- Daily - CERT.at

Tageszusammenfassung - Mittwoch 22-07-2015
by Daily end-of-shift report 22 Jul '15

22 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-07-2015 18:00 − Mittwoch 22-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** WP-CLI Guide: Secure WordPress Backup and Update *** --------------------------------------------- Welcome to our second post in the series on WP-CLI for WordPress management over SSH. In our previous post, we discussed how to get your SSH credentials and use WP-CLI to connect to your website over the command line. Before we get into changing anything, we'll show you how to back up your database and compress... --------------------------------------------- https://blog.sucuri.net/2015/07/wp-cli-guide-secure-wordpress-backup-update… *** Exclusive: Visa application portal closed following SC Magazine investigation *** --------------------------------------------- VFS Global closes visa application portal following SC Magazine investigation. Editable Schengen visa application forms accessed FOUR DAYS after operating company VFS Global said a vulnerability had been fixed. --------------------------------------------- http://www.scmagazine.com/exclusive-visa-application-portal-closed-followin… *** Free security tools help detect Hacking Team malware *** --------------------------------------------- Vulnerabilities and other threats exposed in the Hacking Team leaks has spurred Rook Security and Facebook to each release free security tools. --------------------------------------------- http://www.scmagazine.com/rook-security-facebook-release-free-security-tool… *** "Super-Spion": Android-Überwachungssoftware von Hacking Team nutzt allerhand schmutzige Tricks *** --------------------------------------------- Eine Analyse der Spionage-App RCSAndroid zeigt umfassende Ausspähfunktionen auf. Die Infektion erfolgt über Exploits - und möglicherweise auch Google Play. --------------------------------------------- http://heise.de/-2759365 *** Introduction to Alternate Data Streams *** --------------------------------------------- In this post, we defined what is an alternate data stream (ADS), showed how it can be created and read, and how one can remove unwanted ADS.Categories: All Things DevTags: adsalternate data streamsPieter Arntzpowershellstreams(Read more...) --------------------------------------------- https://blog.malwarebytes.org/development/2015/07/introduction-to-alternate… *** Think your website isn't worth anything to hackers? Think again *** --------------------------------------------- Have you ever thought about the cost of your website compromise? --------------------------------------------- https://www.htbridge.com/blog/think-your-website-isn-t-worth-anything-to-ha… *** l+f: Falsche Microsoft-Techniker simulieren falsche Bluescreens *** --------------------------------------------- Die Telefonabzocker, die sich als Microsoft-Techniker ausgeben, haben sich eine neue Masche überlegt - und sind jetzt auch telefonisch erreichbar. --------------------------------------------- http://heise.de/-2760509 *** DFN-CERT-2015-1107: FreeBSD, Transmission Control Protocol (TCP): Eine Schwachstelle erlaubt einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle im Transmission Control Protocol (TCP) der TCP/IP Protocol Suite ermöglicht einem entfernten, nicht authentisierten Angreifer einen kompletten Denial-of-Service-Zustand zu bewirken. Von der Schwachstelle sind alle derzeit unterstützten FreeBSD-Versionen betroffen. Sicherheitsupdates stehen bereit. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1107/ *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco IOS XR Concurrent Data Management Replication Process BGP Process Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40067 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40021 *** [R1] PHP < 5.4.43 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-09 *** Hospira Symbiq Infusion System Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides compensating measures for a vulnerability in the Hospira Symbiq Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01 *** Counter-Strike 1.6 GameInfo Query Reflection DoS *** --------------------------------------------- Topic: Counter-Strike 1.6 GameInfo Query Reflection DoS Risk: Medium Text:#!/usr/bin/perl # # Counter-Strike 1.6 GameInfo Query Reflection DoS # Proof Of Concept # # Copyright 2015 (c) Todor ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070103

1 0

Tageszusammenfassung - Dienstag 21-07-2015
by Daily end-of-shift report 21 Jul '15

21 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-07-2015 18:00 − Dienstag 21-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl Co-Handler: Stephan Richter *** One Perfect Bug: Exploiting Type Confusion in Flash *** --------------------------------------------- Posted by Natalie Silvanovich, Dazed and (Type) ConfusedFor some attackers, it is important that an exploit be extremely reliable. That is to say, the exploit should consistently lead to code execution when it is run on a system with a known platform and Flash version. One way to create such an exploit is to use an especially high-quality bug. This post describes the exploitation of one such bug, and the factors that make it especially good for reliable exploitation.The BugCVE-2015-3077 is a... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-perfect-bug-exploiting-ty… *** Hackers Remotely Kill a Jeep on the Highway - With Me in It *** --------------------------------------------- I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. --------------------------------------------- http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ *** Searching Through the VirusTotal Database, (Tue, Jul 21st) *** --------------------------------------------- Now that my overview of Sysinternals tools with VirusTotal support is complete (Process Explorer, Autoruns and Sigcheck), lets address a couple of remarks I received (BTW, if I missed a Sysinternals tools, let me know with a comment). 1) Upload of files. Some people are worried that the Sysinternals tools will upload (confidential) files to VirusTotal. That is a valid concern, but for each tool I described, I showed how to enable hash searching first. Configured like this, the Sysinternals... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19945&rss *** Finding XSS Vulnerabilities More Quickly with Dynamic Contextual Analysis *** --------------------------------------------- Cross-Site Scripting (XSS) has been around since the 1990s and countless scanners have been created to find this vulnerability class. Each scanner has its own set of payloads with some more extensive than others. However, almost all of these payloads... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Finding-XSS-Vulnerabili… *** Black Hat 2015: 32 SCADA, mobile zero-day vulns will drop *** --------------------------------------------- Pwn storm brews Gird your loins, admins; researchers are set to drop 32 zero-day vulnerabilities at the Black Hat hacking fest in Las Vegas in August. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/21/black_hat_2… *** x86 Exploitation 101: "House of Spirit" - Friendly stack overflow *** --------------------------------------------- The last technique from the "Malloc Maleficarum" is different from all the others because, among the requirements, there's a stack overflow. --------------------------------------------- https://gbmaster.wordpress.com/2015/07/21/x86-exploitation-101-house-of-spi… *** Cybercrime - Tipping the Balance *** --------------------------------------------- It's been said before (on this very blog) but it's worth saying again; if you work back far enough from any cybercrime, eventually you find a person. Someone, somewhere is writing the code and calling the shots. When this statement is presented to a non-technical audience, the question that typically follows is "so who are these people?", and hot on it's heels "why are they doing this?". Simple and reasonable queries, but as most of us know, the answers... --------------------------------------------- https://blog.team-cymru.org/2015/07/cybercrime-tipping-the-balance/ *** Key findings from the ENISA Workshop: Protection of Electronic Communications Infrastructure and Information Sharing *** --------------------------------------------- ENISA’s Workshop on the Protection of Electronic Communications Infrastructure and Information Sharing successfully concluded with the participation of more than forty-five (45) participants from twenty (20) Member States. Representatives included Ministries and National Regulatory Agencies, Electronic communication providers and infrastructure owners. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/key-findings-from-the-enisa-wor… *** Operation Shrouded Horizon: Darkode and its Ties to Bulletproof Hosting Services *** --------------------------------------------- One of the challenges in fighting cybercrime is that it is borderless; cybercriminals can conduct their malicious activities in countries that do not have strict implementation of cybercrime laws. However, no matter how difficult and perilous the task of arresting attackers and taking down cybercriminal operations is, it can be achieved through collaboration between security researchers... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-S0neNV90as/ *** DFN-CERT-2015-1104: Microsoft Internet Explorer: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- ZDI-15-362-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CTreePos-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-361-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CCurrentStyle-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-360-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CAttrArray-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-359-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Verarbeitung von Arrays für die Repräsentation von HTML-Tabellen, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu einem Speicherüberlauf ("Out-Of-Bounds Memory Access") führt. Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1104/ *** MS15-078 - Critical: Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904) - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-078 *** ZDI-15-358: BitTorrent/uTorrent URI Protocol Command Line Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent and uTorrent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-358/ *** ZDI-15-363: (0Day) Hewlett-Packard Client Automation Agent Stack Based Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-363/ *** ZDI-15-364: (0Day) Hewlett-Packard Client Automation Agent Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-364/ *** ZDI-15-365: Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-365/ *** VU#912036: N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password *** --------------------------------------------- Vulnerability Note VU#912036 N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview SolarWinds N-Able N-Central is an agent-based enterprise support and management solution. N-Able N-Central contains several hard-coded encryption constants in the web interface that allow decryption of the password when combined. Description CWE-547: Use of Hard-coded,... --------------------------------------------- http://www.kb.cert.org/vuls/id/912036 *** Cisco WebEx Meetings Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39755 *** Cisco WebEx Training Center Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39753 *** Cisco WebEx Administration Site Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39756 *** Cisco Videoscape Policy Resource Manager Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40050 *** [R1] OpenSSL secadv_20150709 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-08 *** SSA-267489 (Last Update 2015-07-21): Vulnerabilities in Android App Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-396873 (Last Update: 2015-07-21): TLS Vulnerability in Ruggedcom ROS- and ROX-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Active Super Shop 1.0 Cross Site Scripting *** --------------------------------------------- Topic: Active Super Shop 1.0 Cross Site Scripting Risk: Low Text:# Exploit Title:Active Super Shop Persistent XSS # Date: Fri July 17 2015 # Exploit Author: Angelo Ruwantha # Vendor Homepag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070101 *** WordPress Mailcwp 1.99 Shell Upload *** --------------------------------------------- Topic: WordPress Mailcwp 1.99 Shell Upload Risk: High Text:Title: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin Author: Larry W. Cashdollar, @_larry0 Date: 2015-07... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070100

1 0

Tageszusammenfassung - Montag 20-07-2015
by Daily end-of-shift report 20 Jul '15

20 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-07-2015 18:00 − Montag 20-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cyber-securitys dirty little secret: Its not as bad as you think *** --------------------------------------------- And as for botnets - on their way out A new research report from the Global Commission on Internet Governance has reached a surprising conclusion: cyberspace is actually getting safer. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/18/cybersecuri… *** Its the Data, Stupid! *** --------------------------------------------- At least with MySQL, PostgreSQL and much of the relational database software the defaults are fairly secure: listen on the local interface only and provide some form of authorization by default. This isnt the case with some of the newer NoSQL products that started entering mainstream fairly recently. For the purpose of this article I will talk about one of the more popular NoSQL products called MongoDB, though much of what is being said also applies to other software (Im looking at you Redis). --------------------------------------------- https://blog.shodan.io/its-the-data-stupid/ *** RedStar OS Watermarking *** --------------------------------------------- During the last few months information about one of North Koreas operating systems was leaked. It is a Linux based OS that tries to simulate the look and feel of a Mac. Some of it's features have already been discussed on various blog posts and news articles. We thought we would take a short look at the OS. This blog post contains some of the results. --------------------------------------------- http://www.insinuator.net/2015/07/redstar-os-watermarking/ *** Autoruns and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at autoruns. Autoruns is another fine Sysinternals tool that comes with VirusTotal integration. If you are not familiar with autoruns, it scans all auto-starting locations in Windows and provides a comprehensive report. This gives you an overview of all programs that start automatically on the scanned Windows machine. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19933 *** Sigcheck and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at sigcheck. Sigcheck is a command-line utility to check the digital signature of files like PE files (EXEs). --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19935 *** Disabled Adobe Flash browser plugin? This might not be enough *** --------------------------------------------- I went to the Adobes Flash test page and opened it in IE (top left). As expected, the plugin couldnt run because (see the Manage Add-ons window in the bottom-left corner) it has been disabled. And yet when I opened the same test URL in HH - Flash was right there. And this is a problem. Yes, by disabling Flash in the main browsers we have significantly reduced the risk but we have not eliminated it. --------------------------------------------- http://blog.kulshitsky.com/2015/07/disabled-adobe-flash-browser-plugin.html *** Parlamentswebsite nur mehr mit aktuellen Browsern nutzbar *** --------------------------------------------- SSL-Verschlüsselungsprotokolle werden auf den neuesten Stand gebracht --------------------------------------------- http://derstandard.at/2000019420275 *** Ashley Madison hacked: Site for people who cant be trusted cant be trusted *** --------------------------------------------- Bin site or well spaff everything, say hax0rz Adulterers hookup website Ashley Madison has been hacked, with the miscreants threatening to release personal details, including users sexual fantasies, unless the site is shut down. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/20/ashley_madi… *** BSI warnt vor Sicherheitslücke in Blackberry-Link-App für Mac und PC *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik warnt vor einem Fehler in dem Synchronisationstool. Nutzer sollten aktualisieren. --------------------------------------------- http://heise.de/-2753660 *** Zero Days, the documentary *** --------------------------------------------- VPRO (the Dutch public broadcasting organisation) produced a 45-minute documentary about hacking and the trade of zero days. The documentary has now been released in English on Youtube. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002821.html *** BGP Security Alerts Coming to Twitter *** --------------------------------------------- At Black Hat, researchers from OpenDNS are expected to launch a new Twitter feed called BGP Stream that will send out alerts on possible BGP and DNS hijacking attacks. --------------------------------------------- http://threatpost.com/bgp-security-alerts-coming-to-twitter/113843 *** Maligno: An Open Source Pentesting Tool *** --------------------------------------------- Today I want show you a new tool that could help in your penetration testing activity. Maligno is an open source penetration-testing tool under the FreeBSD license, written in Python for maximum compatibility with Metasploit. It uses the Metasploit framework, in particular msfvenom, to generate the shellcode AES encrypted and encoded prior to transmission. Maligno... --------------------------------------------- http://resources.infosecinstitute.com/maligno-open-source-penetration-testi… *** Cyber savvy? Take a Quick Security Awareness Quiz to Find Out *** --------------------------------------------- So you think you are cyber-savvy knowledgeable in the cyber security risks you face every day in the digital world? Take this quick security quiz and find out. Just get record your answers as you take the quiz. There are 10 questions for this security awareness quiz. You can refer to the Answers Section to... --------------------------------------------- http://resources.infosecinstitute.com/cyber-savvy-take-a-quick-security-awa… *** Free Tool Looks for HackingTeam Malware *** --------------------------------------------- Researchers at Rook Security have released a new tool that looks for HackingTeam malware on target systems, and also have published a set of indicators of compromise to help organizations look for signs of an infection from the intrusion software. The HackingTeam Remote Control System is the company's flagship surveillance and intrusion platform. It sold... --------------------------------------------- http://threatpost.com/free-tool-looks-for-hackingteam-malware/113850 *** OpenSSH anfällig für Bruteforce-Angriffe *** --------------------------------------------- Die eingestellte Grenze der maximal möglichen Passwort-Angaben vor einem Verbindungsabbruch lässt sich in einigen Konfigurationen recht einfach austricksen. --------------------------------------------- http://heise.de/-2753501 *** OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) *** --------------------------------------------- Topic: OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) Risk: Low Text:OpenSSH has a default value of six authentication tries before it will close the connection (the ssh client allows only three p... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070097 *** VU#813631: Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read *** --------------------------------------------- Vulnerability Note VU#813631 Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview Total Commanders File Info plugin version 2.21 attempts an out-of-bounds read when reading a file carefully crafted by an attacker. Description CWE-125: Out-of-bounds Read - CVE-2015-2869An attacker that can control the contents of certain file types may be able to cause an out-of-bounds read error in --------------------------------------------- http://www.kb.cert.org/vuls/id/813631 *** DFN-CERT-2015-1093: JBoss Enterprise Portal Platform: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsmaßnahmen *** --------------------------------------------- Durch eine Schwachstelle in JBoss Portal Plattform ist es einem entfernten, einfach authentifizierten Angreifer möglich, Sicherheitsvorkehrungen zu umgehen. Red Hat stellt für die Komponente PortletBridge von Red Hat JBoss Portal 6.2.0 ein Sicherheitsupdate zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1093/ *** Security Advisory: PCRE library vulnerability CVE-2015-2326 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16984.htm… *** HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04745746 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Power Systems Firmware affected by Open Source - 2 issues for OpenSSL (CVE-2015-0286, CVE-2015-0287) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022521 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Analytic Server (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961993 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Virtualization Engine TS7700 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005295 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Content Manager Enterprise Edition (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962455 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Websphere Partner Gateway Enterprise/Advanced Editions (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962162 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Publishing Engine (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961086 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961214 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808, CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960528 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDKs affect IBM Virtualization Engine TS7700 - April 2015 *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005294 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=swg21957734 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Publishing Engine (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21961080 *** IBM Security Bulletin: Security Vulnerability in IBM WebSphere Application Server affects IBM WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-1920) *** http://www.ibm.com/support/docview.wss?uid=swg21957802 *** IBM Security Bulletin: Insufficient authorization in Service REST API and cross site scripting vulnerability in REST API affecting IBM Business Process Manager (CVE-2015-1905, CVE-2015-1906) *** http://www.ibm.com/support/docview.wss?uid=swg21700717 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962372

1 0

Tageszusammenfassung - Freitag 17-07-2015
by Daily end-of-shift report 17 Jul '15

17 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-07-2015 18:00 − Freitag 17-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** MSRT July 2015: Crowti *** --------------------------------------------- In our ongoing effort to provide malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Crowti Win32/Reveton Crowti, a file encryption threat, is one of the top prevalent ransomware families. We have recently seen it sent as a spam email attachment with formats similar to those shown below: Figure 1: Email spam samples delivering Crowti as an attachment As well as using spam emails as the entry point or infection... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/07/14/msrt-july-2015-crowti.as… *** Running SAP? Checked for patches lately? Nows a good time *** --------------------------------------------- New round of fixes includes one for security bypass flaw SAP has released its July pack of security fixes, including critical patches one researcher says demand your urgent attention. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/running_sap… *** Ad networks beware; Google raises Red Screen of malware Dearth *** --------------------------------------------- Chrome to take shine off dodgy ad networks. Watch out dodgy ad slingers and news sites; Google is expanding its last line of defence Chrome feature to brand all security-slacker ad networks as unsafe. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/google_safe… *** Fake News App in Hacking Team Dump Designed to Bypass Google Play *** --------------------------------------------- Looking into the app's routines, we believe the app can circumvent Google Play restrictions by using dynamic loading technology. Initially, it only asks for three permissions and can be deemed safe by Google's security standards as there are no exploit codes to be found in the app. However, dynamic loading technology allows the app to download and execute a partial of code from the Internet. It will not load the code while Google is verifying the app but will later push the code once... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/fake-news-app-in… *** Significant Flash exploit mitigations are live in v18.0.0.209 *** --------------------------------------------- Whilst Project Zero has gained a reputation for vulnerability and exploitation research, thats not all that we do. One of the main reasons we perform this research is to provide data to defenders; and one of the things that defenders can do with this data is to devise exploit mitigations. Sometimes, well take on exploit mitigations ourselves. Recently, weve been working with Adobe on Flash mitigations, and this post describes some significant mitigations have landed over the past couple of... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/07/significant-flash-exploit-m… *** Save the Date: 2 November NCSRA-Symposium 2015 *** --------------------------------------------- For the second time the NCSC will be co-organizing the NCSRA Symposium, which will be held on 2 November during Alert Online (the Dutch national cyber security awareness campaign). This symposium offers possibilities for knowledge sharing and community building in cybersecurity research and innovation. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/save-the-date-2-november-nc… *** Process Explorer and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- About a year ago, Rob had a diary entry about checking a file from Process Explorer with VirusTotal. Did you know you can have all EXEs of running processes scanned with VirusTotal? In Process Explorer, add column VirusTotal: Enable VirusTotal checks: And accept the VirusTotal terms: And now you can see the VirusTotal scores: Process Explorer is not the only Sysinternals tool that comes with VirusTotal support. Ill showcase more tools in upcoming diary entries. Sysinternals:... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19931&rss *** SANS: Kostenloser Webcast: 5 Jahre nach Stuxnet: Was hat sich geändert, was nicht und was liegt vor uns *** --------------------------------------------- Wednesday, July 29, 2015 at 17:00 CEST Thomas Brandstetter | In der industriellen Welt war die Entdeckung der Stuxnet-Malware das markanteste Ereignis der letzten Jahre. Viele Präsentationen über Industrial Security haben seither mit dem Satz Seit Stuxnet ist alles anders begonnen. Anlässlich des 5-Jahres-Jubiläums der Entdeckung von Stuxnet lohnt es zu fragen: Stimmt das? Welche Auswirkungen hatte Stuxnet tatsächlich auf die industrielle Welt? Thomas Brandstetter war im... --------------------------------------------- https://www.sans.org/webcasts/5-years-stuxnet-changed-didnt-lies-100617 *** Flash-Updates für Linux und noch einmal für die Extended-Support-Version *** --------------------------------------------- Auch Linux-Nutzer, die nicht mit Chrome unterwegs sind, kommen nun in den Genuss des neuesten Flash-Updates. Außerdem müssen Extended-Support-Nutzer noch mal patchen. --------------------------------------------- http://heise.de/-2752440 *** Kommentar: Weg mit Flash! *** --------------------------------------------- Bei Adobes Plug-in stimmt die Balance aus Nutzen und Risiko nicht mehr. Es wird Zeit, dieses Relikt abzuschalten, meint Herbert Braun --------------------------------------------- http://heise.de/-2751583 *** TotoLink Routers Plagued By XSS, CSRF, RCE Bugs *** --------------------------------------------- A slew of routers manufactured in China are fraught with vulnerabilities, some which have existed in products for as long as six years. --------------------------------------------- http://threatpost.com/totolink-routers-plagued-by-xss-csrf-rce-bugs/113816 *** Bugtraq: Novell GroupWise 2014 WebAccess vulnerable to XSS attacks *** --------------------------------------------- http://www.securityfocus.com/archive/1/536023 *** Elasticsearch 1.6.0 Remote Code Execution *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Remote Code Execution Risk: High Text:Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol that enables r... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070089 *** Elasticsearch 1.6.0 Directory Traversal *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Directory Traversal Risk: Medium Text:Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070090 *** WP Backitup <= 1.9.1 - Backup File Disclosure *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8105 *** Cisco Prime Collaboration Assurance Web Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40003 *** EMC Documentum WebTop Lets Remote Users Redirect the Target User to an Arbitrary Site *** --------------------------------------------- http://www.securitytracker.com/id/1032965 *** EMC Documentum CenterStage Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032966 *** Eaton's Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on January 6, 2015, and is now being released to the ICS-CERT web site. This advisory provides mitigation details for a predictable TCP sequence vulnerability in Eaton's Cooper Power Systems Form 6 and Idea/IdeaPLUS relays with Ethernet application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01 *** SSA-732541 (Last Update 2015-07-17): Denial-of-Service Vulnerability in SIPROTEC 4 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** IBM Security Bulletins *** --------------------------------------------- IBM Vulnerability in Apache Tomcat may affect IBM WebSphere Application Server Community Edition (CVE-2014-0230) IBM Security Bulletin: Open Source Apache Tomcat vulnerability and vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2014-0230, CVE-2014-7810, CVE-2015-4000) IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Secure Proxy and Sterling External Authentication Server (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0478, CVE-2015-0204) IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Application Developer for WebSphere Software (CVE-2015-4000, CVE-2015-1793) IBM Security Bulletin: Vulnerability in OpenSSL affects IBM SDK for Node.js (CVE-2015-1793) IBM Security Bulletin: Vulnerability in the Dojo Toolkit affects IBM Business Process Manager, which is shipped with IBM SmartCloud Orchestrator and IBM SmartCloud Orchestrator Enterprise (CVE-2014-8917) IBM Security Bulletin: Tivoli Workload Scheduler Distributed Potential Security vulnerabilities with IBM WebSphere Application Server (CVE-2015-1920) --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 16-07-2015
by Daily end-of-shift report 16 Jul '15

16 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-07-2015 18:00 − Donnerstag 16-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RC4 crypto: Get RID of it already, say boffins *** --------------------------------------------- This one simple attack busts WPA-TKIP in less than an hour ... As they explain here, the weakness of RC4 (inherited by systems using it) is based on biases in the RC4 keystream. The bias was already known, and is why vendors like Microsoft are working to deprecate it. Whats different in the new work is the acceleration of the cryptanalysis Vanhoef and Piessens carry out. --------------------------------------------- http://www.theregister.co.uk/2015/07/16/rc4_get_rid_of_it_already_say_boffi… *** RC4 in HTTPS & Verbreitung *** --------------------------------------------- RC4 gehört nicht zu den stärksten Verschlüsselungsmethoden, und sollte eigentlich nach RFC7465 (aktuell noch ein Draft) gar nicht mehr verwendet werden. Neue Angriffe ermöglichen im Nachhinein das entschlüsseln von sensitiven Informationen wie zum Beispiel Session cookies innerhalb von wenigen Tagen. In den letzten Wochen haben wir ca. 2 Millionen TLS Konfigurationen weltweit mittels dem Tool... --------------------------------------------- https://www.sba-research.org/2015/07/16/rc4-in-https-verbreitung/ *** Poodle-Nachspiel: Mace und weitere Lücken in TLS-Servern *** --------------------------------------------- Cisco, F5, Juniper, Fortinet: Ein Sicherheitsforscher hat eine Reihe von TLS-Servern entdeckt, die den sogenannten Message Authentication Code (MAC) von Verbindungen nicht prüfen. Andere Serverimplementierungen prüfen eine Checksumme am Ende des Handshakes nicht. --------------------------------------------- http://www.golem.de/news/poodle-nachspiel-mace-und-weitere-luecken-in-tls-s… *** Adobe's CVE-2015-5090 - Updating the Updater to become the bossman *** --------------------------------------------- Amongst the many bugs Adobe patched in July 2015, CVE-2015-5090 stands out as being worth a closer look. Adobe lists this vulnerability as a privilege escalation from low to medium integrity, but this doesn’t tell the whole story. In actuality, this bug can used to execute code with SYSTEM privileges, which could allow an attacker to completely take over a target. Since this affects the Adobe updater service, the bug exists in both Adobe Reader and Acrobat Pro. Both of these programs install the ARMSvc service (Updater) and both keep AdobeARM.exe/AdobeARMHelper.exe in c:\progra~1\common~1\Adobe\ARM\1.0. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Adobe-s-CVE-2015-509… *** Mozilla Winter of Security is back! *** --------------------------------------------- The first edition of MWoS was a success, and a lot of fun for students and mentors, so we decided to run it again this year. For the 2015 edition, we are proposing six projects that directly contribute to our most impactful security tools. Students will be able to work on digital forensics with MIG, SSL/TLS configurations with Menagerie, certificate management with LetsEncrypt, security visualization with MozDef, and web security scanning with OWASP ZAP. --------------------------------------------- https://blog.mozilla.org/security/2015/07/15/mozilla-winter-of-security-is-… *** Understanding PCI compliance fines: Who is in charge of enforcing PCI? *** --------------------------------------------- If your business stores, processes, or transmits data from payment cards, then you are subject to the requirements of the PCI DSS. This set of security controls is designed to help merchants combat da... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/--jT_s5xAyE/article.php *** Researchers prove HTML5 can be used to hide malware *** --------------------------------------------- A group of Italian researchers have come up with new obfuscation techniques that can be used to dupe malware detection systems and allow malicious actors to execute successful drive-by download attack... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/9k3wj_RIqQ8/malware_news.… *** Authentication Bypass Bug Hits Siemens Energy Automation Device *** --------------------------------------------- An authentication bypass vulnerability in a Siemens device that's used in energy automation systems could allow an attacker to gain control of the device. The vulnerability is in the Siemens SICAM MIC, a small telecontrol system that performs a number of functions and includes an integrated Web server and several other features. The devices consist of... --------------------------------------------- http://threatpost.com/authentication-bypass-bug-hits-siemens-energy-automat… *** Are smart infrastructures experts in cyber security? *** --------------------------------------------- [...] Prof. Helmbrecht said: “Currently there is no clear definition of cyber security for smart infrastructures at an EU level. It will be beneficial to increase information sharing and coordination for example on public transport. As new technologies and applications are developed, their security aspects also need to be developed from the design phase, allowing for improved services, user experience and safety in a connected online world”. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/are-smart-infrastructures-exper… *** Bugtraq: ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536014 *** Bugtraq: ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536015 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco WebEx Meetings Server Remote Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39938 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39920 *** Cisco Email Security Appliance Malformed DMARC Policy Records File Modification Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39940 *** Oracle Critical Patch Update Advisory - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Oracle Critical Patch Update - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Solaris Third Party Bulletin - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.h…

1 0

Tageszusammenfassung - Mittwoch 15-07-2015
by Daily end-of-shift report 15 Jul '15

15 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-07-2015 18:00 − Mittwoch 15-07-2015 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** July 2015 Security Updates *** --------------------------------------------- Today we released security updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, and Internet Explorer. As a best practice, we encourage customers to apply security updates as soon as they are released. For more information about this month's security updates and advisories visit the Security TechNet Library. You can also follow the Microsoft Security Response Center (MSRC) team on Twitter at @MSFTSecResponse MSRC Team --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/07/14/july-2015-security-updat… https://technet.microsoft.com/en-us/library/security/MS15-JUL *** TA15-195A: Adobe Flash and Microsoft Windows Vulnerabilities *** --------------------------------------------- Original release date: July 14, 2015 Systems Affected Microsoft Windows systems with Adobe Flash Player installed. Overview Used in conjunction, recently disclosed vulnerabilities in Adobe Flash and Microsoft Windows may allow a remote attacker to execute arbitrary code with system privileges. Since attackers continue to target and find new vulnerabilities in popular, Internet-facing software, updating is not sufficient, and it is important to use exploit mitigation and other defensive --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-195A *** Microsoft Patch Tuesday July 2015 *** --------------------------------------------- Julys Patch Tuesday is here and brings with it a rather large 14 bulletins with 4 Critical and 10 Important rated patches. All combined this months release patches 59 vulnerabilities 29 of which are in the old stalwart Internet Explorer.... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Microsoft-Patch-Tuesday-July… *** Adobe, MS, Oracle Push Critical Security Fixes *** --------------------------------------------- This being the second Tuesday of the month, its officially Patch Tuesday. But its not just Windows users who need to update today: Adobe has released fixes for several products, including a Flash Player bundle that patches two vulnerabilities for which exploit code is available online. Separately, Oracle issued a critical patch update that plugs more than two dozen security holes in Java. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/GZ70l-ulAqw/ *** Oracle Critical Patch Update dichtet 193 Lücken ab *** --------------------------------------------- Wie üblich bei Oracles quartalsweisen Updates stopft die Firma massenweise Lücken in fast allen ihrer Produkte. Sogar die Ghost-Lücke vom Januar feiert ein Comeback. Besonders die Updates für Java und MySQL sollten baldigst installiert werden. --------------------------------------------- http://heise.de/-2750641 *** Microsoft Ends Support for Windows Server 2003, Migration a Must *** --------------------------------------------- End-of-life fun times are coming to infosec departments everywhere again. Just a year after the announcement of Windows XP's end-of-life, we see another body in the OS graveyard: Windows Server 2003. After July 14th, servers running this venerable OS will no longer be receiving any more security updates. This would leave you out in the cold --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/sr3phsOSoFM/ *** Microsoft Security Essentials is no longer available for Windows XP *** --------------------------------------------- We strongly recommend that you complete your migration to a supported operating system as soon as possible so that you can receive regular security updates to help protect your computer from malicious attacks. --------------------------------------------- http://windows.microsoft.com/en-us/windows/security-essentials-download?os=… *** Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39907 *** Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39872 *** Unit 42 Technical Analysis: Seaduke *** --------------------------------------------- Earlier this week Symantec released a blog post detailing a new Trojan used by the "Duke" family of malware. Within this blog post, a payload containing a function named "forkmeiamfamous" was mentioned. While performing some ... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/y_CGsjS6Bio/ *** An In-Depth Look at How Pawn Storm's Java Zero-Day Was Used *** --------------------------------------------- Operation Pawn Storm is a campaign known to target military, embassy, and defense contractor personnel from the United States and its allies. The attackers behind Operation Pawn Storm have been active since at least 2007 and they continue to launch new campaigns. Over the past year or so, we have seen numerous techniques and tactics --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gJtU9nel0NM/ *** Hideouts for Lease: The Silent Role of Bulletproof Hosting Services in Cybercriminal Operations *** --------------------------------------------- What do LeaseWeb, Galkahost, and Spamz have in common? All of them, at one point or another, have functioned as cybercriminal hideouts in the form of bulletproof hosting services (BPHS). Simply put, BPHS is any hosting facility that can store any type of malicious content like phishing sites, pornography, and command-and-control (C&C) infrastructure. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ojxl_6lsUjU/ *** DFN-CERT-2015-1068/ BlackBerry Link: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1068/ *** Rootkits: User Mode *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Rootkits: Kernel Mode *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** Rootkits: User Mode & Kernel Mode-Part 2 *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** FBI paid Hacking Team to identify Tor users *** --------------------------------------------- Documents leaked online after the Hacking Team data breach revealed that the company supported the FBI in the investigation on Tor users. While the security experts are continuing to analyze the impressive amount of data stolen from the Hacking Team, new revelation are circulating over the Internet. Among the clients of the Italian security firm, there ... --------------------------------------------- http://securityaffairs.co/wordpress/38601/cyber-crime/fbi-hacking-team-tor.… *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- We have our hands on the code repositories of HackingTeam, and inside of them we've found the source code for a cross-platform, highly-featured, government-grade RAT (Remote Access Trojan). It's rare that we get to do analysis of complex malware at the source-code level, so I couldn't wait to write a blog about it! --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Epic Games, Epic Fail: Forumers info blown into dust by hack *** --------------------------------------------- Company sorry for the inconvenience caused. Great Epic Games, known for its Unreal Engine and the Games of War series, sent a grovelling letter to its forum users this morning explaining that a hack "may have resulted in unauthorised access to your username, email address, password, and the date of birth you provided at registration." --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/15/epic_games_… *** Details on Internet-wide Scans from SBA *** --------------------------------------------- To clarify what we are scanning on the Internet, here are some details on the project and which tools we use. Most importantly: if you want your IP to be excluded from future scans, please send an email to abuse(a)sba-research.org. For quite some time now we scan Internet-wide for well-known ports that use TLS, most ... --------------------------------------------- https://www.sba-research.org/2015/07/15/details-on-internet-wide-scans-from…

1 0

Tageszusammenfassung - Dienstag 14-07-2015
by Daily end-of-shift report 14 Jul '15

14 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-07-2015 18:00 − Dienstag 14-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Been hacked? Now to decide if you chase the WHO or the HOW *** --------------------------------------------- Imagine a security researcher has plucked your customer invoice database from a command and control server. Youre nervous and angry. Your boss will soon be something worse and will probably want you to explain who pulled off the heist, and how. But only one of these questions, the how, is worth your precious resources; security experts say the who is an emotional distraction. --------------------------------------------- http://www.theregister.co.uk/2015/07/14/attribution_feature/ *** Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems *** --------------------------------------------- Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets' systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running. They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops). However, the code can very likely work on AMI BIOS as well. A Hacking Team slideshow... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-use… *** Lowering Defenses to Increase Security *** --------------------------------------------- Starting at WhiteHat was a career change for me. I wasn't sure exactly what to expect, but I knew there was a lot of unfamiliar terminology: "MD5 signature", "base64", "cross-site request forgery", "'Referer' header", to name a few. When I started testing real websites, I was surprised that a lot of what I was doing... --------------------------------------------- https://blog.whitehatsec.com/lowering-defenses-to-increase-security/ *** Adobe Updates Flash Player, Shockwave and PDF Reader, (Tue, Jul 14th) *** --------------------------------------------- In a warm up to patch Tuesday, it looks like we have a new version for Adobe Flash Player, Shockwave Player and PDF Reader. Given that some of the exploits against the vulnerabilities patchedare public, you may want to expedite patching and review your Flash Player and browser configuration. the latest (patched) versions are (thanks Dave!): - FlashPlayer 18.0.0.209 - Flash Player EST 13.0.0.305 - Reader 10.1.15 - Reader 11.0.12 - Shockwave Player">12.1.9.159 Bulletins: --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19917&rss *** Adobe: Look, honestly, we really do take Flash security seriously *** *** Mozilla: Right, THATS IT. You, Flash, behind the shed with me. *snick snack* *** *** FLASH MUST DIE, says Facebook security chief *** --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/adobe_respo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/firefox_blo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/facebook_fl… *** Security Bulletins Posted *** --------------------------------------------- Security Bulletins for Adobe Acrobat and Reader (APSB15-15), Adobe Shockwave Player (APSB15-17) and Adobe Flash Player (APSB15-18) have been published. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1247 *** SSA-632547 (Last Update 2015-07-14): Authentication Bypass Vulnerability in SICAM MIC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** VU#919604: Kaseya Virtual System Administrator contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#919604 Kaseya Virtual System Administrator contains multiple vulnerabilities Original Release date: 13 Jul 2015 | Last revised: 13 Jul 2015 Overview Kaseya Virtual System Administrator (VSA), versions R9 and possibly earlier, contains arbitrary file download and open redirect vulnerabilities. Description CWE-22: Improper Limitation of Pathname to a Restricted Directory (Path Traversal) - CVE-2015-2862Kaseya VSA is an IT management platform with a help desk ticketing --------------------------------------------- http://www.kb.cert.org/vuls/id/919604 *** Cisco Vulnerability Alerts *** --------------------------------------------- *** Cisco Identity Services Engine Cross-Frame Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 *** Cisco TelePresence Integrator C Series Multiple Request Parameter Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39880 *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39873 *** Cisco Unified Communications Manager Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39877 *** Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerabilities *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39879 *** Cisco Unified Communications Manager ccmivr Page Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39905 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Moodle Bugs Permit Cross-Site Scripting and Open Redirect Attacks and Let Remote Authenticated Users Modify Data *** --------------------------------------------- http://www.securitytracker.com/id/1032877 *** F5 Security Advisory: Multiple PHP CDF vulnerabilities CVE-2014-0237 and CVE-2014-0238 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16954.htm… *** DFN-CERT-2015-1009: Django: Mehrere Schwachstellen ermöglichen u.a. Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1009/

1 0

Tageszusammenfassung - Montag 13-07-2015
by Daily end-of-shift report 13 Jul '15

13 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-07-2015 18:00 − Montag 13-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- Security researchers the world over have been digging through the massive HackingTeam dump for the past five days, and what we've found has been surprising. I've heard this situation called many things, and there's one description that I can definitely agree with: it's like Christmas for hackers. "On the fifth day of Christmas Bromium sent to... --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Pawn Storm Update: Trend Micro Discovers New Java Zero-Day Exploit *** --------------------------------------------- Analysis and data by Brooks Li (Threats Analyst) and Feike Hacquebord (Senior Threat Researcher) Zero-day exploits continued to be used in targeted attacks because they are effective, given that software vendors have yet to create patches for them. Throughout our on-going investigation and monitoring of a targeted attack campaign, Operation Pawn Storm, we found suspicious URLs that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5OzXdZhhVhc/ *** New Zero-Day Vulnerability (CVE-2015-5123) in Adobe Flash Emerges from Hacking Team Leak *** --------------------------------------------- After two Adobe Flash player zero-days disclosed in a row from the leaked data of Hacking Team, we discovered another Adobe Flash Player zero-day (assigned with CVE number, CVE-2015-5123) that surfaced from the said leak. Adobe has already released a security advisory after we reported the said zero-day. This vulnerability is rated as critical and... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rV5yri4x48E/ *** Mit Windows 10 kommen Updates automatisch *** --------------------------------------------- Windows 10-Kunden können sich künftig nur noch sehr begrenzt aussuchen, wann sie ein Update erhalten. --------------------------------------------- http://futurezone.at/produkte/mit-windows-10-kommen-updates-automatisch/141… *** Jump List Files Are OLE Files, (Sun, Jul 12th) *** --------------------------------------------- Jump List files are another type of files that are actually OLE files. They can contain useful data for forensic investigations. There are a couple of tools that can extract information from these files. Here you can see oledump analyzing an automatic Jump List file: The stream DestList contains the Jump List data: There are several sites on the Internet explaining the format of this data, like this one. I used this information to code a plugin for Jump List files: The plugin takes an option... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19911&rss *** Identifying the five principal methods of network attacks *** --------------------------------------------- Companies are underestimating the risk of failing to provide security training to non-technical staff. A new Intel Security study, which surveyed IT decision makers in European-based companies, fo... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/gSbxVIXvO94/secworld.php *** Mobile SSL failures: More common than they should be *** --------------------------------------------- Securing your mobile application traffic is apparently more difficult than it should be, as researchers Anthony Trummer and Tushar Dalvi discovered when looking into SSL/TLS usage on the Android opera... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/dY8mHp2RDC4/article.php *** Identifying and exploiting IBM WebSphere Application Server *** --------------------------------------------- IBM WebSphere is application server similar to Tomcat, JBoss and WebLogic. Therefore, it should be interesting to any penetration tester doing enterprise scale work where Websphere might be present. It should be also interesting to anyone who is working on securing enterprise environment since Websphere allows deploying own (malicious or not) code to the server. I have written NSE scripts to identify IBM Websphere consoles of application servers and to brute force any usernames and passwords. I... --------------------------------------------- https://k0st.wordpress.com/2015/07/13/identifying-and-exploiting-ibm-websph… *** Start Secure 2015 - Sicherheits-Start-ups gesucht *** --------------------------------------------- Der Wettbewerb "Start Secure 2015" wird gemeinsam vom Innenministerium und der futurezone veranstaltet. Als Organisationspartner fungieren SBA Research, das die Sieger-Start-ups auf Wunsch auch als Inkubator bei der Investorensuche berät, sowie das Kuratorium Sicheres Österreich. --------------------------------------------- http://futurezone.at/thema/start-ups/sicherheits-start-ups-gesucht/139.420.… *** Common Assessment Tool Cheatsheets *** --------------------------------------------- I have an unhealthy obsession for time savers when im doing pentest work. Since a lot of my time is spent on the command line I love cheatsheets. I thought id use this thread to post some of the more awesome cheat sheets I find... --------------------------------------------- https://forum.bugcrowd.com/t/common-assessment-tool-cheatsheets/502 *** Tunneling Data and Commands Over DNS to Bypass Firewalls *** --------------------------------------------- No matter how tightly you restrict outbound access from your network, you probably allow DNS queries to at least one server. Adversaries can abuse this "hole" in your firewall to exfiltrate data and establish stealthy Command and Control (C2) channels that are very difficult to block. ... I am struggling to come up with a solution to plug this firewall "hole", but I have a few risk mitigation recommendations:... --------------------------------------------- https://zeltser.com/c2-dns-tunneling/ *** Google Photo App Uploads Your Images To Cloud, Even After Uninstalling *** --------------------------------------------- Have you ever seen any mobile application working in the background silently even after you have uninstalled it completely? I have seen Google Photos app doing the same. Your Android smartphone continues to upload your phone photos to Google servers without your knowledge, even if you have already uninstalled the Google Photos app from your device. Nashville Business... --------------------------------------------- http://feedproxy.google.com/~r/TheHackersNews/~3/yxF2id-ZsHg/google-photo-a… *** "Forkmeiamfamous": Seaduke, latest weapon in the Duke armory *** --------------------------------------------- Low-profile information-stealing Trojan is used only against high-value targets --------------------------------------------- http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon… *** BGP Hijacking - why you need to care! *** --------------------------------------------- This came across our desk this morning when we were putting together Dragon News Bytes. There is lots of talk about what has been discovered in the recent reporting on the data dump from the Hacking Team incident. A lot of the reporting discusses the ethics of the company's services and whom they have been selling them to. Concentrating for a moment on the technology deployed in this activity, it is suggested that BGP hijacking was involved. This is described the article entitled... --------------------------------------------- https://blog.team-cymru.org/2015/07/bgp-hijacking-why-do-you-need-to-care/ *** Allerletzter Aufruf: Support fÜr Windows 2003 Server endet *** --------------------------------------------- Am 14. Juli ist endgÜltig Schluss. FÜr Windows 2003 Server liefert Microsoft keine Updates mehr aus, auch nicht bei Sicherheitsproblemen. Wobei auch hier zu gelten scheint: Ausnahmen bestÄtigen die Regel. --------------------------------------------- http://www.heise.de/newsticker/meldung/Allerletzter-Aufruf-Support-fuer-Win… *** Hacking Team 0-day Flash Wave with Exploit Kits *** --------------------------------------------- https://www.f-secure.com/weblog/archives/00002819.html *** New PHP Releases Fix BACRONYM MySQL Flaw *** --------------------------------------------- Several new versions of PHP have been released, all of which contain a number of bug fixes, most notably a patch for the so-called BACKRONYM vulnerability in MySQL. That bug in MySQL is caused by a problem with the way that the database software handles requests for secure connections. Researchers at Duo Security disclosed the... --------------------------------------------- http://threatpost.com/new-php-releases-fix-bacronym-mysql-flaw/113740 *** The Adobe Flash Conundrum: Old Habits Die Hard *** --------------------------------------------- Is it time to hop off the endless cycle of Flash vulnerabilities and updates? Last week has not been great for Adobe Flash. The 440GB of leaked Hacking Team emails has become a treasure trove for vulnerability hunters. Over the past 7 days, Flash was hit by three separate vulnerabilities: CVE-2015-5119 CVE-2015-5122 CVE-2015-5123 At this time, only the... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/AmkybOPif7Y/ *** Bugtraq: ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535981 *** Cisco Mobility Services Engine Control And Provisioning Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39825 *** Juniper Security Advisories *** --------------------------------------------- *** Juniper Junos IPv6 SEND Processing Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032849 *** Juniper Junos SRX Network Security Daemon Bug Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032848 *** Juniper Junos EX4600 and QFX Series Unspecified Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032847 *** Juniper Junos J-Web Bugs Let Remote Users Conduct Cross-Site Scripting and Denial of Service Attacks *** http://www.securitytracker.com/id/1032846 *** Bugtraq: [security bulletin] HPSBGN03373 rev.1 - HP Release Control running TLS, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535983 *** Cisco WebEx Meeting Center Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39782 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Boost memory allocator vulnerability CVE-2012-2677 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16946.htm… *** Security Advisory: Multiple SQLite vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16950.htm… *** Security Advisory: Mailx vulnerabilities CVE-2004-2771 and CVE-2014-7844 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16945.htm… *** Security Advisory: Expat vulnerabilities CVE-2012-0876 and CVE-2012-1148 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16949.htm… *** Splunk Enterprise and Splunk Light Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032859 *** Squid CONNECT Method Peer Response Processing Flaw Lets Remote Users Bypass Security Controls *** --------------------------------------------- http://www.securitytracker.com/id/1032873 *** PHP 5.x Security Updates, (Sun, Jul 12th) *** --------------------------------------------- PHP 5.6.11, 5.5.27 and 5.4.43 were updated fixing numerous bugs in the various components of PHP including CVE-2015-3152. PHP recommend testing and upgrading to the current release. The binaries and packages are available here and the release notes here. [1] http://www.php.net/ChangeLog-5.php [2] http://windows.php.net/download/ ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19907&rss *** Joomla J2Store 3.1.6 SQL Injection *** --------------------------------------------- Topic: Joomla J2Store 3.1.6 SQL Injection Risk: Medium Text:J2Store v3.1.6, a Joomla! extension that adds basic store functionality to a Joomla! instance, suffered from two unauthenticate... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070053 *** DFN-CERT-2015-0907 FreeRADIUS: Eine Schwachstelle ermÖglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0907/ *** DFN-CERT-2015-1030 strongSwan: Zwei Schwachstellen ermöglichen das Ausspähen von Informationen und Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1030/

1 0

Tageszusammenfassung - Freitag 10-07-2015
by Daily end-of-shift report 10 Jul '15

10 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-07-2015 18:00 − Freitag 10-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco TelePresence products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39798 http://tools.cisco.com/security/center/viewAlert.x?alertId=39802 http://tools.cisco.com/security/center/viewAlert.x?alertId=39801 http://tools.cisco.com/security/center/viewAlert.x?alertId=39795 http://tools.cisco.com/security/center/viewAlert.x?alertId=39796 http://tools.cisco.com/security/center/viewAlert.x?alertId=39800 http://tools.cisco.com/security/center/viewAlert.x?alertId=39797 *** VMSA-2015-0005 *** --------------------------------------------- VMware Workstation, Player and Horizon View Client for Windows do not set a discretionary access control list (DACL) for one of their processes. This may allow a local attacker to elevate their privileges and execute code in the security context of the affected process. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0005.html *** The Massive OPM Hack Actually Hit 21 Million People *** --------------------------------------------- The massive hack that struck the US Office of Personnel Management affected some 21.5 million people, all of them people who had information stolen about them from a backgrounds investigation database used for evaluating people who sought classified clearances from the government. --------------------------------------------- http://www.wired.com/2015/07/massive-opm-hack-actually-affected-25-million/ *** Yubikeys Zwei-Faktor-Authentifizierung unter Linux nutzen *** --------------------------------------------- Mit Hilfe des Yubikeys lässt sich eine verschlüsselte Systempartition unter Linux zusätzlich per Zwei-Faktor-Authentifizierung absichern. In dieser Kombination kann auch ein bequemeres Kennwort genutzt werden. --------------------------------------------- http://www.golem.de/news/systemverschluesselung-yubikeys-zwei-faktor-authen… *** Magento-Patch: Update soll Kundendaten-Leck stopfen *** --------------------------------------------- Im Shop-System Magento klaffen Lücken, die es Angreifern erlauben, Admin-Konten zu kapern und Kundendaten auszulesen. Der Hersteller hat jetzt einen Patch veröffentlicht, der Abhilfe schaffen soll. --------------------------------------------- http://heise.de/-2747984 *** Hacking Team Shows the World How Not to Stockpile Exploits *** --------------------------------------------- Bank robber Willie Sutton’s famous line about why he robs banks—“because that’s where the money is”—was particularly apt this week after the Italian firm Hacking Team was hacked and at least two zero-day exploits the firm possessed were spilled to the public, along with about 400 gigabytes of company emails and other data. --------------------------------------------- http://www.wired.com/2015/07/hacking-team-shows-world-not-stockpile-exploit… *** Rootkits: User Mode & Kernel Mode - Part 1 *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. In this Part we will learn .. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Programmier-Tipps für die BIOS-Backdoor *** --------------------------------------------- Der Hacker Cr4sh erklärt, wie er eine Hintertür in die UEFI-Firmware eines Intel-Mainboards einbaut. Dabei zeigen sich einmal mehr kritische Lücken in der x86-Plattform, vor allem beim System Management Mode. --------------------------------------------- http://heise.de/-2748219

1 0

Tageszusammenfassung - Donnerstag 9-07-2015
by Daily end-of-shift report 09 Jul '15

09 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-07-2015 18:00 − Donnerstag 09-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Hacking Team Flash Zero-Day Tied To Attacks In Korea and Japan... on July 1 *** --------------------------------------------- Earlier this week several vulnerabilities were disclosed as part of the leak of information from the Italian company Hacking Team. We've noted that this exploit is now in use by various exploit kits. However, feedback provided by the Smart Protection Network also indicates that this exploit was also used in limited attacks in Korea and Japan.... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ys8noghmsHc/ *** Ding! Your RAT has been delivered *** --------------------------------------------- Talos is constantly observing malicious spam campaigns delivering various different types of payloads. Common payloads include things like Dridex, Upatre, and various versions of Ransomware. One less common payload that Talos analyzes periodically are Remote Access Trojans or RATs. A recently observed spam campaign was using freeware remote access trojan DarkKomet (a.k.a DarkComet). This isn't a novel approach since threat actors have been leveraging tools like DarkKomet or Hawkeye... --------------------------------------------- http://blogs.cisco.com/security/talos/darkkomet-rat-spam *** Finnland: 17-jähriger Botnetz-Betreiber verurteilt *** --------------------------------------------- Über 50.000 Rechner für ein Botnetz gekapert, DDoS-Attacken geritten und Kreditkartendaten geklaut: Ein 17-jähriger Finne, angeblich Mitglied der Hackergruppe Lizard Squad, wird zu zwei Jahren auf Bewährung verurteilt. --------------------------------------------- http://heise.de/-2745646 *** Detecting Random - Finding Algorithmically chosen DNS names (DGA), (Thu, Jul 9th) *** --------------------------------------------- Most normal user traffic communicates via a hostname and not an IP address. So looking at traffic communicating directly by IP with no associated DNS request is a good thing do to. Some attackers use DNS names for their communications. There is also malware such as Skybot and the Styx exploit kit that use algorithmically chosen host name rather than IP addresses for their command and control channels. This malware uses what has been called DGA or Domain Generation Algorithms to create random... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19893&rss *** Happy Video Game Day 2015 *** --------------------------------------------- Gamers are being targeted more and more by malware, trojans, and keyloggers, especially those that participate in pay-to-play games and MMORPGs (Massively Multiplayer Online Role-Playing Game). Your accounts, personal identity, banking information and even credit card numbers can be stolen if you are playing without a cyber-security solution. The PC gaming market is increasing rapidly and is expected to reach $30.9 Billion in 2016, and with that, the targets are getting bigger and more... --------------------------------------------- http://www.webroot.com/blog/2015/07/08/happy-video-game-day-2015 *** Cisco PSIRT reporting Customers affected by ASA VPN DoS attacks, (Thu, Jul 9th) *** --------------------------------------------- Patch your firewalls! 2015-July-08 UPDATE:">Cisco PSIRT is aware of disruption to some Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this Security Advisory. Traffic causing the disruption was isolated to a specific source IPv4 address. Cisco has engaged the provider and owner of that device and determined that the traffic was sent with no malicious intent. Cisco strongly recommends that customers... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19895&rss *** Sicherheitslücke: OpenSSL akzeptiert falsche Zertifikate *** --------------------------------------------- Ein OpenSSL-Update behebt eine kritische Sicherheitslücke. Mittels einiger Tricks kann ein Angreifer damit ein gewöhnliches Zertifikat zu einer Zertifizierungsstelle machen. Betroffen sind vor allem Clients. --------------------------------------------- http://www.golem.de/news/sicherheitsluecke-openssl-akzeptiert-falsche-zerti… *** OpenSSL CVE-2015-1793: Man-in-the-Middle Attack *** --------------------------------------------- As announced at the beginning of this week, OpenSSL has released the fix for CVE-2015-1793. --------------------------------------------- https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/ *** OpenSSL Security Advisory [9 Jul 2015] *** --------------------------------------------- An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. (original advisory). Reported by Adam Langley and David Benjamin (Google/BoringSSL). --------------------------------------------- https://openssl.org/news/secadv_20150709.txt *** Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-132Project: Administration Views (third-party module)Version: 7.xDate: 2015-July-08Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionAdministration Views module replaces overview/listing pages with actual views for superior usability.The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have --------------------------------------------- https://www.drupal.org/node/2529378

1 0

Tageszusammenfassung - Mittwoch 8-07-2015
by Daily end-of-shift report 08 Jul '15

08 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-07-2015 18:00 − Mittwoch 08-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory for Adobe Flash Player (APSA15-03) *** --------------------------------------------- A Security Advisory (APSA15-03) has been published regarding a critical vulnerability (CVE-2015-5119) in Adobe Flash Player 18.0.0.194 and earlier versions for Windows, .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1223 *** Security Updates Available for Adobe Flash Player (APSB15-16) *** --------------------------------------------- A security bulletin (APSB15-16) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1228 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39675 http://tools.cisco.com/security/center/viewAlert.x?alertId=39643 http://tools.cisco.com/security/center/viewAlert.x?alertId=39641 http://tools.cisco.com/security/center/viewAlert.x?alertId=39623 *** CVE-2015-5119 (HackingTeam 0d - Flash up to 18.0.0.194) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/hackingteam-flash-0d-cve-2015-xxx… *** When ‘int’ is the new ‘short’ *** --------------------------------------------- This is going to be a quick post, just describing a particularly interesting Chrome issue that I found last month; how I found it; and what is interesting about it�I was looking through some Chrome networking code; and I noticed an interesting API design .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/when-int-is-new-short.html *** Windows 10 kann WLAN-Passwörter an Kontakte verteilen *** --------------------------------------------- In Windows 10 lässt sich das WLAN-Passwort automatisch an Facebook-Freunde oder Skype-Kontakte verteilen. Das erspart das lästige Diktieren von Kennwörtern bei Besuch, bringt aber auch Risiken mit sich. --------------------------------------------- http://www.golem.de/news/it-sicherheit-windows-10-kann-wlan-passwoerter-an-… *** Schwachstelle in Nameserversoftware BIND 9 *** --------------------------------------------- Ein Angreifer, der einen Nameserver mit aktivierter DNSSEC-Validierung dazu bringen kann, eine Zone mit speziellem Inhalt abzufragen, kann den Nameserver zum Absturz bringen. --------------------------------------------- https://cert.at/warnings/all/20150708.html *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) - Patches jetzt verfügbar *** --------------------------------------------- Durch Ausnutzen dieser Lücke kann ein Angreifer vermutlich vollständige Kontrolle über betroffene Systeme erlangen. Damit sind alle Daten auf diesen Systemen, sowie alle durch diese erreichbaren (etwa durch Login, VPN etc.) Daten und Systeme gefährdet. --------------------------------------------- https://cert.at/warnings/all/20150708-2.html *** Dyre Banking Trojan Exploits CVE-2015-0057 *** --------------------------------------------- CVE-2015-0057 is a Use-After-Free vulnerability that exists in the win32k.sys component of the Windows Kernel which can be exploited to perform local privilege escalation. The vulnerability was reported to Microsoft by Udi Yavo, and, after the patch .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/dyre_banking_trojan.ht… *** Prenotification: Upcoming Security Updates for Adobe Acrobat and Reader (APSB15-15) *** --------------------------------------------- A prenotification security advisory has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, July 14, 2015. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1232 *** Wild Neutron – Economic espionage threat actor returns with new tricks *** --------------------------------------------- A powerful threat actor known as “Wild Neutron” (also known as “Jripbot” and “Morpho”) has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware. --------------------------------------------- https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-…

1 0

Tageszusammenfassung - Dienstag 7-07-2015
by Daily end-of-shift report 07 Jul '15

07 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-07-2015 18:00 − Dienstag 07-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory: BIG-IQ remote authentication vulnerability CVE-2015-4637 *** --------------------------------------------- When remote authentication is configured on the BIG-IQ system for a LDAP server that allows anonymous BIND operations, a unauthenticated user may obtain an authentication token from the REST API for any known (or guessed) LDAP user account and will receive all the access and privileges of that user account for REST API calls. (CVE-2015-4637) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16861.htm… *** Fraudulent BatteryBot Pro App Yanked from Google Play *** --------------------------------------------- A malicious Android app spoofing the popular BatteryBot Pro app has been pulled from Google Play. Researchers at Zscaler reported the app, which had a package name of com.polaris.BatteryIndicatorPro. The app requested excessive permissions from the user in an attempt to get full control of an .. --------------------------------------------- http://threatpost.com/fraudulent-batterybot-pro-app-yanked-from-google-play… *** Malvertisement - A Nuclear EK Tale *** --------------------------------------------- Over the past couple of years delivering malware via advertisements, or "malvertisement," has become one of the most popular methods of distribution for exploit kits. Like most trends in the world of Internet security, the longer it endures - the .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Malvertisement-%e2%80%9… *** Social Engineering - A Case Study *** --------------------------------------------- In this article, I am going to illustrate a real life social engineering hack that I did it for my friend. My friend saw some property ads on internet. He filled the query form for that ad, and after a day he got a call fraudulent call .. --------------------------------------------- http://resources.infosecinstitute.com/social-engineering-a-case-study/ *** Two major IT-Security Myths debunked *** --------------------------------------------- There are two statements G DATA’s security experts hear and read time and again: “I do not surf on porn websites, my computer can’t get infected” as well as “my computer does not hold anything valuable and I have nothing to hide – why should I be a target?” It would be a pleasure to confirm this, but, unfortunately, we do not live in an ideal world. The company’s latest Malware Report underlines why such sentences should be regarded as myths and IT-Security is important for everyone. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/two-major-it-security-myths-deb… *** NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8081 *** NewStatPress <= 1.0.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8080 *** Safer Internet *** --------------------------------------------- Anna is the director of a small kindergarten in Zurich. To give the kindergarten a home on the Internet, she registered a domain name and put up a website where parents can get up-to-date information about the kindergarten. A friend .. --------------------------------------------- http://securityblog.switch.ch/2015/07/07/safer-internet/ *** Kritischer OpenSSL-Patch voraus *** --------------------------------------------- Mit einer kurzen Notiz verkündet Mark J. Cox, dass man Donnerstag, den 9. Juli, ein Sicherheits-Update für OpenSSL veröffentlichen wolle. Dies sei der höchsten Sicherheitsstufe zuzurechnen (high). Das bedeutet, dass gängige Konfigurationen betroffen sind und die Lücke sich wahrscheinlich ausnutzen lässt, um Denial-of-Service-Angriffe durchzuführen, Daten zu klauen oder sogar betroffene System zu kapern. --------------------------------------------- http://heise.de/-2739804 *** Landeskriminalamt Salzburg warnt vor gefälschten Paketdienst-E-Mails *** --------------------------------------------- In Salzburg sind derzeit verstärkt Internet-Betrüger aktiv. Die Polizei warnt akut vor gefälschten E-Mails im Namen bekannter Paketdienste, die vorgeben, dass eine Postsendung unterwegs sei. Über einen Link könne man den aktuellen Paketstatus abrufen. Ein Klick darauf installiert in Wirklichkeit aber die Schadsoftware "CryptoLocker", welche die auf der Festplatte gespeicherten Daten verschlüsselt. --------------------------------------------- http://derstandard.at/2000018700461 *** Fuzzing: Auf Fehlersuche mit American Fuzzy Lop *** --------------------------------------------- Programme testweise mit massenhaft fehlerhaften Daten zu füttern, ist eine effektive Methode, um Fehler zu finden. Das sogenannte Fuzzing ist schon seit Jahrzehnten bekannt, doch bessere Tools und einige spektakuläre Funde von Sicherheitslücken haben zuletzt das Interesse daran erneut geweckt. --------------------------------------------- http://www.golem.de/news/fuzzing-auf-fehlersuche-mit-american-fuzzy-lop-150… *** New Android Malware Family Evades Antivirus Detection by Using Popular Ad Libraries *** --------------------------------------------- Unit 42 discovered a new family of Android malware that successfully evaded all antivirus products on the VirusTotal web service. We named this malware family 'Gunpoder' based on the main malicious component name, .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/new-android-malware-fami… *** Hacked Hacking Team *** --------------------------------------------- Wie ja seit gestern gross durch die diversen Medien getrommelt wird (siehe etwa heise.de, derstandard.at), wurde das Unternehmen "Hacking Team" anscheinend selbst Opfer eines Angriffs. In den dabei geleakten Daten sind auch etliche Hinweise auf bislang unbekannte Exploits ("0-days") zu finden. Leider fehlt uns die Kapazität, die gesamten geleakten Daten (gut 160.000 Dateien mit insg. rund 400GB!) in endlicher Zeit selbst zu analysieren, daher müssen wir uns dabei auf die Community verlassen. --------------------------------------------- http://www.cert.at/services/blog/20150707141314-1556.html *** Attack of the Zombie Orkut Phishing Pages *** --------------------------------------------- Sometimes long dead websites are targeted by phishing pages. When those sites made use of single sign-on, the danger will never quite go away. Orkut may be gone, but the fake login pages persist .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/07/attack-of-the-zombie-orkut…

1 0

Tageszusammenfassung - Montag 6-07-2015
by Daily end-of-shift report 06 Jul '15

06 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-07-2015 18:00 − Montag 06-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** [20150602] - Core - CSRF Protection *** --------------------------------------------- http://developer.joomla.org/security-centre/618-20150602-core-remote-code-e… *** [20150601] - Core - Open Redirect *** --------------------------------------------- http://developer.joomla.org/security-centre/617-20150601-core-open-redirect… *** This 20-year-old Student Has Written 100 Malware Programs in Two Years *** --------------------------------------------- Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around .. --------------------------------------------- http://thehackernews.com/2015/07/student-hacker.html *** A .BUP File Is An OLE File *** --------------------------------------------- Yesterday I mentioned that McAfee quarantine files on Windows (.BUP extension) are actually OLE files. Im going to write a couple of diary entries highlighting some file types that are OLE files, and .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19869 *** MMD-0036-2015 - KINS (or ZeusVM) v2.0.0.0 tookit (builder & panel) leaked. *** --------------------------------------------- The background KINS (or ZeusVM to be precised) v2.0.0.0 tookit (builder & panel) was leaked and spread all over the internet. On Jun 26th 2015 we were informed about this and after several internal discussion, considering that: "so .. --------------------------------------------- http://blog.malwaremustdie.org/2015/07/mmd-0036-2015-kins-or-zeusvm-v2000.h… *** A fileless Ursnif doing some POS focused reco *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.… *** BizCN gate actor changes from Fiesta to Nuclear exploit kit *** --------------------------------------------- Introduction An actor using gates registered through BizCN recently switched from Fiesta to Nuclear exploit kit (EK). This happened around last month, and we first noticed the change on 2015-06-15. I started writing about this actor in 2014 .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19875 *** Don't Be Fooled By Phony Online Reviews *** --------------------------------------------- The Internet is a fantastic resource for researching the reputation of companies with which you may wish to do business. Unfortunately, this same ease-of-use can lull the unwary into falling for marketing scams originally perfected .. --------------------------------------------- http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/ *** Spionagefirma Hacking Team: "Feind des Internets" selbst gehackt *** --------------------------------------------- Die italienische Überwachungsfirma Hacking Team wurde selbst Opfer eines massiven Hacks: Eindringlinge konnten rund 480 GB an internen Daten übernehmen und diese als Download bereitstellen. Auch der Twitter-Account des Unternehmens wurde übernommen und in "Hacked Team" umbenannt. Die veröffentlichten Informationen .. --------------------------------------------- http://derstandard.at/2000018630550 *** Blue-Pill-Lücke in Xen geschlossen *** --------------------------------------------- In der langen Liste der Sicherheits-Verbesserungen von Xen 4.5.1 finden sich auch eine Lücke, die den Ausbruch aus einer virtuellen Maschine erlaubt - und ein geheimnisvoller, noch undokumentierte Eintrag. --------------------------------------------- http://heise.de/-2736158 *** ManageEngine Password Manager Pro 8.1 SQL Injection *** --------------------------------------------- An authenticated user (even the guest user) is able to execute arbitrary SQL code using a forged request to the SQLAdvancedALSearchResult.cc. The SQL query is build manually and is not escaped properly in the AdvanceSearch.class of AdventNetPassTrix.jar. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070020 *** Insider Threats Defined *** --------------------------------------------- According to the second annual SANS survey on the security of the financial services sector, the number one threat companies are concerned about doesn’t relate to nation-states, organised criminal gangs or ‘APTs’. Rather the main worry revolves around insider threats – but what exactly is an insider threat and what can be done to detect and respond to these threats? --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/insider-threats-defined *** How to Deal with Reverse Domain Name Hijacking *** --------------------------------------------- The fact that one owns a trademark which is identical or confusingly similar to a domain name does not necessarily mean that she is entitled to that domain name. For .. --------------------------------------------- http://resources.infosecinstitute.com/how-to-deal-with-reverse-domain-name-… *** Rätselaufgaben gegen DDoS-Angriffe auf TLS *** --------------------------------------------- Ein Akamai-Mitarbeiter beschreibt, wie mit einfachen Rechenaufgaben DDoS-Angriffe durch Clients auf TLS-Verbindungen minimiert werden könnten. Die Idee ist zwar noch ein Entwurf, könnte aber als Erweiterung für TLS 1.3 standardisiert werden. --------------------------------------------- http://www.golem.de/news/ietf-raetselaufgaben-gegen-ddos-angriffe-auf-tls-1… *** AWS Best Practices for DDoS Resiliency (PDF) *** --------------------------------------------- http://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf *** No one expect command execution ! *** --------------------------------------------- Unix is a beautiful world where your shell gives you the power of launching any command you like. But sometimes, command can be used to launch another commands, and thats sometimes unexpected. --------------------------------------------- http://0x90909090.blogspot.fr/2015/07/no-one-expect-command-execution.html

1 0

Tageszusammenfassung - Freitag 3-07-2015
by Daily end-of-shift report 03 Jul '15

03 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-07-2015 18:00 − Freitag 03-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory: PHP vulnerability CVE-2015-4024 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16826.html *** Angler Exploit Kit Evasion Techniques Keep Cryptowall Thriving *** --------------------------------------------- Since the Angler Exploit Kit began pushing the latest version of Cryptowall ransomware, the kit has gone to great lengths to evade detection from IDS and other security technologies. The latest tactic is an almost-daily change to URL patterns used by the kit in HTTP GET requests for the Angler landing .. --------------------------------------------- http://it.slashdot.org/story/15/07/02/1829244/angler-exploit-kit-evasion-te… *** Plex: Foren des Media Servers gehackt *** --------------------------------------------- Unbekannten Angreifern ist es offenbar gelungen das zum Service gehörige Forum zu hacken, und Zugriff auf sensible Daten zu erhalten. Neben Mail-Adressen sollen dabei auch Passwort-Hashes, private Nachrichten und IP-Adressen abgegriffen worden sein. ... So wurden alle betroffenen User mittlerweile per .. --------------------------------------------- http://derstandard.at/2000018475799/Plex-Foren-des-Media-Servers-gehackt *** Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39612 *** DSA-3299 stunnel4 - security update *** --------------------------------------------- Johan Olofsson discovered an authentication bypass vulnerability inStunnel, a program designed to work as an universal SSL tunnel fornetwork daemons. When Stunnel in .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3299 *** REcon Recap: Here's What Caught My Eye *** --------------------------------------------- A few weeks ago I was fortunate enough to attend REcon in Montreal, Canada. This conference focuses on reverse engineering and exploitation techniques and has been .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/recon-recap/ *** WordPress File Upload <= 2.7.6 - Multiple Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8070 *** Sicherheitsrisiko: LGs Update-App für Smartphones ist anfällig *** --------------------------------------------- Smartphones von LG sind aufgrund einer schlecht umgesetzten SSL-Verschlüsselung anfällig für Man-in-the-Middle-Attacken. Offenbar weiß der Hersteller schon länger davon, ein Patch soll das Problem beheben - auf manchen Geräten ist dieser aber noch nicht angekommen. --------------------------------------------- http://www.golem.de/news/sicherheitsrisiko-lgs-update-app-fuer-smartphones-… *** Viele VPNs plaudern wahre Identität ihrer Nutzer aus *** --------------------------------------------- Forscher finden grobe Implementationsprobleme - IPv6 und DNS-Abfragen unterwandern Sicherheit --------------------------------------------- http://derstandard.at/2000018498920 *** Mozilla: Firefox 39 schmeisst alte Krypto raus *** --------------------------------------------- SSLv3 ist aus Firefox 39 endgültig entfernt worden, und RC4 ist nur noch temporär für einige wenige Seiten erlaubt. Das Mozilla-Team erweitert den Schutz des Browsers vor Malware, daneben gibt es noch viele kleinere Neuerungen. --------------------------------------------- http://www.golem.de/news/mozilla-firefox-39-schmeisst-alte-krypto-raus-1507… *** Kovter AdFraud is updating Flash Player (and Internet Explorer) *** --------------------------------------------- Checking my systems I noticed multiple VM trying to grab last version of Flash and thought they were not properly setup allowing Flash Player to auto-update (which we do not want obviously - we want to keep them exploitable and also avoid behavioural/network noise). --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/kovter-adfraud-is-updating-flash-… *** l+f: Noch mehr Hintertüren bei Cisco *** --------------------------------------------- http://heise.de/-2734480 *** Apple: EFI-Sicherheits-Update nicht für ältere Macs *** --------------------------------------------- Das Sicherheits-Update, das eine mögliche Modifikation der Firmware verhindert, steht zwar für ältere OS-X-Versionen zur Verfügung – lässt sich jedoch nur auf jüngeren Macs installieren. --------------------------------------------- http://heise.de/-2735051

1 0

Tageszusammenfassung - Donnerstag 2-07-2015
by Daily end-of-shift report 02 Jul '15

02 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-07-2015 18:00 − Donnerstag 02-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Attackers Revive Deprecated RIPv1 Routing Protocol in DDoS Attacks *** --------------------------------------------- An advisory from Akamai warns of a recent reflection style DDoS attack in which the deprecated RIPv1 routing protocol was leveraged against targets. --------------------------------------------- http://threatpost.com/attackers-revive-deprecated-ripv1-routing-protocol-in… *** EMC Documentum D2 Input Validation Flaw Lets Remote Authenticated Users Obtain Potentially Sensitive Information *** --------------------------------------------- A remote authetnicated user can send specially crafted data to inject data query language (DQL) commands and obtain potentially sensitive information from the database on the target system. ... The D2CenterstageService.getComments method is affected [CVE-2015-0547]. ... The D2DownloadService.getDownloadUrls method is affected [CVE-2015-0548]. --------------------------------------------- http://www.securitytracker.com/id/1032769 *** Updated Point-to-Point Encryption standard now provides more flexibility *** --------------------------------------------- The Payment Card Industry Security Standards Council (PCI SSC) published an important update to one of its eight security standards, simplifying the development and use of Point-to-Point Encryption (P2PE) solutions that make payment card data unreadable and less valuable to criminals if stolen in a breach. --------------------------------------------- http://www.net-security.org/secworld.php?id=18581 *** Final Year Dissertation Paper Release: An Evaluation of the Effectiveness of EMET 5.1 *** --------------------------------------------- My paper covers three separate exploits that I converted to try bypass EMET 5.1s protections as best I could and the techniques that I used to do so as well as how successful EMET 5.1 was at preventing me from exploiting the vulnerable programs. --------------------------------------------- http://tekwizz123.blogspot.co.at/2015/07/final-year-dissertation-paper-rele… *** ENISA's Udo Helmbrecht at EPP Hearing on cybersecurity *** --------------------------------------------- ENISA's Udo Helmbrecht participated at the EPP Hearing on data driven security, which took place today 1st July 2015, at the European Parliament in Brussels. Topics discussed included: Session I: New trends in digital technology developments and cyber threats to security Session II: Fighting crime: use of new technologies and use of data Session III: Cyber Security: ensuring security and safety on state and individual levels --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa2019s-udo-helmbrecht-at-ep… *** How safe is the Windows 10 Wi-Fi sharing feature? *** --------------------------------------------- ... what worries security experts is the fact that it allows users to share access to their password-protected Wi-Fi networks with their Outlook.com contacts, Skype contacts, and Facebook friends. ... While this feature can come very handy, it could also open users to security risks. --------------------------------------------- http://www.net-security.org/secworld.php?id=18584 *** Cisco Security Advisories/Vulnerability Alerts *** --------------------------------------------- Cisco Unified Communications Domain Manager Default Static Privileged Account Credentials http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39611 --------------------------------------------- Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39583 --------------------------------------------- Cisco Digital Content Manager Message Processing Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39556 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 1-07-2015
by Daily end-of-shift report 01 Jul '15

01 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-06-2015 18:00 − Mittwoch 01-07-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** What is Wi-Fi Sense and Why Does It Want Your Facebook Account? *** --------------------------------------------- Wi-Fi Sense is a feature built into Windows 10. You may see a pop-up saying "Wi-Fi Sense needs permission to use your Facebook account." It also works with Outlook.com and Skype contacts. This feature allows you to share Wi-Fi login information - network names and passphrases - with your friends. It's designed to automatically connect Windows 10 devices to shared networks. ... Wi-Fi Sense was originally a Windows Phone 8.1 feature that made the jump to desktop PCs and tablets with Windows 10. --------------------------------------------- http://www.howtogeek.com/219700/what-is-wi-fi-sense-and-why-does-it-want-yo… *** EU-Kompromiss zu Meldepflichten bei Cyberangriffen steht *** --------------------------------------------- Betreiber "wesentlicher" Infrastrukturen und Dienste in der EU müssen bald Cyberangriffe melden, für Digitalplattformen wie soziale Netzwerke sollen abgestufte Regeln gelten. Darauf haben sich EU-Rat und Parlament geeinigt. --------------------------------------------- http://www.heise.de/newsticker/meldung/EU-Kompromiss-zu-Meldepflichten-bei-… *** Apple Patches Dozens of Flaws in iOS 8.4, OS X 10.10.4 *** --------------------------------------------- Apple has released new versions of iOS and OS X, both of which include a significant number of security patches, several for bugs that can lead to remote code execution and other serious issues. Version 8.4 of iOS contains fixes for more than 30 security vulnerabilities, including bugs in the iOS kernel, WebKit, and CoreText. --------------------------------------------- http://threatpost.com/apple-patches-dozens-of-flaws-in-ios-8-4-os-x-10-10-4… *** ZDI-15-275: (0Day) SolarWinds Storage Manager AuthenticationFilter Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-275/ *** TYPO3 CMS 6.2.14 and 7.3.1 released *** --------------------------------------------- We are announcing the release of the following TYPO3 CMS updates: TYPO3 CMS 6.2.14 LTS TYPO3 CMS 7.3.1 Both versions are maintenance releases and contain bug and security fixes. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6214-and-731-released/ *** Apple gets around to fixing those 77 security holes in OS X Yosemite *** --------------------------------------------- Your OS X box can still be owned by, well, just about everything Apple has released a series of security updates to address 77 CVE-listed security vulnerabilities in OS X Yosemite. --------------------------------------------- http://www.theregister.co.uk/2015/06/30/apple_finally_gets_around_to_fixing… *** A third of iThings open to VPN-hijacking, app-wrecking attacks *** --------------------------------------------- Masques off: Researchers detail five ways to wreck Apple stuff A trio of FireEye researchers have reported twin app-demolishing iOS vulnerabilities Apple has partially fixed in its latest update that could wreck core apps such as the App Store and Settings. --------------------------------------------- http://www.theregister.co.uk/2015/07/01/masque_attack_ios_fireeye/ *** June 2015 Android malware review from Doctor Web *** --------------------------------------------- PRINCIPAL TRENDS IN JUNE - Activity of banking Trojans - Emergence of new downloader - Trojans Emergence of new Android ransomware - Growing number of SMS Trojans --------------------------------------------- http://news.drweb.com/show/?i=9511&lng=en&c=9 *** Cisco Vulnerability Alerts *** --------------------------------------------- Cisco Nexus Devices NX-OS Software Command-Line Interpreter Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39569 --------------------------------------------- Cisco Nexus Devices Python Subsystem Local Privilege Escalation Vulnerabilities http://tools.cisco.com/security/center/viewAlert.x?alertId=39571 --------------------------------------------- Cisco Unified MeetingPlace SQL Injection Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39570 --------------------------------------------- Cisco Nexus 7000 Devices Virtual Device Context Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39568 --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961048 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects PowerKVM (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=isg3T1022395 --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961049 --------------------------------------------- IBM Security Bulletin: CICS Transaction Gateway for Multiplatforms http://www.ibm.com/support/docview.wss?uid=swg21903636 --------------------------------------------- IBM Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web version 7.0 software installations and IBM Tivoli Access Manager for e-business (CVE-2015-1920) http://www.ibm.com/support/docview.wss?uid=swg21960450 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in the FreeType library affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960562 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in FreeType library affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958900 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960668 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958903 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Web (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21960456 --------------------------------------------- Vulnerabilities in NTPv4 affect AIX http://www.ibm.com/support/ --------------------------------------------- IBM Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917) http://www.ibm.com/support/docview.wss?uid=swg21883851 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a kexec-tools vulnerability (CVE-2015-0267) http://www.ibm.com/support/docview.wss?uid=isg3T1022407 --------------------------------------------- IBM Security Bulletin: Dual_EC_DRBG vulnerability and RC4 stream cipher vulnerability affect WebSphere Transformation Extender Secure Adapter Collection (CVE-2007-6755, CVE-2015-2808) http://www.ibm.com/support/docview.wss?uid=swg21959577 --------------------------------------------- IBM Security Bulletin: XSS vulnerability in Error dialog which can execute scripts injected into addressability and comments features that affects IBM Case Manager (CVE-2015-1979) http://www.ibm.com/support/docview.wss?uid=swg21959695 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Sterling Connect:Express for UNIX (CVE-2015-4000, CVE-2014-8176, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792) http://www.ibm.com/support/docview.wss?uid=swg21959308 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cognos Command Center (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960508 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects the Enterprise Common Collector component of the IBM Tivoli zEnterprise Monitoring Agent (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960019 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM InfoSphere Optim Performance Manager (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21959591 --------------------------------------------- IBM Security Bulletin: JavaScript evaluation vulnerability in IBM Business Process Manager (CVE-2015-1961) http://www.ibm.com/support/docview.wss?uid=swg21959052 --------------------------------------------- IBM Security Bulletin: IBM Security Identity Manager Virtual Appliance affected by Java vulnerabilities (CVE-2015-0138 CVE-2015-0204 CVE-2015-1914 CVE-2015-2808 ) http://www.ibm.com/support/docview.wss?uid=swg21960515 --------------------------------------------- IBM Security Bulletin: Potential denial of service may affect IBM WebSphere Application Server shipped with IBM Tivoli Network Performance Manager (CVE-2015-1829) http://www.ibm.com/support/docview.wss?uid=swg21960364 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a bind vulnerability (CVE-2015-1349) http://www.ibm.com/support/docview.wss?uid=isg3T1022295 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a qemu vulnerability (CVE-2014-9718) http://www.ibm.com/support/docview.wss?uid=isg3T1022294 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Access Manager for Mobile (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) http://www.ibm.com/support/docview.wss?uid=swg21959597 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Mobile (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21959604 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance v2 API unrestricted path traversal (CVE-2014-9493, CVE-2015-1195) http://www.ibm.com/support/docview.wss?uid=nas8N1020785 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by Apache Qpid security vulnerabilities (CVE-2015-0203, CVE-2015-0223, CVE-2015-0224) http://www.ibm.com/support/docview.wss?uid=nas8N1020787 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959068 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959071 --------------------------------------------- IBM Security Bulletin: XSS Vulnerability in IBM Jazz Foundation affects multiple IBM Rational products based on IBM Jazz technology (CVE-2015-0130) http://www.ibm.com/support/docview.wss?uid=swg21960407 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 30-06-2015
by Daily end-of-shift report 30 Jun '15

30 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-06-2015 18:00 − Dienstag 30-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Windows kerberos ticket theft and exploitation on other platforms *** --------------------------------------------- I decided to take a look at how the kerberos tickets can be dumped from a Windows target and re-used on Linux. It was surprisingly easy to accomplish. --------------------------------------------- https://mikkolehtisalo.wordpress.com/2015/06/29/copying-windows-kerberos-ti… *** Why vulnerability disclosure shouldn't be a marketing tool *** --------------------------------------------- So now we have three approaches to vulnerability disclosure: full disclosure, responsible disclosure, and marketing disclosure. My concern with the latter is that by its very nature it will get more coverage in both the IT industry and mainstream media. ... In the cases where the vulnerability does affect the organization, the security team is called into action to remediate it, but this remediation may be based more on the impact the vulnerability has had on the news headlines rather than on the impact it actually may have on the environment, This results in already overstretched security teams being distracted from other core tasks. --------------------------------------------- http://www.net-security.org/article.php?id=2318 *** DSA-3297 unattended-upgrades - security update *** --------------------------------------------- It was discovered that unattended-upgrades, a script for automaticinstallation of security upgrades, did not properly authenticatedownloaded packages when the force-confold or force-confnew dpkg optionswere enabled via the DPkg::Options::* apt configuration. --------------------------------------------- https://www.debian.org/security/2015/dsa-3297 *** How Malware Campaigns Employ Google Redirects and Analytics, (Tue, Jun 30th) *** --------------------------------------------- The email message sent to the bank employee claimed that the sender received a wire transfer from the recipients organization and that the sender wanted to confirm that the payment went through without issues. The victim was encouraged to click a link that many people would considersafe, in part because it began with https://www.google.com/. How would you examine the nature of this email? Examining MSG and EML Files on Linux One way to analyze the suspicious message saved as an Outlook .msg file --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19843&rss *** Tearing Apart a Datto *** --------------------------------------------- Datto devices are becoming a popular backup solution for small to medium sized businesses. They are easy to use and well equipped out of the box. We recently found ourselves in an engagement where one of these devices was accessible via the LAN. Gaining access to backups is a bit of a goldmine during an assessment; unrestricted access to file shares, configuration information, extracting hashes from the NTDS.dit file, and a multitude of other things. --------------------------------------------- http://silentbreaksecurity.com/tearing-apart-a-datto/ *** Vulnerability in Citrix NetScaler Application Deliver Controller and NetScaler Gateway Management Interface Could Result in Arbitrary Command Injection *** --------------------------------------------- A vulnerability has been identified in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway Management Interface that could allow an authenticated malicious user to execute shell commands on the appliance. CVE: CVE-2015-5080 --------------------------------------------- http://support.citrix.com/article/CTX201149 *** Viele Android-Geräte über Debugger angreifbar *** --------------------------------------------- Über eine Schwachstelle im Debugger können Angreifer den Inhalt des Hauptspeichers von über 90 Prozent aller Android-Geräte auslesen und so weitere Attacken fahren. --------------------------------------------- http://www.heise.de/newsticker/meldung/Viele-Android-Geraete-ueber-Debugger… *** Analyzing a Facebook Clickbait Worm *** --------------------------------------------- Here at Sucuri we suspect everything, especially when your friends start to share content written in another language with clickbait headlines. If you are not familiar with the term, clickbait is when web content is created in a way that psychologically exploits the reader's curiosity using compelling headlines. When someone clicks on the article to read it, the service promoting the article generates online advertisement revenue. --------------------------------------------- https://blog.sucuri.net/2015/06/analyzing-a-facebook-clickbait-worm.html *** Vulnerabilities in Cisco products*** --------------------------------------------- Cisco Unified IP Phones 9900 Series Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39554 --------------------------------------------- Cisco Unified Communications Domain Manager Information Disclosure Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39557 --------------------------------------------- *** Vulnerabilities in IBM products*** --------------------------------------------- Security Bulletin: Vulnerabilities in libxml2 affect System Networking Products (CVE-2014-0191, CVE-2013-2877, CVE-2014-3660) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098306 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098265 --------------------------------------------- Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Flex System Manager (FSM) SMIA Configuration Tool (CVE-2015-4000) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403 --------------------------------------------- Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098314 --------------------------------------------- Security Bulletin: Vulnerability in RC4 stream cipher affects IBM System Networking RackSwitch (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098302 ---------------------------------------------Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter Switches (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098303 --------------------------------------------- Security Bulletin: Multiple vulnerabilities in xorg-x11-server affect IBM Flex System Manger (FSM) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098372 --------------------------------------------- Security Bulletin: GNU C library (glibc) vulnerability affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware (CVE-2015-0235) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098317 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru Firmware (CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098358 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect IBM System x, BladeCenter and Flex Systems Unified Extensible Firmware Interface (UEFI) (CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098339 --------------------------------------------- IBM Security Bulletin: IBM SmartCloud Analytics - Log Analysis is affected by Open Source Python Vulnerability (CVE-2014-9365) http://www.ibm.com/support/docview.wss?uid=swg21958936 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Endpoint Manager for Remote Control http://www.ibm.com/support/docview.wss?uid=swg21903374 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect Tivoli Endpoint Manager for Remote Control. http://www.ibm.com/support/docview.wss?uid=swg21903373 --------------------------------------------- IBM Security Bulletin: A vulnerability in cURL libcURL affects IBM Tivoli Composite Application Manager for Transactions (CVE-2014-8150) http://www.ibm.com/support/docview.wss?uid=swg21697198 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 29-06-2015
by Daily end-of-shift report 29 Jun '15

29 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-06-2015 18:00 − Montag 29-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** In eigener Sache: CERT.at sucht Verstärkung *** --------------------------------------------- Wir suchen aktuell eine/n ProgrammiererIn - vorerst als Karenzvertretung bis Jahresende. Details siehe https://cert.at/about/jobs/jobs.html --------------------------------------------- http://www.cert.at/services/blog/20150629141329-1553.html *** IETF Officially Deprecates SSLv3 *** --------------------------------------------- The IETF, in RFC7568, declared SSLv3 "not sufficiently secure" and prohibited its use. SSLv3 fallbacks were to blame for the POODLE and BEAST attacks. --------------------------------------------- http://threatpost.com/ietf-officially-deprecates-sslv3/113503 *** NIST Updates Random Number Generation Guidelines *** --------------------------------------------- An anonymous reader writes: Encryption weighs heavily on the public consciousness these days, as weve learned that government agencies are keeping an eye on us and a lot of our security tools arent as foolproof as weve thought. In response to this, the National Institute of Standards and Technology has issued a formal update to its document on how to properly generate a random number - crucial in many types of encryption. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/JJ7XjyjPA9c/nist-updates-ra… *** Lücke im Flash Player: Exploit Kit erhöht Angriffs-Risiko *** --------------------------------------------- Bisher haben Angreifer die in der letzten Woche bekanntgewordene Schwachstelle in Adobes Flash Player nur vereinzelt und gezielt attackiert. Aktuell nutzt jedoch auch das Magnitude Exploit Kit die Lücke aus und vergrößert den Angriffsradius. --------------------------------------------- http://heise.de/-2730795 *** The State of the ESILE/Lotus Blossom Campaign *** --------------------------------------------- As is generally the case with backdoors, ESILE contacts a command-and-control server in order to receive commands from its attacker. How it does this is also a fingerprint of the campaign as well. It uses a URL based on the MAC address of the infected machine's network interface, as well as the current time. ... This distinctive pattern can be used to help spot and block ESILE-related endpoints on an organization's network. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-state-of-the… *** Migrating from SHA-1 to SHA-2 *** --------------------------------------------- Heres a comprehensive document on migrating from SHA-1 to SHA-2 in Active Directory certificates.... --------------------------------------------- https://www.schneier.com/blog/archives/2015/06/migrating_from_.html *** Cyber Security Challenge: Bundesheer sucht Nachwuchs-Hacker *** --------------------------------------------- Qualifikation läuft bis August, Veranstaltung von Cyber Security Austria und Abwehramt organisiert --------------------------------------------- http://derstandard.at/2000018220253 *** Bugtraq: ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities *** --------------------------------------------- Summary: ESRS VE version 3.06 contains security fixes for multiple vulnerabilities that could potentially be exploited by malicious uses to compromise the affected system Insufficient Certificate Validation CVE-2015-0543: CVSSv2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) Cookie Generated with Insufficient Randomness CVE-2015-0544: CVSSv2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) --------------------------------------------- http://www.securityfocus.com/archive/1/535851 *** The Powershell Diaries 2 - Software Inventory, (Mon, Jun 29th) *** --------------------------------------------- After last weeks story, hopefully youve got your problem users accounts identified. With that worked out, lets see about finding problem applications. We all need a handle on what applications are installed on workstations for a number of reasons to make sure that when upgrade time comes, that nobody gets left behind that older apps that have security vulnerabilities or have limited function get taken care of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19851&rss *** Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) *** --------------------------------------------- Business recommendation: By combining all vulnerabilities documented in this advisory an unprivileged authenticated remote attacker can gain full system access (root) on the RPRM appliance. This has an impact on all conferences taking place via this RP Resource Manager. Attackers can steal all conference passcodes and join or record any conference. SEC Consult recommends not to use this system until a thorough security review has been performed by security professionals and all identified issues have been resolved. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3-EXT-SA-2015-015: Cross-Site Scripting in extension "404 Page not found handling" (pagenotfoundhandling) *** --------------------------------------------- It has been discovered that the extension "404 Page not found handling" (pagenotfoundhandling) is susceptible to Cross-Site Scripting Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C Affected Versions: version 2.1.0 and below --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** Hacker-Angriff vermutet: Apache Build-Server offline *** --------------------------------------------- Bis jetzt wurde ein Angriff nicht offiziell bestätigt. Auch ist nicht bekannt, ob ein Eingriff in auf den Servern gebaute Software-Pakete stattgefunden hat. Die Build-Systeme der ASF werden unter anderem von OpenOffice, dem Tomcat-Projekt und dem Web-Framework Apache Wicket verwendet. Neben den Build-Servern und der Continuous-Integration-Webseite ist auch das CMS der Apache-Seiten betroffen. --------------------------------------------- http://heise.de/-2731265 *** Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability *** --------------------------------------------- CVE: CVE-2015-4225, CVSS2 Base Score: 5.5 A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (Cisco APIC) could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC for health scoring. An attacker could exploit this vulnerability to gain access to information on the affected system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39529

1 0

Tageszusammenfassung - Freitag 26-06-2015
by Daily end-of-shift report 26 Jun '15

26 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-06-2015 18:00 − Freitag 26-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Magento Platform Targeted By Credit Card Scrapers *** --------------------------------------------- We've been writing a lot about E-Commerce hacks and PCI Compliance recently. The more people buy things online, the more of an issue this will be come and the more important it will .. --------------------------------------------- https://blog.sucuri.net/2015/06/magento-platform-targeted-by-credit-card-sc… *** MMD-0034-2015 - New ELF Linux/DES.Downloader on Elasticsearch CVE-2015-1427 exploit *** --------------------------------------------- This is a tough writing, and will be many addition will be added after the initial release. We are pushed to release this as alert of an on going attack, it is a real malware incident .. --------------------------------------------- http://blog.malwaremustdie.org/2015/06/mmd-0034-2015-new-elf.html *** That shot you heard? SSLv3 is now DEAD *** --------------------------------------------- Its joined the choir invisible We really, really, really mean it this time: take SSL3 and bury .. --------------------------------------------- http://www.theregister.co.uk/2015/06/26/that_shot_you_heard_sslv3_is_now_de… *** EU-Ermittler zerschlagen Ring von Online-Banking-Betrügern *** --------------------------------------------- Verschiedenen Behörden aus Europa haben eine erfolgreiche Operation gegen Cyber-Kriminelle durchgeführt, die im großen Stil über alle Kontinente verteilt Banking-Trojaner eingesetzt haben. --------------------------------------------- http://heise.de/-2729777 *** Windows Server 2003 noch auf Drittel aller Server: Support-Ende im Juli *** --------------------------------------------- Am 14. Juli endet der Support von Windows Server 2003, Server 2003 R2 und Small Business Server 2003. Ab dann wird es für das zwölf Jahre alte System keine neuen Updates, Hotfixes oder Sicherheits-Aktualisierung mehr geben. --------------------------------------------- http://derstandard.at/2000018075592 *** Polycom RealPresence Resource Manager critical vulnerabilities allow surveillance on conferences *** --------------------------------------------- Multiple remote vulnerabilities (arbitrary file disclosure, path traversal, arbitrary file upload, privilege escalation in the web application) combined with local vulnerabilities (sudo misconfiguration, weak filesystem permissions) allow an .. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Siemens Climatix BACnet/IP Communication Module Cross-site Scripting Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an identified cross-site scripting vulnerability in the Siemens Climatix BACnet/IP communication module. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01 *** PACTware Exceptional Conditions Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a handling of exceptional conditions vulnerability in the PACTware Consortium PACTware application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02 *** Latest spam filter test sees significant drop in catch rates *** --------------------------------------------- Despite a drop in catch rates, 15 products earn a VBSpam award, with four earning a VBSpam+ award.Spam is notoriously volatile and thus, while we like to make the news headlines with our tests as much as anyone, we would warn against .. --------------------------------------------- http://www.virusbtn.com/blog/2015/06_26.xml *** ZDI-15-262: HP System Management Homepage Single Sign On Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard System Management Homepage. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-262/

1 0

Tageszusammenfassung - Donnerstag 25-06-2015
by Daily end-of-shift report 25 Jun '15

25 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-06-2015 18:00 − Donnerstag 25-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Paper: Using .NET GUIDs to help hunt for malware *** --------------------------------------------- Tool to extract identifiers incorporated into VirusTotal. The large number of new malware samples found each day hasnt made malware analysis an easier task, and researchers could use anything that helps them automate this task. Today, we publish a paper by Cylance researcher Brian Wallace, who looks at two globally unique identifiers (GUIDs) found in malware created using .NET, which can help link multiple files to the same Visual Studio project. --------------------------------------------- http://www.virusbtn.com/blog/2015/06_24a.xml?rss *** The Powershell Diaries - Finding Problem User Accounts in AD, (Wed, Jun 24th) *** --------------------------------------------- Powershell has gotten a lot of attention lately as a pentesters tool of choice, since it has access to pretty much every low-level system function in the Microsoft ecosystem, and the AV industry isnt dealing well with that yet (aside from ignoring powershell completely that is). But what about day-to-day system administration? Really, the possibilities for admins are just as limitless as for pentesters - thats what Powershell was invented for after all ! --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19833&rss *** Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-129 Project: Shibboleth authentication (third-party module) Version: 6.x, 7.x Date: 2015-June-24 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Description Shibboleth authentication module allows users to log in and get permissions based on federated (SAML2) authentication.The module didnt filter the text that is displayed as a login link. --------------------------------------------- https://www.drupal.org/node/2511518 *** HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-127 Project: HybridAuth Social Login (third-party module) Version: 7.x Date: 2015-June-24 Security risk: 8/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypass Description The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. --------------------------------------------- https://www.drupal.org/node/2511410 *** Web security subtleties and exploitation of combined vulnerabilities, (Thu, Jun 25th) *** --------------------------------------------- The goal of a penetration test is to report all identified vulnerabilities to the customer. Of course, every penetration tester puts most of his effort into finding critical security vulnerabilities: SQL injection, XSS and similar, which have the most impact for the tested web application (and, indeed, it does not hurt a penetration testers ego when such a vulnerability is identified :) However, I strongly push towards reporting of every single vulnerability, no matter how harmless it might appear ... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19837&rss *** Samsung deaktiviert keine Sicherheitsupdates von Windows *** --------------------------------------------- PR-Desaster im Eigenbau: Samsung veröffentlicht ein Tool namens "disable_Windowsupdate.exe". Doch das macht gar nicht das, was der Name vermuten lässt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Samsung-deaktiviert-keine-Sicherheit… *** Von wegen Schutz: NOD32 erlaubt das Kapern von Rechnern *** --------------------------------------------- Statt die Nutzer zu schützen erlaubte NOD32 von Eset es Angreifern, die Rechner der Opfer komplett zu übernehmen. Das Update, welches die Lücke schließt, sollte schleunigst eingespielt werden. --------------------------------------------- http://heise.de/-2728967 *** SSA-142512 (Last Update 2015-06-25): Cross-Site Scripting Vulnerability in Climatix BACnet/IP Communication Module *** --------------------------------------------- SSA-142512 (Last Update 2015-06-25): Cross-Site Scripting Vulnerability in Climatix BACnet/IP Communication Module --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Multiple vulnerabilities in Cisco products *** *** Cisco Wireless LAN Controller Command Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39517 *** Cisco IOS XR MPLS LDP Packet Processing Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39509 *** Cisco Unified Presence Server Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39504 *** Cisco IM and Presence Service Leaked Encrypted Passwords Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39505 *** Cisco IM and Presence Service SQL Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39506

1 0

Tageszusammenfassung - Mittwoch 24-06-2015
by Daily end-of-shift report 24 Jun '15

24 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-06-2015 18:00 − Mittwoch 24-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Operation Clandestine Wolf � Adobe Flash Zero-Day in APT3 PhishingCampaign *** --------------------------------------------- In June, FireEye�s FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability (CVE-2015-3113). The attackers� emails included links to compromised web servers that served either benign content or a malicious Adobe Flash Player file that exploits CVE-2015-3113. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-… *** Digital Snake Oil *** --------------------------------------------- One of the most common complaints we see on our forums, and from our users, concerns a particular category of program called �Registry Optimizers� or �Registry Cleaners� or �Registry Defragmenters�. For this post, we will just refer to them as .. --------------------------------------------- https://blog.malwarebytes.org/social-engineering/2015/06/digital-snake-oil/ *** Websites Hacked Via Website Backups *** --------------------------------------------- The past few months we�ve been spending a good deal of time talking about backups. This is for good reason, they are often your safety net when things go wrong; interestingly enough though, they are often the forgotten pillar of security. It�s why we .. --------------------------------------------- https://blog.sucuri.net/2015/06/websites-hacked-via-website-backups.html *** Cisco AnyConnect Client for Windows Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39466 *** MMD-0033-2015 - Linux/XorDDoS infection incident report (CNC: HOSTASA.ORG) *** --------------------------------------------- This post is an actual malware infection incident of the"Linux/XOR.DDoS" malware, see this previous post as reference, malware was in attempt to infect a real service. Incident details: Source of attack: An attack .. --------------------------------------------- http://blog.malwaremustdie.org/2015/06/mmd-0033-2015-linuxxorddos-infection… *** Analysis and Exploitation of an ESET Vulnerability *** --------------------------------------------- Many antivirus products include emulation capabilities that are intended to allow unpackers to run for a few cycles before signatures are applied. ESET NOD32 uses a minifilter or kext to intercept all disk I/O, which is analyzed and then emulated if .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-… *** Of Privacy, Security, and the Art of Scanning *** --------------------------------------------- With all the recent news and attention on world events the concept and concern around privacy has increased over the last several years. This is an excellent progression of personal protection and should be pursued .. --------------------------------------------- http://blog.shadowserver.org/2015/06/23/of-privacy-security-and-the-art-of-… *** Attacking Ruby Gem Security with CVE-2015-3900 *** --------------------------------------------- A Ruby gem is a standard packaging format used for Ruby libraries and applications. This packaging format allows Ruby software developers a clearly defined format in which they can .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Secu… *** Samsung deliberately disabling Windows Update *** --------------------------------------------- On my home forum Sysnative, a user (wavly) was being assisted with a WU issue, which was going well, aside from the fact that wavlys WU kept getting disabled randomly. It was figured out eventually after using auditpol.exe and registry security .. --------------------------------------------- http://bsodanalysis.blogspot.de/2015/06/samsung-deliberately-disabling-wind… *** Kaspersky hilft Facebook User-PCs nach Viren zu scannen *** --------------------------------------------- Facebook will die Verbreitung von Malware über das soziale Netzwerk eindämmen. Dafür werden nicht nur Profile nach verdächtigen Aktivitäten gescannt. Das Unternehmen bietet Nutzern auch die Möglichkeit an, einen kostenlosen Scan ihres Computers durchzuführen. Seit einiger Zeit .. --------------------------------------------- http://derstandard.at/2000017946165 *** Identifying vulnerable code *** --------------------------------------------- No matter how much care you take during development of any software, security issues creep in. Hence, it is important to get the code reviewed for security loopholes. Code is the only advantage for organizations over the hackers and they need .. --------------------------------------------- http://resources.infosecinstitute.com/identifying-vulnerable-code/ *** Am 30. Juni ist DNSSEC-Day *** --------------------------------------------- Am 30. Juni 2015 veranstalten das BSI, der DENIC und heise online den DNSSEC-Day. Kern der Veranstaltung ist ein Livestreaming, bei dem Fachleute Nutzen und .. --------------------------------------------- http://heise.de/-2723932 *** Results of my recent PostScript Charstring security research unveiled *** --------------------------------------------- Some months ago, I started reverse engineering and investigating the security posture of the Adobe Type Manager Font Driver (ATMFD.DLL) module, which provides support for Type 1 and OpenType fonts in the Windows kernel since Windows NT 4.0, .. --------------------------------------------- http://j00ru.vexillium.org/?p=2520

1 0

Tageszusammenfassung - Dienstag 23-06-2015
by Daily end-of-shift report 23 Jun '15

23 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-06-2015 18:00 − Dienstag 23-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-14) *** --------------------------------------------- A Security Bulletin (APSB15-14) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability (CVE-2015-3113), and Adobe recommends users update their product installations to the latest .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1210 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39439 http://tools.cisco.com/security/center/viewAlert.x?alertId=39440 http://tools.cisco.com/security/center/viewAlert.x?alertId=39455 http://tools.cisco.com/security/center/viewAlert.x?alertId=39457 http://tools.cisco.com/security/center/viewAlert.x?alertId=39459 http://tools.cisco.com/security/center/viewAlert.x?alertId=39460 http://tools.cisco.com/security/center/viewAlert.x?alertId=39377 http://tools.cisco.com/security/center/viewAlert.x?alertId=39458 *** �Free� Proxies Aren�t Necessarily Free *** --------------------------------------------- Netflix, Hulu and a host of other content streaming services block non-U.S. users from viewing their content. As a result, many people residing in or traveling outside of the United States seek to circumvent such restrictions by using services that advertise "free" and "open" Web proxies capable of .. --------------------------------------------- http://krebsonsecurity.com/2015/06/free-proxies-arent-necessarily-free *** Security hole in MacKeeper used to shove malware onto Macs *** --------------------------------------------- According to researchers at BAE, a recent Mac malware infestation was carried out using a security hole in a utility called MacKeeper. --------------------------------------------- https://nakedsecurity.sophos.com/2015/06/22/security-hole-in-mackeeper-used… *** New Dridex infection vector identified - Banking Trojan�s authors use Microsoft Office trick and a legitimate service to infect systems *** --------------------------------------------- Malware authors can sometimes be creative in order to manipulate their human targets on the one hand and to circumvent security products, too. The experts of G DATA�s SecurityLabs analyzed a specially crafted Microsoft Word document .. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/new-dridex-infection-vector-ide… *** XOR DDOS Mitigation and Analysis, (Tue, Jun 23rd) *** --------------------------------------------- I have struggled over the past recent months with a clients environment becoming infected and reinfected with an XOR DDOS trojan. The disruption and reinfection rates were costly at times. The client in question .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19827 *** This Radio Bug Can Steal Laptop Crypto Keys, Fits Inside a Pita *** --------------------------------------------- The list of paranoia-inducing threats to your computer�s security grows daily: Keyloggers, trojans, infected USB sticks, ransomware�and now the rogue falafel sandwich. --------------------------------------------- http://www.wired.com/2015/06/radio-bug-can-steal-laptop-crypto-keys-fits-in… *** mTAN-Trojaner hat es erneut auf Android-Nutzer abgesehen *** --------------------------------------------- Gefälschte E-Mails im Namen der Postbank machen aktuell die Runde und fordern Nutzer dazu auf, eine SSL-Zertifikat-App zu installieren. Dahinter verbirgt sich jedoch ein Trojaner, der unter anderem mTANs für Online-Banking mitschneidet. --------------------------------------------- http://heise.de/-2721682 *** Moose Malware-Part 1 *** --------------------------------------------- In this article series, we will learn about a famous Linux family of malware known as MOOSE, which is used to steal unencrypted traffic over the wire and infect other devices automatically. This malware steals HTTP cookies and performs .. --------------------------------------------- http://resources.infosecinstitute.com/moose-malware-part-1/ *** Edges for file renames and process kills. *** --------------------------------------------- With build 47 ProcDOT introduced brand new edges to visualize situations where a file is being renamed or a process is being killed by some thread. While the latter was quite easy to implement it�s the renaming of files which stands out of the mass of typical frames/events in terms of ProcDOT�s animation capabilities. --------------------------------------------- http://procdot.com/blog_20150623.htm *** Support-Ende beim Windows Server 2003 am 14. Juli *** --------------------------------------------- Länger als Windows XP hat Microsoft sein Server-Betriebssystem derselben Generation mit Sicherheits-Updates versorgt. Aber am 14. Juli ist damit endgültig Schluss. --------------------------------------------- http://www.heise.de/newsticker/meldung/Support-Ende-beim-Windows-Server-200…

1 0

Tageszusammenfassung - Montag 22-06-2015
by Daily end-of-shift report 22 Jun '15

22 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-06-2015 18:00 − Montag 22-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Owning Internet Printing - A Case Study in Modern Software Exploitation *** --------------------------------------------- Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs become unexploitable, .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/owning-internet-printing-case… *** Cacti Input Validation Flaw Permits Cross-Site Scripting and SQL Injection Attacks *** --------------------------------------------- The software does not properly filter HTML code from user-supplied input before displaying the input [CVE-2015-2665]. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The .. --------------------------------------------- http://www.securitytracker.com/id/1032672 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39432 http://tools.cisco.com/security/center/viewAlert.x?alertId=39431 http://tools.cisco.com/security/center/viewAlert.x?alertId=39422 http://tools.cisco.com/security/center/viewAlert.x?alertId=39424 http://tools.cisco.com/security/center/viewAlert.x?alertId=39423 *** Banking Trojan has targeted Bundestag *** --------------------------------------------- After the initial reports on the attacks on the Bundestag (German Federal Parliament), variants of the Swatbanker family are now putting the Bundestags intranet on a watch list. The operators of the botnet are apparently trying to steal access data and server responses associated with this .. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/banking-trojan-has-targeted-bun… *** Microsoft website dedicated to online privacy gets hacked *** --------------------------------------------- Digital Constitution was running outdated of version of WordPress. --------------------------------------------- http://arstechnica.com/security/2015/06/microsoft-website-dedicated-to-onli… *** Microsoft: Meine Lücken schließ' ich nicht *** --------------------------------------------- Sicherheitsexperten geben Details zu Lücken in Internet Explorer heraus, weil Microsoft die Lücken nicht schließen will. --------------------------------------------- http://heise.de/-2718449 *** Standardschlüssel gefährdet SAPs Datenbank Hana *** --------------------------------------------- Bei der Installation wird die Benutzerdatenbank in SAPs Hana mit dem stets gleichen Standardschlüssel abgesichert. Weil dieser nur selten geändert wird, könnten sich Unberechtigte leicht Zugriff auf die dort gespeicherten Administratorkonten verschaffen. --------------------------------------------- http://www.golem.de/news/it-sicherheit-standardschluessel-gefaehrdet-saps-d… *** VMware Workstation: Der Einbruch �über Port COM1 *** --------------------------------------------- Über Schwachstellen in VMwares Workstation und Player ist ein vollständiger Zugriff auf das Wirtssystem aus einem Gastsystem heraus möglich. VMware hat bereits Updates veröffentlicht. --------------------------------------------- http://www.golem.de/news/vmware-workstation-der-einbruch-ueber-port-com1-15… *** Advertising: The Digital Turf War on your Desktop *** --------------------------------------------- https://blog.malwarebytes.org/privacy-2/2015/06/advertising-the-digital-tur… *** XARA-Lücke: Apple kündigt Fix für iOS und OS X an *** --------------------------------------------- Das Sicherheitsproblem, über das unter anderem Passwörter ausgelesen werden könnten, soll demnächst in der Software behoben werden. Zudem versucht sich der iPhone-Hersteller an anderen Lösungen. --------------------------------------------- http://heise.de/-2718624 *** The most common information security mistakes of e-commerces *** --------------------------------------------- Almost every month a new incident involving a big retailer, e-commerce or web platform makes the news headlines. Most retail fraud is now committed online, and in 2014 alone hackers managed to steal more than 61 million records from .. --------------------------------------------- https://www.htbridge.com/blog/the-most-common-information-security-mistakes… *** Adware for OS X distributes Trojans *** --------------------------------------------- Lately, reports about distribution of new malicious and potentially dangerous programs for OS X have been emerging with great frequency. Doctor Web security researches have registered a growing number of various adware and installers .. --------------------------------------------- http://news.drweb.com/show/?i=9502&lng=en&c=9 *** Steal That Car in 60 Seconds *** --------------------------------------------- Introduction Cars are everywhere and they are being upgraded with new technology as often as any other device we use. Taking some inspiration from the movie Knight and Day, .. --------------------------------------------- http://resources.infosecinstitute.com/the-car-in-60-seconds/ *** NSA spionierte österreichische Antiviren-Hersteller aus *** --------------------------------------------- Ikarus und Emsisoft genannt – NSA überwachte E-Mails an Firmen, um Entdeckung von Schadprogrammen mitzubekommen --------------------------------------------- http://derstandard.at/2000017842807 *** Magnitude EK: Traffic Analysis *** --------------------------------------------- Hello and welcome! Recently I have been skilling up in malware analysis. Specifically, my focus has been centred on client-side exploit kits, such common kits include: Angler, Nuclear, Magnitude, Neutrino, RIG... There are quite a few reasons for my new found .. --------------------------------------------- http://www.fuzzysecurity.com/tutorials/21.html *** Android Activtity Security *** --------------------------------------------- Each Android Application is made up of Activity, Service, Content Provider and Broadcast Receiver, which are the basic components of Android. Among those components, An Activity is .. --------------------------------------------- http://translate.wooyun.io/2015/06/22/android-activtity-security.html *** A month with BADONIONS *** --------------------------------------------- A few weeks ago I got the idea of testing how much sniffing is going on in the Tor network by setting up a phishing site where I login with unique password and then store them. I .. --------------------------------------------- https://chloe.re/2015/06/20/a-month-with-badonions/ *** Poseidon and Backoff POS � the links and similarities *** --------------------------------------------- Poseidon, also known as FindPOS, is a malware family designed for Windows point-of-sale systems. Poseidon scans the memory for running processes and employs keystroke logging .. --------------------------------------------- https://blog.team-cymru.org/2015/06/poseidon-and-the-backoff-pos-link *** Bypassing Microsoft EMET 5.2 - a neverending story? *** --------------------------------------------- The experts of the SEC Consult Vulnerability Lab managed to adapt the EMET 5.0 / 5.1 bypasses to additionally work against the latest Microsoft EMET version which is 5.2. Results of the research were already presented this year at .. --------------------------------------------- http://blog.sec-consult.com/2015/06/bypassing-microsoft-emet-52-neverending…

1 0

Tageszusammenfassung - Freitag 19-06-2015
by Daily end-of-shift report 19 Jun '15

19 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-06-2015 18:00 − Freitag 19-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** So Long, and Thanks for All the Domains *** --------------------------------------------- While Trojans like Dyre and Dridex are dominating malware-related news, we take the time to have a closer look at Tinba (Tiny Banker, Zusy, Illi), yet another Trojan which targets Windows users. In the first part of this post, we... --------------------------------------------- http://securityblog.switch.ch/2015/06/18/so-long-and-thanks-for-all-the-dom… *** Understanding type confusion vulnerabilities: CVE-2015-0336 *** --------------------------------------------- In March 2014, we observed a patched Adobe Flash vulnerability (CVE-2015-0336) being exploited in the wild. Adobe released the patch on March 12, 2014, and exploit code using this vulnerability first appeared about a week later. To help stay protected: Keep your Microsoft security software, such as Windows Defender for Windows 8.1 up-to-date. Keep your third-party software, such as Adobe Flash Player, up-to-date. Be cautious when browsing potentially malicious or compromised websites. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/18/understanding-type-confu… *** Tapatalk-Plug-in liest Daten von Forennutzern aus *** --------------------------------------------- Wie die Administratoren des HardwareLuxx-Forums entdeckten, liest das Plug-in der Mobil-App die E-Mail-Adressen ihrer 200.000 Nutzer auf Anfrage aus und schickt diese an eigene Server. Tapatalk hält das Ganze für ein Versehen. --------------------------------------------- http://heise.de/-2716662 *** Paper: Beta exploit pack: one more piece of crimeware for the infection road! *** --------------------------------------------- Exploit kit currently being tested focuses primarily on Flash Player exploits.Nuclear, Angler, Magnitude and Rig. Security researchers know were talking about exploit kits (or browser exploit packs), toolkits that automate the exploitation of client-side vulnerabilities and thus facilitate infection through drive-by downloads.Today, we publish an article by researchers Aditya K. Sood and Rohit Bansal, in which they look at a new exploit kit, Beta. Though it is still in a testing phase, Aditya... --------------------------------------------- http://www.virusbtn.com/blog/2015/06_19.xml?rss *** SAP Hana users warned of security vulnerability *** --------------------------------------------- Hard on the heels of the release of a newly updated version of SAP Hana, a security researcher has warned of a potentially serious vulnerability in the in-memory platform. "If an attacker can exploit this vulnerability, he can get access to all encrypted data stored in an SAP Hana database," said Alexander Polyakov, CTO with ERPScan, which presented the details Thursday at the Black Hat Sessions XIII conference in the Netherlands. --------------------------------------------- http://www.cio.com/article/2937953/sap-hana-users-warned-of-security-vulner… *** Identifying Your Prey *** --------------------------------------------- User hunting is one of my favorite phases of an engagement. Whether it's performed for lateral spread and escalation, or to demonstrate impact by tracking down incident responders and executives, we end up hunting for users on nearly every assessment we conduct. I presented this topic at the Shmoocon '15 Firetalks, and published the "I Hunt Sys Admins" post to help highlight some of the ways we track down where users are located in Windows domains. --------------------------------------------- http://www.verisgroup.com/2015/06/17/identifying-your-prey/ *** an awesome list of honeypot resources *** --------------------------------------------- A curated list of awesome honeypots, tools, components and much more. The list is divided into categories such as web, services, and others, focusing on open source projects. There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the guide. --------------------------------------------- https://github.com/paralax/awesome-honeypots *** The Samsung SwiftKey Vulnerability - What You Need To Know, And How To Protect Yourself *** --------------------------------------------- Recently, researchers announced that a vulnerability in Samsung Android devices had been found which allowed attackers to run malicious code on vulnerable devices if they became the targets of a man-in-the-middle attack. In this post we will explain how this vulnerability works, and what can users do to protect themselves. The Vulnerability The stock Android... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Y8_n4zFsafI/ *** Security CheatSheets - A collection of cheatsheets for various infosec tools and topics *** --------------------------------------------- These security cheatsheets are part of a project for the Ethical Hacking and Penetration Testing course offered at the University of Florida. Expanding on the default set of cheatsheets, the purpose of these cheatsheets are to aid penetration testers/CTF participants/security enthusiasts in remembering commands that are useful, but not frequently used. Most of the tools that will be covered have been included in our class and are available in Kali Linux. --------------------------------------------- http://www.kitploit.com/2015/06/security-cheatsheets-collection-of.html *** Bundestag: Linksfraktion veröffentlicht Malware-Analyse *** --------------------------------------------- Die Linksfraktion veröffentlicht im Zusammenhang mit dem Bundestags-Hack eine Analyse von Malware, die auf ihren Servern gefunden wurde. Darin wird eine Verbindung zur russischen Organisation APT28 nahegelegt. Doch wirklich überzeugend sind die Belege dafür nicht. --------------------------------------------- http://www.golem.de/news/bundestag-linksfraktion-veroeffentlicht-malware-an… *** Bugtraq: ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535797 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Content Manager Enterprise Edition (CVE-2015-0478, CVE-2015-0488, CVE-2015-1916, CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21960248 *** IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21903544 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=swg21959294 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server uses an insecure hashing scheme for handling user passwords (CVE-2015-1913) *** http://www.ibm.com/support/docview.wss?uid=swg21959298 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=swg21959291 *** IBM Security Bulletin: GNU C library (glibc) vulnerabilities affect IBM SmartCloud Entry (CVE-2014-6040 CVE-2014-7817) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022093 *** Wind River VXWorks TCP Predictability Vulnerability in ICS Devices *** --------------------------------------------- This advisory provides mitigation details for a TCP predictability vulnerability identified in Wind River's VxWorks. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01 *** Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39420

1 0

Tageszusammenfassung - Donnerstag 18-06-2015
by Daily end-of-shift report 18 Jun '15

18 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-06-2015 18:00 − Donnerstag 18-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** OS X and iOS Unauthorized Cross Application Resource Access (XARA), (Thu, Jun 18th) *** --------------------------------------------- The last couple of days, a paper with details about XARA vulnerabilities in OS X and iOS is getting a lot of attention [1]. If you havent seen the term XARA before, then this is probably because cross-application-resource-access was normal in the past. Different applications has access to each others data as long as the same user ran them. But more recently, operating systems like OS X and iOS made attempts to sandbox applications and isolate applications from each other even if the same user... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19815&rss *** Apple OS X and iOS in the vulnerability spotlight - meet "CORED," also known as "XARA" *** --------------------------------------------- The security issue of the week has arrived in iOS and OS X, and its attracted a funky name already. The researchers called it XARA, but others had different ideas, and dubbed it "CORED." As in "Apple CORED." --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/Q4IwUfvQIVM/ *** IT-Sicherheitskonferenz FIRST: Ohne Vertrauen geht nichts, aber das Vertrauen geht *** --------------------------------------------- Die FIRST-Konferenz in Berlin beschäftigte sich damit, wie die Sicherheit von Computernetzen verbessert werden kann. Am Ende stand die Erkenntnis, dass die Arbeit komplizierter wird, weil Staaten zunehmend in IT-Sicherheit eingreifen. --------------------------------------------- http://heise.de/-2716841 *** Caching Out: The Value of Shimcache for Investigators *** --------------------------------------------- During a recent investigation, we found references to timestamps associated with probable malicious files that preceded the earliest known date of compromise. These Application Compatibility Cache (“Shimcache”) timestamps were the only evidence linked to this timeframe. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/06/caching_out_the_val.ht… *** Uncovering Tor users: where anonymity ends in the Darknet *** --------------------------------------------- Intelligence services have not disclosed any technical details of how they detained cybercriminals who created Tor sites to distribute illegal goods; in particular, they are not giving any clues how they identify cybercriminals who act anonymously. This may mean that the implementation of the Tor Darknet contains some vulnerabilities and/or configuration defects that make it possible to unmask any Tor user. In this research, we will present practical examples to demonstrate how Tor users may... --------------------------------------------- http://securelist.com/analysis/publications/70673/uncovering-tor-users-wher… *** Drupal-Lücken erlauben das Kapern von Admin-Konten *** --------------------------------------------- In Drupal 6 und 7 klaffen vier Sicherheitslücken. Die schwerwiegendste erlaubt es Angreifer, Admin-Konten des CMS über OpenID zu kapern. Updates, welche die Lücken schließen, stehen zum Download bereit. --------------------------------------------- http://heise.de/-2715975 *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2015-002Project: Drupal core Version: 6.x, 7.xDate: 2015-June-17Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass, Information Disclosure, Open Redirect, Multiple vulnerabilitiesDescriptionImpersonation (OpenID module - Drupal 6 and 7 - Critical)A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their --------------------------------------------- https://www.drupal.org/SA-CORE-2015-002 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- https://www.drupal.org/security/contrib *** Bugtraq: [security bulletin] HPSBGN03350 rev.1 - HP SiteScope Using RC4, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535785 *** Bugtraq: [security bulletin] HPSBGN03338 rev.1 - HP Service Manager running RC4, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535786 *** Cisco IOS XR IPv6 Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39383 *** Cisco IOS XR SSH Disconnect Error Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39402 *** Symantec Endpoint Protection Manager and Client Issues *** ---------------------------------------------  Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSEPM Auth User Blind SQLi in PHP prepared state... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** [R2] PHP < 5.4.41 Vulnerabilities Affect Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-06 *** Rack denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103917 *** SQL Injection in EXT:sb_akronymmanager *** --------------------------------------------- It has been discovered that the extension "Akronymmanager" (sb_akronymmanager) is susceptible to SQL Injection --------------------------------------------- http://www.typo3.org/news/article/sql-injection-in-extsb-akronymmanager/ *** pure-ftpd 1.0.39 remote denial of service in glob_() *** --------------------------------------------- Topic: pure-ftpd 1.0.39 remote denial of service in glob_() Risk: Medium Text:Version 1.0.40 of pure-FTPd fixes a potential denial of service issue. From the NEWS file: - The process handling a user... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060101

1 0

Tageszusammenfassung - Mittwoch 17-06-2015
by Daily end-of-shift report 17 Jun '15

17 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-06-2015 18:00 − Mittwoch 17-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Unpatched OS X, iOS flaws allow password, token theft from keychain, apps *** --------------------------------------------- Six researchers from Indiana University Bloomington, Peking University and Georgia Tech have recently published a paper in which they detail the existence of critical security weaknesses in Apples OS... --------------------------------------------- http://www.net-security.org/secworld.php?id=18523 *** Security: Unverschlüsselte App-Updates gefährden Samsungs Smartphones *** --------------------------------------------- Wenn Apps ihre Aktualisierungen unverschlüsselt abholen, sind sie leicht zu manipulieren. Vor allem bei systemnahen Anwendungen ist das ein gravierendes Problem, wie ein aktueller Fall belegt, der vor allem die Galaxy-Reihe von Samsung betrifft. --------------------------------------------- http://www.golem.de/news/security-unverschluesselte-app-updates-gefaehrden-… *** CVE-2014-4114 and an Interesting AV Bypass Technique, (Tue, Jun 16th) *** --------------------------------------------- Citizenlabs recently reported on a CVE-2014-4114 campaign against pro-democracy / pro-Tibetian groups in Hong Kong. The attacks happening should not surprise anyone, nor that the attacks were sophisticated. The vulnerability itself was patched with MS14-060 and has been used by APT and crime groups for sometime. Trend Micro wrote a good write-up of the issue here. What is interesting is what, in effect, is an anti-virus bypass that was employed by the actors. This bypass was discussed in this... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19809&rss *** VU#155412: Samsung Galaxy S phones fail to properly validate Swiftkey language pack updates *** --------------------------------------------- Vulnerability Note VU#155412 Samsung Galaxy S phones fail to properly validate Swiftkey language pack updates Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, fail to properly validate Swiftkey language pack updates. Description CWE-345: Insufficient Verification of Data Authenticity - CVE-2015-2865Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, are pre-installed with a version of Swiftkey... --------------------------------------------- http://www.kb.cert.org/vuls/id/155412 *** EMC Unified Infrastructure Manager/Provisioning Authentication Flaw Lets Remote Users Access the System *** --------------------------------------------- http://www.securitytracker.com/id/1032589 *** Red Hat OpenSSL Locking Error in ssleay_rand_bytes() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032587 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Cloud Portal Appliance Pregenerated Default Host Keys Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39380 *** Cisco Prime Collaboration Manager SQL Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39365 *** Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=31998 *** Cisco Adaptive Security Appliance Encrypted IPSec or IKEv2 Packet Modification Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39366 *** [HTB23261]: OS Command Injection in Vesta Control Panel *** --------------------------------------------- Product: Vesta Control Panel v0.9.8Vulnerability Type: OS Command Injection [CWE-78]Risk level: Critical Creater: http://vestacp.comAdvisory Publication: May 20, 2015 [without technical details]Public Disclosure: June 17, 2015 CVE Reference: CVE-2015-4117 CVSSv2 Base Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C) Vulnerability Details: High-Tech Bridge Security Research Lab discovered critical vulnerability in Vesta Control Panel, which can be exploited to execute arbitrary system commands and gain... --------------------------------------------- https://www.htbridge.com/advisory/HTB23261 *** VU#842780: Vesta Control Panel is vulnerable to cross-site request forgery *** --------------------------------------------- Vulnerability Note VU#842780 Vesta Control Panel is vulnerable to cross-site request forgery Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview Vesta Control Panel is vulnerable to a cross-site request forgery (CSRF) attack. Description CWE-352: Cross-Site Request Forgery (CSRF) - CVE-2015-2861Vesta Control Panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has --------------------------------------------- http://www.kb.cert.org/vuls/id/842780 *** Bugtraq: ESA-2015-043: RSA Validation Manager Security Update for Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535777 *** GarrettCom Magnum Series Devices Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in GarrettCom's Magnum 6k and Magnum 10k product lines. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01-0 *** Security update available for Adobe Photoshop CC *** --------------------------------------------- Adobe has released an update for Photoshop CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. --------------------------------------------- https://helpx.adobe.com/security/products/photoshop/apsb15-12.html *** Security update available for Adobe Bridge CC *** --------------------------------------------- Adobe has released an update for Adobe Bridge CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. --------------------------------------------- https://helpx.adobe.com/security/products/bridge/apsb15-13.html *** Bugtraq: VCE3570: VCE Vision(TM) Intelligent Operations Cryptographic and Cleartext Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535781 *** [R1] PHP < 5.4.41 Vulnerabilities Affect Tenable SecurityCenter *** --------------------------------------------- June 15, 2015 --------------------------------------------- http://www.tenable.com/security/tns-2015-06

1 0

Tageszusammenfassung - Dienstag 16-06-2015
by Daily end-of-shift report 16 Jun '15

16 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-06-2015 18:00 − Dienstag 16-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Dude, where's my heap? *** --------------------------------------------- Guest posted by Ivan Fratric, spraying 1TB of memoryThe ability to place controlled content to a predictable location in memory can be an important primitive in exploitation of memory corruption vulnerabilities. A technique that is commonly used to this end in browser exploitation is heap spraying: By allocating a large amount of memory an attacker ensures that some of the allocations happen in a predictable memory region. In order to break this technique, in Windows 8 Microsoft introduced High... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my-heap.html *** RFC 7540 - HTTP/2 protocol, (Mon, Jun 15th) *** --------------------------------------------- RFC 7540 has been out for a month now. What should we expect with this new version? 1. New frame: HTTP/2 implements a binary protocol with the following frame structure: Length: The length of the frame payload expressed as an unsigned 24-bit integer. Values greater than 2^14 must not be sent unless the receiver has set a larger value for SETTINGS_MAX_FRAME_SIZE parameter. Type: The 8-bit type of the frame. It determines the format and semantics of the frame.">Length: The length of the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19799&rss *** LastPass Security Notice *** --------------------------------------------- We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised. --------------------------------------------- https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ *** Blackhats exploiting MacKeeper hole to foist dangerous trojan *** --------------------------------------------- Peskware now net nasty Last months MacKeeper vulnerability is now being exploited in the wild to hijack Apple machines, according to BAE security researcher Sergei Shevchenko. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/16/blackhats_e… *** Odd HTTP User Agents, (Tue, Jun 16th) *** --------------------------------------------- Many web application firewalls do block odd user agents. However, decent vulnerability scanners will try to evade these simple protections by trying to emulate the user agent string of commonly used browsers. To figure out if I can distinguish bad from good, I compared some of the logs from our honeypotsto logs from a normalweb server (isc.sans.edu). Many of the top user agents hitting the honeypot are hardly seen on normal web sites, allowing me to identify possible vulnerability scanners. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19805&rss *** Phone hacking blitz hammers UK.bizs poor VoIP handsets *** --------------------------------------------- If I ever get my hands on those phreaking kids who hacked my phones... UK businesses are getting disproportionately targeted by a surge of attacks against Voice over IP (VoIP) systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/16/voip_hackin… *** iOS Application Security Part 45 - Enhancements in Damn Vulnerable iOS app version 2.0 *** --------------------------------------------- In this article, i would like to give a quick walkthrough of the new vulnerabilities and challenges that we have added in version 2.0 of Damn Vulnerable iOS app. In the Insecure Data storage section, we have added challenges for the following databases. Realm Database Couchbase Lite YapDatabase We have also added a new section... --------------------------------------------- http://resources.infosecinstitute.com/ios-application-security-part-45-enha… *** DSA-3289 p7zip - security update *** --------------------------------------------- Alexander Cherepanov discovered that p7zip is susceptible to adirectory traversal vulnerability. While extracting an archive, itwill extract symlinks and then follow them if they are referenced infurther entries. This can be exploited by a rogue archive to writefiles outside the current directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3289 *** VU#101500: Retrospect Backup Client uses weak password hashing *** --------------------------------------------- Vulnerability Note VU#101500 Retrospect Backup Client uses weak password hashing Original Release date: 15 Jun 2015 | Last revised: 15 Jun 2015 Overview Retrospect Backup Client is a client to a network-based backup utility. This client stores passwords in a hashed format that is weak and susceptible to collision, allowing an attacker to generate a password hash collision and gain access to the targets backup files. Description CWE-916: Use of Password Hash With Insufficient Computational... --------------------------------------------- http://www.kb.cert.org/vuls/id/101500 *** VU#626420: Pearson ProctorCache contains hard coded credentials *** --------------------------------------------- Vulnerability Note VU#626420 Pearson ProctorCache contains hard coded credentials Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview The Pearson ProctorCache software uses a hard coded password for administrative tasks. Description The ProctorCache is designed to cache the testing content, as well as cache the responses and maintain a client list of active test-takers. ProctorCache is a server software package installed locally within the LAN on a Windows system.CWE-259: --------------------------------------------- http://www.kb.cert.org/vuls/id/626420 *** Bugtraq: ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535776 *** Security Advisory: MIT Kerberos 5 vulnerability CVE-2014-5355 *** --------------------------------------------- (SOL16743) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16743.htm… *** RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-162-01 RLE Nova Wind Turbine HMI Unsecure Credentials Vulnerability that was published June 11, 2015, on the NCCIC/ICS-CERT web site. This updated advisory provides publicly disclosed vulnerabilities and mitigation measures for the RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01A *** IBM Security Bulletins *** --------------------------------------------- Vulnerability in Diffie-Hellman ciphers affects TS3400 (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects TS2900 (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects IBM Cognos Metrics Manager (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects the IBM Installation Manager and IBM Packaging Utility (CVE-2015-4000) Vulnerability with Diffie-Hellman ciphers may affect Lotus Quickr 8.5 for WebSphere Portal (CVE-2015-4000) Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Integrated Operations Management (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469, CVE-2015-0458, CVE-2015-0480, CVE-2015-0488, CVE-2015-0478, CVE-2015-047...) IBM QRadar Incident Forensics 7.2.4 is vulnerable to a cross site scripting vulnerability. (CVE-2015-1919) Vulnerabilities in OpenSSL affect IBM Campaign, IBM ContactOptimization (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0292, CVE-2015-0293) Open Source Apache Tomcat prior to 6.0.42 as used in IBM QRadar Security Information and Event Manager 7.1 MR2, and 7.2.4 is vulnerable to HTTP request smuggling. (CVE-2014-0227) Vulnerabilities in OpenSSL affect IBM Campaign, IBM ContactOptimization (CVE-2014-3569) IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL (CVE-2014-3511, CVE-2014-3512) Vulnerability in Diffie-Hellman ciphers affects IBM Operations Analytics - Predictive Insights (CVE-2015-4000) Vulnerability in OpenSSL affects IBM XIV Storage System Gen3 (CVE-2014-3570) Multiple vulnerabilities in IBM SDK Java Technology Edition affect IBM Business Process Manager and WebSphere Lombardi Edition April 2015 CPU --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Montag 15-06-2015
by Daily end-of-shift report 15 Jun '15

15 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-06-2015 18:00 − Montag 15-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Hey kids, who wants to pwn a million BIOSes? *** --------------------------------------------- IT security bods warn of dysfunctional ecosystem, fraught with vulnerability The overlooked task of patching PC BIOS and UEFI firmware vulnerabilities leaves corporations wide open to attack, a new paper by security researchers warns. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/12/bios_securi… *** Oh look - JavaScript Droppers *** --------------------------------------------- In a typical drive-by-download attack scenario the shellcode would download and execute a malware binary. The malware binary is usually wrapped in a dropper that unpacks or de-obfuscates and executes it. Droppers' main goal is to launch malware without being detected by antiviruses and HIPS. Nowadays the most popular way of covert launching would probably... --------------------------------------------- http://labs.bromium.com/2015/06/12/oh-look-javascript-droppers/ *** NTP für Windows: Schaltsekunde könnte Probleme bereiten *** --------------------------------------------- Wer den NTP-Client für Windows installiert hat, sollte vor dem 30. Juni ein Update durchführen --------------------------------------------- http://derstandard.at/2000017430786 *** Windows Server 2003 End of Life: You Can't RIP *** --------------------------------------------- Windows XP reached end of support last year and now it's time for another end of life: Windows Server 2003. On July 14, 2015, this widely deployed Microsoft operating system will reach its end of life - a long run since its launch in April 2003. Estimates on the number of still-active Windows Server 2003 users vary from... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/FwOEN1rriTc/ *** OPM hack: Vast amounts of extremely sensitive data stolen *** --------------------------------------------- The extent of the breach suffered by the US Office of Personnel Management has apparently widened. Reports are coming in that the hackers have not only accessed Social Security numbers, job assign... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/FaMAmsBY66Y/secworld.php *** Dnstwist variiert und testet Domainnamen *** --------------------------------------------- Wer überwachen will, wie Vertipper- und Phishing-Domains für einen Domainnamen verbreitet sind, kann das Python-Skript Dnstwist nutzen. Es übernimmt viel Handarbeit und hilft bei der Analyse. --------------------------------------------- http://heise.de/-2690418 *** The top mistakes banks make defending against hackers *** --------------------------------------------- Many financial institutions fail to perform comprehensive risk analysis and assessment, exposing their companies and clients to enormous risk. --------------------------------------------- https://www.htbridge.com/blog/the-top-mistakes-banks-make-defending-against… *** Call to participate in the EU28 Cloud Security Conference *** --------------------------------------------- On June 16, in Riga, the Ministry of Defence of the Republic of Latvia and the European Union Agency for Network and Information Security (ENISA) will organise the EU28 Cloud Security Conference: Reaching the Cloud Era in the European Union. The participants of the conference will discuss the cloud security in the two parallel tracks: "Legal & Compliance" and "Technologies and Solutions". --------------------------------------------- http://www.enisa.europa.eu/media/news-items/call-to-participate-in-the-eu28… *** The Duqu 2.0 persistence module *** --------------------------------------------- We have described how Duqu 2.0 does not have a normal "persistence" mechanism. This can lead users to conclude that flushing out the malware is as simple as rebooting all the infected machines. In reality, things are a bit more complicated. --------------------------------------------- http://securelist.com/blog/research/70641/the-duqu-2-0-persistence-module/ *** Duqu 2.0 Attackers Used Stolen Foxconn Certificate to Sign Driver *** --------------------------------------------- The attackers behind the recently disclosed Duqu 2.0 APT have used stolen digital certificates to help sneak their malware past security defenses, and one of the certificates used in the attacks was issued to Foxconn, the Chinese company that manufactures products for Apple, BlackBerry, Dell, and many other companies. Researchers at Kaspersky Lab, who discovered... --------------------------------------------- http://threatpost.com/duqu-2-0-attackers-used-stolen-foxconn-certificate-to… *** Massive route leak causes Internet slowdown *** --------------------------------------------- Earlier today a massive route leak initiated by Telekom Malaysia (AS4788) caused significant network problems for the global routing system. Primarily affected was Level3 (AS3549 - formerly known as Global Crossing) and their customers. Below are some of the details as we know them now. --------------------------------------------- https://www.bgpmon.net/massive-route-leak-cause-internet-slowdown/ *** Cisco issues 16 patches to pop pesky peccant packets *** --------------------------------------------- Remote code execution for some, denial of service for the rest of us Cisco has issued a string of patches for 16 faults including a fix for a possible remote code execution in its IOS and IOS XE routing software. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/15/cisco_ipv6_… *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39339 *** Cisco IOS Software TCL Script Interpreter Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39343 *** Cisco Virtualization Experience Client 6215 Devices Command Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39347 *** Novell ZENworks Mobile Management Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032576 *** Novell Messenger 3.0 Support Pack 1 *** --------------------------------------------- Abstract: Novell Messenger 3.0 Support Pack 1 has been released. Please be aware that there are security fixes to Messengers server and client components (see the change log below and the Readme documentation on the web). It is recommended that they are updated on an expedited basis.Document ID: 5212230Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:consoleone1.3.6h_windows.zip (46.82 MB)nm301_full_linux_multi.tar.gz (269.54 MB)nm301_client_mac_multi.zip (40.62... --------------------------------------------- https://download.novell.com/Download?buildid=o8Y11QiTuc4~ *** DSA-3285 qemu-kvm - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu-kvm, a fullvirtualization solution on x86 hardware. --------------------------------------------- https://www.debian.org/security/2015/dsa-3285 *** DSA-3284 qemu - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu, a fast processoremulator. --------------------------------------------- https://www.debian.org/security/2015/dsa-3284 *** DSA-3288 libav - security update *** --------------------------------------------- Several security issues have been corrected in multiple demuxers anddecoders of the libav multimedia library. A full list of the changes isavailable at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 --------------------------------------------- https://www.debian.org/security/2015/dsa-3288 *** DSA-3287 openssl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in OpenSSL, a Secure SocketsLayer toolkit. --------------------------------------------- https://www.debian.org/security/2015/dsa-3287 *** DSA-3286 xen - security update *** --------------------------------------------- Multiple security issues have been found in the Xen virtualisationsolution: --------------------------------------------- https://www.debian.org/security/2015/dsa-3286 *** Vulnerabilities in multiple third party TYPO3 CMS extensions *** --------------------------------------------- *** SQL Injection vulnerability in extension FAQ - Frequently Asked Questions (js_faq) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Developer Log (devlog) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Smoelenboek (ncgov_smoelenboek) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Store Locator (locator) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension wt_directory (wt_directory) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** Arbitrary Code Execution in extension Frontend User Upload (feupload) *** http://www.typo3.org/news/article/arbitrary-code-execution-in-extension-fro… *** Cross-Site Scripting in extension BE User Log (beko_beuserlog) *** http://www.typo3.org/news/article/cross-site-scripting-in-extension-be-user… *** Arbitrary Code Execution in extension Job Fair (jobfair) *** http://www.typo3.org/news/article/arbitrary-code-execution-in-extension-job… *** Security Advisory - Web UI Authentication Vulnerability in Huawei E5756S *** --------------------------------------------- Jun 15, 2015 18:00 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Filezilla 3.11.0.2 sftp module denial of service vulnerability *** --------------------------------------------- Topic: Filezilla 3.11.0.2 sftp module denial of service vulnerability Risk: Medium Text: # Exploit title: filezilla 3.11.0.2 sftp module denial of service vulnerability # Date: 5-6-2015 # Vendor homepage: http... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060077 *** putty v0.64 denial of service vulnerability *** --------------------------------------------- Topic: putty v0.64 denial of service vulnerability Risk: Medium Text: # Exploit title: putty v0.64 denial of service vulnerability # Date: 5-6-2015 # Vendor homepage: http://www.chiark.green... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060076 *** E-Detective Lawful Interception System multiple security vulnerabilities *** --------------------------------------------- Topic: E-Detective Lawful Interception System multiple security vulnerabilities Risk: Medium Text:Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060075

1 0

Tageszusammenfassung - Freitag 12-06-2015
by Daily end-of-shift report 12 Jun '15

12 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-06-2015 18:00 − Freitag 12-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Gamarue dropping Lethic bot *** --------------------------------------------- The Gamarue (aka Andromeda) botnet is a highly modular botnet family that allows attackers to take complete control of an infected system and perform a range of malicious activity by downloading additional payloads. In this blog, we will cover a recent Gamarue .. --------------------------------------------- http://research.zscaler.com/2015/06/gamarue-dropping-lethic-bot.html *** Popcash Malvertising Leads to CryptoWall *** --------------------------------------------- End users face the harsh reality of malvertising with CryptoWall ransomware dropped on their systems. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/06/popcash-malvertising-l… *** RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability *** --------------------------------------------- This advisory provides publicly disclosed vulnerabilities and mitigation measures for the RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01 *** Microsoft flags Ask toolbar as unwanted and dangerous *** --------------------------------------------- >From this month on, all versions of Ask.coms infamous browser toolbar except the very last will be detected as unwanted .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18506 *** The June 2015 issue of our SWITCH Security Report is available! *** --------------------------------------------- Dear Reader! A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: What do tax authorities and contact sites have in .. --------------------------------------------- http://securityblog.switch.ch/2015/06/12/the-june-2015-issue-of-our-switch-… *** Integrating PaX into Android *** --------------------------------------------- The PaX project provides many exploit mitigation features to harden the Linux kernel far beyond the baseline security features provided by upstream. Android is close enough to a normal Linux distribution for it to work quite well out-of-the-box .. --------------------------------------------- https://copperhead.co/2015/06/11/android-pax *** Phisher setzen auf Geo-Blocking *** --------------------------------------------- Damit Phishing-Seiten länger überleben, lassen sich manche von ihnen nur aus dem Land abrufen, auf das es die Cyber-Ganoven abgesehen haben. Phishing-Filterdienste bleiben deshalb außen vor und schöpfen keinen Verdacht. --------------------------------------------- http://www.heise.de/security/meldung/Phisher-setzen-auf-Geo-Blocking-268948… *** Dyre Configuration Dumper *** --------------------------------------------- It�s been over a year since Dyre first appeared, and with a rise of infections in 2015, it doesn�t look like the attackers are stopping anytime soon. At PhishMe we�ve been .. --------------------------------------------- http://phishme.com/dyre-configuration-dumper/ *** OpenSSL-Update verursacht ABI-Probleme *** --------------------------------------------- OpenSSL veröffentlicht Updates für kleinere Sicherheitslücken - dabei ist den Entwicklern ein Fehler unterlaufen: Durch eine veränderte Datenstruktur ändert sich die Binärschnittstelle der Bibliothek, was zu Fehlfunktionen führen kann. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-openssl-update-verursacht-abi-p… *** How Heartbleed couldve been found *** --------------------------------------------- tl;dr With a reasonably simple fuzzing setup I was able to rediscover the Heartbleed bug. This uses state-of-the-art fuzzing and memory protection technology (american fuzzy lop and Address Sanitizer), but it doesnt require any prior knowledge about .. --------------------------------------------- https://blog.hboeck.de/archives/868-How-Heartbleed-couldve-been-found.html

1 0

Tageszusammenfassung - Donnerstag 11-06-2015
by Daily end-of-shift report 11 Jun '15

11 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-06-2015 18:00 − Donnerstag 11-06-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Increase in CryptoWall 3.0 from malicious spam and Angler exploit kit, (Thu, Jun 11th) *** --------------------------------------------- Introduction Since Monday2015-05-25(a bitmore than 2 weeks ago), weve seen a significantamount of CryptoWall 3.0 ransomware from">) and theAngler exploit kit (EK). A malspam campaign pushing CryptoWall 3.0 started as early as Monday 2015-05-25, but it hasincreased significantly since Monday 2015-06-08. The CryptoWall3.0push from Angler EK appears to have started around the same time. Both campaigns (malspam and Angler EK) were active as recently as Wednesday 2015-06-10. The timing of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19785&rss *** Factsheet: Software has an expiry date *** --------------------------------------------- Software vendors regularly make announcements that certain versions of software will no longer be supported after a particular date. Such dates are known as End-of-Life. After the End-of-Life, software is no longer supported and can therefore not be considered to be secure. The NCSC advises to update systems after the announcement as soon as possible. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Cyberangriff: Bundestag benötigt komplett neues Computer-Netzwerk *** --------------------------------------------- Das Computer-Netzwerk im Bundestag ist hinüber. Der Cyberangriff auf den deutschen Bundestag hat weitreichendere Folgen als bisher angenommen. Das Parlament muss ein völlig neues Computer-Netzwerk errichten. --------------------------------------------- http://www.golem.de/news/cyberangriff-bundestag-benoetigt-komplett-neues-co… *** Bundestag: "Von einem Totalschaden kann keine Rede sein" *** --------------------------------------------- Nur 15 Rechner sollen von dem Hacker-Angriff auf den Bundestag betroffen sein. Das berichtet der Unionsabgeordnete Thomas Jarzombek und beruft sich auf das BSI. --------------------------------------------- http://www.golem.de/news/bundestag-von-einem-totalschaden-kann-keine-rede-s… *** MSRT June 2015: BrobanDel *** --------------------------------------------- Providing further protections for our customers, this month we added three new malware families and two variants to the Microsoft Malicious Software Removal Tool (MSRT): Win32/Bagopos Win32/BrobanDel Win32/Gatak PWS:Win32/OnLineGames.AH PWS:Win32/OnLineGames.MV Gatak is a family of information-stealing malware that collects sensitive information and sends it to a remote attacker, if a system is compromised. Bagopos is another information-stealing malware family that targets credit card... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/09/msrt-june-2015-brobandel… *** Windows 10 to offer application developers new malware defenses *** --------------------------------------------- Application developers can now actively participate in malware defense - in a new way to help protect customers from dynamic script-based malware and non-traditional avenues of cyberattack. Microsoft is making that possible through the Antimalware Scan Interface (AMSI) - a generic interface standard that allows applications and services to integrate with any antimalware product present on a machine. AMSI is currently available through the Windows 10 Technical Preview, and will be fully... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/09/windows-10-to-offer-appl… *** Advances in Scripting Security and Protection in Windows 10 and PowerShell V5 *** --------------------------------------------- In the last several releases of Windows, we've been working hard to make the platform much more powerful for administrators, developers, and power users alike. PowerShell is an incredibly useful and powerful language for managing Windows domains. Unfortunately, attackers can take advantage of these same properties when performing "post-exploitation" activities (actions that are performed after a system has been compromised). The PowerShell team, recognizing this behavior, have --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/06/10/advances-in-scripting-sec… *** CSDanube *** --------------------------------------------- CERT.at ist keine isolierte Einrichtung, im Gegenteil: Wir kooperieren in diversen Kreisen mit anderen Institutionen und Firmen. Das reicht von unserer Einbettung in die Umsetzung der ÖSCS, lokalen Partnern in der Industrie und Forschung bis hin zur globalen Vernetzung der CERTs. In diesem Kontext nehmen wir an einem Projekt teil, dass im Rahmen des START Programms der Danube Region Strategy gefördert wird: Es geht bei diesem Projekt darum, dass die CERTs der Region... --------------------------------------------- http://www.cert.at/services/blog/20150611115640-1547.html *** Security Advisory: Object Injection Vulnerability in WooCommerce *** --------------------------------------------- Security Risk: Dangerous Exploitation Level: Easy/Remote DREAD Score: 8/10 Vulnerability: Object Injection Patched Version: 2.3.11 During a routine audit for our WAF, we discovered a dangerous Object Injection vulnerability which could, in certain contexts, be used by an attacker to download any file on the vulnerable server. Are you at risk? The vulnerability is only... --------------------------------------------- https://blog.sucuri.net/2015/06/security-advisory-object-injection-vulnerab… *** Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities *** --------------------------------------------- This advisory provides publicly disclosed vulnerabilities and compensating measures for the Hospira Plum A+ and Symbiq Infusion System that are similar to vulnerabilities identified in the Hospira LifeCare PCA Infusion System discussed in the updated advisory ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01 *** HPSBUX03337 SSRT102066 rev.1 - HP-UX Apache Web Server Suite running Apache Web Server, Tomcat v6.x, or PHP v5.4.x, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with the HP-UX Apache Web Server Suite, Tomcat Servlet Engine, and PHP. These could be exploited remotely to create a Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04686230 *** Cisco IOS XR telnetd Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39293 *** Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39280 *** Cisco Identity Services Engine Improper Web Page Controls Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39299

1 0

Tageszusammenfassung - Mittwoch 10-06-2015
by Daily end-of-shift report 10 Jun '15

10 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-06-2015 18:00 − Mittwoch 10-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39256 http://tools.cisco.com/security/center/viewAlert.x?alertId=39257 http://tools.cisco.com/security/center/viewAlert.x?alertId=39240 *** MS15-JUN - Microsoft Security Bulletin Summary for June 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-JUN *** VMSA-2015-0004 *** --------------------------------------------- VMware Workstation, Fusion and Horizon View Client updates address critical security issues .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0004.html *** Vawtrak Uses Tor2Web making hard to track down its servers *** --------------------------------------------- Security experts at Fortinet uncovered a new strain of the Vawtrak banking Trojan is implementing an obscuring mechanism based on the Tor2Web service. The authors of the banking Trojan Vawtrak are adopting a new tactic to hide the .. --------------------------------------------- http://securityaffairs.co/wordpress/37682/malware/vawtrak-uses-tor2web.html *** iOS und OS X: Apple könnte HTTPS für Apps erzwingen *** --------------------------------------------- Entwickler von Apps für iOS und OS X sollten "so schnell wie möglich" auf sichere Verbindungen per HTTPS wechseln, empfiehlt Apple. Das Unternehmen könnte die Verschlüsselung gar für die Aufnahme im App Store erzwingen. --------------------------------------------- http://www.golem.de/news/ios-und-os-x-apple-koennte-https-fuer-apps-erzwing… *** Schlag gegen internationale Bande von Cyber-Kriminellen in Europa *** --------------------------------------------- http://derstandard.at/2000017259662 *** N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys *** --------------------------------------------- This advisory provides mitigation details for hard-coded SSH and HTTPS encryption keys in the N-Tron 702-W Industrial Wireless Access Point device. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-160-01 *** Sinapsi eSolar Light Plaintext Passwords Vulnerability *** --------------------------------------------- This advisory provides mitigation details for plain text passwords in the Sinapsi eSolar Light application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-160-02 *** Adobe, Microsoft Issue Critical Security Fixes *** --------------------------------------------- Adobe today released software updates to plug at least 13 security holes in its Flash Player software. Separately, Microsoft pushed out fixes for at least three dozen flaws .. --------------------------------------------- http://krebsonsecurity.com/2015/06/adobe-microsoft-issue-critical-security-… *** The Mystery of Duqu 2.0: a sophisticated cyberespionage actor returns *** --------------------------------------------- Kaspersky Lab uncovers Duqu 2.0 � a highly sophisticated malware platform exploiting up to three zero-day vulnerabilities. --------------------------------------------- http://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophist… *** Duqu 2.0 *** --------------------------------------------- In our full report, available at http://www.crysys.hu/duqu2/duqu2.pdf, we point out numerous similarities that we discovered between Duqu and Duqu 2.0, .. --------------------------------------------- http://blog.crysys.hu/2015/06/duqu-2-0/ *** Microsoft pusht HTTPS beim Internet Explorer und Edge-Webbrowser *** --------------------------------------------- Ab sofort sollen der Internet Explorer und Webbrowser von Windows 10 Edge das verschlüsselte Surfen über HTTPS vorantreiben. Dafür hat Microsoft jetzt Updates verteilt, die HSTS einführen. --------------------------------------------- http://heise.de/-2687051 *** Xen Security Advisory CVE-2015-3209 / XSA-135 *** --------------------------------------------- The QEMU security team has predisclosed the following advisory: pcnet_transmit loads a transmit-frame descriptor from the guest into the /tmd/ local variable to recover a length field, a status field and a guest-physical location of the associated .. --------------------------------------------- http://www.openwall.com/lists/oss-security/2015/06/10/3 *** Russische Hacker sollen hinter Cyber-Angriff auf TV-Sender stecken *** --------------------------------------------- Nicht – wie bisher angenommen – der Islamistischer Staat (IS), sondern russische Profi-Hacker sollen im April den Sendebetrieb von TV5 lahm gelegt haben. Die platzierte IS-Propaganda sei möglicherweise nur ein Täuschungsmanöver gewesen. --------------------------------------------- http://heise.de/-2687434

1 0

Tageszusammenfassung - Dienstag 9-06-2015
by Daily end-of-shift report 09 Jun '15

09 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-06-2015 18:00 − Dienstag 09-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bug Bounties in Crosshairs of Proposed US Wassenaar Rules *** --------------------------------------------- Bug bounties and rewards programs provide researchers with a measure of income, and if the proposed Wassenaar rules are implemented in the U.S., that initiatives could be adversely impacted. --------------------------------------------- http://threatpost.com/bug-bounties-in-crosshairs-of-proposed-us-wassenaar-r… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39210 http://tools.cisco.com/security/center/viewAlert.x?alertId=38883 http://tools.cisco.com/security/center/viewAlert.x?alertId=39233 http://tools.cisco.com/security/center/viewAlert.x?alertId=39192 *** Fast look at Sundown EK *** --------------------------------------------- Disclaimer : There is nothing worth a post there...except mentionning this EK is around. I would put that "kit" in the same .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html *** New Episode of Punkey PoS Malware Airs *** --------------------------------------------- Reruns from the 1980s are all the rage these days, and like the sitcom its based on, weve encountered a second run from the Punkey Point of Sale malware as part of an .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Episode-of-Punkey-P… *** Website der US-Armee wegen Hackerangriffs vorübergehend stillgelegt *** --------------------------------------------- Wegen eines Hackerangriffs hat die US-Armee ihre Website vorübergehend stillgelegt. Nach der Entdeckung der Cyberattacke seien "geeignete Vorsichtsmaßnahmen" ergriffen .. --------------------------------------------- http://derstandard.at/2000017173834 *** Pin und Aktivierungssperre: Apple erhöht Sicherheit von iOS und der Apple Watch *** --------------------------------------------- Apple führt bei iOS 9 längere Pin-Codes ein, mit denen die mobilen Geräte vor unbefugtem Zugriff geschützt werden. Wer TouchID verwendet, muss ein sechsstelliges Kennwort eingeben und die Apple Watch erhält die geforderte Aktivierungssperre. --------------------------------------------- http://www.golem.de/news/pin-und-aktivierungssperre-apple-erhoeht-sicherhei… *** Amazon will SSL-Zertifizierungstelle werden *** --------------------------------------------- Amazons SSL-Zertifizierungstelle soll Server- und EV-Zertifikate ausstellen und sich dabei nicht auf Amazon-Kunden beschränken. --------------------------------------------- http://heise.de/-2683851 *** iOS: Schwachstelle in Apple Mail ermöglicht offenbar raffiniertes iCoud-Phishing *** --------------------------------------------- Ein Angreifer kann die Lücke nach Angabe eines Entwicklers dazu nutzen, den iCloud-Anmeldedialog zu imitieren, der öfters in iOS erscheint. Apple ist angeblich seit Monaten über das Problem informiert. --------------------------------------------- http://heise.de/-2684896 *** Security updates available for Adobe Flash Player (APSB15-11) *** --------------------------------------------- A Security Bulletin (APSB15-11) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1200 *** Asus schützt seine Router vor Exploit-Kit *** --------------------------------------------- Nachdem kürzlich ein Exploit-Kit aufgetaucht ist, dass über 50 Router-Modelle verschiedener Hersteller angreifen kann, hat Asus nun Firmware-Updates für 16 Router herausgebracht. --------------------------------------------- http://heise.de/-2684612 *** SweetCAPTCHA Service used to Distribute Adware *** --------------------------------------------- SweetCaptcha is free CAPTCHA service that offers to match sweet-looking images instead of making you recognize distorted digits and characters. It has integration with many website .. --------------------------------------------- https://blog.sucuri.net/2015/06/sweetcaptcha-service-used-to-distribute-adw…

1 0

Tageszusammenfassung - Montag 8-06-2015
by Daily end-of-shift report 08 Jun '15

08 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-06-2015 18:00 − Montag 08-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** �UnfriendAlert� wants your Facebook Credentials *** --------------------------------------------- For our first "PUP Friday" post, we talked about UnfriendAlert, a program that purports to notify users .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/06/unfriendalert-wants-y… *** Changes in Oracle Database 12c password hashes *** --------------------------------------------- Oracle has made improvements to user password hashes within Oracle Database 12c. By using a PBKDF2-based SHA512 hashing algorithm, instead of simple SHA1 hash, password .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Changes-in-Oracle-Database-1… *** [Honeypot Alert] Fritz!Box � Remote Command Execution Exploit Attempt *** --------------------------------------------- Our web honeypots picked up some exploit attempts for a remote command execution vulnerability in FRITZ!Box, a series of routers produced by AVM. This exploit targets router .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/-Honeypot-Alert--Fritz!Box-%… *** Checking for BACNet devices inside corporate networks *** --------------------------------------------- Building automation Networks are very common today for intelligent buildings. They interconnect several type of devices like escalators, elevators, power circuits, heating, ventilating and air conditioning (HVAC) to the main control .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19771 *** Insider vs. Outsider Threats: Identify and Prevent *** --------------------------------------------- In my last article, we discussed on a step-by-step approach on APT attacks. The origin of any kind of cyber-attack is through an external or an internal source. Multiple sophisticated insider attacks resulted in the exfiltration of .. --------------------------------------------- http://resources.infosecinstitute.com/insider-vs-outsider-threats-identify-… *** Antiquated environment and bad security practices aided OPM hackers *** --------------------------------------------- By now, youve all heard about the massive breach at the US Office of Personnel Managements (OPM), and that the attackers have accessed (and likely made off with) personal information .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18484 *** Plex verschl�sselt Verbindung zur eigenen Medienzentrale *** --------------------------------------------- Den bisher größte Einsatz von Sicherheitszertifikaten heftet sich die Medienzentrale Plex auf die eigenen Fahnen. In einer Kooperation mit DigiCert bekommen sämtliche Nutzer der Software ein kostenloses SSL/TLS-Zertifikat für ihren Server ausgestellt. --------------------------------------------- http://derstandard.at/2000017144835 *** DSA-3281 - Debian Security Team PGP/GPG key change notice *** --------------------------------------------- This is a notice that the Debian Security Team has changed its PGP/GPGcontact key because of a periodic regular key rollover. --------------------------------------------- https://www.debian.org/security/2015/dsa-3281 *** Matryoshka dolls: analysing a packer for CTB locker *** --------------------------------------------- We recently encountered a phishing campaign distributing CTB locker. Victims were sent an e-mail that appeared to be from a Dutch webshop, with the e-mail describing a Fifa15 order for Playstation 3. While no one uses PS3 anymore , there were users who .. --------------------------------------------- https://www.dearbytes.com/en/nieuws/matroesjka-poppen-ctb-locker/ *** Raub im Zug: Datendiebstahl - ganz analog *** --------------------------------------------- Banden stehlen Handys und Laptops von Managern, um die Besitzer oder deren Firmen mit den erbeuteten Daten zu erpressen. --------------------------------------------- http://www.golem.de/news/raub-im-zug-datendiebstahl-ganz-analog-1506-114530… *** Malware zapft Kreditkartendaten von Oracle-Kassensystemen ab *** --------------------------------------------- Ein weiterer Schädling nistet sich in Point-of-Sales-Terminals ein und kopiert die Daten ahnungsloser Kreditkarten-Nutzer. MalaumPOS hat es auf ein weit verbreitetes Kassensystem von Oracle abgesehen. --------------------------------------------- http://heise.de/-2680638 *** Bugtraq: strongswan security update *** --------------------------------------------- Alexander E. Patrakov discovered an issue in strongSwan, an IKE/IPsec suite used to establish IPsec protected links. When an IKEv2 client authenticates the server with certificates and the client authenticates itself to the server using pre-shared key or EAP, the constraints on the .. --------------------------------------------- http://www.securityfocus.com/archive/1/535708 *** Zeus Isn�t Dead, New Version Evades All Antivirus Detection Tools *** --------------------------------------------- The venerable Zeus banking Trojan has been killed off many times; disappearing from the global Internet time and time again only to reappear with new modifications designed .. --------------------------------------------- http://www.pcrisk.com/internet-threat-news/9068-zeus-evades-all-antivirus-d… *** Many Drug Pumps Open to Variety of Security Flaws *** --------------------------------------------- In April, a security researcher disclosed a litany of severe vulnerabilities in the PCA3 drug-infusion pump manufactured by a company named Hospira. He went so far as to .. --------------------------------------------- http://threatpost.com/many-drug-pumps-open-to-variety-of-security-flaws/113…

1 0

Tageszusammenfassung - Freitag 5-06-2015
by Daily end-of-shift report 05 Jun '15

05 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-06-2015 18:00 − Freitag 05-06-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Zero-Day Disclosed in Unity Web Player *** --------------------------------------------- A zero-day vulnerability has been disclosed in the popular Unity Web Player browser plugin. The flaw allows an attacker crossdomain access to websites and services using the victims credentials. --------------------------------------------- http://threatpost.com/zero-day-disclosed-in-unity-web-player/113124 *** PCI Council releases PA-DSS 3.1, nixes SSL, early TLS *** --------------------------------------------- The PCI Security Standards Council revisions to PA-DSS addresses SSL vulnerabilities. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Ybnmzlufdo4/ *** Embedded: Geldautomaten sollen von XP auf Windows 10 updaten *** --------------------------------------------- Die Branchenorganisation ATM Industry Association ruft die Hersteller dazu auf, bei Geldautomaten Windows 8 und 8.1. zu überspringen. Auf Windows XP ausruhen sollen sie sich nicht. --------------------------------------------- http://www.golem.de/news/embedded-geldautomaten-sollen-von-xp-auf-windows-1… *** ICS Amsterdam 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 hosts five dedicated training courses for those tasked with securing Industrial Control Systems as well as a two day ICS Security Summit. This specialist training event takes place at the Radisson Blue Amsterdam, from September 22nd - 28th. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** Critical vulnerabilities in JSON Web Token libraries *** --------------------------------------------- Great. So, what's wrong with that? ... Meet the "none" algorithm. --------------------------------------------- http://ab0files.com/critical-vulnerabilities-in-json-web-token-libraries *** Achtung: Offene Intranets verraten zu viel *** --------------------------------------------- Viele Organisationen haben ein eigenes Intranet. Manche stellen versehentlich vertrauliche Dokumente online, die über Google auffindbar sind. Wir haben uns per Google Beispiele herausgepickt. --------------------------------------------- http://heise.de/-2680058 *** Asprox / Kuluoz Botnet Analysis *** --------------------------------------------- Introduction Kuluoz, aka Asprox, is a spam botnet that emerged in 2007. It has been known for sending mass of phishing emails used in conjunction with social engineering lures (e.g. booking confirmations, postal-themed spam, etc.) This article presents a view on the malware and its capabilities, how it communicates with the CnC, encryption schemes used,... --------------------------------------------- http://resources.infosecinstitute.com/asprox-kuluoz-botnet-analysis/ *** WLAN-Trick soll Apple-Pay-Nutzern Kreditkartendaten entlocken *** --------------------------------------------- Angreifer können die automatische WLAN-Verbindungsaufnahme von iOS dazu nutzen, um mit einem manipulierten Apple-Pay-Dialog auf Kreditkartenfang zu gehen, warnt eine Sicherheitsfirma. --------------------------------------------- http://heise.de/-2680369 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** McAfee ePolicy Orchestrator SSL/TLS spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103610 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco FireSIGHT Management Center XSS and HTML Injection Vulnerabilities *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39171 *** Cisco ONS 15454 System Software Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39172 *** Cisco Edge 340 Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39187 *** Cisco TelePresence SX20 HTTP Response Splitting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39210 *** XZERES 442SR Wind Turbine CSRF Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-155-01 *** Bugtraq: CA20150604-01: Security Notice for CA Common Services *** --------------------------------------------- http://www.securityfocus.com/archive/1/535684

1 0

Tageszusammenfassung - Mittwoch 3-06-2015
by Daily end-of-shift report 03 Jun '15

03 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-06-2015 18:00 − Mittwoch 03-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Your Website Hacked but No Signs of Infection *** --------------------------------------------- Imagine for a moment, you have a suspicion that you have somehow been hacked. You see that something is off, but you feel as if you are missing something. This is the emotionally draining world that many live in, with a paranoia and concern that grips you once you see and recognize that something is not right. --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/0D6hUcbKq34/your-website-hack… *** Holy SSH-it! Microsoft promises secure logins for Windows PowerShell *** --------------------------------------------- Now that the door has hit Ballmer on the way out, OpenSSH support is go Microsoft has finally decided to add support for SSH to PowerShell, allowing people to log into Windows systems and use software remotely over an encrypted connection. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/02/openssh_win… *** Bug des Tages: Skype hat eine "SMS des Todes" *** --------------------------------------------- Sending the characters "http://:" (without the quotes) crashes Skype, and receiving a message with those characters makes it crash any time you try to sign in again. --------------------------------------------- http://blog.fefe.de/?ts=ab900965 *** Good Patch Management Is Crucial to Cybersecurity in ICS *** --------------------------------------------- A good cybersecurity strategy for industrial control systems (ICS) must include both a systematic approach to patch management and compensating cybersecurity controls for when patching is not an option. Patch management resolves bugs, operability, reliability,... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/tK1mqdG1qkA/ *** IoT Devices Hosted On Vulnerable Clouds In Bad Neighborhoods *** --------------------------------------------- OpenDNS report finds that organizations may be more susceptible to Internet of Things devices than they realize. --------------------------------------------- http://www.darkreading.com/cloud/iot-devices-hosted-on-vulnerable-clouds-in… *** Mass break-in: researchers catch 22 more routers for the SOHOpeless list *** --------------------------------------------- A business model ripe for the bin Yet another disclosure tips 22 SOHO routers in the security bin, with everything from privilege escalation and authentication bypass to hard-coded credential backdoors. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/03/mass_breaki… *** Piwik: Unberechtigte können Webseiten-Statistiken abrufen *** --------------------------------------------- Installationen der Google-Analytics-Alternative Piwik sind häufig nicht korrekt konfiguriert und Dritte können ohne viel Aufwand Abrufstatistiken einsehen und sogar herunterladen. --------------------------------------------- http://heise.de/-2678572 *** SSH: Sechs Jahre alter Bug bedroht Github-Repositories *** --------------------------------------------- Ein Debian-Bug aus dem Jahr 2008 hinterlässt immer noch Spuren. Eine Analyse der öffentlichen SSH-Schlüssel bei Github zeigt: Mittels angreifbarer Schlüssel hätten Angreifer die Repositories von Projekten wie Python und Firmen wie Spotify oder Yandex manipulieren können. --------------------------------------------- http://www.golem.de/news/ssh-sechs-jahre-alter-bug-bedroht-github-repositor… *** Emergency Security Band-Aids with Systemtap *** --------------------------------------------- Software security vulnerabilities are a fact of life. So is the subsequent publicity, package updates, and suffering service restarts. Administrators are used to it, and users bear it, and it's a default and traditional method. On the other hand, in... --------------------------------------------- https://securityblog.redhat.com/2015/06/03/emergency-security-band-aids-wit… *** Krypto-Trojaner überlegt es sich anders und entschlüsselt alles wieder *** --------------------------------------------- Der Erpressungs-Trojaner Locker ist erst seit wenigen Tagen im Umlauf. Und schon ist seine Karriere wieder vorbei: Er hat vergangenen Dienstag den Befehl erhalten, alle verschlüsselten Dateien wiederherzustellen. --------------------------------------------- http://heise.de/-2678669 *** Hackers Scan All Tor Hidden Services To Find Weaknesses In The Dark Web *** --------------------------------------------- If you go down to the deep web today, you'll be following hot on the heels of a digital beast. In a matter of hours last week, the entire semi-anonymising Tor network, where activists and criminals alike try to hide from the gaze of their respective authorities, was traversed by PunkSPIDER, an automated scanner that pokes websites to uncover vulnerabilities. --------------------------------------------- http://www.forbes.com/sites/thomasbrewster/2015/06/01/dark-web-vulnerabilit… *** DSA-3277 wireshark - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in the dissectors/parsers forLBMR, web sockets, WCP, X11, IEEE 802.11 and Android Logcat, which couldresult in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3277 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Unified MeetingPlace Microsoft Outlook Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39161 *** Cisco Unified MeetingPlace Session ID Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39162 *** Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39158 *** Cisco Adaptive Security Appliance XAUTH Bypass Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39157 *** Cisco Unified MeetingPlace Arbitrary File Download Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39163 *** Beckwith Electric TCP Initial Sequence Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a TCP initial sequence numbers vulnerability in multiple Beckwith Electric products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-153-01 *** Moxa SoftCMS Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Moxa SoftCMS software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-153-02 *** [HTB23258]: Local PHP File Inclusion in ResourceSpace *** --------------------------------------------- Product: ResourceSpace v7.1.6513Vulnerability Type: PHP File Inclusion [CWE-98]Risk level: High Creater: Montala LimitedAdvisory Publication: May 6, 2015 [without technical details]Public Disclosure: June 3, 2015 CVE Reference: CVE-2015-3648 CVSSv2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in ResourceSpace, which can be exploited to include arbitrary local PHP file, execute PHP code, and compromise --------------------------------------------- https://www.htbridge.com/advisory/HTB23258 *** USN-2626-1: Qt vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2626-13rd June, 2015qt4-x11, qtbase-opensource-src vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryQt could be made to crash or run programs as your login if it opened aspecially crafted file.Software description qt4-x11 - Qt 4 libraries qtbase-opensource-src - Qt 5 libraries DetailsWolfgang Schenk discovered that Qt incorrectly handled certain malformedGIF... --------------------------------------------- http://www.ubuntu.com/usn/usn-2626-1/ Next End-of-Shift report on 2015-06-05

1 0

Tageszusammenfassung - Dienstag 2-06-2015
by Daily end-of-shift report 02 Jun '15

02 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-06-2015 18:00 − Dienstag 02-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit *** --------------------------------------------- What follows is a detailed analysis of the root cause of a vulnerability we call CVE-2015-X, as well as a step-by-step explanation of how to trigger it. For more on Flash vulnerabilities, we also invite you... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/JsuXUOWrYYM/ *** DYRE Banking Malware Upsurges; Europe and North America Most Affected *** --------------------------------------------- Online banking users in Europe and North America are experiencing the upsurge of DYRE, a malware family notorious for the multiple ways it steals data and its ties to parcel mule scams, among others. There has been a 125% increase of DYRE-related infections worldwide this quarter compared to the last, proving that cybercriminal interest in... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/HyDW9pkWWws/ *** Malvertising infected millions of users in 2015 *** --------------------------------------------- New research from Malwarebytes has found that malvertising is one of the primary infection vectors used to reach millions of consumers this year. The analysis looked at the three large scale zero-... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/9go1s-jFKtc/malware_news.… *** Playing with IP Reputation with Dshield & OSSEC *** --------------------------------------------- [This blogpost has also been published as a guest diary on isc.sans.org] When investigating incidents or searching for malicious activity in your logs, IP reputation is a nice way to increase the reliability of generated alerts. It can help to prioritize incidents. Let's take an example with a WordPress blog. It will, sooner or later, be targeted by a brute-force attack on the default /wp-admin page. In... --------------------------------------------- http://blog.rootshell.be/2015/06/02/playing-with-ip-reputation-with-dshield… *** Bugtraq: WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535663 *** Red Hat JBoss Fuse and A-MQ XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Files *** --------------------------------------------- http://www.securitytracker.com/id/1032442 *** Xen Security Advisories XSA-128, XSA-129, XSA-130, XSA-131 *** --------------------------------------------- Potential unintended writes to host MSI message data field via qemu, PCI MSI mask bits inadvertently exposed to guests, Guest triggerable qemu MSI-X pass-through error messages, Unmediated PCI register access in qemu --------------------------------------------- http://xenbits.xen.org/xsa/ *** USN-2625-1: Apache HTTP Server update *** --------------------------------------------- Ubuntu Security Notice USN-2625-12nd June, 2015apache2 updateA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security improvements have been made to the Apache HTTP Server.Software description apache2 - Apache HTTP server DetailsAs a security improvement, this update makes the following changes tothe Apache package in Ubuntu 12.04 LTS:Added support for ECC keys and ECDH ciphers.The SSLProtocol configuration directive now allows specifying --------------------------------------------- http://www.ubuntu.com/usn/usn-2625-1/ *** USN-2624-1: OpenSSL update *** --------------------------------------------- Ubuntu Security Notice USN-2624-11st June, 2015openssl updateA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryThe export cipher suites have been disabled in OpenSSL.Software description openssl - Secure Socket Layer (SSL) cryptographic library and tools DetailsAs a security improvement, this update removes the export cipher suitesfrom the default cipher list to prevent their use in possible --------------------------------------------- http://www.ubuntu.com/usn/usn-2624-1/ *** Cisco Headend Digital Broadband Delivery System Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39133 *** HPSBGN03269 rev.2 - HP StoreAll OS, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP StoreAll OS. This is the GNU C Library (glibc) vulnerability known as "GHOST" which could be exploited remotely resulting in execution of code. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599438 *** PCRE Heap Overflow in Regex Processing Lets Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032453

1 0

Tageszusammenfassung - Montag 1-06-2015
by Daily end-of-shift report 01 Jun '15

01 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-05-2015 18:00 − Montag 01-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Which malware lures work best? *** --------------------------------------------- More often than not, malware peddlers main goal is to deliver their malicious wares to the maximum number of users possible. Choosing the right lure is crucial to achieving that goal. Two researc... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/SXwL_z3NcUM/malware_news.… *** New Android NFC Attack Could Steal Money From Credit Cards Anytime Your Phone Is Near *** --------------------------------------------- Your NFC capable Android smartphone could be the newest weapon hackers use to steal money from the credit cards in your pocket, researchers find. In a presentation at Hack In The Box Security Conference in Amsterdam, security researchers Ricardo J. Rodriguez and Jose Vila presented a demo of a real world attack, to which all NFC capable Android phones are vulnerable. This attack, delivered through poisoned apps, exploits the NFC feature allowing unethical hackers to steal money from... --------------------------------------------- http://www.idigitaltimes.com/new-android-nfc-attack-could-steal-money-credi… *** Crypto flaws in Blockchain Android app sent Bitcoins to the wrong address *** --------------------------------------------- A comedy of programming errors could prove catastrophic for affected users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/9dMUjIT6yyo/ *** HITB Amsterdam Wrap-Up Day #2 *** --------------------------------------------- I left Amsterdam after the closing keynote and I just arrived at home. This is my quick wrap-up for the second day of Hack in the Box! The second keynote was presented by John Matherly: "The return of the Dragons". John is the guy behind Shodan, the popular devices search engine. Shodan started because Nmap was not designed to scan the whole Internet. With Shodan, Stateless... --------------------------------------------- http://blog.rootshell.be/2015/05/29/hitb-amsterdam-wrap-up-day-2-2/ *** Adventures in Social Engineering: The Evil Reference *** --------------------------------------------- I recently completed a social engineering gig targeting four bank locations. After a phone call and a few e-mails, I was able to grab some victims NTLMv2 domain hashed credentials. The Approach I developed a fictitious persona to help me... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Adventures-in-Social-En… *** Locker Ransomware Author Allegedly Releases Database Dump of Private Keys *** --------------------------------------------- Allegedly, the author of the "Locker" ransomware has uploaded a dump of the C2 server database, releasing private keys of infected hosts to the public. Allegedly, the author of the "Locker" ransomware has uploaded a dump of the C2 server database, releasing private keys of infected hosts worldwide to the public. The "author" claims that... --------------------------------------------- http://securityaffairs.co/wordpress/37346/cyber-crime/locker-ransomware-db-… *** Malware Evolution Calls for Actor Attribution? *** --------------------------------------------- What makes one novel strain of malicious software more dangerous or noteworthy than another? Is it the sheer capability and feature set of the new malware, or are these qualities meaningless without also considering the skills, intentions and ingenuity of the person wielding it? Most experts probably would say it's important to consider attribution insofar as it is knowable, but it's remarkable how seldom companies that regularly publish reports on the latest criminal innovations go... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/8rYlMnG_kmU/ *** Intelligente Städte: "Smart wäre, wenn man den ganzen Quatsch lassen würde" *** --------------------------------------------- Der White-Hat-Hacker Felix Lindner ist entsetzt, wie wenig Wert Politik und Industrie auf den Schutz der digital vernetzten Stadt vor Cyberattacken legen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Intelligente-Staedte-Smart-waere-wen… *** Researchers discover hidden shell in Hola VPN software *** --------------------------------------------- Hola, an Israeli company that develops a browser plug-in promoted heavily as a means to bypass region locks on Web-based content and anonymous surfing, faced a considerable amount of backlash last week - after it was discovered they were selling access to their users connections in what one researcher called "a poorly secured botnet."On Friday, 24-hours after the quasi-botnet operation was disclosed, a group of researchers released details on a number of critical vulnerabilities in... --------------------------------------------- http://www.csoonline.com/article/2929192/data-protection/researchers-discov… *** Unzählige Apps speichern private Daten unsicher in der Cloud *** --------------------------------------------- Auf den Cloud-Servern von Apple und Co. schlummern 56 Millionen nicht optimal geschützte Datensätze. Angreifer könnten vergleichsweise einfach Fotos, Adressdaten und weitere Infos abgreifen. --------------------------------------------- http://heise.de/-2671988 *** Blue Coat: SSL Visibility Appliance web based vulnerabilities, (Sun, May 31st) *** --------------------------------------------- Blue Coat has released a security advisory for SSL Visibility Appliance. The SSL Visibility Appliance is susceptible to multiple web-based vulnerabilities in the administration console. A remote attacker can use these vulnerabilities to obtain administrative access to the SSL Visibility Appliance. All versions of SSL Visibility prior to 3.8.4 are vulnerable. The vulnerabilities exist in the WebUI are: Cross-Site Request Forgery (CVE-2015-2852): Cross-site request forgery (CSRF) vulnerability... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19749&rss *** JSA10681 - 2015-05 Out of Cycle Security Bulletin: "Logjam" passive attack on sub-1024 DH groups, and active downgrade attack of TLS to DHE_EXPORT (CVE-2015-4000) *** --------------------------------------------- Affected Products: Junos OS (XNM-SSL)*, WXOS --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10681&actp=RSS *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Headend Digital Broadband Delivery System HTTP Response-Splitting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38863 *** Cisco Conductor for Videoscape and Cisco Headend System Release HTTP Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38945 *** Cisco Headend System Release Archive File Download Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38944 *** Cisco Headend System Release UDP TFTP and DHCP Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38938 *** Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39130 *** Multiple Cisco Products TCP Flood Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38943 *** Security Advisory: cURL and libcurl vulnerability CVE-2015-3148 *** --------------------------------------------- (SOL16707) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16707.htm… *** Security Advisory: cURL and libcurl vulnerability CVE-2015-3143 *** --------------------------------------------- (SOL16704) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16704.htm… *** Novell Messenger 3.0 Support Pack 1 *** --------------------------------------------- Abstract: Novell Messenger 3.0 Support Pack 1 has been released. Please be aware that there are security fixes to Messengers server and client components (see the change log below and the Readme documentation on the web). It is recommended that they are updated on an expedited basis.Document ID: 5211030Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:consoleone1.3.6h_windows.zip (46.82 MB)nm301_full_linux_multi.tar.gz (269.53 MB)nm301_client_mac_multi.zip (40.61 --------------------------------------------- https://download.novell.com/Download?buildid=j6RbJAJrtC4~ *** IDM 4.5 MSGW Driver 4.0.1.0 *** --------------------------------------------- Abstract: This is a patch for the Managed System Gateway Driver (MSGW) for Identity Manager. It installs on Identity Manager version 4.5 but can be used on IDM 4.0.2. The version of this driver is 4.0.1.0Document ID: 5211010Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:IDM45_MSGW_4010.zip (4.68 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches:IDM 4.0.2 MSGW Driver Version 4.0.0.6 --------------------------------------------- https://download.novell.com/Download?buildid=UQgGwYtht9c~ *** PHP Integer Overflows Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032433 *** PHP Multipart POST Request Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032432 *** PHP Functions That Permit Null Characters in Path Values May Let Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1032431 *** Security Notice - Statement on Security Researchers Revealing Security Vulnerabilities in Huawei SOHO Products on Packet Storm Website *** --------------------------------------------- May 30, 2015 17:23 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Huawei Wimax CPE Bm632w Hidden Backdoor *** --------------------------------------------- Topic: Huawei Wimax CPE Bm632w Hidden Backdoor Risk: High Text:Exploit Title : Huawei Wimax CPE Bm632w Hidden Backdoor Date : 30 May 2015 Exploit Author : Koorosh Ghorbani Site : http://8... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050183 *** Security Notice - Statement on Security Researchers Revealing Security Vulnerability in Huawei CPE Products on cxsecurity Website *** --------------------------------------------- Jun 01, 2015 14:48 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DSA-3275 fusionforge - security update *** --------------------------------------------- Ansgar Burchardt discovered that the Git plugin for FusionForge, aweb-based project-management and collaboration software, does notsufficiently validate user provided input as parameter to the method tocreate secondary Git repositories. A remote attacker can use this flawto execute arbitrary code as root via a specially crafted URL. --------------------------------------------- https://www.debian.org/security/2015/dsa-3275 *** DSA-3276 symfony - security update *** --------------------------------------------- Jakub Zalas discovered that Symfony, a framework to create websites andweb applications, was vulnerable to restriction bypass. It wasaffecting applications with ESI or SSI support enabled, that use theFragmentListener. A malicious user could call any controller via the/_fragment path by providing an invalid hash in the URL (or removingit), bypassing URL signing and security rules. --------------------------------------------- https://www.debian.org/security/2015/dsa-3276 *** ESC 8832 Data Controller Session Hijacking *** --------------------------------------------- Topic: ESC 8832 Data Controller Session Hijacking Risk: Medium Text:=begin # Exploit Title: ESC 8832 Data Controller multiple vulnerabilities # Date: 2014-05-29 # Platform: SCADA / Web Applica... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050181

1 0

Tageszusammenfassung - Freitag 29-05-2015
by Daily end-of-shift report 29 May '15

29 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-05-2015 18:00 − Freitag 29-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** The Empire Strikes Back Apple - how your Mac firmware security is completely broken *** --------------------------------------------- [...] What is that hole after all? Is Dark Jedi hard to achieve on Macs? No, it's extremely easy because Apple does all the dirty work for you. What the hell am I talking about? Well, Apple's S3 suspend-resume implementation is so f*cked up that they will leave the flash protections unlocked after a suspend-resume cycle. --------------------------------------------- https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-ma… *** HITB Amsterdam Wrap-Up Day #1 *** --------------------------------------------- The HITB crew is back in the beautiful city of Amsterdam for a new edition of their security conference. Here is my wrap-up for the first day! The opening keynote was assigned to Marcia Hofmann who worked for the EFF (the Electronic Frontier Foundation). Her keynote title was: "Fighting for Internet Security in the New Crypto Wars". EFF always fight for more privacy and she reviewed the history of encryption and... --------------------------------------------- http://blog.rootshell.be/2015/05/28/hitb-amsterdam-wrap-up-day-1-2/ *** Sicherheitslücken: Fehler in der Browser-Logik *** --------------------------------------------- Mit relativ simplen Methoden ist es dem 18-jährigen Webentwickler Bas Venis gelungen, schwerwiegende Sicherheitslücken im Chrome-Browser und im Flash-Plugin aufzudecken. Er ruft andere dazu auf, nach Bugs in der Logik von Browsern zu suchen. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-fehler-in-der-browser-logik-150… *** Tor: Hidden Services leichter zu deanonymisieren *** --------------------------------------------- Das Tor-Protokoll erlaubt es Angreifern relativ einfach, die Kontrolle über die Verzeichnisserver sogenannter Hidden Services zu erlangen. Dadurch ist die Deanonymisierung von Traffic deutlich einfacher als beim Zugriff auf normale Webseiten. --------------------------------------------- http://www.golem.de/news/tor-hidden-services-leichter-zu-deanonymisieren-15… *** Crypto flaws in Blockchain Android app sent Bitcoins to the wrong address *** --------------------------------------------- A comedy of programming errors could prove catastrophic for affected users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/9dMUjIT6yyo/ *** ZyXEL schützt seine Router vor NetUSB-Lücke *** --------------------------------------------- Mit Sicherheits-Updates schließt der Netzwerkausrüster ZyXEL die kritische NetUSB-Lücke in allen betroffenen Modellen. --------------------------------------------- http://heise.de/-2671364 *** Lessons learned from Flame, three years later *** --------------------------------------------- Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. Since that, we reported on many other advanced malware platform. Looking back at the discovery of Flame, here are some lessons we learned. --------------------------------------------- http://securelist.com/blog/opinions/70149/lessons-learned-from-flame-three-… *** Phishing Gang is Audacious Manipulator *** --------------------------------------------- Cybercriminals who specialize in phishing -- or tricking people into giving up usernames and passwords at fake bank and ecommerce sites -- arent generally considered the most sophisticated crooks, but occasionally they do exhibit creativity and chutzpah. Thats most definitely the case with a phishing gang that calls itself the "Manipulaters Team", whose Web site boasts that it specializes in brand research and development. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qKqrwDK8oQ8/ *** A Drafty House: Analysis of the Current Use of AWS EC2 Security Groups *** --------------------------------------------- After a very confusing set of results from a survey we ran and exploring the new world of threat detection and incident response in AWS, we decided to go out and do a little research to see how the world was faring with the new security features in Amazon AWS. In short, we can safely say there is a good chunk of the EC2 users who left their front door open (actually with this analogy they also left their back door, side window, and garage open). Our analysis showed that users are: Using... --------------------------------------------- https://feeds.feedblitz.com/~/93538286/0/alienvault-blogs~A-Drafty-House-An… *** Stegosploit hides malicious code in images, this is the future of online attacks *** --------------------------------------------- Stegosploit is the technique developed by the security researcher Saumil Shah that allows an attacker to embed executable JavaScript code within an image. The security researcher Saumil Shah from Net Square security has presented at Hack In The Box conference in Amsterdam his Stegosploit project which allows an attacker to embed executable JavaScript code within an... --------------------------------------------- http://securityaffairs.co/wordpress/37302/hacking/stegosploit-malware-image… *** Statistics on botnet-assisted DDoS attacks in Q1 2015 *** --------------------------------------------- One popular DDoS scenario is a botnet-assisted attack. In Q1 2015, 23,095 botnet-assisted DDoS attacks were reported. These statistics refer to those botnets which were detected and analyzed by Kaspersky Lab. --------------------------------------------- http://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddo… *** Linux Kernel __driver_rfc4106_decrypt() Buffer Overflow May Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032416 *** Pivotal Cloud Foundry directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103449 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** IBM Cognos Business Intelligence Developer 10.2.1 (backURL) Open Redirect *** --------------------------------------------- Input passed via the backURL GET parameter in /p2pd/servlet/dispatch is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5244.php *** DSA-3274 virtualbox - security update *** --------------------------------------------- Jason Geffner discovered a buffer overflow in the emulated floppydisk drive, resulting in potential privilege escalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3274 *** IDS RTU 850 Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in IDS RTU 850C. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-148-01 *** Security Notice - Statement on Security Researchers Revealing Security Issues on Huawei Products in HITB SecConf *** --------------------------------------------- May 29, 2015 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Notice-Statement on the Wooyun-disclosed XSS Vulnerability in Huawei Smartphone Browser *** --------------------------------------------- May 29, 2015 17:43 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36740 *** HPSBGN03332 rev.1 - HP Operations Analytics running SSLv3, Remote Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP Operations Analytics running SSLv3. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290405142… *** HPSBMU03267 rev.2 - HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with the HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL. These vulnerabilities comprise the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290406517… *** HPSBMU03263 rev.3 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Insight Control running OpenSSL. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290408721… *** HPSBMU03261 rev.2 - HP Systems Insight Manager running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Systems Insight Manager running OpenSSL on Linux and Windows. These vulnerabilities are related to the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290410464…

1 0

Tageszusammenfassung - Donnerstag 28-05-2015
by Daily end-of-shift report 28 May '15

28 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-05-2015 18:00 − Donnerstag 28-05-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39012 http://tools.cisco.com/security/center/viewAlert.x?alertId=39013 http://tools.cisco.com/security/center/viewAlert.x?alertId=39015 http://tools.cisco.com/security/center/viewAlert.x?alertId=38349 http://tools.cisco.com/security/center/viewAlert.x?alertId=39041 http://tools.cisco.com/security/center/viewAlert.x?alertId=39042 *** Microsoft to Detect Search Protection Code as Malware *** --------------------------------------------- Microsoft security products will begin detecting software containing search protection functions and classifying it as malicious on June 1. --------------------------------------------- http://threatpost.com/microsoft-to-detect-search-protection-code-as-malware… *** ZDI-15-246: (0Day) Wavelink Emulation ConnectPro TermProxy WLTermProxyService.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation ConnectPro TermProxy. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-246/ *** ZDI-15-245: (0Day) Wavelink Emulation License Server LicenseServer.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation License Server. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-245/ *** Ransomware threat Locker has sleeper component *** --------------------------------------------- KnowBe4 is alerting IT managers to be vigilant of a new ransomware threat that leverages a sleeper function. --------------------------------------------- http://www.scmagazine.com/alert-warns-it-managers-of-locker-ransomware/arti… *** Apple iOS Notification Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032408 *** Angler exploit kit pushing CryptoWall 3.0, (Thu, May 28th) *** --------------------------------------------- In the past two days, Ive infected two hosts from Angler exploit kit (EK) domains at 216.245.213.0/24. Both hosts were infected with CryptoWall 3.0 ransomware using the same bitcoin address for the ransom payment: 16Z6sidfLrfNoxJNu4qM5zhRttJEUD3XoB On Tuesday, 2015-05-26 at 15:17 UTC, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19737 *** APPLE-SA-2015-05-27-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00002.ht… *** Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities *** --------------------------------------------- Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities Multiple vulnerabilities in OpenSSL versions before 1.0.1m and 0.9.8zf (SPL-98351) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on .. --------------------------------------------- http://www.splunk.com/view/SP-CAAAN4P *** Grabit and the RATs *** --------------------------------------------- Not so long ago, Kaspersky clients in the United States approached Kaspersky researchers with a request to investigate a new type of malicious software that they were able to recover from their organizations' servers. The malware calls itself Grabit. --------------------------------------------- http://securelist.com/blog/research/70087/grabit-and-the-rats/ *** Trend Micro Discovers Apache Cordova Vulnerability that Allows One-Click Modification of Android Apps *** --------------------------------------------- We've discovered a vulnerability in the Apache Cordova app framework that allows attackers to modify the behavior of apps just by clicking a URL. The extent of the modifications can range from causing nuisance for app users to crashing the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** SAP HANA Log Injection *** --------------------------------------------- Under certain conditions the SAP HANA XS engine is vulnerable to arbitrary log injection, allowing remote authenticated attackers to write arbitrary information in log files. This could be .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050172 *** SAP HANA Information Disclosure *** --------------------------------------------- Under certain conditions some SAP HANA Database commands could be abused by a remote authenticated attacker to access information which is restricted. This could be used to gain access .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050171 *** SOPHOS WAF JSON Filter Bypass *** --------------------------------------------- Topic: SOPHOS WAF JSON Filter Bypass Risk: Low Text:SECURITYLABS INTELLIGENT RESEARCH - SECURITY ADVISORY http://www.securitylabs.com.br/ ADVISORY/0115 - SOPHOS WAF (WEBSERV... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050169 *** Phishers register domain names, hammer traditional targets *** --------------------------------------------- The number of domain names used for phishing reached an all-time high, according to a new report by the the Anti-Phishing Working Group (APWG). Many of these were registered by .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18429 *** Crash-Benachrichtigung für iOS-Geräte: Apple stellt Bugfix in Aussicht *** --------------------------------------------- Apple will den 'Unicode of Death'-Fehler, der iPhone und iPad durch eine bestimmte Zeichenfolge zum Absturz bringt, mit einem Software-Update beheben - das Problem betrifft weit mehr als nur iMessage. --------------------------------------------- http://heise.de/-2669432 *** Oracle PeopleSoft admin credentials open to hackers *** --------------------------------------------- SAP Security experts discovered a number of unpatched vulnerabilities and weaknesses in Oracle PeopleSoft that could be exploited to obtain admin passwords. The SAP security experts, Alexander Polyakov and Alexey Tyurin, revealed that Oracle .. --------------------------------------------- http://securityaffairs.co/wordpress/37270/hacking/oracle-peoplesoft-vulnera… *** Bugtraq: [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices *** --------------------------------------------- http://www.securityfocus.com/archive/1/535626 *** IDS, IPS and UTM - What's the Difference? *** --------------------------------------------- In our last webcast, we learned about lingering and general confusion over these crazy acronyms IDS and IPS, and how they are like or unlike UTM software modules. Everyone likes primers and simple descriptive definitions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/ids-ips-and-utm-whats-…

1 0

Tageszusammenfassung - Mittwoch 27-05-2015
by Daily end-of-shift report 27 May '15

27 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-05-2015 18:00 − Mittwoch 27-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** This is not the UEFI backdoor you are looking for *** --------------------------------------------- This is currently the top story on the Linux subreddit. It links to this Tweet which demonstrates using a System Management Mode backdoor to perform privilege escalation under Linux. This is not a story.But first, some background. System Management Mode (SMM) is a feature in most x86 processors since the 386SL back in 1990. It allows for certain events to cause the CPU to stop executing the OS, jump to an area of hidden RAM and execute code there instead, and then hand off back to the OS... --------------------------------------------- http://mjg59.dreamwidth.org/35110.html *** Breach detection: Five fatal flaws and how to avoid them *** --------------------------------------------- When the Sarbanes-Oxley Act of 2002 was passed, it fell on corporate security teams to translate its requirements into technical controls. That threw the IT Security function into the deep end of the ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uoHRSOyKltE/article.php *** Five Mistakes MSSPs Should Avoid *** --------------------------------------------- MSSPs, or Managed Security Service Providers, are at an exciting point where market acceptance, awareness and demand have converged. I view this as a positive for a potential MSSP but also for the customers and businesses they will protect, enhancing security for everyone. However, excitement and the prospect of profits can create haste, and with haste comes an increased risk of mistakes. In my role at AlienVault, Ive been fortunate enough to work with and help ensure the success of a number of... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/five-mistakes-mssps-sh… *** Over 30% of Official Images in Docker Hub Contain High Priority Security Vulnerabilities *** --------------------------------------------- Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of official repositories contain images that are highly susceptible to a variety of security attacks (e.g., Shellshock, Heartbleed, Poodle, etc.). For general images... --------------------------------------------- http://www.banyanops.com/blog/analyzing-docker-hub/ *** Jetzt patchen: Synology-NAS über Fotoalbum angreifbar *** --------------------------------------------- Synologys Web-Fotoalbum Photo Station gewährt Angreifern ungewollt Zugriff auf DiskStation NAS-Systeme. Wer nicht will, dass Fremde beliebigen Code auf dem eigenen NAS ausführen, sollte den Patch des Herstellers jetzt einspielen. --------------------------------------------- http://heise.de/-2668853 *** How to Prevent a Domain Name Theft *** --------------------------------------------- 1. Introduction The domain names may cost far more than a real estate. For instance, Facebook paid USD 8.5 million to buy fb.com. The high prices of the domain names attract not only businesses, but also thieves. The domain name theft can be huge trouble for companies because it effects their brand and reputation. This... --------------------------------------------- http://resources.infosecinstitute.com/how-to-prevent-a-domain-name-theft/ *** SQL-Injection-Lücke in xt:Commerce *** --------------------------------------------- Sicherheitsupdates schließen in der Shop-Software eine Lücke, durch die Angreifer potenziell Datenbankbefehle einschleusen können. --------------------------------------------- http://heise.de/-2667569 *** Possible Wordpress Botnet C&C: errorcontent.com, (Tue, May 26th) *** --------------------------------------------- Thanks to one of our readers, for sending us this snipped of PHP he found on a Wordpress server (I added some line breaks and comments in red for readability): #2b8008# ">">/* turn off error reporting */ @ini_set(display_errors ">/* do not display errors to the user */ $wp_mezd8610 = @$_SERVER[HTTP_USER_AGENT">/* only run the code if this is Chrome or IE and not a bot */ if (( preg_match (/Gecko|MSIE/i, $wp_mezd8610) !preg_match (/bot/i, $wp_mezd8610))) { --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19733&rss *** Researchers Exploit Patched Windows Group Policy Bug *** --------------------------------------------- Researchers from Core Security were able to exploit a security vulnerability in Windows group policy -- MS15-011 -- that was patched by Microsoft in February. --------------------------------------------- http://threatpost.com/researchers-exploit-patched-windows-group-policy-bug/… *** Online-Dienst erstellt maßgeschneiderte Krypto-Trojaner *** --------------------------------------------- Die Einstiegshürde für angehende Online-Erpresser ist erneut gesunken: Ein Dienst im Tor-Netz erstellt nach wenigen Klicks den individuellen Erpressungs-Trojaner. Falls ein Opfer das geforderte Lösegeld zahlt, verdienen die Betreiber mit. --------------------------------------------- http://heise.de/-2668860 *** Security: Zwei neue Exploits auf Router entdeckt *** --------------------------------------------- Unsichere Router sind aktuell von gleich zwei Versionen von Malware bedroht. Die eine verteilt Spam über soziale Medien, die andere leitet Anfragen auf manipulierte Webseiten um. (Router, Virus) --------------------------------------------- http://www.golem.de/news/security-zwei-neue-exploits-auf-router-entdeckt-15… *** extjs Arbitrary File Read / ssrf Vulnerability *** --------------------------------------------- Topic: extjs Arbitrary File Read / ssrf Vulnerability Risk: High Text:Hi all： Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050162 *** USN-2622-1: OpenLDAP vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2622-126th May, 2015openldap vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryOpenLDAP could be made to crash if it received specially crafted networktraffic.Software description openldap - OpenLDAP utilities DetailsIt was discovered that OpenLDAP incorrectly handled certain search queriesthat returned empty attributes. A remote attacker could use this issue tocause... --------------------------------------------- http://www.ubuntu.com/usn/usn-2622-1/ *** Cisco IP Phone 7861 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39011 *** ZDI-15-240: Dell NetVault Backup Heap Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell NetVault Backup. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/y6osEWmyti0/ *** ZDI-15-244: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicies Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NFGleCbsATc/ *** ZDI-15-243: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicy Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OV8j2fD9GSM/ *** ZDI-15-242: Arcserve Unified Data Protection Management Service exportServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/CxxqPV5u-0s/ *** ZDI-15-241: Arcserve Unified Data Protection Management Service reportFileServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/MNmtjnSQ_b4/ *** SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information --------------------------------------------- http://www.securitytracker.com/id/1032402 *** Security Advisory: Point-to-Point Protocol (PPP) vulnerability CVE-2015-3310 *** --------------------------------------------- (SOL16686) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/600/sol16686.htm… *** lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries *** --------------------------------------------- lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries --------------------------------------------- http://www.securitytracker.com/id/1032405 *** Rockwell Automation RSView32 Weak Encryption Algorithm on Passwords *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on May 12, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a password encryption vulnerability in RSView32. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02 *** Thycotic Password Manager Secret Server iOS Application MITM *** --------------------------------------------- Topic: Thycotic Password Manager Secret Server iOS Application MITM Risk: Medium Text:Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability -- http://www.info-sec.ca/adviso... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050167

1 0

Tageszusammenfassung - Dienstag 26-05-2015
by Daily end-of-shift report 26 May '15

26 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-05-2015 18:00 − Dienstag 26-05-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Annual Privacy Forum 2015: Call for Papers and latest news *** --------------------------------------------- The Annual Privacy Forum (APF) meeting will be taking place on the 7th and 8th of October 2015 in Luxembourg, during its Presidency of the Council of the EU. This year, the main focus of the APF will be on privacy of electronic communications. Current open calls:... --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2015-call-… *** Securing Web APIs: The Basics with Node.js Examples *** --------------------------------------------- Introduction Public-facing APIs have tremendously increased in the last couple of years. Businesses have seen that sharing their business data with the public can be beneficial. There are many reasons for this: such as the fact that it allows the API users to create something new and interesting with the shared data, and that APIs... --------------------------------------------- http://resources.infosecinstitute.com/securing-web-apis-the-basics-with-nod… *** Android: Schlüssel werden auf zurückgesetzten Smartphones nicht gelöscht *** --------------------------------------------- Auf zurückgesetzten Android-Smartphones lassen sich Daten wiederherstellen, auch auf solchen, die zuvor verschlüsselt wurden. Anwender können kaum etwas dagegen tun. --------------------------------------------- http://www.golem.de/news/android-schluessel-werden-auf-zurueckgesetzten-sma… *** Recent Breaches a Boon to Extortionists *** --------------------------------------------- The recent breaches involving the leak of personal data on millions of customers at online hookup site Adult Friend Finder and mobile spyware maker mSpy give extortionists and blackmailers plenty of ammunition with which to ply their trade. And there is some evidence that neer-do-wells are actively trading this data and planning to abuse it for financial gain. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/spK0KOTLf64/ *** Travel smart: Tips for staying secure on the road *** --------------------------------------------- Cybercriminals dont take vacations. In fact, they feast on tourists and travelers, taking advantage of people when their guards are down or when theyre distracted by other pursuits. Wombat Security Technologies pulled together four essential tips from our security awareness and training materials that you can use to stay safe when you travel --------------------------------------------- http://www.net-security.org/secworld.php?id=18421 *** How to Pass-the-Hash with Mimikatz *** --------------------------------------------- A hidden gem in mimikatz is its ability to create a trust relationship from a username and password hash. --------------------------------------------- http://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/ *** Windows Functions in Malware Analysis - Cheat Sheet - Part 1 *** --------------------------------------------- In this article, we will learn briefly about the various windows functions commonly encountered by malware analysts. Windows Functions Accept: This function is used to listen for incoming connections. This function indicates that the program will listen for incoming connections on a socket. It is mostly used by malware to communicate with their Command and... --------------------------------------------- http://resources.infosecinstitute.com/windows-functions-in-malware-analysis… *** Exploit-Kit greift über 50 Router-Modelle an *** --------------------------------------------- Wer einen unsicher konfigurierten Router betreibt, könnte schon bald Probleme bekommen: Ein Virenforscher hat ein Exploit-Kit entdeckt, das zahlreiche Router-Modelle bekannter Hersteller angreifen kann. --------------------------------------------- http://heise.de/-2665387 *** How often should companies conduct web penetration testing? *** --------------------------------------------- Following our previous blog post "How long does website penetration testing take" we received a lot of questions from our customers and partners about the recommended frequency of penetration testing for their web applications. In this blog post we will answer that question. --------------------------------------------- https://www.htbridge.com/blog/how_often_conduct_web_penetration_testing.html *** Cisco Unified Communications Manager Multiple Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38964 *** Cisco HCS Administrative Web Interface Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38969 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** PostgreSQL Bugs Let Remote Users Deny Service and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032396 *** Cacti Input Validation Flaw in graph.php Lets Remote Authenticated Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032385 *** VU#551972: Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files *** --------------------------------------------- Vulnerability Note VU#551972 Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files Original Release date: 26 May 2015 | Last revised: 26 May 2015 Overview The Synology Cloud Station sync client for OS X contains a setuid root executable that allows regular users to claim ownership of system files. Description CWE-276: Incorrect Default Permissions - CVE-2015-2851The Synology Cloud Station sync client for OS X contains an executable named --------------------------------------------- http://www.kb.cert.org/vuls/id/551972 *** Bugtraq: Synology Photo Station multiple Cross-Site Scripting vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535607 *** Bugtraq: Reflected Cross-Site Scripting in Synology DiskStation Manager *** --------------------------------------------- http://www.securityfocus.com/archive/1/535606 *** Bugtraq: Command injection vulnerability in Synology Photo Station *** --------------------------------------------- http://www.securityfocus.com/archive/1/535605 *** HP SiteScope Unspecified Flaw Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1032395 *** GigPress <= 2.3.8 - Authenticated SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8003 *** NewStatPress 0.9.8 - XSS and SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8004

1 0

Tageszusammenfassung - Freitag 22-05-2015
by Daily end-of-shift report 22 May '15

22 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-05-2015 18:00 − Freitag 22-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake jQuery Scripts in Nulled WordPress Plugins *** --------------------------------------------- We recently investigated some random redirects on a WordPress website that would only happen to certain visitors. Traffic analysis showed us that it was not a server-side redirect, rather it happened due to some script loaded by the web pages. A quick look through the HTML code revealed this script: It was very suspicious for... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NmLDakrD_1U/fake-jquery-scrip… *** Researchers publish developer guidance for medical device security *** --------------------------------------------- The guidance is organized into 10 categories, and serves as "starting point for a more complete code," report authors said. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/jvWoZydXqwc/ *** Researchers observe SVG files being used to distribute ransomware *** --------------------------------------------- When downloaded and executed, the SVG files cause websites to open up that download what appears to be CryptoWall ransomware. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Aa-yVI5Bd-A/ *** Exploring CVE-2015-1701 - A Win32k Elevation of Privilege Vulnerability Used in Targeted Attacks *** --------------------------------------------- Our analysis of the win32k.sys vulnerability used in a recent targeted attack reveals that it opens up an easy way to bypass the sandbox, making it a bigger threat than originally thought. As mentioned in Microsoft security bulletin MS15-051, CVE-2015-1701 is an elevation of privilege vulnerability that exists when the Win32k.sys kernel-mode driver improperly handles... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RuzGqW0kQdY/ *** Digital Agenda Seminar: European Cyber Security Month *** --------------------------------------------- Within the context of European Cyber Security Month (ECSM) preparations, the ENISA team is organising several seminars and trainings in order to build up the coalition for Cybersecurity Education action. You are invited to participate in the second seminar in Berlin, Germany on June 5th, 2015. In this half-day seminar we discuss and provide the latest information on Digital Agenda topics such as e-skills, Network Information Security, educational tools and advocacy initiatives. To participate it is necessary to confirm participation to daria.catalui(a)enisa.europa.eu by June 4th, 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/digital-agenda-seminar-european… *** Daten von Millionen zurückgesetzten Android-Smartphones wiederherstellbar *** --------------------------------------------- Wer sein Android-Smartphone verkauft hat, muss befürchten, dass trotz gelöschten Gerätespeichers noch private Daten wie etwa Nachrichten und Log-in-Daten im Speicher schlummern, die unter Umständen wiedergehergestellt werden können. --------------------------------------------- http://heise.de/-2663267 *** Forensic Analysis of Smartphone Factory Reset Function *** --------------------------------------------- ADISA, the organisation that sets security standards around the secure disposal of IT Assets, has released new research into the forensic analysis of smartphone factory reset functions. Written by Steve Mellings, Founder of ADISA, and Professor Andrew Blyth of the University of South Wales, the white paper explores how effective smartphone factory reset functions actually are at removing data. This data is then used to offer businesses and individual users advice on how best to protect their... --------------------------------------------- http://www.informationsecuritybuzz.com/forensic-analysis-of-smartphone-fact… *** When Security Makes Users Asleep! *** --------------------------------------------- It's a fact, in industries or on building sites, professional people make mistakes or, worse, get injured. Why? Because their attention is reduced at a certain point. When you're doing the same job all day long, you get tired and lack of concentration. The same can apply in information security! For a long time, more and more solutions are deployed in companies to protect their data and users. Just... --------------------------------------------- http://blog.rootshell.be/2015/05/22/when-security-makes-users-asleep/ *** Citrix Security Advisory for DHE_EXPORT TLS Vulnerability CVE-2015-4000 *** --------------------------------------------- A TLS protocol vulnerability has been recently disclosed that could result in attackers being able to intercept and modify SSL/TLS encrypted traffic ... --------------------------------------------- http://support.citrix.com/article/CTX201114 *** Citrix Security Advisory for CVE-2015-3456 *** --------------------------------------------- Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the ... --------------------------------------------- http://support.citrix.com/article/CTX201078 *** python-kerberos checkPassword() spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103310 *** Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38946 *** ICU Buffer Overflows in resolveImplicitLevels() Let Remote Users Deny Service and Potentially Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032366 *** Schneider Electric OFS Server Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a DLL hijacking vulnerability in the Schneider Electric OPC Factory Server (OFS) server application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 *** Emerson AMS Device Manager SQL Injection Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an SQL injection vulnerability in the Emerson AMS Device Manager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 *** OleumTech WIO Family Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-202-01 OleumTech WIO Family Vulnerabilities that was published July 21, 2014. This advisory provides vulnerability details in the OleumTech WIO family including the sensors and the DH2 data collector. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-202-01A *** HPSBMU03336 rev.1- HP Helion OpenStack affected by VENOM, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has identitfied with HP Helion OpenStack. The vulnerability could be exploited resulting in Denial of Service (DoS) or execution of arbitrary code. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c… *Next End-of-Shift report on 2015-05-26*

1 0

Tageszusammenfassung - Donnerstag 21-05-2015
by Daily end-of-shift report 21 May '15

21 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-05-2015 18:00 − Donnerstag 21-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RIG Exploit Kit Infection Cycle Analysis *** --------------------------------------------- Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes weve observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post well cover an example of a full RIG infection cycle. Delivery... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JM9Mp15Wupg/rig-exploit-… *** New Router Attack Displays Fake Warning Messages *** --------------------------------------------- Just because security researchers report about threats doesn't mean we're exempted from them. I recently experienced an incident at home that involved tampered DNS router settings. I was redirected to warning pages that strongly resemble those used in previous FAKEAV attacks. I noticed that my home internet router DNS settings have been modified from its default settings. (My router... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/dJj2wXBlvgk/ *** Exploit kits delivering Necurs, (Thu, May 21st) *** --------------------------------------------- Introduction In the past few days, weve seenNuclear and Anglerexploit kits (EKs) deliveringmalware identified as Necurs. It certainly isntthe only payload sentfrom Nuclear and otherEKs, but I hadnt really looked into EK traffic sending Necurs lately. Documented as early as 2012, Necurs is a type of malware that opens a back door on the infected computer [1]. It may also disable antivirus products as well as download additional malware [1][2]. I sawNecurs as a malware payload from Nuclear and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19719&rss *** Das Erste-Hilfe-Kit gegen Krypto-Trojaner *** --------------------------------------------- Mit einer Reihe von Werkzeugen will ein Forscher den Opfern von Erpressungs-Trojanern helfen, ihre Daten zu retten und ihre Systeme zu reinigen. Allerdings ist bei der Anwendung Vorsicht geboten. --------------------------------------------- http://heise.de/-2661154 *** Mumblehard Malware *** --------------------------------------------- Introduction In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives the full control of the infected machine to cybercriminals. Mumblehard malware -Components Perl Backdoor Perl backdoor will request for commands from its Command &Control Server and... --------------------------------------------- http://resources.infosecinstitute.com/mumblehard-malware/ *** Logjam: the latest TLS vulnerability explained *** --------------------------------------------- 21 May 2015 by Filippo Valsorda --------------------------------------------- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ *** The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange *** --------------------------------------------- Logjam is a new attack against the Diffie-Hellman key-exchange protocol used in TLS. Basically: The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html *** CVE-2015-4000 alias "Logjam" .. *** --------------------------------------------- http://www.cert.at/services/blog/20150521111403-1485.html *** Vuln: OpenSSL CVE-2015-0288 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73237 *** Vuln: OpenSSL /evp/encode.c Remote Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73228 *** Samba Memory Corruption Error in prs_append_some_prs_data() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032362 *** Cisco Security Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 *** Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38937 *** Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 *** DSA-3265 zendframework - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in Zend Framework, a PHPframework. Except for CVE-2015-3154, all these issues were already fixedin the version initially shipped with Jessie. --------------------------------------------- https://www.debian.org/security/2015/dsa-3265

1 0

Tageszusammenfassung - Mittwoch 20-05-2015
by Daily end-of-shift report 20 May '15

20 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-05-2015 18:00 − Mittwoch 20-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS, (Wed, May 20th) *** --------------------------------------------- Theres a new vulnerability in town... As reported by the Wall Street Journal, The new bug, dubbed LogJam, is a cousin of Freak. But its in the basic design of TLS itself, meaning all Web browsers, and some email servers, are vulnerable. [1] According to the article, Internet-security experts crafted a fix for a previously undisclosed bug in security tools used by all modern Web browsers. But deploying the fix could break the Internet for thousands of websites. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19717&rss *** Logjam: PFS Deployment Guide *** --------------------------------------------- Guide to Deploying Diffie-Hellman for TLS | Our study finds that the current real-world deployment of Diffie-Hellman is less secure than previously believed. This page explains how to properly deploy Diffie-Hellman on your server. | We have three recommendations for correctly deploying Diffie-Hellman for TLS:... --------------------------------------------- https://weakdh.org/sysadmin.html *** DDoS Attacks on the rise in Q1 2015, says Akamai *** --------------------------------------------- DDoS attacks even more dangerous according to the last report published by Akamai Technologies, the "Q1 2015 State of the Internet - Security Report". According to Akamai Technologies, Q1 2015 showed that distributed denial-of-service attacks are on the rise again, and according to Akamai Technologies, Q1 set a record for the number of DDoS attacks,... --------------------------------------------- http://securityaffairs.co/wordpress/36983/security/akamai-ddos-q1-2015.html *** "Los Pollos Hermanos" ransomware - what will they think of next? *** --------------------------------------------- The latest visual meme in ransomware comes from a cult TV show...about ficticious crooks. Paul Ducklin walks you through "PolloCrypt," more correctly known as Troj/LPoLock-A... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/jdSKvU31t58/ *** JSON, Homoiconicity, and Database Access *** --------------------------------------------- During a recent review of an internal web application based on the Node.js platform, we discovered that combining JavaScript Object Notation (JSON) and database access (database query generators or object-relational mappers, ORMs) creates interesting security challenges, particularly for JavaScript programming... --------------------------------------------- https://securityblog.redhat.com/2015/05/20/json-homoiconicity-and-database-… *** iOS Security Guide (iOS 8.3) *** --------------------------------------------- https://www.apple.com/business/docs/iOS_Security_Guide.pdf *** What We Learned From a Data Exfiltration Incident at an Electric Utility *** --------------------------------------------- We often hear about the dangers of a cyberattacks taking down the grid, but seldom is public information available about the loss of sensitive information, particularly from the OT. The confidential information in this case was the utilitys smart grid and metering R&D knowledge base, which is intellectual property and information that attackers can use to compromise the smart grid. --------------------------------------------- http://www.elp.com/articles/powergrid_international/print/volume-20/issue-5… *** 5 Signs Credentials In Your Network Are Being Compromised *** --------------------------------------------- Where should you start to keep ahead of attackers using insiders to steal corporate secrets or personal identifiable information? Check out these common scenarios. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/5-signs-credentials-in… *** Update soll Mac-Outlook 2011 reanimieren *** --------------------------------------------- Mit Version 14.5.1 der Office-Version 2011 für OS X will Microsoft ein Problem bei Outlook beseitigen - der E-Mail-Client ließ sich nach Installation des vorausgehehenden Updates unter Umständen nicht mehr verwenden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-soll-Mac-Outlook-2011-reanimi… *** MS15-046 - Version: 2.0 *** --------------------------------------------- V2.0 (May 19, 2015): Bulletin revised to announce the release of the Microsoft Office for Mac 14.5.1 update. The release addresses a potential issue with Microsoft Outlook for Mac when customers install the Microsoft Office for Mac 14.5.0 update. Customers who have not already installed the 14.5.0 update should install the 14.5.1 update to be fully protected from this vulnerability. To avoid the possibility of future issues with Microsoft Outlook for Mac, Microsoft recommends that customers... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-046 *** HPSBGN03286 rev.1 - HP LoadRunner, Buffer Overflow *** --------------------------------------------- A potential security vulnerability has been identified with HP LoadRunner. The vulnerability could be exploited remotely to allow a buffer overflow. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04594015 *** HPSBUX03334 SSRT102000 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679334 *** HPSBUX03333 SSRT102029 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS), or Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679309 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- 38913 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38913 *** ZDI-15-235: ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x_So65VKXQk/ *** ZDI-15-234: ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NDUhf-djzIs/ *** ZDI-15-233: Valve Steam Client Detection Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute a denial of service attack on vulnerable installations of Valve Steam. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/z6v9MWWd9O4/ *** Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities *** --------------------------------------------- Topic: Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities Risk: High Text:Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Bru... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050127 *** IPsec-Tools 0-day Denial of Service *** --------------------------------------------- Topic: IPsec-Tools 0-day Denial of Service Risk: High Text:Denial of Service in IPsec-Tools Vulnerability Report May 19, 2015 Product: IPsec-Tools Version: 0.8.2 Website: http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050128 *** Security Advisory - Two Privilege Escalation Vulnerabilities in Huawei Mate 7 Smartphones *** --------------------------------------------- May 20, 2015 14:40 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23257]: Stored XSS in WP Photo Album Plus WordPress Plugin *** --------------------------------------------- Product: WP Photo Album Plus WordPress Plugin v6.1.2Vulnerability Type: Cross-Site Scripting [CWE-79]Risk level: Medium Creater: J.N. BreetveltAdvisory Publication: April 29, 2015 [without technical details]Public Disclosure: May 20, 2015 CVE Reference: CVE-2015-3647 CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N) Vulnerability Details: High-Tech Bridge Security Research Lab discovered stored XSS vulnerability in WP Photo Album Plus WordPress plugin, which can be exploited to perform... --------------------------------------------- https://www.htbridge.com/advisory/HTB23257 *** Bugtraq: Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535576

1 0

Tageszusammenfassung - Dienstag 19-05-2015
by Daily end-of-shift report 19 May '15

19 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-05-2015 18:00 − Dienstag 19-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tracking SSL Issues with the SSL Labs API *** --------------------------------------------- The SSL and TLS protocols have been on the front of the stage for months. Besides many vulnerabilities disclosed in the OpenSSL library, the deployment of SSL and TLS is not always easy. They are weak cyphers (like RC4), weak signatures, certificates issues (self-signed, expiration or fake ones). Other useful features are mis-understood and not often not configured like PFS ("Perfect Forward Secrecy"). Encryption effectiveness is directly related... --------------------------------------------- http://blog.rootshell.be/2015/05/18/tracking-ssl-issues-with-the-ssl-labs-a… *** Magnitude Exploit Kit leading to Ransomware via Malvertising *** --------------------------------------------- Magnitude Exploit Kit is a malicious exploit package that leverages a victim's vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack, which is often leveraged on compromised websites and malicious advertising networks. We recently found a number of compromised pages following the structure of fake search engine... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/YQBX1Zq733A/magnitude-ex… *** Website Security - How Do Websites Get Hacked? *** --------------------------------------------- In 2014 the total number of websites on the internet reached 1 billion, today it's hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let's take a minute to absorb that number for a moment. Another surprising statistic is... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/w0FMyW_q_bA/website-security-… *** Cyber Security Challenge 2015 *** --------------------------------------------- Cyber Security Challenge 2015 | 19. Mai 2015 | Auch heuer gibt es wieder die Cyber Security Challenge zur Suche von Hacker-Nachwuchstalenten. 2015 wird das europäische Finale zwischen 6 Ländern ausgespielt, und Österreich muss den Titel verteidigen.Die Qualifizierungsrunde läuft heuer von 4. Mai bis 3. August und steht Schülern und Studenten offen. Details siehe www.verbotengut.at.Wir wollen wieder ein gutes Team zusammenbekommen, wir bitten daher alle Leser, diesen Hinweis... --------------------------------------------- http://www.cert.at/services/blog/20150519084602-1482.html *** Cmstar Downloader: Lurid and Enfal's New Cousin *** --------------------------------------------- In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as "Enfal". Cmstar was named for the log message "CM**" used by the downloader. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-… *** SSH-Client Putty: Trojaner-Version im Umlauf *** --------------------------------------------- Wer mit dem SSH-Client Putty auf Geräte zugreifen will, sollte auf die Quelle des Clients achten. Aktuell geistert nämlich eine Version durch das Internet, die einen Trojaner auf Computer schmuggelt, um Daten abzugreifen. --------------------------------------------- http://heise.de/-2654274 *** More on Chris Roberts and Avionics Security *** --------------------------------------------- Last month ago I blogged about security researcher Chris Roberts being detained by the FBI after tweeting about avionics security while on a United flight: But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/more_on_chris_r.html *** How much money do cyber crooks collect via crypto ransomware? *** --------------------------------------------- FireEye researchers have calculated that the cybercriminals wielding TeslaCrypt and AlphaCrypt have managed to extort $76,522 from 163 victims in only two months. "This amount may seem trivial co... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uK_6Ovw0K9M/malware_news.… *** Address spoofing Safari bug opens door for phishing attacks *** --------------------------------------------- Hacker David Leo has released a PoC exploit for a Safari vulnerability that can be misused to trick users into thinking they are on one site while they are actually on another - a boon for phishers. ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/6F6ptWfI8rw/secworld.php *** Address-Spoofing Bug Haunts Android Stock Browser *** --------------------------------------------- There's an easily exploitable vulnerability in the Android stock browser that enables an attacker to spoof the URL in the address bar and force a victim to visit a malicious site while believing he is visiting a benign one. Security researcher Rafay Baloch discovered the vulnerability and developed the technique for exploiting it. The problem... --------------------------------------------- http://threatpost.com/address-spoofing-bug-haunts-android-stock-browser/112… *** KCodes NetUSB: How a Small Taiwanese Software Company Can Impact the Security of Millions of Devices Worldwide *** --------------------------------------------- Today the SEC Consult Vulnerability Lab released an advisory regarding a vulnerability in a software component called NetUSB. This post intends to give some background information about this vulnerability.NetUSB is a proprietary technology developed by the Taiwanese company KCodes, intended to provide "USB over IP" functionality. USB devices (e.g. printers, external hard drives, flash drives) plugged into a Linux-based embedded system (e.g. a router, an access point or a dedicated... --------------------------------------------- http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html *** [2015-05-19] Critical buffer overflow vulnerability in KCodes NetUSB *** --------------------------------------------- KCodes NetUSB is vulnerable to a buffer overflow via the network that results in a denial of service or code execution. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38905 *** IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by cross-site scripting (XSS) Vulnerabilities in Dojo Toolkit *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21902837 *** Moodle Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1032358 *** Bugtraq: [SECURITY] [DSA 3175-2] kfreebsd-9 security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/535562

1 0

Tageszusammenfassung - Montag 18-05-2015
by Daily end-of-shift report 18 May '15

18 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-05-2015 18:00 − Montag 18-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyberattacks on Oil and Gas Firms Launched with no Malware at all *** --------------------------------------------- Oil and gas industry targeted by hackers with a genuine looking windows file, not a malware. The attacks are ongoing for about two years. A unique targeted attack being underway for about two consecutive years exploits Windows file functions that look legitimate and a couple of homemade scripts - but not malware - in order... --------------------------------------------- http://securityaffairs.co/wordpress/36843/cyber-crime/cyberattacks-on-oil-a… *** Microsoft Stops Chinese Group from Using TechNet Site for Attacks (May 14, 2015) *** --------------------------------------------- Microsoft and FireEye have taken steps to prevent a group of Chinese cyber criminals known as APT17 from using the companys TechNet website in its attacks... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/38/302 *** VENOM - Does it live up to the hype?, (Sat, May 16th) *** --------------------------------------------- Unless you have been hiding under a rock this week you have heard about VENOM. The first article that I saw was fromZDNet with the headline of Bigger than Heartbleed, Venom security vulnerability threatens most datacenters. Pretty provocative stuff. Is VENOM really worth that much hype? VENOM stands for Virtualized Environment Neglected Operations Manipulation. The cuteacronym basically means that the exploit takes advantage of a vulnerability in legacy code.In short thevulnerability is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19701&rss *** AEADs: getting better at symmetric cryptography *** --------------------------------------------- I gave a talk a couple of weeks ago at the Yahoo Unconference. The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer, articulation of its contents. --------------------------------------------- http://www.imperialviolet.org/2015/05/16/aeads.html *** About the supposed factoring of a 4096 bit RSA key *** --------------------------------------------- tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key. Earlier today a blog post claiming the factoring of a 4096 bit RSA key was published and quickly made it to the top of Hacker News. The key in question was the PGP key of a well-known Linux kernel developer. I already commented on Hacker News why this is most likely wrong, but I thought Id write up some more details. To understand what is going on I have to explain some background both on RSA and... --------------------------------------------- https://blog.hboeck.de/archives/872-No,-nobody-has-factored-a-4096-bit-RSA-… *** Google App Engine: Google reagiert träge auf Java-Sicherheitslücken *** --------------------------------------------- Klammheimlich patcht Google Java-Schwachstellen in seiner Entwicklungsumgebung App Engine und ignoriert den Entdecker der Lücken weitgehend. Einige Sicherheitslücken klaffen immer noch. --------------------------------------------- http://heise.de/-2652121 *** Angreifer nutzen kritische Lücke in ProFTPD aus *** --------------------------------------------- Wer den FTP-Server ProFTPD betreibt, muss handeln: Durch eine schwerwiegende Schwachstelle können Online-Ganoven beliebigen Code ausführen. Und das tun sie auch bereits. --------------------------------------------- http://heise.de/-2652114 *** Screech! Grand Theft Auto V malware mods warning *** --------------------------------------------- Gamers find themselves in latest Mods & Rockstar punch-up Cybercrooks are cooking up malware disguised as mods for the Grand Theft Auto V video game. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/18/gta_malware… *** Rombertiks disk wiping mechanism is aimed at pirates, not researchers *** --------------------------------------------- Rombertik, the information-stealing malware that was recently analyzed by Cisco researchers and which apparently tries to prevent researchers from doing so by rewriting the computers Master Boot Reco... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/oE0fh7NZ4sg/malware_news.… *** Oracle Patches VENOM Vulnerability *** --------------------------------------------- Oracle on Saturday released its patch for the VENOM vulnerability, a guest escape flaw that affects many virtualization platforms. --------------------------------------------- http://threatpost.com/oracle-patches-venom-vulnerability/112868 *** openssh 6.8p1 heap buffer overflow *** --------------------------------------------- Topic: openssh 6.8p1 heap buffer overflow Risk: High Text:Quick background story: I started a while ago to develop a solution to use american fuzzy lop with networking input. I did so b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050105 *** Bugtraq: [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine *** --------------------------------------------- http://www.securityfocus.com/archive/1/535548 *** ZDI-15-230: ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/qN5KZVA4xgA/ *** ZDI-15-229: ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/PLAGhXOxQh0/ *** ZDI-15-231: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/HtMlLoJoKXI/ *** Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38884 *** DSA-3261 libmodule-signature-perl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libmodule-signature-perl, aPerl module to manipulate CPAN SIGNATURE files. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3261 *** SAP Sybase Unwired Platform Online Data Proxy Discloses Password and Username Information to Local Users *** --------------------------------------------- http://www.securitytracker.com/id/1032310 *** SAP Customer Relationship Management Bugs Let Users Execute Arbitrary Code and Remote Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032309 *** SAP NetWeaver RFC SDK Discloses Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032308

1 0

Tageszusammenfassung - Freitag 15-05-2015
by Daily end-of-shift report 15 May '15

15 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-05-2015 18:00 − Freitag 15-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38789 http://tools.cisco.com/security/center/viewAlert.x?alertId=38808 http://tools.cisco.com/security/center/viewAlert.x?alertId=38811 http://tools.cisco.com/security/center/viewAlert.x?alertId=38833 http://tools.cisco.com/security/center/viewAlert.x?alertId=38864 http://tools.cisco.com/security/center/viewAlert.x?alertId=38865 http://tools.cisco.com/security/center/viewAlert.x?alertId=38866 http://tools.cisco.com/security/center/viewAlert.x?alertId=38869 http://tools.cisco.com/security/center/viewAlert.x?alertId=38868 *** Multiple vulnerabilities in Loxone Smart Home (part 2) *** --------------------------------------------- The Loxone Smart Home vulnerabilities published in February 2015 (SA-20150227-0) have not been fixed entirely and can still be exploited. Furthermore, new security issues have been identified. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Openlitespeed <= 1.3.10 Multiple Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050096 *** Hospira LifeCare PCA Infusion System Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification .. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A *** Organizational Challenges in the Internet of Things *** --------------------------------------------- As a result of the increase in cyber-attacks launched by nation-states, cybercriminals, hacktivist groups and other entities, it has become increasingly important to understand the ecosystem of hardware, O/S, software, and services that are used in each organization's network, including .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/organizational-c… *** Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked *** --------------------------------------------- mSpy, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the companys servers was posted on the Dark Web, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-cu… *** Vulnerabilities in PHPMyAdmin *** --------------------------------------------- http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php *** Kritik an fehlenden Sicherheitsfunktionen der Apple Watch *** --------------------------------------------- Die Apple Watch lässt sich ohne Kenntnis des Gerätecodes zurücksetzen – im Unterschied zu iPhone und iPad gibt es allerdings keine Aktivierungssperre, die die frische Inbetriebnahme durch einen Dieb verhindert. --------------------------------------------- http://heise.de/-2650499 *** Erpresser drohen zahlreichen deutschen Shops mit DDoS-Attacken *** --------------------------------------------- Eine Erpresserwelle verunsichert Betreiber von deutschen Online-Shops: Wer nicht zahlt, verliert womöglich Kunden. Was tun? --------------------------------------------- http://heise.de/-2650465 *** McAfees Reinigungs-Tool Stinger installiert heimlichen Wächter *** --------------------------------------------- Wer McAfees Scan-Tool "Stinger" benutzt, um seinen PC zu säubern, bekommt ungefragt einen Virenwächter im Betastadium untergeschoben. Einen Opt-Out gibt es nicht. --------------------------------------------- http://heise.de/-2645759 *** Hacking communities in the Deep Web *** --------------------------------------------- The role of hackers has changed over the years, in the past these professionals were viewed as dangerous criminals that needed to be kept at arm's length; meanwhile today they are highly sought from private companies, intelligence .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-communities-in-the-deep-web/ *** SAP LZC LZH Compression Multiple Vulnerabilities *** --------------------------------------------- SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the .. --------------------------------------------- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vul… *** Latest Microsoft Security Intelligence Report Now Available *** --------------------------------------------- This volume of the SIR focuses on the second half of 2014 and contains longer term trend data as well. SIR volume 18 contains data, insights and practical guidance on a range of global and regional cybersecurity threats including vulnerability disclosures, malware and unwanted software including the latest on .. --------------------------------------------- http://blogs.microsoft.com/cybertrust/2015/05/14/latest-microsoft-security-… *** If Youre Typing the Word MCRYPT Into Your Code, Youre Doing It Wrong *** --------------------------------------------- Foreword: You probably should not be deploying your own cryptography to begin with, especially if you dont already understand that encryption is not authentication. For production systems, use PECL libsodium or defuse/php-encryption and save yourself the headache. The rest of this post is intended for PHP developers who still want to write their own cryptography code, or already have. --------------------------------------------- https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-c… *** One year of DANE Tales and Lessons Learned *** --------------------------------------------- https://ripe70.ripe.net/presentations/183-dane-ripe.pdf *** Cylance SPEAR Team: A Threat Actor Resurfaces *** --------------------------------------------- Attackers typically shut down campaigns or halt activity after they are exposed by security researchers, thereby creating the impression they have dropped off the map. This often leads to a false sense of security within the community and perpetuates the idea that public exposure makes us all safer. While the .. --------------------------------------------- http://blog.cylance.com/spear-a-threat-actor-resurfaces

1 0

Tageszusammenfassung - Mittwoch 13-05-2015
by Daily end-of-shift report 13 May '15

13 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-05-2015 18:00 − Mittwoch 13-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-09: Security updates available for Adobe Flash Player APSB15-10: Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1197 *** How Social Media Blacklisting Happens *** --------------------------------------------- In today's world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in .. --------------------------------------------- https://blog.sucuri.net/2015/05/how-social-media-blacklisting-happens.html *** Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web-based administration interface of the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38767 *** Another look at Niteris : post exploitation WMI and Fiddler checks *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html *** Adobe, Microsoft Push Critical Security Fixes *** --------------------------------------------- Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-f… *** [2015-05-13] Multiple critical vulnerabilities in WSO2 Identity Server *** --------------------------------------------- An unauthenticated attacker is able to read arbitrary local files from the WSO2 Identity Server by using the SAMLv2 authentication interface. Moreover, targeted attacks against users or administrators of the Identity Server may be conducted using CSRF and XSS vulnerabilities. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security: Wie Google Android sicher macht *** --------------------------------------------- HTTPS soll ausgemustert, Android sicherer werden, und es soll ein PGP-Plugin für Gmail geben: Google verstärkt seinen Einsatz im Bereich IT-Sicherheit enorm. Wir haben mit Googles IT-Sicherheitsexperten Stephan Somogyi darüber gesprochen. (Google, Gmail) --------------------------------------------- http://www.golem.de/news/security-wie-google-android-sicher-macht-1505-1140… *** Microsoft Security Bulletin Summary for May 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for May 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. Microsoft also .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-may *** VENOM, don't get bitten. *** --------------------------------------------- QEMU is a generic and open source machine emulator and virtualizer and is incorporated in some Red Hat products as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM hypervisors. CVE-2015-3456 (aka VENOM) .. --------------------------------------------- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ *** Anatomy of an APT Attack: Step by Step Approach *** --------------------------------------------- This article will explore the technique, design and the inner workings of an APT (Advanced Persistent Threat) attack. It will also relate various stages of attack with a few attacks that were custom-created to penetrate enterprises for extraction of internal data, trade secrets, and sensitive business .. --------------------------------------------- http://resources.infosecinstitute.com/anatomy-of-an-apt-attack-step-by-step… *** Spam and Phishing in the First Quarter of 2015 *** --------------------------------------------- The share of spam in email traffic in the first quarter of 2015 was 59.2%; the percentage of spam gradually declined during the quarter. Spam traffic included a large number of mass mailings with Microsoft Word or Excel attachments containing macro viruses. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/69932/spam-and-phishi… *** OSIsoft PI AF Incorrect Default Permissions Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 *** Edge: Wie Microsoft seinen neuen Browser absichern will *** --------------------------------------------- Detailliert beschreibt Microsoft neue und bekannte Techniken, mit denen die Sicherheit des Edge-Browsers "fundamental" verbessert werden soll. Dabei hilft auch der Verzicht auf alte Technik des Internet Explorers. --------------------------------------------- http://www.golem.de/news/edge-wie-microsoft-seinen-neuen-browser-absichern-… Aufgrund des morgigen (14.05.2015) Feiertages erscheint der nächste End-of-Shift-Report erst am Freitag, den 15.05.2015.

1 0

Tageszusammenfassung - Dienstag 12-05-2015
by Daily end-of-shift report 12 May '15

12 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-05-2015 18:00 − Dienstag 12-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Steganography and Malware: Concealing Code and C&C Traffic *** --------------------------------------------- In our earlier post discussing steganography, I discussed how it is now being used to hide configuration data by malware attackers. Let's go discuss this subject another facet of this topic in this post: how actual malware code is hidden in similar ways. Security analysts will probably throw their hands up in the air and say, 'we've .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/steganography-an… *** Add GitHub dorking to list of security concerns *** --------------------------------------------- One of the big lessons that weve learned in the last 10 years is that even little pieces of once disparate data, gathered in a single location, can yield startling truths. With Facebook, that lesson crystallized with the introduction of its Graph Search feature in 2013, when the online world .. --------------------------------------------- http://www.csoonline.com/article/2921177/application-security/add-github-do… *** Golem.de-Test mit Kaspersky: So sicher sind Fototerminals und Copyshops *** --------------------------------------------- Wie gefährlich ist es, mit beschreibbaren USB-Sticks und SD-Karten Fotos und Dateien ausdrucken zu lassen? Golem.de hat zusammen mit dem Sicherheitsunternehmen Kaspersky getestet, ob auch Windows-XP-Terminals ohne Virenscanner sicher sind. --------------------------------------------- http://www.golem.de/news/golem-de-test-mit-kaspersky-so-sicher-sind-fototer… *** Verschlüsselte OSGP-Kommunikation von Smart Metern leicht belauschbar *** --------------------------------------------- Wenn Geräte im Smart Grid Informationen austauschen, könnten Angreifer trotz Krypto-Einsatz zumindest beim Standard Open Smart Grid Protocol Daten abgreifen. Sicherheitsforscher machen dafür das schwache Protokoll verantwortlich. --------------------------------------------- http://heise.de/-2642228 *** The State of ASLR on Android Lollipop *** --------------------------------------------- Modern platforms like Android devices enforce execute protections on memory, so injecting code into the process is often no longer the lowest hanging fruit for exploitation. Reusing the existing code and data has become the norm, and statistical defense via Address-Space Layout randomization is still the only widely available .. --------------------------------------------- https://copperhead.co/2015/05/11/aslr-android-zygote *** How secure will our data be in the post-quantum era? *** --------------------------------------------- Build your security for the next 50 years. If the speed of processing doubles every two years, make sure your cryptographic systems can't be brute forced in 50 years. If you use 2048 bit RSA, it will take some quadrillion years to break it. Good enough, right? --------------------------------------------- https://medium.com/@amarchenkova/how-secure-will-our-data-be-in-the-post-qu… *** Bublik Trojan - Variant Evolves with New Features *** --------------------------------------------- While there are many similar types of malware in use today, Bublik is being used for malicious activity and appears to be under active development, suggesting that its creators have paying customers. Because security involves a dynamic interaction .. --------------------------------------------- http://www.isightpartners.com/2015/05/bublik-trojan-variant-evolves-with-ne…

1 0

Tageszusammenfassung - Montag 11-05-2015
by Daily end-of-shift report 11 May '15

11 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-05-2015 18:00 − Montag 11-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 *** VMSA-2015-0003.8 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38763 *** Who's Scanning Your Network? (A: Everyone) *** --------------------------------------------- Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldnt believe that people actually still cared about scanning, and I told him as much: These days there are .. --------------------------------------------- http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/ *** NCSC publishes factsheet Help! My website has been defaced *** --------------------------------------------- To deface a website the attacker changes the content of existing pages or adds new ones. Hundreds of websites are defaced every day, often without being specifically targeted. It is becoming increasingly common for defacements to .. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-he… *** Jellyfish: Malware nistet sich in GPUs ein *** --------------------------------------------- Nutzt eine Malware den Prozessor einer Grafikkarte, ist sie nicht nur schwerer aufzuspüren, sondern kann auch die höhere Rechenleistung der GPU nutzen. Jellyfish will zeigen, dass solcher Schadcode funktioniert. --------------------------------------------- http://www.golem.de/news/jellyfish-malware-nistet-sich-in-gpus-ein-1505-113… *** Yubikey: Nie mehr schlechte Passwörter *** --------------------------------------------- Unser Autor hat 152 Onlinekonten, die er möglichst gut absichern will. Mit dem Passwortmanager Keepass und einem sogenannten Token - dem Yubikey Neo. Eine Anleitung. --------------------------------------------- http://www.golem.de/news/yubikey-nie-mehr-schlechte-passwoerter-1505-113872… *** Tor-Bridges für Amazon EC2 eingestampft *** --------------------------------------------- Ab sofort wird es schwerer, Nutzern alternative Zugänge zum Anonymisierungsnetz Tor zur Verfügung zu stellen. Das entsprechende Projekt für Cloud-Images wurde eingestellt. --------------------------------------------- http://heise.de/-2640793 *** 60 Days of Watching Hackers Attack Elasticsearch *** --------------------------------------------- Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the .. --------------------------------------------- https://jordan-wright.github.io/blog/2015/05/11/60-days-of-watching-hackers… *** Finger printing: Print the Finger of an Application *** --------------------------------------------- When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, .. --------------------------------------------- http://resources.infosecinstitute.com/finger-printing-print-the-finger-of-a… *** Angler exploit kit using tricks to avoid referrer chain leading back to malvertisement provider *** --------------------------------------------- For some time I've been seeing the Angler exploit kit pop up and infect clients without through malvertising campaigns without having a referer when visitng the landing page. The reason why this is interesting is that it makes it a lot harder to track down the malicious creative IDs which can .. --------------------------------------------- http://blog.0x3a.com/post/118366451134/angler-exploit-kit-using-tricks-to-a…

1 0

{Spam?} Tageszusammenfassung - Freitag 8-05-2015
by Daily end-of-shift report 08 May '15

08 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-05-2015 18:00 − Freitag 08-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB15-10) *** --------------------------------------------- A prenotification Security Advisory has been posted regarding upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 12, 2015. We will continue to provide updates on the upcoming release via the Security Advisory as well as the Adobe PSIRT blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1193 *** Compromised WordPress sites leaking credentials *** --------------------------------------------- Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/63XGcunva0k/compromised-… *** GPU-based malware, the evolution of rootkits and keyloggers *** --------------------------------------------- Malware developers have presented two proof-of-concept malware, a rootkit and a keylogger, which exploit the GPU of the infected host. Malware authors always demonstrate a great creativity and the ability to propose even more effective solutions, recently developers have published two strains of malware, Jellyfish rootkit and the Demon keylogger, that implement an unusual way to run on a victim's... --------------------------------------------- http://securityaffairs.co/wordpress/36634/malware/gpu-based-malware.html *** Almost EVERY SAP install hackable, researchers say *** --------------------------------------------- Even worse when you tinker with it. A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/08/sap_95_perc… *** l+f: Kritische Lücke in Überwachungs-Software für kritische Systeme *** --------------------------------------------- Über einen Bug in Symantecs Server-Überwachungs-Software können Angreifer den Systemen beliebige Dateien unterjubeln und diese ausführen. --------------------------------------------- http://heise.de/-2638669 *** The USBKILL anti-forensics tool - it doesnt do *quite* what it says on the tin *** --------------------------------------------- A hacker who very modestly goes by the handle Hephaestos has just announced an "anti-forensic kill switch" dubbed, well, usbkill. It doesnt do quite what the name might suggest, and it could cut either way, so use it with care! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/tzGEjCOTbq4/ *** Flawed Open Smart Grid Protocol is a risk for Smart Grid *** --------------------------------------------- More than four million smart meters and similar devices worldwide are open to cyber attacks due to the security issued in the Open Smart Grid Protocol. The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) that are implemented today by more than four million smart... --------------------------------------------- http://securityaffairs.co/wordpress/36648/hacking/flaws-open-smart-grid-pro… *** IETF spezifiziert Richtlinien für den Einsatz von Verschlüsselung *** --------------------------------------------- Das Gremium für Internet-Standards dokumentiert Richtlinien für den sinnvollen Einsatz der Transportverschlüsselung TLS. Der RFC 7525 enthält gute Anleitungen, Tipps und Hinweise auf Fallstricke für jeden, der Verschlüsselung selbst einrichtet. --------------------------------------------- http://heise.de/-2639221 *** Angreifer können Viren-Scanner von BullGuard und Panda lahmlegen *** --------------------------------------------- Mehrere Antiviren-Anwendungen von BullGuard und Panda weisen eine Sicherheitslücke auf, über die Angreifer die Schutzfunktionen deaktivieren können. --------------------------------------------- http://heise.de/-2639307 *** DSA-3253 pound - security update *** --------------------------------------------- Pound, a HTTP reverse proxy and load balancer, had several issuesrelated to vulnerabilities in the Secure Sockets Layer (SSL) protocol. --------------------------------------------- https://www.debian.org/security/2015/dsa-3253 *** Sentinel 7.3 HF1 (Sentinel 7.3.0.1) Build 1800 7.3.0.1 *** --------------------------------------------- Abstract: Sentinel 7.3.0.1 upgrade patch for Sentinel 7.Document ID: 5202070Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:sentinel_server-7.3.0.1-1817.x86_64.tar.gz.sha256 (109 bytes)sentinel_server-7.3.0.1-1817.x86_64.tar.gz (1.67 GB)Products:Sentinel 7.1SentinelSentinel 7.1.1Sentinel 7.1.2Sentinel 7.XSentinel 7.3Sentinel 7.2.2Sentinel 7.2.1Sentinel 7.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=mBuUwDq2kD0~ *** Rockwell Automation RSLinx Classic Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Rockwell Automation's OPCTest.exe, which is a test client for RSLinx Classic's support of the OPC-DA protocol. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02 *** VMSA-2015-0003.7 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** ZDI Security Advisories for EMC AutoStart and for ManageEngine Products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/published/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21902444 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli System Automation for Multiplatforms (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21882749 *** IBM Security Bulletin: Multiple Kernel vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022146 *** IBM Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer *** http://www.ibm.com/support/docview.wss?uid=swg21883926 *** Security Bulletin: Vulnerability in SSLv3 affects Upward Integration Modules (UIM) (CVE-2014-3566) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097659 *** IBM Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022149 *** IBM Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022145 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Endpoint Manager (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883852 *** Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097676

1 0

Tageszusammenfassung - Donnerstag 7-05-2015
by Daily end-of-shift report 07 May '15

07 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-05-2015 18:00 − Donnerstag 07-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco UCS Central Software Arbitrary Command Execution Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco UCS Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** eShop 6.3.11 - Remote Code Execution *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7967 *** Multiple vulnerabilities in ManageEngine Applications Manager *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-170 http://www.zerodayinitiative.com/advisories/ZDI-15-169 http://www.zerodayinitiative.com/advisories/ZDI-15-168 http://www.zerodayinitiative.com/advisories/ZDI-15-167 http://www.zerodayinitiative.com/advisories/ZDI-15-166 *** Macro Malware: When Old Tricks Still Work, Part 2 *** --------------------------------------------- In the first part of this series, we discussed about the macro malware we have recently seen in the threat landscape. This second entry will delve deeper into the techniques or routines of macro malware. Unintended consequences Let us put things into .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/macro-malware-wh… *** APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 *** --------------------------------------------- Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00000.ht… *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Wie gestern (06. Mai) bekannt wurde, gibt es eine Sicherheitslücke im "Genericons icon font package" von WordPress, welches in vielen populären Themes und Erweiterungen, darunter das .. --------------------------------------------- http://cert.at/warnings/all/20150507.html *** Protect your network with DNS Firewall *** --------------------------------------------- If you run your own mail server, you will quickly find out that 90% of the e-mails you receive are spam. The solution .. --------------------------------------------- http://securityblog.switch.ch/2015/05/07/protect-your-network-with-dns-fire… *** Security Operations Center *** --------------------------------------------- Ensuring the confidentiality, integrity, and availability of a modern information technology enterprise is a big job. Cyber security breaches are becoming common news. The role of .. --------------------------------------------- http://resources.infosecinstitute.com/security-operations-center/ *** Analyzing Quantum Insert Attacks *** --------------------------------------------- A Quantum Insert Attack is a classic example of man-in-the-middle attacks which resurfaced into news among the top 10 biggest .. --------------------------------------------- http://resources.infosecinstitute.com/analyzing-quantum-insert-attacks/ *** Avast verdächtigt Windows-Bibliotheken als Trojaner *** --------------------------------------------- Der Virenwächter Avast hat DLL-Dateien von Windows als gefährlich eingestuft und in Quarantäne verschoben. Danach liefen bei betroffenen Nutzern einige Programme nicht mehr. --------------------------------------------- http://heise.de/-2638093 *** Falscher PC-Experte überwies während Fernwartung Geld nach Bangkok *** --------------------------------------------- Mehrere Hundert Euro Schaden - Bank konnte Transaktion nicht mehr rückgängig machen - Polizei warnt vor Betrugsmasche mit falschen Microsoft-Mitarbeitern --------------------------------------------- http://derstandard.at/2000015448793 *** How to make two binaries with the same MD5 hash *** --------------------------------------------- One question I was asked when I demod creating two PHP files with the same hash is; does it work on compiled binaries? --------------------------------------------- http://natmchugh.blogspot.co.uk/2015/05/how-to-make-two-binaries-with-same-…

1 0

Tageszusammenfassung - Mittwoch 6-05-2015
by Daily end-of-shift report 06 May '15

06 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-05-2015 18:00 − Mittwoch 06-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Root-Shell im Krankenhaus: Hospira-Infusionspumpe mit Telnet-Lücke *** --------------------------------------------- Computer, die in Krankenhäusern die Abgabe von Medikamenten direkt ins Blut der Patienten steuern, sollten eigentlich einigermaßen abgesichert sein. Bei in US-Kliniken verbreiteten Infusionspumpen wurde jedoch eine "game-over vulnerability" entdeckt. --------------------------------------------- http://heise.de/-2633529 *** Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the CUCReports page of Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the CUCReports web interface. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38675 *** Cisco Unified Communications Manager SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38674 *** Spearphishing: A New Weapon in Cyber Terrorism *** --------------------------------------------- Introduction: Spear phishing attacks Spear phishing and its evolutions like the watering hole attack represent one of the most insidious attack techniques adopted by the majority of threat actors in cyber space. According to the experts .. --------------------------------------------- http://resources.infosecinstitute.com/spearphishing-a-new-weapon-in-cyber-t… *** Hospira LifeCare PCA Infusion System Vulnerabilities *** --------------------------------------------- This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in the Hospira LifeCare PCA Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 *** Studie: Die Smart City ist intelligent, aber angreifbar *** --------------------------------------------- Smarte Städte könnten zum Ziel von Hackerangriffen werden. Durch die zunehmende Vernetzung potenzieren sich die Sicherheitslücken, wie eine Studie zeigt. --------------------------------------------- http://www.golem.de/news/studie-die-smart-city-ist-intelligent-aber-angreif… *** Tinba - Yet another anti-sandbox tricks *** --------------------------------------------- Malware authors certainly do not take a breather when it comes to inventing new tricks for detecting sandbox, a very useful system to automatically analyze millions of samples nowadays. Recently, Seculert unveiled an unprecedented sandbox detection method that was employed by the Dyre/Dyreza malware. We had seen similar anti-sandbox tricks used by the .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002810.html *** Erneut massive Sicherheitslücke bei Lenovo-Rechnern *** --------------------------------------------- Hacker konnten durch Fehler im Update-System Schadprogramme als Lenovo-Software ausgeben --------------------------------------------- http://derstandard.at/2000015349945 *** IT threat evolution in Q1 2015 *** --------------------------------------------- In the first quarter of 2015 Kaspersky Lab products detected a total of 2,2 bln malicious attacks and more than 93 mln unique malicious URLs. The story of the powerful Equation cyberespionage group was perhaps the most talked-about news story of Q1. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/69872/it-threat-ev… *** Nmap Cheat Sheet 5: The Final View of a Ninja Pentester *** --------------------------------------------- As we discussed in the last topic of our Nmap Series, this will be our final touch for the cheat sheet. Here we will try to cover most of the topic as required for Vulnerability Assessment and Penetration Testing. As a Ninja Pentester, .. --------------------------------------------- http://resources.infosecinstitute.com/nmap-cheat-sheet-5-the-final-view-of-… *** Explaining Security Lingo *** --------------------------------------------- This post is aimed to clarify certain terms often used in the security community. Let's start with the easiest one: vulnerability. A vulnerability is a flaw in a selected system .. --------------------------------------------- https://securityblog.redhat.com/2015/05/06/explaining-security-lingo/ *** Multiple Fortiguard products cross-site scripting vulnerabilities *** --------------------------------------------- The Web User Interface of FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiADC D models are vulnerable to reflected cross-site scripting vulnerabilities. --------------------------------------------- http://www.fortiguard.com/advisory/FG-IR-15-005/ *** JetPack and TwentyFifteen Vulnerable to DOM-based XSS - Millions of WordPress Websites Affected *** --------------------------------------------- Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with .. --------------------------------------------- https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom… *** Google-Studie: Millionen Computer mit Adware infiziert *** --------------------------------------------- Fast 5,4 Millionen Google-Besucher haben Adware auf ihren Computern installiert. Ein Grossteil davon geht auf Googles eigene Kappe, denn viele der Werbe-Einblender stammen aus dem Chrome Web Store. --------------------------------------------- http://heise.de/-2636130

1 0

Tageszusammenfassung - Dienstag 5-05-2015
by Daily end-of-shift report 05 May '15

05 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-05-2015 18:00 − Dienstag 05-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** In-Console-Able *** --------------------------------------------- Posted by James Forshaw, giving the security community a shoulder to cry on.TL;DR; this blog post describes an unfixed bug in Windows 8.1 which allows you to escape restrictive job objects in order to help to develop a sandbox escape chain in Chrome or similar sandboxes. If you're trying to develop a secure application sandbox in user-mode you're at the mercies of the underlying operating system. While you can try and use every available security feature, sometimes the OS developer... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/05/in-console-able.html *** Upatre/Dyre - the daily grind of botnet-based malspam, (Tue, May 5th) *** --------------------------------------------- Malicious spam (malspam) delivering Upatre/Dyre has been an ongoing issue for quite some time. Many organizations have posted articles about this malware. Ive read good information on Dyre last year [1, 2] and this year [3]. Upatre is the malware downloader that retrieves Dyre (Dyreza), an information stealer described as a Zeus-like banking Trojan [4]. Earlier this year, EmergingThreats reported Upatre and Dyre are under constant development [5], while SecureWorks told us banking botnets... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19657&rss *** Analogue modems allow UNSTOPPABLE Android attack ... at 13bps *** --------------------------------------------- Yes its slow, but its enough to leak data to another Android The better your Android smartphones audio, the worse its security - the audio channel is the latest path for "low and slow" data leak attacks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/boffins_rev… *** Rombertik malware kills host computers if you attempt a cure *** --------------------------------------------- Say goodbye to your master boot record and home directory if you try to stop it Cisco researchers Ben Baker and Alex Chiu have found new malware that destroys a machines Master Boot Record and home directories if it detects meddling white hats. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/rombertik_m… *** Macro Malware: When Old Tricks Still Work, Part 1 *** --------------------------------------------- Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters: Figure 1. Microsoft Word security warning for macros I went around my peers this afternoon and asked, "On the top of your head, can you give me a name of an effective macro malware? Better if its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/LjTF4yhzWt8/ *** Introducing FIDO: Automated Security Incident Response *** --------------------------------------------- Were excited to announce the open source release of FIDO (Fully Integrated Defense Operation - apologies to the FIDO Alliance for acronym collision), our system for automatically analyzing security events and responding to security incidents. --------------------------------------------- http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html *** Revealing the Secrets: Advances in Android and iOS Attacks *** --------------------------------------------- In recent months, Unit 42, the cyber threat intelligence team at Palo Alto Networks, has encountered several game-changing advances in mobile malware for both iOS and Android. For example, WireLurker employed a multistage infection that... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/revealing-secrets-advanc… *** Steganography and Malware: Why and How *** --------------------------------------------- Threats that can evade detection are among the most dangerous kind we're facing today. We see these characteristics in the most challenging security issues like targeted attacks and zero-day exploits. Being able to stay hidden can determine the success of an attack, making it something that attackers continuously want to achieve. In this series of blog posts, we... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G-eR3GU5L3Y/ *** ICU Project Overflow Vulnerabilities Patched *** --------------------------------------------- Buffer and integer overflow vulnerabilities have been patched in the ICU Project ICU4C library, used in hundreds of open source and enterprise software packages. --------------------------------------------- http://threatpost.com/icu-project-overflow-vulnerabilities-patched/112623 *** Usbkill Script Can Render Computers Useless *** --------------------------------------------- The idea of needing to disable a computer quickly as the police - or another potential adversary - comes through the door typically has been the concern of criminals. But in today's climate activists, journalists, and others may find themselves wanting to make their laptops unusable in short order, and that's where usbkill comes in. The new tool is a... --------------------------------------------- http://threatpost.com/usbkill-script-can-render-computers-useless/112622 *** VU#978652: Bomgar Remote Support Portal deserializes untrusted data *** --------------------------------------------- Vulnerability Note VU#978652 Bomgar Remote Support Portal deserializes untrusted data Original Release date: 05 May 2015 | Last revised: 05 May 2015 Overview Bomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data without sufficient validation, allowing an attacker to potentially execute arbitrary PHP code. Description CWE-502: Deserialization of Untrusted DataBomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data... --------------------------------------------- http://www.kb.cert.org/vuls/id/978652 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM OS Images for Red Hat Linux Systems and AIX. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883879 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005217 *** IBM Security Bulletin: IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models nodes are affected by vulnerabilities in Apache's Struts library (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005078 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor (CVE-2014-6585, CVE-2014-6591, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21883285 *** DSA-3250 wordpress - security update *** --------------------------------------------- Multiple security issues have been discovered in Wordpress, a weblogmanager, that could allow remote attackers to upload files with invalidor unsafe names, mount social engineering attacks or compromise a sitevia cross-site scripting, and inject SQL commands. --------------------------------------------- https://www.debian.org/security/2015/dsa-3250

1 0

Tageszusammenfassung - Montag 4-05-2015
by Daily end-of-shift report 04 May '15

04 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-04-2015 18:00 − Montag 04-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** eBay ignoriert XSS-Lücke ein Jahr lang *** --------------------------------------------- Eine Schwachstelle in eBay erlaubt es Angreifern eine Session mitzuschneiden und im schlimmsten Fall einen Account zu übernehmen. Die Lücke ist ein Jahr alt und wurde immer noch nicht geschlossen. --------------------------------------------- http://heise.de/-2630964 *** Threatpost News Wrap, May 1, 2015 *** --------------------------------------------- Dennis Fisher and Mike Mimoso discuss the post-RSA news, including the MySQL bug, the progress of the OpenSSL overhaul and the wildly entertaining House hearing on crypto backdoors. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-may-1-2015/112538 *** 3062591 - Local Administrator Password Solution (LAPS) Now Available - Version: 1.0 *** --------------------------------------------- Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3062591 *** New Google Password Alert extension already hacked *** --------------------------------------------- A few hours after the presentation of the Google Password Alert extension a researcher already have developed two methods to bypass it. A few hours ago, Google released the Password Alert extension that was designed to warn users when they are submitting their Google credentials to fraudulent websites. Here's how it works for consumer accounts. Once you've... --------------------------------------------- http://securityaffairs.co/wordpress/36483/hacking/password-alert-extension-… *** VolDiff, for memory image differential analysis, (Sun, May 3rd) *** --------------------------------------------- VolDiff is a bash script that runs Volatility plugins against memory images captured before and after malware execution providing a differential analysis, helping identify IOCs and understand advanced malware behaviour. I had intended to include it in my latest toolsmith article, Attack Detection: Hunting in-memory adversaries with Rekall and WinPmem, but quite literally ran out of space and time. Using WinPmem, as part of Rekall and GRR offerings, you can acquire two memory images, one clean --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19651&rss *** Traffic pattern change noted in Fiesta exploit kit, (Mon, May 4th) *** --------------------------------------------- A few hours ago, Jerome Segura, the Senior Security Researcher at Malwarebytes, tweeted about a change in traffic patterns from Fiesta exploit kit (EK) [1]. What had been semi-colons in the URLs from Fiesta EK are now commas. Here" /> Here" /> Any signatures for detecting Fiesta EK that depend on those semi-colons will need to be updated. A pcap of the traffic is available at http://malware-traffic-analysis.net/2015/05/04/2015-05-04-Fiesta-EK-traffic…, and a zip file of the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19655&rss *** Securing the smart grid: European Network of Cyber Security *** --------------------------------------------- Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this int... --------------------------------------------- http://www.net-security.org/article.php?id=2270 *** Nasty Dyre malware bests white hat sandboxes *** --------------------------------------------- Core checker a defensive wrecker Seculert CTO Aviv Raff says a nasty piece of malware linked to widespread destruction and bank account plundering has become more dangerous with the ability to evade popular sandboxes. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/04/dyre_malwar… *** Anti-Phishing-Erweiterung für Chrome mehrfach unterwandert *** --------------------------------------------- Eigentlich soll das Chrome-Plug-in Passwort-Warnung Alarm schlagen, wenn Nutzer ihre Log-in-Daten auf Phishing-Webseiten eingeben. Mittlerweile wurde die Funktion aber schon zum wiederholten Male ausgehebelt. --------------------------------------------- http://heise.de/-2632031 *** Linuxwochen von 7. bis 9. Mai in Wien *** --------------------------------------------- Am FH Technikum Wien finden von Donnerstag bis Sonntag Workshops und Vorträge zu Verschlüsselung, 3D-Druck und Open Hardware statt. --------------------------------------------- http://futurezone.at/produkte/linuxwochen-von-7-bis-9-mai-in-wien/128.621.4… *** AlphaCrypt *** --------------------------------------------- We've encountered yet another encrypting ransomware variant and at this point it's expected since the scam has exploaded in popularity since it's inception in late 2013. This one has a GUI that is almost... --------------------------------------------- http://www.webroot.com/blog/2015/05/04/alphacrypt/ *** Microsoft Security Bulletin MS15-032 - Critical *** --------------------------------------------- V2.0 (April 30, 2015): Updated bulletin to inform customers running Internet Explorer on Windows Server 2003 Service Pack 2 that the 3038314 update on the Microsoft Download Center was updated on April 22, 2015. Microsoft recommends that customers who installed the 3038314 update prior to April 22 should reinstall the update to be fully protected from the vulnerabilities discussed in this bulletin. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-032 *** DSA-3249 jqueryui - security update *** --------------------------------------------- Shadowman131 discovered that jqueryui, a JavaScript UI library fordynamic web applications, failed to properly sanitize its titleoption. This would allow a remote attacker to inject arbitrary codethrough cross-site scripting. --------------------------------------------- https://www.debian.org/security/2015/dsa-3249 *** DSA-3244 owncloud - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in ownCloud, a cloud storageweb service for files, music, contacts, calendars and many more. --------------------------------------------- https://www.debian.org/security/2015/dsa-3244 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco Finesse Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38607 *** Squid SSL-Bump Certificate Validation Flaw Lets Remote Servers Bypass Client-side Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032221 *** VMSA-2015-0003.6 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** VU#581276: EMC AutoStart is vulnerable to remote code execution via specially crafted packets *** --------------------------------------------- Vulnerability Note VU#581276 EMC AutoStart is vulnerable to remote code execution via specially crafted packets Original Release date: 30 Apr 2015 | Last revised: 30 Apr 2015 Overview EMC AutoStart, version 5.5.0 and earlier, is vulnerable to remote command execution via specially crafted packets. Description EMC AutoStart is an enterprise software application developed to help networks and service maintain a high level of availability. AutoStart can manage clusters of applications or nodes --------------------------------------------- http://www.kb.cert.org/vuls/id/581276 *** Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities *** --------------------------------------------- Description Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities. Multiple vulnerabilities in OpenSSL prior to 1.0.1m (SPL-98351) Disable SSLv3 in KV Store Replication (SPL-96280) Secure flag inconsistently set for session cookies when appServerPorts!=0 (SPL-95798) Cross-site scripting in Search (SPL-95594) Cross-site scripting in management and configuration (SPL-93516) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have --------------------------------------------- http://www.splunk.com/view/SP-CAAANZ7 *** RSA Identity Management and Governance Password Reset Weakness Lets Remote Users Gain Privileged Access *** --------------------------------------------- http://www.securitytracker.com/id/1032218 *** Security Advisory: TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 *** --------------------------------------------- (SOL14190) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/14000/100/sol14190.htm… *** OPTO 22 Multiple Product Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that are present in the OPTO 22 PAC Project Professional, PAC Project Basic, OptoOPCServer, OptoDataLink, PAC Display Basic, and PAC Display Professional products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 *** Clam AntiVirus Multiple File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032223 *** Dell SonicWALL Secure Remote Access Access Control Flaw in cgi-bin/editBookmark Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032227 *** SSA-311412 (Last Update 2015-05-04): Incorrect Certificate Verification in Android App HomeControl for Room Automation *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit…

1 0

Tageszusammenfassung - Donnerstag 30-04-2015
by Daily end-of-shift report 30 Apr '15

30 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-04-2015 18:00 − Donnerstag 30-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101 *** --------------------------------------------- The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2480253 *** My Website Was Blacklisted By Google and Distributing Email Spam *** --------------------------------------------- Being blacklisted is one of the worst things that can happen to a website. The public shame coming from every visitor being stopped by the Big Red Warning page can literally destroy .. --------------------------------------------- https://blog.sucuri.net/2015/04/my-website-was-blacklisted-by-google-and-di… *** Cisco StarOS for Cisco ASR 5000 Series HTTP Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38580 *** Bedep trojan malware spread by the Angler exploit kit gets political *** --------------------------------------------- We recently observed what seems to be a group of cybercriminals helping spread pro-Russia messaging by artificially inflating video views and ratings on a popular video website. The .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malware-sp… *** Cyber threat intelligence group links Russia to cyber espionage and attacks *** --------------------------------------------- "Operation Armageddon," active since at least mid-2013, exposes a cyber espionage campaign devised to provide a military advantage to Russian leadership by targeting Ukrainian government, law enforcement, and military .. --------------------------------------------- http://www.liveleak.com/view?i=b39_1430249732 *** WhatsApp durchleuchtet: Vorbildliche Verschlüsselung weitgehend nutzlos *** --------------------------------------------- Um die Frage zu beantworten wie vertrauenswürdig die von WhatsApp seit einigen Monaten eingesetzte Ende-zu-Ende-Verschlüsselung ist, hat c't sie unter die Lupe genommen: Zwar setzt WhatsApp die richtige Technik ein, viel nützt das aber trotzdem nicht. --------------------------------------------- http://heise.de/-2629081 *** Voiceprint: Stimmenerkennung ist die neue Gesichtserkennung *** --------------------------------------------- Statt mit einem Passwort können sich Bankkunden mittlerweile mit ihrer Stimme am Telefon identifizieren. Akustische Biometriesysteme werden in immer mehr Firmen eingesetzt. Die Gefahr: Auch Geheimdienste und Staaten können auf die Technik zugreifen. --------------------------------------------- http://www.golem.de/news/voiceprint-stimmenerkennung-ist-die-neue-gesichtse… *** Analysis of a MICROSOFT WORD INTRUDER sample: execution, check-in and payload delivery *** --------------------------------------------- On April 1st FireEye released a report on 'MWI; and 'MWISTAT' which is a sort of exploit kit for Word Documents if you will: A New Word Document Exploit Kit In the article FireEye goes over MWI which is the short for 'Microsoft Word Intruder' coded .. --------------------------------------------- http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intrude… *** A Brief Look at DNS Zone Transfer for Alexia's Top 1M Domains *** --------------------------------------------- The folks at Rapid7 have released another scan. This one is looking at Alexa's top 1 million domains for DNS servers which have allowed unauthenticated requests for Zone Transfer. --------------------------------------------- http://atechdad.com/a-brief-look-at-dns-zone-transfer-for-alexias-top-1m-do… *** TA15-120A: Securing End-to-End Communications *** --------------------------------------------- Securing end-to-end communications plays an important role in protecting privacy and preventing some forms of man-in-the-middle (MITM) attacks. Recently, researchers described a MITM attack used to inject code, .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A-0 *** The BACKRONYM MySQL Vulnerability *** --------------------------------------------- Earlier this year, I - along with some members of our DevOps team - noticed some interesting behavior in libmysqlclient and the MySQL CLI: no matter how hard we tried (no matter how many MYSQL_OPT_SSL_* options we set) we could not make the client enforce the use of SSL. If the server claimed not to support it, the .. --------------------------------------------- https://www.duosecurity.com/blog/backronym-mysql-vulnerability

1 0

Tageszusammenfassung - Mittwoch 29-04-2015
by Daily end-of-shift report 29 Apr '15

29 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-04-2015 18:00 − Mittwoch 29-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** VU#534407: Barracuda Web Filter insecurely performs SSL inspection *** --------------------------------------------- Barracuda Web Filter prior to version 8.1.0.005 does not properly check upstream certificate validity when performing SSL inspection, and delivers one of three default root CA certificates across multiple machines for SSL inspection. --------------------------------------------- http://www.kb.cert.org/vuls/id/534407 *** Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Overlay Transport Virtualization (OTV) processing code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 *** Cisco StarOS for Cisco ASR 5000 Series HAMGR Service Proxy Mobile IPv6 Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in proxy mobile (PM) IPv6 processing of Cisco StarOS for Cisco ASR 5000 Series devices could allow an unauthenticated, remote attacker to cause a reload of the hamgr service on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38557 *** Android: Tausende Apps akzeptieren gefälschte Zertifikate *** --------------------------------------------- Die Schwachstelle ist seit einem halben Jahr bekannt, doch noch immer können Tausende Android-Apps mit gefälschten Zertifikaten überlistet werden, verschlüsselte Verbindungen aufzubauen. Über diese können Zugangsdaten abgegriffen werden --------------------------------------------- http://www.golem.de/news/android-tausende-apps-akzeptieren-gefaelschte-zert… *** Example setup of WordPress with static export *** --------------------------------------------- 'the only winning move is not to play' - Joshua, Wargames 2 So another advice from CIRCL is: whenever it is possible, the Content Management System component should be removed from the attack surface. This article gives an example about how to set up a system that exposes only static websites without dynamically generated content to the user and attacker. --------------------------------------------- https://www.circl.lu/pub/tr-36/ *** Malware Analysis-Basics: Static Analysis *** --------------------------------------------- Hi all, I have started learning malware analysis sometime back, and will share my learning through a series of articles on malware analysis. I will start from very basic and go to advanced level of analysis. So in this this document we .. --------------------------------------------- http://resources.infosecinstitute.com/malware-analysis-basics-static-analys… *** Und täglich grüsst die D-Link-Lücke *** --------------------------------------------- Seit mindestens August klafft eine kritische Lücke in Routern der Firmen D-Link und Trendnet. Diese geht auf ein Toolkit der Firma Realtek zurück, die Anfragen von Sicherheitsforschern für Monate beharrlich ignorierte. Nun ist die Lücke öffentlich. --------------------------------------------- http://heise.de/-2628562 *** Unboxing Linux/Mumblehard: Muttering spam from your servers *** --------------------------------------------- Today, ESET researchers reveal a family of Linux malware that stayed under the radar for more than 5 years. We have named this family Linux/Mumblehard. A white paper about this threat is available for download on WeLiveSecuriy. --------------------------------------------- http://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering… *** Magento updaten! ASAP! *** --------------------------------------------- Für die Onlineshop-Software Magento ist bereits im Februar ein Patch (SUPEE-5344) erschienen, der eine schwerwiegende Sicherheitslücke schliesst. Die Firma Check Point, die die Schwachstelle entdeckt hat, .. --------------------------------------------- http://www.cert.at/services/blog/20150429154511-1469.html *** TA15-119A: Top 30 Targeted High Risk Vulnerabilities *** --------------------------------------------- Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A *** Container Security: Just The Good Parts *** --------------------------------------------- Security is usually a matter of trade-offs. Questions like: 'Is X Secure?', don't often have direct yes or no answers. A technology can mitigate certain classes of risk even .. --------------------------------------------- https://securityblog.redhat.com/2015/04/29/container-security-just-the-good… *** Report: SSDP reflection attacks spike, and other Q1 2015 DDoS trends *** --------------------------------------------- The largest distributed denial-of-service attack ever detected by Arbor Networks systems was observed in the first quarter of this year. --------------------------------------------- http://www.scmagazine.com/largest-ddos-detected-in-q1-report-says/article/4… *** ZDI-15-157: Samsung Security Manager ActiveMQ Broker Service MOVE Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-157/ *** ZDI-15-156: Samsung Security Manager ActiveMQ Broker Service PUT Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-156/

1 0

Tageszusammenfassung - Dienstag 28-04-2015
by Daily end-of-shift report 28 Apr '15

28 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-04-2015 18:00 − Dienstag 28-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Fake Security Scams - 2015 Edition *** --------------------------------------------- New Year, Similar Scams In 2013, I wrote an article talking about the popular Fake Microsoft Security Scams that were doing the rounds. As expected, these type of scams have continued to grow .. --------------------------------------------- http:////www.webroot.com/blog/2015/04/27/fake-security-scams-2015-edition/ *** 10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed *** --------------------------------------------- Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management? --------------------------------------------- http://blog.beyondtrust.com/10-reasons-your-privileged-password-management-… *** When Prevention Fails, Incident Response Begins, (Mon, Apr 27th) *** --------------------------------------------- Ive been asked a few times this year ($dayjob) to discuss and review incident handling practices with some of our clients. This topic seems to have come up to the surface again, and with some breaches getting main-stream coverage, it only .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19629 *** WordPress 4.2.1 Security Release *** --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-2-1/ *** SendGrid: Employee Account Hacked, Used to Steal Customer Credentials *** --------------------------------------------- Sendgrid, an email service used by tens of thousands of companies -- including Silicon Valley giants as well as Bitcoin exchange Coinbase -- said attackers compromised a Sendgrid employees account, which was then used to steal the usernames, email .. --------------------------------------------- http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to… *** Booby trapped! Malvertising campaign hit Adult Site xHamster *** --------------------------------------------- A New malvertising campaign hit adult website xHamster by abusing ad provider TrafficHaus and exploiting the Google's URL shortener service. Malversting campaigns are becoming a serious problem for web users, cyber criminals are exploiting .. --------------------------------------------- http://securityaffairs.co/wordpress/36367/cyber-crime/malvertising-campaign… *** Best Free and Open Source SQL Injection Tools *** --------------------------------------------- SQL injection is one of the most common attacks against web applications. This is used against websites which use SQL to query data from the database server. A successful .. --------------------------------------------- http://resources.infosecinstitute.com/best-free-and-open-source-sql-injecti… *** Hacker tarnen sich als Rüstungsfirma und tricksen Antiviren-Programme aus *** --------------------------------------------- Angreifer nutzten die Gunst der Stunde und verschickten im Zuge einer Firmenübernahme als Willkommensnachricht getarnte Phishing-Mails, um mit einer raffinierten Methode Schadcode auf die Computer von Angestellten zu schmuggeln. --------------------------------------------- http://heise.de/-2625892 *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Angesichts der potentiellen Auswirkung der Lücke und der hohen Anzahl an installierten WordPress Content Management Systemen bittet CERT.at um Beachtung der folgenden .. --------------------------------------------- https://cert.at/warnings/all/20150428.html *** Inside the Zeroaccess Trojan *** --------------------------------------------- The Zeroaccess trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. --------------------------------------------- http://blog.norsecorp.com/2015/04/27/inside-the-zeroaccess-trojan/ *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote attacker could exploit this vulnerability by sending crafted RADIUS packets to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38544 *** Cisco IOS Software and Cisco IOS XE Software Crafted DHCPv6 Sequence Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper handling of DHCPv6 packets for a SOLICIT message for an Identity Association for Non-Temporary Addresses (IA-NA) by a device running the affected software. An unauthenticated, adjacent attacker could exploit this vulnerability by sending a crafted sequence exchange of DHCPv6 packets for a SOLICIT message for an IA-NA to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38543

1 0

Tageszusammenfassung - Montag 27-04-2015
by Daily end-of-shift report 27 Apr '15

27 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-04-2015 18:00 − Montag 27-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitslücke im Yubikey Neo *** --------------------------------------------- Der USB-Stick Yubikey Neo lässt sich auch als Smartcard nutzen. Durch einen Bug kann man die eigentlich erforderliche Eingabe der PIN umgehen. Ein Angreifer kann die Krypto-Funktionen dadurch sogar über Funk missbrauchen. --------------------------------------------- http://heise.de/-2621122 *** CVE-2015-0359 (Flash up to 17.0.0.134) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134… *** Security Advisory: NTP vulnerability CVE-2015-1799 *** --------------------------------------------- The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16506.htm… *** What's Your Security Maturity Level? *** --------------------------------------------- Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think 15 pieces of flair). When .. --------------------------------------------- http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/ *** Sunday, April 26. 2015 How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security *** --------------------------------------------- Lately a lot of attention has been payed to software like Superfish and Privdog that intercepts TLS connections to be able to manipulate HTTPS traffic. These programs had severe (technically different) vulnerabilities that allowed attacks on HTTPS connections. --------------------------------------------- https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-t… *** Pwning a thin client in less than two minutes *** --------------------------------------------- The point of this blog post is to demonstrate that a malicious actor can compromise such thin clients in a trivial and quick way provided physical access, a standard prerequisite in an attack against a kiosk. --------------------------------------------- http://blog.malerisch.net/2015/04/pwning-hp-thin-client.html *** Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information .. --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. *** --------------------------------------------- A lot of network defense goes wrong before any contact with an adversary, starting with how defenders conceive of the battlefield. Most defenders focus on protecting their assets, prioritizing them, and sorting them by workload and .. --------------------------------------------- http://blogs.technet.com/b/johnla/archive/2015/04/26/defenders-think-in-lis… *** IBM Security Bulletin: SPSS Statistics ActiveX Control Code Execution Vulnerability Notification *** --------------------------------------------- SPSS Statistics ActiveX control on Windows 32 bit installations could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially-crafted Web page with Internet Explorer, a local attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697746 *** A Javascript-based DDoS Attack as seen by Safe Browsing *** --------------------------------------------- To protect users from malicious content, Safe Browsing's infrastructure analyzes web pages with web browsers running in virtual machines. This allows us to determine if a page contains malicious content, such as Javascript .. --------------------------------------------- http://googleonlinesecurity.blogspot.co.at/2015/04/a-javascript-based-ddos-… *** Node.js Server-Side JavaScript Injection Detection & Exploitation *** --------------------------------------------- Late last year, Burp scanner started testing for Server-Side JavaScript (SSJS) code injection. As you'd expect, this is where an attacker injects JavaScript into a server side parser and results in arbitrary code execution. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/4/15/nodejs-server-side-javascript-in… *** Critical Persistent XSS 0day in WordPress *** --------------------------------------------- Yes, you've read it right: a critical, unpatched 0-day vulnerability affecting WordPress' comment mechanisms was disclosed earlier today by Klikki Oy. Who's affected If your .. --------------------------------------------- https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.h… *** TeslaCrypt - Decrypt It Yourself *** --------------------------------------------- After the takedown of Cryptolocker, we have seen the rise of Cryptowall. Cryptowall 2 introduced 'features' such as advanced anti-debugging techniques, only to have many of those features removed in Cryptowall 3. Ransomware is .. --------------------------------------------- http://blogs.cisco.com/security/talos/teslacrypt

1 0

Tageszusammenfassung - Freitag 24-04-2015
by Daily end-of-shift report 24 Apr '15

24 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-04-2015 18:00 − Freitag 24-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** When automation does not help, (Thu, Apr 23rd) *** --------------------------------------------- In a lot of web application penetration tests that Ive done in last couple of years I noticed that the amount of technical vulnerabilities (i.e. XSS or SQL injection) is slowly declining.Of course, this depends on developers awareness but also on frameworks that are used for development of such applications. One of the best (or worst, depending on the point of view) is definitely .NET (yeah, I know, it feels weird to say that Microsoft is best in something security related). With .NET... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19615&rss *** Security Advisory: NTP vulnerability CVE-2015-1798 *** --------------------------------------------- (SOL16505) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16505.htm… *** CVE-2014-6284 - Probe login access vulnerability in SAP ASE *** --------------------------------------------- The SpiderLabs team at Trustwave published a new advisory today which details issues discovered in the SAP ASE (Adaptive Server Enterprise) by Martin Rakhmanov, a SpiderLabs Senior Researcher. SAP ASE is a relational database management system for UNIX, Linux, and... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-6284----Probe-… *** VMSA-2015-0003.5 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** The Rise of Counterintelligence in Malware Investigations *** --------------------------------------------- The key to operationalizing cybersecurity threat intelligence rests in the critical thinking that establishes that a given indicator is, in fact, malicious. There has been a great deal of talk about the emerging field of cybersecurity threat intelligence in recent years. CTI is the application of intelligence tactics to gain insights on adversarial actors and their tools, techniques, and procedures. However, one aspect that's not frequently discussed is the use of counterintelligence... --------------------------------------------- http://www.darkreading.com/partner-perspectives/general-dynamics-fidelis/th… *** Objectifying Cyber Intel Indicators *** --------------------------------------------- I've had the fortune of visiting a good number of SOCs (including building some) and meeting with a number of leaders in the SOC/IR space over the years- and the better teams will tell you that you simply cannot look at every single alert that fires. Expanding upon this even more, in regards to an Intel-driven IR program, this means that you cannot simply dump all indicators into production; I've seen this fail for both immature programs (overwhelmed with alerts) as well as mature... --------------------------------------------- http://seanmason.com/2014/08/25/objectifying-cyber-intel-indicators/ *** Honeywell XLWEB SCADA Path Traversal *** --------------------------------------------- Topic: Honeywell XLWEB SCADA Path Traversal Risk: Medium Text:SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual X... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040161 *** Magento-Lücke wird aktiv ausgenutzt *** --------------------------------------------- Wer einen Magento-Shop betreibt und noch nicht das jüngste Sicherheits-Update installiert hat, muss mit unerwünschten Besuchern rechnen. Hacker nutzen die Lücke aus, um SQL-Befehle in den Datenbankserver einzuschleusen. --------------------------------------------- http://heise.de/-2620110 *** IBM Products affected by Vulnerability in RC4 stream cipher ("Bar Mitzvah Attack") and other Vulnerabilities *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Dyreza's anticrypt *** --------------------------------------------- In the previous post, we have described how to set up a loft to monitor Dyreza with the help of virtual machines configured with breakpoints at addresses where communications appear in clear text. Configuration file updates can thus be obtained in real-time easily. Another way to monitor this kind of malware using a decentralised architecture is to implement parts of the malicious binary in a thin client, which requires to fully understand its decryption routine details. --------------------------------------------- http://www.lexsi-leblog.com/cert-en/dyrezas-anticrypt.html *** Antiviren-Software und Apples Schutzmechanismen für Mac OS X nutzlos *** --------------------------------------------- Einem Sicherheitsforscher zufolge sei es trivial, einen Mac nachhaltig mit Malware zu verseuchen. Weder würde gängige Antivirensoftware helfen, noch Apples eigene Mechanismen wie XProtect oder das Signieren von Apps. --------------------------------------------- http://heise.de/-2620049 *** HTML5 Security: Local Storage *** --------------------------------------------- In a previous article of mine, I discussed Cross Domain Messaging in HTML5. This article walks you through another feature, called local storage, and its security. Local Storage Local storage is one of the new features added in HTML5. It was first introduced in Mozilla 1.5 and eventually embraced by the HTML5 specification. We can... --------------------------------------------- http://resources.infosecinstitute.com/html5-security-local-storage/ *** Yubikey NEO (JavaCard OpenPGP) private key operations can be accessed without PIN *** --------------------------------------------- The source code contains a logical flaw related to user PIN (aka PW1) verification that allows an attacker with local host privileges and/or physical proximity (NFC) to perform security operations without knowledge of the user's PIN code. --------------------------------------------- https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.h…

1 0

Tageszusammenfassung - Donnerstag 23-04-2015
by Daily end-of-shift report 23 Apr '15

23 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-04-2015 18:00 − Donnerstag 23-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Deep dive into QUANTUM INSERT *** --------------------------------------------- Summary and recommendations QUANTUMINSERT (QI) is actually a relatively old technique. In order to exploit it, you will need a monitoring capabilities to leak information of observed TCP sessions and a host that can send spoofed packets. Your spoofed packet also needs to arrive faster than the original packet to be able to be successful. Any... --------------------------------------------- http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ *** Sicherheitsfirma warnt vor iOS-Killer-Funktion *** --------------------------------------------- Ein bösartiger Hotspot könnte iOS-Geräte in einen endlosen Reboot-Cycle schicken, warnt eine Sicherheitsfirma. Ursache ist anscheinend ein Fehler in Apples Verschlüsselungsimplementierung. --------------------------------------------- http://heise.de/-2617385 *** New Threat Report *** --------------------------------------------- Our latest comprehensive threat report, based on our analysis of H2 2014 data, is now available. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002805.html *** Mobile Threats Incident Handling: Updated ENISA material *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/mobile-threats-incident-handlin… *** Schadcode durch WLAN-Pakete *** --------------------------------------------- Durch eine Lücke in dem Standard-Tool wpa_supplicant können Angreifer anfällige Systeme über WLAN kompromittieren. Es kommt unter anderem bei Android und Linux zum Einsatz. Abhilfe schafft ein Patch, eine abgesicherte Version soll folgen. --------------------------------------------- http://heise.de/-2618115 *** wpa_supplicant P2P SSID processing vulnerability *** --------------------------------------------- A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from --------------------------------------------- http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt *** SSA-237894 (Last Update 2015-04-23): Vulnerability in SIMATIC PCS 7 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerDNS decompression bug can cause crashes *** --------------------------------------------- Topic: PowerDNS decompression bug can cause crashes Risk: Medium Text:Hi everybody, Please be aware of PowerDNS Security Advisory 2015-01 (http://doc.powerdns.com/md/security/powerdns-advisory-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040155 *** Security patch 02 for ZEN 11 Appliance - Freak - See TID 7016312 *** --------------------------------------------- Abstract: Patch for CVE-2015-0204 (FREAK) - OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability for ZCM ApplianceDocument ID: 5207650Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11_Security_Patch_2.zip (12.65 MB)Products:ZENworks Configuration Management 11ZENworks Configuration Management 11.1ZENworks Configuration Management 11 SP3ZENworks Configuration Management 11.2ZENworks Configuration Management 11.2.1ZENworks Configuration Management --------------------------------------------- https://download.novell.com/Download?buildid=Ddi7yDlFrqA~ *** ZDI-15-149: Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to disclose Session IDs of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ly4m30xpA5I/ *** ZDI-15-148: Novell Zenworks schedule.ScheduleQuery SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/04USkHANe4s/ *** ZDI-15-147: Novell Zenworks GetStoredResult.class SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/vaCwk090UHI/ *** ZDI-15-153: Novell ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sPdD0Sy4sxQ/ *** ZDI-15-152: Novell Zenworks com.novell.zenworks.inventory.rtr.actionclasses.wcreports Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/GTCY2AUbObw/ *** ZDI-15-151: Novell Zenworks Rtrlet doPost Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. By default, authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Wi0h3ROfwWc/ *** ZDI-15-150: Novell Zenworks FileViewer Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/-6nZPEvRTF0/ *** Security Advisory: Linux kernel vulnerabilities CVE-2014-8159 and CVE-2014-8369 *** --------------------------------------------- (SOL16478) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16478.htm… *** Security Advisory: Rsync vulnerability CVE-2007-6199 *** --------------------------------------------- (SOL15549) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15549.htm… *** Security Advisory: Linux kernel vulnerability CVE-2009-4537 *** --------------------------------------------- (SOL16479) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16479.htm… *** DSA-3232 curl - security update *** --------------------------------------------- Several vulnerabilities were discovered in cURL, an URL transfer library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3232 *** iPassword Manager 2.6 Script Insertion *** --------------------------------------------- Topic: iPassword Manager 2.6 Script Insertion Risk: Low Text:Document Title: iPassword Manager v2.6 iOS - Persistent Vulnerabilities References (Source): == http://www... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040147 *** Docker Privilege Escalation *** --------------------------------------------- Topic: Docker Privilege Escalation Risk: Medium Text:TLDR; Don’t use the ‘docker’ group Docker, if you aren’t already familiar with it, is a lightweight runtime and pack... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040151 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM/Cisco switches and directors (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005132 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affecting Sametime Unified Telephony (OpenSSL: CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8725, CVE-2015-0204, CVE-2015-0205) *** http://www.ibm.com/support/docview.wss?uid=swg21882876 *** IBM Security Bulletin: RPM vulnerability issue on IBM SONAS (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005166 *** IBM Security Bulletin: RPM vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005160 *** IBM Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005147 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM Storwize V7000 Unified (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005075 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM SONAS (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005152 *** IBM Security Bulletin: NSS vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005148 *** IBM Security Bulletin: Vulnerability in NSS affects SAN Volume Controller and Storwize Family (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005209 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by several OpenSSL vulnerabilities. *** http://www.ibm.com/support/docview.wss?uid=nas8N1020693 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect IBM Sterling B2B Integrator (CVE-2015-0209, CVE-2015-0287, CVE-2015-0292, and others) *** http://www.ibm.com/support/docview.wss?uid=swg21883249 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects Rational Software Architect for Websphere Software *** http://www.ibm.com/support/docview.wss?uid=swg21882955 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Mobile (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701358 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701548 *** IBM Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005125 *** IBM Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005157 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883226 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Composite Application Manager for Transactions (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21701114

1 0

Tageszusammenfassung - Mittwoch 22-04-2015
by Daily end-of-shift report 22 Apr '15

22 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-04-2015 18:00 − Mittwoch 22-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How attackers exploit end-users psychology *** --------------------------------------------- At RSA Conference 2015, Proofpoint released the results of its annual study that details the ways attackers exploit end-users psychology to circumvent IT security. Last year was the year attacke... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/tTatKVMFrgE/secworld.php *** How to hack Avaya phones with a simple text editor *** --------------------------------------------- At RSA conference 2015 a researcher demonstrated that Avaya's Ethernet office phones can be compromised with just a simple text editor. At the RSA conference 2015 in San Francisco, Dr Ang Cui from Columbia University PhD and Red Ballon Security cofounder announced that Avaya's Ethernet office phones can be compromised with just a simple text... --------------------------------------------- http://securityaffairs.co/wordpress/36187/hacking/how-to-hack-avaya-phone.h… *** 2 out of 3 IT pros put systems at risk by making undocumented changes *** --------------------------------------------- The Netwrix 2015 State of IT Changes Survey of more than 700 IT professionals across 40 industries found that 70% of companies forget about documenting changes, up from 57% last year. Most surprisingl... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4YM1XhU4vq4/secworld.php *** The CozyDuke APT *** --------------------------------------------- CozyDuke (aka CozyBear, CozyCar or "Office Monkeys") is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets. The White House and Department of State are two of the most spectacular... --------------------------------------------- http://securelist.com/blog/research/69731/the-cozyduke-apt/ *** CozyDuke, TLP: White *** --------------------------------------------- This whitepaper provides an overview of CozyDuke, a set of tools used by one or more malicious actors for performing targeted attacks against high profile organizations, such as governmental organizations and other entities that work closely with these institutions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002804.html *** "No iOS Zone" - A New Vulnerability Allows DoS Attacks on iOS Devices *** --------------------------------------------- In today's RSA Conference presentation, (Tuesday, April 21, 2015 | 3:30 PM - 4:20 PM | West | Room: 2001) Adi Sharabani, CEO and my fellow co-founder at Skycure, and I covered the lifecycle of vulnerabilities and vendor pitfalls. We also shared some details about a vulnerability our team recently identified in iOS 8 - a vulnerability that we are currently working with Apple to fix. --------------------------------------------- https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ *** Regular expressions and recommended practices *** --------------------------------------------- Whenever a security person crosses a vulnerability report, one of the the first steps is to ensure that the reported problem is actually a vulnerability. Usually, the issue falls into well known and studied categories and this step is done... --------------------------------------------- https://securityblog.redhat.com/2015/04/22/regular-expressions-and-recommen… *** RSA 2015: Thousands of Android apps found to be vulnerable *** --------------------------------------------- Vulnerability testing by CERT found tens of thousands of Android apps are vulnerable and no full register exists as they dont all get CVE assigned. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/42uHv7yPt0M/ *** RSA 2015: Experts discuss six dangerous attack techniques *** --------------------------------------------- Data breaches, ransomware, and threats against industrial control system were were discussed during an RSA Conference 2015 session on dangerous attack techniques. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yup3ar8W41U/ *** SSA-994726 (Last Update 2015-04-22): GHOST Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-451236 (Last Update 2015-04-22): Vulnerability in SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** HPSBGN03308 rev.1 - HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS), Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with the HP TippingPoint Security Management System (SMS) and vSMS. A vulnerability in JBOSS RMI could be exploited to allow remote code execution. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626974 *** Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting Risk: Low Text: = Reflected XSS Vulnerability In Manage Engine Firewall Analyzer = . contents:: Table Of Content Overview == ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040128 *** Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38486 *** Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38461 *** Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38460 *** DSA-3231 subversion - security update *** --------------------------------------------- Several vulnerabilities were discovered in Subversion, a version controlsystem. The Common Vulnerabilities and Exposures project identifies thefollowing problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3231 *** Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032178 *** Platform Agent 2011.1r2 *** --------------------------------------------- Abstract: The Novell Audit Platform Agent (Platform Agent) facilitates auditing events by transmitting log data from multiple applications to the Audit server.Document ID: 5207351Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Platform-Agent_2011.1r2.sha256 (93 bytes)Platform-Agent_2011.1r2.zip (16.8 MB)Products:Sentinel 7.0Sentinel 7.0.1Sentinel 7.0.2Sentinel 7.0.3Sentinel 7.1Sentinel 7.1.1Sentinel 7.1.2Sentinel 7.2Sentinel 7.2.1Sentinel 7.2.2Sentinel 7.3Sentinel Log --------------------------------------------- https://download.novell.com/Download?buildid=dpHkpNu89zw~

1 0

Tageszusammenfassung - Dienstag 21-04-2015
by Daily end-of-shift report 21 Apr '15

21 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-04-2015 18:00 − Dienstag 21-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** JavaScript CPU cache snooper tells crooks EVERYTHING you do online *** --------------------------------------------- New research sends browser kingpins scurrying for fixes Four Cornell University boffins reckon they can spy on keystrokes and mouse clicks in a web browser tab by snooping on the PCs processor caches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/21/cache_creep… *** New fileless malware found in the wild *** --------------------------------------------- Since the discovery of the Poweliks fileless Trojan in August 2014, researchers have been expecting other similar malware to pop up. The wait over: Phasebot malware, which also has fileless infecti... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/fLPIj0uz1VY/malware_news.… *** Cross-Site-Scripting: Zahlreiche Wordpress-Plugins verwenden Funktion fehlerhaft *** --------------------------------------------- Eine schlecht dokumentierte Funktion der Wordpress-API ist von zahlreichen populären Plugins fehlerhaft verwendet worden. Der Fehler führt zu Cross-Site-Scripting-Lücken: Betroffen sind unter anderem das Jetpack-Plugin, die Plugins von Yoast und das All-in-one-SEO-Plugin. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-zahlreiche-wordpress-plugins-… *** 2nd workshop on National Cyber Security Strategies: 13th May *** --------------------------------------------- ENISA and the Latvian Ministry of Defence are hosting on the 13th of May 2015, the 2nd workshop on National Cyber Security Strategies in Riga, during the Presidency of the Council of the European Union. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/2nd-workshop-on-national-cyber-… *** Fehlerhafte Netzwerkbibliothek macht iOS-Apps angreifbar *** --------------------------------------------- Durch einen Bug in der Bibliothek AFNetwork kann man die verschlüsselten Verbindungen zahlreicher Apps angreifen, die sie einsetzen. Eine Online-Datenbank verrät, welche Apps betroffen waren oder sind. --------------------------------------------- http://heise.de/-2615960 *** WordPress 4.1.2 Security Release *** --------------------------------------------- WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-1-2/ *** Security Advisory: glibc vulnerability CVE-2013-7424 *** --------------------------------------------- (SOL16472) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16472.htm… *** VU#260780: NetNanny uses a shared private key and root CA *** --------------------------------------------- Vulnerability Note VU#260780 NetNanny uses a shared private key and root CA Original Release date: 20 Apr 2015 | Last revised: 20 Apr 2015 Overview NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used --------------------------------------------- http://www.kb.cert.org/vuls/id/260780 *** Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38455 *** Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38459 *** HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03305 rev.1 - HP Business Service Management (BSM) products running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Business Service Management (BSM), SiteScope, Business Service Management (BSM) Integration Adaptor, Operations Manager for Windows, Unix and Linux, Reporter, Operation Agent Virtual Appliance, Performance Manager, Virtualization Performance Viewer, Operations Agent, BSM Connector and Service Health Reporter running SSLv3. The vulnerability could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626982

1 0

Tageszusammenfassung - Montag 20-04-2015
by Daily end-of-shift report 20 Apr '15

20 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-04-2015 18:00 − Montag 20-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Handling Special PDF Compression Methods, (Sun, Apr 19th) *** --------------------------------------------- Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. A couple of months before, I had started developing my pdf-parser tool, and Maartens diary entry motivated me to continue adding features to pdf-parser. Extracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. You select the object that contains the stream... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19597&rss *** Taking Down Fraud Sites is Whac-a-Mole *** --------------------------------------------- I've been doing quite a bit of public speaking lately - usually about cybercrime and underground activity - and there's one question that nearly always comes from the audience: "Why are these fraud Web sites allowed to operate, and not simply taken down?" This post is intended to serve as the go-to spot for answering... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Da3rhmEIBt0/ *** An Analysis Of MS15-034 *** --------------------------------------------- By now you've undoubtedly heard about MS15-034. The following is a collection of my cursory research and thoughts on this vulnerability. --------------------------------------------- http://www.securitysift.com/an-analysis-of-ms15-034/ *** How to use a malicious JPEG to hack corporate networks *** --------------------------------------------- Security researcher Marcus Murray discovered a method to exploit a malicious JPEG to compromise modern Windows servers inside corporate networks. Security expert and penetration tester Marcus Murray discovered a way to use a malicious JPEG to compromise modern Windows servers and elevate privileges over targeted networks. The researcher has demonstrated the attack a few days.... --------------------------------------------- http://securityaffairs.co/wordpress/36130/hacking/malicious-jpeg-hack-corpo… *** Fiesta Exploit Kit Spreading Crypto-Ransomware - Who Is Affected? *** --------------------------------------------- Exploits kits have long been used to deliver threats to users, but they seem to have gone retro: it was recently being used to deliver fake antivirus malware. We closely monitor exploit kit activity because of their widespread use (we discussed their use in malvertising recently), so it was no great surprise to see the Fiesta... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/F_yFw0VwfG8/ *** "Rootpipe"-Lücke in OS X besteht offenbar weiter *** --------------------------------------------- Trotz Patch in der letzten Yosemite-Version scheint die Rechteausweitung nicht behoben zu sein. Schadcode soll die Lücke schon 2014 ausgenutzt haben. Ein Blogger zeigt unterdessen eine Möglichkeit auf, den Bug auch in früheren OS-X-Versionen zu fixen. --------------------------------------------- http://heise.de/-2612346 *** Bypassing Same Origin Policy, Part 3: Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Bypassing Packet Filters with IP Fragmentation Overlapping *** --------------------------------------------- 1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-packet-filters-with-ip-frag… *** Threats From Within: The Out of Office Reply *** --------------------------------------------- As the guy who sends out the marketing emails at Cyveillance (yes, I'm THAT guy) I see a lot of Out-of-Office auto-responders in any given month. Having worked in cybersecurity for more than seven years, I've developed an appreciation for both information and physical security. With the RSA Conference coming up in a few days, and awaiting my barrage of Out of Office emails, I think now is the perfect time to discuss this seemingly innocuous topic. Why? Amazingly, even in the security... --------------------------------------------- https://blog.cyveillance.com/threats-from-within-the-out-of-office-reply/ *** Upatre malware gets full SSL comms encryption *** --------------------------------------------- The extremely popular Upatre Trojan downloader has undergone considerable changes that will make it and its communication more difficult to spot and block. The changes were implemented in the new v... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/qIIbd4nwtHA/malware_news.… *** Critical Magento Shoplift Vulnerability (SUPEE-5344) - Patch Immediately! *** --------------------------------------------- The Magento team released a critical security patch (SUPEE-5344) to address a remote command execution (RCE) vulnerability back in February. It's been more than two months since the release and still more than 50% of all the Magento installations have not been patched, leaving them open to attacks. This means hundreds of thousands of websites are... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/lfn2WVKTfWo/critical-magento-… *** DSA-3228 ppp - security update *** --------------------------------------------- Emanuele Rocca discovered that ppp, a daemon implementing thePoint-to-Point Protocol, was subject to a buffer overflow whencommunicating with a RADIUS server. This would allow unauthenticatedusers to cause a denial-of-service by crashing the daemon. --------------------------------------------- https://www.debian.org/security/2015/dsa-3228 *** GnuTLS RSA PKCS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/102423 *** Zenworks Architecture ZDI Vulnerability - See TID 7016431 *** --------------------------------------------- Abstract: Fix for ZDI-CAN-2491: ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability Document ID: 5206350Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11.3.2_FRU1_Patch_921190.zip (3.53 MB)ZCM_11.2.4_MU1_Patch_921190.zip (1.63 MB)Products:ZENworks Configuration Management 11.3.2ZENworks Configuration Management 11.2.4ZENworks Configuration Management 11.3.1ZENworks Configuration Management 11 SP3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BJbybNUmQRQ~ *** Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-085Project: Invoice (third-party module)Version: 6.x, 7.xDate: 2015-March-25 Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionInvoice module allows you to create invoices in Drupal.The module doesnt sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.Additionally, some URLs were not --------------------------------------------- https://www.drupal.org/node/2459337 *** DSA-3229 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.43. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2015/dsa-3229 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21883028 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2015-0208, CVE-2015-0286, CVE-2015-0292) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21713653 *** IBM Security Bulletin: RC4 stream cipher vulnerability and HTTP request smuggling vulnerability affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2808, CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21882717 *** Bugtraq: CVE-2014-7953 Android backup agent code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/535296 *** Android 4.4 MTP Path Traversal *** --------------------------------------------- Topic: Android 4.4 MTP Path Traversal Risk: Medium Text:MTP path traversal vulnerability in Android 4.4 -- doSendObjectInfo() method of the MtpServer class implemen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040116

1 0

Tageszusammenfassung - Freitag 17-04-2015
by Daily end-of-shift report 17 Apr '15

17 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-04-2015 18:00 − Freitag 17-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Internet broken as usual. *** --------------------------------------------- We continue to see active exploitation against MS15-034. But nothing different from yesterday, so back to Infocon Green for now. (Fri, Apr 17th) --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19593&rss *** USB Defense: Stop Data Walking Out The Door *** --------------------------------------------- The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. --------------------------------------------- http://thehackernews.com/2015/04/usb-security-software.html *** US-Polizei schickt Malware an Whistleblower-Anwalt *** --------------------------------------------- Drei Whistelblower beschuldigen eine Polizei in Arkansas der Korruption und des Mobbings. Das Gericht ordnet die Freigabe von Dokumenten an. Die Polizei schickt eine Festplatte mit Passwortlogger, Backdoor und Command&Control Software. --------------------------------------------- http://heise.de/-2610436 *** On false alarms in detection of DGA botnet domains - part 1 *** --------------------------------------------- Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and botnet itself) from a takeover. Often domains generated this way are composed of random .. --------------------------------------------- http://www.cert.pl//news/9887/langswitch_lang/en *** Google's April Fool's prank inadvertently broke their security *** --------------------------------------------- As part of its traditional series of April Fools day jokes, Google used its own .google gTLD to launch a backwards version of its home page from the domain com.google on 1st April. However, this years joke inadvertently undermined an important security feature on Googles real homepage, which made it vulnerable to user interface redressing attacks such as click-jacking. This vulnerability would have allowed a remote attacker to change a users search settings, including turning off SafeSearch --------------------------------------------- http://news.netcraft.com/archives/2015/04/17/googles-april-fools-prank-inad… *** GnuTLS Certificate Validation Flaw Lets Remote Users Force a Signature Algorithm Downgrade *** --------------------------------------------- A vulnerability was reported in GnuTLS. A remote user can force the use of a weaker signature algorithm. The software does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm specified in the certificate. A remote user can exploit this to force the use of a weaker encryption algorithm. --------------------------------------------- http://www.securitytracker.com/id/1032148

1 0

Tageszusammenfassung - Donnerstag 16-04-2015
by Daily end-of-shift report 16 Apr '15

16 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-04-2015 18:00 − Donnerstag 16-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Impacts of a Hack on a Magento Ecommerce Website *** --------------------------------------------- Recently we wrote about the impacts of a hacked website and how it is important to give website visitors a safe online experience In this post, I'll show you how a hacked website results in almost immediate loss of money. We are not talking about drive-by infections that can be prevented by using a good anti-virus, updated software, and extensions like NoScript. ... This time, we're talking about using legitimate sites that have absolutely no externally visible signs of compromise. --------------------------------------------- https://blog.sucuri.net/2015/04/impacts-of-a-hack-on-a-magento-ecommerce-we… *** Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2015-096 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-096 Project: Services (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 16/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass, Arbitrary PHP code execution --------------------------------------------- https://www.drupal.org/node/2471879 *** Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-095 Project: Display Suite (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting --------------------------------------------- https://www.drupal.org/node/2471733 *** The Delicate Art of Remote Checks - A Glance Into MS15-034 *** --------------------------------------------- Recently, the research team posted a testing script for the MS15-034 vulnerability to pastebin for the greater community to test. We received some feedback about how exactly we figured out how to check, and remote checks in general. --------------------------------------------- http://blog.beyondtrust.com/the-delicate-art-of-remote-checks-a-glance-into… *** Denial of Service Attacks Possible with OpenSSL Vulnerability CVE-2015-1787 *** --------------------------------------------- On March 19 we wrote about how OpenSSL disclosed and fixed 13 vulnerabilities to address several security holes. Among the vulnerabilities addressed was CVE-2015-1787, which can result in a complete denial of service on an application compiled with OpenSSL library. This blog post will tackle how the bug can be exploited ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Q6dMoVlcsE4/ *** Exploit kits (still) pushing Teslacrypt ransomware, (Thu, Apr 16th) *** --------------------------------------------- Teslacrypt is a form of ransomware that was first noted in January of this year. This malware apparently targets video game-related files. Ive seen Teslacrypt dropped by the Sweet Orange exploit kit (EK), and its also been dropped by Nuclear EK. McAfee saw it dropped by Angler EK last month. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19581&rss *** New POS Malware Emerges - Punkey *** --------------------------------------------- During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey. It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges… *** IBM stellt seine Security-Datenbank ins Netz *** --------------------------------------------- IBM Security macht seine IT-Sicherheitsdatenbank künftig auf der Sharing-Plattform X-Force Exchange in der Cloud zugänglich. --------------------------------------------- http://heise.de/-2608795 *** crossdomain.xml : Beware of Wildcards *** --------------------------------------------- This blog entry will describe a wide spread Flash vulnerability that affected many big websites including paypal.com. The description will picture the state of the website paypal.com and ebay.com in 2013-2014. The vulnerabilities were completely fixed two weeks ago. Therefore, it is not possible to reproduce this vulnerability as-is. --------------------------------------------- http://blog.h3xstream.com/2015/04/crossdomainxml-beware-of-wildcards.html *** Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38403 *** Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Mittwoch 15-04-2015
by Daily end-of-shift report 15 Apr '15

15 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-04-2015 18:00 − Mittwoch 15-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-06: Security updates available for Adobe Flash Player APSB15-07: Security update: hotfixes available for ColdFusion APSB15-08: Security bulletin available .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1190 *** MSRT April: Unskal, Saluchtra, Dexter and IeEnablerCby *** --------------------------------------------- This month we added four new malware families to the Malicious Software Removal Tool: Win32/Saluchtra, Win32/Dexter, Win32/Unskal and Win32/IeEnablerCby, further protecting customers against malicious activity. IeEnablerCby is .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/14/msrt-april-unskal-saluch… *** Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38350 *** Cisco Web Security Appliance Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38351 *** Critical Patch Update - April 2015 *** --------------------------------------------- This Critical Patch Update contains 98 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html *** Solaris Third Party Bulletin - April 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.h… *** Alte Xorg-Lücke bedroht haufenweise Drittsoftware *** --------------------------------------------- Die Lücke wurde bereits 2013 gestopft. Programme, die unter der Verwendung von Headern aus verwundbaren Versionen übersetzt wurden, sind allerdings nach wie vor angreifbar. --------------------------------------------- http://heise.de/-2606536 *** What the Ridiculous Fuck, D-Link?! *** --------------------------------------------- As mentioned in an update to my post on the HNAP bug in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a patch was released. D-Link .. --------------------------------------------- http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/ *** Das Imperium schlägt zurück: Hacker-Gruppen ziehen gegeneinander zu Felde *** --------------------------------------------- Zwei Cyberspionage-Gruppen kamen sich in die Quere und attackierten sich wechselseitig. Sicherheitsforscher sehen hier einen neuen Trend, bei dem sich Hacker-Gruppen gezielt gegenseitig anfeinden. --------------------------------------------- http://heise.de/-2607493 *** Microsoft Security Bulletin Summary for April 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for April 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-apr

1 0

Tageszusammenfassung - Dienstag 14-04-2015
by Daily end-of-shift report 14 Apr '15

14 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-04-2015 18:00 − Dienstag 14-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38306 *** Linux 4.0 freigegeben: Sicherheitslücken im laufenden Betrieb korrigieren *** --------------------------------------------- Bei Linux 4.0 lassen sich Sicherheitslücken ohne Neustart des Systems beheben. Ein verzögertes Aktualisieren von Dateieigenschaften soll die Performance von Ext4 verbessern. --------------------------------------------- http://heise.de/-2600691 *** A Tale of Two Exploits *** --------------------------------------------- CVE-2015-0336 is a type confusion vulnerability in the AS2 NetConnection class. I reported this issue in January and soon wrote a proof-of-concept exploit for the bug. The issue was patched by Adobe in March and less than a .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/04/a-tale-of-two-exploits.html *** Bioazih RAT: How clean-file metadata can help keep you safe *** --------------------------------------------- As mentioned in our previous blog post about the Microsoft Clean-File Metadata initiative, there are a number of benefits for our partners and customers who use our clean or released-file metadata, specifically during antimalware whitelisting efforts. Using the authoritative metadata manifest .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/13/bioazih-rat-how-clean-fi… *** New Trojan for Linux attacks websites *** --------------------------------------------- April 13, 2015 Doctor Web security researchers have examined a new Trojan that can infect computers with Linux operating system. This malicious program possesses the ability to scan remote websites for vulnerabilities and to attack resources with the specified HTTP protocol addresses. Criminals can .. --------------------------------------------- http://news.drweb.com/show/?i=9386&lng=en&c=9 *** IT-Sicherheit: Auch Medizintechnik lässt sich hacken *** --------------------------------------------- Überdosis nicht mehr ausgeschlossen: Der Sicherheitsforscher Billy Rios kann eine in Krankenhäusern verwendete Infusionspumpe über das Intranet manipulieren. --------------------------------------------- http://www.golem.de/news/it-sicherheit-auch-medizintechnik-laesst-sich-hack… *** As Ransomware Attacks Evolve, More Potential Victims Are at Risk *** --------------------------------------------- In early December, as most people were dealing with the stress of looking for the perfect holiday gifts and planning out their upcoming celebrations, police officers in .. --------------------------------------------- http://threatpost.com/as-ransomware-attacks-evolve-more-potential-victims-a… *** Sicherheitssoftware klemmt Windows vom IPv6-Internet ab *** --------------------------------------------- Die Sicherheitssoftware Warsaw 1.5.1 für Windows blockiert Internetserver, die sowohl über IPv6 als auch IPv4 erreichbar sind. Betroffen sind vor allem mehrere Millionen brasilianischer Windows-Geräte, deren Nutzer Homebanking betreiben. --------------------------------------------- http://heise.de/-2603192 *** TV5Monde - A (tentative) technical analysis *** --------------------------------------------- As it may appear surprising that a TV station can be forced to stop broadcasting after having its website defaced and social network accounts controlled by some hackers, I've tried to collect publicly available technical information and improve my understanding of this interesting issue. Below you .. --------------------------------------------- http://www.fixsing.com/tv5monde-a-tentative-technical-analysis/ *** Hardening IIS Security *** --------------------------------------------- Security is an essential part of a web application and should be taken into consideration from the first stage of the development process. A website couldn't ever be secure enough unless you would undertake necessary security .. --------------------------------------------- http://resources.infosecinstitute.com/hardening-iis-security/ *** Verschlüsselung: Auch Mozilla will HTTPS zum Standard machen *** --------------------------------------------- Ein Vorschlag von Mozilla sieht vor, dass der Firefox-Browser künftig bestimmte neue Features nur noch über HTTPS-Verbindungen zulässt. Langfristig wird angestrebt, dass alle Webseiten HTTPS benutzen. --------------------------------------------- http://www.golem.de/news/verschluesselung-auch-mozilla-will-https-zum-stand…

1 0

Tageszusammenfassung - Montag 13-04-2015
by Daily end-of-shift report 13 Apr '15

13 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-04-2015 18:00 − Montag 13-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38305 *** Hacking the D-Link DIR-890L *** --------------------------------------------- The past 6 months have been incredibly busy, and I haven't been keeping up with D-Link's latest shenanigans. In need of some entertainment, I went to their web page today and was greeted by this atrocity: I think the most .. --------------------------------------------- http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/ *** Reversing Belkin's WPS Pin Algorithm *** --------------------------------------------- After finding D-Link's WPS algorithm, I was curious to see which vendors might have similar algorithms, so I grabbed some Belkin firmware and started dissecting it. This particular firmware uses the SuperTask! RTOS, and in fact uses the .. --------------------------------------------- http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ *** Digital Certificates: Who Can You Trust? *** --------------------------------------------- Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/digital-certific… *** APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation *** --------------------------------------------- Having some of the world's most active economies, Asia Pacific countries are more likely to be a target of targeted attacks than the rest of the world. In Operation Quantum Entanglement, Pacific Ring of Fire: PlugX / Kaba and other FireEye reports, we have highlighted how Northeast Asian countries have been .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.h… *** Polizeiorganisation Interpol verstärkt Kampf gegen Cyberkriminalität *** --------------------------------------------- Zum Kampf gegen die Internetkriminalität und andere neue Bedrohungen hat die internationale Polizeiorganisation Interpol ein Forschungszentrum in Singapur eröffnet. Der Interpol-Weltkomplex für Innovation (IGCI) soll .. --------------------------------------------- http://heise.de/-2599811 *** Windows XP noch auf zehntausenden Berliner Behörden-PCs *** --------------------------------------------- Seit einem Jahr gibt es keine offiziellen Patches mehr für Windows XP. Dennoch ist das fast 14 Jahre alte Betriebssystem noch weiter verbreitet, als Sicherheitsexperten lieb ist. In der Berliner Verwaltung sollen es sogar noch zehntausende PCs sein. Der Datenschutzbeauftragte Alexander Dix fordert nun die Abschaltung aller Behördenrechner. --------------------------------------------- http://derstandard.at/2000014223975 *** Zero Access Malware *** --------------------------------------------- The Zero Access trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. Once the trojan has been delivered into the system, it .. --------------------------------------------- http://resources.infosecinstitute.com/zero-access-malware/ *** Microsoft partners with Interpol, industry to disrupt global malware attack affecting more than 770,000 PCs in past six months *** --------------------------------------------- Today Interpol and the Dutch National High Tech Crime Unit (DNHTCU) announced the disruption of Simda.AT, a significant malware threat affecting more than 770,000 computers in over 190 countries. The Simda.AT variant first appeared in .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/12/microsoft-partners-with-… *** How to bypass Google's Santa LOCKDOWN mode *** --------------------------------------------- Santa is a binary whitelisting/blacklisting system made by Google's Macintosh Operations Team. While I refer to it as Google's Santa it is not an official Google product. It is based on a kernel extension and userland components to .. --------------------------------------------- https://reverse.put.as/2015/04/13/how-to-bypass-googles-santa-lockdown-mode/ *** Huthos VPS Provider: Totally legit, 1000% not a criminal organization - Andrew Morris *** --------------------------------------------- I observed a hacker trying to compromise one of my internet-facing Linux servers and repurpose it to sell to unknowing legitimate customers. --------------------------------------------- http://morris.guru/huthos-the-totally-100-legit-vps-provider/ *** OS X 10.10.3 soll gegen Adware helfen *** --------------------------------------------- Apple hat weitere Massnahmen gegen Adware ergriffen, die verstärkt kostenlosen Mac-Programmen beim Download beigelegt wird und unter anderem Browser-Einstellungen ändert. --------------------------------------------- http://heise.de/-2601940 *** VU#672268: Microsoft Windows NTLM automatically authenticates via SMB when following a file:// URL *** --------------------------------------------- Software running on Microsoft Windows that utilizes HTTP requests can be forwarded to a file:// protocol on a malicious server, which causes Windows to automatically attempt authentication via SMB to the malicious server in some circumstances. The .. --------------------------------------------- http://www.kb.cert.org/vuls/id/672268

1 0

Tageszusammenfassung - Freitag 10-04-2015
by Daily end-of-shift report 10 Apr '15

10 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-04-2015 18:00 − Freitag 10-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Beebone: FBI und Europol legen Wurm-Netz lahm *** --------------------------------------------- Das interessante am ausgeschalteten Beebone-Botnetz ist der Schädling dahinter: Es handelt sich um einen Downloader, der anderen Unrat nachlädt, sich selber weiter verbreitet und dabei ständig mutiert. --------------------------------------------- http://heise.de/-2598111 *** How To Create a Website Backup Strategy *** --------------------------------------------- We've all heard it million times before - backups are important. Still, the reality is that even today, backups remain one of the most overlooked and under-utilized precautions we can take to protect our vital data. Why are backups so important Put simply, a good set of backups can save your website when absolutely everythingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/II8TR_qV6OA/how-to-create-a-w… *** 122 online forums compromised to redirect visitors to Fiesta exploit kit *** --------------------------------------------- Over a hundred forum websites have been compromised and injected with code that redirects users to sites hosting the Fiesta exploit kit, Cyphort researchers have found. These are not highly popular... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4VryRaL3aoc/malware_news.… *** Don't Be Fodder for China's "Great Cannon" *** --------------------------------------------- China has been actively diverting unencrypted Web traffic destined for its top online search service -- Baidu.com -- so that some visitors from outside of the country were unwittingly enlisted in a novel and unsettling series of denial-of-service attacks aimed at sidelining sites that distribute anti-censorship tools, according to research released this week. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/-n1M-QyvCoA/ *** Cisco and Level 3 team up to squash brute force server hijackers *** --------------------------------------------- #DownWithSSHPsychos Cisco and service provider Level 3 have teamed up take down netblocks linked to brute-force hack kingpins SSHPsychos, severely degrading (but not destroying) the groups potential to hack servers in the process. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/10/sshpsychos_… *** In eigener Sache: Wartungsarbeiten 16. 4. 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten 16.4.2015 | 10. April 2015 | Am Donnerstag, 16. April 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt telefonisch unter +43 1 505 64 16 78 erreichen. --------------------------------------------- http://www.cert.at/services/blog/20150410112411-1466.html *** Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38292 *** Red Hat JBoss XML External Entity Expansion Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032017 *** VMSA-2015-0003.1 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** f5 Security Advisories *** --------------------------------------------- *** Security Advisory: FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16380.htm… *** Security Advisory: Linux kernel vulnerability CVE-2014-9683 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16381.htm… *** Security Advisory: OpenSSL vulnerability CVE-2012-2110 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/200/sol16285.htm… *** Security Advisory: Linux file utility vulnerabilities CVE-2014-8116 / CVE-2014-8117 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16347.htm… *** Security Advisory: GnuPG vulnerability CVE-2013-4576 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16396.htm… *** Security Advisory: Linux RPM vulnerability CVE-2013-6435 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16383.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16389.htm… *** Security Advisory: NTP vulnerability CVE-2014-9297 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16392.htm… *** Security Advisory: Python vulnerability CVE-2006-4980 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16398.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16385.htm… *** Security Advisory: NTP vulnerability CVE-2014-9298 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16393.htm… *** Security Advisory: Apache Tomcat vulnerability CVE-2014-0227 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16344.htm… *** DFN-CERT-2015-0483 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0483/ *** DFN-CERT-2015-0318 - IBM Java, IBM Notes, IBM Domino: Mehrere Schwachstellen ermöglichen die Übernahme der Systemkontrolle *** --------------------------------------------- 10.03.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0318/ *** Security_Advisory-Xen Vulnerabilities on Huawei FusionSphere products *** --------------------------------------------- Apr 10, 2015 10:12 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [2015-04-10] Unauthenticated Local File Disclosure in multiple TP-LINK products *** --------------------------------------------- Attackers can read sensitive configuration files without prior authentication on multiple TP-LINK devices. These files e.g. include the administrator credentials and the WPA passphrase. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015…

1 0

Tageszusammenfassung - Donnerstag 9-04-2015
by Daily end-of-shift report 09 Apr '15

09 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-04-2015 18:00 − Donnerstag 09-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Securing high-risk, third-party relationships *** --------------------------------------------- High-profile attacks reveal that malicious hackers target third-party vendors and supply chain partners as a backdoor into their primary target, according to CyberArk Software. Organizations in e... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/vSpu1uYwxR4/secworld.php *** AlienSpy RAT exploited to deliver the popular Citadel Trojan *** --------------------------------------------- Security experts at Fidelis firm discovered that variants of the AlienSpy remote access trojan (RAT) are currently being used in global phishing campaigns. Cyber criminals have exploited the AlienSpy RAT to deliver the popular Citadel banking Trojan and maintain the persistence inside the targeted architecture with a backdoor mechanism. Criminal crews used AlienSpy RAT to compromise systems in... --------------------------------------------- http://securityaffairs.co/wordpress/35802/cyber-crime/alienspy-rat-citadel-… *** Apple aktualisiert Safari für OS X 10.8, 10.9 und 10.10 *** --------------------------------------------- Mit den Versionen 8.0.5, 7.1.5 und 6.2.5 seines Browsers behebt Cupertino jede Menge Sicherheitslücken, darunter auch ein altes Problem im Privatmodus. --------------------------------------------- http://heise.de/-2597649 *** 44 Relevant Cyber Security Conferences around the World *** --------------------------------------------- Wherever you may be in the world, chances are there's a cyber security event happening near you this year. Cyber security conferences are important and necessary for the industry and for each of us, individually, because they help bring together the community. What's more, innovation often spurs after having a meaningful discussion with a peer or a mentor, or after being part of a conversation on your favorite topic in the field of information security. --------------------------------------------- https://heimdalsecurity.com/blog/44-relevant-cyber-security-conferences-aro… *** Polymorphic Beebone botnet sinkholed in international police operation *** --------------------------------------------- On April 8, a global operation targeted the Beebone (also known as AAEH) botnet, a polymorphic downloader bot which installs various forms of malware on victims' computers. Initial figures show tha... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/MGj0qJKKZ0I/secworld.php *** Deadly combination of Upatre and Dyre Trojans still actively targeting users *** --------------------------------------------- Upatre (or Waski) is a downloader Trojan that has lately become the malware of choice for cyber crooks to deliver additional, more dangerous malware on users computers. A few weeks ago, Swiss and ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/IJ4tqq_YAUU/malware_news.… *** LG software disables Windows security feature, developer says *** --------------------------------------------- LG Split Screen software that comes with the companys ultra wide monitors stealthily weakens Windows users defenses by deactivating the OS User Account Control (UAC) feature, developer Christopher ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/1t_AM7tskik/secworld.php *** Hidden backdoor API to root privileges in Apple OS X *** --------------------------------------------- The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It's been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to escalate privileges to root from any user account in the system. --------------------------------------------- https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-pri… *** The Banking Trojan Emotet: Detailed Analysis *** --------------------------------------------- The Emotet Trojan is a highly automated and developing, territorially-targeted bank threat. Its small size, the dispersal methods used and the modular architecture, all make Emotet a very effective weapon for the cyber-criminal. --------------------------------------------- http://securelist.com/analysis/69560/the-banking-trojan-emotet-detailed-ana… *** Apple Leaves CNNIC Root in iOS, OSX Certificate Trust Lists *** --------------------------------------------- When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether, Apple has kept the root certificates in its trusted store for both iOS and OSX. Apple on Wednesday released... --------------------------------------------- http://threatpost.com/apple-leaves-cnnic-root-in-ios-osx-certificate-trust-… *** TA15-098A: AAEH *** --------------------------------------------- Original release date: April 09, 2015 Systems Affected Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012 Overview AAEH is a family of polymorphic downloaders created with the primary purpose of downloading other malware, including password stealers, rootkits, fake antivirus, and ransomware.The United States Department of Homeland Security (DHS), in collaboration with Europol, the Federal Bureau of Investigation (FBI) and... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-098A *** ZDI-15-119: IBM Tivoli Storage Manager FastBack CRYPTO_S_EncryptBufferToBuffer Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OQuaNiGQOf8/ *** ZDI-15-118: IBM Tivoli Storage Manager FastBack Mount CMountDismount::GetVaultDump Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/RumTeWThXlw/ *** DFN-CERT-2015-0484 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0484/ *** DFN-CERT-2015-0477 - MantisBT: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0477/ *** Asterisk TLS Certificate Validation Flaw With Null Byte in Common Name Lets Remote Users Bypass Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032052 *** CiviCRM private report - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-094 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-094Project: CiviCRM private report (third-party module)Version: 6.x, 7.xDate: 2015-April-08 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionCiviCRM private report module enables users to create their own private copies of CiviCRM reports, which they can modify and save to meet their needs without requiring the "Administer reports" permission.The --------------------------------------------- https://www.drupal.org/node/2467697 *** [2015-04-09] Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows *** --------------------------------------------- XSS and XSRF vulnerabilities within the Confluence plugin Comala Workflows of Comalatech enable an attacker to perform unauthorized actions in the name of another logged-in user and attack other users of the web application with JavaScript code, browser exploits or Trojan horses. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Juniper Security Advisories *** --------------------------------------------- *** JSA10679 - 2015-04 Security Bulletin: OpenSSL 8th January 2015 advisory. *** http://kb.juniper.net/index?page=content&id=JSA10679&actp=RSS *** JSA10680 - 2015-04 Security Bulletin: OpenSSL 19th March 2015 advisory *** http://kb.juniper.net/index?page=content&id=JSA10680&actp=RSS *** JSA10678 - 2015-04 Security Bulletin: Junos: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up (CVE-2015-3006) *** http://kb.juniper.net/index?page=content&id=JSA10678&actp=RSS *** JSA10677 - 2015-04 Security Bulletin: SRX Series: Cross-Site-Scripting Vulnerability in Dynamic VPN (CVE-2015-3005). *** http://kb.juniper.net/index?page=content&id=JSA10677&actp=RSS *** JSA10676 - 2015-04 Security Bulletin: SRX Series: ISC BIND vulnerability denial of service in delegation handling (CVE-2014-8500) *** http://kb.juniper.net/index?page=content&id=JSA10676&actp=RSS *** JSA10675 - 2015-04 Security Bulletin: Junos J-Web: Clickjacking vulnerability (CVE-2015-3004) *** http://kb.juniper.net/index?page=content&id=JSA10675&actp=RSS *** JSA10674 - 2015-04 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2015-3003) *** http://kb.juniper.net/index?page=content&id=JSA10674&actp=RSS *** JSA10673 - 2015-04 Security Bulletin: IDP: Multiple vulnerabilities addressed by third party software updates. *** http://kb.juniper.net/index?page=content&id=JSA10673&actp=RSS *** JSA10672 - 2015-04 Security Bulletin: SRX Series: disconnecting from console may not automatically log out (CVE-2015-3002) *** http://kb.juniper.net/index?page=content&id=JSA10672&actp=RSS *** Apple Security Advisories *** --------------------------------------------- Apple TV 7.2 https://support.apple.com/kb/HT204662 *** iOS 8.3 *** https://support.apple.com/kb/HT204661 *** OS X Yosemite 10.10.3 and Security Update 2015-004 *** https://support.apple.com/kb/HT204659 *** Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 *** https://support.apple.com/kb/HT204658 *** OS X Yosemite 10.10.3 Combo Update *** https://support.apple.com/kb/DL1804 *** OS X Yosemite 10.10.3 Update *** https://support.apple.com/kb/DL1805 *** Security Update 2015-004 Mountain Lion *** https://support.apple.com/kb/DL1802 *** Security Update 2015-004 Mavericks *** https://support.apple.com/kb/DL1803 *** iOS 8.3 *** https://support.apple.com/kb/DL1806 *** Xcode 6.3 *** https://support.apple.com/kb/HT204663

1 0

Tageszusammenfassung - Mittwoch 8-04-2015
by Daily end-of-shift report 08 Apr '15

08 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-04-2015 18:00 − Mittwoch 08-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Gmail Problems Due to Expired Certificate (April 6, 2015) *** --------------------------------------------- Because Google allowed a servers security certificate to expire, Gmail users experienced problems for several hours on April 4....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/27/302 *** Aw snap! How hideous HTML can crash Chrome tabs in one click *** --------------------------------------------- Watch out for drive-by browser bombs - for now, at least A bug in the most recent version of the Chrome allows miscreants to crash browser tabs simply by embedding a link with a malformed URL in the HTML of a page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/07/chrome_awsn… *** Drive-by-login attack identified and used in lieu of spear phishing campaigns *** --------------------------------------------- A new attack, drive-by-logins, allows attackers to target specific victims on sites they trust. --------------------------------------------- http://www.scmagazine.com/high-tech-bridge-identifies-new-attack-method-pos… *** Nuclear Exploit-Kit mit Google Ads ausgeliefert *** --------------------------------------------- Googles Werbebanner lieferten für mehrere Stunden ein gefährliches Exploit-Kit aus, das die Rechner vieler nichtsahnender Opfer mit Schadcode infiziert haben könnte. --------------------------------------------- http://heise.de/-2596908 *** Most top corporates still Heartbleeding over the internet *** --------------------------------------------- Australia crowned global head-in-sand champion A depressing 76 percent of the top 2000 global organisations have public facing systems still exposed to Heartbleed, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/still_bleed… *** Your home automation things are a security nightmare *** --------------------------------------------- Veracode tests leave lazy devs red-faced Its not just home broadband routers that have hopeless security: according to security outfit Veracode, cloudy home automation outfits also need to hang their collective heads in shame. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/your_home_a… *** Why cybersecurity is vital during the vendor selection process *** --------------------------------------------- You likely have a list of criteria to check through during the hiring process of a vendor, but if you havent added cybersecurity standards to that list, you should. --------------------------------------------- http://www.scmagazine.com/why-cybersecurity-is-vital-during-the-vendor-sele… *** l+f: Updated euer WordPress oder ISIS kommt! *** --------------------------------------------- Das FBI schlägt Alarm: Sympathisanten des Islamischen Staates hacken haufenweise WordPress-Seiten. --------------------------------------------- http://heise.de/-2596912 *** Guide outlines specifications of smart card-based PACS *** --------------------------------------------- Smart cards are increasingly accepted as the credential of choice for securely authenticating identity, determining appropriate levels of information access and controlling physical access. To furt... --------------------------------------------- http://www.net-security.org/secworld.php?id=18179 *** A flawed ransomware encryptor *** --------------------------------------------- Last autumn, we discovered the first sample of an interesting new encryptor, TorLocker. The Trojan encrypts all files with AES-256 + RSA-2048 and uses the Tor network to contact its "owners". --------------------------------------------- http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/ *** New Tor version fixes issues that can crash hidden services and clients *** --------------------------------------------- Two new versions of the Tor anonymity software have been released on Tuesday, with fixes for two security issues that can be exploited to crash hidden services and clients visiting them. The first ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18180 *** Don't judge the risk by the logo *** --------------------------------------------- It's been almost a year since the OpenSSL Heartbleed vulnerability, a flaw which started a trend of the branded vulnerability, changing the way security vulnerabilities affecting open-source software are being reported and perceived. Vulnerabilities are found and fixed all the... --------------------------------------------- https://securityblog.redhat.com/2015/04/08/dont-judge-the-risk-by-the-logo/ *** NTP Project ntpd reference implementation contains multiple vulnerabilities *** --------------------------------------------- NTP Project ntpd reference implementation accepts unauthenticated packets with symmetric key cryptography and does not protect symmetric associations against denial of service attacks. --------------------------------------------- https://www.kb.cert.org/vuls/id/374268 *** Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150408-ntpd --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco ASA FirePOWER Services and Cisco ASA CX Services Crafted Packets Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150408-cxfp --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- cisco-sa-20150408-asa --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** HPSBHF03310 rev.1 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Execution of Code *** --------------------------------------------- Potential security vulnerabilities have been identified with certain HP Thin Clients running Windows Embedded Standard 7 (WES7) and Windows Embedded Standard 2009 (WES09) and all versions of HP Easy Deploy. The vulnerabilities could be exploited remotely to allow elevation of privilege and execution of code. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04629160 *** SSA-487246 (Last Update 2015-04-08): Vulnerabilities in SIMATIC HMI Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** FreeBSD IPv6 Router Advertisement Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032043 *** DSA-3214 mailman - security update *** --------------------------------------------- A path traversal vulnerability was discovered in Mailman, the mailinglist manager. Installations using a transport script (such aspostfix-to-mailman.py) to interface with their MTA instead of staticaliases were vulnerable to a path traversal attack. To successfullyexploit this, an attacker needs write access on the local file system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3214

1 0

Tageszusammenfassung - Dienstag 7-04-2015
by Daily end-of-shift report 07 Apr '15

07 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-04-2015 18:00 − Dienstag 07-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** On Demand Webinar: Monitoring Linux/UNIX Privileged Users *** --------------------------------------------- On Demand Webinar - Randy Franklin Smith looks at how to audit what admins do inside Linux and UNIX with sudo's logging capabilities. Then, the BeyondTrust team will walk through how to augment sudo for complete control and auditing over UNIX and Linux user activity. --------------------------------------------- http://blog.beyondtrust.com/on-demand-webinar-monitoring-linuxunix-privileg… *** Dyre Wolf malware steals more than $1 million, bypasses 2FA protection *** --------------------------------------------- Campaign is crude and brazen, but rakes in cash anyway. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/dSucTqiLvNI/ *** Angler Exploit Kit Utilizing 302 Cushioning and Domain Shadowing *** --------------------------------------------- Overview Angler Exploit Kit is one of the most prevalent and advanced exploit kits in use today and is continually evolving. Angler continues to utilize malvertising to push landing pages and malicious actors are still registering domains solely for serving exploits, but recently, weve noticed an increase in two new infection vectors - 302 Cushioning and Domain Shadowing. 302 Cushioning, or a --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JUMaL-rqARE/angler-explo… *** Bugs in Tor exploited to run DoS against black markets *** --------------------------------------------- A severe vulnerability in Tor network was exploited by attackers to run denial of service attacks against two underground black markets. An operator of an underground black market hosted on the Tor network revealed that hit site suffered a DoS attack that exploited a flaw in Tor architecture. The event is not isolated, a similar... --------------------------------------------- http://securityaffairs.co/wordpress/35663/hacking/bugs-in-tor-dos.html *** Bring Out Your Dead: An Update on the PCI relevance of SSLv3 *** --------------------------------------------- In October, a tidal wave of discussion surrounding SSLv3 hit the information security community with the release of the POODLE attack vector. This served to heat up existing discussions about when and how organizations would give SSLv3 the final thump... --------------------------------------------- https://www.ambiron.com/Resources/SpiderLabs-Blog/Bring-Out-Your-Dead--An-U… *** A severe arbitrary code execution in BitTorrent Sync affects various products *** --------------------------------------------- A security expert has discovered a severe vulnerability in BitTorrent Sync that can be exploited by a remote attacker to execute arbitrary code on a vulnerable machine. The security expert Andrea Micalizzi, also known as "rgod", has discovered a serious vulnerability in BitTorrent Sync (CVE-2015-2846) can be exploited by a remote attacker to execute arbitrary code. --------------------------------------------- http://securityaffairs.co/wordpress/35752/hacking/severe-flaw-bittorrent-sy… *** SS7-Schwachstellen: Firewalls sollen Angriffe mildern *** --------------------------------------------- Die Probleme im Protokoll SS7 lassen sich nicht ohne weiteres absichern, denn es wurden dafür nie entsprechende Sicherheitsmaßnahmen implementiert. Mit Firewalls können Provider Schwachstellen zumindest abmildern. --------------------------------------------- http://www.golem.de/news/ss7-schwachstellen-firewalls-sollen-angriffe-milde… *** Fuzzing: Wie man Heartbleed hätte finden können *** --------------------------------------------- Vor einem Jahr machte der Heartbleed-Bug in OpenSSL Schlagzeilen - doch solche Bugs lassen sich mit Hilfe von Fuzzing-Technologien aufspüren. Wir haben das mit den Tools American Fuzzy Lop und Address Sanitizer nachvollzogen und den Heartbleed-Bug neu entdeckt. --------------------------------------------- http://www.golem.de/news/fuzzing-wie-man-heartbleed-haette-finden-koennen-1… *** Firefox-Update: Mozilla schaltet opportunistische Verschlüsselung wieder aus *** --------------------------------------------- Nicht mal eine Woche nach Firefox 37 muss Mozilla nun Firefox 37.0.1 nachlegen. Das Sicherheits-Feature "opportunistic encryption" kann missbraucht werden, um die Sicherheit von SSL/TLS-Verbindungen zu untergraben und wurde wieder entfernt. --------------------------------------------- http://heise.de/-2596576 *** Cell Phone Opsec *** --------------------------------------------- Heres an article on making secret phone calls with cell phones. His step-by-step instructions for making a clandestine phone call are as follows: Analyze your daily movements, paying special attention to anchor points (basis of operation like home or work) and dormant periods in schedules (8-12 p.m. or when cell phones arent changing locations); Leave your daily cell phone behind... --------------------------------------------- https://www.schneier.com/blog/archives/2015/04/cell_phone_opse.html *** ZDI-15-112: ManageEngine Desktop Central MSP InventorySWMeteringServlet domain File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-112/ *** ZDI-15-113: ManageEngine OpManager MultipartRequestServlet filename File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-113/ *** ZDI-15-114: ManageEngine Desktop Central MSP AndroidCheckInServlet UDID Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-114/ *** ZDI-15-115: BitTorrent Sync btsync: Protocol Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent Sync. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-115/ *** ZDI-15-116: IBM Lotus Domino SSL2 Client Master Key Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-116/ *** ZDI-15-117: IBM Lotus Domino LDAP ModifyRequest add Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-117/ *** Security Advisory: OpenSSL vulnerability CVE-2015-0287 *** --------------------------------------------- (SOL16318) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16318.htm… *** Security Advisory: OpenSSL vulnerability CVE-2009-5146 *** --------------------------------------------- (SOL16337) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16337.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** --------------------------------------------- (SOL16355) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16355.htm… *** SA-CONTRIB-2015-065 - Registration codes - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-065Project: Registration codes (third-party module)Version: 6.x, 7.xDate: 2015-March-04 Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionRegistration codes module allows new account registrations only for users who provide a valid registration code. The module was not properly sanitizing user supplied text in some pages, thereby exposing XSS --------------------------------------------- https://www.drupal.org/node/2445955 *** OpenSSH 6.8 Insecure Functions *** --------------------------------------------- Topic: OpenSSH 6.8 Insecure Functions Risk: Low Text:-=[Advanced Information Security Corp]=- Author: Nicholas Lemonias Report Date: 2/4/2015 Email: lem.nikolas (at) gmail ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040029 *** IDM 4.0.2 ACF2 Driver Version 4.0.0.3 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional ACF2 Driver Version 4.0.0.3. This patch is for the Identity Manager 4.0.2 to 4.5 ACF2 Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206570Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402acf2_4003.tar.gz (2.55 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=oJ3evaNQb2M~ *** IDM 4.0.2 RACF Driver Version 4.0.0.11 Patch 3 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional RACF Driver Version 4.0.0.11. This patch is for the Identity Manager 4.0.2 to 4.5 RACF Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206551Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402racf_40011.tar.gz (2.99 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches:IDM 4.0.2 RACF Driver Version 4.0.0.8 Patch2 --------------------------------------------- https://download.novell.com/Download?buildid=6F0mcIA5UQs~ *** IDM 4.0.2-4.5 Top Secret Driver Version 3.6.1.10 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional Top Secret Driver Version 3.6.1.10. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, TSSEXEC.XMTDocument ID: 5206590Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402topsecret_36110.tar.gz (2.66 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_WYyICODfL8~ *** Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38222 *** HPSBMU03296 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP BladeSystem c-Class Onboard Administrator. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599440 *** HPSBGN03306 rev.1 - HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626468 *** DFN-CERT-2015-0463 - Google Chrome, Chromium, Ubuntu oxide-qt: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 07.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0463/ *** Security Advisory: Persistent XSS in WP-Super-Cache *** --------------------------------------------- Security Risk: Dangerous Exploitation level: Very Easy/Remote DREAD Score: 8/10 Vulnerability: Persistent XSS Patched Version: 1.4.4 During a routine audit for our Website Firewall (WAF), we discovered a dangerous Persistent XSS vulnerability affecting the very popular WP-Super-Cache plugin (more than a million active installs according to wordpress.org). The security issue, as well as another bug-fixRead More --------------------------------------------- http://blog.sucuri.net/2015/04/security-advisory-persistent-xss-in-wp-super…

1 0

Tageszusammenfassung - Freitag 3-04-2015
by Daily end-of-shift report 03 Apr '15

03 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-04-2015 18:00 − Freitag 03-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Website Malware - The SWF iFrame Injector Evolves *** --------------------------------------------- Last year, we released a post about a malware injector found in an Adobe Flash (.SWF) file. In that post, we showed how a .SWF file is used to inject an invisible, .. --------------------------------------------- http://blog.sucuri.net/2015/04/website-malware-the-swf-iframe-injector-evol… *** Audit Concludes No Backdoors in TrueCrypt *** --------------------------------------------- Auditors performing a cryptanalysis of TrueCrypt found four vulnerabilities, but zero backdoors in the popular open source encryption software. --------------------------------------------- http://threatpost.com/audit-concludes-no-backdoors-in-truecrypt/111994 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38194 http://tools.cisco.com/security/center/viewAlert.x?alertId=38193 http://tools.cisco.com/security/center/viewAlert.x?alertId=38210 *** The Fine Line Between Ad and Adware: A Closer Look at the MDash SDK *** --------------------------------------------- Just last month, there were reports that Google removed three apps from its Play Store as they were discovered to be adware in disguise. At the time of the discovery, the apps were said to have been downloaded into millions of devices, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-fine-line-be… *** VMSA-2015-0003 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** All in One SEO Pack <= 2.2.5.1 - Authentication Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7881 *** Schneider Electric VAMPSET Software Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a vulnerability in the Schneider Electric VAMPSET software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-092-01 *** SSH Fingerprints Are Important, (Fri, Apr 3rd) *** --------------------------------------------- Some years ago, I was preparing Cisco certification exams. I connected via SSH to a new Cisco router, and was presented with this familiar dialog: This made me think: before proceeding, I wanted to obtain the fingerprint out-of-band, via a trusted channel, so that I could verify it. So I took a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19543 *** Android Security - 2014 in Review *** --------------------------------------------- https://static.googleusercontent.com/media/source.android.com/en/us/devices…

1 0

Tageszusammenfassung - Donnerstag 2-04-2015
by Daily end-of-shift report 02 Apr '15

02 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-04-2015 18:00 − Donnerstag 02-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Phishing-Mails mit Anweisungen des Chefs oft erfolgreich *** --------------------------------------------- Phishing-Mails werden immer raffinierter. So gibt es etwa getarnte Mails vom Boss an seine Mitarbeiter, Geld zu überweisen, die höchst erfolgreich sind. --------------------------------------------- http://futurezone.at/digital-life/phishing-mails-mit-anweisungen-des-chefs-… *** User Import - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-093 *** --------------------------------------------- This module enables the import of users into Drupal, or the update of existing users, with data from a CSV file (comma separated file).Some management URLs were not properly protected. A malicious user could trick an administrator .. --------------------------------------------- https://www.drupal.org/node/2463949 *** Password Policy - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-090 *** --------------------------------------------- The Password Policy module allows enforcing restrictions on user passwords by defining password policies.The module doesnt sufficiently sanitize usernames in some administration pages, thereby exposing a Cross Site Scripting .. --------------------------------------------- https://www.drupal.org/node/2463835 *** NewPosThings Has New PoS Things *** --------------------------------------------- Arbor Networks initially posted about a new point-of-sale (PoS) malware family named NewPosThings last September, which we detect as either TSPY_POSNEWT.SM or TSPY_POSNEWT.A. We are now .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/newposthings-has… *** Google suspends CNNIC from Chromes certificate store *** --------------------------------------------- Chinese certificate authority told to re-apply.When a web client, such as a browser, attempts to make an HTTPS connection, it needs to know that no man-in-the-middle attack is taking place. The web server therefore proves its .. --------------------------------------------- http://www.virusbtn.com/blog/2015/04_02b.xml *** Frühjahrsputz bei Chrome: Fast 200 Adware-Plug-ins fliegen raus *** --------------------------------------------- Google räumt im Chrome Web Store auf und verbannt reihenweise Adware-Erweiterungen, die Millionen von Nutzern mit Werbung genervt haben. In Zukunft sollen derartige Plagegeister erst gar nicht im Web Store landen. --------------------------------------------- http://heise.de/-2595248 *** E-Mail-Sicherheit: Gedächtnislücken und Darkmail-Ideen *** --------------------------------------------- Die Internet Engineering Task Force hat sich die Vertraulichkeit der Internetprotokolle auf die Fahnen geschrieben. Was lässt sich bei E-Mails noch machen? Zum Beispiel Metadaten verbergen. Auch gibt es Versuche, sichere E-Mail handlicher zu machen. --------------------------------------------- http://heise.de/-2595167 *** Using the docker command to root the host (totally not a security issue) *** --------------------------------------------- It is possible to do a few more things more with docker besides working with containers, such as creating a root shell on the host, overwriting system configuration files, reading restricted stuff, etc. --------------------------------------------- http://reventlov.com/advisories/using-the-docker-command-to-root-the-host *** Analysis of a Romanian Botnet *** --------------------------------------------- Recently I noticed some strange entries in our web server log files. Specifically, someone was trying to exploit our servers using the ShellShock vulnerability (CVE-2014-6271) to execute a .. --------------------------------------------- http://blog.politoinc.com/2015/04/analysis-of-a-romanian-botnet/ *** Verschlüsselung: Truecrypt-Audit findet kleinere Sicherheitsprobleme *** --------------------------------------------- Die zweite Phase des Audits für die Verschlüsselungssoftware Truecrypt ist beendet. Dabei wurden die kryptographischen Funktionen untersucht. Einige Sicherheitsprobleme wurden entdeckt, sie treten aber nur in seltenen Fällen auf. --------------------------------------------- http://www.golem.de/news/verschluesselung-truecrypt-audit-findet-kleinere-s…

1 0

Tageszusammenfassung - Mittwoch 1-04-2015
by Daily end-of-shift report 01 Apr '15

01 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 31-03-2015 18:00 − Mittwoch 01-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38113 http://tools.cisco.com/security/center/viewAlert.x?alertId=38118 http://tools.cisco.com/security/center/viewAlert.x?alertId=38114 http://tools.cisco.com/security/center/viewAlert.x?alertId=38124 *** The Resurrection of CVE-2011-2461 *** --------------------------------------------- Security researchers Luca Carettoni and Mauro Gentile recently found during their research that even though Adobe has fixed an old vulnerability found in 2011 (CVE-2011-2461), its side effects still linger around the Internet. Your favorite .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-resurrection… *** OWASP/WASC Distributed Web Honeypots Project Re-Launch - Seeking Participants *** --------------------------------------------- The SpiderLabs Research Team is proud to announce that we are officially re-launching the Distributed Web Honeypots Project under the new joint OWASP/WASC project home! For those SpiderLabs Blog readers who follow our .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/OWASP/WASC-Distributed-… *** Intro to E-Commerce and PCI Compliance - Part I *** --------------------------------------------- Have you ever heard of the term Payment Card Industry (PCI)? Specifically, PCI compliance? If you have an e-commerce website, you probably have already heard about it. But do .. --------------------------------------------- http://blog.sucuri.net/2015/03/intro-to-e-commerce-and-pci-compliance-part-… *** Inductive Automation Ignition Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for several vulnerabilities in Inductive Automation's Ignition Software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-01 *** Ecava IntegraXor DLL Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two DLL loading vulnerabilities in Ecava's IntegraXor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-02 *** Hospira MedNet Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for four vulnerabilities in Hospira's MedNet server software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-03 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01A *** Rig Exploit Kit Changes Traffic Patterns, (Wed, Apr 1st) *** --------------------------------------------- Sometime within the past month, Rig exploit kit (EK) changed URL structure." /> Notice the PHPSSESID and ?req= patterns in the above example." /> Now, we dont see the PHPSSESID and ?req= patterns. Lets take a closer look at the more .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19533 *** Multiple Xen-vulnerabilities *** --------------------------------------------- http://www.securitytracker.com/id/1031994 http://www.securitytracker.com/id/1031998 http://www.securitytracker.com/id/1031997 *** Crypto-Ransomware Sightings and Trends for 1Q 2015 *** --------------------------------------------- It seems that cybercriminals have yet to tire of creating crypto-ransomware malware. Since the start of 2015, we have spotted several variants of crypto-ransomware plague the threat landscape. In January, the Australia-New Zealand region was beset by variants of TorrentLocker. But we soon .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/crypto-ransomwar… *** Firefox 37 verbessert Browser-Sicherheit *** --------------------------------------------- Es ist wieder einmal Update-Zeit bei Mozilla: Mit Firefox 37 gibt es nun also eine neue Version des Browsers, die vor allem Sicherheitsverbesserungen verspricht. --------------------------------------------- http://derstandard.at/2000013734909 *** A timeline of mobile botnets *** --------------------------------------------- With the recent explosion in smartphone usage, malware authors have increasingly focused their attention on mobile devices, leading to a steep rise in mobile malware over the past couple of years. In this paper, Ruchna Nigam focuses on mobile botnets, drawing up an inventory of types of known mobile bot variants. --------------------------------------------- https://www.virusbtn.com/virusbulletin/archive/2015/03/vb201503-mobile-botn… *** Google: Fünf Prozent aller Nutzer haben Adware auf ihren Rechnern *** --------------------------------------------- Bei mehr als einem Drittel davon sind es sogar mehr als vier Tools, die Werbung in Webseiten injizieren --------------------------------------------- http://derstandard.at/2000013745151 *** Smartes Türschloss August war zu gastfreundlich *** --------------------------------------------- Durch eine Lücke in vernetzten Türschlossern konnten sich deren Besitzer unangemeldet untereinander besuchen. --------------------------------------------- http://heise.de/-2593822 *** JOSE - JSON Object Signing and Encryption *** --------------------------------------------- Federated Identity Management has become very widespread in past years - in addition to enterprise deployments a lot of popular web services allow users to carry their identity over multiple sites. Social networking .. --------------------------------------------- https://securityblog.redhat.com/2015/04/01/jose-json-object-signing-and-enc… *** DNS/AXFR: Nameserver verraten Geheim-URLs *** --------------------------------------------- Das DNS-Protokoll hat eine Funktion, mit der man umfangreiche Informationen zu einer Domain abfragen kann. Dieser sogenannte AXFR-Transfer ist normalerweise .. --------------------------------------------- http://www.golem.de/news/dns-axfr-nameserver-verraten-geheim-urls-1504-1132…

1 0

Tageszusammenfassung - Dienstag 31-03-2015
by Daily end-of-shift report 31 Mar '15

31 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 30-03-2015 18:00 − Dienstag 31-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New reconnaissance threat Trojan.Laziok targets the energy sector *** --------------------------------------------- A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised .. --------------------------------------------- http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlazio… *** WordPress Leads 1.6.1-1.6.2 - Persistent XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7871 *** Drive-by code and Phishing on Swiss websites in 2014 *** --------------------------------------------- In 2014, about 1,800 Swiss websites were cleaned from drive-by code, compared with 2,700 in 2013, a decline of 33%. At the same time, the number of phishing cases affecting .ch and .li .. --------------------------------------------- http://securityblog.switch.ch/2015/03/31/drive-by-phishing-swiss-websites-2… *** Citrix Command Center Bugs Let Remote Users Download Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031993 *** VB2015 conference programme announced *** --------------------------------------------- >From drones to elephants: an exciting range of topics will be covered in Prague.In six months time, security researchers from around the world will gather in Prague for the 25th Virus Bulletin conference. Today we are excited to reveal the conference programme.As every year, the selection committees task .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_31.xml?rss *** IoT Research - Smartbands *** --------------------------------------------- One of the big trends in sphere of health and fitness are fitness trackers such as smartbands. Tracking devices and their mobile applications from three leading vendors were inspected in this report to shed some light on the current .. --------------------------------------------- http://securelist.com/analysis/publications/69412/iot-research-smartbands/ *** Chinas Man-on-the-Side Attack on GitHub *** --------------------------------------------- We have looked closer at this attack, and can conclude that China is using their active and passive network infrastructure in order to perform a man-on-the-side attack against GitHub. See our "TTL analysis" at the end of .. --------------------------------------------- http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-… *** Hacking Browsers: Are Browsers the Weakest Link of the Security Chain? *** --------------------------------------------- Current scenario The number of cyber attacks is constantly increasing, and according to security experts they grow even more sophisticated. The security firm Secunia has recently released its annual study of trends in software vulnerabilities, an interesting report that highlights the .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-browsers-are-browsers-the-wea… *** The sad state of SMTP encryption *** --------------------------------------------- This is a quick recap of why Im sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it. --------------------------------------------- https://blog.filippo.io/the-sad-state-of-smtp-encryption/

1 0

Tageszusammenfassung - Montag 30-03-2015
by Daily end-of-shift report 30 Mar '15

30 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-03-2015 18:00 − Montag 30-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** iOS, OS X Library AFNetwork Patches MiTM Vulnerability *** --------------------------------------------- Until yesterday, a popular networking library for iOS and OS X, used by several apps like Pinterest and Simple was susceptible to SSL man-in-the-middle (MiTM) attacks. --------------------------------------------- http://threatpost.com/ios-os-x-library-afnetwork-patches-mitm-vulnerability… *** Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38079 *** Privilege Escalation in TYPO3 Neos *** --------------------------------------------- http://www.typo3.org/news/article/privilege-escalation-in-typo3-neos/ *** Offenbar schwerwiegendes Datenleck bei Uber *** --------------------------------------------- Offenbar kursieren im Dark Web zurzeit Zugangsdaten zu Tausenden von Nutzerkonten des Fahrdienstes Uber. Diese werden zu Spottpreisen von mehreren Anbietern laut Motherboard verhökert. Die Datensätze enthalten demnach Benutzername, Passwort und die letzten Ziffern, sowie das Verfallsdatum der .. --------------------------------------------- http://derstandard.at/2000013594365 *** British Airways: Hacker hatten Zugriff auf Bonusmeilen *** --------------------------------------------- In einem offenbar automatisierten Angriff auf Konten des British Airways Executive Club ist es Einbrechern möglicherweise gelungen, die Bonusmeilen einiger Kunden abzugreifen. --------------------------------------------- http://www.golem.de/news/british-airways-hacker-hatten-zugriff-auf-bonusmei… *** Announcing tlscompare.org *** --------------------------------------------- As part of an ongoing project on increasing TLS security we are today announcing https://tlscompare.org This webpage is about evaluating a massive extension of the ruleset for HTTPSEverywhere, a browser extension for Chrome and Firefox which .. --------------------------------------------- https://www.sba-research.org/2015/03/30/announcing-tlscompare-org/ *** Newsletter 3.7.0 - Open Redirect *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7868 *** Projekt-Hosting: Tagelanger DDoS-Angriff auf Github *** --------------------------------------------- Seit Donnerstag läuft die grösste DDoS-Attacke auf Github seit dem Entstehen des Dienstes. Experten vermuten, der Angriff gehe von chinesische Behörden aus, bestätigt wird das durch den Projekt-Hoster aber nicht. --------------------------------------------- http://www.golem.de/news/projekt-hosting-tagelanger-ddos-angriff-auf-github… *** Security Attacks via Malicious QR Codes *** --------------------------------------------- With the increasing use of smartphones, QR codes are becoming popular. Recently, WhatsApp launched its web version, which needs QR code scanning to access the web version of WhatsApp. So, many people now know what QR code is, but still more are unaware. It is very similar to a bar code we .. --------------------------------------------- http://resources.infosecinstitute.com/security-attacks-via-malicious-qr-cod… *** OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36956 *** Ad Networks Ripe for Abuse Via Malvertising *** --------------------------------------------- Criminals have found a safe haven abusing legitimate processes, such as real-time bidding, implemented by online advertising networks to move exploits and malware, and build botnets and fraud campaigns. --------------------------------------------- http://threatpost.com/ad-networks-ripe-for-abuse-via-malvertising/111840 *** WordPress Plugin - Revslider update captions CSS file critical vulnerability *** --------------------------------------------- Today being another day at work for SecureLayer7 to recover our client's defaced website, and bang I think I hit upon a nasty vulnerability of a famous plugin. Although we successfully patched the vulnerability and we fixed the undoing of the blacklisting. On further research I stumbled .. --------------------------------------------- http://blog.securelayer7.net/wordpress-plugin-revslider-update-captions-css…

1 0

Tageszusammenfassung - Freitag 27-03-2015
by Daily end-of-shift report 27 Mar '15

27 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-03-2015 18:00 − Freitag 27-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Task Name aaaQueueReader Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38076 *** Verschlüsselung: Kryptographen zeigen neue Angriffe gegen RC4 *** --------------------------------------------- Eine bislang wenig beachtete Schwäche von RC4 nutzt der Kryptograph Itsik Mantin für seine neue Angriffsmethode. Ein weiterer kürzlich vorgestellter Angriff betrifft IMAP-Verbindungen. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patches that mitigate these vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01 *** Beta Bot Trojan *** --------------------------------------------- In this article, I would like to show how an analysis is performed on the Beta Bot trojan to identify its characteristics. The Beta Bot trojan, classified as Troj/Neurevt-A, is a dangerous trojan. This trojan is transferred to the victim machine through a phishing email, and the user downloads the files disguised .. --------------------------------------------- http://resources.infosecinstitute.com/beta-bot-trojan/ *** Cisco NX-OS Software DHCP Options Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38062 *** Microsoft will Windows-Lücke nicht schliessen *** --------------------------------------------- Google entdeckt Fehler, über den sich einfache Nutzer Systemrechte verschaffen können. --------------------------------------------- http://derstandard.at/2000013551658 *** The bizarre, pre-internet history of ransomware *** --------------------------------------------- Two months ago, I wrote a short article about helping my mother deal with CryptoWall 2.0., a form of computer virus more broadly known as ransomware. Basically what happens is this: You flip open your laptop to find you have been locked out of all your files. Then a ransom note hovers into view, written .. --------------------------------------------- https://medium.com/un-hackable/the-bizarre-pre-internet-history-of-ransomwa… *** Baidu's traffic hijacked to DDoS GitHub.com *** --------------------------------------------- As a Chinese living outside of China, I frequently visit Chinese websites, many of which use advertising and visitor tracking provided by Baidu, the largest search engine available in China. As I was browsing one of the most popular .. --------------------------------------------- http://insight-labs.org/?p=1682 *** Vulnerability: CVE-2015-0932 *** --------------------------------------------- ANTLabs InnGate devices are a popular Internet gateway for visitor-based networks. They're commonly installed in hotels, convention centers and other places that provide temporary guests access to a WiFi connection. If you've ever used WiFi in a hotel, you're familiar with these types of devices as they are typically tied to a specific room number for billing purposes. --------------------------------------------- http://blog.cylance.com//spear-team-cve-2015-0932

1 0

Tageszusammenfassung - Donnerstag 26-03-2015
by Daily end-of-shift report 26 Mar '15

26 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-03-2015 18:00 − Donnerstag 26-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Pin-up on your Smartphone!, (Thu, Mar 26th) *** --------------------------------------------- Yeah, okay, I admit that headline is cheap click bait. Originally, it said Certificate Pinning on Smartphones. If you are more interested in pin-ups on your smartphone, I fear youll have to look elsewhere :). Recently, an email provider that I use changed their Internet-facing services completely. I hadnt seen any announcement that this would happen, and the provider likely thought that since the change was transparent to the customer, no announcement was needed. But Im probably a tad more... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19513&rss *** Data lurking: How to protect your company against overlooked insider threats *** --------------------------------------------- Enterprises often fear hackers as their number one security threat. However, they should be more scared of what happens internally. More often than not, data breaches come from employees or system err... --------------------------------------------- http://www.net-security.org/article.php?id=2245 *** Setting issue in Windows 7 and 8.1 could allow privilege escalation *** --------------------------------------------- Experts of the Project Zero have disclosed a proof-of-concept for the exploitation of a default setting in Windows 7, 8.1 that allow privilege escalation. A new security issue threatens users of Windows 7 and 8.1, this time experts are warning about a default setting in both OSs that could allow local users to elevate privileges... --------------------------------------------- http://securityaffairs.co/wordpress/35318/hacking/win-7-and-8-1-privilege-e… *** Security Harden CentOS 7 *** --------------------------------------------- This HowTo walks you through the steps required to security harden CentOS 7, it's based on the OpenSCAP benchmark, unfortunately the current version of OpenSCAP that ships with CentOS does not offically support CentOS CPEs. But there is a "workaround" that will allow OpenSCAP + OpenSCAP workbench to run on CentOS, I'll document this in a separate post. --------------------------------------------- http://highon.coffee/blog/security-harden-centos-7/ *** Encryption Solutions for the New World *** --------------------------------------------- Keeping personal information secure and protected remains a top priority for computer users who now rely heavily on information systems to manage a large part of their personal and business lives. One of the ways to make sure only authorized users have access to information is the use of encryption, a process that transforms data... --------------------------------------------- http://resources.infosecinstitute.com/encryption-solutions-for-the-new-worl… *** Who Is the Antidetect Author? *** --------------------------------------------- Earlier this month I wrote about Antidetect, a commercial tool designed to help thieves evade fraud detection schemes employed by many e-commerce companies. That piece walked readers through a sales video produced by the author of Antidetect showing the software being used to buy products online with stolen credit cards. Today, well take a closer look at clues to a possible real-life identity of this tools creator. --------------------------------------------- http://krebsonsecurity.com/2015/03/who-is-the-antidetect-author/ *** Hacking-Kit für Steuergeräte im Auto *** --------------------------------------------- Ein Hacking-Toolkit soll dabei helfen, IT-Sicherheitslücken bei Autos aufzudecken. Ziel ist es, die Hersteller zu mehr Sorgfalt bei diesem Thema zu bewegen. --------------------------------------------- http://heise.de/-2585225 *** Verschlüsselung: RC4 erneut unter Beschuss *** --------------------------------------------- Auf der Black Hat Asia hat der Kryptograph Itsik Mantin neue Angriffsmethoden gegen die RC4-Verschlüsselung vorgestellt. Den Grundstein dazu hatte Mantin bereits vor 13 Jahren gelegt. Davon unabhängig wurde kürzlich ein weiterer Angriff gegen RC4 vorgestellt, der IMAP-Verbindungen betrifft. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** WordPress Malware Causes Psuedo-Darkleech Infection *** --------------------------------------------- Darkleech is a nasty malware infection that infects web servers at the root level. It use malicious Apache modules to add hidden iFrames to certain responses. It's difficult to detect because the malware is only active when both server and site admins are not logged in, and the iFrame is only injected once a dayRead More --------------------------------------------- http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html *** VMSA-2015-0001.2 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** DFN-CERT-2015-0416 - Citrix Command Center: Zwei Schwachstellen ermöglichen die Übernahme des Systems *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0416/ *** EMC Isilon OneFS Privilege Escalation *** --------------------------------------------- Topic: EMC Isilon OneFS Privilege Escalation Risk: Medium Text:ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Identifier: ESA-2015-049 CVE Identifier: CVE-2015-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030182 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** Linear Case - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-084 *** https://www.drupal.org/node/2459327 *** Webform Multiple File Upload - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-083 *** https://www.drupal.org/node/2459323 *** Crumbs - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-082 *** https://www.drupal.org/node/2459315 *** Petition - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-081 *** https://www.drupal.org/node/2459311 *** Invoice - Moderately Critical - Multiple vulnerabilities - Unsupported - SA-CONTRIB-2015-085 *** https://www.drupal.org/node/2459337 *** Ubercart Webform Checkout Pane - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-087 *** https://www.drupal.org/node/2459359 *** Decisions - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349 *** Decisions - Moderately Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349

1 0

Tageszusammenfassung - Mittwoch 25-03-2015
by Daily end-of-shift report 25 Mar '15

25 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-03-2015 18:00 − Mittwoch 25-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Patched Flash Vulnerability Now Part of Exploit Kit (March 20, 2015) *** --------------------------------------------- A vulnerability in Adobes Flash Player that was patched on March 12 has already been added to an exploit kit....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/23/200 *** Macro-based Malware Increases Along with Spam Volume, Now Drops BARTALEX *** --------------------------------------------- Early this year Microsoft reported an increase in macro-related threats being used to spread malware via spam. Similarly, we've been seeing a drastic increase in spammed emails with attached Microsoft Word documents and Microsoft Excel spreadsheets that come with embedded macros. Macros are a set of commands or code that are meant to help automate... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/EHquGcibJew/ *** 15,435 vulnerabilities across 3,870 applications were recorded in 2014 *** --------------------------------------------- In 2014, 15,435 vulnerabilities were discovered according to data from Secunia Research. The vulnerabilities are spread across 3,870 applications published by 500 different vendors, and these numbers ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18132 *** l+f: XXSs not dead *** --------------------------------------------- Nur weil es keine Schlagzeilen mehr macht, ist es noch lange nicht aus der Welt. Das beweist etwa eine XSS-Lücke bei Amazon. --------------------------------------------- http://heise.de/-2584311 *** Multifunctional Vawtrak malware now updated via favicons *** --------------------------------------------- The Vawtrak (aka Snifula) multifunctional malware has been around since mid-2013. Its information-stealing, backdoor and spying capabilities deservedly earned it the description as the "Swiss army kni... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2997 *** Not using IPv6? Are you sure? *** --------------------------------------------- Internet Protocol version 6 (IPv6) has been around for many years and was first supported in Red Hat Enterprise Linux 6 in 2010. Designed to provide, among other things, additional address space on the ever-growing Internet, IPv6 has only recently... --------------------------------------------- https://securityblog.redhat.com/2015/03/25/security-considerations-regardin… *** PHP 5.5.23 is available, (Wed, Mar 25th) *** --------------------------------------------- >From the fine folks at php.net: The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version. (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19507&rss *** F-Secure: FSC-2015-2: PATH TRAVERSAL VULNERABILITY, (Wed, Mar 25th) *** --------------------------------------------- F-Secure has announced a security vulnerability affecting their corporate and consumer protection products. The details are available here: https://www.f-secure.com/en/web/labs_global/fsc-2015-2 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19509&rss *** Researcher finds backdoor opened by Dells helper app *** --------------------------------------------- A security researcher has discovered a serious bug in Dell System Detect, the software Dell users are urged to use to download the appropriate drivers for their machines. The flaw can be exploited by ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18134 *** Flash in 2015 *** --------------------------------------------- In the past few years, web exploits had three main targets: Internet Explorer, Java, and Flash. In 2013, the popularity of Java exploits peaked. Bug hunters became really good at finding Java bugs, and corrupting the security manager was a convenient exploitation technique. Multiple exploit campaigns used Java zero-days, and exploit kits (EK) universally adopted these exploits. In January of 2014, however, Oracle blocked the execution of unsigned applets by default, and exploit authors largely abandoned Java. The change left Internet Explorer and Adobe Flash as the next best targets. Both IE and Flash received attention from exploit developers, but in June of 2014, Microsoft began rolling out heap corruption mitigations such as an isolated heap and delayed frees for IE. Exploit developers again, needed to shift their focus. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/flash_in_2015.html *** Guest talk: "Large-scale Automated Software Diversity - Programming Language Technology to Enhance System Security" *** --------------------------------------------- 26/03/2015 - 10:00 am - 11:00 am SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/guest-talk-large-scale-automated-softwa… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco IOS XR Software DHCPv4 Server Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38006 *** Cisco Mobility Service Engine Password Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38007 *** Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699013 *** IBM Security Bulletin: NTP vulnerabilities affect IBM SmartCloud Entry (CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022036 *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0206) *** http://www.ibm.com/support/docview.wss?uid=swg21697205 *** IBM Security Bulletin: IBM Cloud Manager with OpenStack Nova Vulnerability (CVE-2014-3708) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022097 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime Technology Edition affect Rational Functional Tester (CVE-2014-3065, CVE-2014-3566, CVE-2014-6511) *** http://www.ibm.com/support/docview.wss?uid=swg21693297 *** IBM Security Bulletin: Vulnerabilities in GSKit affect IBM Content Collector for SAP Applications (CVE-2015-0138, CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699263 *** IBM Security Bulletin : Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker *** http://www.ibm.com/support/docview.wss?uid=swg21697107 *** IBM Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect Rational DOORS Web Access (CVE-2014-6593, CVE-2015-0410, CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21697068 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2014-6549) (CVE-2015-0408) (CVE-2015-0412) (CVE-2015-0395) (CVE-2015-0403) (CVE-2015-0406) (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699907 *** DFN-CERT-2015-0399 GnuTLS: Mehrere Schwachstellen ermöglichen das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0399/ *** GE and MACTek HART Device DTM Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-036-01 GE and MACTek HART Device DTM Vulnerability that was published February 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01A *** Random Article component for Joomla! multiple SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101773

1 0

Tageszusammenfassung - Dienstag 24-03-2015
by Daily end-of-shift report 24 Mar '15

24 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-03-2015 18:00 − Dienstag 24-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** DMARC and Spam: Why It Matters *** --------------------------------------------- Recently I discussed how TorrentLocker spam was using email authentication for its spam runs. At the time, I suggested that these spam runs were using email authentication to gather information about victim networks and potentially improve the ability to evade spam filters. DomainKeys Identified Mail's (DKIM) own specification mentions the possibility of messages with from "trusted sources" and with a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/W3IX-WkypVo/ *** Why enterprise IT and security teams should talk more *** --------------------------------------------- The "It wont happen to me" mentality combined with communication gaps between the IT and security teams greatly increases enterprises risk of being breached. --------------------------------------------- http://www.scmagazine.com/why-enterprise-it-and-security-teams-should-talk-… *** Xen shows off 35-piece cloudpocalypse collection *** --------------------------------------------- The latest fixing fashions for open-source hypervisors hit the catwalk The Xen Project has fixed 35 flaws, all rated critical, for versions 4.3 and 4.4 of its flagship hypervisor. The fixes appear to correspond to flaws identified after the late February 2014 cloudpocalypse, when major cloud providers feared they would once again need to reboot substantial parts of their server fleets to keep them secure. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/xen_shows_o… *** Four advantages of an identity behavior-based approach to cybersecurity *** --------------------------------------------- With an ever-increasing number of data breaches, more money is being poured into IT security budgets. According to Gartner, the average global security budget increased 8 percent from 2013 to 2014 and... --------------------------------------------- http://www.net-security.org/article.php?id=2243 *** KNX-Schwachstellen: Spielen mit den Lichtern der anderen *** --------------------------------------------- Das aktuelle KNX-Protokoll abzusichern, halten die Entwickler nicht für nötig. Denn Angreifer brauchen physischen Zugriff auf das System. Doch den bekommen sie leichter als gedacht - und können dann sogar Türöffner und Alarmanlagen steuern. --------------------------------------------- http://www.golem.de/news/knx-schwachstellen-spielen-mit-den-lichtern-der-an… *** BlackHat talk hibernated over 0-day in SAPs Afaria mobile manager *** --------------------------------------------- Researcher has form as a gent: he held back disclosure of medical records leak Alexander Polyakov has been forced to withdraw a talk detailing dangerous vulnerabilities into SAPs mobile device management product Afaria scheduled to be given at BlackHat Asia Pacific this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/sap_blackha… *** Google deckt erneut Missbrauch im SSL-Zertifizierungssystem auf *** --------------------------------------------- Über das Public-Key-Pinning im Webbrowser Chrome ist Google auf gefälschte Zertifikate für Google-Domains gestoßen. Diese werden von der Root-CA CNNIC beglaubigt, der viele Betriebssysteme und Browser beim Aufbau verschlüsselter Verbindungen vertrauen. --------------------------------------------- http://heise.de/-2583414 *** The importance of standards in electronic identification and trust services providers *** --------------------------------------------- ENISA publishes a new report on the importance of standards in the area of electronic identification and trust services providers. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/the-importance-of-standards-in-… *** Full, cracked version of NanoCore RAT leaked, onslaught of infection attempts expected *** --------------------------------------------- NanoCore, a lesser-known remote access Trojan (RAT), has recently been spotted being delivered to employees of energy companies in Asia and the Middle East via spear-phishing emails impersonating a le... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2995 *** Android Installer Hijacking Vulnerability Could Expose Android Users to Malware *** --------------------------------------------- Executive Summary We discovered a widespread vulnerability in Google's Android OS we are calling "Android Installer Hijacking", estimated to impact 49.5 percent of all current Android users. In detail: Android Installer Hijacking allows an attacker... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijack… *** The average DDoS attack tripled in volume *** --------------------------------------------- The average packet volume for DDoS attacks increased 340 percent to 4.36 million packets per second (Mpps), and the average bit volume swelled 245 percent to 12.1 Gbps in the final quarter of 2014, ac... --------------------------------------------- http://www.net-security.org/secworld.php?id=18125 *** Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls *** --------------------------------------------- BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks. --------------------------------------------- http://blog.beyondtrust.com/privilege-gone-wild-2-over-25-of-organizations-… *** Is Your Multi-Factor Authentication Solution the Real Thing? *** --------------------------------------------- In infosec, multi-factor authentication is often considered a positive, constructive element of layered security. However, some people have an oversimplified view. With multi-factor authentication, there are many nuances to consider. At BSides Austin I presented on this topic. When shopping for a multi-factor authentication solution, what should you look for? There are over 200 multi-factor authentication vendors, how do you evaluate the best one for your needs? You can weed out more the half --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/is-your-multi-factor-a… *** Why Website Reinfections Happen *** --------------------------------------------- I joined Sucuri a little over a month ago. My job is actually as a Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It's this idea that regardless of you are you must always... --------------------------------------------- http://blog.sucuri.net/2015/03/why-website-reinfections-happen.html *** HP Security Bulletins *** --------------------------------------------- *** HPSBST03196 rev.1- HP StoreEver MSL6480 Tape Library running OpenSSL, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599191 *** HPSBGN03299 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information, Unauthorized Access *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04604357 *** HPSBHF03289 rev.1- HP ThinClient PCs running ThinPro Linux, Remote Code Execution, Denial of Service, Disclosure of information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04602055 *** HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, Remote Execution of Code *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04518183 *** HPSBMU03297 rev.1- HP Helion Application Lifecycle Service (ALS) for Linux, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599861 *** HPSBMU03301 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04609844 *** HPSBHF03151 rev.1 - HP Integrated Lights-Out 2 and 4 (iLO 2, iLO 4), Chassis Management (iLO CM), Remote Denial of Service, Remote Execution of Code, Elevation of Privilege *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04486432 *** HPSBHF03275 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582218 *** HPSBHF03276 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Unauthorized Access, Denial of Service (Dos) *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582368 *** HPSBMU03292 rev.1 - HP Operations Orchestration Authentication Bypass *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595607 *** HPSBMU03291 rev.1 - HP Operations Orchestration running Powershell Operations, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595417 *** HPSBMU03263 rev.1 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 are affected by vulnerabilities in NTP (CVE-2014-9293, CVE-2014-9294, CVE-2014-9297, CVE-2014-9298) *** http://www.ibm.com/support/docview.wss?uid=swg21699578 *** IBM Security Bulletin: Vulnerabilities in IBM Rational ClearQuest (CVE-2014-8925) *** http://www.ibm.com/support/docview.wss?uid=swg21699148 *** IBM Security Bulletin: IBM Forms Experience Builder is affected by a Dojo Toolkit vulnerability (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21697448 *** IBM Security Bulletin: IBM Security Identity Manager Adapters passwords exposed in log files (CVE-2014-8923) *** http://www.ibm.com/support/docview.wss?uid=swg21699902 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-3566 CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698921 *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3065) *** http://www.ibm.com/support/docview.wss?uid=swg21696456 *** IBM Security Bulletin: Multiple vulnerabilities in Java Runtime affect XIV Management Tools (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005143 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-6593 CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698695 *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005037 *** IBM Security Bulletin: Multiple Kerberos (krb5) vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022076 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by the following SAMBA vulnerabilities: CVE-2015-0240 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020638 *** EMC Documentum xMS information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101741 *** DSA-3203 tor - security update *** --------------------------------------------- Several denial-of-service issues have been discovered in Tor, aconnection-based low-latency anonymous communication system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3203 *** InBoundio Marketing Plugin <= 2.0.3 - Shell Upload *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7864

1 0

Tageszusammenfassung - Montag 23-03-2015
by Daily end-of-shift report 23 Mar '15

23 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-03-2015 18:00 − Montag 23-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple: Those security holes we fixed last week? Youre going to need to repatch *** --------------------------------------------- Turns out those bugs werent quite squished Apple has released a follow-up to last weeks security update after finding a pair of flaws that are still vulnerable on patched systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/20/apple_remem… *** Drupal Compromise Analysis Including Indicators of Compromise *** --------------------------------------------- I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis Wilson, Bryant Smith and Casey Critchfield for their help with gathering data and analyzing this attack. Analysis of a real Drupal compromise In this blog post, we will... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Drupal-Compromise-Analy… *** Operation Woolen Goldfish, a hacking campaign in the wild *** --------------------------------------------- Security experts at Trend micro uncovered a new hacking campaign dubbed Operation Woolen Goldfish likely run by a threat actor group known as Rocket Kitten. Security experts at Trend Micro have uncovered a new cyber espionage campaign that is targeting a number of European organisations and businesses. The attackers run a spear phishing campaign that... --------------------------------------------- http://securityaffairs.co/wordpress/35128/cyber-crime/operation-woolen-gold… *** PoSeidon the most sophisticated PoS malware until now *** --------------------------------------------- Cisco Security Team has spotted in the wild a new Point-of-Sale malware dubbed PoSeidon that is more sophisticated than previously detected PoS malware. Expert at Cisco have discovered a new Point-of-Sale (PoS) malware dubbed PoSeidon. The experts have discovered many similarities with the popular Zeus Trojan and use sophisticated methods to find card data respect other POS malware like BlackPoS, which was used... --------------------------------------------- http://securityaffairs.co/wordpress/35181/cyber-crime/poseidon-pos-malware.… *** CREEPS rejoice: Small biz Cisco phones open to eavesdrop 0-day *** --------------------------------------------- Open phones may crop up on Shodan Creeps can listen in to conversations placed over vulnerable Cisco small business phones. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/23/creeps_rejo… *** New Dridex malware evades detection with AutoClose function *** --------------------------------------------- Security experts at Proofpoint have discovered a new phishing campaign that exploits a Dridex variant that evades detection with AutoClose function. Criminal crews behind the Dridex banking malware are very prolific and are improving the popular malicious code. Recently we have discussed about a Dridex variant which was spread through phishing messages with Microsoft Office documents embedding malicious macros. The attackers exploited social engineering technique to lure... --------------------------------------------- http://securityaffairs.co/wordpress/35197/cyber-crime/new-dridex-malware.ht… *** Adobe CVE-2011-2461 Remains Exploitable Four Years After Patch *** --------------------------------------------- A Flash vulnerability that Adobe patched four years ago actually remains exploitable according to a presentation given by a pair of researchers at the TROOPERS security conference. --------------------------------------------- http://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-years-af… *** Watch for updated router firmware!, (Mon, Mar 23rd) *** --------------------------------------------- With the OpenSSL updates this week I am sure you are all diligently testing and deploying to all your vulnerable servers. Something you may not have though of is that most SOHO routers run some kind of *nix variant and will most likely make use of OpenSSL. Be sure to watch for new firmware for those devices as well. On Friday I chatted to two of the larger manufacturers and neither had any timeline for deploying new firmware containing the OpenSSL patches and both said to watch for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19497&rss *** BIOS-Rootkit LightEater: In den dunklen Ecken abseits des Betriebssystems *** --------------------------------------------- Ein Rootkit, das unabhängig vom Betriebssystem operiert, sämtlichen Speicher auslesen kann und durch den Tausch der Festplatte im System nicht gestoppt wird - was klingt wie eine IT-Gruselgeschichte haben zwei Forscher nun öffentlich präsentiert. --------------------------------------------- http://heise.de/-2582782 *** VU#631788: Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM *** --------------------------------------------- Vulnerability Note VU#631788 Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM Original Release date: 20 Mar 2015 | Last revised: 20 Mar 2015 Overview Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. Description Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. According to Corey Kallenberg --------------------------------------------- http://www.kb.cert.org/vuls/id/631788 *** Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150320-openssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3199 xerces-c - security update *** --------------------------------------------- Anton Rager and Jonathan Brossard from the Salesforce.com ProductSecurity Team and Ben Laurie of Google discovered a denial of servicevulnerability in xerces-c, a validating XML parser library for C++. Theparser mishandles certain kinds of malformed input documents, resultingin a segmentation fault during a parse operation. An unauthenticatedattacker could use this flaw to cause an application using thexerces-c library to crash. --------------------------------------------- https://www.debian.org/security/2015/dsa-3199 *** DSA-3202 mono - security update *** --------------------------------------------- Researchers at INRIA and Xamarin discovered several vulnerabilities inmono, a platform for running and developing applications based on theECMA/ISO Standards. Monos TLS stack contained several problems thathampered its capabilities: those issues could lead to clientimpersonation (via SKIP-TLS), SSLv2 fallback, and encryption weakening(via FREAK). --------------------------------------------- https://www.debian.org/security/2015/dsa-3202 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-15:06.openssl [REVISED] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534943 *** Xen Project 4.4.2 *** --------------------------------------------- We are pleased to announce the release of Xen 4.4.2. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.4 (tag RELEASE-4.4.2) or from this download page This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-44-series/xen-442.html *** Xen Project 4.3.4 *** --------------------------------------------- We are pleased to announce the release of Xen 4.3.4. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.3 (tag RELEASE-4.3.4) or from this page. Note that this is expected to be the last release of the 4.3 stable series. The tree will be switched to security only maintenance mode after this release. This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-43-series/xen-434.html *** SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-066Project: Tracking Code (third-party module)Version: 7.xDate: 2015-March-04Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionTracking Code module allows you to create tracking code snippets and control their visibility.The module doesnt sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting --------------------------------------------- https://www.drupal.org/node/2445961 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Enterprise for UNIX (CVE-2014-3569, CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275) *** http://www.ibm.com/support/docview.wss?uid=swg21699211 *** IBM Security Bulletin: TLS padding vulnerability affects IBM API Management (CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699160 *** IBM Security Bulletin: IBM Content Collector affected by vulnerability in IBM Dojo Toolkit (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21694603 *** IBM Security Bulletin: Multiple security vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2014-3566, CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698748 *** IBM Security Bulletin: XML External Entity Processing in Castor might affect IBM Business Process Manager (CVE-2014-3004) *** http://www.ibm.com/support/docview.wss?uid=swg21690565 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center July 2014 CPU *** http://www.ibm.com/support/docview.wss?uid=swg21695005 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services (CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698702 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699032 *** IBM Security Bulletin: IBM Forms Viewer can crash based on an embedded PNG image (CVE-2014-9495, CVE-2015-0973) *** http://www.ibm.com/support/docview.wss?uid=swg21697791

1 0

Tageszusammenfassung - Freitag 20-03-2015
by Daily end-of-shift report 20 Mar '15

20 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-03-2015 18:00 − Freitag 20-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Dylib hijacking on OS X *** --------------------------------------------- Patrick Wardle shows how OS X is also vulnerable to once common Windows attacks.A few years ago, DLL hijacking on Windows was really hot, despite the fact that the concept had been discussed by none other than the NSA as far .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_19.xml?rss *** FindPOS: New POS Malware Family Discovered *** --------------------------------------------- Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37934 http://tools.cisco.com/security/center/viewAlert.x?alertId=37947 http://tools.cisco.com/security/center/viewAlert.x?alertId=37946 *** Security Update 2015-003 *** --------------------------------------------- https://support.apple.com/kb/HT204563 *** Who Develops Code for IT Support Scareware Websites? *** --------------------------------------------- When investigating a website used as part of an IT support scam, I came across a web page that attempted to fool the visitor into thinking that the persons system was infected. The goal was to persuade the potential victim to call a Microsoft Certified Live Technician at the designated phone number .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19489&rss *** CryptoWall 3.0 Ransomware Partners With FAREIT Spyware *** --------------------------------------------- Crypto-ransomware is once again upping the ante with its routines. We came across one crypto-ransomware variant that's combined with spyware - a first for crypto-ransomware. This development just comes at the heels of the discovery that .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cryptowall-3-0-r… *** Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple DLL Hijacking vulnerabilities in a software component included with Rockwell Automation's FactoryTalk View Studio product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-02 *** CVE-2015-0336 (Flash up to 16.0.0.305) and Exploit Kits *** --------------------------------------------- As reported by Malwarebytes and FireEye, Nuclear Pack is now taking advantage of a vulnerability patched with the last version of Flash Player ( 17.0.0.134 ) --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to-1600305… *** Erhebliche Sicherheitsmängel bei Geschenkkarten *** --------------------------------------------- Geschenkkarten lassen sich erschreckend einfach manipulieren, wird in der aktuellen Ausgabe des Computermagazins c’t gewarnt. Während Geldscheine mit immer mehr Sicherheitsmerkmalen gegen Fälschungen geschützt werden, sieht das bei den beliebten Geschenkkarten völlig anders aus. "Mit simplen Tricks .. --------------------------------------------- http://derstandard.at/2000013205756 *** Android Security Symposium, co-organized by SBA Research *** --------------------------------------------- https://www.sba-research.org/events/android-security-symposium-co-organized… *** Apple: Anti-Viren-Apps für iOS "irreführend" *** --------------------------------------------- Als Begründung für den plötzlichen Rauswurf von Anti-Viren-Software aus dem App Store hat Apple einem Bericht zufolge angeführt, diese Apps könnten Nutzer glauben lassen, es gäbe Viren für iOS. --------------------------------------------- http://heise.de/-2581916

1 0

Tageszusammenfassung - Donnerstag 19-03-2015
by Daily end-of-shift report 19 Mar '15

19 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-03-2015 18:00 − Donnerstag 19-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitsforscher: Unsichtbare Apps unter iOS 8 weiterhin möglich *** --------------------------------------------- Mit einer neuen Methode ist es möglich, für den Nutzer praktisch unsichtbare iOS-Software zu installieren und diese als Spyware einzusetzen, erklärt ein Sicherheitsforscher – dies funktioniere auch auf Jailbreak-freien iPhones. --------------------------------------------- http://heise.de/-2579429 *** Experten warnen vor Risiken vernetzter medizinischer Geräte *** --------------------------------------------- "Wenn vernetztes Gerät in menschlichen Körper implantiert wurde, sind Konsequenzen eines Cyberangriffs besonders bedrohlich" --------------------------------------------- http://derstandard.at/2000013144564 *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 *** --------------------------------------------- https://www.drupal.org/SA-CORE-2015-001 *** SA-CONTRIB-2015-079 - Chaos tool suite (ctools) - Multiple vulnerabilities *** --------------------------------------------- https://www.drupal.org/node/2454909 *** SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2454903 *** Introduction to GSM Security *** --------------------------------------------- Introduction The Global System for Mobile Communication or GSM is a wireless communication that uses digital technology and is widely deployed across the globe for mobile communications, such as mobile phones. This technology utilizes microwaves, and its signal transmission is divided by time, .. --------------------------------------------- http://resources.infosecinstitute.com/introduction-to-gsm-security/ *** New BIOS Implant, Vulnerability Discovery Tool to Debut at CanSecWest *** --------------------------------------------- Researchers are expected to present at CanSecWest a BIOS rootkit that automates BIOS vulnerability discovery and implants persistent malware. --------------------------------------------- http://threatpost.com/new-bios-implant-vulnerability-discovery-tool-to-debu… *** Freak-Attacke: Noch immer tausende Android- und iOS-Apps gefährdet *** --------------------------------------------- Im Vergleich zu früheren OpenSSL-Lücken wie Heartbleed sind die Auswirkungen der vor einigen Wochen aufgetauchten Freak-Attacke vergleichsweise begrenzt. Dies liegt nicht zuletzt daran, dass für einen Angriff sowohl Client als auch Server verwundbar sein müssen, und mittlerweile viele Browser-Hersteller mit Updates die entsprechende Lücke abgedichtet haben. --------------------------------------------- http://derstandard.at/2000013168279 *** Cisco will an falsche Adressen liefern, um NSA zu täuschen *** --------------------------------------------- Router und andere Hardware soll an leerstehende Wohnungen versandt werden, um Empfänger zu verschleiern --------------------------------------------- http://derstandard.at/2000013170564 *** Ransomware - should you pay? *** --------------------------------------------- The big question, usually left unanswered in technical discussions of ransomware, is, "Should you pay?" We help you make up your mind. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/19/ransomware-should-you-pay/ *** Critical Vulnerability in Microsoft Translator hub writeup *** --------------------------------------------- A month back I was hunting for Vulnerabilities in Microsoft Web services, as Microsoft has large online infrastructure, finding a vulnerability which could lead to Microsoft hall of fame for security researchers wasn't difficult. While browsing around their online services, one of their services, .. --------------------------------------------- https://haiderm.com/critical-vulnerability-in-microsoft-translator-hub-writ… *** The Impacts of a Hacked Website *** --------------------------------------------- Today, with the proliferation of open-source technologies like WordPress, Joomla! and other Content Management Systems (CMS) people around the world are able to quickly establish a virtual presence with little to no cost. In the process however, a lot is being lost in terms of what it means to own a .. --------------------------------------------- http://blog.sucuri.net/2015/03/the-impacts-of-a-hacked-website.html *** Intrusion Detection (IDS) for Analysts *** --------------------------------------------- IDS device installed? Check. IDS seeing traffic? Check. IDS generating Events? Check. Analysts investigating Events? Ummm .. Investigating IDS alerts is a process like any other; however the variable nature of Information Security often makes this process difficult to adhere to. Maintaining .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/intrusion-detection-id… *** OpenSSL Security Advisory [19 Mar 2015] *** --------------------------------------------- https://www.openssl.org/news/secadv_20150319.txt *** Google Analytics by Yoast <= 5.3.2 - Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7856 *** Erschlichenes Zertifikat: Microsoft antwortet vier Jahre nicht auf Warnung *** --------------------------------------------- Zum fälschlicherweise ausgestellten Zertifikat für die Microsoft-Domain live.fi sind weitere Details bekannt. Demnach hatte sich Microsoft Wochen Zeit gelassen, um zu reagieren. In einem ähnlichen Fall ließ Microsoft sogar vier Jahre verstreichen. --------------------------------------------- http://www.golem.de/news/gefaelschtes-zertifikat-microsoft-antwortet-vier-j… *** TLS-Zertifikate: Comodo stellt fälschlicherweise Microsoft-Zertifikat aus *** --------------------------------------------- Für die Domain live.fi, die Microsoft für die finnische Version seiner Live-Services nutzt, ist ein unberechtigtes Zertifikat von Comodo ausgestellt worden. Dabei wird eine Reihe von Schwächen des Zertifikatssystems deutlich. --------------------------------------------- http://www.golem.de/news/tls-zertifikate-comodo-stellt-gefaelschtes-microso… *** Aktiver Angriff auf Shop-System xt:Commerce *** --------------------------------------------- Angreifer nutzen die Sicherheitslücke in einem Versionszweig des Online-Shop-Systems xt:Commerce aktiv aus, um an sensible Kundendaten zu gelangen. Wer den Hotfix noch nicht eingespielt hat, sollte dies jetzt schleunigst tun. --------------------------------------------- http://heise.de/-2580640 *** Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37935 *** Linux-Entwickler erschweren Rowhammer-Angriffe *** --------------------------------------------- Momentan kann ein Programm mit einfachen Nutzerrechten beim Kernel erfragen, wo im Speicher die Daten eines Prozesses liegen. Das vereinfacht den Rowhammer-Angriff. Ab Linux .. --------------------------------------------- http://heise.de/-2580654

1 0

Tageszusammenfassung - Mittwoch 18-03-2015
by Daily end-of-shift report 18 Mar '15

18 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-03-2015 18:00 − Mittwoch 18-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Malware Hunting with the Sysinternals Tools *** --------------------------------------------- This session provides an overview of several Sysinternals tools, including Process Monitor, Process Explorer, and Autoruns, focusing on the features useful for malware analysis and removal. These utilities enable deep inspection and control of processes, file system and registry activity, and autostart execution points. Mark Russinovich demonstrates their malware-hunting capabilities by presenting several real-world cases that used the tools to identify and clean malware, and concludes by... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/17/malware-hunting-with… *** Pass the hash!, (Wed, Mar 18th) *** --------------------------------------------- No, this isnt about sharing a hallucinogen-laced bong for a smoke. The hash were referring to here is the one that Wikipedia aptly but unhelpfully defines as a derivation of data, notably used in cryptographic hash functions. Passing the hash is a form of login credential theft that is quite prevalent. In it, an attacker captures the encoded session password (the hash) from one computer, and then re-uses it to illicitly access another computer. On (most configurations of) the Microsoft Windows... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19479&rss *** SSL Labs unveils free open source tool, new APIs *** --------------------------------------------- Qualys SSL Labs now includes free assessment APIs, accompanied by a free open source tool that can be used for bulk and automated testing of websites. These new enhancements provide the same results a... --------------------------------------------- http://www.net-security.org/secworld.php?id=18096 *** Apple-Browser: Update für drei Safari-Versionen behebt Sicherheitslücken *** --------------------------------------------- Apple hat in der Nacht zum Mittwoch Aktualisierungen für Safari unter OS X Mountain Lion, OS X Mavericks und OS X Yosemite veröffentlicht. Damit werden teils schwerwiegende Fehler ausgebügelt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Apple-Browser-Update-fuer-drei-Safar… *** Fatally flawed RC4 should just die, shout angry securobods *** --------------------------------------------- Its the Swiss Cheese of infosec and were all gazing through its holes Security researchers have banged another nail into the coffin of the ageing RC4 encryption algorithm. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/18/kill_rc4_sa… *** Mobile Android, iOS Apps Still Vulnerable to FREAK Attacks *** --------------------------------------------- FireEye scanned iOS and Android apps downloaded billions of times in aggregate and determined that, despite the availability of patches, because the apps still connect to vulnerable HTTPS servers, they're subject to FREAK attacks. --------------------------------------------- http://threatpost.com/mobile-android-ios-apps-still-vulnerable-to-freak-att… *** Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37889 *** VU#868948: HP ArcSight contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#868948 HP ArcSight contains multiple vulnerabilities Original Release date: 17 Mar 2015 | Last revised: 17 Mar 2015 Overview HP ArcSight contains multiple vulnerabilities. Description CWE-434: Unrestricted Upload of File with Dangerous Type - CVE PendingHP ArcSight Logger 5.3.1.6838.0 configuration import file upload capability does not sanitize file names, which allows a remote, authenticated attacker to put arbitrary files into the document root. This vulnerability... --------------------------------------------- http://www.kb.cert.org/vuls/id/868948 *** Security Advisory - Resource Management Vulnerability in the AR1220 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Directory File Deletion Vulnerability in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Multiple Injection Vulnerabilities in UDS *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [DSA 3195-1] php5 security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-2305 - Guido Vranken discovered a heap overflow in the ereg extension (only applicable to 32 bit systems). ... CVE-2015-0231 - Stefan Esser discovered a use-after-free in the unserialisation of objects. CVE-2015-0232 - Alex Eubanks discovered incorrect memory management in the exif extension. CVE-2015-0273 - Use-after-free in the unserialisation of DateTimeZone. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00080.html *** XZERES 442SR Wind Turbine Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01 *** Honeywell XL Web Controller Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in Honeywell's XL Web Controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02

1 0

Tageszusammenfassung - Dienstag 17-03-2015
by Daily end-of-shift report 17 Mar '15

17 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-03-2015 18:00 − Dienstag 17-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** 3046310 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 1.0 *** --------------------------------------------- Microsoft is aware of an improperly issued SSL certificate for the domain “live.fi” that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. It cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3046310 *** Man who obtained Windows Live cert said his warnings went unanswered *** --------------------------------------------- "I tried, just for fun," said man who reported hole to Microsoft and authorities. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/GS2QPGGMdJ0/ *** Forthcoming OpenSSL releases *** --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf. These releases will be made available on 19th March. They will fix a number of security defects. The highest severity defect fixed by these releases is classified as "high" severity. --------------------------------------------- https://mta.openssl.org/pipermail/openssl-users/2015-March/000778.html *** From PEiD To YARA, (Tue, Mar 17th) *** --------------------------------------------- Some time ago, Jim Clausing had a diary entry about PeID (a packer identifier) and since then he has a PEiD signature database on his handler page. Now, wouldnt it be great if we could reuse these signatures? For example as YARA rules? Thats why I wrote a Python program that converts PEiD signatures to YARA rules: peid-userdb-to-yara-rules.py Here is an example: PEiD signature: [!EP (ExE Pack) V1.0 - Elite Coding Group] signature = 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 ep_only = true Generated... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19473&rss *** Zweifaktor-Dienst Authy ließ jeden rein *** --------------------------------------------- Zwei-Faktor-Authentifizierung ist eine sichere Sache - wenn sie denn funktioniert. Authy, das von vielen prominenten Sites eingesetzt wird, ließ sich bis vor kurzem mit dem Generalschlüssel "../sms" umgehen. --------------------------------------------- http://heise.de/-2576764 *** D-Link patches critical flaws in wireless range extender, Wi-Fi cameras firmware *** --------------------------------------------- D-Link has released new firmware for its DAP-1320 wireless range extender and the DCS-93xL family of Wi-Fi cameras in order to patch two critical vulnerabilities that can lead to device hijacking. ... --------------------------------------------- www.net-security.org/secworld.php?id=18093 *** Search for vulnerable servers unearths weak, thousands-times repeated RSA keys *** --------------------------------------------- A group of researchers from the Information Security Group from Royal Holloway, University of London, wanted to see how many TLS servers still supported the weak, export-grade (512-bit) RSA public key... --------------------------------------------- http://www.net-security.org/secworld.php?id=18094 *** Cisco Virtual TelePresence Server Serial Console Privileged Access Vulnerability *** --------------------------------------------- Cisco Virtual TelePresence Server Software contains a vulnerability that could allow an authenticated, local attacker to gain unauthorized access with elevated privileges. Updates are available. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37869 *** DSA-3192 checkpw - security update *** --------------------------------------------- Hiroya Ito of GMO Pepabo, Inc. reported that checkpw, a passwordauthentication program, has a flaw in processing account names whichcontain double dashes. A remote attacker can use this flaw to cause adenial of service (infinite loop). --------------------------------------------- https://www.debian.org/security/2015/dsa-3192 *** Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability *** --------------------------------------------- Topic: Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Risk: High Text:/* Intel Network Adapter Diagnostic Driver IOCTL Handling Vulnerability Vendor: Intel Product webpage: http://www.intel.co... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030110 *** TYPO3 CMS 6.2.11 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.11 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6211-released/ *** HPSBHF03293 rev.1 - HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash, Remote Denial of Service (DoS), Code Execution, Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Virtual Connect 8Gb 24-Port FC Module running OpenSSL and Bash including: The OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. The SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 16-03-2015
by Daily end-of-shift report 16 Mar '15

16 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-03-2015 18:00 − Montag 16-03-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** ICS-CERT Monitor Quarterly Report - Phishing Reigns Supreme (March 12, 2015) *** --------------------------------------------- According to a quarterly report from the US Industrial Control System Computer Emergency Response Team (ICS-CERT), industrial control systems were targets of cyber attacks at least 245 times in the 12-month period between October 1, 2013 and September 30, 2014....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/20/200 *** Security Advisory - NTPd Security Vulnerability in Multiple Huawei Products *** --------------------------------------------- Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet. Multiple Huawei products have this vulnerability. ( Vulnerability ID: HWPSIRT-2014-1276) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TeslaCrypt ransomware attacks gamers - "all your files are belong to us!" *** --------------------------------------------- TeslaCrypt is a new ransomware that goes above and beyond CryptoLocker in the types of files it seeks out to hold for ransom, including those related to video games. SophosLabs dug in to find out what TeslaCrypt has in store for gamers, and everyone else. --------------------------------------------- https://nakedsecurity.sophos.com/2015/03/16/teslacrypt-ransomware-attacks-g… *** Safari: Alte Sicherheitslücke speichert URLs auch im Private-Browsing-Modus *** --------------------------------------------- Normalerweise sollte ein Browser alle angesurften Adressen vergessen, wenn er im 'Privatmodus' genutzt wird. Apples Safari tut das allerdings nicht - die besuchten Adressen landen in einer ungeschützten Datenbank. --------------------------------------------- http://heise.de/-2575426 *** Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS *** --------------------------------------------- We provide new attacks against RC4 in TLS that are focussed on recovering user passwords, still the pre-eminent means of user authentication on the Web today. Our attacks enhance the statistical techniques used in the previous attacks and exploit specific features of the password setting to produce attacks that are much closer to being practical. We report on extensive simulations that illustrate this. --------------------------------------------- http://www.isg.rhul.ac.uk/tls/RC4mustdie.html *** Talk at Troopers15 *** --------------------------------------------- Peter Kieseberg and Sebastian Schrittwieser give a talk about 'iAnalyze - Automated security analysis of iOS apps' at the 'Hacking Mobiles Vol. 2.1 - MMA: Mobile Malicious Apps' workshop, which is held at Troopers15 conference in Heidelberg, Germany. --------------------------------------------- https://www.sba-research.org/2015/03/16/talk-at-troopers15/ *** Cisco Security Advisories *** * Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37863 * Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37862 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37861 * Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37860

1 0

Tageszusammenfassung - Freitag 13-03-2015
by Daily end-of-shift report 13 Mar '15

13 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-03-2015 18:00 − Freitag 13-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-05) *** --------------------------------------------- A Security Bulletin (APSB15-05) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. This... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1185 *** After Delays, Samsung Patches Social Media Vulnerability in Millions of Devices *** --------------------------------------------- Samsung patched a vulnerability last month in SNS Provider that if exploited could have given attackers the ability to access to any personal information users stored on Facebook, LinkedIn and Twitter. --------------------------------------------- http://threatpost.com/after-delays-samsung-patches-social-media-vulnerabili… *** Blind SQL Injection against WordPress SEO by Yoast, (Fri, Mar 13th) *** --------------------------------------------- WordPress has released an advisory for the WordPress plugin SEO by Yoast. Version up to and including 1.7.3.3 can be exploited with a blind SQL injection. According to WordPress, this plugin has more than one million downloads. A description of the SQL injection with proof of concept is described here and the latest update is available here. [1] https://wordpress.org/plugins/wordpress-seo/ [2] https://downloads.wordpress.org/plugin/wordpress-seo.1.7.4.zip [3] --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19457&rss *** Achievement Locked: New Crypto-Ransomware Pwns Video Gamers *** --------------------------------------------- Gamers may be used to paying to unlock downloadable content in their favorite games, but a new crypto-ransomware variant aims to make gamers pay to unlock what they already own. Data files for more than 20 games can be affected by the threat, increasing what is already a large target for cybercriminals. Another file type... --------------------------------------------- http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware… *** VIRLOCK Combines File Infection and Ransomware *** --------------------------------------------- Analysis by Jaaziel Carlos, Jonh Chua, and Rodwin Fuentes Ransomware has become one of the biggest problems for end users are as of late. In the past months alone, we have reported on several variants of both ransomware and crypto-ransomware, each with their own "unique" routines. We recently came across one malware family, detected as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/eJWas-XoY6I/ *** Microsoft EMET 5.2 is available, (Fri, Mar 13th) *** --------------------------------------------- Microsoft has announced a new release of the Enhanced Mitigation Experience Toolkit (EMET) 5.2. The main the main changes and improvements as the following: Control Flow Guard:EMETs native DLLs have been compiled with Control Flow Guard(CFG). CFG is a new feature introduced in Visual Studio 2015 (and supported by Windows 8.1 and Windows 10) that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects. Since we --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19461&rss *** Adobe schließt kritische Lücken in Flash *** --------------------------------------------- Ein neues Update für den Flash-Player schließt elf Sicherheitslücken und ist für alle Plattformen verfügbar. Eine zügige Installation ist ratsam, da Angreifer im schlimmsten Fall das System übernehmen könnten. --------------------------------------------- http://heise.de/-2574278 *** Bootschleife nach SHA-2-Update für Windows 7 *** --------------------------------------------- Böse Überraschung für einige Nutzer mit Linux-Dual-Boot: Ein Windows-7-Update vom letzten Patchday stürzt den Rechner in eine Bootschleife. Das scheint allerdings nur beim Booten über das klassische BIOS aufzutreten, UEFI-Nutzer haben Glück. --------------------------------------------- http://heise.de/-2574289 *** BlackBerry has no fix for devices vulnerable to FREAK security flaw *** --------------------------------------------- Summary:The company, lauded for having the worlds most protected devices for encrypted messaging, warns that devices will be vulnerable to a serious security flaw until a patch is released. --------------------------------------------- http://www.zdnet.com/article/blackberry-slow-to-respond-to-freak-flaw-says-… *** Mozilla Releases Open Source Masche Forensics Tool *** --------------------------------------------- Mozilla has released an open source memory forensics tool that some college students designed and built during the company's recent Winter of Security event. The new tool, known as Masche, is designed specifically for investigating server memory and has the advantage of being able to scan running processes without causing any problems with the machine. --------------------------------------------- http://threatpost.com/mozilla-releases-open-source-masche-forensics-tool/11… *** Google-Panne: Inhaberdaten von 300.000 geschützten Domains einsehbar *** --------------------------------------------- Google bietet seinen Kunden die Möglichkeit, Domains zu registrieren, ohne dass dabei persönliche Daten in den Whois-Einträgen auftauchen. Durch einen Bug waren die Informationen trotzdem abrufbar. --------------------------------------------- http://heise.de/-2574423 *** Bypassing ASLR with CVE-2015-0071: An Out-of-Bounds Read Vulnerability *** --------------------------------------------- Almost every Patch Tuesday cycle contains one bulletin that (for convenience) rolls up multiple Internet Explorer vulnerabilities into a single bulletin. February's Patch Tuesday cumulative IE bulletin (MS15-009) included a fix for a particularly interesting vulnerability that could be used to bypass one of the key anti-exploit technologies in use today, address space layout randomization... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/35xufNRKED8/ *** Security Afterworks: Cybercrime - Lessons From the Field & Best Of Troopers15 *** --------------------------------------------- Cybercrime – wie reagieren nach einem Vorfall? Die Frage ist schon längst nicht mehr ob, sondern wann Sie zum Ziel werden. Andreas Tomek informiert beim Security Afterworks im April über Lessons from the field – Incident Response & Cybercrime in Österreich. Danach geht es mit den Hot Topics der Troopers15 weiter. Lassen Sie sich von uns auf den neuesten Stand bringen! Dienstag, 14. April 2015 16.30 Uhr ab 17.30 Uhr gemütlicher Ausklang SBA Research --------------------------------------------- https://www.sba-research.org/events/security-afterworks-cybercrime-lessons-… https://www.sba-research.org/wp-content/uploads/2015/03/Security-Afterworks… *** Cisco FREAKs out, starts epic OpenSSL bug-splat *** --------------------------------------------- Happy weekend, network admins Cisco admins will be watching and waiting for fixes, with the company announcing that many of its OpenSSL implementations are carrying a bunch of post-POODLE fleas. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/13/cisco_freak… *** Samsung SNS Provider Application For Android Access Theft *** --------------------------------------------- Topic: Samsung SNS Provider Application For Android Access Theft Risk: Low Text: Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar *Vulnerabilities in the Samsung SNS ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030093 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DSA-3186 nss - security update *** --------------------------------------------- It was discovered that the Mozilla Network Security Service library(nss) incorrectly handled certain ASN.1 lengths. A remote attacker couldpossibly use this issue to perform a data-smuggling attack. --------------------------------------------- https://www.debian.org/security/2015/dsa-3186 *** DSA-3185 libgcrypt11 - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libgcrypt: --------------------------------------------- https://www.debian.org/security/2015/dsa-3185 *** DSA-3184 gnupg - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in GnuPG, the GNU Privacy Guard: --------------------------------------------- https://www.debian.org/security/2015/dsa-3184 *** WPML Multiple Vulnerabilities (Including SQLi) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7843 *** Schneider Electric Pelco DS-NVs Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Schneider Electric Pelco DS-NVs software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01 *** Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems *** --------------------------------------------- http://www.securitytracker.com/id/1031806

1 0

Tageszusammenfassung - Donnerstag 12-03-2015
by Daily end-of-shift report 12 Mar '15

12 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-03-2015 18:00 − Donnerstag 12-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyber Security in Supply Chain Management: Part 1 *** --------------------------------------------- Introduction Cyber security is generally thought of as various types of security devices like firewalls, Web Application Firewall (WAF), IDS/IPS, SIEM, DLP etc. to safeguard network, applications and data. But what if, for example, the deployed security solutions have a bug inside? The latest example of this is exposing of a vulnerability in Lenovo notebooks. --------------------------------------------- http://resources.infosecinstitute.com/cyber-security-in-supply-chain-manage… *** Paper: Windows 10 patching process may leave enterprises vulnerable to zero-day attacks *** --------------------------------------------- Aryeh Goretsky gives advice on how to adapt to Windows 10s patching strategy.Patching is hard, especially when the code base is old and the bugs are buried deeply. This was highlighted once again this week when Microsoft released a patch for a vulnerability that was thought to have been patched almost five years ago, but which could still be exploited.In fact, six out of the last eight Patch Tuesdays have included patches that have caused problems for some Windows users.Probably in response to... --------------------------------------------- http://www.virusbtn.com/blog/2015/03_12.xml?rss *** Microsoft SHA-2 Advisory Causing "Infinite Loop" Issues *** --------------------------------------------- Windows users are having issues with a security update issued this week meant to add SHA-2 code-signing and verification support to Windows 7 and Windows Server 2008 R2 machines. --------------------------------------------- http://threatpost.com/microsoft-sha-2-advisory-causing-infinite-loop-issues… *** Schwerwiegende Sicherheitslücke im Shop-System xt:Commerce *** --------------------------------------------- Derzeit klafft eine Sicherheitslücke im aktuellen Versionszweig des verbreiteten Online-Shop-Systems xt:Commerce. Ein Patch ist bereits verfügbar. --------------------------------------------- http://heise.de/-2573755 *** Who got the bad SSL Certificate? Using tshark to analyze the SSL handshake., (Thu, Mar 12th) *** --------------------------------------------- Ever wonder if any of your users connect to sites with bad SSL certificates? I ran into this issue recently when debugging some SSL issues, and ended up with thisquick tshark and shell script trickto extract the necessary information from a packet capture. First, you may want to compare the host name your clients connect to, to the host name returned as part of the certificate. While the Host header is encrypted and not accessible, modern SSL libraries use Server Name Indication (SNI) as part... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19455&rss *** Defending Against PoS RAM Scrapers *** --------------------------------------------- Stealing payment card data has become an everyday crime that yields quick monetary gains. Attackers aim to steal the data stored in the magnetic stripe of payment cards, optionally clone the cards, and run charges on the accounts associated with them. The topic of PoS RAM scraper malware always prompts businesses and retailers to ask... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CYPwDbRGFfc/ *** Dropbox Patches Remotely Exploitable Vulnerability in SDK *** --------------------------------------------- Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the app that enabled attackers to connect applications on some devices to a Dropbox account without the users consent. --------------------------------------------- http://threatpost.com/dropbox-patches-remotely-exploitable-vulnerability-in… *** Inverted WordPress Trojan *** --------------------------------------------- Trojan (or trojan horse) is software that does (or pretends to be doing) something useful but also contains a secret malicious payload that inconspicuously does something bad. In WordPress, typical trojans are plugins and themes (usually pirated) which may have backdoors, or send out spam, create doorways, inject hidden links or malware. The trojan modelRead More --------------------------------------------- http://blog.sucuri.net/2015/03/inverted-wordpress-trojan.html *** RSA Digital Certificate Manager Input Validation Flaws Permit Cross-Site Scripting and Denial of Service Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031912 *** EMC Secure Remote Services GHOST / SQL Injection / Command Injection *** --------------------------------------------- Topic: EMC Secure Remote Services GHOST / SQL Injection / Command Injection Risk: High Text:ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities CVE Identifier: CVE-2... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030076 *** Google Android Integer Oveflow / Heap Corruption *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030079 *** phpMyAdmin Bug May Disclose CSRF Token to Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1031871 *** Elipse E3 Process Control Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A *** IBM Security Bulletin: Apache Tomcat request smuggling affects Algo Audit and Compliance (CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698437 *** IBM Security Bulletin: IBM PowerVC - Ceilometer DB2/MongoDB Backend Password Leak (CVE-2013-6384) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020585 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM/Cisco Switches and Directors (CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1005122 *** IBM Security Bulletin: Multiple IBM InfoSphere Information Server components are affected by a vulnerability in the XML4C parser (CVE-2014-8901) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696312 *** SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450427 *** SA-CONTRIB-2015-076 - Image Title - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450393 *** SA-CONTRIB-2015-075 - Perfecto - Open Redirect *** --------------------------------------------- https://www.drupal.org/node/2450391 *** SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS) *** --------------------------------------------- https://www.drupal.org/node/2450387 *** Pie Register 2.0.14 - Cross Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7842

1 0

Tageszusammenfassung - Mittwoch 11-03-2015
by Daily end-of-shift report 11 Mar '15

11 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-03-2015 18:00 − Mittwoch 11-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the EquationDrug Espionage Platform *** --------------------------------------------- EquationDrug represents the main espionage platform from the Equation Group. It's been in use for over 10 years, replacing EquationLaser until it was itself replaced itself by the even more sophisticated GrayFish platform. --------------------------------------------- http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage… *** DroppedIn: Remotely Exploitable Vulnerability in the Dropbox SDK for Android *** --------------------------------------------- The IBM X-Force Application Security Research Team has discovered a vulnerability in the Dropbox SDK for Android (CVE-2014-8889) which allows attackers to connect applications on mobile devices to a Dropbox account controlled by the attacker without the victim's knowledge or authorization. This is a serious flaw in the authentication mechanism within any Android app using a Dropbox SDK Version 1.5.4 through 1.6.1 (note: this vulnerability was resolved in Dropbox SDK for Android v1.6.2). --------------------------------------------- http://securityintelligence.com/droppedin-remotely-exploitable-vulnerabilit… *** Unpatched security vulnerabilities affecting Facebook *** --------------------------------------------- A web security researcher from Portugal has discovered several vulnerabilities affecting Facebook that he considers to be serious, but hasnt had much success convincing the company of that, so he sha... --------------------------------------------- http://www.net-security.org/secworld.php?id=18069 *** Reconnect tool for hacking Facebook is publicly available *** --------------------------------------------- The security expert Egor Homakov from Sakurity firm has released the Reconnect tool that allows hackers to hijack accounts on sites that use Facebook logins. The security expert Security Egor Homakov has developed a hacking tool dubbed Reconnect that exploit a flaw in Facebook to hijack accounts on sites that use Facebook logins. Homakov, with works for... --------------------------------------------- http://securityaffairs.co/wordpress/34705/hacking/reconnect-hacking-faceboo… *** DDoS on UPNP Devices *** --------------------------------------------- Denial of service (DOS) attack is an attempt to make a machine or a network resource unavailable to its users. It basically consists of methods to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet, and these attacks are sent by one person or a system. One common method of... --------------------------------------------- http://resources.infosecinstitute.com/ddos-upnp-devices/ *** Full details on CVE-2015-0096 and the failed MS10-046 Stuxnet fix *** --------------------------------------------- In early January 2015, researcher Michael Heerklotz approached the Zero Day Initiative with details of a vulnerability in the Microsoft Windows operating system. We track this issue as ZDI-15-086. Unless otherwise noted, the technical details in this blog post are based on his detailed research. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-… *** Threatglass has pcap files with exploit kit activity, (Tue, Mar 10th) *** --------------------------------------------- Threatglassis a one way to find up-to-date examples of exploit kit traffic. Not all of it is exploit kit traffic, but all of it represents some sort of malicious activity. Threatglassdoesnt explain what type of traffic youre looking at from the pcaps the site provides. Letslook at a page from last week on Thursday, March 5th 2015 [1]. This one isexploit kit activity. In the image below, youll find a link to the packet capture in the lower right-hand corner" /> Download the pcap and open... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19433&rss *** n00bs CTF Labs by Infosec Institute *** --------------------------------------------- n00bs CTF (Capture the Flag) Labs is a web application presented by Infosec Institute. It has 15 mini Capture the Flag challenges intended for beginners and newbies in the information security field or for any average infosec enthusiasts who haven't attended hacker conventions yet. So what is a CTF? In hacker conventions, CTF or Capture... --------------------------------------------- http://resources.infosecinstitute.com/n00bs-ctf-labs-infosec-institute/ *** Achtung: Panda-Virenscanner zerschießt Windows, nicht Neustarten! *** --------------------------------------------- Die Antivirenschutz-Produkte von Panda Security haben wegen fehlerhaften Signaturen etliche Windows-Rechner lahm gelegt. Wer betroffen ist, soll die Füße still halten und das System nicht neu starten - da es unter Umständen nicht mehr hochfährt. --------------------------------------------- http://heise.de/-2573233 *** Panda Antivirus: Gravierender Fehler im Virenscanner löscht Systemdateien *** --------------------------------------------- Ein gravierender Fehler in Pandas Antivirensoftware kann unter Umständen zu einem vollkommen unbrauchbaren System führen. Panda bestätigt das Problem. Golem.de hat erste Hinweise erhalten, wie der Fehler zu stoppen ist. (Virenscanner, Applikationen) --------------------------------------------- http://www.golem.de/news/panda-antivirus-gravierender-fehler-im-virenscanne… *** Doctor Web: February 2015 virus activity review *** --------------------------------------------- March 4, 2015 The shortest month of the year had its share of new malware. In early February, Doctor Web security researchers finished examining a complex multi-purpose malicious program for Linux, while at month's end, they published the results of their analysis of a new version of a backdoor for Mac OS X. As before, malicious programs for Android remained active throughout the month. PRINCIPAL TRENDS IN JANUARY New Linux Trojans Virus makers are still showing an interest in Mac OS X. --------------------------------------------- http://news.drweb.com/show/?i=9316&lng=en&c=9 *** Ein Blick in die Zukunft der Handy-Malware *** --------------------------------------------- Kaspersky hat eine Analyse zu einer Android-Malware veröffentlicht, die zwar aktuell nur in Russland aktiv ist, aber einen Vorgeschmack gibt, was demnächst auch bei uns passieren könnte: Wichtige Punkte daraus: Das Teil ist inzwischen so modular und gut geschützt, wie typische Windows Malware Frameworks Es enthält Code zum Anmelden des Opfers bei diversen Premium-Services Dabei kann es automatisch... --------------------------------------------- http://www.cert.at/services/blog/20150311102554-1454.html *** DSA-3177 mod-gnutls - security update *** --------------------------------------------- Thomas Klute discovered that in mod-gnutls, an Apache module providingSSL and TLS encryption with GnuTLS, a bug caused the servers clientverify mode not to be considered at all, in case the directorysconfiguration was unset. Clients with invalid certificates were thenable to leverage this flaw in order to get access to that directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3177 *** DSA-3182 libssh2 - security update *** --------------------------------------------- Mariusz Ziulek reported that libssh2, a SSH2 client-side library, wasreading and using the SSH_MSG_KEXINIT packet without doing sufficientrange checks when negotiating a new SSH session with a remote server. Amalicious attacker could man in the middle a real server and cause aclient using the libssh2 library to crash (denial of service) orotherwise read and use unintended memory areas in this process. --------------------------------------------- https://www.debian.org/security/2015/dsa-3182 *** Manage Engine AD Audit Manager Plus Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine AD Audit Manager Plus Cross Site Scripting Risk: Low Text: # Title:- Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Bui... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030060 *** tcpdump Denial Of Service / Code Execution *** --------------------------------------------- Topic: tcpdump Denial Of Service / Code Execution Risk: High Text:Hi, please find tcpdump 4.7.2 source code at: http://www.ca.tcpdump.org/beta/tcpdump-4.7.2.tar.gz http://www.ca.tcpdu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030064 *** Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150311-ips --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor *** --------------------------------------------- cisco-sa-20150311-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Multiple vulnerabilities fixed in Current Release of Liberty for Java for IBM Bluemix (CVE-2012-6153, CVE-2014-3577, CVE-2015-0178) *** --------------------------------------------- 2015-03-11T10:06:12-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696864 *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities could, if exploited, allow ... --------------------------------------------- http://support.citrix.com/article/CTX200484 *** HPSBNS03280 rev.1 - HP NonStop Servers running SAMBA, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running SAMBA. The vulnerability could be exploited remotely resulting in execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03281 SSRT101968 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** USN-2524-1: eCryptfs vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2524-110th March, 2015ecryptfs-utils vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummarySensitive information in encrypted home and Private directories could beexposed if an attacker gained access to your files.Software description ecryptfs-utils - eCryptfs cryptographic filesystem utilities DetailsSylvain Pelissier discovered that eCryptfs did not generate a random --------------------------------------------- http://www.ubuntu.com/usn/usn-2524-1/ *** USN-2522-3: ICU vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2522-310th March, 2015icu vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummaryICU could be made to crash or run programs as your login if it processedspecially crafted data. Software description icu - International Components for Unicode library DetailsUSN-2522-1 fixed vulnerabilities in ICU. On Ubuntu 12.04 LTS, the fontpatches caused a regression when using LibreOffice Calc. The patches havenow been updated --------------------------------------------- http://www.ubuntu.com/usn/usn-2522-3/ *** VU#794095: Telerik Analytics Monitor Library allows DLL hijacking *** --------------------------------------------- Vulnerability Note VU#794095 Telerik Analytics Monitor Library allows DLL hijacking Original Release date: 10 Mar 2015 | Last revised: 10 Mar 2015 Overview Telerik Analytics Monitor Library is a third-party application analytics service that collects detailed application metrics for vendors. Some versions of the Telerik library allow DLL hijacking, allowing an attacker to load malicious code in the context of the Telerik-based application. Description CWE-114: Process ControlTelerik --------------------------------------------- http://www.kb.cert.org/vuls/id/794095 *** WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7841

1 0

Tageszusammenfassung - Dienstag 10-03-2015
by Daily end-of-shift report 10 Mar '15

10 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-03-2015 18:00 − Dienstag 10-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS15-MAR - Microsoft Security Bulletin Summary for March 2015 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for March 2015. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-MAR *** Apple Patches for iOS, OS X and Apple TV, (Tue, Mar 10th) *** --------------------------------------------- With yesterdays updates for iOS, OS X and Apple TV, Apple also addressed a number of security vulnerabilities, most notably the Freak vulnerability. After updating, the affected operating systems no longer support export quality ciphers. However, Apple browsers continue to support SSLv3 and as a result, continue to be vulnerable to POODLE. Quick Summary of the security content of Apples updates: XCode 6.2: This update addresses 4 vulnerabilities in subversion and 1 in git. OS X: 5... --------------------------------------------- https://isc.sans.edu/diary/Apple+Patches+for+iOS%2C+OS+X+and+Apple+TV/19443 *** Exploiting the DRAM rowhammer bug to gain kernel privileges *** --------------------------------------------- "Rowhammer" is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. We tested a selection of laptops and found that a subset of them exhibited the problem. We built two working privilege escalation exploits that use this effect. One exploit uses rowhammer-induced bit flips to gain kernel privileges on x86-64 Linux when run as an unprivileged userland process. When run on a machine vulnerable to the rowhammer... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/03/exploiting-dram-rowhammer-b… *** Network Forensics What Are Your Investigations Missing - SANS DFIR WEBCAST *** --------------------------------------------- Traditionally, computer forensic investigations focused exclusively on data from the seized media associated with a system of interest.Recently, memory analysis has become an integral part of forensic analysis, resulting in a new and significantly different way for digital examiners and investigators to perform their craft.Now another evolution in computer forensics is at hand - one that includes data collected from network devices as well as the from wires themselves. Every day, more and more... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/09/network-forensics-wh… *** Yahoo Patches Critical eCommerce, Small Business Vulnerabilities *** --------------------------------------------- Yahoo has fixed a handful of vulnerabilities that could have given an attacker free reign over all of its user-run eCommerce websites and caused multiple headaches for small business owners. --------------------------------------------- http://threatpost.com/yahoo-patches-critical-ecommerce-small-business-vulne… *** Attackers targeting Elasticsearch remote code execution hole *** --------------------------------------------- Devs ring patch alarm bells, drop shell code Attackers are targeting a patched remote code execution vulnerability in Elasticsearch that grants unauthenticated bad guys access through a buggy API. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/10/elastic_sea… *** SMS Trojan bypasses CAPTCHA *** --------------------------------------------- Trojan-SMS.AndroidOS.Podec proved to be remarkable: it can send messages to premium-rate numbers employing tools that bypass the Advice of Charge system. It can also subscribe users to premium-rate services while bypassing CAPTCHA. --------------------------------------------- http://securelist.com/analysis/publications/69169/sms-trojan-bypasses-captc… *** Xen Security Advisory CVE-2015-2150 / XSA-120 *** --------------------------------------------- Non-maskable interrupts triggerable by guests --------------------------------------------- http://xenbits.xen.org/xsa/advisory-120.html *** Xen Security Advisory CVE-2015-2151 / XSA-123 *** --------------------------------------------- Hypervisor memory corruption due to x86 emulator flaw --------------------------------------------- http://xenbits.xen.org/xsa/advisory-123.html *** Xen Security Advisory XSA-124 *** --------------------------------------------- Non-standard PCI device functionality may render pass-through insecure --------------------------------------------- http://xenbits.xen.org/xsa/advisory-124.html *** Exploiting the DRAM "Row Hammer" Bug *** --------------------------------------------- IBM has determined that all IBM System z, System p, and System x products are not vulnerable to this attack. IBM is analyzing other IBM products to determine if they are potentially impacted by this issue. Please actively monitor both your IBM Support Portal for available fixes and/or remediation steps and this blog for additional information. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/exploiting_the_dram_r… *** Row Hammer Privilege Escalation Vulnerability *** --------------------------------------------- cisco-sa-20150309-rowhammer --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150310-ssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response *** --------------------------------------------- Topic: Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response Risk: High Text:Hi there, Latest varnish-cache 4.0.3 (https://www.varnish-cache.org/) seem to have a problem with parsing HTTP responses fro... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030056 *** Foxit Reader Update Service Unsafe Service Path Lets Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031879 *** Foxit Reader GIF File LZWMinimumCodeSize Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031878 *** Foxit Reader GIF File Ubyte Size Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031877 *** Red Hat Enterprise MRG Messaging Qpid Daemon Bugs Let Remote Users Deny Service and Access the System *** --------------------------------------------- http://www.securitytracker.com/id/1031872 *** Rails ActiveModel::Name Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031873 *** Security Advisory: MainWP-Child WordPress Plugin *** --------------------------------------------- Security Risk: Critical Exploitation level: Very Easy/Remote DREAD Score: 9/10 Vulnerability: Password bypass / Privilege Escalation Patched Version: 2.0.9.2 During a routine audit of our Website Firewall (WAF), we found a critical vulnerability affecting the popular MainWP Child WordPress plugin. According to worpdress.org, it is installed on more than 90,000 WordPress sites as as remote administration... --------------------------------------------- http://blog.sucuri.net/2015/03/security-advisory-mainwp-child-wordpress-plu… *** Google Analytics by Yoast 5.3.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7838 *** Fraction Theme <= 1.1.1 - Privilege Escalation via CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7840

1 0

Tageszusammenfassung - Montag 9-03-2015
by Daily end-of-shift report 09 Mar '15

09 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-03-2015 18:00 − Montag 09-03-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Attackers concealing malicious macros in XML files *** --------------------------------------------- XML files are harmless text files right? Wrong! The group behind the malicious Microsoft Office document campaigns have started to utilize Microsoft Office XML formats to hide malicious macros. This week, our spam traps were flooded with spam with XML... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attackers-concealing-ma… *** Samba Remote Code Execution Vulnerability - CVE-2015-0240 *** --------------------------------------------- The Samba team reported CVE-2015-0240 last February 23, 2015. This vulnerability is very difficult to exploit and we are not aware of successful exploitation. However, it is quite interesting from the point for view of detection. There are two important facts: The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/samba-remote-cod… *** How Malware Generates Mutex Names to Evade Detection, (Mon, Mar 9th) *** --------------------------------------------- Malicious software sometimes uses mutex objects to avoid infecting the system more than once, as well as to coordinate communications among its multiple components on the host. Incident responders can look for known mutex names to spot the presence of malware on the system. To evade detection, some malware avoids using a hardcoded name for its mutex, as is the case with the specimen discussed in this note. Static Mutex Names as Indicators of Compromise For background details about mutex... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19429&rss *** New crypto ransomware in town : CryptoFortress *** --------------------------------------------- This post has been heavily edited to fix my mistake. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** Seagate Confirms NAS Zero Day, Won't Patch Until May *** --------------------------------------------- Seagate confirmed a publicly disclosed vulnerability in one of its network attached storage products, but said it wont have a patch available until May. --------------------------------------------- http://threatpost.com/seagate-confirms-nas-zero-day-wont-patch-until-may/11… *** OpenSSL Audit *** --------------------------------------------- IntroductionThe reputation built by NCC Group, including iSEC Partners, Matasano Security, Intrepidus Group and NGS Secure, has led compani ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/03/openssl-audit/ *** l+f: Vernetzte Wetterstation funkte WLAN-Passwort zum Hersteller *** --------------------------------------------- Die Netatmo-Wetterstationen schickten nicht nur ihre Messwerte ins Netz, sondern auch SSID und WLAN-Passwort des Nutzers. --------------------------------------------- http://heise.de/-2571218 *** Update - Notizen zu FREAK *** --------------------------------------------- In den letzten Tagen gab es wieder einmal große mediale Aufmerksamkeit für eine Schwachstelle in OpenSSL und anderen Crypto-Libraries. Der Eintrag für die zugehörige CVE-ID CVE-2015-0204 besteht seit November letzten Jahres, aktualisierte Versionen von OpenSSL wurden heuer im Jänner veröffentlicht. | Update 2015-03-09 | Ergänzung: Auflistungen betroffener Bibliotheken/Anbieter finden sich auf... --------------------------------------------- http://www.cert.at/services/blog/20150306175713-1442.html *** Mono TLS vulnerabilities *** --------------------------------------------- Topic: Mono TLS vulnerabilities Risk: Medium Text:Hi A TLS impersonation attack was discovered in Monos TLS stack by researchers at Inria. During checks on our TLS stack, w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030042 *** IBM Security Bulletin: Multiple Vulnerabilities in the IBM Java SDK affect IBM Notes and Domino (Oracle January 2015 Critical Patch Update) *** --------------------------------------------- 2015-03-09T11:05:28-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698222 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204) *** --------------------------------------------- 2015-03-09T11:04:47-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698574 *** IBM Security Bulletin: Vulnerability in SSLv3 Affects Power Hardware Management Console (CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- 2015-03-09T11:01:43-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020593 *** IBM Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566) *** --------------------------------------------- 2015-03-09T11:01:10-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697348 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-6214; CVE-2015-0139; CVE-2015-0177) *** --------------------------------------------- 2015-03-09T11:10:19-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697213 *** HPSBUX03235 SSRT101750 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vulnerabilities in WordPress Pluins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 https://wpvulndb.com/vulnerabilities/7827 https://wpvulndb.com/vulnerabilities/7828 https://wpvulndb.com/vulnerabilities/7829 https://wpvulndb.com/vulnerabilities/7830 https://wpvulndb.com/vulnerabilities/7831 https://wpvulndb.com/vulnerabilities/7832 https://wpvulndb.com/vulnerabilities/7833 https://wpvulndb.com/vulnerabilities/7834 https://wpvulndb.com/vulnerabilities/7835 https://wpvulndb.com/vulnerabilities/7836 https://wpvulndb.com/vulnerabilities/7837

1 0

Tageszusammenfassung - Freitag 6-03-2015
by Daily end-of-shift report 06 Mar '15

06 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-03-2015 18:00 − Freitag 06-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Oracle hängt Adware an den Java-Installer für Mac OS X *** --------------------------------------------- Bei der Installation von Java wird nun auch Mac-Nutzern Adware angedreht - dabei handelt es sich aktuell um eine Browser-Erweiterung. --------------------------------------------- http://heise.de/-2568995 *** Intuit Failed at 'Know Your Customer' Basics *** --------------------------------------------- Intuit, the makers of TurboTax, recently introduced several changes to beef up the security of customer accounts following a spike in tax refund fraud at the state and federal level. Unfortunately, those changes dont go far .. --------------------------------------------- http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basi… *** Why A Free Obfuscator Is Not Always Free. *** --------------------------------------------- We all love our code but some of us love it so much that we don't want anyone else to read or understand it. When you think about it, that's understandable - hours and hours of hard dev work, days of testing and weeks .. --------------------------------------------- http://blog.sucuri.net/2015/03/why-a-free-obfuscator-is-not-always-free.html *** Cisco IOS Autonomic Networking Infrastructure Self-Referential Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Contact Form DB 2.8.29 - CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco IOS XR Software Malformed SNMP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Freak: Auch Windows von SSL-Lücke betroffen *** --------------------------------------------- Deutlich mehr Clients gefährdet als bisher angenommen - Neben Android und iOS auch Opera unter Linux .. --------------------------------------------- http://derstandard.at/2000012569585 *** Internetdienst Onlinetvrecorder.com gehackt *** --------------------------------------------- Der Internet-Aufnahmedienst Onlinetvrecorder.com ist Opfer eines Hackangriffes geworden. Der Anbieter empfiehlt allen Nutzern, ihr Passwort zu ändern. --------------------------------------------- http://heise.de/-2569350 *** Multiple vulnerabilities in Siemens products *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-064-01 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-02 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-03 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-04 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-05 *** Verbraucherschützer warnen vor falschen E-Mails von Paketdiensten *** --------------------------------------------- Links führen laut deutscher Verbraucherzentrale zu Schadsoftware - Falsche Mails nutzen Namen von DHL und UPS --------------------------------------------- http://derstandard.at/2000012593805 *** Powerspy: Stalking über den Akkuverbrauch *** --------------------------------------------- Statt über Bluetooth und per GPS lassen sich Smartphone-Benutzer auch anhand ihres Akkuverbrauchs verfolgen. Powerspy macht's möglich. --------------------------------------------- http://www.golem.de/news/powerspy-stalking-ueber-den-akkuverbrauch-1503-112… *** Adobe drückt sich vor Finderlohn für gemeldete Lücken *** --------------------------------------------- Wer Lücken im Adobe Reader, Flash und Co. findet, kann diese jetzt über ein Belohnungsprogramm an den Hersteller melden. Eine geldwerte Belohnung gibt es allerdings nicht – zumindest nicht von Adobe. --------------------------------------------- http://heise.de/-2569878 *** The Ongoing Debate about the Gap between Compliance and Security *** --------------------------------------------- Companies required to comply with the Payment Card Industry Data Security Standard (PCI DSS) must meet a wide range of technical and operation requirements. The challenge organizations face regarding PCI compliance has shifted from achieving the minimum level required to satisfy PCI audit .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/the-ongoing-debate-abo…

1 0

Tageszusammenfassung - Donnerstag 5-03-2015
by Daily end-of-shift report 05 Mar '15

05 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-03-2015 18:00 − Donnerstag 05-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MICROSYS PROMOTIC Stack Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the MICROSYS, spol. s r.o. PROMOTIC application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-01 *** Adobe Launches Web Application Vulnerability Disclosure Program on HackerOne *** --------------------------------------------- In recognition of the important role that independent security researchers play in keeping Adobe customers safe, today Adobe launches a web application .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1179 *** SA-CONTRIB-2015-063 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- The module doesn't sufficiently escape user data presented to administrative users in the webform results table. This issue affects the 7.x-4.x branch only. This vulnerability is mitigated by the fact that an attacker .. --------------------------------------------- https://www.drupal.org/node/2445935 *** Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Secure Access Control Server Default Tomcat Administration Interface Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Toshiba Bluetooth Stack Untrusted Service Path Lets Local Users Gain System Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031825 *** BIND DNSSEC Guide *** --------------------------------------------- ISC has new documentation introducing DNSSEC, configuring BIND for common DNSSEC features, and basic DNSSEC troubleshooting. ISCs BIND DNSSEC Guide, co-written with DeepDive Networking, covers DNSSEC requirements, setting up a validating resolver, maintaining signed authoritative zones, and .. --------------------------------------------- http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html *** SANS ICS410 Vienna *** --------------------------------------------- SANS presents the essential ICS/SCADA training course, ICS410 ICS Security Essentials. This specialist training event is running with the support of the International Atomic Energy Agency (IAEA) and follows the IAEAs International Conference on Computer Security in a Nuclear World which takes place the preceding week in Vienna. --------------------------------------------- https://www.sans.org/event/ics410-vienna-with-iaea *** Malware "Casper": Wie die Franzosen in Syrien spionieren *** --------------------------------------------- Sicherheitsforscher analysieren Schadprogramm, das wohl von Frankreichs Geheimdiensten eingesetzt wird --------------------------------------------- http://derstandard.at/2000012513213 *** Format Injection Vulnerability in Duo Security Web SDK *** --------------------------------------------- Format Injection is not a new bug, but it was never described as a subclass of A1 Injection. You probably already hate me for giving it a name (at least I didn't create a logo!) but calling it an 'injection' is too general. --------------------------------------------- http://sakurity.com/blog/2015/03/03/duo_format_injection.html *** The State Of The Internet *** --------------------------------------------- One great idea behind the internet is to connect devices from nearly every position on earth. Well, this idea sometimes has its drawbacks. In order to get an overview about devices that are actually connected, the University of .. --------------------------------------------- https://splone.com/blog/2015/3/4/the-state-of-the-internet *** Schutz vor Freak Attack: Diese Browser sind betroffen *** --------------------------------------------- Der Freak-Angriff kompromittiert unzählige verschlüsselte Webseiten und Angreifer könnten sensible Daten ausspionieren. Ob man für die Attacke anfällig ist, hängt aber vom eingesetzten Betriebssystem, Webbrowser und der besuchten Internetseite ab. --------------------------------------------- http://heise.de/-2567655 *** OpenSSL Cookbook 2nd Edition released *** --------------------------------------------- Today we're releasing the second edition of OpenSSL Cookbook, Feisty Ducks free OpenSSL book. This edition is a major update, with some improvements to the existing text and new content added. The new edition has about 95 pages, an increase of about 35 pages. --------------------------------------------- http://blog.ivanristic.com/2015/03/openssl-cookbook-second-edition-released… *** Utilizing NLP To Detect APT in DNS *** --------------------------------------------- Imagine that after a nice, relaxing long weekend, you come in to work Monday morning at your job at the bank. While waking up with a cup of coffee, you begin checking email. Among the usual messages, there's a message about a security update and you click it. Security updates are so common these days that it's .. --------------------------------------------- https://labs.opendns.com/2015/03/05/nlp-apt-dns/ *** l+f: Abgelaufenes SSL-Zertifikat bei Visa *** --------------------------------------------- Wenn der Browser beim Besuch von Visa.de einen Zertifikatswarnung anzeigt, kann ein Angriff im Gange sein – oder der Admin hat vergessen, wann das Zertifikat abläuft. --------------------------------------------- http://heise.de/-2568054 *** VB2014 paper: Leaving our ZIP undone: how to abuse ZIP to deliver malware apps *** --------------------------------------------- Gregory Panakkal explains there are different ways of looking at APK files - and that sometimes has unintended consequences.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_05.xml *** Domain Trusts: Why You Should Care *** --------------------------------------------- Red teams have been abusing Windows domain trusts for years with great success, but the topic is still underrepresented in public infosec discussions. While the community has started to talk more about Active Directory .. --------------------------------------------- http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/ *** Decoding ZeuS Disguised as an .RTF File *** --------------------------------------------- While going through emails that were reported by our internal users using Reporter, I came across a particularly nasty looking phishing email that had a .doc attachment. At first when I detonated the sample in my VM, it seemed that the attackers weaponized the attachment incorrectly. .. --------------------------------------------- http://phishme.com/decoding-zeus-disguised-as-an-rtf-file/

1 0

Tageszusammenfassung - Mittwoch 4-03-2015
by Daily end-of-shift report 04 Mar '15

04 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-03-2015 18:00 − Mittwoch 04-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Datensicherheit: Smartphones sollen sicherer werden - zumindest ein bisschen *** --------------------------------------------- Wie lassen sich mobile Geräte wenn schon nicht sicher, dann zumindest weniger unsicher machen? In Barcelona stellen Silent Circle, Jolla und Qualcomm ihre Ideen vor. --------------------------------------------- http://www.golem.de/news/datensicherheit-smartphones-sollen-sicherer-werden… *** phpMoAdmin 0-day Nmap Script *** --------------------------------------------- An 0-day vulnerability has been posted on Full-Disclosure this morning. It affects the MongoDB GUI phpMoAdmin. The GUI is similar to the well-known phpMyAdmin and allows the DB administrator to perform maintenance tasks on the .. --------------------------------------------- http://blog.rootshell.be/2015/03/04/phpmoadmin-0-day-nmap-script/ *** Freak Attack: SSL-Verschlüsselung von Millionen Webseiten angreifbar *** --------------------------------------------- Wenn Nutzer von Apple- und Android-Geräten eine der Millionen für den Angriff Freak anfälligen Webseiten ansurfen, kann ein Man-in-the-Middle die verschlüsselten Verbindungen knacken. Angreifer können nicht nur Daten mitlesen, sondern auch manipulieren. --------------------------------------------- http://heise.de/-2566444 *** CryptoFortress : Teerac.A (aka TorrentLocker) got a new identity *** --------------------------------------------- Blitz post. I was hunting for Gootkit (pushed in a Nuclear Pack instance in France those days) but instead I got a Teerac.A. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** SuperFish SSL Sniffing *** --------------------------------------------- Let's start off by saying that SuperFish may top Adobe's ColdFusion un-authenticated remote code executions versions 6-10. Although, Adobe may not have put those vulnerabilities in there themselves and knowingly, Lenovo has no excuse. --------------------------------------------- http://pashakravtsov.com/2015/03/03/SuperFish-SSL-Sniffing/ *** Forensik-Training: Shellshock-Hinweise in Serverlogs aufspüren *** --------------------------------------------- Die europäische Sichereitsbehörde ENISA hat ihr Trainingsmaterial für netzwerkforensische Analysen aktualisiert und um neue Themen ergänzt. --------------------------------------------- http://heise.de/-2566554 *** Threat Spotlight: Angler Lurking in the Domain Shadows *** --------------------------------------------- Over the last several months Talos researchers have been monitoring a massive exploit kit campaign that is utilizing hijacked registrant accounts to create large amounts .. --------------------------------------------- http://blogs.cisco.com/security/talos/angler-domain-shadowing *** A Few Thoughts on Cryptographic Engineering *** --------------------------------------------- This is the story of how a handful of cryptographers hacked the NSA. Its also a story of encryption backdoors, and why they never quite work out the way you want them to. --------------------------------------------- http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-fac… *** Google: Chrome-Support für Android 4.0 wird eingestellt *** --------------------------------------------- Der Chrome-Browser wird für Android 4.0 nur noch wenige Wochen mit Updates versorgt. Nach Version 42 wird der Support beendet. Der steigende Wartungsaufwand für das dreieinhalb Jahre alte Android sei nicht mehr gerechtfertigt, sagt Google. --------------------------------------------- http://www.golem.de/news/google-chrome-support-fuer-android-4-0-wird-einges… *** Skyfall Meets Skype *** --------------------------------------------- The portmanteau-named SKYPEFALL.EXE is the latest, very active, malware-spamming campaign spreading through Skype. --------------------------------------------- http://securelist.com/blog/incidents/69065/skyfall-meets-skype/

1 0

Tageszusammenfassung - Dienstag 3-03-2015
by Daily end-of-shift report 03 Mar '15

03 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-03-2015 18:00 − Dienstag 03-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Ads Gone Bad *** --------------------------------------------- FireEye Labs tracks malvertising activity and recently discovered hundreds of sites that may have been exposed to malvertisements via abuse of ad networks that use real-time bidding (RTB). Since February 4, 2015, FireEye Labs has seen over 1,700 advertiser RTB requests that resulted in downloading of malicious SWF files. We believe this activity is part of an active malvertising operation. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/ads_gone_bad.html *** D-Link Routers Haunted by Remote Command Injection Bug *** --------------------------------------------- Some D-Link routers contain a vulnerability that leaves them open to remote attacks that can give an attacker root access, allow DNS hijacking and other attacks. The vulnerability affects affects a number of D-Link's home routers and the key .. --------------------------------------------- http://threatpost.com/d-link-routers-haunted-by-remote-command-injection-bu… *** Older Keen Team Use-After-Free IE Exploit Added to Angler Exploit Kit *** --------------------------------------------- Attackers behind one of the more popular exploit kits, Angler, have added a tweaked version of an exploit from last fall, a use after free vulnerability in Microsofts Internet Explorer browser. --------------------------------------------- http://threatpost.com/older-keen-team-use-after-free-ie-exploit-added-to-an… *** How to keep your Smart Home safe *** --------------------------------------------- The Internet of Things (IoT) devices can help you save time and hassle and improve your quality of life. As an example, you can check the contents of your fridge and turn on the oven while at the grocery store thus saving money, uncertainty, and .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002792.html *** Symantec NetBackup OpsCenter Server Javascript Injection RCE *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** SSH-Client Putty: Fast vergessene Sicherheitslücke geschlossen *** --------------------------------------------- Der Schöpfer von Putty entschuldigt sich dafür, eine Sicherheitslücke erst nach eineinhalb Jahren vollständig geschlossen zu haben und ergänzt die neue Version um weitere Bugfixes und zwei neue Funktionen. --------------------------------------------- http://heise.de/-2563230 *** SA-CONTRIB-2015-050 - Services Basic Authentication - Access bypass *** --------------------------------------------- https://www.drupal.org/node/2428851 *** New gTLD Portals Taken Offline by ICANN Due to Security Flaw *** --------------------------------------------- The Internet Corporation for Assigned Names and Numbers (ICANN) shut down two new generic top-level domain (gTLD) portals on February 27 after learning of a vulnerability that could have been exploited to view users' data. --------------------------------------------- http://www.securityweek.com/new-gtld-portals-taken-offline-icann-due-securi… *** Cyber criminals target call center operators in Apple Pay fraud schema *** --------------------------------------------- Cybercriminals are targeting call centers operators in Apple Pay fraud to circumvent the checks implemented by Apple, banks and card issuers. The security expert Cherian Abraham revealed a spike in the fraud on Apple's .. --------------------------------------------- http://securityaffairs.co/wordpress/34359/cyber-crime/apple-pay-fraud.html *** Captcha <= 4.0.6 - Captcha Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7822 *** Financial Trojans in 2014: Takedowns contributed to 53 percent drop in infections, but threat is still prevalent *** --------------------------------------------- While the number of financial Trojan detections decreased in 2014, the threat was still .. --------------------------------------------- http://www.symantec.com/connect/blogs/financial-trojans-2014-takedowns-cont… *** phpMoAdmin Zero-day Vulnerability Puts Websites Using MongoDB at Risk *** --------------------------------------------- About two weeks back, over 40,000 organizations running MongoDB were found unprotected and vulnerable to hackers. Now, once again the users of MongoDB database are at risk because of a critical zero-day vulnerability making .. --------------------------------------------- http://thehackernews.com/2015/03/phpMoAdmin-mongoDB-exploit.html *** Ted Unangst: OpenBSD will Browser sicherer machen *** --------------------------------------------- Mindestens ein Webbrowser soll durch die Umsetzung einer Speicherrichtlinie aus OpenBSD abgesichert werden. Dafür bezahlt die Stiftung des Betriebssystems einen Entwickler mit Erfahrung bei Libressl. --------------------------------------------- http://www.golem.de/news/ted-unangst-openbsd-will-browser-sicherer-machen-1… *** Thanks for the Memories: Identifying Malware from a Memory Capture *** --------------------------------------------- Weve all seen attackers try and disguise their running malware as something legitimate. They might use a file name of a legitimate Windows file or even inject code into a legitimate process thats already running. Regardless of how its done, that code has to run, which means it has to be in memory. Somewhere. --------------------------------------------- http://www.contextis.com/resources/blog/thanks-memories-identifying-malware… *** LogPOS - New Point of Sale Malware Using Mailslots *** --------------------------------------------- There has been an explosion in POS malware in the last year. At Morphick, Jeremy Humble and I found 2 undiscovered families in 2014 and we just found our first new family of 2015. This new malware which were calling .. --------------------------------------------- http://morphick.com/blog/2015/2/27/mailslot-pos *** Change to Lollipop Encryption Policy May Not Have Much Effect, Experts Say *** --------------------------------------------- Google has made a subtle, but important, shift in the requirements for Android handset makers, saying now that OEMs manufacturing phones that will run Lollipop do not have to enable disk encryption by default. This is a major change from the .. --------------------------------------------- http://threatpost.com/change-to-lollipop-encryption-policy-may-not-have-muc… *** Cisco Network Analysis Module Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 2-03-2015
by Daily end-of-shift report 02 Mar '15

02 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-02-2015 18:00 − Montag 02-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Abusing Blu-ray Players Pt. 1 - Sandbox Escapes *** --------------------------------------------- tl;drIn today's (28 February) closing keynote talk at the Abertay Ethical Hacking Society's Secuir-Tay conference I discussed how it was po ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/abusing-blu-ray-players-pt-1-sandb… *** dnstest - Monitor Your DNS for Hijacking *** --------------------------------------------- In light of the latest round of attacks against and/or hijacking of DNS, it occurred to me that most people really don't know what to do about it. More importantly, many companies don't even notice they've been attacked until a customer complains. Especially for smaller companies who may not have as many customers, or only... --------------------------------------------- https://blog.whitehatsec.com/dnstest-monitor-your-dns-for-hijacking/ *** Virtualization Incident Response *** --------------------------------------------- Virtualization is a game changer, this session looks at the new world of virtualization and the impact on Incident Response & Computer Forensics. Details include answers to several important questions: Is forensics more difficult or perhaps actually easier in the virtual realm? What do I image if the Data Store has PI from 200 different companies on it that are not subjects to the investigation? Where are virtual machine files stored? What files are of forensic value? What about all of... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/27/virtualization-incid… *** TorrentLocker campaign uses email authentication to tune the operations *** --------------------------------------------- The emails of a new TorrentLocker campaign use Domain-based Message Authentication, Reporting and Conformance (DMARC) to avoid detection and collect data. Cyber criminals are continuously improving the technique to spread malicious code and avoid detection systems. Recently security experts at Trend Micro noticed an improvement in the evasion techniques implemented by malware authors to spread the... --------------------------------------------- http://securityaffairs.co/wordpress/34268/cyber-crime/new-torrentlocker-cam… *** The Rmnet botnet is very much alive! *** --------------------------------------------- February 27, 2015 Despite the numerous reports of news agencies that Europol held massive operation to stop the Rmnet botnet, Doctor Webs analysts continue to monitor this botnets activity. According to the media reports, the staff of British polices office engaged in combating cyber crimes, together with experts from Germany, Italy and the Netherlands, has suppressed the activity of several major Rmnets command and control servers. According to the news reports, on February 24, 2015 command... --------------------------------------------- http://news.drweb.com/show/?i=9310&lng=en&c=9 *** The return of the dangerous Trojan for Mac OS X *** --------------------------------------------- February 27, 2015 Doctor Web analysts conducted a research of a new version of the backdoor Trojan for Mac OS X named Mac.BackDoor.OpinionSpy.3. This malicious program is intended to spy on Mac users: it can collect and transmit information about loaded web pages to the attackers, analyze the traffic passing through the computers network card, intercept the network packets sent by instant messaging programs and perform some other dangerous features. Mac.BackDoor.OpinionSpy programs have been... --------------------------------------------- http://news.drweb.com/show/?i=9309&lng=en&c=9 *** OWASP ProActive Controls: Part 1 *** --------------------------------------------- What is OWASP ProActive Controls? In one line, this project can be explained as "Secure Coding Practices by Developers for Developers". OWASP ProActive Controls is a document prepared for developers who are developing or are new to developing software/application with secure software development. This OWASP project lists 10 controls that can help a developer implement... --------------------------------------------- http://resources.infosecinstitute.com/owasp-proactive-controls-part-1/ *** Xen Hypervisor Flaws Force Amazon, Rackspace to Reboot Servers (SecurityWeek) *** --------------------------------------------- Rackspace, Amazon, Linode and likely other cloud providers will reboot some of their servers over the next week after they patch several vulnerabilities affecting the Xen open-source hypervisor. --------------------------------------------- http://www.securityweek.com/xen-hypervisor-flaws-force-amazon-rackspace-reb… *** Zero-Day-Lücken in Seagates Business NAS *** --------------------------------------------- Wer ein Business-NAS von Seagate nutzt, sollte sicherstellen, dass es nicht über das Internet erreichbar ist. Im Webinterface klaffen kritische Lücken, zu denen bereits ein passender Exploit kursiert. --------------------------------------------- http://heise.de/-2563240 *** Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2015-0651 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2015-0655 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletin: A page in IBM Curam Universal Access contains a risk of Sensitive Information Exposure(CVE-2014-4804) *** --------------------------------------------- 2015-02-27T18:10:56-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695931 *** Jetty 9.2.8 Shared Buffer Leakage *** --------------------------------------------- Topic: Jetty 9.2.8 Shared Buffer Leakage Risk: High Text:GDS LABS ALERT: CVE-2015-2080 JetLeak Vulnerability Remote Leakage Of Shared Buffers In Jetty Web Server SYNOPSIS == Go... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020151 *** Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution *** --------------------------------------------- Topic: Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution Risk: High Text:CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags Severity: Important Vendor: The Apache Software Foundation ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020154 *** HPSBST03274 rev.1 - HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux, Remote Cross-site Scripting (XSS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux. The vulnerabilities could be exploited resulting in remote Cross-site scripting (XSS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IP Blacklist Cloud - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7816 *** WP-ViperGB 1.3.10 - XSS Weakness and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7817

1 0

Tageszusammenfassung - Freitag 27-02-2015
by Daily end-of-shift report 27 Feb '15

27 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-02-2015 18:00 − Freitag 27-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** #JetLeak: Jetty-Webserver gibt Verbindungsdaten preis *** --------------------------------------------- Der Jetty-Server steckt unter anderem in Hadoop, Heroku, Eclipse und der Google AppEngine. Angreifer können eine jetzt entdeckte Lücke dazu nutzen, Daten aus den Verbindungen anderer Nutzer auszuspionieren. --------------------------------------------- http://heise.de/-2560894 *** Spam Uses Default Passwords to Hack Routers *** --------------------------------------------- In case you needed yet another reason to change the default username and password on your wired or wireless Internet router: Phishers are sending out links that, when clicked, quietly alter the settings on vulnerable routers to harvest online banking credentials and other sensitive data from victims. Sunnyvale, Calif. based security firm Proofpoint said it recently detected a four-week spam... --------------------------------------------- http://krebsonsecurity.com/2015/02/spam-uses-default-passwords-to-hack-rout… *** Adventures in Xen exploitation *** --------------------------------------------- tl;drThis post is about my experience trying to exploit the Xen SYSRET bug (CVE-2012-0217).This issue was patched in June 2012 and was dis ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/adventures-in-xen-exploitation/ *** Sicherheits-Tool PrivDog telefoniert nach Hause - unverschlüsselt *** --------------------------------------------- Das vermeintliche Sicherheits-Tool PrivDog steht erneut in der Kritik, denn es sendet alle besuchten URLs unverschlüsselt an den Hersteller. --------------------------------------------- http://heise.de/-2560926 *** Dridex Downloader Analysis *** --------------------------------------------- Introduction Yesterday I received in my company inbox an email with an attached .xlsm file named D92724446.xlsm coming from Clare588(a)78-83-77-53.spectrumnet.bg. Central and local AV engines did not find anything malicious, and a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file... --------------------------------------------- http://resources.infosecinstitute.com/dridex-downloader-analysis/ *** D-Link remote access vulnerabilities remain unpatched *** --------------------------------------------- D-Link routers have several unpatched vulnerabilities, the worst of which could allow an attacker to gain total control over a device, according to a systems engineer in Canada. Peter Adkins, who does security research in his free time, released details of the flaws on Thursday. Adkins said in a phone interview that he has been in intermittent contact with D-Link since Jan. 11 on the issues, but the company has not indicated when it might patch. --------------------------------------------- http://www.cio.com/article/2889994/dlink-remote-access-vulnerabilities-rema… *** Microsoft Malware Protection Center assists in disrupting Ramnit *** --------------------------------------------- Recent disruption of the Ramnit malware family was successful due to a multinational collaboration, led by Europol's European Cybercrime Center (EC3), in partnership with Financial Services and Information Sharing & Analysis Center (FS-ISAC), Symantec, AnubisNetworks, Microsoft's Digital Crimes Unit (DCU), and the Microsoft Malware Protection Center (MMPC). The MMPC has been closely monitoring Ramnit since its discovery in April 2010, as you can see by reading: Ramnit - The... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/25/microsoft-malware-protec… *** The Evil CVE: CVE-666-666 - "Report Not Read" *** --------------------------------------------- I had an interesting discussion with a friend this morning. He explained that, when he is conducting a pentest, he does not hesitate to add sometimes in his report a specific finding regarding the lack of attention given to the previous reports. If some companies are motivated by good intentions and ask for regular pentests against their infrastructure or a specific application, what if they even don't... --------------------------------------------- http://blog.rootshell.be/2015/02/26/the-evil-cve-cve-666-666-report-not-rea… *** Weekly Metasploit Wrapup *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/26/weekly-me… *** Threatpost News Wrap, February 27, 2015 *** --------------------------------------------- Mike Mimoso and Dennis Fisher discuss the news of the last week, including the Superfish fiasco, the Gemalto SIM hack controversy and the continuing NSA drama. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-february-27-2015/111312 *** VMSA-2015-0001.1 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** Security Advisory: BIG-IP ASM cross-site scripting (XSS) vulnerability CVE-2015-1050 *** --------------------------------------------- (SOL16081) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/000/sol16081.htm… *** Security Advisory: OpenSSL vulnerability CVE-2014-0160 *** --------------------------------------------- (SOL15159) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15159.htm… *** Security Advisory: XSS vulnerability in echo.jsp CVE-2014-4023 *** --------------------------------------------- (SOL15532) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15532.htm… *** Cisco Security Notices *** --------------------------------------------- *** Vulnerability in IPv6 Neighbor Discovery in Cisco IOS and IOS-XE Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Vulnerability in Authentication Proxy Feature in Cisco IOS Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Common Services Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco ACE 4710 Application Control Engine and Application Neworking Manager Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- *** DSA-3176 request-tracker4 - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in Request Tracker, anextensible trouble-ticket tracking system. The Common Vulnerabilitiesand Exposures project identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3176 *** Network Vision IntraVue Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability in Network Vision's IntraVue software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01 *** [2015-02-27] Multiple vulnerabilities in Loxone Smart Home *** --------------------------------------------- Multiple design and implementation flaws within Loxone Smart Home enable an attacker to control arbitrary devices connected to the system, execute JavaScript code in the users browser, steal the users credentials and cause a denial of service. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3 CMS 6.2.10 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.10 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6210-released/ *** IBM Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695042 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695037 --------------------------------------------- *** Huge-IT Slider - SQL Injection *** https://wpvulndb.com/vulnerabilities/7811 *** CrossSlide jQuery Plugin <= 2.0.5 - Stored XSS & CSRF *** https://wpvulndb.com/vulnerabilities/7812 *** WPBook - CSRF *** https://wpvulndb.com/vulnerabilities/7813 *** WPBook <= 2.7 - Cross-Site Request Forgery (CSRF) *** https://wpvulndb.com/vulnerabilities/7813 *** WP Media Cleaner <= 2.2.6 - Cross-Site Scripting (XSS) *** https://wpvulndb.com/vulnerabilities/7814 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 26-02-2015
by Daily end-of-shift report 26 Feb '15

26 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-02-2015 18:00 − Donnerstag 26-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** 2014 Spam Landscape: UPATRE Trojan Still Top Malware Attached to Spam *** --------------------------------------------- The malware UPATRE was first spotted in August 2013 following the demise of the Blackhole Exploit kit. It was since known as one of the top malware seen attached to spammed messages and continues to be so all throughout 2014 with particularly high numbers seen in the fourth quarter of the year. We have released... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jUSb_mMOQCc/ *** Webnic Registrar Blamed for Hijack of Lenovo, Google Domains *** --------------------------------------------- Two days ago, attackers allegedly associated with the fame-seeking group Lizard Squad briefly hijacked Googles Vietnam domain (google.com.vn). On Wednesday, Lenovo.com was similarly attacked. Sources now tell KrebsOnSecurity that both hijacks were possible because the attackers seized control over Webnic.cc, the Malaysian registrar that serves both domains and 600,000 others. --------------------------------------------- http://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-le… *** Why Websites Get Hacked *** --------------------------------------------- I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I'm talking large enterprise, there is a common question that often comes up: Why would anyone ever hack my website? Depending on who you are, the answer to this can vary. Nonetheless, it often revolves... --------------------------------------------- http://blog.sucuri.net/2015/02/why-websites-get-hacked.html *** 5 New Vulnerabilities Uncovered In SAP *** --------------------------------------------- ERP security researchers at Onapsis have discovered five new vulnerabilities in SAP BusinessObjects and SAP HANA, three of them high-risk. One in particular gives attackers the power to overwrite data within mission-critical systems. --------------------------------------------- http://www.darkreading.com/application-security/5-new-vulnerabilities-uncov… *** Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Title: Electronic Arts Origin Client 9.5.5 Multiple Privilege | Escalation Vulnerabilities | Advisory ID: ZSL-2015-5231 | Type: Local | Impact: Privilege Escalation | Risk: (3/5) | Release Date: 26.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5231.php *** Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation *** --------------------------------------------- Title: Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege | Escalation | Advisory ID: ZSL-2015-5230 | Type: Local | Impact: Privilege Escalation | Risk: (2/5) | Release Date: 25.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5230.php *** HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04580241 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04580241 Version: 1 HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04556853 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04556853 Version: 2 HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM Sterling Connect:Direct File Agent (CVE-2014-3065, CVE-2014-6468) *** --------------------------------------------- 2015-02-26T11:42:30-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696580 *** Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution (CVE-2014-3566, CVE-2014-6558) *** --------------------------------------------- 2015-02-25T12:49:31-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697112 *** Security Advisory-Multiple Vulnerabilities on Huawei Tecal Server Products *** --------------------------------------------- Feb 26, 2015 09:44 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory-Glibc Buffer Overflow Vulnerability *** --------------------------------------------- Feb 26, 2015 16:35 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** EasyCart 1.1.30 - 3.0.20 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7808 *** WP All Import Pro <= 4.1.0 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7810 *** WP All Import <= 3.2.3 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7809 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** SA-CONTRIB-2015-062 - Watchdog Aggregator - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437993 *** SA-CONTRIB-2015-061 - Ubercart Webform Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437991 *** SA-CONTRIB-2015-060 - Custom Sitemap - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437985 *** SA-CONTRIB-2015-059 - Spider Video Player - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437981 *** SA-CONTRIB-2015-058 - Spider Catalog - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437977 *** SA-CONTRIB-2015-057 - Spider Contacts - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437973 *** SA-CONTRIB-2015-056 - inLinks Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437969 *** SA-CONTRIB-2015-055 - Services single sign-on server helper - Open Redirect - Unsupported *** https://www.drupal.org/node/2437965 *** SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437943 *** SA-CONTRIB-2015-053 - Entity API - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437905 *** SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF) *** https://www.drupal.org/node/2424409 ---------------------------------------------

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily