intrusions took a sinister turn in 2024 ∗∗∗ --------------------------------------------- >From targeted espionage to pre-positioning - not that they are mutually exclusive The Chinese governments intrusions into Americas telecommunications and other critical infrastructure networks this year appears to signal a shift from cyberspying as usual to prepping for destructive attacks. --------------------------------------------- https://www.theregister.com/2024/12/31/china_cyber_intrusions_2024/ ∗∗∗ US Treasury Department outs the blast radius of BeyondTrusts key leak ∗∗∗ --------------------------------------------- Data pilfered as miscreants roamed affected workstations The US Department of the Treasury has admitted that miscreants were in its systems, accessing documents in what has been called a "major incident." --------------------------------------------- https://www.theregister.com/2024/12/31/us_treasury_department_hacked/ ∗∗∗ "Die perfekte Phishing-Mail": Mit KI-Textgeneratoren gegen Führungskräfte ∗∗∗ --------------------------------------------- KI-Technik ermöglicht es Kriminellen, hochpersonalisierte Phishing-Mails an Führungskräfte zu schicken, warnt ein Versicherer. Trainingsmaterial gibt es online. --------------------------------------------- https://www.heise.de/news/Die-perfekte-Phishing-Mail-Mit-KI-Textgeneratoren… ∗∗∗ U.S. Army Soldier Arrested in AT&T, Verizon Extortions ∗∗∗ --------------------------------------------- Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and .. --------------------------------------------- https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizo… ∗∗∗ Vorsicht vor betrügerischen E-Mails zur Rückerstattung von ORF-Gebühren ∗∗∗ --------------------------------------------- Derzeit finden zahlreiche Personen ein E-Mail in ihrem Postfach, in dem behauptet wird, dass sie Anspruch auf eine Rückerstattung von ORF-Gebühren in Höhe von 34,40 Euro haben. Achtung: Es handelt sich dabei um einen Phishing-Versuch, der darauf abzielt, Kontodaten zu stehlen. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerisches-orf-rueckerstattung-… ∗∗∗ Bad Likert Judge: A Novel Multi-Turn Technique to Jailbreak LLMs by Misusing Their Evaluation Capability ∗∗∗ --------------------------------------------- The jailbreak technique "Bad Likert Judge" manipulates LLMs to generate harmful content using Likert scales, exposing safety gaps in LLM guardrails. --------------------------------------------- https://unit42.paloaltonetworks.com/multi-turn-technique-jailbreaks-llms/ ∗∗∗ DORA Regulation (Digital Operational Resilience Act): A Threat Intelligence Perspective ∗∗∗ --------------------------------------------- The Digital Operational Resilience Act (DORA) is coming in 2025. --------------------------------------------- https://www.team-cymru.com/post/dora-regulation-digital-operational-resilie… ∗∗∗ Passkey technology is elegant, but it’s most definitely not usable security ∗∗∗ --------------------------------------------- It's that time again, when families and friends gather and implore the more technically inclined among them to troubleshoot problems they're having behind the device screens all around them. One of the most vexing .. --------------------------------------------- https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-… ∗∗∗ I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny ∗∗∗ --------------------------------------------- API flaws in the McDonald’s McDelivery system in India, one of the world’s most popular food delivery apps, enabled a variety of fun exploits .. --------------------------------------------- https://eaton-works.com/2024/12/19/mcdelivery-india-hack/ ∗∗∗ Déjà vu: Ghostly CVEs in my terminal title ∗∗∗ --------------------------------------------- As I've spoken and written about all modern terminals are actually "emulating" something dating from the .. --------------------------------------------- https://dgl.cx/2024/12/ghostty-terminal-title ===================== = Vulnerabilities = ===================== ∗∗∗ ZDI-24-1737: Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-1737/ ∗∗∗ ZDI-24-1736: (0Day) Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-1736/ ∗∗∗ ZDI-24-1739: Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-1739/ ∗∗∗ ZDI-24-1738: Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-1738/ ∗∗∗ PAN-OS Firewall Denial of Service (DoS) Vulnerability ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/threat-signal-report/5610 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.12.2024
by Daily end-of-shift report 30 Dec '24

30 Dec '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-12-2024 18:00 − Montag 30-12-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Customer data from 800,000 electric cars and owners exposed online ∗∗∗ --------------------------------------------- Volkswagens automotive software company, Cariad, exposed data collected from around 800,000 electric cars. The info could be linked to drivers names and reveal precise vehicle locations. --------------------------------------------- https://www.bleepingcomputer.com/news/security/customer-data-from-800-000-e… ∗∗∗ Malware botnets exploit outdated D-Link routers in recent attacks ∗∗∗ --------------------------------------------- Two botnets tracked as Ficora and Capsaicin have recorded increased activity in targeting D-Link routers that have reached end of life or are running outdated firmware versions. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malware-botnets-exploit-outd… ∗∗∗ Hackerangriff auf Flughäfen von Mailand ∗∗∗ --------------------------------------------- Eine prorussische Hackergruppe bekannte sich zu dem Cyberangriff. Der Flugbetrieb war nicht gefährdet. --------------------------------------------- https://futurezone.at/digital-life/hackerangriff-auf-flughaefen-von-mailand… ∗∗∗ Bundestagswahlen: Wahlsoftware immer noch unsicher ∗∗∗ --------------------------------------------- Seit Jahren fordert der CCC eine transparente Wahlsoftware. Wie sinnvoll das wäre, zeigt die Analyse eines weit verbreiteten Tools. Ein Bericht von Friedhelm Greis. --------------------------------------------- https://www.golem.de/news/bundestagswahlen-wahlsoftware-immer-noch-unsicher… ∗∗∗ Rundsteuerempfänger gehackt: Lässt sich über Funksignale ein Blackout herbeiführen? ∗∗∗ --------------------------------------------- Zwei Sicherheitsforscher haben die Protokolle für funkbasierte Rundsteuerempfänger entschlüsselt. Doch es ist strittig, in welchem Umfang sich manipulierte Signale missbrauchen lassen. Ein Bericht von Friedhelm Greis. --------------------------------------------- https://www.golem.de/news/rundsteuerempfaenger-gehackt-laesst-sich-ueber-fu… ∗∗∗ Prioritizing patching: A deep dive into frameworks and tools – Part 2: Alternative frameworks ∗∗∗ --------------------------------------------- In the second of a two-part series on tools and frameworks designed to help with remediation prioritization, we explore some alternatives to CVSS --------------------------------------------- https://news.sophos.com/en-us/2024/12/30/prioritizing-patching-a-deep-dive-… ∗∗∗ 16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft ∗∗∗ --------------------------------------------- A new attack campaign has targeted known Chrome browser extensions, leading to at least 16 extensions being compromised and exposing over 600,000 users to data exposure and credential theft.The attack targeted publishers of browser extensions on the Chrome Web Store via a phishing campaign and used their access permissions to insert malicious code into legitimate extensions in order to steal --------------------------------------------- https://thehackernews.com/2024/12/16-chrome-extensions-hacked-exposing.html ∗∗∗ Its only a matter of time before LLMs jump start supply-chain attacks ∗∗∗ --------------------------------------------- The greatest concern is with spear phishing and social engineering Interview Now that criminals have realized theres no need to train their own LLMs for any nefarious purposes - its much cheaper and easier to steal credentials and then jailbreak existing ones - the threat of a large-scale supply chain attack using generative AI becomes more real. --------------------------------------------- https://www.theregister.com/2024/12/29/llm_supply_chain_attacks/ ∗∗∗ 38C3: Große Sicherheitsmängel in elektronischer Patientenakte 3.0 aufgedeckt ∗∗∗ --------------------------------------------- Gravierende Sicherheitslücken müssten bis zum Start der ePA 3.0 noch geschlossen werden. Das demonstrieren Martin Tschirsich und Bianca Kastl auf dem 38C3. --------------------------------------------- https://www.heise.de/news/38C3-Weitere-Sicherheitsmaengel-in-elektronischer… ∗∗∗ 38C3: BogusBazaar-Bande betreibt noch immer Tausende Fakeshops ∗∗∗ --------------------------------------------- Monate nach der Entdeckung operiert eine chinesische Cyberbande weiterhin unbehelligt, berichten Sicherheitsforscher. Schützenhilfe leisten auch US-Anbieter. --------------------------------------------- https://www.heise.de/news/38C3-BogusBazaar-Bande-betreibt-noch-immer-Tausen… ∗∗∗ 38C3: BitLocker-Verschlüsselung von Windows 11 umgangen, ohne PC zu öffnen. ∗∗∗ --------------------------------------------- Zwei Jahre nach der vermeintlichen Behebung einer Lücke kann diese weiterhin genutzt werden, um BitLocker-geschützte Festplatten von Windows 11 zu entschlüsseln --------------------------------------------- https://www.heise.de/news/38C3-BitLocker-Verschluesselung-von-Windows-11-um… ∗∗∗ On the sixth day of Christmas, an X account gave to me: a fake 7-Zip ACE ∗∗∗ --------------------------------------------- An account with the name @NSA_Employee39 claimed to have dropped a zero-day vulnerability for the popular file archive software 7-Zip. Nobody could get it to work. --------------------------------------------- https://therecord.media/fake-zero-day-7Zip ∗∗∗ Lets Encrypt to end OCSP support in 2025 ∗∗∗ --------------------------------------------- Well, the writing has been on the wall for some years now, arguably over a decade, but the time has finally come where the largest CA in the World is going to drop support for the Online Certificate Status Protocol.What is OCSP?The Online Certificate Status Protocol is a --------------------------------------------- https://scotthelme.ghost.io/lets-encrypt-to-end-ocsp-support-in-2025/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gst-plugins-good1.0 and opensc), Fedora (iwd and libell), and SUSE (chromium, govulncheck-vulndb, and poppler). --------------------------------------------- https://lwn.net/Articles/1003768/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.12.2024
by Daily end-of-shift report 27 Dec '24

27 Dec '24

===================== = End-of-Day report = ===================== Timeframe: Montag 23-12-2024 18:00 − Freitag 27-12-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cybersecurity firms Chrome extension hijacked to steal users data ∗∗∗ --------------------------------------------- One attack was disclosed by Cyberhaven, a data loss prevention company that alerted its customers of a breach on December 24 after a successful phishing attack on an administrator account for the Google Chrome store. Among Cyberhaven's customers are Snowflake, Motorola, Canon, Reddit, AmeriHealth, Cooley, IVP, Navan, DBS, Upstart, and Kirkland & Ellis. [..] Cyberhaven's internal security team removed the malicious package within an hour since its detection, the company says in an email to its customers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cybersecurity-firms-chrome-e… ∗∗∗ Microsoft warnt: Bug könnte Security-Updates verhindern ∗∗∗ --------------------------------------------- Microsoft warnt Nutzer, die ihr System vor Kurzem via CD oder USB-Stick installiert haben. Konkret geht es um Installationsmedien, die das Sicherheitsupdate vom Oktober oder das vom November inkludiert haben. Hier kann es passieren, dass diese Systeme keine weiteren Updates mehr erhalten, wenn sie derzeit auf 24H2 sind. --------------------------------------------- https://futurezone.at/produkte/microsoft-warnung-bug-security-updates-windo… ∗∗∗ Datenschutzverletzung: Volkwagen-Bewegungsprofile von 800.000 E-Autos offengelegt ∗∗∗ --------------------------------------------- Persönliche Daten und Bewegungsprofile von rund 800.000 VW-E-Auto-Besitzern lagen monatelang öffentlich zugänglich in der Cloud. --------------------------------------------- https://www.golem.de/news/datenschutzverletzung-volkwagen-bewegungsprofile-… ∗∗∗ Threat landscape for industrial automation systems in Q3 2024 ∗∗∗ --------------------------------------------- The ICS CERT quarterly report covers threat landscape for industrial automation systems in Q3 2024. --------------------------------------------- https://securelist.com/ics-cert-q3-2024-report/115182/ ∗∗∗ More SSH Fun!, (Tue, Dec 24th) ∗∗∗ --------------------------------------------- A few days ago, I wrote a diary about a link file that abused the ssh.exe tool present in modern versions of Microsoft Windows. At the end, I mentioned that I will hunt for more SSH-related files/scripts. Guess what? I already found another one. --------------------------------------------- https://isc.sans.edu/diary/rss/31542 ∗∗∗ Jahresrückblick: Diese Themen beschäftigten uns 2024! ∗∗∗ --------------------------------------------- Wir sagen „DANKE“ und blicken noch einmal zurück auf die Entwicklungen und Geschehnisse des vergangenen Jahres. --------------------------------------------- https://www.watchlist-internet.at/news/jahresrueckblick-2024/ ∗∗∗ ASUS: "Weihnachtsüberraschung" mit christmas.exe schief gegangen ∗∗∗ --------------------------------------------- Anbieter ASUS wollte seine Benutzer überraschen und hat diesen eine besondere Weihnachtskarte mit dem Dateinamen christmas.exe zukommen lassen. Ist natürlich seit Jahren bekannt, dass man aus Sicherheitsgründen keine .exe-Grußkarte mit Weihnachtsgrüßen verschickt. --------------------------------------------- https://www.borncity.com/blog/2024/12/26/asus-weihnachtsueberraschung-mit-c… ∗∗∗ PMKID Attacks: Debunking the 802.11r Myth ∗∗∗ --------------------------------------------- This article addresses common misconceptions surrounding PMKID-based attacks while offering technical insights into their mechanics and effective countermeasures. The PMKID-based attack, first disclosed in 2018 by the Hashcat team, introduced a novel method of compromising WPA2-protected Wi-Fi networks. Unlike traditional techniques, this approach does not require capturing a full 4-way handshake, instead leveraging a design flaw in the Pairwise Master Key Identifier (PMKID). --------------------------------------------- https://www.nccgroup.com/us/research-blog/pmkid-attacks-debunking-the-80211… ∗∗∗ From Arbitrary File Write to RCE in Restricted Rails apps ∗∗∗ --------------------------------------------- Introduction Recently, we came across a situation where we needed to exploit an arbitrary file write vulnerability in a Rails application running in a restricted environment. The application was deployed via a Dockerfile that imposed...O post From Arbitrary File Write to RCE in Restricted Rails apps apareceu primeiro em Conviso AppSec. --------------------------------------------- https://blog.convisoappsec.com/en/from-arbitrary-file-write-to-rce-in-restr… ===================== = Vulnerabilities = ===================== ∗∗∗ Palo Alto: CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet (Severity: HIGH) ∗∗∗ --------------------------------------------- A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-3393 ∗∗∗ Apache Tomcat Vulnerability CVE-2024-56337 Exposes Servers to RCE Attacks ∗∗∗ --------------------------------------------- The Apache Software Foundation (ASF) has released a security update to address an important vulnerability in its Tomcat server software that could result in remote code execution (RCE) under certain conditions. The vulnerability, tracked as CVE-2024-56337, has been described as an incomplete mitigation for CVE-2024-50379 (CVSS score: 9.8), another critical security flaw in the same product that was previously addressed on December 17, 2024. --------------------------------------------- https://thehackernews.com/2024/12/apache-tomcat-vulnerability-cve-2024.html ∗∗∗ Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now ∗∗∗ --------------------------------------------- The Apache Software Foundation (ASF) has shipped security updates to address a critical security flaw in Traffic Control that, if successfully exploited, could allow an attacker to execute arbitrary Structured Query Language (SQL) commands in the database. The SQL injection vulnerability, tracked as CVE-2024-45387, is rated 9.9 out of 10.0 on the CVSS scoring system. --------------------------------------------- https://thehackernews.com/2024/12/critical-sql-injection-vulnerability-in.h… ∗∗∗ Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization ∗∗∗ --------------------------------------------- The Apache Software Foundation (ASF) has released patches to address a maximum severity vulnerability in the MINA Java network application framework that could result in remote code execution under specific conditions. Tracked as CVE-2024-52046, the vulnerability carries a CVSS score of 10.0. --------------------------------------------- https://thehackernews.com/2024/12/apache-mina-cve-2024-52046-cvss-100.html ∗∗∗ Adobe warns of critical ColdFusion bug with PoC exploit code ∗∗∗ --------------------------------------------- Adobe has released out-of-band security updates to address a critical ColdFusion vulnerability with proof-of-concept exploit code. In an advisory released on Monday, the company says the flaw (tracked as CVE-2024-53961) is caused by a path traversal weakness that impacts Adobe ColdFusion versions 2023 and 2021 and can enable attackers to read arbitrary files on vulnerable servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/adobe-warns-of-critical-cold… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (containernetworking-plugins, edk2:20240524, gstreamer1-plugins-base, gstreamer1-plugins-good, kernel, libsndfile:1.0.31, mpg123:1.32.9, pam, php:8.1, php:8.2, python3.11, python3.11-urllib3, python3.12, python3.9:3.9.21, skopeo, and unbound:1.16.2), Debian (intel-microcode), Fedora (python3-docs and python3.12), Mageia (emacs), Red Hat (podman), and SUSE (gdb, govulncheck-vulndb, libparaview5_12, mozjs115, mozjs78, and vhostmd). --------------------------------------------- https://lwn.net/Articles/1003381/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (sympa and tomcat), Red Hat (kernel), and SUSE (poppler). --------------------------------------------- https://lwn.net/Articles/1003462/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (fastnetmon, webkit2gtk, and xen), Fedora (sympa), Oracle (postgresql), and Red Hat (pcp, tigervnc, and xorg-x11-server and xorg-x11-server-Xwayland). --------------------------------------------- https://lwn.net/Articles/1003542/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (node-postcss), Fedora (age, dr_libs, incus, libxml2, moodle, and python-sql), and SUSE (poppler and python-grpcio). --------------------------------------------- https://lwn.net/Articles/1003601/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily