- Daily - CERT.at

Tageszusammenfassung - Mittwoch 17-12-2014
by Daily end-of-shift report 17 Dec '14

17 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-12-2014 18:00 − Mittwoch 17-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Schadcode nutzt Monate alte WordPress-Lücke aus *** --------------------------------------------- Der Schädling namens SoakSoak hat hunderttausende Webseiten über das Plug-in Slider Revolution befallen und spioniert die Server aus. In einigen Fällen werden auch Besucher per Drive-By-Download infiziert. --------------------------------------------- http://www.heise.de/security/meldung/Schadcode-nutzt-Monate-alte-WordPress-… *** Firefox, IE11 zero-day bugs possibly targeted in SoakSoak WordPress malware attacks *** --------------------------------------------- Attackers exploiting a bug in the Slider Revolution plugin to compromise WordPress websites with malware may also be targeting zero-day vulnerabilities in Firefox and Internet Explorer 11. --------------------------------------------- http://www.scmagazine.com/firefox-ie11-zero-day-bugs-possibly-targeted-in-s… *** Some Memory Forensic with Forensic Suite (Volatility plugins), (Tue, Dec 16th) *** --------------------------------------------- In previous diaries we have talked about memory forensics and how important it is. In this diary I will talk about a new volatility plugins called Forensic Suite written by Dave Lasalle. The suite has 14 plugins and they cover different area of memory forensics The Forensics Suite can be obtain from: http://downloads.volatilityfoundation.org/contest/2014/DaveLasalle_Forensic… . In this diary I will talk about some of the plugins Firefox history: To test this plugin first I browsed the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19071&rss *** URL flaw discovered for airline mobile boarding passes *** --------------------------------------------- A URL flaw that impacts mobile boarding passes for airlines, such as Southwest and Delta, was discovered on Tuesday. --------------------------------------------- http://www.scmagazine.com/url-flaw-discovered-for-airline-mobile-boarding-p… *** Impact of Linux bug grinch spans servers, workstations, Android devices and more *** --------------------------------------------- Alert Logic discovered the bug, which is susceptible to exploitation due to the default installation process used by Linux. --------------------------------------------- http://www.scmagazine.com/impact-of-linux-bug-grinch-spans-servers-workstat… *** Comparing OpenBSD with FreeBSD - securitywise *** --------------------------------------------- OpenBSD and FreeBSD are both great OS that I admire and use. OpenBSD is considered more secure since it is its main goal, but FreeBSD can be tweaked to be pretty well hardened as well. Depending on the forums or to who we ask, we will have different opinions. But what are the facts? Which OS is more secure and why? --------------------------------------------- http://networkfilter.blogspot.co.at/2014/12/security-openbsd-vs-freebsd.html *** SSL Labs end of year 2014 updates *** --------------------------------------------- >From the SSL/TLS perspective, 2014 was quite an eventful year. The best way to describe what we at SSL Labs did is we kept running to stay in the same place. What I mean by this is that we spent a lot of time reacting to high profile vulnerabilities: Hearbleed, the ChangeCipherSpec protocol issue in OpenSSL, POODLE (against SSL 3 in October and against TLS in December), and others. Ultimately, this has been a very successful year for us, with millions of assessments carried out. --------------------------------------------- http://blog.ivanristic.com/2014/12/ssl-labs-end-of-year-updates.html *** Top 5 malware attacks: 35 reused components *** --------------------------------------------- CyActive identified the top five malware that returned the highest ROI for hackers with the least effort per dollar - achieved by recycling code and using the same methods from previous malware attack... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2932 *** Protecting the underground electronic communications infrastructure *** --------------------------------------------- ENISA has released a new report on the Protection of Underground Electronic Communications Infrastructure. This report - targeted at Member States (MS), public institutions, owners of underground comm... --------------------------------------------- http://www.net-security.org/secworld.php?id=17763 *** The Abandoned Side of the Internet: Hijacking Internet Resources When Domain Names Expire *** --------------------------------------------- In this paper, we discuss an attacker model that accounts for the hijacking of network ownership information stored in Regional Internet Registry (RIR) databases. We show that such threats emerge from abandoned Internet resources (e.g., IP address blocks, AS numbers). When DNS names expire, attackers gain the opportunity to take resource ownership by re-registering domain names that are referenced by corresponding RIR database objects. --------------------------------------------- http://arxiv.org/abs/1412.5052 *** How the FBI Unmasked Tor Users *** --------------------------------------------- Kevin Poulson has a good article up on Wired about how the FBI used a Metasploit variant to identify Tor users.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/how_the_fbi_unm.html *** Fast Flux Networks Working and Detection, Part 1 *** --------------------------------------------- Introduction In this series of articles, we will learn about a not-so-new type of attack, but one of the most difficult attacks to control. Yes, we will lean about the demon Fast Flux!! In this article, we will learn about what exactly Fast Flux is, types of Fast Flux, and [...]The post Fast Flux Networks Working and Detection, Part 1 appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/fast-flux-networks-working-detection-… *** What's New in Exploit Kits in 2014 *** --------------------------------------------- Around this time in 2013, the most commonly used exploit kit - the Blackhole Exploit Kit - was shut down after its creator, Paunch, was arrested by law enforcement. Since then, a variety of exploit kits has emerged and have been used by cybercriminals. The emergence of so many replacements has also meant that there... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/N44vwrIcGrM/ *** Researchers warn of new OphionLocker ransomware *** --------------------------------------------- OphionLocker doesnt diverge much from previous ransomware schemes, although it does generate a unique hardware ID based on the first hard drives serial number, the motherboards serial number and other information. --------------------------------------------- www.scmagazine.com/ophionlocker-discovered-in-the-wild-update-provided-on-t… *** Certified pre-pw0ned Android Smartphones: Coolpad Firmware Backdoor, (Wed, Dec 17th) *** --------------------------------------------- Researchers at Palo Alto found that many ROM images used for Android smart phones manufactured by Coolpad contain a backdoor, giving an attacker full control of the device. Palo Alto named the backdoor Coolreaper. With Android, it is very common for manufacturers to install additional applications. But these applications are installed on top of the Android operating system. In this case, Coolpad integrated additional functionality into the firmware of the device. This backdoor was then used by --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19075&rss *** BSI-Sicherheitsbericht: Erfolgreiche Cyber-Attacke auf deutsches Stahlwerk *** --------------------------------------------- Bei einem bislang unbekannten Angriff beschädigten die Angreifer einen Hochofen schwer. Doch neben den gezielten Angriffen auf Industrieanlagen bilanziert das BSI auch eine steigende Gefahr für Endanwender. --------------------------------------------- http://www.heise.de/security/meldung/BSI-Sicherheitsbericht-Erfolgreiche-Cy… *** Meet FlashFlood, the lightweight script that causes websites to falter *** --------------------------------------------- Bringing big database-driven sites to their knees just got a little easier. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/ir5Zy4m-thY/ *** iCloud-Daten: Forensik-Software verspricht umfangreichen Zugriff *** --------------------------------------------- Die vermutlich auch für den iCloud-Promi-Hack genutzte Forensik-Software "Phone Breaker" erweitert die Möglichkeiten, bei Apples Cloud-Dienst gespeicherte Nutzerdaten auszulesen. Unterstützung zum Fremdzugriff auf iCloud Drive soll folgen. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Daten-Forensik-Software-verspri… *** Cisco ISB8320-E High-Definition IP-Only DVR Remote Unauthenticated Access Vulnerability *** --------------------------------------------- CVE-2014-8006 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Symantec Web Gateway OS Authenticated Command Injection *** --------------------------------------------- Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSymantec Web Gateway Operating System Command Injection - Low... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** IBM Business Process Manager cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98418 *** IBM WebSphere Process Server, IBM WebSphere Enterprise Service Bus, IBM Business Process Manager information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98488 *** IBM Business Process Manager security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95724 *** HP Security Bulletins *** --------------------------------------------- [security bulletin] HPSBMU03221 rev.1 - HP Connect-IT running SSLv3, Remote Disclosure of Information --------------------------------------------- http://www.securityfocus.com/archive/1/534259 [security bulletin] HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Code Execution --------------------------------------------- http://www.securityfocus.com/archive/1/534262 [security bulletin] HPSBOV03226 rev.1 - HP TCP/IP Services for OpenVMS, BIND 9 Resolver, Multiple Remote Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/534261 [security bulletin] HPSBOV03225 rev.1 - HP OpenVMS running POP, Remote Denial of Service (DoS) --------------------------------------------- http://www.securityfocus.com/archive/1/534260 *** Patches for Novell Products *** --------------------------------------------- https://download.novell.com/Download?buildid=3dJODsdcDKE~ https://download.novell.com/Download?buildid=STisn28FRWs~ https://download.novell.com/Download?buildid=q4S96klvwhE~ https://download.novell.com/Download?buildid=Mh8CRo1Ljh8~ https://download.novell.com/Download?buildid=nlOmW2y333Q~ https://download.novell.com/Download?buildid=anuuh6CDWX8~ *** DSA-3105 heirloom-mailx - security update *** --------------------------------------------- Two security vulnerabilities were discovered in Heirloom mailx, animplementation of the mail command: --------------------------------------------- https://www.debian.org/security/2014/dsa-3105 *** DSA-3104 bsd-mailx - security update *** --------------------------------------------- It was discovered that bsd-mailx, an implementation of the mailcommand, had an undocumented feature which treats syntactically validemail addresses as shell commands to execute. --------------------------------------------- https://www.debian.org/security/2014/dsa-3104 *** SSA-134508 (Last Update 2014-12-16): Vulnerabilities in SIMATIC WinCC, PCS 7 and WinCC in TIA Portal *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** iWifi For Chat 1.1 Denial Of Service *** --------------------------------------------- Topic: iWifi For Chat 1.1 Denial Of Service Risk: Medium Text:Document Title: iWifi for Chat v1.1 iOS - Denial of Service Vulnerability References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120110 *** iUSB 1.2 Arbitrary Code Execution *** --------------------------------------------- Topic: iUSB 1.2 Arbitrary Code Execution Risk: High Text:Document Title: iUSB v1.2 iOS - Arbitrary Code Execution Vulnerability References (Source): == http://www.... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120109 *** Bugtraq: [REVIVE-SA-2014-002] Revive Adserver 3.0.6 and 3.1.0 fix multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/534264 *** Security Advisory-Multiple Vulnerabilities in Huawei eSpace Desktop Product *** --------------------------------------------- Dec 17, 2014 16:09 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Schneider Electric ProClima Command Injection Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for command injection vulnerabilities in Schneider Electrics ProClima software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-350-01 *** Bird Feeder <= 1.2.3 CSRF & XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7727 *** DB Backup <= 4.5 - Path Traversal File Access *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7726

1 0

Tageszusammenfassung - Dienstag 16-12-2014
by Daily end-of-shift report 16 Dec '14

16 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-12-2014 18:00 − Dienstag 16-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Is POODLE Back for Another Byte? *** --------------------------------------------- [...] The problem is a number of other TLS implementations are optimized for performance by verifying only that the first byte of padding matches the number of padding bytes. Such implementations would accept any value for the second and subsequent padding bytes. What's worse is that the adversary doesn't need to artificially downgrade the connection to SSLv3 to exploit this issue, so the barriers to execution are lower. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2014/12/is_poodle_back_fora.ht… *** RevSlider Vulnerability Leads To Massive WordPress SoakSoak Compromise *** --------------------------------------------- Yesterday we disclosed a large malware campaign targeting and compromising over 100,000 WordPress sites, and growing by the hour. It was named SoakSoak due to the first domain used in the malware redirection path (soaksoak.ru). After a bit more time investigating this issue, we were able to confirm that the attack vector is the RevSlider... --------------------------------------------- http://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wor… *** SoakSoak: Payload Analysis - Evolution of Compromised Sites - IE 11 *** --------------------------------------------- Thousands of WordPress sites has been hit by the SoakSoak attack lately. At this moment we know quite a lot about it. It uses the RevSlider vulnerability as a point of penetration. Then uploads a backdoor and infects all websites that share the same server account (so sites that don't use the RevSlider plugin can... --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-payload-analysis-evolution-of-compr… *** Google Blacklists WordPress Sites Peddling SoakSoak Malware *** --------------------------------------------- Up to 100,000 sites hosted on WordPress may be vulnerable to new campaign thats pushing malware and multiple exploit kits to the browser. --------------------------------------------- http://threatpost.com/google-blacklists-wordpress-sites-peddling-soaksoak-m… *** Safari 8.0.2 Still Supporting SSLv3 with Block Ciphers, (Mon, Dec 15th) *** --------------------------------------------- In October, Apple released Security Update 2014-005, specifically with the intend to address the POODLE issue [1]. The description with the update stated: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling CBC cipher suites when TLS connection... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19067&rss *** ENISA CERT training programme now available online *** --------------------------------------------- ENISA has launched a new section on its website introducing the ENISA CERT training programme. In the new section, you can find all the publicly available training resources and the training courses currently provided by ENISA. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-cert-training-programme-n… *** SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-8730 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Internet-Sicherheit: Auch Cisco mit Poodle-Problemen *** --------------------------------------------- Ausgerechnet Firewalls und Load-Balancing-Erweiterungen des Netzwerkgeräte-Herstellers pfuschen bei der Umsetzung von TLS - und werden damit ebenfalls anfällig für Poodle-Angriffe auf die Verschlüsselung. --------------------------------------------- http://www.heise.de/security/meldung/Internet-Sicherheit-Auch-Cisco-mit-Poo… *** Android Hacking and Security, Part 16: Broken Cryptography *** --------------------------------------------- Introduction In this article, we will discuss broken cryptography in Android applications. Broken cryptography attacks come into the picture when an app developer wants to take advantage of encryption in his application. This article covers the possible ways where vulnerabilities associated with broken cryptography may be introduced in Android apps. [...]The post Android Hacking and Security, Part 16: Broken Cryptography appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/android-hacking-security-part-16-brok… *** F5 Security Advisory: Linux kernel SCTP vulnerabilities CVE-2014-3673 and CVE-2014-3687 *** --------------------------------------------- (SOL15910) - Remote attackers may be able to cause a denial-of-service (DoS) using malformed or duplicate ASCONF chunk. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/900/sol15910.html *** Security Advisory 2014-06: Incomplete Access Control *** --------------------------------------------- An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured. --------------------------------------------- https://www.otrs.com/security-advisory-2014-06-incomplete-access-control/ *** Apache Buffer Overflow in mod_proxy_fcgi Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031371 *** SSA-831997 (Last Update 2014-12-15): Denial-of-Service Vulnerability in Ruggedcom ROS-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** CA Release Automation Multiple Flaws Permit Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031375 *** DokuWiki conf/mime.conf cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99291 *** Python TLS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99294 *** CA LISA Multiple Vulns *** --------------------------------------------- Topic: CA LISA Multiple Vulns Risk: Medium Text:CA20141215-01: Security Notice for CA LISA Release Automation Issued: December 15, 2014 CA Technologies Support is alerti... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120097 *** Bugtraq: [Onapsis Security Advisory 2014-034] SAP Business Objects Search Token Privilege Escalation via CORBA *** --------------------------------------------- http://www.securityfocus.com/archive/1/534249 *** Better Search <= 1.3.4 - Reflective XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7725 *** WP Construction Mode <= 1.91 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7724 *** Sliding Social Icons <= 1.61 - CSRF & Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7723 *** Bugtraq: "Ettercap 8.0 - 8.1" multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/534248

1 0

Tageszusammenfassung - Montag 15-12-2014
by Daily end-of-shift report 15 Dec '14

15 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-12-2014 18:00 − Montag 15-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ICS-CERT: BlackEnergy may be infecting WinCC systems lacking recent patch *** --------------------------------------------- BlackEnergy malware may be exploiting a vulnerability in Siemens SIMATIC WinCC software that was patched in early November. --------------------------------------------- http://www.scmagazine.com/ics-cert-urges-wincc-users-others-to-update-softw… *** BGP Hijacking Continues, Despite the Ability To Prevent It *** --------------------------------------------- An anonymous reader writes: BGPMon reports on a recent route hijacking event by Syria. These events continue, despite the ability to detect and prevent improper route origination: Resource Public Key Infrastructure. RPKI is technology that allows an operator to validate the proper relationship between an IP prefix and an Autonomous System. That is, assuming you can collect the certificates. ARIN requires operators accept something called the Relying Party Agreement. But the provider community... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/hl_eP152_h0/story01.htm *** Batten down the patches: New vuln found in Docker container tech *** --------------------------------------------- Last months patch brought new privilege escalation flaw More security woes plagued users of the Docker application containerization tech for Linux this week, after an earlier security patch was found to have introduced a brand-new critical vulnerability in the software. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/12/docker_vuln… *** Cisco to release flying pig - Snort 3.0 *** --------------------------------------------- Sourcefires been making bacon, now wants you to fry it Ciscos going to release a flying pig. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/12/cisco_to_re… *** Worm Backdoors and Secures QNAP Network Storage Devices, (Sun, Dec 14th) *** --------------------------------------------- Shellshock is far from over, with many devices still not patched andout there ready for exploitation. One set of thedevices receiving a lot of attention recently are QNAP disk storage systems. QNAP released a patch in early October, but applying the patch is not automatic and far from trivial for many users[1]. Our reader Erichsubmitted a link to an interesting Pastebin post with code commonly used in these scans [2] The attack targets a QNAP CGI script, /cgi-bin/authLogin.cgi, a well known... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19061&rss *** SoakSoak Malware Compromises 100,000+ WordPress Websites *** --------------------------------------------- This Sunday has started with a bang. Google has blacklisted over 11,000 domains with this latest malware campaign from SoakSoak.ru: Our analysis is showing impacts in the order of 100s of thousands of WordPress specific websites. We cannot confirm the exact vector, but preliminary analysis is showing correlation with the Revslider vulnerability we reported a... --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpres… *** Man in the Middle attack vs. Cloudflares Universal SSL *** --------------------------------------------- MitM attacks are a class of security attacks that involve the compromise of the authentication of a secure connection. In essence, an attacker builds a transparent tunnel between the client and the server, but makes sure that the client negotiates the secure connection with the attacker, instead of the intended server. Thus the client instead of having a secure connection to the server, has a secure connection to the attacker, which in turn has set up its own secure connection to the server, so... --------------------------------------------- http://blog.ricardomacas.com/index.php?controller=post&action=view&id_post=4 *** 10th Annual ICS Security Summit - Orlando *** --------------------------------------------- For SCADA, Industrial Automation, and Control System Security Join us for the 10th anniversary of the Annual SANS ICS Security Summit. The Summit is the premier event to attend in 2015 for ICS cybersecurity practitioners and managers. This years summit will feature hands-on training courses focused on Attacking and Defending ICS environments, Industry specific pre-summit events, and an action packed summit agenda with the release of ICS security tools and the popular security kit for Summit --------------------------------------------- https://www.sans.org/event/ics-security-summit-2015 *** Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege (3009712) *** --------------------------------------------- V3.0 (December 12, 2014): Rereleased bulletin to announce the reoffering of Microsoft security update 2986475 for Microsoft Exchange Server 2010 Service Pack 3. The rereleased update addresses a known issue in the original offering. Customers who uninstalled the original update should install the updated version of 2986475 at the earliest opportunity. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-075 *** Two newcomers in the exploit kit market *** --------------------------------------------- Exploit kits are a great means to an end for malware distributors, who either buy them or rent them in order to widely disseminate their malicious wares. Its no wonder then that unscrupulous developers are always trying to enter the market currently cornered by Angler, Nuclear, FlashEK, Fiesta, SweetOrange, and others popular exploit kits. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2929 *** RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect *** --------------------------------------------- Topic: RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect Risk: Low Text:ESA-2014-173: RSA Authentication Manager Unvalidated Redirect Vulnerability EMC Identifier: ESA-2014-173 CVE Identifier:... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120080 *** RSA Archer GRC Platform 5.x Cross Site Scripting *** --------------------------------------------- Topic: RSA Archer GRC Platform 5.x Cross Site Scripting Risk: Low Text:ESA-2014-163: RSA Archer GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2014-163 CVE Identifier: See b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120079 *** EMC Isilon InsightIQ Cross Site Scripting *** --------------------------------------------- Topic: EMC Isilon InsightIQ Cross Site Scripting Risk: Low Text:ESA-2014-164: EMC Isilon InsightIQ Cross-Site Scripting Vulnerability EMC Identifier: ESA-2014-164 CVE Identifier: CVE-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120078 *** Cisco Prime Security Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-3364 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass *** --------------------------------------------- Topic: Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Risk: Medium Text:Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://ww... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120086 *** Multiple vulnerabilities in InfiniteWP Admin Panel *** --------------------------------------------- InfiniteWP (http://www.infinitewp.com/) allows an administrator to manage multiple Wordpress sites from one control panel. According to the InfiniteWP homepage, it is used on over 317,000 Wordpress sites. The InfiniteWP Admin Panel contains a number of vulnerabilities that can be exploited by an unauthenticated remote attacker. These vulnerabilities allow taking over managed Wordpress sites by leaking secret InfiniteWP client keys, allow SQL injection, allow cracking of InfiniteWP admin --------------------------------------------- http://seclists.org/fulldisclosure/2014/Dec/43 *** Bugtraq: Vulnerabilities in Ekahau Real-Time Location Tracking System [MZ-14-01] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534241 *** [dos] - phpMyAdmin 4.0.x, 4.1.x, 4.2.x - DoS *** --------------------------------------------- http://www.exploit-db.com/exploits/35539 *** Multiple vulnerabilities in BibTex Publications (si_bibtex) *** --------------------------------------------- It has been discovered that the extension "BibTex Publications" (si_bibtex) is susceptible to Cross-Site Scripting and SQL Injection. --------------------------------------------- http://www.typo3.org/news/article/multiple-vulnerabilities-in-bibtex-public… *** Multiple vulnerabilities in Drag Drop Mass Upload (ameos_dragndropupload) *** --------------------------------------------- It has been discovered that the extension "Drag Drop Mass Upload" (ameos_dragndropupload) is susceptible to Cross-Site Scripting, Cross-Site Request Forgery and Improper Access Control. --------------------------------------------- http://www.typo3.org/news/article/improper-access-control-in-drag-drop-mass… *** Security Advisory-SSLv3 POODLE Vulnerability in Huawei Products *** --------------------------------------------- Dec 15, 2014 18:30 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** SEO Redirection <= 2.2 - Unauthenticated Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7722 *** Lightbox Photo Gallery 1.0 - CSRF/XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7719 *** WP-FB-AutoConnect <= 4.0.5 - XSS/CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7721 *** Timed Popup <= 1.3 - CSRF & Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7720 *** Bugtraq: CVE-2014-2026 Reflected Cross-Site Scripting (XSS) in "Intrexx Professional" *** --------------------------------------------- http://www.securityfocus.com/archive/1/534230 *** Bugtraq: CVE-2014-2025 Remote Code Execution (RCE) in "Intrexx Professional" *** --------------------------------------------- http://www.securityfocus.com/archive/1/534229

1 0

Tageszusammenfassung - Freitag 12-12-2014
by Daily end-of-shift report 12 Dec '14

12 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-12-2014 18:00 − Freitag 12-12-2014 18:00 Handler: Alexander Riepl Co-Handler: Otmar Lendl *** Archie and Astrum: New Players in the Exploit Kit Market *** --------------------------------------------- Thu, 11 Dec 2014 17:10:55 +0200 --------------------------------------------- https://www.f-secure.com/weblog/archives/00002776.html *** Researcher: Lax Crossdomain Policy Puts Yahoo Mail At Risk *** --------------------------------------------- A security researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that puts email content and contacts at risk. --------------------------------------------- http://threatpost.com/researcher-lax-crossdomain-policy-puts-yahoo-mail-at-… *** DSA-3098 graphviz - security update *** --------------------------------------------- Joshua Rogers discovered a format string vulnerability in the yyerrorfunction in lib/cgraph/scan.l in Graphviz, a rich set of graph drawingtools. An attacker could use this flaw to cause graphviz to crash orpossibly execute arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3098 *** ZDI-14-424: Honeywell OPOS Suite HWOPOSScale.ocx Open Method Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell OPOS Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/8tlo_ZfI4BE/ *** ZDI-14-423: Honeywell OPOS Suite HWOPOSSCANNER.ocx Open Method Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell OPOS Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ZDVuupIJS6Q/ *** ZDI-14-422: ManageEngine NetFlow Analyzer CollectorConfInfoServlet COLLECTOR_ID Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sBfZBCsAKl4/ *** ZDI-14-421: ManageEngine Password Manager Pro UploadAccountActivities filename Directory Traversal Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to create a denial of service condition on vulnerable installations of ManageEngine Password Manager Pro. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/agLsqjzz9u4/ *** ZDI-14-420: ManageEngine Desktop Central MSP NativeAppServlet UDID JSON Object Code Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/YGf1aa88_QM/ *** Targeted Phishing Against GoDaddy Customers *** --------------------------------------------- I do get a lot of phishing emails, we all do, but as security professionals we tend to recognize them immediately. Either the syntax is wrong, or it's missing a name. When you get them from a bank you don't even deal with that's a pretty good clue. However, when the phishing is well doneRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/uan3MNQ2J9g/targeted-phishing… *** Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-329-02A Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published December 2, 2014, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-02B *** Wire transfer spam spreads Upatre *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) is currently monitoring a spam email campaign that is using a wire transfer claim to spread Trojan:Win32/Upatre. It is important to note that customers running up-to-date Microsoft security software are protected from this threat. Additionally, customers with Microsoft Active Protection Service Community (MAPS) enabled also benefit from our cloud protection service. Upatre typically uses spam email campaigns to spread and then downloads other --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-spam-sprea… *** Digitaler Anschlag: Cyber-Attacke soll Ölpipeline zerstört haben *** --------------------------------------------- Ein Cyber-Angriff soll 2008 die Explosion einer Ölpipeline in der Türkei verursacht haben, wie anonyme Quellen berichten. Es gibt dafür aber nur Indizien. (Cyberwar, Virus) --------------------------------------------- http://www.golem.de/news/digitaler-anschlag-cyber-attacke-soll-oelpipeline-… *** Cross-Signed Certificates Crashes Android *** --------------------------------------------- We have discovered a vulnerability in Android that affects how cross-signed certificates are handled. No current Android release correctly handles these certificates, which are created when two certificates are signed with a looped certificate chain (certificate A signs certificate B; certificate B signs certificate A). We've already notified Google about this vulnerability, and there is no fix Post from: Trendlabs Security Intelligence Blog - by Trend MicroCross-Signed --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/K85aQffE_W0/ *** Microsoft: Neues Zertifikats-Update, noch ein zurückgezogener Patch *** --------------------------------------------- Microsoft hat ein neues Zertifikats-Update für Windows 7 und Server 2008 ausgeliefert, das die Update-Probleme beheben soll. In der Zwischenzeit musste allerdings der dritte Patch in wenigen Tagen zurückgezogen werden, da er Silverlight zerschossen hatte. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-Neues-Zertifikats-Update-noc… *** Office für Mac 2011: Microsoft beseitigt kritische Schwachstelle *** --------------------------------------------- Das Update für die OS-X-Version der Büro-Suite soll eine Sicherheitslücke in Word beseitigen, die das Einschleusen und Ausführen von Schadcode erlaubt. Auch ein kleineres Problem wird behoben. --------------------------------------------- http://www.heise.de/security/meldung/Office-fuer-Mac-2011-Microsoft-beseiti… *** Microsoft pulls Patch Tuesday fix - "Outlook can't connect to Exchange" *** --------------------------------------------- Part of Patch Tuesday is now only partly available as Microsoft recalls its already-delayed Exchange 2010 update. Paul Ducklin takes a look... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/pyrMdTGYdYo/ *** DFN-CERT-2014-1647/">MantisBT: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- 12.12.2014 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2014-1647/ *** OphionLocker: Joining in the Ransomware Race *** --------------------------------------------- Fri, 12 Dec 2014 16:32:35 +0200 --------------------------------------------- https://www.f-secure.com/weblog/archives/00002777.html *** SSL-Lücke: Der POODLE beißt Windows Phone 7 *** --------------------------------------------- Windows Phone 7 kann Mails nur mit dem uralten SSL-Protokoll Version 3 abholen. Das wird aber von vielen Mailservern wegen der POODLE-Lücke nicht mehr angeboten. Auf Abhilfe können Nutzer wohl nicht hoffen. (Windows Phone, E-Mail) --------------------------------------------- http://www.golem.de/news/ssl-luecke-der-poodle-beisst-windows-phone-7-1412-…

1 0

Tageszusammenfassung - Donnerstag 11-12-2014
by Daily end-of-shift report 11 Dec '14

11 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-12-2014 18:00 − Donnerstag 11-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Critical vulnerability affecting HD FLV Player *** --------------------------------------------- We've been notified of a critical vulnerability affecting the HD FLV Player plugin for Joomla!, WordPress and custom websites. It was silently patched on Joomla! and WordPress, leaving the custom website version vulnerable. Furthermore, websites .. --------------------------------------------- http://blog.sucuri.net/2014/12/critical-vulnerability-in-joomla-hd-flv-play… *** Underground black market: Thriving trade in stolen data, malware, and attack services *** --------------------------------------------- The underground market is still booming after recent major data breaches. The price of stolen email accounts has dropped substantially, but the value of .. --------------------------------------------- http://www.symantec.com/connect/blogs/underground-black-market-thriving-tra… *** Odd new ssh scanning, possibly for D-Link devices, (Wed, Dec 10th) *** --------------------------------------------- I noticed it in my own logs overnight and also had a couple of readers (both named Paul) report some odd new ssh scanning overnight. The scanning involves many sites, likely a botnet, attempting to ssh in as 3 users, D-Link, admin, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19055 *** Microsoft Enables Removal of SSL 3.0 Fallback In IE *** --------------------------------------------- Microsoft has given Windows admins the option to remove the SSL 3.0 fallback from Internet Explorer. By disabling SSL 3.0, IE is no longer vulnerable to POODLE attacks. --------------------------------------------- http://threatpost.com/microsoft-enables-removal-of-ssl-3-0-fallback-in-ie/1… *** FreeBSD Buffer Overflow in libc stdio Lets Local Users Deny Service or Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031343 *** FreeBSD file(1) and libmagic(3) File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031344 *** WordPress Uninstall <= 1.1 - WordPress Deletion via CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7715 *** Mysterious Turla Linux backdoor also for Solaris? *** --------------------------------------------- There has been numerous reports about the mysterious Linux backdoor connected to Turla, an APT family. The malware has some pretty interesting features, the most interesting being its ability to sniff the network interface. More specifically, it .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002775.html *** Regin *** --------------------------------------------- Wir haben in der Woche ab dem 24. November 2014 zum Thema Regin regelmässige Status-Updates an die GovCERT Constituency (in unserer Rolle als GovCERT Austria), die potentiell betroffenen Sektoren (im Rahmen des ATC) und den CERT-Verbund verschickt.Dieser Blogpost stellt unsere Timeline .. --------------------------------------------- http://www.cert.at/services/blog/20141211105745-1339.html *** Patch-Debakel: Microsoft zieht erneut Update zurück *** --------------------------------------------- Nach einem fehlerhaften Rollup-Update für Exchange musste Microsoft nun auch einen Patch für die Root-Zertifikate in Windows zurückziehen. Probleme mit Updates und Patches hatte Microsoft in letzter Zeit des öfteren. --------------------------------------------- http://www.heise.de/security/meldung/Patch-Debakel-Microsoft-zieht-erneut-U… *** Cyber-Spionage: Auf Roter Oktober folgt Cloud Atlas *** --------------------------------------------- Eine neue Angriffswelle mit gezielten Attacken droht: Cloud Atlas soll die nächste digitale Spionagekampagne sein. Die Malware sei eine aktualisierte Variante von Roter Oktober, sagen IT-Sicherheitsexperten. --------------------------------------------- http://www.golem.de/news/cyber-spionage-auf-roter-oktober-folgt-cloud-atlas…

1 0

Tageszusammenfassung - Mittwoch 10-12-2014
by Daily end-of-shift report 10 Dec '14

10 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-12-2014 18:00 − Mittwoch 10-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1149 *** VMSA-2014-0013 *** --------------------------------------------- VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability. VMware vCloud Automation Center has a remote privilege escalation vulnerability. This issue may allow an authenticated vCAC user to obtain administrative access to vCenter Server. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0013.html *** MS14-DEC - Microsoft Security Bulletin Summary for December 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-DEC *** Multiple vulnerabilities in SAP SQL Anywhere *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-415/ http://www.zerodayinitiative.com/advisories/ZDI-14-414/ http://www.zerodayinitiative.com/advisories/ZDI-14-413/ http://www.zerodayinitiative.com/advisories/ZDI-14-412/ *** ZDI-14-411: Lexmark MarkVision Enterprise ReportDownloadServlet Information Disclosure Vulnerability *** --------------------------------------------- The specific flaw exists within the ReportDownloadServlet class. The class contains a method that does not properly sanitize input allowing for directory traversal. An attacker can leverage this vulnerability to read files under the context of SYSTEM. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-411/ *** ZDI-14-410: Lexmark MarkVision Enterprise GfdFileUploadServlet Remote Code Execution Vulnerability *** --------------------------------------------- The specific flaw exists within the GfdFileUploadServlet class. The class contains a method that does not properly sanitize input allowing for directory traversal. An attacker can leverage this vulnerability to write files under the context of SYSTEM and achieve remote code execution. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-410/ *** X Multiple Memory Corruption Flaws Let Remote Users Deny Service and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031326 *** Yokogawa FAST/TOOLS XML External Entity *** --------------------------------------------- This advisory provides mitigation details for an XML external entity processing vulnerability in the Yokogawa FAST/TOOLS application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-343-01 *** Trihedral VTScada Integer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an integer overflow vulnerability in Trihedral Engineering Ltd's VTScada application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02 *** .Bank hires Symantec to check credentials *** --------------------------------------------- Soon you might be able to trust that financial email The launch of new .bank domain names is one step closer with the announcement that Symantec has been chosen to act as the credentials verifier for the top-level domain .. --------------------------------------------- http://www.theregister.co.uk/2014/12/10/bank_hires_symantec_to_check_creden… *** Nach Hack: Sony-Sicherheitszertifikat zur Malware-Tarnung genutzt *** --------------------------------------------- Es ist wohl der verheerendste Angriff auf die IT-Sicherheit eines Unternehmens, den es je gegeben hat. Seit Tagen tauchen immer neue interne Informationen aus dem Netzwerk von Sony Pictures auf. Neben bislang .. --------------------------------------------- http://derstandard.at/2000009194439 *** Cloud Atlas: RedOctober APT is back in style *** --------------------------------------------- Two years ago, we published our research into RedOctober, a complex cyber-espionage operation targeting diplomatic embassies worldwide. We named it RedOctober because we started this investigation in October 2012, an unusually hot month. --------------------------------------------- http://securelist.com/blog/research/68083/cloud-atlas-redoctober-apt-is-bac… *** DFN-CERT-2014-1622: Red Hat Package Manager (RPM): Zwei Schwachstellen ermöglichen die Ausführung beliebiger Befehle *** --------------------------------------------- Zwei Schwachstellen im Red Hat Package Manager (RPM) ermöglichen einem entfernten, nicht authentisierten Angreifer die Ausführung beliebiger Befehle während der Paketinstallation und damit die Übernahme des Systems. Die Schwachstelle .. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2014-1622/ *** F5 BIG-IP SSLv3 Decoding Function Lets Remote Users Decrypt TLS Traffic *** --------------------------------------------- A vulnerability was reported in F5 BIG-IP. A remote user can decrypt TLS sessions in certain cases. The system may accept incorrect TLS padding when terminating TLSv1 CBC connections. A remote user can with the ability to conduct a man-in-the-middle attack can force a client to use a vulnerable SSLv3 decoding function with TLS and then conduct a BEAST-style of attack to decrypt portions of the session. --------------------------------------------- http://www.securitytracker.com/id/1031338 *** Link spoofing and cache poisoning vulnerabilities in TYPO3 CMS *** --------------------------------------------- An attacker could forge a request, which modifies anchor only links on the homepage of a TYPO3 installation in a way that they point to arbitrary domains, if the .. --------------------------------------------- http://www.typo3.org/news/article/link-spoofing-and-cache-poisoning-vulnera… *** Störungen bei 1&1-Webhosting wegen DDos-Attacke *** --------------------------------------------- Weil das DNS-System von 1&1 angegriffen wird, sind sowohl Webhosting als auch Mail von 1&1 zeitweise nicht über Domains erreichbar. --------------------------------------------- http://www.heise.de/security/meldung/Stoerungen-bei-1-1-Webhosting-wegen-DD… *** Sony Pictures wurde vor Angriff auf IT-Infrastruktur angeblich erpresst *** --------------------------------------------- Die Umstände des Hacker-Angriffs auf Sony Pictures werden immer verwirrender. Eine Geldforderung legt einen kriminellen Hintergrund nahe. Zugleich fordern die Hacker aber angeblich auch, die Nordkorea-Komödie "The Interview" zu stoppen. --------------------------------------------- http://www.heise.de/security/meldung/Sony-Pictures-wurde-vor-Angriff-auf-IT… *** X.ORG: Wieder Jahrzente alte Lücken im X-Server *** --------------------------------------------- Der X-Server ist von 13 Sicherheitslücken betroffen, die sich auf verschiedene Implementierungen auswirken können. Die älteste reicht fast 30 Jahre in die erste Version von X11 zurück. Andeutungen auf die Fehler gab es bereits auf dem 30C3 vor einem Jahr. --------------------------------------------- http://www.golem.de/news/x-org-wieder-jahrzente-alte-luecken-im-x-server-14…

1 0

Tageszusammenfassung - Dienstag 9-12-2014
by Daily end-of-shift report 09 Dec '14

09 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-12-2014 18:00 − Dienstag 09-12-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Advance Notification Service for the December 2014 Security Bulletin Release *** --------------------------------------------- Today, we provide advance notification for the release of seven Security Bulletins. Three of these updates are rated Critical and four are rated as Important in severity. These updates are for Microsoft Windows, Internet Explorer (IE), Office and Exchange. As per our monthly process, we've scheduled the Security Bulletin release for the second Tuesday of the month, December 9, 2014, at approximately 10 a.m. PDT. Until then, please review the ANS summary page for more information to help... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/12/04/advance-notification-ser… *** Leveraging the WordPress Platform for SPAM *** --------------------------------------------- We've all seen WordPress comment and pingback spam, but thanks to strict moderation regimes and brilliant WordPress plugins that focus strictly on SPAM comments, comment spam isn't a major problem for most websites these days. I have seen however, a new trend starting to emerge when it comes to spam involving WordPress. In recent years... --------------------------------------------- http://blog.sucuri.net/2014/12/leveraging-the-wordpress-platform-for-spam.h… *** SSLv3: Kaspersky-Software hebelt Schutz vor Poodle-Lücke aus *** --------------------------------------------- Das Paket Kaspersky Internet Security kann auch bei Browsern, die unsichere Verbindungen per SSLv3 nicht unterstützen, das veraltete Protokoll dennoch aktivieren. Patchen will das der Hersteller erst 2015, es gibt aber schon jetzt eine einfache Lösung. --------------------------------------------- http://www.golem.de/news/sslv3-kaspersky-software-hebelt-schutz-vor-poodle-… *** Sicherheitslücken: Java-Sandbox-Ausbrüche in Googles App Engine *** --------------------------------------------- Ein Forscherteam hat diverse Möglichkeiten und Lücken gefunden, aus der Java-Sandbox von Googles App Engine auszubrechen. Dadurch seien sogar beliebige Systemaufrufe im darunter liegenden Betriebssystem möglich. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-java-sandbox-ausbrueche-in-goog… *** DNS-Server BIND, PowerDNS und Unbound droht Endlosschleife *** --------------------------------------------- Eine Sicherheitslücke in den drei DNS-Servern kann dazu ausgenutzt werden, die Software lahmzulegen. Dazu muss ein Angreifer allerdings die Zonen manipulieren oder einen bösartigen DNS-Resolver einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/DNS-Server-BIND-PowerDNS-und-Unbound-d… *** The Penquin Turla - A Turla/Snake/Uroburos Malware for Linux *** --------------------------------------------- So far, every single Turla sample weve encountered was designed for the Microsoft Windows family, 32 and 64 bit operating systems. The newly discovered Turla sample is unusual in the fact that its the first Turla sample targeting the Linux operating system that we have discovered. --------------------------------------------- https://securelist.com/blog/research/67962/the-penquin-turla-2/ *** Setting Up Your Gadgets Securely *** --------------------------------------------- I'm sure that many of us will take home brand new iPhones and Android devices and set it up just the way we want our personal devices to be. We should take a minute to remember, however, that because these devices are so personal to us, the damage a hacked smartphone can do to is significant. Imagine what would happen if a hacker stole your personal data. We don't have to imagine, however, as this has happened to many users in 2014. At the very least, this is embarrassing to the user... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/setting-up-your-… *** Social Engineering improvements keep Rogues/FakeAV a viable scam *** --------------------------------------------- The threat landscape has been accustomed to rogues for a while now. They've been rampant for the past few years and there likely isn't any end in sight to this scam. These aren't complex pieces of malware by any means and typically don't fool the average experienced user, but that's because they're aimed at the inexperienced user. We're going to take a look at some of the improvements seen recently in the latest round of FakeAVs that lead to their success. --------------------------------------------- http://www.webroot.com/blog/2014/12/05/social-engineering-improvements-keep… *** MediaWiki unspecified cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99151 *** MediaWiki unspecified code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99152 *** [Xen-announce] Xen Security Advisory 114 (CVE-2014-9065, CVE-2014-9066) - p2m lock starvation *** --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-12/msg00001.html *** [TYPO3-announce] Announcing TYPO3 CMS 6.2.8 LTS *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS version 6.2.8 LTS, which is now ready for you to download. This version is maintenance releases and contains bug fixes. The packages can be downloaded here: http://typo3.org/download/ --------------------------------------------- http://typo3.org/news/article/typo3-cms-628-released/ *** Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting, Denial of Service and Local File Inclusion. --------------------------------------------- http://www.typo3.org/news/article/multiple-vulnerabilities-in-extension-php…

1 0

Tageszusammenfassung - Freitag 5-12-2014
by Daily end-of-shift report 05 Dec '14

05 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-12-2014 18:00 − Freitag 05-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-DEC - Microsoft Security Bulletin Advance Notification for December 2014 - Version: 1.0 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on December 9, 2014. This bulletin advance notification will be replaced with the December bulletin summary on December 9, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-DEC *** Missing Exchange Patch Expected Among December Patch Tuesday Bulletins *** --------------------------------------------- Microsofts December 2014 advanced Patch Tuesday notification includes three critical bulletins and a missing Exchange patch originally scheduled for November. --------------------------------------------- http://threatpost.com/missing-exchange-patch-expected-among-december-patch-… *** Details Emerge on Sony Wiper Malware Destover *** --------------------------------------------- Kaspersky Lab has published an analysis of Destover, the wiper malware used in the attacks against Sony Pictures Entertainment, and its similarities to Shamoon and DarkSeoul. --------------------------------------------- http://threatpost.com/details-emerge-on-sony-wiper-malware-destover/109727 *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-28) *** --------------------------------------------- December 4, 2014 --------------------------------------------- http://blogs.adobe.com/psirt/?p=1147 *** Upcoming Adobe Reader, Acrobat Update to Patch Sandbox Escape *** --------------------------------------------- Adobe announced security updates for Reader and Acrobat that likely include patches for a sandbox escape vulnerability. Googles Project Zero released details and exploit code earlier this week. --------------------------------------------- http://threatpost.com/upcoming-adobe-reader-acrobat-update-to-patch-sandbox… *** Weekly Metasploit Wrapup: On Unicorns and Wizards *** --------------------------------------------- This week, we shipped a brand new exploit for the "unicorn" bug in Microsoft Internet Explorer, CVE-2014-6332, not-so-prosaically entitled, Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution. This is a big deal client-side vulnerability for the usual reason that Internet Explorer 11 accounts for about a quarter of browser traffic today; nearly always, remote code execution bugs in latest IE are usually particularly dangerous to leave unpatched in your environment. The buzz around this bug, though, is that it's been exploitable... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/12/04/weekly-me… *** Schwachstelle: Yosemite schreibt Firefox-Eingaben mit *** --------------------------------------------- Unter Mac OS X 10.10 werden sämtliche Eingaben im Browser Firefox protokolliert. Mozilla spricht von einer schweren Schwachstelle, die in der aktuellen Version des Browsers geschlossen ist. Die Protokolldateien sind allgemein zugänglich und sollten gelöscht werden. --------------------------------------------- http://www.golem.de/news/schwachstelle-yosemite-schreibt-firefox-eingaben-m… *** Demo-Exploit für kritische Kerberos-Lücke in Windows Server *** --------------------------------------------- Höchste Zeit zu patchen: Mit dem Python Kerberos Exploitation Kit können sich Angreifer sonst zum Enterprise-Admin machen. --------------------------------------------- http://www.heise.de/security/meldung/Demo-Exploit-fuer-kritische-Kerberos-L… *** ZDI-14-403: (0Day) Microsoft Internet Explorer display:run-in Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-403/ *** ZDI: (0Day) 3S Pocketnet Tech VMS PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 multiple Vulnerabilities *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-393 http://www.zerodayinitiative.com/advisories/ZDI-14-394 http://www.zerodayinitiative.com/advisories/ZDI-14-395 http://www.zerodayinitiative.com/advisories/ZDI-14-396 http://www.zerodayinitiative.com/advisories/ZDI-14-397 *** DSA-3090 iceweasel - security update *** --------------------------------------------- Multiple security issues have been found in Iceweasel, Debians versionof the Mozilla Firefox web browser: Multiple memory safety errors, bufferoverflows, use-after-frees and other implementation errors may lead tothe execution of arbitrary code, the bypass of security restrictions ordenial of service. --------------------------------------------- https://www.debian.org/security/2014/dsa-3090 *** Security Advisory: libxml2 vulnerability CVE-2014-3660 *** --------------------------------------------- (SOL15872) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15872.htm… *** Novell Patches and Security Updates *** --------------------------------------------- https://download.novell.com/Download?buildid=gV_oiDtqRV0~ https://download.novell.com/Download?buildid=vPrLP1Ai9zY~ https://download.novell.com/Download?buildid=GuVaYIx6DDo~ https://download.novell.com/Download?buildid=lHQCbRDbSMI~ https://download.novell.com/Download?buildid=Tlic28DXD3o~ https://download.novell.com/Download?buildid=zhVqTr2nsdg~ *** MediaWiki Bugs Permit Cross-Site Request Forgery and API Code Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031301 *** Security Advisories for VMware vSphere *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://www.vmware.com/security/advisories/VMSA-2014-0008.html http://www.vmware.com/security/advisories/VMSA-2014-0002.html *** HPSBUX03218 SSRT101770 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03205 rev.1 - HP Insight Remote Support Clients running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Insight Remote Support Clients running SSLv3 which may impact WBEM, WS-MAN and WMI connections from monitored devices to a HP Insight Remote Support Central Management Server (CMS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… Next End-of-Shift report on 2014-12-09

1 0

Tageszusammenfassung - Donnerstag 4-12-2014
by Daily end-of-shift report 04 Dec '14

04 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-12-2014 18:00 − Donnerstag 04-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** An Analysis of the "Destructive" Malware Behind FBI Warnings *** --------------------------------------------- TrendLabs engineers were recently able to obtain a malware sample of the "destructive malware" described in reports about the Federal Bureau of Investigation (FBI) warning to U.S. businesses last December 2. According to Reuters, the FBI issued a warning to businesses to remain vigilant against this new "destructive" malware in the wake of the recent Sony Pictures... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/ZsHCPcPYoQk/ *** Sony Got Hacked Hard: What We Know and Don't Know So Far *** --------------------------------------------- A week into the Sony hack, however, there is a lot of rampant speculation but few solid facts. Here's a look at what we do and don't know about what's turning out to be the biggest hack of the year. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/41179d61/sc/28/l/0L0Swired0N0C20A… *** Automating Incident data collection with Python, (Thu, Dec 4th) *** --------------------------------------------- One of my favorite Python modules isImpacketby the guys at Core Labs. Among other things it allows me to create Python scripts that can speak to Windows computers over SMB. I can use it to map network drives, kill processes on a remote machine and much more. During an incident having the ability to reach out to allthe machines in your environment to list or kill processes is very useful. Python andImpacketmake this very easy. Check it out. After installing Impacketall of the awesome modules are... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19025&rss *** Escaping the Internet Explorer Sandbox: Analyzing CVE-2014-6349 *** --------------------------------------------- Applications that have been frequently targeted by exploits frequently add sandboxes to their features in order to harden their defenses against these attacks. To carry out a successful exploit, an attacker will have to breach these sandboxes to run malicious code. As a result, researchers will pay particular attention to exploits that are able to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OnnBY6zHrlw/ *** Android Hacking and Security, Part 15: Hacking Android Apps Using Backup Techniques *** --------------------------------------------- In the previous article, we had an introduction on how to analyze Android application specific data using Android backup techniques. This article builds on the previous article. We are going to see how local data storage or basic checks that are performed on a local device can be exploited on... --------------------------------------------- http://resources.infosecinstitute.com/android-hacking-security-part-15-hack… *** WebSocket Security Issues *** --------------------------------------------- Overview In this article, we will dive into the concept of WebSocket introduced in HTML 5, security issues around the WebSocket model, and the best practices that should be adopted to address security issues around WebSocket. Before going straight to security, let's refresh our concepts on WebSocket. Why Websocket and... --------------------------------------------- http://resources.infosecinstitute.com/websocket-security-issues/ *** Avoiding Mod Security False Positives with White-listing *** --------------------------------------------- We have already discussed in my previous articles how to configure Mod Security Firewall with OWASP rules and also analysed the different types of logs which Mod Security generates. While analysing the logs, we have seen that the OWASP rules generate a lot of false positive results, as these rules [...]The post Avoiding Mod Security False Positives with White-listing appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/avoiding-mod-security-false-positives… *** Apple veröffentlicht Updates für Safari-Browser - und zieht sie wieder zurück *** --------------------------------------------- Laut Apple soll Safari 8.0.1 unter anderem Fehler im Zusammenhang mit iCloud-Diensten beheben. Gleichzeitig wurden Safari 6.2.1 und 7.1.1 für ältere OS-X-Versionen veröffentlicht. Apple hat die Updates allerdings kommentarlos offline genommen. --------------------------------------------- http://www.heise.de/security/meldung/Apple-veroeffentlicht-Updates-fuer-Saf… *** Quantum Attack on Public-Key Algorithm *** --------------------------------------------- This talk (and paper) describe a lattice-based public-key algorithm called Soliloquy developed by GCHQ, and a quantum-computer attack on it. News article.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/quantum_attack_.html *** The TYPO3 community publishes TYPO3 CMS 7.0 *** --------------------------------------------- Following our new release cycle, TYPO3 CMS 7.0 is the first sprint release on our way towards the final 7 LTS which will be released in fall 2015. 7.0 will not receive regular bugfix releases, an upgrade to 7.1 should be installed after its release in around 8 weeks instead - see our roadmap for more details. --------------------------------------------- https://typo3.org/news/article/the-typo3-community-publishes-typo3-cms-70-a… *** Cisco Unified Computing System (UCS) Manager Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-8009 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SA-CONTRIB-2014-117 - Hierarchical Select - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-117Project: Hierarchical Select (third-party module)Version: 6.xDate: 2014-December-03Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescriptionThe Hierarchical Select module provides a "hierarchical_select" form element, which is a greatly enhanced way for letting the user select items in a taxonomy. The module does not sanitize some of the user-supplied data... --------------------------------------------- https://www.drupal.org/node/2386615 *** SA-CONTRIB-2014-116 -Webform Invitation - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-116Project: Webform Invitation (third-party module)Version: 7.xDate: 2014-December-03Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to create custom invitation codes for Webforms.The module failed to sanitize node titles.This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new... --------------------------------------------- https://www.drupal.org/node/2386387 *** Security Advisory - High Severity - WordPress Download Manager *** --------------------------------------------- Advisory for: WordPress Download Manager Security Risk: Very High Exploitation level: Easy/Remote DREAD Score: 9/10 Vulnerability: Code Execution / Remote File Inclusion Risk Version: Read More --------------------------------------------- http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-do… *** Security Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products *** --------------------------------------------- Dec 04, 2014 18:26 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** DSA-3086 tcpdump - security update *** --------------------------------------------- Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service, leaking sensitive information from memory or, potentially, execution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3086 *** DSA-3089 jasper - security update *** --------------------------------------------- Josh Duart of the Google Security Team discovered heap-based bufferoverflow flaws in JasPer, a library for manipulating JPEG-2000 files,which could lead to denial of service (application crash) or theexecution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3089 *** DSA-3088 qemu-kvm - security update *** --------------------------------------------- Paolo Bonzini of Red Hat discovered that the blit region checks wereinsufficient in the Cirrus VGA emulator in qemu-kvm, a fullvirtualization solution on x86 hardware. A privileged guest user coulduse this flaw to write into qemu address space on the host, potentiallyescalating their privileges to those of the qemu host process. --------------------------------------------- https://www.debian.org/security/2014/dsa-3088 *** DSA-3087 qemu - security update *** --------------------------------------------- Paolo Bonzini of Red Hat discovered that the blit region checks wereinsufficient in the Cirrus VGA emulator in qemu, a fast processoremulator. A privileged guest user could use this flaw to write into qemuaddress space on the host, potentially escalating their privileges tothose of the qemu host process. --------------------------------------------- https://www.debian.org/security/2014/dsa-3087 *** GNU cpio Heap Overflow in process_copy_in() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031285

1 0

Tageszusammenfassung - Mittwoch 3-12-2014
by Daily end-of-shift report 03 Dec '14

03 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-12-2014 18:00 − Mittwoch 03-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Shodan Add-on for Firefox *** --------------------------------------------- It's now possible to see what information Shodan has available on a server from within Firefox thanks to the new Shodan add-on created by @PaulWebSec and @romainletendart! It's a minimalistic yet powerful add-on to see what the website you're visiting is exposing to the Internet. And the add-on will also tell you other information about the IP,... --------------------------------------------- http://shodanio.wordpress.com/2014/12/02/shodan-add-on-for-firefox/ *** Böse Schlüssel werden zum Problem für GnuPG *** --------------------------------------------- Ein Forscherteam hat demonstriert, wie einfach sich die IDs zu GnuPG-Schlüsseln fälschen lassen und kurzerhand böse Duplikate des kompletten Strong-Sets erzeugt. Das umfasst rund 50.000 besonders eng vernetzte und vertrauenswürdige Schlüssel. --------------------------------------------- http://www.heise.de/security/meldung/Boese-Schluessel-werden-zum-Problem-fu… *** IBM Fixes Serious Code Execution Bug in Endpoint Manager Product *** --------------------------------------------- IBM has fixed a serious vulnerability in its Endpoint Manager product that could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The vulnerability lies in the Endpoint Manager for Mobile Devices component of the product and the researchers who discovered it said the bug could be used to compromise not... --------------------------------------------- http://threatpost.com/ibm-fixes-serious-code-execution-bug-in-endpoint-mana… *** An interesting case of the CVE-2014-8439 exploit *** --------------------------------------------- We have recently seen an exploit targeting the Adobe Flash Player vulnerability CVE-2014-8439 (we detect it as Exploit:SWF/Axpergle). This exploit is being integrated into multiple exploit kits, including the Nuclear exploit kit (Exploit:JS/Neclu) and the Angler exploit kit (Exploit:JS/Axpergle). Adobe released a patch in November to address this exploit (APSB14-26). Coincidentally, our investigation shows that Adobe released a patch to address a different exploit and that patch appears to... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/12/02/an-interesting-case-of-t… *** Keeping Your Website Safe From WordPress's XSS Vulnerability *** --------------------------------------------- Last month, a Finnish IT company by the name of Klikki Oy identified a critical vulnerability in WordPress - one which has been present in the platform for approximately four years. It allows attackers to enter comments which include malicious JavaScript. Once the script in these comments is executed, the attacker could then do anything from infecting the PCs of visitors to completely hijacking the website; locking the original administrator out of their account. --------------------------------------------- http://www.ahosting.net/blog/keeping-your-website-safe-from-wordpresss-xss-… *** A Physical Security Policy Can Save Your Company Thousands of Dollars *** --------------------------------------------- Investments in cybersecurity and physical security are proportionally connected to your organization's improved financial picture for a long-term perspective. Our digital lives are getting smaller as technology simplifies our communications, but cyber attacks are also prevalent. While the Internet radically changes the way organizations operate globally, from handling sensitive data to offshore outsourcing of IT architecture, the payoffs of security are significant and can't be... --------------------------------------------- http://resources.infosecinstitute.com/physical-security-policy-can-save-com… *** Samurai Web Testing Framework 3.0 - LiveCD Web Pen-testing Environment *** --------------------------------------------- The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test. --------------------------------------------- http://hack-tools.blackploit.com/2014/12/samurai-web-testing-framework-30-l… *** New LusyPOS malware is a cross between Dexter and Chewbacca *** --------------------------------------------- A new piece of Point-of-Sale RAM scraping malware has been submitted to VirusTotal and analyzed by researchers, who found that its a cross between two older and different POS malware families and is offered for sale on underground markets for $2,000. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2926 *** The Future of Auditory Surveillance *** --------------------------------------------- Interesting essay on the future of speech recognition, microphone miniaturization, and the future ubiquity of auditory surveillance.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/the_future_of_a.html *** DSA-3084 openvpn *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3084 *** Bugtraq: ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/534135 *** Bugtraq: ESA-2014-160: RSA Adaptive Authentication (On-Premise) Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/534136 *** F5 Security Advisories *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15147.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15158.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/300/sol15329.htm… *** Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-329-02 Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published November 25, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for two vulnerabilities within products utilizing the Siemens WinCC application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-329-02A *** Elipse SCADA DNP3 Denial of Service *** --------------------------------------------- Independent researchers Adam Crain and Chris Sistrunk have identified a DNP3 denial of service vulnerability in the Elipse SCADA application. Elipse has produced a new version of the DNP3 driver that mitigates this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-303-02 *** Emerson ROC800 Multiple Vulnerabilities (Update A) *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities affecting the Emerson Process Management's ROC800 remote terminal units (RTUs) products (ROC800, ROC800L, and DL8000). --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-13-259-01A *** Yokogawa CENTUM and Exaopc Vulnerability (Update A) *** --------------------------------------------- Tod Beardsley of Rapid7 Inc. and Jim Denaro of CipherLaw have identified an authentication vulnerability and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 series and Exaopc products. JPCERT and Yokogawa have mitigated this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_powerkvm_2_issues… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 2-12-2014
by Daily end-of-shift report 02 Dec '14

02 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-12-2014 18:00 − Dienstag 02-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Researcher Releases Database of Known-Good ICS and SCADA Files *** --------------------------------------------- A prominent security researcher has put together a new database of hundreds of thousands of known-good files from ICS and SCADA software vendors in an effort to help users and other researchers identify legitimate files and home in on potentially malicious ones. The database, known as WhiteScope, comprises nearly 350,000 files, including executables and DLLs,... --------------------------------------------- http://threatpost.com/researcher-releases-database-of-known-good-ics-and-sc… *** CVE-2014-1824 - A New Windows Fuzzing Target *** --------------------------------------------- As time progresses, due to constant fuzzing and auditing many common Microsoft products are becoming reasonably hard targets to fuzz and find interesting crashes. There are two solutions to this: write a better fuzzer (http://lcamtuf.coredump.cx/afl/) or pick a less audited target. In a search for less audited attack surface, we are brought to MS14-038, Vulnerability... --------------------------------------------- http://blog.beyondtrust.com/cve-2014-1824-searching-for-windows-attack-surf… *** Kritische Lücke legt OpenVPN-Server lahm *** --------------------------------------------- Wer einen OpenVPN-Server betreibt, sollte diesen umgehend auf den aktuellen Stand bringen. Durch eine Schwachstelle können Angreifer dessen Erreichbarkeit erheblich beeinträchtigen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Luecke-legt-OpenVPN-Server-l… *** Operation DeathClick *** --------------------------------------------- The era of spear phishing and the waterhole attack, which uses social engineering, has come to an end. Hackers are now moving their tricky brains towards targeted Malvertising - a type of attack that uses online advertising to spread malware. A recent campaign termed "Operation death click" displays a new form of cyber-attack focused on specific targets. The attack is also defined as micro targeted malvertising. In this newly targeted variation of malvertising, the hackers are --------------------------------------------- http://resources.infosecinstitute.com/operation-deathclick/ *** 3Q 2014 Security Roundup: Vulnerabilities Under Attack *** --------------------------------------------- Our report on the threats seen in 3Q 2014 shows us that once again, software vulnerabilities are the most favored cybercriminal targets. Following the second quarter's infamous Heartbleed vulnerability came another serious vulnerability in open-source software: Shellshock. Having gone unnoticed for years, the Shellshock incident suggests that there might be more vulnerabilities in Bash or in... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/4qiLKTUdqhM/ *** Betrügerische E-Mails im Namen des Finanzministeriums in Umlauf *** --------------------------------------------- Täuschend echte Phishing-Masken in Design von FinanzOnline --------------------------------------------- http://derstandard.at/2000008913504 *** JSA10607 - 2014-01 Security Bulletin: Junos: Memory-consumption DoS attack possible when xnm-ssl or xnm-clear-text service enabled (CVE-2014-0613) *** --------------------------------------------- Product Affected: This issue can affect any product or platform running Junos OS. Problem: When xnm-ssl or xnm-clear-text is enabled within the [edit system services] hierarchy level of the Junos configuration, an unauthenticated, remote user could exploit the XNM command processor to consume excessive amounts of memory. This, in turn, could lead to system instability or other performance issues. --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10607 *** Security advisory - High severity - InfiniteWP Client WordPress plugin *** --------------------------------------------- Advisory for: InfiniteWP Client for WordPress Security Risk: High (DREAD score : 8/10) Exploitation level: Easy/Remote Vulnerability: Privilege escalation and potential Object Injection vulnerability. Patched Version: 1.3.8 If you're using the InfiniteWP WordPress Client plugin to manage your website, now is a good time to update. While doing a routine audit of our Website FirewallRead More --------------------------------------------- http://blog.sucuri.net/2014/12/security-advisory-high-severity-infinitewp-c… *** Security Bulletin: Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management (CVE-2014-6140) *** --------------------------------------------- A vulnerability exists in IBM Endpoint Manager Mobile Device Management component, where an attacker could misuse cookies to execute arbitrary code. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691701 *** Security Advisory: PHP vulnerability CVE-2013-2110 *** --------------------------------------------- (SOL15876) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15876.htm… *** Security Advisory: SOAP parser vulnerability CVE-2013-1824 *** --------------------------------------------- (SOL15879) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15879.htm… *** Yokogawa FAST/TOOLS XML information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99018 *** EntryPass N5200 Credential Disclosure *** --------------------------------------------- Topic: EntryPass N5200 Credential Disclosure Risk: Low Text:Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated do... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120010 *** 1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting *** --------------------------------------------- Topic: 1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting Risk: Low Text: # # # SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security # # # # CVE ID: ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120009 *** Security Advisory-Multiple Vulnerabilities on Huawei P2 product *** --------------------------------------------- Dec 02, 2014 15:22 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Montag 1-12-2014
by Daily end-of-shift report 01 Dec '14

01 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-11-2014 18:00 − Montag 01-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** [Update] (Keine) Sicherheitsheitslücke in Ciscos H.264-Modul für Firefox *** --------------------------------------------- Cisco hat eine Sicherheitswarnung wegen seines jüngst für Firefox bereitgestellten Video-Codecs herausgegeben. [update]Allerdings soll dies nicht die im aktuellen Webbrowser verwendete Version betreffen.[/update] --------------------------------------------- http://www.heise.de/security/meldung/Update-Keine-Sicherheitsheitsluecke-in… *** EVIL researchers dupe EVERY 32 bit GPG print *** --------------------------------------------- Keys fall in four seconds Researchers have found collision attacks for 32 bit GPG keys leaving the superseded technology well and truly dead. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/01/evil_resear… *** Critical denial of service vulnerability in OpenVPN servers *** --------------------------------------------- A critical denial of service security vulnerability affecting OpenVPN servers was recently brought to our attention. A fixed version of OpenVPN (2.3.6) will be released today/tomorrow (1st Dec 2014) at around 18:00 UTC. --------------------------------------------- https://forums.openvpn.net/topic17625.html *** FIN4: Stealing Insider Information for an Advantage in Stock Trading? *** --------------------------------------------- FireEye tracks a threat group that we call “FIN4,” whose intrusions seem to have a different objective: to obtain an edge in stock trading. FIN4 appears to conduct intrusions that are focused on a single objective: obtaining access to insider information capable of making or breaking the stock prices of public companies. The group specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and compliance personnel, and other individuals who would regularly discuss confidential, market-moving information. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.ht… *** ENISA survey: New Directions in securing personal Data *** --------------------------------------------- Under the growing interest in the areas of personal data protection and cryptography, ENISA has launched a project with the objective to detect the existing technological gaps in the fields. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-survey-new-directions-in-… *** Flushing out the Crypto Rats - Finding "Bad Encryption" on your Network, (Mon, Dec 1st) *** --------------------------------------------- Just when folks get around to implementing SSL, we need to retire SSL! Not a week goes buy that a client isnt asking me about SSL (or more usually TLS) vulnerabilities or finding issue son their network. In a recent case, my client had just finished a datacenter / PCI audit, and had one of his servers come up as using SSL 2.0, which of course has been deprecated since 1996 - the auditors recommendation was to update to SSL 3.0 (bad recommendation, keep reading on). When he then updated to SSL... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19009&rss *** AGbot DDoS Attacks Internet VNC Servers *** --------------------------------------------- Last week, our FortiGuard Labs Threat Intelligence system was able to capture a DDoS attack targeting internet VNC servers. The attack was raised by a brand new IrcBot, which we are detecting as W32/AGbot.AB!tr. Let's now dig into the details of this attack. --------------------------------------------- http://blog.fortinet.com/post/agbot-ddos-attacks-internet-vnc-servers *** Researchers identify POS malware targeting ticket machines, electronic kiosks *** --------------------------------------------- Electronic kiosks and ticketing systems are being targeted by a new type of point-of-sale (POS) threat known as "d4re|dev1|," which acts as an advanced backdoor with remote administration and has RAM scraping and keylogging features, according to IntelCrawler. --------------------------------------------- http://www.scmagazine.com/researchers-identify-pos-malware-targeting-ticket… *** Early version of new POS malware family spotted *** --------------------------------------------- A security researcher came across what appears to be a new family of point-of-sale malware that few antivirus programs were detecting. Nick Hoffman, a reverse engineer, wrote the Getmypass malware shares traits that are similar to other so-called RAM scrapers, which collect unencrypted payment card data held in a payment system's memory. --------------------------------------------- http://www.cio.com/article/2853274/early-version-of-new-pos-malware-family-… *** Sandbox Escape Bug in Adobe Reader Disclosed *** --------------------------------------------- Details and exploit code for a vulnerability in Adobe Reader have surfaced and the bug can be used to break out of the Reader sandbox and execute arbitrary code. The bug was discovered earlier this year by a member of Google's Project Zero and reported to Adobe, which made a change to Reader that made it... --------------------------------------------- http://threatpost.com/sandbox-escape-bug-in-adobe-reader-disclosed/109637 *** Using Shodan from the Command-Line *** --------------------------------------------- Have you ever needed to write a quick script to download data from Shodan? Or setup a cronjob to check what Shodan found on your network recently? How about getting a list of IPs out of the Shodan API? For the times where you'd like to have easy script-friendly access to Shodan there's now a new command-line tool appropriately called shodan. --------------------------------------------- http://shodanio.wordpress.com/2014/12/01/using-shodan-from-the-command-line/ *** l+f: Türsteuerung mit Hintertür *** --------------------------------------------- Beim Türsteuerungsmodul Entrypass N5200 ist der Name Programm: Rein kommt jeder - zumindest wenn er nicht durch die Tür sondern übers Netz kommt. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Tuersteuerung-mit-Hintertuer-24700… *** Dridex Phishing Campaign uses Malicious Word Documents, (Mon, Dec 1st) *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. During the past few months, Botnet-based campaigns have sent waves of phishing emails associated with Dridex. Today, well examine a wave that occurred approximately 3 weeks ago. The emails contained malicious Word documents, and with macros enabled, these documents infected Windows computers with Dridex malware. Various people have posted about Dridex [1] [2], and some sites like Dynamoos blog [3] and TechHelpList [4] often report on these and --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19011&rss *** Malware: Gefälschte Telekom-Rechnungen mit vollständigen Kundennamen *** --------------------------------------------- Die seit November 2014 kursierenden Mails mit Malware in Form von Dateianhängen an vermeintlichen Rechnungen der Telekom haben eine neue Qualität erreicht. Die Empfänger werden darin nun mit ihrem Vor- und Nachnamen angesprochen. --------------------------------------------- http://www.golem.de/news/malware-gefaelschte-telekom-rechnungen-mit-vollsta… *** Clubbing Seals - Exploring the Ecosystem of Third-party Security Seals *** --------------------------------------------- Is this website secure? Well, it just contains statically generated content and holds no personal information, so most likely it is. But how would you be able to tell whether it actually is secure? This problem is exactly what security seal providers are trying to tackle. These seal providers offer a service which allows website owners to show their customers that their website is secure, and therefore safe to use. This works as follows:... --------------------------------------------- https://vagosec.org/2014/11/clubbing-seals/ *** Raiffeisen warnt vor Trojaner beim Online-Banking *** --------------------------------------------- Keine "Test-Überweisungen" durchführen --------------------------------------------- http://derstandard.at/2000008856256 *** DSA-3081 libvncserver *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3081 *** DSA-3080 openjdk-7 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3080 *** DSA-3083 mutt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3083 *** DSA-3082 flac *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3082 *** Security Notice-Statement on Multiple Vulnerabilities in Huawei P2 Smartphone *** --------------------------------------------- Nov 29, 2014 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Vuln: LibYAML and Perl YAML-LibYAML Module scanner.c Remote Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/71349 *** Bugtraq: CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4 *** --------------------------------------------- http://www.securityfocus.com/archive/1/534124

1 0

Tageszusammenfassung - Freitag 28-11-2014
by Daily end-of-shift report 28 Nov '14

28 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-11-2014 18:00 − Freitag 28-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Syrian Electronic Army attack leads to malvertising, (Thu, Nov 27th) *** --------------------------------------------- A number of online services were impacted by what has been referred to by multiple sources as a redirection attack by Syrian Electronic Army (SEA) emanating from the Gigya CDN. Gigya explained the issue as follows: Gigya explained that earlier today at 06:45 EST, it noticed sporadic failures with access to our service. The organization than found a breach at its domain registrar, with the hackers modifying DNS entries and pointing them away from Gigyas CDN domain, instead redirecting to their... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19001&rss *** Worlds best threat detection pwned by HOBBIT *** --------------------------------------------- Forget nation-states, BAB0 is the stuff of savvy crims Some of the worlds best threat detection platforms have been bypassed by custom malware in a demonstration of the fallibility of single defence security. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/28/malware_cru… *** ENISA publishes the first framework on how to evaluate National Cyber Security Strategies *** --------------------------------------------- ENISA issues today an Evaluation Framework on National Cyber Security Strategies (NCSS) addressed to policy experts and government officials who design, implement and evaluate an NCSS policy. This work is strongly aligned with the EU Cyber Security Strategy (EU CSS) and aims to assist Member States in developing capabilities in the area of NCSS. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-publishes-the-first-f… *** CryptoPHP: Hinterlistiger Schadcode hat zehntausende Server infiziert *** --------------------------------------------- Der Schädling versteckt sich in raubkopierten Themes und Plug-ins für die Content-Management-Systeme Drupal, WordPress und Joomla. Einmal infiziert, wird der Server Teil eines Botnetzes, das Such-Rankings manipuliert. Zum Schaden der eigenen Seite. --------------------------------------------- http://www.heise.de/newsticker/meldung/CryptoPHP-Hinterlistiger-Schadcode-h… *** Kritische Updates für Siemens-Industriesteuerungen *** --------------------------------------------- Ein Update soll kritisches Sicherheitslücken in der Software Simatic WinCC schließen, die als Kontrollzentrum für die Überwachung und Steuerung industrieller Anlagen zum Einsatz kommt. Allerdings gibt es das Update noch nicht für alle Versionen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Updates-fuer-Siemens-Industr… *** Economic Failures of HTTPS Encryption *** --------------------------------------------- Interesting paper: "Security Collapse of the HTTPS Market." From the conclusion: Recent breaches at CAs have exposed several systemic vulnerabilities and market failures inherent in the current HTTPS authentication model: the security of the entire ecosystem suffers if any of the hundreds of CAs is compromised (weakest link); browsers are unable to revoke trust in major CAs ("too big to... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/economic_failur.html *** Fehler in H.264-Plugin könnte Firefox-Nutzer betreffen *** --------------------------------------------- [...] In dem dazugehörigen Bugreport bei Mozilla schreibt der Cisco-Angestellte Ethan Hugg, dass der Fehler in keiner Version des bisher für Firefox bereitgestellten OpenH.264-Moduls vorhanden ist. Noch führen die Mozilla-Hacker den Fehler allerdings nicht als offiziell behoben. Nachtrag vom 28. November 2014, 13:10 Uhr Laut Cisco sind Firefox-Nutzer nicht betroffen, wir haben den Artikel entsprechend angepasst. --------------------------------------------- http://www.golem.de/news/cisco-fehler-in-h-264-plugin-betrifft-alle-firefox… *** Bugtraq: Defense in depth -- the Microsoft way (part 22): no DEP in Windows filesystem (and ASLR barely used) *** --------------------------------------------- http://www.securityfocus.com/archive/1/534109

1 0

Tageszusammenfassung - Donnerstag 27-11-2014
by Daily end-of-shift report 27 Nov '14

27 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-11-2014 18:00 − Donnerstag 27-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** New anti-APT tools are no silver bullets: An independent test of APT attack detection appliances *** --------------------------------------------- New anti-APT tools are no silver bullets: An independent test of APT attack detection appliances CrySyS Lab, BME http://www.crysys.hu/ MRG-Effitas https://www.mrg-effitas.com/ November 26, 2014. The term Advanced Persistent Threat (APT) refers to a potential attacker that has the capability and the intent to carry out advanced attacks against specific high profile targets in order to [...] --------------------------------------------- http://blog.crysys.hu/2014/11/new-anti-apt-tools-are-no-silver-bullets-an-i… *** Adobe Reader sandbox popped says Google researcher *** --------------------------------------------- Yet another reason to make sure youve patched promptly and properly The Acrobat Reader Windows sandbox contains a vulnerability that could allow attackers to break out and gain higher privileges, Google security bod James Forshaw claims. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/27/adobe_reade… *** Crunch - Password Cracking Wordlist Generator *** --------------------------------------------- Features: crunch generates wordlists in both combination and permutation ways it can breakup output by number of lines or file size * now has resume support * pattern now supports number and symbols * pattern now supports upper and lower case characters separately * adds a status report when generating multiple files * new -l option for literal support of @,%^ * new -d option to limit duplicate characters see man file for details * now has unicode support... --------------------------------------------- http://hack-tools.blackploit.com/2014/11/crunch-password-cracking-wordlist.… *** SEC Risk Factors: How To Determine The Business Value Of Your Data To A Foreign Government *** --------------------------------------------- This white paper will explore where the SEC is headed on this issue and propose a novel solution that's both specific to the company and avoids the potential danger of revealing too much information about company vulnerabilities - the ability to verifiably assess the value of your intellectual property (IP) to a rival Nation State by establishing its Target Asset Value™. --------------------------------------------- http://jeffreycarr.blogspot.co.uk/2014/11/sec-risk-factors-how-to-determine… *** Factsheet HTTPS could be a lot more secure *** --------------------------------------------- HTTPS is a frequently used protocol for protecting web traffic against parties setting out to eavesdrop on or manipulate the traffic. Configuring HTTPS requires precision: there are many options, and by no means all of them are secure. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Cisco: Fehler in H.264-Plugin betrifft alle Firefox-Nutzer *** --------------------------------------------- Ein Fehler in der Speicherverwaltung des H.264-Plugins betrifft potentiell alle Firefox-Nutzer, da Mozilla dieses zwangsweise installiert. Besonders schwerwiegend ist der Fehler zwar nicht, er offenbart aber ein Problem in der Zusammenarbeit mit Cisco. --------------------------------------------- http://www.golem.de/news/cisco-fehler-in-h-264-plugin-betrifft-alle-firefox… *** l+f: Nur zwei Tage vom Patch zum Exploit-Kit *** --------------------------------------------- Der Zeitraum zwischen der Bekanntgabe einer Lücke durch einen Patch und deren aktiver Ausnutzung wird immer kürzer. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Nur-zwei-Tage-vom-Patch-zum-Exploi… *** Meta-Hack stört hunderte Medien-Webseiten *** --------------------------------------------- Auf hunderten großer Webseiten erschien am Donnerstag die Meldung "You have been hacked". Ursache war eine eingebettete Kommentarfunktion von Gigya. --------------------------------------------- http://www.heise.de/security/meldung/Meta-Hack-stoert-hunderte-Medien-Webse… *** TYPO3 CMS 4.5.38 and 6.2.7 released *** --------------------------------------------- The TYPO3 Community announces the versions 4.5.38 LTS and 6.2.7 LTS of the TYPO3 Enterprise Content Management System. All versions are maintenance releases and contain bug fixes. --------------------------------------------- https://typo3.org/news/article/typo3-cms-4538-and-627-released/ *** TYPO3-EXT-SA-2014-017: Improper Access Control in WebDav for filemounts (webdav) *** --------------------------------------------- It has been discovered that the extension "WebDav for filemounts" (webdav) is susceptible to Improper Access Control. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.0 Vulnerability Type: Improper Access Control Severity: Medium Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:H/RL:OF/RC:C --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** DSA-3077 openjdk-6 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3077 *** Cisco ASA SSL VPN Memory Consumption Error Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031269 *** Mutt Buffer Overflow in mutt_substrdup() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031266 *** Xen Security Advisory 112 (CVE-2014-8867) - Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor *** --------------------------------------------- Acceleration support for the "REP MOVS" instruction, when the first iteration accesses memory mapped I/O emulated internally in the hypervisor, incorrectly assumes that the whole range accessed is handled by the same hypervisor sub-component. Impact: A buggy or malicious HVM guest can crash the host. Mitigation: Running only PV guests will avoid this issue. There is no mitigation available for HVM guests. Resolution: Applying the appropriate attached patch resolves this issue. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00006.html *** Xen Security Advisory 111 (CVE-2014-8866) - Excessive checking in compatibility mode hypercall argument translation *** --------------------------------------------- Impact: A buggy or malicious HVM guest can crash the host. Mitigation: Running only PV guests will avoid this issue. There is no mitigation available for HVM guests on any version of Xen so far released by xenproject.org. Resolution: Applying the appropriate attached patch resolves this issue. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00005.html *** F5 Security Advisories *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15877.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15875.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15881.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15868.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15885.htm…

1 0

Tageszusammenfassung - Mittwoch 26-11-2014
by Daily end-of-shift report 26 Nov '14

26 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-11-2014 18:00 − Mittwoch 26-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-26) *** --------------------------------------------- A Security Bulletin (APSB14-26) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1144 *** Brain Science and Browser Warnings *** --------------------------------------------- Computer users will click through browser warnings and security alerts in order to complete a task, but once theyre hacked, their behaviors change, a recent BYU study learned. --------------------------------------------- http://threatpost.com/brain-science-and-browser-warnings/109615 *** Multiple vulnerabilities in ARRIS VAP2500 *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-389/ http://www.zerodayinitiative.com/advisories/ZDI-14-388/ http://www.zerodayinitiative.com/advisories/ZDI-14-387/ *** DSA-3076 wireshark *** --------------------------------------------- Multiple vulnerabilities were discovered in the dissectors/parsers for SigComp UDVM, AMQP, NCP and TN5250, which could result in denial of service. --------------------------------------------- http://www.debian.org/security/2014/dsa-3076 *** ModSecurity Advanced Topic of the Week: Detecting Malware with Fuzzy Hashing *** --------------------------------------------- In the most recent release of ModSecurity v2.9.0-RC1, we introduced a new operator called @fuzzyHash which uses functionality from the ssdeep tool. This blog post will demonstrate a powerful use-case with ModSecurity which is identifying .. --------------------------------------------- http://blog.spiderlabs.com/2014/11/modsecurity-advanced-topic-of-the-week-d… *** Google Doc Embedder plugin for WordPress google-document-embedder\view.php SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98944 *** VB2014 paper: Labelling spam through the analysis of protocol patterns *** --------------------------------------------- What do your IP packet sizes say about whether youre a spammer?Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Labelling spam through the analysis .. --------------------------------------------- http://www.virusbtn.com/blog/2014/11_26.xml *** Typos Can have a Bigger Impact Than Expected *** --------------------------------------------- Have you ever thought about the cost of a typo? You know what I mean, a simple misspelling of a word somewhere on your website. Do you think there's a risk in that? You may have seen the Grammar Police all over your comments .. --------------------------------------------- http://blog.sucuri.net/2014/11/typos-can-have-a-bigger-impact-than-expected… *** Black Friday and Cyber Monday - 4 Scams To Watch Out For While Shopping *** --------------------------------------------- Holiday Shopping season is really an excited time for both shoppers and retailers, but unfortunately its a good time for cyber criminals and scammers as well. With Black Friday .. --------------------------------------------- http://thehackernews.com/2014/11/black-friday-and-cyber-monday-4-scams_26.h… *** Mängel beim Selbstschutz von Antiviren-Software *** --------------------------------------------- Nur 2 von 32 getesteten Antivirus-Produkten setzen eigentlich selbstverständliche Schutztechniken wie DLP und ASLR auch wirklich konsequent ein, stellte das deutsche Testlabor AV-Test fest. --------------------------------------------- http://www.heise.de/security/meldung/Maengel-beim-Selbstschutz-von-Antivire… *** CryptoPHP a week later: more than 23.000 sites affected *** --------------------------------------------- On November 20th we published our report on CryptoPHP. Since publishing we have, together with other parties, been busy dealing with the affected servers and taking down the CryptoPHP infrastructure. Sinkhole .. --------------------------------------------- http://blog.fox-it.com/2014/11/26/cryptophp-a-week-later-more-than-23-000-s… *** MatrikonOPC for DNP Unhandled C++ Exception *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-01 *** Siemens SIMANTIC WinCC, PCS7, and TIA Portal Vulnerabilities *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-02 *** Hintergrund: Schwachstellen-Scanner für Web-Applikationen *** --------------------------------------------- Ein guter Überblick präsentiert 16 Open-Source-Scanner für Web-Applikationen, die Lücken von XSS bis hin zu SQL-Injection aufspüren. --------------------------------------------- http://www.heise.de/security/artikel/Schwachstellen-Scanner-fuer-Web-Applik…

1 0

Tageszusammenfassung - Dienstag 25-11-2014
by Daily end-of-shift report 25 Nov '14

25 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-11-2014 18:00 − Dienstag 25-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Remote Code Execution in Popular Hikvision Surveillance DVR *** --------------------------------------------- A number Hikvision digital video recorders contain vulnerabilities that an attacker could remotely exploit in order to gain full control of those devices. --------------------------------------------- http://threatpost.com/remote-code-execution-in-popular-hikvision-surveillan… *** Multiple Dell SonicWALL products code execution *** --------------------------------------------- Multiple Dell SonicWALL products could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the failure to validate user data prior to executing a command in the GMS ViewPoint .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98911 *** Obfuscated Flash Files Make Their Mark in Exploit Kits *** --------------------------------------------- In recent years, we noticed that more and more malicious Adobe Flash (.SWF) files are being incorporated into exploit kits like the Magnitude Exploit Kit, the Angler Exploit Kit, and the Sweet Orange Exploit Kit. However, we did some more .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malicious-flash-… *** The Other Side of Masque Attacks: Data Encryption Not Found in iOS Apps *** --------------------------------------------- Based on our research into the iOS threat Masque Attacks announced last week, Trend Micro researchers have found a new way that malicious apps installed through successful Masque Attacks can pose a threat to iOS devices: by accessing unencrypted data used by legitimate apps. According to reports, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-other-side-o… *** Docker docker pull privilege escalation *** --------------------------------------------- Docker could allow a remote attacker to gain elevated privileges on the system, caused by an error in the docker pull and the docker load operations. An attacker could exploit this vulnerability to gain elevated privileges on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98924 *** Docker image privilege escalation *** --------------------------------------------- Docker could allow a remote attacker to gain elevated privileges on the system, caused by the ability to modify the default run profile of containers by images. attacker could exploit this vulnerability to gain elevated privileges on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98925 *** WordPress wpDataTables 1.5.3 SQL Injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110163 *** WordPress wpDataTables 1.5.3 Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110162 *** [oCERT 2014-008] heap overflow, remote code execution in libFLAC *** --------------------------------------------- FLAC is an open source lossless audio codec supported by several software and music players. The libFLAC project, an open source library implementing reference encoders and decoders for native FLAC and Ogg FLAC audio content, suffers from multiple implementation issues. In particular, a stack overflow and a heap overflow condition, which may .. --------------------------------------------- http://www.ocert.org/advisories/ocert-2014-008.html *** Chrome läutet Ende für Browser-Plugins ein *** --------------------------------------------- Ab Jänner werden sämtliche NPAPI-Plugins blockiert - Silverlight und Java betroffen --------------------------------------------- http://derstandard.at/2000008592582 *** Hacker legen Sony Pictures komplett lahm *** --------------------------------------------- Unbekannte haben am Montag den Firmenbetrieb bei Sony Pictures zum Erliegen gebracht. Sie sollen sämtliche Computer im Firmennetz der Sony-Tochter gekapert haben. Auch das Play-Store-Konto von Sony soll betroffen sein. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-legen-Sony-Pictures-komplett-la… *** Secret Malware in European Union Attack Linked to U.S. and British Intelligence *** --------------------------------------------- Complex malware known as Regin is the suspected technology behind sophisticated cyberattacks conducted by U.S. and British intelligence agencies on the European Union and a Belgian telecommunications company, according to security industry sources and technical analysis conducted by The Intercept. --------------------------------------------- https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom… *** EU-Experten: Exporte von Spähsoftware sollen stärker kontrolliert werden *** --------------------------------------------- Wirtschaftsminister Gabriel will den Export von Spähsoftware auf EU-Ebene einschränken. Erste Firmen suchen aber schon Wege, um der Exportkontrolle zu entgehen. --------------------------------------------- http://www.golem.de/news/eu-experten-exporte-von-spaehsoftware-sollen-staer…

1 0

Tageszusammenfassung - Montag 24-11-2014
by Daily end-of-shift report 24 Nov '14

24 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-11-2014 18:00 − Montag 24-11-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Website Malware Removal: Phishing *** --------------------------------------------- As we continue on our Malware Removal series we turn our attention to the increasing threat of Phishing infections. Just like a fisherman casts and reels with his fishing rod, a .. --------------------------------------------- http://blog.sucuri.net/2014/11/website-malware-removal-phishing.html *** Asterisk IP address security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98863 *** "NotCompatible": Die bisher hartnäckigste Android-Malware *** --------------------------------------------- Schadsoftware infiziert täglich 20.000 Geräte - Für Spam-Versand, Ticket-Kauf und Word-Press-Hacking --------------------------------------------- http://derstandard.at/2000008502545 *** DoubleDirect MitM Attack Targets Android, iOS and OS X Users *** --------------------------------------------- Security researchers have discovered a new type of "Man-in-the-Middle" (MitM) attack in the wild targeting smartphone and tablets users on devices running either iOS or Android around the world. The MitM attack, dubbed DoubleDirect, enables an attacker to redirect a victim's traffic of major websites .. --------------------------------------------- http://thehackernews.com/2014/11/doubledirect-mitm-attack-targets_22.html *** Spearphishing: Jeder Fünfte geht in die Falle *** --------------------------------------------- IT-Benutzer sind gutgläubig. Ein Rabattversprechen reicht, um jede Menge Passwörter einzusammeln. Auf der Wiener Security-Konferenz Deepsec wurden erschreckende Zahlen aus der Praxis verraten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Spearphishing-Jeder-Fuenfte-geht-in-… *** A Nightmare on Malware Street *** --------------------------------------------- Another ransomware has been spotted in the wild lately, branded as CoinVault. This one involves some interesting details worth mentioning, including the peculiar characteristic of offering the free decryption of one of the hostage files a.. --------------------------------------------- http://securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/ *** ClamA libclamav/pe.c buffer overflow *** --------------------------------------------- ClamAV is vulnerable to a Heap Based buffer overflow, caused by improper bounds checking by the libclamav/pe.c file. A local attacker could overflow a buffer and execute arbitrary code on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98882 *** Crypto protocols held back by legacy, says ENISA *** --------------------------------------------- EU takes the microscope to security The EU Agency for Network Information and Security (ENISA) has updated its 2013 crypto guidelines, designed to help developers protect personal information in line with EU law, and has sternly told crypto .. --------------------------------------------- http://www.theregister.co.uk/2014/11/24/crypto_protocols_held_back_by_legac… *** Symantec reseachers find Regin malware, label it the new Stuxnet *** --------------------------------------------- Government probably penned peerless p0wn cannon aimed at Russian and Saudi targets An advanced malware instance said to be as sophisticated as Stuxnet and Duqu has has been detected attacking the top end of town and has .. --------------------------------------------- http://www.theregister.co.uk/2014/11/24/regin/ *** Triggering MS14-066 *** --------------------------------------------- Microsoft addressed CVE-2014-6321 this Patch Tuesday, which has been hyped as the next Heartbleed. This vulnerability (actually at least 2 vulnerabilities) promises remote code execution in applications that use the SChannel Security .. --------------------------------------------- http://blog.beyondtrust.com/triggering-ms14-066 *** Hacking RFID Payment Cards Made Possible with Android App *** --------------------------------------------- We recently encountered a high-risk Android app detected as ANDROIDOS_STIP.A in Chile. This app, found distributed through forums and blogs, can be used to hack into the user's RFID bus transit card to recharge the credits. What is the mechanism .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-rfid-pay… *** Protecting Against Unknown Software Vulnerabilities *** --------------------------------------------- Bugs exist in every piece of code. It is suggested that for every 1,000 lines of code, there are on average 1 to 5 bugs to be found. Some of these bugs can have a security implications, these are known as vulnerabilities. These vulnerabilities can be used to exploit and compromise your server, your siteRead More --------------------------------------------- http://blog.sucuri.net/2014/11/protecting-against-unknown-software-vulnerab… *** Linux-Distribution: Less ist ein mögliches Einfallstor *** --------------------------------------------- Das Tool Less wird unter Linux oft benutzt, um in Verbindung mit anderen Tools etwa Dateien zu öffnen. Damit würden viele Fehler und Sicherheitslücken provoziert, meint ein profilierter Hacker. --------------------------------------------- http://www.golem.de/news/linux-distribution-less-als-moegliches-einfallstor… *** Drupal-Update schiebt Session-Klau den Riegel vor *** --------------------------------------------- Die Entwickler des Open-Source CMS haben zwei Sicherheitslücken in Drupal 6 und 7 geschlossen. Die Schwachstellen können missbraucht werden, um Sessions angemeldeter Benutzer zu stehlen und um den Server lahmzulegen. --------------------------------------------- http://www.heise.de/security/meldung/Drupal-Update-schiebt-Session-Klau-den…

1 0

Tageszusammenfassung - Freitag 21-11-2014
by Daily end-of-shift report 21 Nov '14

21 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-11-2014 18:00 − Freitag 21-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Rich Telemetry for Cyber Incident Response and Malicious Code Analysis on Microsoft Windows *** --------------------------------------------- 5..4..3..2..1..launch Earlier this week we launched the first product from the research and development efforts of the NCC Group Security Labs team. NCC Group Security Labs is a combined centre within NCC Group which brings together experts from Security Technical Assurance, Security Research, Cyber Defence Operations and Security Software Development to work on innovative software solutions for real-world cyber security problems. The Problem The world of Cyber Defence Operations involves, in... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/11/rich-telemetry-for-cyber-incident-… *** Securing Personal Data: ENISA guidelines on Cryptographic solutions *** --------------------------------------------- ENISA is launching two reports today. The “Algorithms, key size and parameters” report of 2014 is a reference document providing a set of guidelines to decision makers, in particular specialists designing and implementing cryptographic solutions for personal data protection within commercial organisations or governmental services for citizens. The “Study on cryptographic protocols” provides an implementation perspective, covering guidelines regarding protocols required to protect commercial online communications containing personal data. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/securing-personal-data-enis… *** Weekly Metasploit Wrapup: Exploiting Mobile Security Software *** --------------------------------------------- Exploiting Security Software: Android Edition --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/21/weekly-me… *** VB2014 paper: Sweeping the IP space: the hunt for evil on the Internet *** --------------------------------------------- Dhia Mahjoub explains how the topology of the AS graph can be used to uncover hotspots of maliciousness.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Sweeping the IP space: the hunt for evil on the Internet by OpenDNS researcher Dhia Mahjoub.The Internet is often described as a network of networks. These individual networks are called Autonomous Systems (AS): collections of IPv4 and IPv6 network... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_21.xml?rss *** WordPress 4.0.1 Update Patches Critical XSS Vulnerability *** --------------------------------------------- The latest version of WordPress, 4.0.1, patches a critical cross-site scripting vulnerability in comment fields that enables admin-level control over a website. --------------------------------------------- http://threatpost.com/wordpress-4-0-1-update-patches-critical-xss-vulnerabi… *** The Internet of Things (IoT) will fail if security has no context *** --------------------------------------------- The Internet of Things requires a new way of thinking and acting, one that will protect a business and help it grow. --------------------------------------------- http://www.scmagazine.com/the-internet-of-things-iot-will-fail-if-security-… *** Detekt - Free Anti-Malware Tool To Detect Govt. Surveillance Malware *** --------------------------------------------- Human rights experts and Privacy International have launched a free tool allowing users to scan their computers for surveillance spyware, typically used by governments and other organizations to spy on human rights activists and journalists around the world. This free-of-charge anti-surveillance tool, called Detekt, is an open source software app released in partnership with Human rights... --------------------------------------------- http://thehackernews.com/2014/11/detekt-free-anti-malware-tool-to-detect_20… *** Most Targeted Attacks Exploit Privileged Accounts *** --------------------------------------------- Most targeted attacks exploit privileged account access according to a new report commissioned by the security firm CyberArk. --------------------------------------------- http://threatpost.com/most-targeted-attacks-exploit-privileged-accounts/109… *** Security Advisory - High severity - WP-Statistics WordPress Plugin *** --------------------------------------------- Advisory for: WordPress WP-Statistics Plugin Security Risk: High (DREAD score : 7/10) Exploitation level: Easy/Remote Vulnerability: Stored XSS which executes on the administration panel. Patched Version: 8.3.1 If you're using the WP-Statistics WordPress plugin on your website, now is the time to update. While doing a routine audit for our Website Firewall product, we discovered... --------------------------------------------- http://blog.sucuri.net/2014/11/security-advisory-high-severity-wp-statistic… *** Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities *** --------------------------------------------- Description Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities OpenSSL session ticket memory leak (SPL-91947, CVE-2014-3567) TLS protocol enhancements related to POODLE (SPL-92062,CVE-2014-3566) Persistent cross-site scripting (XSS) via Dashboard (SPL-89216, CVE-2014-5466) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product... --------------------------------------------- http://www.splunk.com/view/SP-CAAANST *** GNU C Library wordexp() command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98852 *** PCRE pcre_exec.c buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98854 *** Multiple Huawei HiLink products cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98858 *** Asterisk DB Dialplan Function Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031251 *** Asterisk CONFBRIDGE Lets Remote Authenticated Users Execute Arbitrary System Commands *** --------------------------------------------- http://www.securitytracker.com/id/1031250 *** Asterisk ConfBridge State Transition Error Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031247 *** Asterisk PJSIP Channel Driver Flaw in res_pjsip_refer Module Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031249 *** Asterisk PJSIP Channel Driver Race Condition Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031248 *** Asterisk PJSIP ACL Bug Lets Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1031246 *** HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnerabilities *** --------------------------------------------- Version:1 (rev.1) - 20 June 2014 Initial release Version:2 (rev.2) - 20 November 2014 Removed iMC Platform Products, 5900 virtual switch, and Router 8800 products. Further analysis revealed that those products as not vulnerable. Added additional products. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04347622 *** ZDI-14-385: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-385/

1 0

Tageszusammenfassung - Donnerstag 20-11-2014
by Daily end-of-shift report 20 Nov '14

20 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-11-2014 18:00 − Donnerstag 20-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ROVNIX Infects Systems with Password-Protected Macros *** --------------------------------------------- We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX. Though a fairly old method for infection, cybercriminals realized that using malicious macros work... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/0rtiBt3T3E4/ *** Citadel Variant Targets Password Managers *** --------------------------------------------- Some Citadel-infected computers have received a new configuration file, a keylogger triggered to go after the master passwords from three leading password management tools. --------------------------------------------- http://threatpost.com/citadel-variant-targets-password-managers/109493 *** CryptoPHP: Analysis of a hidden threat inside popular content management systems *** --------------------------------------------- CryptoPHP is a threat that uses backdoored Joomla, WordPress and Drupal themes and plug-ins to compromise webservers on a large scale. By publishing pirated themes and plug-ins free for anyone to use instead of having to pay for them, the CryptoPHP actor is social engineering site administrators into installing the included backdoor on their server. --------------------------------------------- http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-ins… *** An inside look: gathering and analyzing the SIR data *** --------------------------------------------- At the Microsoft Malware Protection Center, threat data is a critical source of information to help protect our customers. We use it to understand what's going on in the overall malware ecosystem, determine the best way to protect our customers, and find the most effective way to deliver that protection. We also use the data to produce a number of reports to help our customers. This includes our bi-annual Security Intelligence Report (SIR). This blog post gives you a behind-the-scenes... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/19/an-inside-look-gathering… *** Annual Privacy Forum 2014 materials and APF2015 - Call for partnership *** --------------------------------------------- ENISA's Information Security and Data Protection Unit announces the commencement of preparations for the Annual Privacy Forum of 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2014-mater… *** Electronic Arts: Datenpanne bei Origin *** --------------------------------------------- Einblicke in persönliche Daten von anderen Nutzern zeigt derzeit Origin, das Onlineportal von Electronic Arts, beim Zugriff auf die Foren an. --------------------------------------------- http://www.golem.de/news/electronic-arts-datenpanne-bei-origin-1411-110689-… *** How Splitting A Computer Into Multiple Realities Can Protect You From Hackers *** --------------------------------------------- Eight years ago, polish hacker Joanna Rutkowska was experimenting with rootkits - tough-to-detect spyware that infects the deepest level of a computer's operating system - when she came up with a devious notion: What if, instead of putting spyware inside a victim's computer, you put the victim's computer inside the spyware? At the time, a technology known... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/40ab9794/sc/4/l/0L0Swired0N0C20A1… *** Vulnerabilities identified in three Advantech products *** --------------------------------------------- Researchers with Core Security have identified vulnerabilities in three products manufactured by Advantech, some of which can be exploited remotely. --------------------------------------------- http://www.scmagazine.com/vulnerabilities-identified-in-three-advantech-pro… *** Bugtraq: [CORE-2014-0009] - Advantech EKI-6340 Command Injection *** --------------------------------------------- http://www.securityfocus.com/archive/1/534021 *** Bugtraq: [CORE-2014-0008] - Advantech AdamView Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534022 *** Bugtraq: [CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534023 *** Drupal Patches Denial of Service Vulnerability; Details Disclosed *** --------------------------------------------- Drupal has released a patched a denial of service and account hijacking vulnerability, details of which were disclosed by the researchers who discovered the issue. --------------------------------------------- http://threatpost.com/drupal-patches-denial-of-service-vulnerability-detail… *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2014-006Project: Drupal core Version: 6.x, 7.xDate: 2014-November-19Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescriptionSession hijacking (Drupal 6 and 7)A specially crafted request can give a user access to another users session, allowing an attacker to hijack a random session.This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS... --------------------------------------------- https://www.drupal.org/SA-CORE-2014-006 *** DRUPAL Security Advisories for Third-Party Modules *** --------------------------------------------- https://www.drupal.org/node/2378287 https://www.drupal.org/node/2378279 https://www.drupal.org/node/2378441 https://www.drupal.org/node/2378401 https://www.drupal.org/node/2378367 *** R7-2014-18: Hikvision DVR Devices - Multiple Vulnerabilities *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/19/r7-2014-1… *** Paid Memberships Pro plugin for WordPress getfile.php directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98805 *** Lsyncd default-rsyncssh.lua command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98806 *** Security Advisory-App Validity Check Bypass Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- Nov 20, 2014 14:53 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Vuln: MantisBT core/file_api.php Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/71104 *** Xen Security Advisory 113 - Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling *** --------------------------------------------- An error handling path in the processing of MMU_MACHPHYS_UPDATE failed to drop a page reference which was acquired in an earlier processing step. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00003.html *** IBM Security Network Protection Shell Command Injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98519 *** IBM Security Bulletins related to POODLE *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 19-11-2014
by Daily end-of-shift report 19 Nov '14

19 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-11-2014 18:00 − Mittwoch 19-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-068 - Critical: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Version: 1.0 *** --------------------------------------------- This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-068 *** Additional information about CVE-2014-6324 *** --------------------------------------------- Today Microsoft released update MS14-068 to address CVE-2014-6324, a Windows Kerberos implementation elevation of privilege vulnerability that is being exploited in-the-wild in limited, targeted attacks. The goal of this blog post is to provide additional information about the vulnerability, update priority, and detection guidance for defenders. Microsoft recommends customers apply this update to their domain controllers as quickly as possible. Vulnerability Details CVE-2014-6324 allows... --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-ab… *** Google Removes SSLv3 Fallback Support From Chrome *** --------------------------------------------- Google has released Chrome 39, fixing 42 security vulnerabilities and removing support for the fallback to SSLv3, the component that was the target of the POODLE attack revealed last month. When the POODLE attack was disclosed by several Google researchers in October, the company said that it had added a change to Chrome that would... --------------------------------------------- http://threatpost.com/google-removes-sslv3-fallback-support-from-chrome/109… *** A New Free CA *** --------------------------------------------- Announcing Lets Encrypt, a new free certificate authority. This is a joint project of EFF, Mozilla, Cisco, Akamai, and the University of Michigan. This is an absolutely fantastic idea. The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server youre actually talking to is the server you intended to talk to. For many server operators,... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html *** Survey: real-time SIEM solutions help orgs detect attacks within minutes *** --------------------------------------------- Real-time security information and event management solutions help organizations detect targeted attacks and advanced persistent threats within minutes, according to a McAfee survey. --------------------------------------------- http://www.scmagazine.com/survey-real-time-siem-solutions-help-orgs-detect-… *** POWELIKS Levels Up With New Autostart Mechanism *** --------------------------------------------- Last August, we wrote about POWELIKS's malware routines that are known for hiding its malicious codes in the registry entry as part of its evasion tactics. In the newer samples we spotted, malware detected as TROJ_POWELIKS.B employed a new autostart mechanism and removes users' privileges in viewing the registry's content. As a result, users won't be able to suspect that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/zurdvNxST00/ *** Pan-European Cyber Security Competition organised by ENISA *** --------------------------------------------- Today (19 November 2014) the European Union Agency for Network and Information Security (ENISA) is happy to announce the planning of the 1st pan-European Cyber Security Competition in 2015. The competition is organised jointly in collaboration with experienced organisations from EU Member States for students. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/pan-european-cyber-security-com… *** RSS Reveals Malware Injections *** --------------------------------------------- There are multiple different ways to detect invisible malware on a website: You can scrutinize the HTML code of web pages. Use external scanners like SiteCheck or UnmaskParasites. Get alerts from anti-viruses or search engines (both in search results and via their Webmaster Tools). Try to open web pages with different User-Agents and check for... --------------------------------------------- http://blog.sucuri.net/2014/11/rss-reveals-malware-injections.html *** Test Tool for Web App Security Scanners Released by Google *** --------------------------------------------- A new tool was open-sourced by Google on Tuesday, aiming at improving the efficiency of automated web security scanners by evaluating them with patterns of vulnerabilities already seen in the wild. --------------------------------------------- http://news.softpedia.com/news/Test-Tool-for-Web-App-Security-Scanners-Rele… *** Microsoft bessert beim SChannel-Patch nach *** --------------------------------------------- Still und heimlich haben die Windows-Macher am Dienstag mit dem Update außer der Reihe auch eine neue Revision des SChannel-Patches ausgeliefert. Diese soll die Probleme mit der TLS-Verschlüsselung und massive Performance-Einbußen bei SQL Server beheben. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-bessert-beim-SChannel-Patch-… *** Most advanced mobile botnet EVER is coming for your OFFICE Androids *** --------------------------------------------- NotCompatible A newly discovered variant of NotCompatible is establishing what has been called the most advanced mobile botnet yet created. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/19/android_bot… *** jQuery: Cross-Site-Scripting in Captcha-Beispielcode weit verbreitet *** --------------------------------------------- Ein populäres jQuery-Plugin liefert Code mit einer Cross-Site-Scripting-Lücke aus. Der verwundbare Code stammt ursprünglich von einem Beispielskript für Captchas, das auf sehr vielen Webseiten zu finden ist. --------------------------------------------- http://www.golem.de/news/jquery-cross-site-scripting-in-captcha-beispielcod… *** A Peek Inside a PoS Scammer's Toolbox *** --------------------------------------------- PoS malware has been receiving a tremendous amount of attention in the past two years with high profile incidents like Target, Home Depot, and Kmart. With the massive "Black Friday" shopping season coming up, PoS malware will surely get additional publicity. This high profile nature means, we constantly look for evolving PoS malware and look into their behavior... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/xF7gxViXP4A/ *** Nasty Security Bug Fixed in Android Lollipop 5.0 *** --------------------------------------------- There is a vulnerability in Android versions below 5.0 that could allow an attacker to bypass ASLR and run arbitrary code on a target device under certain circumstances. The bug was fixed in Lollipop, the newest version of the mobile OS, released earlier this week. The vulnerability lies in java.io.ObjectInputStream, which fails to check whether... --------------------------------------------- http://threatpost.com/nasty-security-bug-fixed-in-android-lollipop-5-0/1094… *** Cisco Unified Communications Manager IM and Presence Service Enumeration Vulnerability *** --------------------------------------------- CVE-2014-8000 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Multiple Samsung Galaxy Devices knox code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98780 *** Google Chrome pdfium code execution *** --------------------------------------------- Google Chrome pdfium code execution --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98790 *** Bugtraq: [SECURITY] [DSA 3074-2] php5 regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/534018 *** Bugtraq: Reflected Cross-Site Scripting (XSS) in Simple Email Form Joomla Extension *** --------------------------------------------- http://www.securityfocus.com/archive/1/534017

1 0

Tageszusammenfassung - Dienstag 18-11-2014
by Daily end-of-shift report 18 Nov '14

18 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-11-2014 18:00 − Dienstag 18-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Out-of-band release for Security Bulletin MS14-068 *** --------------------------------------------- On Tuesday, November 18, 2014, at approximately 10 a.m. PST, we will release an out-of-band security update to address a vulnerability in Windows. We strongly encourage customers to apply this update as soon as possible, following the directions in the security bulletin. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/11/18/out-of-band-release-for-… *** VB2014 paper: Optimized mal-ops. Hack the ad network like a boss *** --------------------------------------------- Why buying ad space makes perfect sense for those wanting to spread malware.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Optimized mal-ops. Hack the ad network like a boss by Bromium researchers Vadim Kotov and Rahul Kashyap.Malicious advertisements (malvertising) go back more than a decade, yet in recent months we have seen a surge in these attacks, including the Kyle and Stan campaign, which... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_18.xml?rss *** l+f: Lücken bei BitTorrent Sync *** --------------------------------------------- Ein Security-Audit hat eine Reihe kleinerer und größerer Lücken im Filesharing-Dienst gefunden. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Luecken-bei-BitTorrent-Sync-245985… *** Matsnu Botnet DGA Discovers Power of Words *** --------------------------------------------- The Matsnu botnet has deployed a new domain generation algorithm that builds domain names from a list of nouns and verbs. The plain English phrases help the DGA elude detection. --------------------------------------------- http://threatpost.com/matsnu-botnet-dga-discovers-power-of-words/109426 *** Cisco Releases Security Analytics Framework to Open Source *** --------------------------------------------- Ciscos OpenSOC, a security analytics framework, has been released to open source. --------------------------------------------- http://threatpost.com/cisco-releases-security-analytics-framework-to-open-s… *** The NSAs Efforts to Ban Cryptographic Research in the 1970s *** --------------------------------------------- New article on the NSAs efforts to control academic cryptographic research in the 1970s. It includes new interviews with public-key cryptography inventor Martin Hellman and then NSA-director Bobby Inman.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/the_nsas_effort.html *** Flashpack Exploit Kit Used in Free Ads, Leads to Malware Delivery Mechanism *** --------------------------------------------- In the entry FlashPack Exploit Leads to New Family of Malware, we tackled the Flashpack exploit kit and how it uses three URLs namely (http://{malicious domain}/[a-z]{3}[0-9]{10,12}/loxotrap.php, http://{malicious domain}/[0-9,a-z]{6,10}/load0515p6jse9.php, http://{malicious domain}/[a-z]{3}[0-9]{10,12}/ldcigar.php) as its landing site. We monitored the abovementioned URLs and found out that the FlashPack exploit kit is now using free ads to distribute malware such as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-FQFl818dVo/ *** IT threat evolution Q3 2014 *** --------------------------------------------- Kaspersky Lab products detected and neutralized a total of 1,325,106,041 threats in the third quarter of 2014. Our solutions blocked 696,977 attacks that attempted to launch malware capable of stealing money from online banking accounts. Were detected 74,489 new malicious mobile programs, including 7010 mobile banking Trojans. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/67637/it-threat-ev… *** Microsofts SChannel-Fix wird zum Problem-Patch *** --------------------------------------------- Microsoft hat bestätigt, dass der Patch für die Krypto-Funktion von Windows auf Servern zu Problemen führt. Es soll sowohl SQL Server als auch IIS beeinträchtigen. Das Update wird aber nach wie vor verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Microsofts-SChannel-Fix-wird-zum-Probl… *** Cisco IOS DLSw Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-7992 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2014-7996 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Vuln: Check Point Security Gateway Multiple Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/67993 *** Rails Action Pack Bug Lets Remote Users Determine if Specified Files Exist on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1031217 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031215 *** Tcpdump Multiple Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031235 *** Xen Security Advisory 110 (CVE-2014-8595) - Missing privilege level checks in x86 emulation of far branches *** --------------------------------------------- The emulation of far branch instructions (CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax) incompletely performs privilege checks. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00001.html *** Xen Security Advisory 109 (CVE-2014-8594) - Insufficient restrictions on certain MMU update hypercalls *** --------------------------------------------- MMU update operations targeting page tables are intended to be used on PV guests only. The lack of a respective check made it possible for such operations to access certain function pointers which remain NULL when the target guest is using Hardware Assisted Paging (HAP). --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00002.html *** Apple Security Advisories *** --------------------------------------------- APPLE-SA-2014-11-17-1 iOS 8.1.1 APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1 APPLE-SA-2014-11-17-3 Apple TV 7.0.2 --------------------------------------------- http://support.apple.com/kb/HT1222 *** IBM Security Bulletins related to a Vulnerability in SSLv3 (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Montag 17-11-2014
by Daily end-of-shift report 17 Nov '14

17 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-11-2014 18:00 − Montag 17-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Microsoft Updates MS14-066, (Sun, Nov 16th) *** --------------------------------------------- Microsoft updated MS14-066 to warn users about some problems caused by the additional ciphers added with the update [1]. It appears that clients who may not support these ciphers may fail to connect at all. The quick fix is to remove the ciphers by editing the respective registry entry (see the KB article link below for more details). One user reported to us performance issues when connecting from MSFT Access to SQL Server, which are related to these ciphers. Sadly, MS14-066hasnt been --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18957&rss *** EVERYTHING needs crypto says Internet Architecture Board *** --------------------------------------------- Calls for all new protocols to protect privacy, all the time, everywhere The Internet Architecture Board (IAB) has called for encryption to become the norm for all internet traffic. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/16/net_gurus_f… *** "Maskierte Apps": Apple veröffentlicht Sicherheitsrichtlinien für App-Installation *** --------------------------------------------- Mit Enterprise-Zertifikaten signierte Apps lassen sich am App Store vorbei auf iOS-Geräten installieren. Angreifer können das nutzen, um Apps durch manipulierte Versionen zu ersetzen. Mit Tipps will Apple Nutzer für Malware sensibilisieren. --------------------------------------------- http://www.heise.de/security/meldung/Maskierte-Apps-Apple-veroeffentlicht-S… *** 91. Treffen der IETF: Das Kapern von BGP-Routen verhindern *** --------------------------------------------- Immer wieder wird Internet-Verkehr unbemerkt über seltsame Wege zum eigentlichen Ziel umgeleitet. Ob es sich um Abhör-Aktionen handelt oder nur um Pannen, ist oft unklar. Nun könnten Netzbetreiber ein Mittel dagegen in die Hand bekommen. --------------------------------------------- http://www.heise.de/newsticker/meldung/91-Treffen-der-IETF-Das-Kapern-von-B… *** Attack reveals 81 percent of Tor users but admins call for calm *** --------------------------------------------- Cisco Netflow a handy tool for cheapskate attackers The Tor project has urged calm after new research found 81 percent of users could be identified using Ciscos NetFlow tool. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/deanonymiza… *** WinShock PoC clocked: But DONT PANIC... Its no Heartbleed *** --------------------------------------------- SChannel exploit opens an easily closed door Security researchers have released a proof-of-concept exploit against the SChannel crypto library flaw patched by Microsoft last week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/ms_schannel… *** Jetzt patchen: Details zur SChannel-Lücke in Windows im Umlauf *** --------------------------------------------- Administratoren sollten Patches für die kritische Sicherheitslücke in Windows, die Microsoft letzte Woche geschlossen hat, umgehend einspielen. Ansonsten riskieren sie, dass Angreifer über das Netz Schadcode einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/Jetzt-patchen-Details-zur-SChannel-Lue… *** Book review: Bulletproof SSL and TLS *** --------------------------------------------- Must-read for anyone working with one of the Internets most important protocols.I was reading Ivan Ristićs book Bulletproof SSL and TLS when rumours started to appear about an attack against SSL 3.0, which would soon become commonly known as the POODLE attack. Thanks to the book, I was quickly able to read up on the differences between SSL 3.0 and its successor, TLS 1.0, which wasnt vulnerable to the attack. Elsewhere in the book, a few pages are dedicated to protocol downgrade attacks,... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_17.xml?rss *** Holy cow! Fasthosts outage blamed on DDoS hack attack AND Windows 2003 vuln *** --------------------------------------------- Monday, bloody Monday Fasthosts five-hour collapse today has been blamed on a Distributed Denial of Service attack and a security flaw spotted on its Windows 2003 shared web server kit. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/fasthosts_o… *** Comedy spam blunder raises a smile to start the week *** --------------------------------------------- We all get lots of spam. Enough, even with junk folders and spam filters, to be more than merely annoying. So heres a spamming mistake to make you smile... --------------------------------------------- https://nakedsecurity.sophos.com/2014/11/17/comedy-spam-blunder-raises-a-sm… *** Cisco Aironet DHCP Denial of Service Vulnerabilty *** --------------------------------------------- CVE-2014-7997 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Aironet EAP Debugging Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-7998 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SSA-860967 (Last Update 2014-11-14): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Hot fix to address POODLE SSLv3 vunerability on Designer 4.0.2 AU5 SVN HTTPS access *** --------------------------------------------- Abstract: Designer 4.0.2 uses SSLv3 to access SVN repositories over HTTPS, making it vulnerable to the poodle weakness in the SSL protocol (CVE-2014-3566). This hot fix addresses the issue by disabling SSLv3 and allowing usage of TLSv1 instead.Document ID: 5195492Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:Designer402AU5HF1.zip (2.09 MB)Products:Identity Manager 4.0.2Identity Manager Roles Based Provisioning Module 4.0.2Designer for Identity... --------------------------------------------- https://download.novell.com/Download?buildid=NjOScYlrw_E~ *** Hot Patch 2 for Novell Messenger 2.2 (security fixes to Messengers server and client components) *** --------------------------------------------- https://download.novell.com/Download?buildid=I2DgXp6pwVY~ https://download.novell.com/Download?buildid=sJ4Wcd1G7Bo~ https://download.novell.com/Download?buildid=66t5njTLVmk~ *** DSA-3073 libgcrypt11 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3073 *** Vuln: GnuTLS CVE-2014-8564 Multiple Heap Corruption Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/71003 *** HPSBGN03192 rev.1 - HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. SSLv3 is enabled by default in the current HP iCAS client software. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Security Bulletin: IBM Systems Director (ISD) is affected by vulnerability in the Console Login Window (CVE-2013-5423) *** --------------------------------------------- IBM Systems Director is affected by a vulnerability in the Console Login Window (CVE-2013-5423). CVE(s): CVE-2013-5423 Affected product(s) and affected version(s): Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096563 X-Force Database: http://xforce.iss.net/xforce/xfdb/87485 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect GPFS V3.5 for Windows (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- OpenSSL vulnerabilities along with SSL 3 Fallback protection (TLS_FALLBACK_SCSV) were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by GPFS V3.5 for Windows. GPFS V3.5 for Windows has addressed the applicable CVEs and included the SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV) provided by OpenSSL. CVE(s): CVE-2014-3513, CVE-2014-3567 and CVE-2014-3568 Affected product(s) and affected version(s): OpenSSH for GPFS V3.5 for Windows Refer to the following reference --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins: Vulnerability in SSLv3 affects multiple products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_vul… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** [webapps] - MyBB Forums 1.8.2 - Stored XSS Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/35266

1 0

Tageszusammenfassung - Freitag 14-11-2014
by Daily end-of-shift report 14 Nov '14

14 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-11-2014 18:00 − Freitag 14-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Network Hijackers Exploit Technical Loophole *** --------------------------------------------- Spammers have been working methodically to hijack large chunks of Internet real estate by exploiting a technical and bureaucratic loophole in the way that various regions of the globe keep track of the worlds Internet address ranges. --------------------------------------------- http://krebsonsecurity.com/2014/11/network-hijackers-exploit-technical-loop… *** BASHLITE Affects Devices Running on BusyBox *** --------------------------------------------- When news of the Shellshock vulnerability broke out at the end of September, we spotted several attacks that leveraged the said vulnerability, thus manifesting the prevalence or even evolution on how attackers used the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects… *** OnionDuke: APT Attacks Via the Tor Network *** --------------------------------------------- Recently, research was published identifying a Tor exit node, located in Russia, that was consistently and maliciously modifying any uncompressed Windows executables downloaded through it. Naturally this piqued our interest, so we decided to peer down the rabbit hole. Suffice to say, the hole was a lot deeper than we expected! In fact, it went all the way .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002764.html *** The Art of Website Malware Removal - The Basics *** --------------------------------------------- When talking about defense against malicious hacks, the attack vector is a common topic for Information Security (InfoSec) professionals. The primary concern is to understand the anatomy of the attack and prevent it from happening .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-art-of-website-malware-removal-the-basic… *** Android 5: Lollipop verschlüsselt - noch besser *** --------------------------------------------- Mehr Sicherheit für persönliche Daten: Ab Android 5.0 aktiviert Google die automatische Verschlüsselung. Es ist nur eine von vielen zusätzlichen Sicherheitsfunktionen in Lollipop. --------------------------------------------- http://www.golem.de/news/android-5-lollipop-verschluesselt-noch-besser-1411… *** Gefälschte iOS-Apps: Apple sind keine Angriffe bekannt *** --------------------------------------------- Apple sieht nach einer Warnung vor Hacker-Angriffen mit gefälschten iOS-Apps keinen akuten Handlungsbedarf. "Uns sind keine Kunden bekannt, die von einer solchen Attacke betroffen gewesen wären", erklärte der Konzern gegenüber .. --------------------------------------------- http://www.heise.de/security/meldung/Gefaelschte-iOS-Apps-Apple-sind-keine-… *** Son of Stuxnet - The Digital Hunt for Duqu, a Dangerous and Cunning U.S.-Israeli Spy Virus *** --------------------------------------------- Boldizsar Bencsath took a bite from his sandwich and stared at his computer screen. The software he was trying to install on his machine was taking forever to load, and he still had a dozen things to do before the Fall 2011 semester began at the Budapest University of Technology and Economics, where .. --------------------------------------------- https://firstlook.org/theintercept/2014/11/12/stuxnet/ *** Android und iPhone beim Mobile Pwn2Own gefällt *** --------------------------------------------- Alle drei grossen Mobil-Betriebssysteme sind bei der diesjährigen Mobile-Ausgabe von HPs Pwn2Own-Wettbewerb erfolgreichen Hacks zum Opfer gefallen. Der Angriff auf Windows Phone ist dabei allerdings im Vergleich noch eher harmlos. --------------------------------------------- http://www.heise.de/security/meldung/Android-und-iPhone-beim-Mobile-Pwn2Own… *** SChannel Update and Experimental Vulnerability Scanner (MS14-066), (Fri, Nov 14th) *** --------------------------------------------- Just a quick update on the SChannel problem (MS14-066, CVE-2014-6321). So far, there is still no public available exploit for the vulnerability, and details are still sparse. But apparently, there is some progress in developing a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18953

1 0

Tageszusammenfassung - Donnerstag 13-11-2014
by Daily end-of-shift report 13 Nov '14

13 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-11-2014 18:00 − Donnerstag 13-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DNSSEC mit zu kurzen RSA-Schlüsseln *** --------------------------------------------- Unter anderem bei DNSSEC kommen noch sehr oft RSA-Schlüssel mit 1024 Bit zum Einsatz. Das könnte noch gefährlicher sein, als bisher angenommen, warnen Kryptologen. --------------------------------------------- http://www.heise.de/security/meldung/DNSSEC-mit-zu-kurzen-RSA-Schluesseln-2… *** Microsoft Patchday November 2014 *** --------------------------------------------- Normalerweise schreiben wir nichts über die monatlichen Patchdays von Microsoft: wir schreiben ja auch nicht, wenn ein heller Feuerball in der Früh im Osten über den Horizont steigt. Fast jeder IT Verantwortliche kennt das monatliche Spiel: Lesen, bewerten, eventuell testen dann der Rollout der Patches auf Server und Clients. Dieses .. --------------------------------------------- http://www.cert.at/services/blog/20141112130155-1300.html *** Evolution of Upatre Trojan Downloader *** --------------------------------------------- Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. We are also seeing Exploit Kits being used as a vector for Upatre infections in the wild. --------------------------------------------- http://research.zscaler.com/2014/11/evolution-of-upatre-trojan-downloader.h… *** SA-CONTRIB-2014-109 - Freelinking - Cross Site Scripting (XSS) *** --------------------------------------------- The Freelinking module implements a filter framework for easier creation of HTML links to other pages on the site or to external sites. The module does not sanitize the node title when providing a link to the node, opening a Cross Site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2373981 *** SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass *** --------------------------------------------- The Webform component module enables site admins to limit visibility or editability of webform components based on user roles. The module doesn't sufficiently check that disabled component values are not modified upon submission of the form. --------------------------------------------- https://www.drupal.org/node/2373973 *** SA-CONTRIB-2014-107 - Scheduler - Cross Site Scripting *** --------------------------------------------- The Scheduler module allows nodes to be published and unpublished on specified dates. The module allows administrators to provide additional help text on the content editing form when scheduling is enabled. The module doesn't sufficiently filter the help text which could lead to a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an .. --------------------------------------------- https://www.drupal.org/node/2373961 *** Annus HORRIBILIS! ALL the main TLS stacks now officially pwned in 2014 *** --------------------------------------------- Critical crypto 0-day not the worst of mega Nov patch batch The appearance of a critical vuln in Microsoft SChannel - patched as part of this years bumper November Patch Tuesday - means that every major TLS stack has now fallen to a critical flaw at some time during this year. --------------------------------------------- http://www.theregister.co.uk/2014/11/12/ms_crypto_library_megaflaw/ *** Use Protection if Peering Promiscuously *** --------------------------------------------- Last week, I wrote a blog post discussing the dangers of BGP routing leaks between peers, illustrating the problem using examples of recent snafus between China Telecom and Russia’s Vimpelcom. This follow-up blog post provides three additional examples of misbehaving peers and further demonstrates the impact unmonitored routes can have on Internet performance .. --------------------------------------------- http://research.dyn.com/2014/11/use-protection-if-peering-promiscuously/ *** Microsoft stopft ein fast zwei Jahrzehnte altes Sicherheitsloch *** --------------------------------------------- Microsoft hat eine seit fast zwei Jahrzehnten existierende Sicherheitslücke in seinem Windows-Betriebssystem gestopft. Microsoft stufte das Problem in einem am Mittwoch veröffentlichten Sicherheitshinweis als "ernst" ein und stellte ein Update zur Verfügung. --------------------------------------------- http://derstandard.at/2000008083067 *** Phisher zielen auf Apple-Pay-Interessenten ab *** --------------------------------------------- Mit einer auf deutschsprachige Nutzer ausgelegten E-Mail wird derzeit nach Apple-ID-Accounts geangelt. Sie laden vorgeblich zur Registrierung für den bislang nur in den USA verfügbaren iPhone-Bezahldienst ein. --------------------------------------------- http://www.heise.de/security/meldung/Phisher-zielen-auf-Apple-Pay-Interesse…

1 0

Tageszusammenfassung - Mittwoch 12-11-2014
by Daily end-of-shift report 12 Nov '14

12 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-11-2014 18:00 − Mittwoch 12-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-24) *** --------------------------------------------- A Security Bulletin (APSB14-24) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1141 *** MS14-NOV - Microsoft Security Bulletin Summary for November 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-NOV *** Assessing Risk for the November 2014 Security Updates *** --------------------------------------------- Today we released fourteen security bulletins addressing 33 unique CVEs. Four bulletins have a maximum severity rating of Critical, eight have a maximum severity rating of Important, and two have a maximum severity rating of Moderate. This table is designed to help you prioritize .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-no… *** Erpressung mit Kinderpornos: Exploit-Kit Angler verteilt Android-Trojaner *** --------------------------------------------- Ein Virenforscher hat einen perfiden Schädling entdeckt, der Android-Nutzer mit kinderpornografischem Material zu erpressen versucht. Er wird bereits über das verbreitete Exploit-Kit Angler verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Erpressung-mit-Kinderpornos-Exploit-Ki… *** Rockwell Automation Connected Components Workbench ActiveX Component Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two custom ActiveX Component vulnerabilities in Rockwell Automation's Connected Components Workbench application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-294-01 *** Security: Dutzende Schwachstellen in Newsletter-Diensten behoben *** --------------------------------------------- Die Sicherheitslücken reichen von XSS-Fehlern über unsichere Formulare bis hin zu SQL-Injection-Schwachstellen: In drei weit verbreiteten E-Mail-Marketing- und Newsletter-Diensten haben IT-Sicherheitsexperten zahlreiche Schwachstellen entdeckt. Sie sind in Absprache mit den Herstellern inzwischen behoben worden. --------------------------------------------- http://www.golem.de/news/security-dutzende-schwachstellen-in-newsletter-die… *** MSRT November 2014 - Tofsee *** --------------------------------------------- This month we added the Win32/Tofsee and Win32/Zoxpng malware families to the Malicious Software Removal Tool. Zoxpng is a backdoor component that can execute remote commands from a malicious hacker. It is related to Win32/Hikiti and the other threats added to the MSRT last .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/11/msrt-november-2014-tofse… *** The Psychology Behind Why Websites Get Hacked *** --------------------------------------------- It's an everyday conversation for security professionals that interact with everyday website owners. The one where we have to explain that just because everything seems fine, doesn't mean that the best security practices .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-psychology-behind-why-websites-get-hacke… *** Bugtraq: CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533968 *** SAP Governance, Risk and Compliance (SAP GRC) Multiple Critical Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110071 *** Expired antimalware software is nearly as unsafe as having no protection at all *** --------------------------------------------- Analyzing data to find the root cause of infections has been a long-standing focus of the MMPC. One area weve been investigating is the correlation between endpoint protection and infection rates. Back in version 14 of the Security Intelligence Report (SIRv14), we first published data on infection .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/12/expired-antimalware-soft… *** Only Half of USB Devices Have an Unpatchable Flaw, But No One Knows Which Half *** --------------------------------------------- After testing the USB controller chips of all eight major manufacturers, the researcher who first discovered BadUSB has some good news and some bad news. The post .. --------------------------------------------- http://www.wired.com/2014/11/badusb-only-affects-half-of-usbs/

1 0

Tageszusammenfassung - Dienstag 11-11-2014
by Daily end-of-shift report 11 Nov '14

11 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-11-2014 18:00 − Dienstag 11-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Communications Manager Remote Mobile Access Subsystem Vulnerability *** --------------------------------------------- A vulnerability in the Remote Mobile Access Subsystem in Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to supply a crafted Transport Layer Security (TLS) certificate that may be accepted by the affected device. The vulnerability is due to improper validation of the SAN field of a TLS certificate. An attacker could exploit this vulnerability by impersonating a VCS core device and supplying a certificate signed by a certificate authority trusted by the Cisco Unified CM that contains crafted values in the SAN field. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Lessons Learn from attacks on Kippo honeypots, (Mon, Nov 10th) *** --------------------------------------------- A number of my fellow Handlers have discussed Kippo, a SSH honeypot that can record adversarial behaviour, be it human or machine. Normal behaviour against my set of Kippo honeypots is randomly predictable; a mixture of known bad IP ranges, researchers or from behind TOR scanning and probing, would be attackers manually entering information from their jump boxes .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18935 *** Hackerangriff auf US-Post *** --------------------------------------------- Der staatliche US Postal Service ist Opfer eines Hackerangriffs geworden. Dabei hätten die Angreifer möglicherweise Zugriff auf persönliche Daten von mehr als 800.000 Beschäftigten sowie von Kunden erhalten, die den Kundendienst per Mail oder Telefon kontaktiert hätten, teilte das Unternehmen .. --------------------------------------------- http://derstandard.at/2000007973390 *** iOS: Schwachstelle erlaubt Installation manipulierter Apps *** --------------------------------------------- Zum zweiten Mal innerhalb weniger Tage entdeckten Datenexperten eine potenzielle Angriffsmethode für Malware in Apples mobilem Betriebssystem iOS. Die IT-Sicherheitsfirma Fireeye warnt vor einer Infizierung von iPhones oder iPads mit einer Methode namens Masque Attack, die auch ohne Jailbreak funktioniert. Dabei .. --------------------------------------------- http://www.golem.de/news/ios-schwachstelle-erlaubt-installation-manipuliert… *** Operation Poisoned Handover: Unveiling Ties Between APT Activity in Hong Kong's Pro-Democracy Movement *** --------------------------------------------- As the pro-democracy movement in Hong Kong has continued, we've been watching for indications of confrontation taking place in cyberspace. Protests began in September and have continued to escalate. In recent weeks, attackers have launched .. --------------------------------------------- http://www.fireeye.com/blog/technical/2014/11/operation-poisoned-handover-u… *** Old-time phishing scams are working just fine, Google finds *** --------------------------------------------- A new Google study has found that the true masterpieces of phishing are successful 45% of the time. Its just another example of how phishers may be old dogs, but they can sure learn new tricks. --------------------------------------------- http://nakedsecurity.sophos.com/2014/11/11/old-time-phishing-scams-are-work… *** Stuxnet: Zero Victims *** --------------------------------------------- We collected Stuxnet files for two years. After analyzing more than 2,000 of these files, we were able to identify the organizations that were the first victims of the worms different variants in 2009 and 2010. Perhaps an analysis of their activity can explain why they became "patients zero" (the original, or zero, victims). --------------------------------------------- http://securelist.com/analysis/publications/67483/stuxnet-zero-victims/ *** Important EMET 5.1 Update. Apply before Patches today, (Tue, Nov 11th) *** --------------------------------------------- Microsoft yesterday release EMET 5.1 . One particular sentence in Microsofts blog post suggests that you should apply this update (if you are using EMET) BEFORE you apply the Interent Explorer patch Microsoft is going to release in a couple of hours: ">If you are using Internet Explorer 11, either on Windows 7 or Windows 8.1, and have deployed EMET 5.0, it is .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18939

1 0

Tageszusammenfassung - Montag 10-11-2014
by Daily end-of-shift report 10 Nov '14

10 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-11-2014 18:00 − Montag 10-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** WireLurker zielt auch als Windows-Trojaner auf iOS-Geräte ab *** --------------------------------------------- Nebem dem Mac-Trojaner haben Sicherheitsforscher inzwischen auch eine Windows-Ausführung aufgespürt. Sie hat es ebenfalls auf angeschlossene iPhones oder iPads abgesehen und schleust auf diesen Malware ein. --------------------------------------------- http://www.heise.de/security/meldung/WireLurker-zielt-auch-als-Windows-Troj… *** VU#432608: IBM Notes Traveler for Android transmits user credentials over HTTP *** --------------------------------------------- The IBM Notes Traveler application for Android does not enforce the use of HTTPS for transmitting user credentials, which can allow an attacker to obtain this information. --------------------------------------------- http://www.kb.cert.org/vuls/id/432608 *** Malicious iframe Injector Found in Adobe Flash File (.SWF) *** --------------------------------------------- Finding malware in Adobe Flash files (.swf) is nothing new, but it usually affects personal computers, not servers. Typically, a hidden iframe is used to drop a binary browser exploit with .SWF files, infecting the client machine. This time we saw the opposite, where a binary .SWF file injects an invisible iframe. This .. --------------------------------------------- http://blog.sucuri.net/2014/11/malicious-injector-in-swf-adobe-flash-file.h… *** Keine Entwarnung beim Router-Farming *** --------------------------------------------- Laut Mitarbeitern der tschechichen CZ.NIC Labs gibt es weltweit mehr als eine halbe Million Router, die ihre Konfiguration und damit das Zugangspasswort unbemerkt herausgeben. Angreifer können Nutzer der Router auf Phishing-Seiten umleiten. --------------------------------------------- http://www.heise.de/security/meldung/Keine-Entwarnung-beim-Router-Farming-2… *** Security: Bilder tausender unsicherer Webcams im Internet zu sehen *** --------------------------------------------- Menschen zu Hause in ihrem Fernsehsessel oder bei der Arbeit am Rechner: Das zeigt eine Webseite - ohne dass die Betroffenen davon wissen. Die unbekannten Betreiber haben dafür weltweit tausende Webcams angezapft. (Datenschutz, Netzwerk) --------------------------------------------- http://www.golem.de/news/security-tausende-unsichere-webcams-im-internet-zu… *** Einfache Lösung zum Live-Patching des Linux-Kernels *** --------------------------------------------- Red-Hat- und Suse-Mitarbeiter arbeiten gemeinsam an einer Live-Patching-Lösung für den Linux-Kernel. Erster Code wurde jetzt veröffentlicht, kann aber weniger Lücken stopfen als Kpatch und kGraft. --------------------------------------------- http://www.heise.de/security/meldung/Einfache-Loesung-zum-Live-Patching-des… *** BND-Kauf von Zero Days: CCC warnt vor "Mitmischen im Schwachstellen-Schwarzmarkt" *** --------------------------------------------- "An Dreistigkeit kaum zu überbieten": Der Chaos Computer Club kritisiert die angeblichen Pläne des BND zum Ankauf von bislang unbekannten Sicherheitslücken. Das Geld liesse sich viel besser verwenden. --------------------------------------------- http://www.golem.de/news/bnd-kauf-von-zero-days-ccc-warnt-vor-mitmischen-im… *** The Dangers of Hosted Scripts - Hacked jQuery Timers *** --------------------------------------------- Google blacklisted a client's website claiming that malicious content was being displayed from forogozoropoto.2waky.com. A scan didn't reveal anything suspicious. The next step was to check all third-party scripts on the website. Soon we found the offending script. It was hxxp://jquery.offput.ca/js/jquery.timers.js - a jQuery Timers plugin that was .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-dangers-of-hosted-scripts-hacked-jquery-… *** Removing Wirelurker from Your iOS or OSX Device *** --------------------------------------------- In an earlier blog post, we tackled what Wirelurker malware is and its security implications and risks for iOS and OSX devices. Within hours of the discovery of this malware, a Windows-based malware (detected as TROJ_WIRELURK.A) that performs the same attack was also seen in the wild. In this blog post, we'dd like .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/removing-wirelur… *** Angriff im Hotel-Netz *** --------------------------------------------- Unter dem Namen Darkhotel berichtet Kaspersky über eine Gruppe von Angreifern mit einer ungewöhnlichen Vorgehensweise: Sie attackieren ihre Opfer auf Auslandsreisen im Netz des Hotels. --------------------------------------------- http://www.heise.de/security/meldung/Angriff-im-Hotel-Netz-2445108.html *** TA14-310A: Microsoft Ending Support for Windows Server 2003 Operating System *** --------------------------------------------- Microsoft is ending support for the Windows Server 2003 operating system on July 14, 2015.[1] After this date, this product will no longer receive:Security patches that help protect PCs from harmful viruses, spyware, and other malicious software. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-310A *** Verschlüsselung: Parallele Angriffe auf RSA-Schlüssel mit 1.024 Bit *** --------------------------------------------- Kurze RSA-Schlüssel lassen sich schneller und günstiger brechen, wenn man einen Angriff auf viele Schlüssel gleichzeitig durchführt. Insbesondere bei DNSSEC sind RSA-Schlüssel mit 1.024 Bit noch in breitem Einsatz. --------------------------------------------- http://www.golem.de/news/verschluesselung-parallele-angriffe-auf-rsa-schlue… *** EMET 5.1 is available *** --------------------------------------------- Today, we're releasing the Enhanced Mitigation Experience Toolkit (EMET) 5.1 which will continue to improve your security posture by providing increased application compatibility and hardened mitigations. You can download EMET 5.1 from microsoft.com/emet. Following is the list of the main changes and improvements: Several application compatibility issues .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/10/emet-5-1-is-available.aspx

1 0

Tageszusammenfassung - Freitag 7-11-2014
by Daily end-of-shift report 07 Nov '14

07 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-11-2014 18:00 − Freitag 07-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Crypto 101 - free book resource, (Thu, Nov 6th) *** --------------------------------------------- Regular reader and contributor Gebhard sent us a pointer to Crypto 101, an introductory course on cryptography, freely available for programmers of all ages and skill levels byLaurens Van Houtven (lvh) available for everyone, for free, forever. Its a pre-release PDF read of a project that will be released in more formats later. The Crypto 101 course allows you to learn by doing and includes everything you need to understand complete systems such as SSL/TLS: block ciphers, stream ciphers, hash... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18925&rss *** Metasploit Weekly Wrapup: Another Android Universal XSS *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/06/metasploi… *** Navy gunners unphased by "integer overflow bug" concerns *** --------------------------------------------- Today, Naked Security received an out-of-the-ordinary email... ..from a vacationing coder with a penchant for fitting geekiness into regular life! We loved his story. We think you will too. --------------------------------------------- http://nakedsecurity.sophos.com/2014/11/06/navy-gunners-unphased-by-integer… *** Slides zum Thema DDoS *** --------------------------------------------- Slides zum Thema DDoS | 5. November 2014 | Das Abwehramt des österreichischen Bundesheeres veranstaltet jedes Jahr eine Konferenz zum Thema IKT-Sicherheit. Dieses Jahr wurde ich eingeladen, einen Vortrag zum Thema DDoS zu halten.In meiner Präsentaion verweise ich auf diverse externe Dokumente, daher wurde ich gebeten, die Slides zum zum Download anzubieten. Autor: Otmar Lendl --------------------------------------------- http://www.cert.at/services/blog/20141105124802-1293.html *** Advance Notification Service for the November 2014 Security Bulletin Release *** --------------------------------------------- Today, we provide advance notification for the release of 16 Security Bulletins. Five of these updates are rated Critical, nine are rated as Important, and two are rated Moderate in severity. These updates are for Microsoft Windows, Internet Explorer, Office, Exchange, .NET Framework, Internet Information Services (IIS), Remote Desktop Protocol (RDP), Active Directory Federation Services (ADFS), Input Method Editor (IME) (Japanese), and Kernel Mode Driver (KMD). As per our monthly process, weve --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/11/06/advance-notification-ser… *** Chinese Routing Errors Redirect Russian Traffic *** --------------------------------------------- In recent weeks, Russian President Vladimir Putin announced a plan to enact measures to protect the Internet of Russia. In a speech to the Russian National Security Council he said, "we need to greatly improve the security of domestic communications networks and information resources." Perhaps he should add Internet routing security to his list because,... --------------------------------------------- http://research.dyn.com/2014/11/chinese-routing-errors-redirect-russian-tra… *** Frankfurt | 04.12.2014 - SAVE us from IP Spoofing and Prefix Hijacking *** --------------------------------------------- DDoS reflection attacks are promoted by IP spoofing and there have been several incidents in the last couple of years where huge networks or whole countries were disconnected from the internet after BGP hijacking. Nevertheless there are countermeasure like RPKI, BCP38 and S.A.V.E that not only protect your network but also help to create a more robust internet. Matthias Wählisch (FU Berlin) and Gert Döring (Space.Net) are going to present these approaches and open the discussion with... --------------------------------------------- http://de-cix.eco.de/2014/events/4-12-frankfurt-spoofing-and-hijacking.html *** Security Holes in Corporate Networks: Network Vulnerabilities *** --------------------------------------------- In this blogpost, we will review in detail the possible vectors for an attack launched on a corporate network from an infected computer within it. --------------------------------------------- http://securelist.com/blog/research/67452/security-holes-in-corporate-netwo… *** Combat Blackhat SEO Infections with SEO Insights *** --------------------------------------------- Blackhat SEO spam is the plague of the internet, and the big search engines take it seriously. One of the worst spam tactics on the internet is becoming more common every day: innocent websites are hacked, and their best pages begin linking to spam. These Blackhat SEO spam tactics are fighting for expensive, high-competition keywords... --------------------------------------------- http://blog.sucuri.net/2014/11/combat-blackhat-seo-infections-with-seo-insi… *** Macro malware on the rise again *** --------------------------------------------- Users taught that having to enable enhanced security features is no big deal.When I joined Virus Bulletin almost eight years ago, macro viruses were already a thing of the past, like porn diallers or viruses that did funny things to the characters on your screen: threats that were once a real problem, but that we didnt have to worry about any longer.A few years ago, I even heard a malware researcher bemoan the fact that "kids these days" didnt even know how to analyse macro viruses. --------------------------------------------- http://www.virusbtn.com/blog/2014/11_07.xml?rss *** Yosemite Beta *** --------------------------------------------- When we first announced that future versions of GPGMail would be available for a small fee, we were pretty scared about the reactions. Despite our expectations, weve received mostly positive responses and we would really like to thank you for that. Today were happy to announce that the first beta of GPGMail for Yosemite is finally ready. --------------------------------------------- https://gpgtools.org/?yosemite *** GnuPG unterstützt Krypto auf Elliptischen Kurven *** --------------------------------------------- Das soeben veröffentlichte Release GnuPG 2.1.0 bringt einige neue Funktionen, bessere Abläufe und es schneidet auch ein paar alte Zöpfe ab. Der 2.0er-Zweig wird als stabile Version weiter gepflegt. --------------------------------------------- http://www.heise.de/security/meldung/GnuPG-unterstuetzt-Krypto-auf-Elliptis… *** Belkin flings out patch after Metasploit module turns guests to admins *** --------------------------------------------- Open guest networks turned on by default Belkin has patched a vulnerability in a dual band router that allowed attackers on guest networks to gain root access using an automated tool. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/07/belkin_flin… *** VB2014 video: Attack points in health apps & wearable devices - how safe is your quantified self? *** --------------------------------------------- Health apps and wearable devices found to make many basic security mistakes."I know a lot of you have a Fitbit device."The geeks attending VB conferences tend to like their gadgets, and many of them have the latest ones, so the claim made by Candid Wüest at the beginning of his VB2014 last-minute presentation Attack points in health apps & wearable devices - how safe is your quantified self? was bound to be accurate. But the Symantec researcher really did know how many... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_07a.xml?rss *** Security: Tausende unsichere Webcams im Internet zu sehen *** --------------------------------------------- Über tausende Webcams sind derzeit Menschen zu Hause in ihrem Fernsehsessel oder bei der Arbeit am Rechner zu sehen - ohne dass sie davon wissen. Die unbekannten Betreiber einer Webseite haben dafür weltweit Überwachungskameras angezapft. --------------------------------------------- http://www.golem.de/news/security-tausende-unsichere-webcams-im-internet-zu… *** Vuln: requests-kerberos requests_kerberos/kerberos_.py Remote Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70909 *** SOL15792: Path MTU discovery vulnerability CVE-2004-1060 *** --------------------------------------------- Description: Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Dont Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." (CVE-2004-1060) Impact: The BIG-IP system may be vulnerable to denial-of-service (DoS) attacks. --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15792.html *** Bugtraq: Open-Xchange Security Advisory 2014-11-07 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533936 *** [R1] OpenSSL Vulnerabilities (20141015) Affect Tenable Products *** --------------------------------------------- November 7, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-11 *** RSA Web Threat Detection SQL Injection *** --------------------------------------------- Topic: RSA Web Threat Detection SQL Injection Risk: Medium Text:ESA-2014-135: RSA Web Threat Detection SQL Injection Vulnerability EMC Identifier: ESA-2014-135 CVE Identifier: C... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110032 *** PHP date_from_ISO8601() buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98522 *** DSA-3067 qemu-kvm *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3067 *** DSA-3066 qemu *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3066 *** DSA-3065 libxml-security-java *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3065 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 6-11-2014
by Daily end-of-shift report 06 Nov '14

06 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-11-2014 18:00 − Donnerstag 06-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Retefe with a new twist *** --------------------------------------------- A few months ago, we blogged about the banking trojan Retefe (Blog post in German) that was and still is targeting Switzerland. First off, Retefe is different because it only targets Switzerland, Austria and Sweden (and sometimes Japan). Contrast this... --------------------------------------------- http://securityblog.switch.ch/2014/11/05/retefe-with-a-new-twist/ *** ENISA calls for Expression of Interest for Membership of the Permanent Stakeholders' Group *** --------------------------------------------- The Executive Director of European Union Agency for Network and Information Security (ENISA) calls for Expression of Interest for Membership of the Permanent Stakeholders' Group (PSG) to be assigned from February 2015 to August 2017. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-calls-for-expression-… *** New ENISA report on Cyber Crisis Cooperation and Management *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-publishes-new-report-on-c… *** WireLurker malware infects iOS devices through OS X *** --------------------------------------------- Non-jailbroken devices infected via enterprise provisioning program.Researchers at Palo Alto Networks have published a research paper (PDF) analysing the WireLurker malware that runs on Mac OS X, and which is then used to further infect iOS devices connected to an infected machine.WireLurker is found to have infected 467 apps on the Maiyadi App Store, a third-party store based in China. Infected apps have been downloaded more than 350,000 times. Malware targeting OS X has become increasingly... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_06.xml?rss *** VB2014 paper: DMARC - how to use it to improve your email reputation *** --------------------------------------------- Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added DMARC - how to use it to improve your email reputation, by Microsofts Terry Zink.Email is a 30-year-old protocol, designed at a time when the Internet was much smaller and you could basically trust anyone. As a consequence, spammers and phishers can easily send email --------------------------------------------- http://www.virusbtn.com/blog/2014/11_06a.xml?rss *** ZMap 1.2.1 - The Internet Scanner *** --------------------------------------------- ZMap is an open-source network scanner that enables researchers to easily perform Internet-wide network studies. With a single machine and a well provisioned network uplink, ZMap is capable of performing a complete scan of the IPv4 address space in under 45 minutes, approaching the theoretical limit of gigabit Ethernet. --------------------------------------------- http://hack-tools.blackploit.com/2014/11/zmap-121-internet-scanner.html *** ICMP Reverse Shell *** --------------------------------------------- A reverse shell is a type of shell in which the target machine communicates back to the attacking machine. The attacking machine has a listener port on which it receives the connection, which by using, code or command execution is achieved. --------------------------------------------- http://resources.infosecinstitute.com/icmp-reverse-shell/ *** ZDI-14-373: Trend Micro InterScan Web Security Virtual Appliance Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to read files from the underlying operating system on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance web application authentication is required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-373/ *** Vuln: Dell EqualLogic CVE-2013-3304 Directory Traversal Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70760 *** Bugtraq: ESA-2014-135: RSA Web Threat Detection SQL Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533912 *** Bugtraq: [The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser *** --------------------------------------------- http://www.securityfocus.com/archive/1/533916 *** Cisco Unity Connection Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-7988 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** [R1] PHP Integer Overflow Affects Tenables SecurityCenter *** --------------------------------------------- November 5, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-10 *** [2014-11-06] XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection *** --------------------------------------------- Attackers are able to perform denial-of-service attacks against the Endpoint Protection Manager which directly impacts the effectiveness of the client-side endpoint protection. Furthermore, session identifiers of users can be stolen to impersonate them and gain unauthorized access to the server. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** IBM Security Bulletin: Security vulnerabilities in Node.js modules affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-6394, CVE-2014-7191) *** --------------------------------------------- Security vulnerabilities have been reported for some dependent Node.js modules. IBM Business Process Manager includes a stand-alone tool for editing configuration properties files that is based on open source Node.js technology. CVE(s): CVE-2014-6394 and CVE-2014-7191 Affected product(s) and affected version(s): IBM Business Process Manager Express V8.5.5 IBM Business Process Manager Standard V8.5.5 IBM Business Process Manager Advanced V8.5.5 Refer to the following reference --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple Reflected XSS Vulnerabilities in Tivoli Netcool/Impact *** --------------------------------------------- IBM Tivoli Netcool Impact is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. CVE(s): CVE-2014-6161 Affected product(s) and affected version(s): IBM Tivoli Netcool Impact 6.1.1 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21689130 X-Force Database: http://xforce.iss.net/xforce/xfdb/97710 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 5-11-2014
by Daily end-of-shift report 05 Nov '14

05 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-11-2014 18:00 − Mittwoch 05-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tool Tip: vFeed, (Wed, Nov 5th) *** --------------------------------------------- I have had a number of occasions lately to use or talk about vFeed from Toolswatch.org (@toolwatch). NJ a useful Python CLI tool that pulls CVEs and other Mitre datasets. From the vFeed Github repo: vFeed framework is an open source naming scheme concept that provides extra structured detailed third-party references and technical characteristics for a CVE entry through an extensible XML schema. It also improves the reliability of CVEs by providing a flexible and comprehensive vocabulary for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18917&rss *** Perfider Schädling haust in der Registry *** --------------------------------------------- Viren sind typischerweise in Dateien Zuhause, die mal besser und mal schlechter auf dem System versteckt sind. Ein neuer Trojaner kommt ohne Dateien aus, wodurch man ihn schwer aufspüren kann. Er wird seit kurzem auch über ein Exploit-Kit verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Perfider-Schaedling-haust-in-der-Regis… *** Which Messaging Technologies Are Truly Safe and Secure? *** --------------------------------------------- In the face of widespread Internet data collection and surveillance, we need a secure and practical means of talking to each other from our phones and computers. Many companies offer "secure messaging" products - but how can users know if these systems actually secure? The Electronic Frontier Foundation (EFF) released its Secure Messaging Scorecard today, evaluating dozens of messaging technologies on a range of security best practices. --------------------------------------------- https://www.eff.org/press/releases/which-messaging-technologies-are-truly-s… *** Crypto collision used to hijack Windows Update goes mainstream *** --------------------------------------------- Final nail in the coffin for the MD5 hash The cryptographic hash collision attack used by cyberspies to subvert Microsofts Windows Update has gone mainstream, revealing that MD5 is hopelessly broken. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/05/md5_hash_co… *** New Phishing Technique Outfoxes Site Owners: Operation Huyao *** --------------------------------------------- We've found a new phishing technique targeting online shopping sites that may significantly change the threat landscape for phishing sites. Conventional phishing sites require an attacker to replicate the targeted site; a more accurate copy is more likely to fool intended victims. This technique we found allows for the creation of nearly perfect copies... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/SfVy0fROxfs/ *** Novembers Issue of the OUCH Newsletter is available, covering Social Engineering! http://www.securingthehuman.org/ouch, (Wed, Nov 5th) *** --------------------------------------------- -- Alex Stanford - GIAC GWEB GSEC, Research Operations Manager, SANS Internet Storm Center (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18921&rss *** Mehr Updates gegen die UEFI-Sicherheitslücke *** --------------------------------------------- Für die vor Monaten entdeckte Sicherheitslücke in UEFI-Firmware stellen nun mehr PC- und Mainboard-Hersteller Patches bereit, andere geben Entwarnung - und manche forschen noch. --------------------------------------------- http://www.heise.de/newsticker/meldung/Mehr-Updates-gegen-die-UEFI-Sicherhe… *** .onion-Domains: Falsches Zertifikat für Tor-Facebook *** --------------------------------------------- Einem Sicherheitsforscher ist es gelungen, ein gefälschtes Zertifikat für die .onion-URL von Facebook ausstellen zu lassen. Facebook ist seit kurzem über das Tor-Netzwerk erreichbar. (Soziales Netz, Facebook) --------------------------------------------- http://www.golem.de/news/onion-domains-falsches-zertifikat-fuer-tor-faceboo… *** Bugtraq: CVE-2014-6617 Softing FG-100 Backdoor Account *** --------------------------------------------- http://www.securityfocus.com/archive/1/533902 *** Bugtraq: KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read *** --------------------------------------------- KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read --------------------------------------------- http://www.securityfocus.com/archive/1/533901 *** Cross-Site Scripting vulnerability in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting. --------------------------------------------- http://www.typo3.org/news/article/cross-site-scripting-vulnerability-in-ext… *** Advisory (ICSA-14-308-01) ABB RobotStudio and Test Signal Viewer DLL Hijack Vulnerability *** --------------------------------------------- Ivan Sanchez of WiseSecurity Team has identified a dll hijack vulnerability in the ABB RobotStudio and Test Signal Viewer applications. ABB has produced new versions that mitigate this vulnerability. Mr. Sanchez has tested the new version to validate that it resolves the vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-308-01 *** Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF *** --------------------------------------------- Topic: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF Risk: Medium Text:<!-- # Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF # Exploit author: Emmanuel Law # Public ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110021 *** Multiple Vulnerabilities in Cisco Small Business RV Series Routers *** --------------------------------------------- cisco-sa-20141105-rv --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3064 php5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3064 *** FreeBSD setlogin() Lets Local Users Obtain Portions of Kernel Memory *** --------------------------------------------- http://www.securitytracker.com/id/1031169 *** FreeBSD OpenSSH Child Process Deadlock Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031168 *** IBM Security Bulletins related to POODLE (CVE-2014-3566) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 4-11-2014
by Daily end-of-shift report 04 Nov '14

04 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-11-2014 18:00 − Dienstag 04-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Smuggler - An interactive 802.11 wireless shell without the need for authentication or association *** --------------------------------------------- I've always been fascinated by wireless communications. The ability to launch seemingly invisible packets of information up into the air without even the need to consider aerodynamics itself seems like some kind of magic. In my quest to become a wireless wizard I started looking at the 802.11 wireless protocol to find out a little more about it. I had always noticed when looking at wireless management frames in various packet dumps that a wealth of additional (and somewhat optional)... --------------------------------------------- http://blog.spiderlabs.com/2014/11/smuggler-an-interactive-80211-wireless-s… *** Some samples in Rotten Tomato campaign not effectively executed *** --------------------------------------------- Researchers at Sophos provided additional details on the malware used in the attacks. --------------------------------------------- http://www.scmagazine.com/some-samples-in-rotten-tomato-campaign-not-effect… *** Whois someone else?, (Tue, Nov 4th) *** --------------------------------------------- A couple of weeks ago, I already covered the situation where a cloud IP address gets re-assigned, and the new owner still sees some of your traffic. Recently, one of our clients had the opposite problem: They had changed their Internet provider, and had held on to the old address range for a decent decay time. They even confirmed with a week-long packet capture that there was no afterglow on the link, and then dismantled the setup. Until last week, when they got an annoyed rant into their... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18911&rss *** New version of Backoff detected, malware variant dubbed ROM *** --------------------------------------------- Researchers at Fortinet detailed the new variant on Monday, and urged businesses to keep their AV up to date. --------------------------------------------- http://www.scmagazine.com/new-version-of-backoff-detected-malware-variant-d… *** Practical Reflected File Download and JSONP *** --------------------------------------------- This week introduced us to a new web attack vector, which the researcher dubbed "Reflected File Download" [RFD] . It's a very interesting attack which has potential to do some severe damage, especially in social engineering contexts. Full details of the reflected file download attack can be found here:... --------------------------------------------- http://blog.davidvassallo.me/2014/11/02/practical-reflected-file-download-a… *** Content Security Policy Builder *** --------------------------------------------- Content Security Policy is a new HTML5 web security feature. Your website can now explicitly tell browsers what sources of content - images, scripts, frames etc - are to be trusted. A new Content-Security-Policy HTTP header is used to announce that policy. --------------------------------------------- https://cspbuilder.info/static/ *** Exploiting CVE-2014-4113 on Windows 8.1 *** --------------------------------------------- On the 14th of October 2014 both CrowdStrike1 and FireEye2 published a blog post describing a new zero-day privilege escalation vulnerability on Windows. The CrowdStrike article explains that this new vulnerability was identified in the process of tracking a supposedly highly advanced adversary group named HURRICANE PANDA and has been actively exploited in the wild for at least five month. ... So I was curious if and how the vulnerability might be exploitable on the most current version of... --------------------------------------------- http://dl.packetstormsecurity.net/papers/attack/CVE-2014-4113.pdf *** Google Releases Nogotofail Tool to Test Network Security *** --------------------------------------------- The last year has produced a rogues' gallery of vulnerabilities in transport layer security implementations and new attacks on the key protocols, from Heartbleed to the Apple gotofail flaw to the recent POODLE attack. To help developers and security researchers identify applications that are vulnerable to known SSL/TLS attacks and configuration problems, Google is releasing a... --------------------------------------------- http://threatpost.com/google-releases-nogotofail-tool-to-test-network-secur… *** Customer confusion over new(ish) gTLDs targeting financial services *** --------------------------------------------- Introduction For the last decade and a bit, banking customers have been relentlessly targeted by professional phishers with a never-ending barrage of deceitful emails, malicious websites and unstoppable crimeware - each campaign seeking to relieve the victim of their online banking credentials and funds. In the battle for the high-ground, many client-side and server-side security technologies have been invented and consequently circumvented over the years. Now we're about to enter a... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/11/customer-confusion-over-newish-gtl… *** Linksys Patches (Most) Routers Running SMART Wi-Fi Firmware *** --------------------------------------------- Linksys released updates for routers running its SMART Wi-Fi firmware, patching vulnerabilities leading to credential theft and information disclosure. Two popular models, however, remain unpatched. --------------------------------------------- http://threatpost.com/linksys-patches-most-routers-running-smart-wi-fi-firm… *** GNU Binutils peXXigen.c denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98420 *** ZDI-14-371: (0Day) Denon AVR-3313CI Friendlyname Persistent Cross-Site Scripting Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to insert persistent JavaScript on vulnerable installations of the Denon AVR-3313CI audio/video receivers web portal. Authentication is not required to persist the attack. However, user interaction is required to exploit this vulnerability in that the target must visit a malicious page. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-371/ *** ZDI-14-372: (0Day) Visual Mining NetCharts Server File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Visual Mining NetCharts Server. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-372/ *** Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability *** --------------------------------------------- cisco-sa-20130109-uipphone --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3063 quassel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3063 *** DSA-3062 wget *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3062

1 0

Tageszusammenfassung - Montag 3-11-2014
by Daily end-of-shift report 03 Nov '14

03 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 31-10-2014 18:00 − Montag 03-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** CVE-2014-4115 Analysis: Malicious USB Disks Allow For Possible Whole System Control *** --------------------------------------------- One of the bulletins that was part of the October 2014 Patch Tuesday cycle was MS14-063 which fixed a vulnerability in the FAT32 disk partition driver that could allow for an attacker to gain administrator rights on affected systems, with only a USB disk with a specially modified file system. This vulnerability as also designated... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/E2Ur54TO5Qo/ *** CSAM Month of False Positives: Appropriately Weighting False and True Positives, (Fri, Oct 31st) *** --------------------------------------------- This is a guest diary submitted by Chris Sanders. We will gladly forward any responses or please use our comment/forum section to comment publicly.">">If you work with any type of IDS, IPS, or other">detection technology then you have to deal with false positives. One">common">mistake I see people make when managing their indicators and rules is">relying">solely on the rate of false positives that are observed. While... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18905&rss *** CVE-2012-0158 continues to be used in targeted attacks *** --------------------------------------------- 30-month old vulnerability still a popular way to infect systems.If all you have to worry about are zero-day vulnerabilities, you have got things pretty well sorted. Although it is true that sometimes zero-days are being used to deliver malware (such as the recent use of CVE-2014-4114 by the SandWorm group), in many cases even the more targeted attacks get away with using older, long patched vulnerabilities, exploiting the fact that many users and organisations dont patch as quickly as they --------------------------------------------- http://www.virusbtn.com/blog/2014/10_31a.xml?rss *** Reversing D-Link's WPS Pin Algorithm *** --------------------------------------------- While perusing the latest firmware for D-Link's DIR-810L 80211ac router, I found an interesting bit of code in sbin/ncc, a binary which provides back-end services used by many other processes on the device, including the HTTP and UPnP servers: I first began examining this particular piece of code with the... --------------------------------------------- http://www.devttys0.com/2014/10/reversing-d-links-wps-pin-algorithm/ *** Adobe: Aktuelle Flash-Sicherheitslücken bereits in Exploit-Kits *** --------------------------------------------- Es wird wieder Zeit, sich bei Sicherheitslücken verstärkt um Adobes Flashplayer zu kümmern. Zwei gerade erst abgesicherte und gefährliche Sicherheitslöcher sind bereits in aktuelle Exploit-Kits integriert worden. Eset glaubt sogar, dass Flash nun wieder Java in der Beliebtheitsskala ablöst. --------------------------------------------- http://www.golem.de/news/adobe-aktuelle-flash-sicherheitsluecken-bereits-in… *** justniffer a Packet Analysis Tool, (Mon, Nov 3rd) *** --------------------------------------------- Are you looking for another packet sniffer? justniffer is a packet sniffer with some interesting features. According to the author, this packet sniffer can rebuild and save HTTP file content sent over the network. It uses portions of Linux kernel source code for handling all TCP/IP stuff. Precisely, it uses a slightly modified version of the libnids libraries that already include a modified version of Linux code in a more reusable way.[1] The tarball can be downloaded here and a package is --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18907&rss *** BE2 Custom Plugins, Router Abuse, and Target Profiles *** --------------------------------------------- The BlackEnergy malware is crimeware turned APT tool and is used in significant geopolitical operations lightly documented over the past year. An even more interesting part of the BlackEnergy story is the relatively unknown custom plugin capabilities to attack ARM... --------------------------------------------- http://securelist.com/blog/research/67353/be2-custom-plugins-router-abuse-a… *** Security: Sicherheitslücke in Mac OS X 10.10 entdeckt *** --------------------------------------------- In Mac OS X 10.10 und 10.8.5 befindet sich eine Sicherheitslücke, die die Übernahme des gesamten Systems ermöglicht. Details hat ihr Entdecker noch nicht veröffentlicht - in Absprache mit Apple. --------------------------------------------- http://www.golem.de/news/security-sicherheitsluecke-in-mac-os-x-10-10-entde… *** OpenBSD 5.6 kickt OpenSSL *** --------------------------------------------- Mit der neuen Version des freien Unix steigen die OpenBSD-Macher von OpenSSL auf LibreSSL um. Dazu kommen zahlreiche kleinere Verbesserungen. --------------------------------------------- http://www.heise.de/newsticker/meldung/OpenBSD-5-6-kickt-OpenSSL-2441288.ht… *** Hacking Team: Handbücher zeigen Infektion Über Code Injection und WLAN *** --------------------------------------------- "Internetüberwachung leicht gemacht": Die italienische Firma Hacking Team gilt neben Finfisher als bekanntester Hersteller von Spionagesoftware. Nun veröffentlichte Handbücher zeigen die Möglichkeiten der Überwachung. --------------------------------------------- http://www.golem.de/news/hacking-team-handbuecher-zeigen-infektion-ueber-co… *** RDP Replay *** --------------------------------------------- Here at Context we work hard to keep our clients safe. During routine client monitoring our analysts noticed some suspicious RDP traffic. It was suspicious for two reasons. Firstly the client was not in the habit of using RDP, and secondly it had a Chinese keyboard layout. This information is available in the ClientData handshake message of non-SSL traffic, and can easily be seen in wireshark. --------------------------------------------- http://contextis.com/resources/blog/rdp-replay/ *** l+f: Analyse des Drupal-Desasters *** --------------------------------------------- Wie konnte das nur passieren? Müssen wir alle sterben? --------------------------------------------- http://www.heise.de/security/meldung/l-f-Analyse-des-Drupal-Desasters-24414… *** Visa: Kreditkarten-Lücke ermöglicht Abbuchen von einer Million Dollar per NFC *** --------------------------------------------- Mittels präpariertem Terminal - Forscher stellen Leck auf Sicherheitskonferenz vor - Visa beschwichtigt --------------------------------------------- http://derstandard.at/2000007655779 *** Ongoing Sophisticated Malware Campaign Compromising ICS (Update A) *** --------------------------------------------- This alert update is a follow-up to the original NCCIC/ICS-CERT Alert titled ICS-ALERT-14-281-01 Ongoing Sophisticated Malware Campaign Compromising ICS that was published October 28, 2014, on the ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-281-01A *** Bugtraq: [SE-2014-01] Missing patches / inaccurate information regarding Oracle Oct CPU *** --------------------------------------------- http://www.securityfocus.com/archive/1/533862 *** HP CM3530 Color LaserJet Printer Lets Remote Users Access Data and Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031153 *** CBI Referral Manager <= 1.2.1 Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-11-01T18:57:24 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7654 *** GB Gallery Slideshow 1.5 - SQL Injection *** --------------------------------------------- 2014-11-02T13:12:44 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7655 *** Vuln: MantisBT Incomplete Fix Multiple SQL Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/70856 *** VU#210620: uIP and lwIP DNS resolver vulnerable to cache poisoning *** --------------------------------------------- Vulnerability Note VU#210620 uIP and lwIP DNS resolver vulnerable to cache poisoning Original Release date: 03 Nov 2014 | Last revised: 03 Nov 2014 Overview The DNS resolver implemented in uIP and lwIP is vulnerable to cache poisoning due to non-randomized transaction IDs (TXIDs) and source port reuse. Description CWE-330: Use of Insufficiently Random Values - CVE-2014-4883The DNS resolver implemented in all versions of uIP, as well as lwIP versions 1.4.1 and earlier, is vulnerable to cache... --------------------------------------------- http://www.kb.cert.org/vuls/id/210620 *** IBM Security Bulletin: Weaker than expected security with Liberty Repository affecting Rational Application Developer for WebSphere Software (CVE-2014-4767) *** --------------------------------------------- The WebSphere Application Server Liberty profile could provide weaker than expected security when installing features via the Liberty Repository. A remote attacker could exploit this vulnerability using a man-in-the-middle technique to cause the installation of malicious code. CVE(s): CVE-2014-4767 Affected product(s) and affected version(s): IBM Rational Application Developer for WebSphere Software 9.1.0.1 Refer to the following reference URLs for remediation and additional --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple Security vulnerabilities found in WebSphere Commerce XML External Entity (XXE) Processing (CVE-2014-4834, CVE-2014-4769 ) *** --------------------------------------------- IBM WebSphere Commerce Enterprise, Professional, Express and Developer is vulnerable to a denial of service, caused by issues with detecting recursion during entity expansion. CVE(s): CVE-2014-4834 and CVE-2014-4769 Affected product(s) and affected version(s): WebSphere Commerce V6.0 and V7.0 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors *** --------------------------------------------- There are multiple vulnerabilities in OpenSSL that is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139). These issues were disclosed on August 6, 2014 by the OpenSSL Project. CVE(s): CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512 and CVE-2014-5139 Affected... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM Notes Traveler for Android client explicit warning against use of HTTP (CVE-2014-6130) *** --------------------------------------------- The IBM Notes Traveler client for Android devices allows the end user to connect to their Traveler server over HTTPS (using SSL) or the open HTTP standard. At present, the client application does not explicitly warn the end user if the Traveler administrator has chosen the insecure HTTP variant as the transport medium. CVE(s): CVE-2014-6130 Affected product(s) and affected version(s): All releases of IBM Notes Traveler for Android prior to version 9.0.1.3. Refer to the following... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM Tivoli NetView for z/OS (distributed components) affected by multiple vulnerabilities that have been identified in IBM Runtime Environment, Java Technology Edition, Versions 6 & 7 (CVE-2014-4263 and *** --------------------------------------------- Vulnerabilities have been identified in IBM Runtime Environment, Java Technology Edition, Versions 6 and 7, utilized by IBM Tivoli NetView for z/OS distributed components. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): This vulnerability is known to affect IBM Tivoli NetView for z/OS v5.3, 5.4, 6.1, 6.2 & 6.2.1 in certain distributed components. Releases/systems/configurations not known to be affected: IBM Tivoli NetView for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 31-10-2014
by Daily end-of-shift report 31 Oct '14

31 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-10-2014 18:00 − Freitag 31-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/: CVE-2014-3371 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security Advisory - Medium Severity - WP eCommerce WordPress Plugin *** --------------------------------------------- If you're using the popular WP eCommerce WordPress plugin (2,900,000 downloads), you should update it right away. During a routine audit for our Website Firewall (WAF), we .. --------------------------------------------- http://blog.sucuri.net/2014/10/security-advisory-medium-severity-wp-ecommer… *** Nordex NC2 XSS Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site scripting vulnerability in the Nordex Control 2 (NC2) application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-303-01 *** Meinberg Radio Clocks LANTIME M-Series XSS *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Meinberg Radio Clocks LANTIME M-Series XSS. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-01 *** Accuenergy Acuvim II Authentication Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two authentication vulnerabilities within the Accuenergy AXM-NET Ethernet module's web server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-02 *** [2014-10-31] XXE and XSS vulnerabilities in Scalix Web Access *** --------------------------------------------- Scalix Web Access is vulnerable to XML external entity injection (XXE) and reflected cross site scripting (XSS) attacks. An unauthenticated attacker can get read access to the filesystem of the Scalix Web Access host and thus obtain sensitive information. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Spotting Malicious Injections in Otherwise Benign Code *** --------------------------------------------- Being able to spot suspicious code, and then determine whether it is benign or malicious is a very important skill for a security researcher. Every day we scan through megabytes of HTML, JS and PHP. It's quite easy to miss something bad, especially .. --------------------------------------------- http://blog.sucuri.net/2014/10/spotting-malicious-injections-in-otherwise-b… *** Setting HoneyTraps with ModSecurity: Adding Fake Cookies *** --------------------------------------------- This blog post continues with the topic of setting "HoneyTraps" within your web applications to catch attackers. Please review the previous posts for more .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/setting-honeytraps-with-modsecurity-addi… *** Facebook geht ins Tor-Netz *** --------------------------------------------- Das soziale Netz will zukünftig eine Nutzung der Dienste auch über das Anonymisierungsnetz Tor möglich machen. Dafür setzt der Konzern einen eigenen Onion-Dienst im Tor-Netz auf. --------------------------------------------- http://www.heise.de/security/meldung/Facebook-geht-ins-Tor-Netz-2440221.html *** Schwachstellen in Samsung Knox *** --------------------------------------------- Bei einer Analyse von der auf vielen Geräten vorinstallierten Security-App Samsung Knox Personal kamen Mängel ans Licht. Der Hersteller erklärte die App für überholt, Ersatz gibt es allerdings nur für zwei aktuelle Spitzengeräte. --------------------------------------------- http://www.heise.de/security/meldung/Schwachstellen-in-Samsung-Knox-2440119… *** Google to kill off SSL 3.0 in Chrome 40 *** --------------------------------------------- Google plans to remove support for the aging Secure Sockets Layer (SSL) version 3.0 protocol in Google Chrome 40, which is expected to ship in about two months.The decision comes after Google security researchers recently discovered a dangerous design flaw in SSL 3.0. Dubbed "POODLE," the vulnerability .. --------------------------------------------- http://www.csoonline.com/article/2841837/application-security/google-to-kil…

1 0

Tageszusammenfassung - Donnerstag 30-10-2014
by Daily end-of-shift report 30 Oct '14

30 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-10-2014 18:00 − Donnerstag 30-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** An In-Depth Look Into Malicious Browser Extensions *** --------------------------------------------- Malicious browser extensions bring about security risks as these often lead to system infection and unwanted spamming on Facebook. Based on our data, these attacks have notably affected users in Brazil. We have previously reported that cybercriminals are putting malicious browsers in the official Chrome .. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mNBK1Z4Uhdo/ *** Cyberangriffe: Neue Spyware kommuniziert über Gmail-Entwürfe *** --------------------------------------------- Eine neue Malware nutzt die Entwurfsfunktion von Googles E-Mail-Dienst, um Befehle zu empfangen und Daten auszulesen. Wer betroffen ist, lässt sich nur schwer feststellen. --------------------------------------------- http://www.golem.de/news/cyberangriffe-neue-spyware-kommuniziert-ueber-gmai… *** SQL-Injection: Sicherheitslücke erlaubt Zugriff auf Sony-Kundendaten *** --------------------------------------------- Eine SQL-Injection-Lücke erlaubt den Zugriff auf Kundendaten des Playstation Networks. Sony wurde bereits vor zwei Wochen über die Sicherheitslücke informiert, sie wurde jedoch bisher nicht geschlossen. Es ist nicht der erste Vorfall im Playstation-Network. --------------------------------------------- http://www.golem.de/news/sql-injection-sicherheitsluecke-erlaubt-zugriff-au… *** Popular Science Website Infected, Serving Malware *** --------------------------------------------- The website of Popular Science magazine was found infecting users with malware via the RIG exploit kit. --------------------------------------------- http://threatpost.com/popular-science-website-infected-serving-malware/1090… *** Poodle: Microsoft "fixt" SSLv3-Verschlüsselung *** --------------------------------------------- Mit einem von Microsoft bereit gestellten "Fix it" kann man den kaputten Verschlüsselungsstandard SSLv3 im Internet Explorer einfach abschalten. Doch die Schnellhilfe hat ihre Tücken. --------------------------------------------- http://www.heise.de/security/meldung/Poodle-Microsoft-fixt-SSLv3-Verschlues… *** Assume 'Every Drupal 7 Site Was Compromised' Unless Patched By Oct. 15 *** --------------------------------------------- The maintainers of the Drupal content management system are warning users that any site owners who haven't patched a critical vulnerability in Drupal Core disclosed earlier this month should consider their sites to be .. --------------------------------------------- http://threatpost.com/assume-every-drupal-7-site-was-compromised-unless-pat… *** Cyber Europe 2014: 29 europäische Länder testen Handlungsfähigkeit gegen Cyberattacken *** --------------------------------------------- Gegen grenzüberschreitende Cyber-Bedrohungen arbeiten die Europäische Sicherheitsbehörde ENISA, die EU-Mitgliedsstaaten und die Industrie Hand in Hand. Heute läuten sie Phase 2 des bislang grössten europäischen Cyber-Security-Tests ein. --------------------------------------------- http://www.heise.de/security/meldung/Cyber-Europe-2014-29-europaeische-Laen… *** Grafikkarte funkt Passwörter durch die Gegend *** --------------------------------------------- Forscher haben eine Grafikkarte zum UKW-Sender umfunktioniert, das Monitorkabel dient als Antenne. So können sie Air Gap überwinden und Daten an Geräte senden, die eigentlich gar nicht untereinander vernetzt sind. --------------------------------------------- http://www.heise.de/security/meldung/Grafikkarte-funkt-Passwoerter-durch-di… *** Reflected File Download - A New Web Attack Vector *** --------------------------------------------- On October 2014 as part of my talk at the Black Hat Europe 2014 event, I presented a new web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from trusted .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/reflected-file-download-the-white-paper.… *** APT28 - State Sponsored Russian Hacker Group *** --------------------------------------------- Nearly a decade-long cyber espionage group that targeted a variety of Eastern European governments and security-related organizations including the North Atlantic Treaty Organization (NATO) has been exposed by a security research firm. The US intelligence firm FireEye released its latest Advanced Persistent .. --------------------------------------------- http://thehackernews.com/2014/10/APT28-Russian-hacker-cyber-espionage.html *** Ausnutzung der Windows-Sandworm-Lücke eskaliert *** --------------------------------------------- Kriminelle nutzen die zunächst im Rahmen gezielter Attacken auf NATO-Einrichtungen und Regierungen eingesetzte Sicherheitslücke in Windows nun, um grossflächig Online-Banking-Trojaner zu verteilen. --------------------------------------------- http://www.heise.de/security/meldung/Ausnutzung-der-Windows-Sandworm-Luecke…

1 0

Tageszusammenfassung - Mittwoch 29-10-2014
by Daily end-of-shift report 29 Oct '14

29 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-10-2014 18:00 − Mittwoch 29-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The dangers of opening suspicious emails: Crowti ransomware *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has seen a spike in number of detections for threats in the Win32/Crowti ransomware this month as the result of new malware campaigns. Crowti is a family of ransomware that when encountered will attempt to encrypt the files on your PC, and then ask for payment .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/28/the-dangers-of-opening-s… *** Ongoing Sophisticated Malware Campaign Compromising ICS *** --------------------------------------------- NCCIC/ICS-CERT has identified a sophisticated malware campaign that has compromised numerous industrial control systems (ICSs) environments using a variant of the BlackEnergy malware. Analysis indicates that this campaign has .. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-281-01 *** Multiple vulnerabilities in Tuleap *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100177 http://cxsecurity.com/issue/WLB-2014100176 http://cxsecurity.com/issue/WLB-2014100175 *** Weisses Haus: Russische Hacker angeblich in US-Regierungsnetz eingedrungen *** --------------------------------------------- Angriffe auf die Computernetze von Regierungen kommen weltweit tagtäglich vor. Hackern ist es nun offenbar gelungen, in das nicht abgeschirmte Netz des Weissen Hauses einzudringen. --------------------------------------------- http://www.golem.de/news/weisses-haus-russische-hacker-angeblich-in-us-regi… *** Microsoft integriert Data Loss Prevention in Cloud- und Office-Produkte *** --------------------------------------------- Mit der Ausweitung seiner Sicherheits-Features auf weitere Produkte und Dienste will der Redmonder Konzern für Unternehmen den Verlust vertraulicher Daten weitestmöglich einschränken. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-integriert-Data-Loss-Prevent… *** [2014-10-29] Multiple critical vulnerabilities in Vizensoft Admin Panel *** --------------------------------------------- Attackers are able to completely compromise the web application built upon Vizensoft CMS as they can gain access to the system and database level and manage the website as an admin without prior authentication. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-10-29] Persistent cross site scripting in Confluence RefinedWiki Original Theme *** --------------------------------------------- By exploiting this vulnerability, users that are able to create or edit content, can attack other users of confluence. An attacker might be able to gain access to otherwise protected information in confluence. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Codeausführung: FTP-Client-Lücke in BSDs, Mac OS X und Linux-Distributionen *** --------------------------------------------- Eine Sicherheitslücke in dem FTP-Client von NetBSD erlaubt mit einem angepassten Server das Ausführen von Code auf dem Rechner. Betroffen davon sind wohl verschiedene BSD-Derivate, Mac OS X sowie Linux-Distributionen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/codeausfuehrung-ftp-client-luecke-in-bsds-mac-os-x… *** Threat Introduced via Browser Extensions *** --------------------------------------------- We love investigating unusual hacks. There are so many ways to compromise a website, but often it's the same thing. When we see malicious code on web pages, our usual suspects are: Vulnerabilities in website software Trojanized software .. --------------------------------------------- http://blog.sucuri.net/2014/10/threat-introduced-via-browser-extensions.html *** AirHopper: Offline-PC schickt Passwort per UKW an Offline-Handy *** --------------------------------------------- Israelische Security-Forscher haben einen neuen Weg für eine Seitenkanalattacke auf PCs gefunden. Mit einem Smartphone und einem Desktoprechner, die beide keine Onlineverbindung haben, können sie ein eingetipptes Passwort mitlesen. --------------------------------------------- http://www.golem.de/news/airhopper-offline-pc-schickt-passwort-per-ukw-an-o…

1 0

Tageszusammenfassung - Dienstag 28-10-2014
by Daily end-of-shift report 28 Oct '14

28 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-10-2014 18:00 − Dienstag 28-10-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** ddosfrei.de: neue Providerinitiative für sichere Server *** --------------------------------------------- Mit über 3.500 Angriffen pro Jahr zählen DDoS-Attacken (Distributed Denial of Service-Attacken) laut dem Bundesamt für Sicherheit in der Informationstechnik (BSI) zu den grössten Gefahren für die IT-Sicherheit in Deutschland, Tendenz steigend. Dabei handelt es sich um von vielen Rechnern gleichzeitig erfolgende .. --------------------------------------------- http://www.eco.de/2014/news/ddosfrei-de-neue-initiative-fuer-sichere-server… *** TA14-300A: Phishing Campaign Linked with "Dyre" Banking Malware *** --------------------------------------------- Since mid-October 2014, a phishing campaign has targeted a wide variety of recipients while employing the Dyre/Dyreza banking malware. Elements of this phishing campaign vary from target to target including senders, attachments, exploits, themes, and payload(s) .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-300A *** wget Default FTP Retrieval Method Lets Remote Users Create Arbitrary Files and Directories *** --------------------------------------------- http://www.securitytracker.com/id/1031121 *** TSX improves timing attacks against KASLR *** --------------------------------------------- Mega biblion mega kakon .. and similarly a long blog is a nuisance, so I managed to squeeze the essence of it into a single sentence, the title. If it is not entirely clear, read on. SMEP A typical privilege escalation exploit based on a kernel vulnerability works by corrupting the kernel .. --------------------------------------------- http://labs.bromium.com/2014/10/27/tsx-improves-timing-attacks-against-kasl… *** Immer Ärger mit Samsung-Dienst "Find My Mobile" *** --------------------------------------------- Erneut wurde ein Sicherheitsproblem in dem Dienst bekannt. Durch die Schwachstelle können Angreifer die Android-Geräte von Samsung unter Umständen aus der Ferne mit einem beliebigen Code sperren. --------------------------------------------- http://www.heise.de/security/meldung/Immer-Aerger-mit-Samsung-Dienst-Find-M… *** Verizon: Permaä-Cookie in manipulierten Datenpaketen *** --------------------------------------------- Die Datenpakete der Kunden des US-Mobilfunkanbieters Verizon enthalten eine eindeutige Identifikationsnummer. Damit sollen einzelne Personen von Verizons Werbekunden identifiziert werden können. Die Aktion läuft bereits seit zwei Jahren, wurde jedoch erst jetzt aufgedeckt. --------------------------------------------- http://www.golem.de/news/verizon-perma-cookie-in-manipulierten-datenpaketen… *** Untersuchung: Deutlich mehr Phishing-Attacken auf Apple-Nutzer *** --------------------------------------------- Laut einem Sicherheitsunternehmen nahmen die Angriffe auf iCloud- und iTunes-Konten im letzten Quartal um fast 250 Prozent zu. --------------------------------------------- http://www.heise.de/security/meldung/Untersuchung-Deutlich-mehr-Phishing-At… *** VB2014 paper: Hiding the network behind the network. Botnet proxy business model *** --------------------------------------------- Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Hiding the network behind the network. Botnet proxy business model .. --------------------------------------------- http://www.virusbtn.com/blog/2014/10_28.xml

1 0

Tageszusammenfassung - Montag 27-10-2014
by Daily end-of-shift report 27 Oct '14

27 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-10-2014 18:00 − Montag 27-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** OpenBSD ELF denial of service *** --------------------------------------------- OpenBSD is vulnerable to a denial of service. A local attacker could exploit this vulnerability using a malicious ELF executable to cause a kernel panic. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97747 *** A Tale of Two Powerpoint Vulnerabilities *** --------------------------------------------- It's been already a week after the announcement of the CVE-2014-4114 vulnerability, and the tally of the exploiters have only increased. There are even .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002756.html *** Amplification DDoS attacks most popular, according to Symantec *** --------------------------------------------- The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August. --------------------------------------------- http://www.scmagazine.com/distributed-denial-of-service-attacks-are-increas… *** OwnCloud Dev Requests Removal From Ubuntu Repos Over Security Holes *** --------------------------------------------- ownCloud developer Lukas Reschke has sent an email to the Ubuntu Devel mailing list, requesting that ownCloud (server) is removed from the Ubuntu repositories because the package is old and there are multiple critical security bugs for .. --------------------------------------------- http://linux.slashdot.org/story/14/10/25/0046256/owncloud-dev-requests-remo… *** iTunes 12.0.1 for Windows DLL Hijacking *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100154 *** Shellshock-Angriffe auf Mailserver *** --------------------------------------------- Nach Informationen von heise Security versuchen Cyber-Kriminelle derzeit vermehrt, durch die Shellshock-Lücken in Mailserver einzudringen. Server-Betreiber sollten umgehend handeln. --------------------------------------------- http://www.heise.de/security/meldung/Shellshock-Angriffe-auf-Mailserver-243… *** WordPress Count-per-Day Plugin (notes.php) Remote Code Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100161 *** WordPress Download Manager Plugin Arbitrary File Download *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100160 *** Sipgate und Fidor Bank: DDoS-Angriffe waren Erpressungsversuch *** --------------------------------------------- Mit dem gross angelegten DDoS-Angriff gegen Sipgate sollte Geld erpresst werden. Auch die Fidor Bank aus München war betroffen. --------------------------------------------- http://www.golem.de/news/sipgate-und-fidor-bank-ddos-angriffe-waren-erpress… *** ASP Backdoors? Sure! It's not just about PHP *** --------------------------------------------- I recently came to the realization that it might appear that we're partial to PHP and WordPress. This realization has brought about an overwhelming need to correct that perception. While they do make up an interesting percentage, there are various .. --------------------------------------------- http://blog.sucuri.net/2014/10/asp-backdoors-its-not-all-about-php.html

1 0

Tageszusammenfassung - Freitag 24-10-2014
by Daily end-of-shift report 24 Oct '14

24 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-10-2014 18:00 − Freitag 24-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Operation Pawn Storm: Putting Outlook Web Access Users at Risk *** --------------------------------------------- In our recently released report, Operation Pawn Storm, we talked about an operation that involved three attack scenarios. For this post, we will talk about the third scenario: phishing emails that redirect victims to fake Outlook Web Access login pages. What's most notable about this is that it is simple, effective, and can be easily replicated. Through one... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CrAgUjYrv14/ *** Has the "Sandworm" zero-day exploit burrowed back to the surface? *** --------------------------------------------- You may have noticed that Microsoft recently published a Security Advisory that sounds a lot like the "Sandworm" vulnerability all over again. Paul Ducklin explains... --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/24/has-the-sandworm-exploit-burrowe… *** The Insecurity of Things : Part One *** --------------------------------------------- Everyday we read about some newfangled internet connected device being released. Things we use everyday are being made "smart" with some rushed-to-production software embedded in a cheap micro-controller. Fitness trackers, smoke alarms, televisions, cars, wall-outlets, even water-bottles. Internet connected-water bottles? What a time to be alive! --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-one *** The Insecurity of Things: Part Two *** --------------------------------------------- When we last left off, we were setting the stage for sharing what the Interns found in a handful of "IOT" or internet connected devices they purchased. So well be starting with a simple one. One that only required simple techniques to compromise it. This first device is a "Smart"-Home Controller. For a bit of background on whats going on here, please see "Part One" of this series otherwise were going to jump right in but first a disclaimer:... --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-two *** The Case of the Modified Binaries *** --------------------------------------------- After creating and using a new exitmap module, I found downloaded binaries being patched through a Tor exit node in Russia. Tor is a wonderful tool for protecting the identity of journalists, their sources, and even regular users around the world; however, anonymity does not guarantee security. --------------------------------------------- http://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/ *** Sipgate: Dienste nach DDoS-Angriff wiederhergestellt *** --------------------------------------------- Nachdem Sipgate über Nacht seine Dienste teilweise wiederhergestellt hatte, ist das Unternehmen am Freitagmorgen erneut einem DDoS-Angriff ausgesetzt worden. Jetzt sollen die Dienste wieder funktionieren. --------------------------------------------- http://www.golem.de/news/sipgate-dienste-nach-ddos-angriff-wiederhergestell… *** QuickTime-Update für Windows schließt Bündel an Sicherheitslücken *** --------------------------------------------- Insgesamt vier Fehler steckten in der Windows-Version von Apples Multimedia-Unterstützung, die sich von Angreifern über manipulierte Dateien ausnützen lassen sollen. --------------------------------------------- http://www.heise.de/security/meldung/QuickTime-Update-fuer-Windows-schliess… *** Manipulating WordPress Plugin Functions to Inject Malware *** --------------------------------------------- Most authors of website malware usually rely on the same tricks, making it easy for malware researchers to spot obfuscated code, random files that don't belong, and malicious lines injected at the top of a file. However, it can become difficult when the malware is buried deep within the lines of code on normal files. --------------------------------------------- http://blog.sucuri.net/2014/10/manipulating-wordpress-plugin-functions-to-i… *** Filr 1.1 - Security Update 1 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.1.0 appliance.Document ID: 5194317Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.1.0.654.HP.txt (1.26 kB)Filr-1.1.0.654.HP.zip (5.64 MB)Products:Filr 1.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=3wpN2nVj2D8~ *** Filr - Security Update 3 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.0.0 and 1.0.1 appliances.Document ID: 5194316Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.0.0-SU3.txt (2.49 kB)readme-Filr-1.0.1-SU3.txt (2.49 kB)Filr-1.0.0-SU3.zip (5.64 MB)Filr-1.0.1-SU3.zip (5.64 MB)Products:Filr 1.0Filr 1.0.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_N6A9M3Jvig~ *** Cisco IOS and IOS XE Software Ethernet Connectivity Fault Management Vulnerability *** --------------------------------------------- CVE-2014-3409 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Bugtraq: [SECURITY] [DSA 3055-1] pidgin security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/533797 *** ZDI-14-368: Apple OS X GateKeeper Bypass Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-368/

1 0

Tageszusammenfassung - Donnerstag 23-10-2014
by Daily end-of-shift report 23 Oct '14

23 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-10-2014 18:00 − Donnerstag 23-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** New CVE-2014-4114 Attacks Seen One Week After Fix *** --------------------------------------------- Despite the availability of fixes related to the Sandworm vulnerability (CVE-2014-4114), we are still seeing new attacks related to this flaw. These attacks contain a new routine that could prevent detection. A New Evasion Technique In our analysis of the vulnerability, we noted this detail:... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/BYhEqtnNGxs/ *** NIST to hypervisor admins: secure your systems *** --------------------------------------------- Hypervisor security draft open for comment US standards body the National Institute of Standards and Technology (NIST) has laid out the basics of hypervisor security in a draft publication released for comment on 20 October. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/nist_to_hyp… *** Kommentar zur UEFI-Lücke: Sie lernen es einfach nicht *** --------------------------------------------- Sicherheitsexperten haben eine kritische Lücke entdeckt, die in vielen UEFI-Firmware-Versionen klafft - vor fast einem Jahr. Doch viele PC- und Mainboard-Hersteller wissen bisher nichts davon. Das ist untragbar. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kommentar-zur-UEFI-Luecke-Sie-lernen… *** Linux Container Security *** --------------------------------------------- First, read these slides. Done? Good.Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].Does this mean containers provide reduced security? --------------------------------------------- http://mjg59.dreamwidth.org/33170.html *** Xen says its security policies might be buggier than its software *** --------------------------------------------- Users didnt know if they were allowed to patch bug behind world cloud reboot The Xen project has asked for help to ensure future bugs arent as disruptive as the XSA-108 flaw that saw major cloud operators reboot an awful lot of servers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/xen_says_it… *** A look at a phishing website *** --------------------------------------------- Yesterday we came across a phishing website under .ch where we were able to download the phishing kit. A phishing kit is an archive file which contains all the relevant files for hosting a phishing website. In this case, the... --------------------------------------------- http://securityblog.switch.ch/2014/10/23/a-look-at-a-phishing-website/ *** Cisco Patches Three-Year-Old Telnet Remote Code Execution Bug in Security Appliances *** --------------------------------------------- There is a severe remote code execution vulnerability in a number of Cisco's security appliances, a bug that was first disclosed nearly three years ago. The vulnerability is in Telnet and there has been a Metasploit module available to exploit it for years. The FreeBSD Project first disclosed the vulnerability in telnet in December 2011... --------------------------------------------- http://threatpost.com/cisco-patches-three-year-old-telnet-remote-code-execu… *** Sicherheit: Apple verbietet SSLv3 für Push-Server *** --------------------------------------------- Entwickler, die den Apple-Push-Notification-Dienst nutzen, dürfen ab Ende des Monats nur noch TLS einsetzen. Grund ist die problematische "Poodle"-Lücke. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheit-Apple-verbietet-SSLv3-fuer-… *** APPLE-SA-2014-10-22-1 QuickTime 7.7.6 *** --------------------------------------------- https://support.apple.com/kb/HT6493 *** VMSA-2014-0011 *** --------------------------------------------- VMware vSphere Data Protection product update addresses a critical information disclosure vulnerability. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0011.html *** TCP Vulnerabilities in Multiple Non-IOS Cisco Products *** --------------------------------------------- cisco-sa-20040420-tcp-nonios --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Wireshark Multiple Dissector Bugs Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031111 *** [R2] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** SA-CONTRIB-2014-102 - Document - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-102Project: Document (third-party module)Version: 6.x, 7.xDate: 2014-October-08Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionDocument module is a basic Document Management System for Drupal. Cross Site Scripting (XSS)The module wasnt sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to --------------------------------------------- https://www.drupal.org/node/2361617 *** SA-CONTRIB-2014-101 - Ubercart - Cross Site Request Forgery *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-101Project: Ubercart (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 13/25 ( Moderately Critical) AC:None/A:Admin/CI:None/II:Some/E:Proof/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Ubercart module provides a shopping cart and e-commerce features for Drupal.Cross Site Request Forgery (CSRF)The country administration links are not properly protected. A malicious user could trick a store administrator into enabling or --------------------------------------------- https://www.drupal.org/node/2361613 *** SA-CONTRIB-2014-100 - Bad Behavior - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-100Project: Bad Behavior (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 15/25 ( Critical) AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionThis module enables you to to target any malicious software directed at a Web site, whether it be a spambot, ill-designed search engine bot, or system crackers. It blocks such access and then logs their attempts.Information DisclosureThe module --------------------------------------------- https://www.drupal.org/node/2361611 *** IBM Security Bulletins for SSLv3 Vulnerability (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 22-10-2014
by Daily end-of-shift report 22 Oct '14

22 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-10-2014 18:00 − Mittwoch 22-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory 3010060 released *** --------------------------------------------- Today, we released Security Advisory 3010060 to provide additional protections regarding limited, targeted attacks directed at Microsoft Windows customers. A cyberattacker could cause remote code execution if someone is tricked into opening a maliciously-crafted PowerPoint document that contains an infected Object Linking and Embedding (OLE) file. As part of this Security Advisory, we have included an easy, one-click Fix it solution to address the known cyberattack. Please review the... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/21/security-advisory-301006… *** Android NFC hack allow users to have free rides in public transportation *** --------------------------------------------- More and more people keep talking about the feature of payments via NFC. The problem in this particular case is that somebody reversed the "Tarjeta BIP!" cards and found a means to re-charge them for free. --------------------------------------------- http://securelist.com/blog/virus-watch/67283/android-nfc-hack-allow-users-t… *** SSL-Verschlüsselung: Noch viel Arbeit für Mail-Provider und Banken *** --------------------------------------------- heise Security hat getestet und festgestellt, dass einige Mail-Provider bereits auf die jüngsten Angriffe auf Verschlüsselung reagiert haben - aber längst nicht alle. Schlimmer noch sieht es bei den Servern für das Online-Banking via HBCI aus. --------------------------------------------- http://www.heise.de/security/meldung/SSL-Verschluesselung-Noch-viel-Arbeit-… *** Malvertising Payload Targets Home Routers *** --------------------------------------------- A few weeks ago we wrote about compromised websites being used to attack your web routers at home by changing DNS settings. In that scenario the attackers embedded iFrames to do the heavy lifting, the short fall with this method is they require a website to inject the iFrame. As is often the case, tacticsRead More --------------------------------------------- http://blog.sucuri.net/2014/10/malvertising-payload-targets-home-routers.ht… *** Gezielte Angriffe über Onlinewerbung *** --------------------------------------------- Datendiebe haben offenbar mit manipulierter Onlinewerbung Rüstungs- und Luftfahrtkonzerne angegriffen. Die Werbung konnte über das so genannte Real Time Bidding gezielt platziert werden. --------------------------------------------- http://www.golem.de/news/phishing-gezielte-angriffe-ueber-onlinewerbung-141… *** Netzangriffe: DDoS-Botnetz weitet sich ungebremst aus *** --------------------------------------------- Ein kürzlich entdecktes Botnetz für DDoS-Angriffe breitet sich nach Angaben von Experten ungehemmt aus. Inzwischen seien auch Windows-Server gefährdet. Der Zweck der darüber gefahrenen Angriffe bleibt aber unklar. --------------------------------------------- http://www.golem.de/news/netzangriffe-ddos-botnetz-weitet-sich-ungebremst-a… *** Hostile Subdomain Takeover using Heroku/Github/Desk + more *** --------------------------------------------- Hackers can claim subdomains with the help of external services. This attack is practically non-traceable, and affects at least 17 large service providers and multiple domains are affected. Find out if you are one of them by using our quick tool, or go through your DNS-entries and remove all which are active and unused OR pointing to External Services which you do not use anymore. --------------------------------------------- http://blog.detectify.com/post/100600514143/hostile-subdomain-takeover-usin… *** TYPO3 CMS 4.5.37, 4.7.20, 6.1.12 and 6.2.6 released *** --------------------------------------------- IMPORTANT: These versions include important security fixes to the TYPO3 core. A security announcement has just been released: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… --------------------------------------------- https://typo3.org/news/article/typo3-cms-4537-4720-6112-and-626-released/ *** Security_Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products *** --------------------------------------------- Oct 21, 2014 20:23 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack (CVE-2014-3566) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in IBM WebSphere MQ. CVE(s): CVE-2014-3566 Affected product(s) and affected version(s): The vulnerability affects all versions and releases of IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Bugtraq: FreeBSD Security Advisories *** --------------------------------------------- http://www.securityfocus.com/archive/1/533773 http://www.securityfocus.com/archive/1/533772 http://www.securityfocus.com/archive/1/533771 http://www.securityfocus.com/archive/1/533770 *** Bugtraq: File Manager v4.2.10 iOS - Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533778 *** Files Document & PDF Reader for iOS Ordner Erstellen code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97698

1 0

Tageszusammenfassung - Dienstag 21-10-2014
by Daily end-of-shift report 21 Oct '14

21 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-10-2014 18:00 − Dienstag 21-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple Multiple Security Updates, (Mon, Oct 20th) *** --------------------------------------------- Apple released security update today for iOS 8 and Apple TV 7. iOS 8.1 (APPLE-SA-2014-10-20-1 iOS 8.1) is now available for iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later, to addresses the following: Bluetooth CVE-2014-4448 House Arrest CVE-2014-4448 iCloud Data Access CVE-2014-4449 Keyboards CVE-2014-4450 Secure Transport CVE-2014-3566 Apple TV 7.0.1 (APPLE-SA-2014-10-20-2 Apple TV 7.0.1) is now available for Apple TV 3rd generation and later, to address the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18857&rss *** Palo Alto Networks boxes spray firewall creds across the net *** --------------------------------------------- Crummy configurations to blame, Moore hardening offered as remedy Misconfigured user identities for Palo Alto Networks firewalls are leaking onto the public web potentially exposing customer services including VPN and webmail, says security luminary HD Moore. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/21/palo_alto_c… *** Download-Sicherheit: Blackberry muss App-Store nachbessern *** --------------------------------------------- Wegen fehlender Sicherung der Downloads aus Blackberry World, dem offiziellen App Store für alle Blackberry-10-Modelle, hätte ein Angreifer ganz leicht Schadsoftware auf die Geräte schmuggeln können. --------------------------------------------- http://www.heise.de/security/meldung/Download-Sicherheit-Blackberry-muss-Ap… *** CSAM Month of False Positives: Ghosts in the Pentest Report, (Tue, Oct 21st) *** --------------------------------------------- As part of most vulnerability assessments and penetration tests against a website, we almost always run some kind of scanner. Burp (commercial) and ZAP (free from OWASP) are two commonly used scanners. Once youve done a few website assessments, you start to get a feel for what pages and fields are likely candidates for exploit. But especially if its a vulnerability assessment, where youre trying to cover as many issues as possible (and exploits might even be out of scope), its always a safe bet --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18861&rss *** Delivering Malicious Android Apps Hidden In Image Files *** --------------------------------------------- An anonymous reader writes "Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app. Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini created a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/mKMqgWAvhIM/story01.htm *** Google Adds Hardware Security Key For Account Protection *** --------------------------------------------- Google is introducing an improved two-factor authentication system for Gmail and its other services that uses a tiny hardware token that will only work on legitimate Google sites. The new Security Key system is meant to help defeat attacks that rely on highly plausible fake sites that are designed to capture users' credentials. Attackers often go... --------------------------------------------- http://threatpost.com/google-adds-hardware-security-key-for-account-protect… *** R7-2014-17: NAT-PMP Implementation and Configuration Vulnerabilities *** --------------------------------------------- In the summer of 2014, Rapid7 Labs started scanning the public Internet for NAT-PMP as part of Project Sonar. NAT-PMP is a protocol implemented by many SOHO-class routers and networking devices that allows firewall and routing rules to be manipulated to enable internal, assumed trusted users behind a NAT device to allow external users to access internal TCP and UDP services for things like Apple's Back to My Mac and file/media sharing services. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/21/r7-2014-1… *** Denial-of-service attacks - short but strong *** --------------------------------------------- DDoS amplification attacks continue to increase as attackers experiment with new protocols. Summary: DDoS amplification attacks continue to increase as attackers experiment with new protocols. read more --------------------------------------------- http://www.symantec.com/connect/blogs/denial-service-attacks-short-strong *** [R1] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** Vuln: Zend Framework CVE-2014-8088 Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70378 *** DSA-3054 mysql-5.5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3054 *** Asterisk SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic *** --------------------------------------------- http://www.securitytracker.com/id/1031078 *** HP Security Bulletins *** --------------------------------------------- http://www.securityfocus.com/archive/1/533732 http://www.securityfocus.com/archive/1/533733 http://www.securityfocus.com/archive/1/533736 http://www.securityfocus.com/archive/1/533737 http://www.securityfocus.com/archive/1/533738 http://www.securityfocus.com/archive/1/533739 http://www.securityfocus.com/archive/1/533740 http://www.securityfocus.com/archive/1/533742 http://www.securityfocus.com/archive/1/533754

1 0

Tageszusammenfassung - Montag 20-10-2014
by Daily end-of-shift report 20 Oct '14

20 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-10-2014 18:00 − Montag 20-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Erneut Sicherheitsupdates für PHP *** --------------------------------------------- Zum zweiten Mal im laufenden Monat veröffentlichten die PHP-Entwickler sicherheitsrelevante Patches für ihr Projekt. Allein im Versionszweig 5.6 haben sie vier Schwachstellen beseitigt. --------------------------------------------- http://www.heise.de/security/meldung/Erneut-Sicherheitsupdates-fuer-PHP-242… *** Spike in Malware Attacks on Aging ATMs *** --------------------------------------------- This author has long been fascinated with ATM skimmers, custom-made fraud devices designed to steal card data and PINs from unsuspecting users of compromised cash machines. But a recent spike in malicious software capable of infecting and jackpotting ATMs is shifting the focus away from innovative, high-tech skimming devices toward the rapidly aging ATM infrastructure in the United States and abroad. --------------------------------------------- http://krebsonsecurity.com/2014/10/spike-in-malware-attacks-on-aging-atms/ *** Breaking International Voicemail Security via VVM Exploitation *** --------------------------------------------- A few days ago, I gave a presentation at Ruxcon about breaking international voicemail security. Whilst the crowd and conference were absolutely amazing - my overall research, I think has a much wider scope in the terms of whom it could affect. This blog post acts as a technical writeup and companion to my slides presented at Ruxcon. TL;DR Briefly put, through researching the visual voicemail protocol, we were able to document a number of different vulnerabilities, including some which affected... --------------------------------------------- https://shubh.am/breaking-international-voicemail-security-via-vvm-exploita… *** Availability of SHA-2 Hashing Algorithm for Windows 7 and Windows Server 2008 R2 *** --------------------------------------------- V1.0 (October 14, 2014): Advisory published. V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2949927 *** An Analysis of A Windows Kernel-Mode Vulnerability (CVE-2014-4113) *** --------------------------------------------- Three zero-day vulnerabilities - CVE-2014-4114, CVE-2014-4148, and CVE-2014-4113 - were reported last week and patched by Microsoft in their October 2014 Patch Tuesday. CVE-2014-4114, also known as the Sandworm vulnerability, can enable attackers to easily craft malware payloads when exploited. This particular vulnerability has been linked to targeted attacks against European sectors and industries. In addition, our researchers found that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/vwOtSBJrH3I/ *** Smart Lock Devices: Security Risks and Opportunities *** --------------------------------------------- Security is one of the top concerns when consumers consider buying smart devices. With cybercrime making the headlines every day, one has to think: is this smart device vulnerable to cyber attacks? Are these technologies secure enough for us to rely on them in our everyday lives? A good example of a technology that we need... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gtATHkHYNv4/ *** Black Hat Europe - day 2 *** --------------------------------------------- IPv6 versus IDPS, XSS in WYSIWYG editors, and reflected file downloads.After a busy first day, I was somewhat glad that the talks on the second day of Black Hat Europe appealed slightly less to my personal tastes and interests, as this gave me a chance to meet some old and new friends, and to have those conversations that perhaps form the heart of a security conference.I did attend three talks though, each of which was very interesting.Early in the morning, Antonios Atlasis, Enno Rey and Rafael... --------------------------------------------- http://www.virusbtn.com/blog/2014/10_20.xml?rss *** Dropbox-Server als Phishing-Helfer *** --------------------------------------------- Phishing-Mails verweisen meist auf dubiose Domains - nicht so in diesem Fall: Datensammler nutzen eine offizielle Dropbox-Domain, um Zugangsdaten aller Art abzugreifen. --------------------------------------------- http://www.heise.de/security/meldung/Dropbox-Server-als-Phishing-Helfer-242… *** Soundsquatting Unraveled: Homophone-based Domain Squatting *** --------------------------------------------- The Domain Name System (DNS) plays a vital role in the operation of the Internet. Over the years, it has been a primary target for malicious users looking for vulnerabilities in its protocol and infrastructure. Some examples include cache poisoning attacks, vulnerable DNS server implementations, and bogus user interactions. Taking advantage of users' spelling mistakes... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Jv_ckUgwnAs/ *** Targeted Attack Protection via Network Topology Alteration *** --------------------------------------------- When it comes to targeted attacks, attackers are not omniscient. They need to gather information in the early stages to know the target they may gather information from various sources of intelligence, like Google, Whois, Twitter, and Facebook. They may gather data such as email addresses, IP ranges, and contact lists. These will then be used as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/75OKb_Lt8XA/ *** Microsoft MSRT October Update, (Sun, Oct 19th) *** --------------------------------------------- This past week Microsoft MSRT push contains detections/removals for several widely used APT tools. The coalition (led by Novetta) that brought about the inclusions of these tools in this month MSRT, are encouraging enterprises to push/execute this month MSRT update. Some of malware included in this month MSRT update have a preliminary report posted here. If you are using either Snort or Sourcefire, the ruleIDs to detect some of the threat/family in this month MSRT release are listed below and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18853&rss *** Staying in control of your browser: New detection changes *** --------------------------------------------- This week we made some important changes to how we detect browser modifiers and adware. These changes are designed to better protect your browsing experience. We have already blogged about the changes to the behaviors we detect as adware. I will explain the changes to our browser modifier detections below. Our objective criteria has all the details about how and why we detect unwanted software. Unacceptable behaviors There are two new browser modifier behaviors that we detect: Bypassing --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/17/staying-in-control-of-yo… *** Drupal SQL Injection Attempts in the Wild *** --------------------------------------------- Less than 48 hours ago, the Drupal team released an update (version 7.32) for a serious security vulnerability (SQL injection) that affected all versions of Drupal 7.x. In our last post, we talked about the vulnerability and that we expected to see attacks starting very soon due to how severe and easy it was to... --------------------------------------------- http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wild.ht… *** Metasploit Weekly Wrapup: POODLE Mitigations *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/17/metasploi… *** OpenX multiple open redirect *** --------------------------------------------- OpenX could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the adclick.php and the ck.php scripts. By sending a specially-crafted URL, an attacker could exploit this vulnerability using the dest and _maxdest parameters to redirect a victim to arbitrary Web sites. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97621 *** VMSA-2014-0010.13 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** Rich Counter 1.1.5 - Cross Site Scripting (XSS) *** --------------------------------------------- 2014-10-18T19:45:31 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7648 *** Information Disclosure vulnerability in Dynamic Content Elements (dce) *** --------------------------------------------- It has been discovered that the extension "Dynamic Content Elements" (dce) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-vulnerability-in-d… *** DSA-3050 iceweasel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3050 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Service Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Service Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685122 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Performance Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Performance Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685121 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Sametime Classic Meeting Record and Playback File Vulnerability (CVE-2014-4766) *** --------------------------------------------- A vulnerability in the Record and Playback (RAP) file that is exported by Classic Meeting (CVE-2014-4766). CVE(s): CVE-2014-4766 Affected product(s) and affected version(s): IBM Sametime Classic Meeting Server versions 8.0.x and 8.5.x Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21687361 X-Force Database: http://xforce.iss.net/xforce/xfdb/94793 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 17-10-2014
by Daily end-of-shift report 17 Oct '14

17 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-10-2014 18:00 − Freitag 17-10-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Logging SSL, (Thu, Oct 16th) *** --------------------------------------------- With POODLE behind us, it is time to get ready for the next SSL firedrill. One of the questions that keeps coming up is which ciphers and SSL/TLS versions are actually in use. If you decide to turn off SSLv3 or not depends a lot on who needs it, and it is an important answer to have ready should tomorrow some other cipher turn out to be too weak. But keep in mind that it is not just numbers that matter. You also need to figure out who the outliers are and how important (or dangerous?) they are. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18847&rss *** Bad news, fandroids: He who controls the IPC tool, controls the DROID *** --------------------------------------------- A security flaw in a core message-passing mechanism leaves every Android device potentially vulnerable to attack, security researchers warned on Thursday. The flaw relates to Binder, Android's inter-process communication (IPC) tool. The message passing mechanism for Android devices acts as a communications hub on smartphones and tablets running the Google-developed mobile OS, making it a prime target for Android malware developers. --------------------------------------------- http://www.theregister.co.uk/2014/10/16/android_messaging_mechanism_securit… *** SAP Netweaver Enqueue Server denial of service *** --------------------------------------------- SAP Netweaver is vulnerable to a denial of service. By sending a specially-crafted SAP Enqueue Server packet to remote TCP port 32NN, a remote attacker could exploit this vulnerability to cause the system to become unresponsive. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97610 *** Close means close: New adware detection criteria *** --------------------------------------------- In April we introduced the rules that software developers should follow when creating advertisements to avoid being detected by Microsoft security products as adware. These rules are designed to keep our customers in control of their Internet browsing experience. Since then, we have had great success working with some companies through our developer contact process. At the same time we have started to see other advertising programs trying to bend and even circumvent our rules. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/16/close-means-close-new-ad… *** Siemens RuggedCom ROX-based Devices Certificate Verification Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-135-03 Siemens RuggedCom ROX-Based Devices Certificate Verification Vulnerability that was published May 15, 2014, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an incorrect certificate verification in Siemens RuggedCom ROX based devices. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-135-03A *** Siemens OpenSSL Vulnerabilities (Update F) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03E Siemens OpenSSL Vulnerabilities that was published October 15, 2014, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03F *** IOServer Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an out of bound read vulnerability in the IOServer application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-289-01 *** Fox DataDiode Proxy Server CSRF Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on September 26, 2014, and is being released to the ICS-CERT web site. This advisory provides mitigation details for a Cross-Site Request Forgery (CSRF) in the proxy server web administration interface for the Fox DataDiode Appliance Proxy Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-269-02 *** Black Hat Europe - day 1 *** --------------------------------------------- Programme packed with interesting talks.Though the prestige of Black Hat Europe doesnt compare to that of its American parent conference, and the event certainly doesnt dominate the debate on Twitter in quite the same way, more than 800 security experts descended on Amsterdam this week where, in the RAI Convention Centre, the 14th edition of Black Hat Europe is taking place.The conference opened with a keynote from Adi Shamir (perhaps still best known as the S in the RSA protocol) on side --------------------------------------------- http://www.virusbtn.com/blog/2014/10_17.xml?rss *** Abusing TZ for fun (and little profit) *** --------------------------------------------- Topic: Abusing TZ for fun (and little profit) Risk: Low Text: By default, sudo preserves the TZ variable[1] from users environment. This is a bad idea on glibc systems, where TZ can be abused to trick the program to read an arbitrary file. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100107 *** Denial of Service vulnerability in extension Calendar Base (cal) *** --------------------------------------------- It has been discovered that the extension "Calendar Base" (cal) is susceptible to Denial of Service. --------------------------------------------- http://www.typo3.org/news/article/several-vulnerabilities-in-extension-cale… *** Hacking Smart Electricity Meters To Cut Power Bills *** --------------------------------------------- Smart devices are growing at an exponential pace with the increase in connecting devices embedded in cars, retail systems, refrigerators, televisions and countless other things people use in their everyday life, but security and privacy are the key issues for such applications, which still face some enormous number of challenges. --------------------------------------------- http://thehackernews.com/2014/10/hacking-smart-electricity-meters-to-cut.ht… *** Apple Updates (not just Yosemite), (Fri, Oct 17th) *** --------------------------------------------- Apple yesterday released the latest version of its operating system, OS X 10.10 Yosemite. As usual, the new version of the operating system does include a number of security related bug fixes, and Apple released these fixes for older versions of OS X today. This update, Security Update 2014-005 is available for versions of OS X back to 10.8.5 (Mountain Lion). Among the long list of fixes, here a couple of highlights: Apple doesnt turn off SSLv3 in this release, but restricts it to non-CBC --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18851&rss

1 0

Tageszusammenfassung - Donnerstag 16-10-2014
by Daily end-of-shift report 16 Oct '14

16 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-10-2014 18:00 − Donnerstag 16-10-2014 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server and Cisco Expressway Software *** --------------------------------------------- cisco-sa-20141015-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability *** --------------------------------------------- cisco-sa-20141015-poodle --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** JSA10656 - 2014-10 Out of Cycle Security Bulletin: Multiple products affected by SSL "POODLE" vulnerability (CVE-2014-3566) *** --------------------------------------------- --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10656&actp=RSS *** SA-CONTRIB-2014-098 - CKEditor - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-098Project: CKEditor - WYSIWYG HTML editor (third-party module)Version: 6.x, 7.xDate: 2014-October-15Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) - a visual HTML editor, sometimes called WYSIWYG editor.Both --------------------------------------------- https://www.drupal.org/node/2357029 *** [DSA 3052-1] wpa security update *** --------------------------------------------- CVE ID : CVE-2014-3686 Jouni Malinen discovered an input sanitization issue in the wpa_cli and hostapd_cli tools included in the wpa package. A remote wifi system within range could provide a crafted string triggering arbitrary code execution running with privileges of the affected wpa_cli or hostapd_cli process. --------------------------------------------- https://lists.debian.org/debian-security-announce/2014/msg00238.html *** The October 2014 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: Same again? Fingerprint sensor on new iPhone 6 hacked using same method as for previous model Up in the air: --------------------------------------------- http://securityblog.switch.ch/2014/10/15/the-october-2014-issue-of-our-swit… *** MindshaRE: Statically Extracting Malware C2s Using Capstone Engine *** --------------------------------------------- I decided to share a technique I've been playing around with to pull C2 and other configuration information out of malware that does not store all of its configuration information in a set structure or in the resource section ... Being able to statically extract this information becomes important in the event that the malware does not run properly in your sandbox, the C2s are down or you don?t have thetime / sandbox bandwidth to manually run and extract the information from network indicators. --------------------------------------------- https://www.arbornetworks.com/asert/2014/10/mindshare-statically-extracting… *** C&C Botnet Detection over SSL *** --------------------------------------------- ...we have designed, implemented and validated a method to detect botnet C&C communication channels over SSL, the security protocol standard de-facto. ... Our analysis also indicates that 0.6% of the SSL connections were broken. --------------------------------------------- http://essay.utwente.nl/65667/1/Riccardo_Bortolameotti_MasterThesis.pdf *** VB2014 paper: DNSSEC - how far have we come? *** --------------------------------------------- Nick Sullivan describes how DNSSEC uses cryptography to add authentication and integrity to DNS responses.Over the next months, we will be sharing conference papers as well as video recordings of the presentations. Today, we have added DNSSEC - how far have we come? by CloudFlares Nick Sullivan.It is rather scary to think about how much of the Internet depends on DNS, and how little guarantee that protocol provides about its responses being correct. The Kaminsky attack is well mitigated these --------------------------------------------- http://www.virusbtn.com/blog/2014/10_16.xml?rss *** Factsheet Vulnerability in libxml2 *** --------------------------------------------- On 16 October 2014, a vulnerability was reported in libxml2, a library for the processing of eXtensible Markup Language (XML). XML is a language for the exchange of structured information between applications. Attackers can use this vulnerability to disrupt the availability of (web) applications through a so called Denial-of-Service (DoS) attack. --------------------------------------------- http://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fact… *** POODLE attack takes bytes out of your encrypted data - heres what to do *** --------------------------------------------- Heartbleed, Shellshock, Sandworm...and now POODLE. Its a security hole that could let crooks read your encrypted web traffic. Paul Ducklin takes you through how it works, and what you can do to avoid it, in plain (well, plain-ish) English... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/nyUmrkuhxuM/

1 0

Tageszusammenfassung - Mittwoch 15-10-2014
by Daily end-of-shift report 15 Oct '14

15 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-10-2014 18:00 − Mittwoch 15-10-2014 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Accessing Risk for the October 2014 Security Updates *** --------------------------------------------- Today we released eight security bulletins addressing 24 unique CVE's. Three bulletins have a maximum severity rating of Critical, and five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max exploitability Platform mitigations and key notes MS14-058 (Kernel mode drivers [win32k.sys]) Attacker loads a malicious --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-oc… *** MS14-OCT - Microsoft Security Bulletin Summary for October 2014 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for October 2014. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-OCT *** More Details About CVE-2014-4073 Elevation of Privilege Vulnerability *** --------------------------------------------- Today Microsoft shipped MS14-057 to the .NET Framework in order to resolve an Elevation of Privilege vulnerability in the ClickOnce deployment service. While this update fixes this service, developers using Managed Distributed Component Object Model (a .NET wrapped around DCOM) need to take immediate action to ensure their applications are secure. Managed DCOM is an inherently unsafe way to perform communication between processes of different trust levels. Microsoft recommends moving --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-20… *** BlackBerry 10 Devices Open to Bug That Allows Malicious App Installation *** --------------------------------------------- BlackBerry has patched a vulnerability in its BlackBerry 10 devices that could allow an attacker to intercept users' traffic to and from the BlackBerry World app store and potentially install malware on a targeted device. The vulnerability is a weakness in the integrity checking system that BlackBerry uses to verify the apps that users download. --------------------------------------------- http://threatpost.com/blackberry-10-devices-open-to-bug-that-allows-malicio… *** An Analysis of Windows Zero-day Vulnerability "CVE-2014-4114" aka "Sandworm" *** --------------------------------------------- Prior to the release of Microsoft's monthly patch Tuesday, a new zero-day exploiting Windows vulnerability covered in CVE-2014-4114 was reported by iSight. The said vulnerability affects desktop and server versions of Vista and Sever 2008 to current versions. It was believed to be associated in cyber attacks related to NATO by Russian cyber espionage group. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jSCRsk2zaNU/ *** Analysis of Linux Backdoor Used In Freenode Hack *** --------------------------------------------- An anonymous reader writes "A detailed analysis has been done of the Linux backdoor used in the freenode hack. It employed port knocking and encryption to provide security against others using it. This seems a little more sophisticated than your average black-hat hacker. Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/K3FWymutqls/story01.htm *** Siemens OpenSSL Vulnerabilities (Update D) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03C Siemens OpenSSL Vulnerabilities that was published August 21, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens OpenSSL cryptographic software library affecting several Siemens industrial products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03D *** Oracle stopft kritische Lücken in Java *** --------------------------------------------- Oracle hat mit seinem Oktober-Update 154 Sicherheitsupdates veröffentlicht, die fast alle Produkte des Unternehmens abdecken. Aber besonders die Sicherheitsupdates für Java sollten laut der Firma so schnell wie möglich installiert werden. --------------------------------------------- http://www.heise.de/security/meldung/Oracle-stopft-kritische-Luecken-in-Jav… *** Security Advisory 3009008 released *** --------------------------------------------- Today, we released Security Advisory 3009008 to address a vulnerability in Secure Sockets Layer (SSL) 3.0 which could allow information disclosure. This is an industry-wide vulnerability that affects the protocol itself, and is not specific to Microsoft's implementation of SSL or the Windows operating system. This advisory provides guidance for customers so that they can disable SSL 3.0 in the browser. Customers should be aware that once they disable SSL 3.0, if they visit a website that --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/14/security-advisory-300900… *** October 2014 Updates *** --------------------------------------------- Today, as part of Update Tuesday, we released eight security updates three rated Critical and five rated Important - to address 24 Common Vulnerabilities & Exposures (CVEs) in Windows, Office, .NET Framework, .ASP.NET, and Internet Explorer (IE). We encourage you to apply all of these updates, but for those who need to prioritize deployment planning, we recommend focusing on the Critical updates first. Here's an overview slide and video of the security updates released today: --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/14/october-2014-updates.aspx *** [2014-10-15] Potential Cross-Site Scripting in ADF Faces *** --------------------------------------------- The Oracle ADF Faces framework fails to encode certain characters in the goButton component. This may lead to Cross-Site Scripting vulnerabilities in applications that use this component. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Bugtraq: two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other) *** --------------------------------------------- two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other) --------------------------------------------- http://www.securityfocus.com/archive/1/533692 *** Java Reflection API Woes Resurface in Latest Oracle Patches *** --------------------------------------------- Oracles Critical Patch update addresses 154 vulnerabilities, many of which are remotely exploitable. Security Explorations of Poland, meanwhile, published details on a number of Java flaws in the Java Reflection API. --------------------------------------------- http://threatpost.com/java-reflection-api-woes-resurface-in-latest-oracle-p… *** Bugtraq: Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin *** --------------------------------------------- Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/533699 *** Bugtraq: Paypal Inc MultiOrderShipping API - Filter Bypass & Persistent XML Vulnerability *** --------------------------------------------- Paypal Inc MultiOrderShipping API - Filter Bypass & Persistent XML Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/533698 *** OpenSSL Releases OpenSSL 1.0.1j, 1.0.0o and 0.9.8zc, (Wed, Oct 15th) *** --------------------------------------------- This update to the OpenSSL Library addresses 3 vulnerabilities. One of these is the POODLE vulnerability announced yesterday. CVE-2014-3513: A memory leak in parsing DTLS SRTPmessages can lead to a denial of service. You are vulnerable, unless you specificly compiled your OpenSSL library with the OPENSSL_NO_SRTP option. All 1.0.1 versions of OpenSSL are affected. CVE-2014-3567: Another memory leak that can lead to a DoS attack. In this case, memory is not free up if an SSL session ticket fails --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18835&rss

1 0

Tageszusammenfassung - Dienstag 14-10-2014
by Daily end-of-shift report 14 Oct '14

14 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-10-2014 18:00 − Dienstag 14-10-2014 18:00 Handler: Stefan Lenzhofer Co-Handler: Otmar Lendl *** Developer of hacked Snapchat web app says "Snappening" claims are hoax *** --------------------------------------------- 500 MB of images pulled from third-party site, but no user data was attached. --------------------------------------------- http://arstechnica.com/security/2014/10/developer-of-hacked-snapchat-web-ap… *** VB2014 paper: The evolution of webinjects *** --------------------------------------------- Jean-Ian Boutin looks at the increased commoditization of webinjects.Virus Bulletin has always been about sharing information, and the Virus Bulletin conference is an important part of that. We would love to be able to share some of the discussions attendees had during the lunch and coffee breaks, the late-night or early-morning meetings in the hotel lobby, and the inspiration one gets from being around such bright minds.Of course, we are unable to do that. But what we can do is share some of --------------------------------------------- http://www.virusbtn.com/blog/2014/10_13.xml?rss *** Cisco AsycnOS Software ZIP Filtering By-Pass Vulnerability *** --------------------------------------------- CVE-2014-3381 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Exploring and Exploiting iOS Web Browsers *** --------------------------------------------- Today we begin a three-post series about mobile security. We start with a discussion of vulnerabilities in iOS web browsers. Later this week well cover jailbreaking and the detection of it. While the release and adoption of iOS 8 may plug some of the holes discussed in this post, many users will continue to use iOS 7 for some time and may remain vulnerable. In Q1 2014, the market share of web traffic from mobile browsers exceeded 30% [1], and it is constantly growing. According to data provided --------------------------------------------- http://blog.spiderlabs.com/2014/10/exploring-and-exploiting-ios-web-browser… *** VMSA-2014-0010.12 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** A Code Signature Plugin for IDA *** --------------------------------------------- When reversing embedded code, it is often the case that completely different devices are built around a common code base, either due to code re-use by the vendor, or through the use of third-party software; this is especially true of devices running the same Real Time Operating System. For example, ... --------------------------------------------- http://www.devttys0.com/2014/10/a-code-signature-plugin-for-ida/ *** vBulletin Input Validation Flaw in XMLRPC API Lets Remote Users Inject SQL Commands *** --------------------------------------------- vBulletin Input Validation Flaw in XMLRPC API Lets Remote Users Inject SQL Commands --------------------------------------------- http://www.securitytracker.com/id/1031001 *** vBulletin Input Validation Flaw in XMLRPC API Permits Cross-Site Scripting Attacks *** --------------------------------------------- vBulletin Input Validation Flaw in XMLRPC API Permits Cross-Site Scripting Attacks --------------------------------------------- http://www.securitytracker.com/id/1031000 *** iSIGHT discovers zero-day vulnerability CVE-2014-4114 *** --------------------------------------------- Zero-day impacting all versions of Microsoft Windows used in Russian cyber-espionage campaign targeting NATO, European Union, Telecommunications and Energy sectors. --------------------------------------------- http://www.isightpartners.com/2014/10/cve-2014-4114/ *** HTTPS-Zertifikate: Key Pinning schützt vor bösartigen Zertifizierungsstellen *** --------------------------------------------- Eine bislang wenig beachtete HTTPS-Erweiterung mit dem Namen HTTP Public Key Pinning (HPKP) steht kurz vor ihrer Standardisierung. Durch Public Key Pinning könnten viele Probleme mit den Zertifizierungsstellen gelöst werden. (Google, Browser) --------------------------------------------- http://www.golem.de/news/https-zertifikate-key-pinning-schuetzt-vor-boesart… *** Windows-Exploit: Russische Hacker greifen angeblich Nato und Regierungen an *** --------------------------------------------- Russische Hacker sollen in den vergangenen Jahren zahlreiche Ziele im Westen und in der Ukraine angegriffen haben. Sie nutzten dabei offenbar eine Sicherheitslücke aus, die in allen aktuellen Windows-Versionen bestehen und am Dienstag gepatcht werden soll. (Microsoft, Datenschutz) --------------------------------------------- http://www.golem.de/news/windows-exploit-russische-hacker-greifen-angeblich… *** Truly scary SSL 3.0 vuln to be revealed soon: sources *** --------------------------------------------- So worrying, no ones breathing a word until patch is out Gird your loins, sysadmins: The Register has learned that news of yet another major security vulnerability - this time in SSL 3.0 - is probably imminent. --------------------------------------------- http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_… *** Angeblich 7 Millionen Dropbox-Passwörter im Umlauf *** --------------------------------------------- Hacker wollen Millionen von Passwörtern für Dropbox-Accounts abgegriffen haben. Diese sollen gegen Bitcoins nun veröffentlicht werden. Dropbox streitet ab, dass die Daten echt sind. --------------------------------------------- http://www.heise.de/security/meldung/Angeblich-7-Millionen-Dropbox-Passwoer… *** VeraCrypt a Worthy TrueCrypt Alternative *** --------------------------------------------- If youre reluctant to continue using TrueCrypt now that the open source encryption project has been abandoned, and you dont want to wait for the CipherShed fork to mature, one alternative thats well worth investigating is VeraCrypt. --------------------------------------------- http://www.esecurityplanet.com/open-source-security/veracrypt-a-worthy-true… *** Apache mod_cache Null Pointer Dereference Lets Remote Users Deny Service *** --------------------------------------------- Apache mod_cache Null Pointer Dereference Lets Remote Users Deny Service --------------------------------------------- http://www.securitytracker.com/id/1031005 *** Analysis of the Linux backdoor used in freenode IRC network compromise *** --------------------------------------------- Background freenode is a large IRC network providing services to Free and Open Source Software communities, and in September the freenode staff team blogged about a potential compromise of an IRC server. NCC Group's Cyber Defence Operations team provided pro bono digital forensic and reverse engineering services to assist the freenode infrastructure team with their incident response activities. In this post we discuss a subset of the information we documented about one of the components --------------------------------------------- https://www.nccgroup.com/en/blog/2014/10/analysis-of-the-linux-backdoor-use… *** [webapps] - Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities *** --------------------------------------------- Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/34956 *** YouTube Ads Lead To Exploit Kits, Hit US Victims *** --------------------------------------------- Malicious ads are a common method of sending users to sites that contain malicious code. Recently, however, these ads have showed up on a new attack platform: YouTube. Over the past few months, we have been monitoring a malicious campaign that used malicious ads to direct users to various malicious sites. Users in the United States have .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/youtube-ads-lead… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM SAN b-type Switches (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by IBM SAN b-type Switches. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s): IBM MTM: 2499-816 IBM System --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Endpoint Manager for Remote Control. CVE-2014-3511, CVE-2014-5139 *** --------------------------------------------- There are multiple vulnerabilities in OpenSSL that is used by IBM Endpoint Manager for Remote Control. These issues were disclosed on August 6, 2014 by the OpenSSL Project. CVE(s): CVE-2014-3511 and CVE-2014-5139 Affected product(s) and affected version(s): IBM Endpoint Manager for Remote Control version 9.1.0. Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21682034 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect IBM Endpoint Manager for Remote Control *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 Service Refresh 7 and earlier, and IBM Runtime Environment Java Technology Edition, Version 7 Service Refresh 7 and earlier, that is used by IBM Endpoint Manager for Remote Control. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4209, CVE-2014-4220, --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.35 *** --------------------------------------------- Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 7.0.0.35, IBM WebSphere Application Server Hypervisor 7.0.0.35 and IBM HTTP Server 7.0.0.35. CVE(s): CVE-2014-3021, CVE-2014-3083, CVE-2014-0226, CVE-2014-0231, CVE-2014-0118, CVE-2013-5704, CVE-2014-4770 and CVE-2014-4816 Affected product(s) and affected version(s): Version 8.5 Full Profile and Liberty Profile Version 8 Version 7 Refer to the following reference URLs for remediation and --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Jailbreak Detection Methods *** --------------------------------------------- This post concludes our three-part series about mobile security. Todays post will outline some options for detecting jailbroken devices, should you choose to do so. Yesterday, we asked whether blocking an apps execution on jailbroken devices was worth it. Earlier this week, we described some vulnerabilities in iOS web browsers. Many iOS applications contain some sort of jailbreak detection mechanism. Some of the detection mechanisms can be bypassed by attackers (sometimes easily), whereas --------------------------------------------- http://blog.spiderlabs.com/2014/10/jailbreak-detection-methods.html *** Executing Apps on Jailbroken Devices *** --------------------------------------------- This post is part two of a three-part series about mobile security. Todays post will discuss the execution of apps on jailbroken devices. Yesterday, we described some vulnerabilities in iOS web browsers. Tomorrow, well explore detecting jailbroken devices. --------------------------------------------- http://blog.spiderlabs.com/2014/10/executing-apps-on-jailbroken-devices.html *** 5 steps to lock down your webmail account *** --------------------------------------------- For most people Gmail, Outlook.com or Yahoo! Mail is their main personal account. Here are some of the most important steps to keep unwanted people out of your web-based email account. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/14/5-steps-to-lock-down-your-webmai…

1 0

Tageszusammenfassung - Montag 13-10-2014
by Daily end-of-shift report 13 Oct '14

13 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-10-2014 18:00 − Montag 13-10-2014 18:00 Handler: Stefan Lenzhofer Co-Handler: Otmar Lendl *** Poor punctuation leads to Windows shell vulnerability *** --------------------------------------------- An attack on Windows scripts shows that quotation marks aren't just for writers. --------------------------------------------- http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-s… *** Researchers observe new type of SYN flood DDoS attack *** --------------------------------------------- Researchers with Radware are referring to the new type of distributed denial-of-service attack as a Tsunami SYN Flood Attack. --------------------------------------------- http://www.scmagazine.com/researchers-observe-new-type-of-syn-flood-ddos-at… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271,CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug"? or "Shellshock"? and two memory corruption vulnerabilities. Bash is used by IBM SDN VE. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s): IBM SDN VE, Unified Controller, VMware Edition: 1.2.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Malware overview: Threats to Mac OS X and other IT security hazards of September 2014 *** --------------------------------------------- October 2, 2014 In September, a number of new threats to Mac OS X were discovered by Doctor Webs security researchers. They included the complex backdoor Mac.BackDoor.iWorm as well as the Trojan Mac.BackDoor.Ventir.1 and the spyware program Mac.BackDoor.XSLCmd. Unexpectedly, gamers came under attack by Trojan.SteamBurglar which steals virtual game items from Steam users to later resell them to other players. As usual, plenty of virus definitions for malware programs geared towards Windows were --------------------------------------------- http://news.drweb.com/show/?i=5982&lng=en&c=9 *** Androids Cyanogenmod open to MitM attacks *** --------------------------------------------- Code re-use spells zero day for millions of modders More than 10 million users of the popular Cyanogen build of Android are exposed to man-in-the-middle (MitM) attacks thanks to reuse of vulnerable sample code. --------------------------------------------- http://www.theregister.co.uk/2014/10/13/androids_cyanogenmod_open_to_mitm_a… *** Adobe, Microsoft, Oracle: Oktober-Patchtag wird aufwendiger als sonst *** --------------------------------------------- Adobe, Microsoft und Oracle werden am kommenden Dienstagabend zahlreiche Patches veröffentlichen: Der Oktober-Patchtag bei allen drei Unternehmen überschneidet sich. Einerseits entlastet dies die Admins, andererseits müssen sie sich auf eine größere Patch-Menge einstellen. (Microsoft, Java) --------------------------------------------- http://www.golem.de/news/adobe-microsoft-oracle-oktober-patchtag-wird-aufwe… *** WordPress is the Most Attacked CMS: Report *** --------------------------------------------- Data security firm Imperva released its fifth annual Web Application Attack report (WAAR) this week, a study designed track the latest trends and cyber threats facing web applications. --------------------------------------------- http://www.securityweek.com/wordpress-most-attacked-cms-report *** SSA-860967 (Last Update 2014-10-13): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- SSA-860967 (Last Update 2014-10-13): GNU Bash Vulnerabilities in Siemens Industrial Products --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-234763 (Last Update 2014-10-13): OpenSSL Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- SSA-234763 (Last Update 2014-10-13): OpenSSL Vulnerabilities in Siemens Industrial Products --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-839231 (Last Update 2014-10-13): Incorrect Certificate Verification in Ruggedcom ROX-based Devices *** --------------------------------------------- SSA-839231 (Last Update 2014-10-13): Incorrect Certificate Verification in Ruggedcom ROX-based Devices --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PHP 5.6.1 schlie�t potentiell gef�hrlichen Puffer�berlauf *** --------------------------------------------- Die aktuelle PHP-Version behebt eine Reihe von Bugs, darunter auch eine von Stefan Esser entdeckte Sicherheitslücke. Diese ist einfach auszunutzen und kann missbraucht werden, um aus der Ferne Schadcode auszuführen. --------------------------------------------- http://www.heise.de/security/meldung/PHP-5-6-1-schliesst-potentiell-gefaehr… *** Mobile threats in September 2014 *** --------------------------------------------- October 2, 2014 As in previous months, in September Doctor Webs security researchers registered multiple attacks on handhelds. In particular, the Dr.Web virus database was expanded to include numerous definitions of threats to Android involving banking Trojans, ransomware, spies, and even a dangerous vandal Trojan, among others. Also added to the database was an entry for another malicious application that operates on jailbroken devices. The number of new malicious programs for Android and --------------------------------------------- http://news.drweb.com/show/?i=5983&lng=en&c=9 *** FinFisher Malware Analysis - Part 3 (Last) *** --------------------------------------------- I've already covered most parts of FinFisher malware in last two articles. This time, in this article, which is last article related to FinFisher, I'll cover last important tricks, methods and techniques used by FinFisher. So I'll make categorize them by subject:... --------------------------------------------- https://www.codeandsec.com/FinFisher-Malware-Analysis-Part-3 *** Who�s Watching Your WebEx? *** --------------------------------------------- KrebsOnSecurity spent a good part of the past week working with Cisco to alert more than four dozen companies -- many of them household names -- about regular corporate WebEx conference meetings that lack passwords and are thus open to anyone who wants to listen in. --------------------------------------------- http://krebsonsecurity.com/2014/10/whos-watching-your-webex *** Kmart becomes the latest retail data breach victim *** --------------------------------------------- Kmart has been confirmed as the latest retail chain to be breached after its parent company admitted that some customers� debit and credit card numbers had been compromised. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/13/kmart-becomes-the-latest-retail-…

1 0

Tageszusammenfassung - Freitag 10-10-2014
by Daily end-of-shift report 10 Oct '14

10 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-10-2014 18:00 − Freitag 10-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cisco addresses numerous vulnerabilities in ASA software *** --------------------------------------------- Many of the vulnerabilities can lead to a denial-of-service condition, but others could result in a full compromise of the affected system. --------------------------------------------- http://www.scmagazine.com/vulnerabilities-in-cisco-asa-software/article/376… *** CSAM: My servers started speaking IRC, and that is when I started to listen!, (Thu, Oct 9th) *** --------------------------------------------- Hassan submitted this story: While reviewing our IDS logs, we noticed an alert for IRC botnet traffic coming from multiple servers in a specific VLAN. Ouch! One thing I keep saying in our IDS Class: If your servers all for sudden start joining IRC channels, then they are either very bored, or very compromised. But lets see how it went for Hassan. Hassan had what every analyst wants: pcaps! So he looked at the full packet capture of the traffic: The traffic wasnt 100% IRC. But it looked... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18799&rss *** Critical Patch Update - October 2014 Pre-Release Announcement *** --------------------------------------------- Critical Patch Update - October 2014 Pre-Release Announcement --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html *** MS14-OCT - Microsoft Security Bulletin Advance Notification for October 2014 - Version: 1.0 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on October 14, 2014. This bulletin advance notification will be replaced with the October bulletin summary on October 14, 2014. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-OCT *** Signed Malware = Expensive "Oops" for HP *** --------------------------------------------- Computer and software industry maker HP is in the process of notifying customers about a seemingly harmless security incident in 2010 that nevertheless could prove expensive for the company to fix and present unique support problems for users of its older products. --------------------------------------------- http://krebsonsecurity.com/2014/10/signed-malware-is-expensive-oops-for-hp/ *** Malware analysts tell crooks to shape up and write decent code *** --------------------------------------------- Who writes their own crypto these days? Seriously! Blackhats beware: reverse engineers are laughing at your buggy advanced persistent threat (APT) malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/10/writing_bet… *** Zwei-Faktor-Authentifizierung: Apple erhöht die Sicherheit für iCloud *** --------------------------------------------- Apple weitet die Zwei-Faktor-Authentifizierung aus. Ab sofort sind anwendungsspezifische Passwörter für den Zugriff auf iCloud-Daten Pflicht. --------------------------------------------- http://www.golem.de/news/zwei-faktor-authentifizierung-apple-erhoeht-die-si… *** Crims zapped mobes, slabs we collared for evidence, wail cops *** --------------------------------------------- Dont worry, sarge, we got all the ... oh, WTF! You know that nifty remote wipe function that takes all the photos off your phone when it gets lost? Turns out criminals know about it too, and theyre using it to wipe phones taken by police as evidence. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/10/police_say_… *** WordPress Websites Continue to Get Hacked via MailPoet Plugin Vulnerability *** --------------------------------------------- The popular Mailpoet(wysija-newsletters) WordPress plugin had a serious file upload vulnerability a few months back, allowing an attacker to upload files to the vulnerable site. This issue was disclosed months ago, the MailPoet team patched it promptly. It seems though that many are still not getting the word, or blatantly not updating, because we areRead More --------------------------------------------- http://blog.sucuri.net/2014/10/wordpress-websites-continue-to-get-hacked-vi… *** May-August 2014 *** --------------------------------------------- The NCCIC/ICS-CERT Monitor for May-August 2014 is a summary of ICS-CERT activities for that period of time. --------------------------------------------- https://ics-cert.us-cert.gov//monitors/ICS-MM201408 *** TWiki Sandbox.pm File Validation Flaw Lets Remote Authenticated Users Upload Arbitrary Windows Apache Configuration Files *** --------------------------------------------- http://www.securitytracker.com/id/1030982 *** TWiki debugenableplugins Parameter Lets Remote Users View and Modify Files *** --------------------------------------------- http://www.securitytracker.com/id/1030981 *** VMSA-2014-0006.11 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** PayPal Inc BB #85 MB iOS 4.6 - Auth Bypass Vulnerability *** --------------------------------------------- The Vulnerability Laboratory Research Team discovered a security auth protection mechanism bypass vulnerability in the PayPal Inc iOS Mobile Application. --------------------------------------------- http://www.vulnerability-lab.com/get_content.php?id=895 *** Cisco Security Notices for Autonomic Networking Infrastructure *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** HPSBHF03136 rev.1 - HP TippingPoint NGFW running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP TippingPoint NGFW running OpenSSL. This is the OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU02895 SSRT101253 rev.4 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBNS03130 rev.1 - HP NonStop Development Environment for Eclipse (NSDEE) running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Development Environment for Eclipse (NSDEE) running Bash Shell . This is the Bash Shell vulnerability known as "ShellShock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBST03122 rev.1 - HP StoreAll Operating System Software running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP StoreAll Operating System Software running Bash Shell. This is the Bash Shell vulnerability known as "Shellshock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Seven (7) Vulnerabilities in OpenSSL affect IBM FlashSystem 840 and V840 (CVEs) *** --------------------------------------------- OpenSSL vulnerabilities affect the IBM FlashSystem 840 and V840 products. These vulnerabilities could allow a remote attacker to execute arbitrary code on the system, to obtain sensitive information, or cause of denial of service. CVE(s): CVE-2014-3509, CVE-2014-3506, CVE-2014-3507, CVE-2014-3511, CVE-2014-3505, CVE-2014-3510 and CVE-2014-3508 Affected product(s) and affected version(s): IBM FlashSystem 840: Machine Type 9840, model -AE1 (all supported releases before 1.1.2.7) Machine Type... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Six (6) Vulnerabilities in Network Security Services (NSS) & Netscape Portable Runtime (NSPR) affect IBM FlashSystem 840 and V840 (CVE-2013-1740, CVE-2014-1490, CVE-2014-1491, CVE-2014-1492, CVE-2014-1544, CVE-2014-1545) *** --------------------------------------------- NSS & NSPR vulnerabilities affect the IBM FlashSystem 840 and V840 products. These vulnerabilities could allow a remote attacker to execute arbitrary code, on the system, to obtain sensitive information, or cause Denial of Service. CVE(s): CVE-2013-1740, CVE-2014-1490, CVE-2014-1491, CVE-2014-1492, CVE-2014-1544 and CVE-2014-1545 Affected product(s) and affected version(s): IBM FlashSystem 840: Machine Type 9840, model -AE1 (all supported releases before 1.1.2.7) Machine Type 9843,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM WebSphere MQ Telemetry Component - Potential authentication bypass vulnerability when using the JAASConfig property (CVE-2014-6116) *** --------------------------------------------- IBM WebSphere MQ contains a vulnerability in which authentication is bypassed by MQTT clients with the "JAASConfig" configuration property set. CVE(s): CVE-2014-6116 Affected product(s) and affected version(s): IBM WebSphere MQ Telemetry Component WebSphere MQ 8.0.0.1 downloaded prior to 24th September 2014 (Level: p000-001-L140910). To check your fix pack level, issue the command dspmqver and check the output of the Level option. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Proventia Network Security Controller is affected by multiple OpenSSL vulnerabilities *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported by the OpenSSL Project (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0160, CVE-2014-0076, CVE-2014-3508, CVE-2014-5139, CVE-2014-3509, CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512) CVE(s): CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0160, CVE-2014-0076, CVE-2014-3508,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Remote Code Execution Vulnerability Security Bulletin: TRIRIGA Application Platform (CVE-2014-4840) *** --------------------------------------------- IBM TRIRIGA Application Platform could allow an attacker to execute code on the vulnerable server. An attacker could send a specially crafted URL to the server that would execute commands as the privileges of the unprivileged user running the server. CVE(s): CVE-2014-4840 Affected product(s) and affected version(s): The following Application Platform versions are affected. IBM TRIRIGA Application Platform 3.4.0 IBM TRIRIGA Application Platform 3.3.2 and 3.3.2.1 fix pack... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins for Products affected by Vulnerabilities in Bash *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 9-10-2014
by Daily end-of-shift report 09 Oct '14

09 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-10-2014 18:00 − Donnerstag 09-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Pricing Policies in the Cyber Criminal Underground *** --------------------------------------------- Underground markets are places on the Internet where criminal gangs offer a wide range of illegal products and services. Black markets are crowded places where single individuals or criminal organizations could acquire or rent products and services at very competitive prices. Like any other market, in black markets the relationship between supply and demand determines the price of the products. A growing number of highly specialized sellers are offering their wares, and the huge offer is... --------------------------------------------- http://resources.infosecinstitute.com/pricing-policies-cyber-criminal-under… *** Working Paper: Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005-2014 *** --------------------------------------------- Some 229 data breach incidents involved the personal records of people in Europe. Globally, all these incidents resulted in the loss of some 645 million records, though not all of these breaches exclusively involved people in Europe. Within Europe, we confirmed 200 cases involving people in Europe, and 227 million records lost in Europe... --------------------------------------------- http://www.databreaches.net/working-paper-data-breaches-in-europe-reported-… *** Bash Bug Saga Continues: Shellshock Exploit Via DHCP *** --------------------------------------------- The Bash vulnerability known as Shellshock can be exploited via several attack surfaces including web applications, DHCP, SIP, and SMTP. With multiple proofs of concept (including Metasploit code) available in the public domain, this vulnerability is being heavily exploited. Most discussion of Shellshock attacks have focused on attacks on web apps. There has been relatively... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/1tDC5sTfbUQ/ *** Android: Rund die Hälfte aller Geräte von Sicherheitslücke betroffen *** --------------------------------------------- 45 Prozent aller Android-Smartphones sind noch immer von einer vor wenigen Wochen entdeckten Sicherheitslücke im Smartphone-Browser betroffen. In Deutschland liegt die Zahl sogar deutlich höher. --------------------------------------------- http://www.golem.de/news/android-rund-die-haelfte-aller-geraete-von-sicherh… *** Flying Blind *** --------------------------------------------- With all the news about data breaches lately, it's not particularly surprising to wake up to headlines describing yet another one. What is perhaps a bit surprising, however, is the common theme that seems to exist in many of the... --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/10/flying-blind.html *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- cisco-sa-20141008-asa --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Juniper Junos Security Bulletins *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10655&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10654&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10653&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10652&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10651&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10650&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10649&actp=RSS *** Schneider Electric SCADA Expert ClearSCADA Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-259-01 Schneider Electric SCADA Expert ClearSCADA Vulnerabilities that was published September 16, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in Schneider Electric's StruxureWare SCADA Expert ClearSCADA. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-259-01A *** Siemens SIMATIC WinCC Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-205-02 Siemens SIMATIC WinCC Vulnerabilities that was published July 24, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens SIMATIC WinCC application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-205-02A *** Security_Advisory-9 OpenSSL Vulnerabilities on Huawei products *** --------------------------------------------- Oct 08, 2014 20:28 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** VMSA-2014-0010.10 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** SA-CONTRIB-2014-097 - nodeaccess - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-097Project: Nodeaccess (third-party module)Version: 6.x, 7.xDate: 2014-October-08Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Access bypassDescriptionNodeaccess is a Drupal access control module which provides view, edit and delete access to nodes.This module enables you to inadvertently allow an author of a node view/edit/delete the node in question (who may not have access). The module --------------------------------------------- https://www.drupal.org/node/2352757 *** SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-096Project: OAuth2 Client (third-party module)Version: 7.xDate: 2014-October-08Security risk: 10/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionOAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication.Within its API code the Client class exposes variables in an error message, which originate from a third party source without --------------------------------------------- https://www.drupal.org/node/2352747 *** DSA-3048 apt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3048 *** OpenSSH <=6.6 SFTP misconfiguration exploit for 64bit Linux *** --------------------------------------------- OpenSSH lets you grant SFTP access to users without allowing full command execution using "ForceCommand internal-sftp". However, if you misconfigure the server and dont use ChrootDirectory, the user will be able to access all parts of the filesystem that he has access to - including procfs. On modern Linux kernels (>=2.6.39, I think), /proc/self/maps reveals the memory layout and /proc/self/mem lets you write to arbitrary memory positions. Combine those and you get easy RCE. --------------------------------------------- http://seclists.org/fulldisclosure/2014/Oct/35 *** Onapsis Security Advisories for SAP Products *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100052 http://cxsecurity.com/issue/WLB-2014100051 http://cxsecurity.com/issue/WLB-2014100050 http://cxsecurity.com/issue/WLB-2014100049 http://cxsecurity.com/issue/WLB-2014100048 http://cxsecurity.com/issue/WLB-2014100047 http://cxsecurity.com/issue/WLB-2014100046 *** Security Advisory-Memory Overflow Vulnerabilities on Huawei E5332 Webserver *** --------------------------------------------- Oct 09, 2014 11:51 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** HPSBMU03127 rev.1 - HP Operations Manager for UNIX, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP Operations Manager for UNIX. The vulnerability can be exploited remotely to execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU03110 rev.1 - HP Sprinter, Remote Execution of Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Sprinter. The vulnerabilities could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Spider Facebook 1.0.8 - SQL Injection *** --------------------------------------------- 2014-10-08T19:00:47 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7639 *** Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-10-09T11:38:57 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7641 *** EWWW Image Optimizer 2.0.1 Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-10-09T11:35:36 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7640

1 0

Tageszusammenfassung - Mittwoch 8-10-2014
by Daily end-of-shift report 08 Oct '14

08 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-10-2014 18:00 − Mittwoch 08-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ISACA announces entry-level cybersecurity certificate *** --------------------------------------------- A new cybersecurity certificate has been launched by global IT association ISACA thats intended for those looking to break into the field. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/C8kTkbciKh0/ *** Belkin Router Apocalypse: heartbeat.belkin.com outage taking routers down *** --------------------------------------------- According ot various reports, many users of Belkin routers had problems connecting to the internet as of last night. It appears that the router will occasionally ping">heartbeat.belkin.com to detect network connectivity. The heartbeat host is however not reachable for some hosts. Currently, the host responds to ICMP">As a workaround, you can add an entry to the routers host file pointing heartbeat.belkin.com to 127.0.0.1. This appears to remove the block. Also, the block only... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18779&rss *** Caution: Gaming fraud! *** --------------------------------------------- October 6, 2014 At the end of September, Doctor Web issued a report about the new Trojan program Trojan.SteamBurglar.1, which steals game items from Steam users, particularly Dota 2 fans. So far Doctor Webs security researchers have learnt about several dozen modifications of this malware. However, cybercriminals seeking to take advantage of massively multiplayer online role-playing game (MMORPG) players have other tools at their disposal to make illicit profit. In this post we will talk about... --------------------------------------------- http://news.drweb.com/show/?i=5987&lng=en&c=9 *** Arbor: DDoS Attacks Getting Bigger as Reflection Increases *** --------------------------------------------- New reflected distributed denial of service attack techniques are increasing the volume of each attack as well as the overall frequency of large-scale DDoS attacks. --------------------------------------------- http://threatpost.com/arbor-ddos-attacks-getting-bigger-as-reflection-incre… *** The facts about BadUSB *** --------------------------------------------- Introduction Since the BadUSB talk[1] by Karsten Nohl and Jakob Lell at Black Hat USA in August there has been much discussion about the implications of this class of USB attack. The discussions gained additional momentum when Adam Caudill and Brandon Wilson investigated the attack further and publicly released working code[2] at the DerbyCon security conference. This blog post is intended to dispel some of the misunderstandings that have arisen around BadUSB and provide some practical advice... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/10/the-facts-about-badusb/ *** Paper: The Hulk *** --------------------------------------------- Raul Alvarez studies cavity file infector.Most file infectors increase the length of the infected file, as the malicious code is added as a new section of the host file, or to the last section of that file. Cavity file infectors are different though: they infect files without increasing their size.Today, we publish a paper by Raul Alvarez, a researcher for Fortinet, in which he studies Win32/Huhk, a virus that implements cavity file infection.In the paper, Raul explains what happens when an... --------------------------------------------- http://www.virusbtn.com/blog/2014/10_08a.xml?rss *** "Tickende Zeitbombe": Windows XP noch immer verbreitet *** --------------------------------------------- Fast sieben Prozent aller deutschen Rechner mit Internetanschluss laufen noch unter Windows XP, ein halbes Jahr nach dem offiziellen Support-Ende. Dabei sind die Geräte nicht nur selbst gefährdet, sondern auch eine Gefahr für andere. --------------------------------------------- http://www.heise.de/newsticker/meldung/Tickende-Zeitbombe-Windows-XP-noch-i… *** remote syslog PRI vulnerability CVE-2014-3683 *** --------------------------------------------- While preparing a fix for CVE-2014-3634 for sysklogd, mancha discovered and privately reported that the initial rsyslog fix set was incomplete. It did not cover cases where PRI values > MAX_INT caused integer overflows resulting in negative values. --------------------------------------------- http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/ *** [R1] Tenable Nessus Web UI Scanned Content Stored XSS *** --------------------------------------------- The Nessus scanners web-based user interface (Web UI) was vulnerable to a stored cross-site scripting (XSS) attack. The issue was due to a security control being briefly removed due to a regression error. During this 48 hour window, one new build of the Web UI was released leading to the ability to inject arbitrary script code. This could be done by setting up a malicious web server that returned a crafted host header containing JavaScript. When Nessus scanned the web server, the input would be... --------------------------------------------- http://www.tenable.com/security/tns-2014-08 *** Alert for CVE-2014-7169 Bash "Shellshock" *** --------------------------------------------- Alert for CVE-2014-7169 Bash "Shellshock" --------------------------------------------- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-23032… *** Cisco Intrusion Prevention System MainApp Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-3402 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VMSA-2014-0010.9 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** Cuckoo Sandbox 1.1.1 *** --------------------------------------------- This is an immediate release of Cuckoo Sandbox 1.1.1, an hotfix for a security vulnerability discovered by Robert Michel from G-Data. The vulnerability is an arbitrary file upload from the guest virtual machines to the host system, which could potentially translate in command or code execution. It affects all versions of Cuckoo Sandbox from 0.6. --------------------------------------------- http://cuckoosandbox.org/2014-10-07-cuckoo-sandbox-111.html *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Wordfence <= 5.2.4 Multiple Vulnerabilities (XSS & Bypasses) *** --------------------------------------------- 2014-10-07T16:27:12 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7636

1 0

Tageszusammenfassung - Dienstag 7-10-2014
by Daily end-of-shift report 07 Oct '14

07 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-10-2014 18:00 − Dienstag 07-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Confusion over SSL and 1024 bit keys, (Tue, Oct 7th) *** --------------------------------------------- Yesterday and today, a post on reddit.org caused quite a bit of uncertainty about the security of 1024 bit RSA keys if used with OpenSSL. The past referred to a presentation given at a cryptography conference, stating that 1024 Bit SSL keys can be factored with moderate resources ("20 minutes on a Laptop"). It was suggested that this is at least in part due to a bug in OpenSSL, which according to the post doesnt pick the random keys from the entire space available. It looks more and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18775&rss *** Yahoo says attackers looking for Shellshock found a different bug *** --------------------------------------------- Yahoo said Monday it has fixed a bug that was mistaken for the Shellshock flaw, but no user data was affected.Three of the companys servers with APIs (application programming interfaces) that provide live streaming for its Sports service "had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers," wrote Alex Stamos, Yahoos chief information security officer.Stamos wrote on the Hacker News website that the servers had been patched after the... --------------------------------------------- http://www.csoonline.com/article/2692375/security/yahoo-says-attackers-look… *** Tyupkin Malware Infects ATMs Worldwide *** --------------------------------------------- The Tyupkin malware, spotted on ATMs in Eastern Europe, allows criminals to make withdrawals of 40 banknotes at a time, researchers at Kaspersky Lab said. --------------------------------------------- http://threatpost.com/tyupkin-malware-infects-atms-in-eastern-europe/108734 *** Phishing with help from Compromised WordPress Sites *** --------------------------------------------- We get thousands of spam and phishing emails daily. We use good spam filters (along with Gmail) and that greatly reduces the noise in our inbox. Today though, one slipped through the crack and showed up in my personal inbox: As I went to mark the email as Spam, I decided to hover over the... --------------------------------------------- http://blog.sucuri.net/2014/10/phishing-with-help-from-compromised-wordpres… *** Huge Security Hole in ZPanel 10.1 *** --------------------------------------------- When it comes to managing a VPS, many of our customers would prefer to install some kind of control panel rather than do it all themselves from the command line. ZPanel is perhaps the most popular choice for this. We even offered ZPanel 10.1 as a pre-made image -- it was a very recent version (10.1.1 is the most recent at the time of writing), and there are no published security announcements relating to it. We thought it was safe. --------------------------------------------- https://chunkhost.com/blog/16/huge_security_hole_in_zpanel_10_1 *** MMD-0029-2015 - Warning of Mayhem shellshock attack *** --------------------------------------------- We afraid this wave will come during the "shellshock", and it did. The attack wave of "ELF .so malware library", and installer of a known botnet called as "Mayhem" just hit all of us. The attack came from various IP, their botnets into many NIX services, utilizing the shellshock web vulnerability scan method to download the remote installer written in Perl (replacing the previous PHP base infection). It obviously a different vector for Mayhem infection, we start --------------------------------------------- http://blog.malwaremustdie.org/2014/10/mmd-0029-2015-warning-of-mayhem.html *** Vulnerabilities in WordPress Themes an Plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7632 https://wpvulndb.com/vulnerabilities/7633 https://wpvulndb.com/vulnerabilities/7635 https://wpvulndb.com/vulnerabilities/7634 *** Distance Vector Multicast Routing Protocol Misuse *** --------------------------------------------- cisco-sr-20141006-dvmrp --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… *** CA Technologies GNU Bash Shellshock *** --------------------------------------------- Topic: CA Technologies GNU Bash Shellshock Risk: Low Text:CA20141001-01: Security Notice for Bash Shellshock Vulnerability Issued: October 01, 2014 Updated: October 03, 2014 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100036 *** SSA-214365 (Last Update 2014-10-07): Vulnerabilities in SIMATIC WinCC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Bugzilla 4.0.14, 4.2.10, 4.4.5, and 4.5.5 Security Advisory *** --------------------------------------------- The following security issues have been discovered in Bugzilla: * The realname parameter is not correctly filtered on user account creation, which could lead to user data override. * Several places were found in the Bugzilla code where cross-site scripting attacks could be used to access sensitive information. * Private comments can be shown to flagmail recipients who arent in the insider group * Specially formatted values in a CSV search results export could be used in spreadsheet software... --------------------------------------------- http://www.bugzilla.org/security/4.0.14/ *** Bugtraq: OWTF 1.0 "Lionheart" released! *** --------------------------------------------- http://www.securityfocus.com/archive/1/533629 *** IBM Security Bulletin: Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187) *** --------------------------------------------- Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187). Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. IBM recommends that you review your entire environment to identify... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities had been identified in Oracle Database related to the RDBMS Core component. (CVE-2014-4236 and CVE-2014-4245) *** --------------------------------------------- Multiple vulnerabilities had been identified in Oracle Database that is consumed by Tivoli Netcool Perfomance Manager for Wireless. (CVE-2014-4236 and CVE-2014-4245 ) CVE(s): CVE-2014-4236 and CVE-2014-4245 Affected product(s) and affected version(s): Tivoli Netcool Performance Manager (TNPM) for Wireless version 1.4 and 1.3.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Vuln: phpMyAdmin CVE-2014-7217 Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/70252 *** VU#280844: Cryoserver Security Appliance vulnerable to privilege escalation *** --------------------------------------------- Vulnerability Note VU#280844 Cryoserver Security Appliance vulnerable to privilege escalation Original Release date: 07 Oct 2014 | Last revised: 07 Oct 2014 Overview Cryoserver Security Appliance 7.3.x vulnerable to privilege escalation Description CWE-264: Permissions, Privileges, and Access Controls Cryoserver Security Appliance 7.3.x does not properly assign permission to the /etc/init.d/cryoserver shell script and allows the default support account to modify it using the /bin/cryo-mgmt --------------------------------------------- http://www.kb.cert.org/vuls/id/280844 *** VU#121036: BMC Track-It! contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#121036 BMC Track-It! contains multiple vulnerabilities Original Release date: 07 Oct 2014 | Last revised: 07 Oct 2014 Overview BMC Track-It! version 11.3.0.355 contains multiple vulnerabilities Description CWE-306: Missing Authentication for Critical Function - CVE-2014-4872BMC Track-It! exposes several dangerous remote .NET services on port 9010 without authentication. .NET remoting allows a user to invoke methods remotely and retrieve their result. The exposed service --------------------------------------------- http://www.kb.cert.org/vuls/id/121036

1 0

Tageszusammenfassung - Montag 6-10-2014
by Daily end-of-shift report 06 Oct '14

06 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-10-2014 18:00 − Montag 06-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious, (Fri, Oct 3rd) *** --------------------------------------------- We all know that anti virus, the necessary evil of basic computer security, isnt a stranger to false positives. So no big surprise here when John is writing that he ran into such a false positive during an incident response: I was scanning a forensic drive image with clamav and scored a positive hit on a file. Great. ClamAV, a free anti-virus product. Of course, we dont trust it. So John did what most of use would have done, and submitted the suspect binary to Virustotal: Virustotal showed... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18759&rss *** Detecting irregular programs and services installed in your network, (Sun, Oct 5th) *** --------------------------------------------- When the corporate network becomes target, auditing for security policy compliance can be challenging if you dont have a software controlling irregular usage of administrator privilege granted and being used to install unauthorized software or to change configuration by installing services that could cause an interruption in network service. Examples of this possible issues are additional DHCP Servers (IPv4 and IPv6), Dropbox, Spotify or ARP scanning devices. We can use nmap to detect all... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18763&rss *** Testing for opened ports with firewalk technique, (Sat, Oct 4th) *** --------------------------------------------- There is an interesting way of knowing what kind of filters are placed in the gateway of a specific host. It is called firewalk and it is based on IP TTL expiration. The algorithm goes as follows: The entire route is determined using any of the traceroute techniques available A packet is sent with the TTL equal to the distance to the target If the packet times out, it is resent with the TTL equal to the distance to the target minus one. If an ICMP type 11 code 0 (Time-to-Live exceeded) is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18761&rss *** Shellshock-like Weakness May Affect Windows *** --------------------------------------------- A weakness in Windows, similar to Shellshock, may put Windows Server deployments at risk to remote code execution. --------------------------------------------- http://threatpost.com/shellshock-like-weakness-may-affect-windows/108696 *** Bugzilla Zero-Day Exposes Zero-Day Bugs *** --------------------------------------------- A previously unknown security flaw in Bugzilla -- a popular online bug-tracking tool used by Mozilla and many of the open source Linux distributions -- allows anyone to view detailed reports about unfixed vulnerabilities in a broad swath of software. Bugzilla is expected today to issue a fix for this very serious weakness, which potentially exposes a veritable gold mine of vulnerabilities that would be highly prized by cyber criminals and nation-state actors. --------------------------------------------- http://krebsonsecurity.com/2014/10/bugzilla-zero-day-exposes-zero-day-bugs/ *** Apple anti-malware update blocks new iWorm Mac botnet *** --------------------------------------------- Apple has updated its malware blacklisting system, known as XProtect, to block a Mac attack thought to have infected over 18,500 Macs. --------------------------------------------- http://www.zdnet.com/apple-anti-malware-update-blocks-new-iworm-mac-botnet-… *** Using the Windows 10 Technical Preview? Microsoft might be watching your every move to help with feedback *** --------------------------------------------- One of the main goals with the Windows 10 Technical Preview is for Microsoft to collect feedback to help shape the final version of the operating system, which is said to be coming sometime in summer 2015. The Technical Preview requires users to register with the Windows Insider Program, which allows users to submit their own feedback about the operating system... but is Microsoft collecting more than what you think youre submitting? --------------------------------------------- http://www.winbeta.org/news/using-windows-10-technical-preview-microsoft-mi… *** SEO poisoning attacks still impacting legitimate websites *** --------------------------------------------- After recently helping a client rid their website of SEO spam, security company Sucuri detailed how SEO poisoning attacks are still impacting legitimate websites. --------------------------------------------- http://www.scmagazine.com/attackers-use-seo-spam-to-improve-the-rankings-of… *** Uni boffins: Accurate Android AV app outperforms most rivals *** --------------------------------------------- ...Dont sweat, VXers, its STILL no use against obfuscated kit German researchers have built an Android app capable of detecting 94 percent of malware quick enough to run on mobile devices they say bests current offerings in effectiveness and description. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/06/uni_bods_sa… *** Bugtraq: BulletProof Security Wordpress v50.8 - POST Inject Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533611 *** Bugtraq: CVE-2014-7277 Stored Server XSS in ZyXEL SBG-3300 Security Gateway *** --------------------------------------------- http://www.securityfocus.com/archive/1/533609 *** Bugtraq: CVE-2014-7278 DoS in ZyXEL SBG-3300 Security Gateway *** --------------------------------------------- http://www.securityfocus.com/archive/1/533610 *** Cisco IOS XR Software Compression ACL Bypass Vulnerability *** --------------------------------------------- CVE-2014-3396 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Password Disclosure Vulnerability *** --------------------------------------------- CVE-2014-3400 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco ASA Software Version Information Disclosure *** --------------------------------------------- CVE-2014-3398 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco ASA Software SharePoint RAMFS Integrity and Lua Injection Vulnerability *** --------------------------------------------- CVE-2014-3399 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletins: Vulnerabilities in Bash affect various Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Identity Assurance Solution Client (IASC) 3.1 Hotfix 2 *** --------------------------------------------- Abstract: This is an update to the shipping release of the Identity Assurance Solution Client (IASC) 3.1 also known as the Novell Enhanced Smart Card Method (NESCM). The IASC client 3.1 is a standalone method that provides smart card-based authentication for eDirectory. This Hotfix has been provided to address the following security vulnerabilities found in OpenSSL & CLDAP SDK: CVE-2014-0224 & CVE-2014-3508 (Bug 893314 / 892895) Files: NTLS.DLL, LDAPSSL.DLL Filename:... --------------------------------------------- https://download.novell.com/Download?buildid=s6M5LsksoOA~ *** Linux Kernel Seed Initialization Flaw Reduces Randomness in Certain Values and May Make TCP Sequence Numbers More Predictable *** --------------------------------------------- http://www.securitytracker.com/id/1030959 *** VMSA-2014-0010.7 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** DSA-3046 mediawiki *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3046 *** Bugtraq: [SECURITY] [DSA 3044-1] qemu-kvm security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/533619 *** Bugtraq: [SECURITY] [DSA 3045-1] qemu security update *** --------------------------------------------- [SECURITY] [DSA 3045-1] qemu security update --------------------------------------------- http://www.securityfocus.com/archive/1/533621 *** SSA-860967 (Last Update 2014-10-06): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** [remote] - OpenVPN 2.2.29 - ShellShock Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34879

1 0

Tageszusammenfassung - Freitag 3-10-2014
by Daily end-of-shift report 03 Oct '14

03 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-10-2014 18:00 − Freitag 03-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Why is your Mac all for sudden using Bing as a search engine?, (Thu, Oct 2nd) *** --------------------------------------------- Even as a Mac user, you may have heard about Bing, at least you may have seen it demonstrated in commercials [1]. But if your default search engine on your Mac is all for sudden switched to Bing, this may be due to another piece of legacy software that some Mac users may have a hard time living .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18753 *** ZDI-14-349: (0Day) Microsoft Internet Explorer ScriptEngine Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-349/ *** ZDI-14-346: (0Day) Apple OS X IOHIDSecurePromptClient Denial Of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-346/ *** Security incidents are up - and pricier! - but infosec budgets are dwindling *** --------------------------------------------- The number of security incidents is popping, as are associated costs to mop them up, according to a report from PcW. Global corporate security budgets, meanwhile, seem to be hiding in the closet, just hoping it all goes away. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/03/security-incidents-are-up-and-pr… *** OPSec for security researchers *** --------------------------------------------- Perfect OPSec is almost impossible. However implementing basic OPSec practices should become second nature for every researcher. You will be more careful and hopefully, avoid rookie mistakes like talking too much and bragging about your research. --------------------------------------------- https://securelist.com/blog/research/66911/opsec-for-security-researchers/ *** BadUSB: Der USB-Stick als digitale Waffe *** --------------------------------------------- Speicher gibt sich als anderes Gerät aus - Forscher veröffentlichen Anleitung und Werkzeuge im Internet --------------------------------------------- http://derstandard.at/2000006383347 *** US-Bericht: Über 80 Millionen Konten bei JPMorgan von Hacker-Angriff betroffen *** --------------------------------------------- Bei dem im August aufgedeckten Großangriff auf US-Amerikanische Banken, konten Hacker offenbar detaillierte Informationen von Kunden erbeuten. --------------------------------------------- http://www.heise.de/security/meldung/US-Bericht-Ueber-80-Millionen-Konten-b… *** Bugtraq: Elasticsearch vulnerability CVE-2014-6439 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533602 *** HPSBMU02895 SSRT101253 rev.3 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Command-injection vulnerability for COMMAND-Shell Scripts *** --------------------------------------------- What if we told you that a normal user in your network could take over the control of your Windows file-servers by just creating a special (but no so complex) directory-name in one of the directories he has access to? --------------------------------------------- http://www.thesecurityfactory.be/command-injection-windows.html

1 0

Tageszusammenfassung - Donnerstag 2-10-2014
by Daily end-of-shift report 02 Oct '14

02 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-10-2014 18:00 − Donnerstag 02-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Shellshock Aftershock for NAS Administrators *** --------------------------------------------- Summary FireEye has been monitoring Shellshock-related attacks closely since the vulnerability was first made public last week. Specifically, FireEye has observed attackers attempting to exploit the BASH remote code injection vulnerability against Network Attached Storage systems (NAS). These attacks .. --------------------------------------------- http://www.fireeye.com/blog/technical/2014/10/the-shellshock-aftershock-for… *** ZDI-14-335: Hewlett-Packard Network Node Manager ovopi.dll Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Network Node Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-335/ *** Vulnerabilities in Citrix Access Gateway Plug-in for Windows could result in arbitrary code execution *** --------------------------------------------- Vulnerabilities have been identified in an ActiveX based component of the Citrix Access Gateway Plug-in for Windows. The vulnerabilities, .. --------------------------------------------- http://support.citrix.com/article/CTX129902 *** The Mac.BackDoor.iWorm threat in detail *** --------------------------------------------- Doctor Webs security researchers have dissected the complex malicious program Mac.BackDoor.iWorm, a threat affecting computers running Mac OS X. As of September 29, 2014, 18,519 unique IP addresses were used by infected computers to connect the botnet created by hackers using this backdoor. The backdoor is unpacked into the directory /Library/Application Support/JavaW. Furthermore, using .. --------------------------------------------- http://news.drweb.com/show/?i=5977&lng=en&c=9 *** New Mac OS X botnet discovered *** --------------------------------------------- Doctor Webs security experts researched several new threats to Mac OS X. One of them turned out to be a complex multi-purpose backdoor that entered the virus database as Mac.BackDoor.iWorm. Criminals can issue commands that get this program to carry out a wide range of instructions on the infected machines. A statistical .. --------------------------------------------- http://news.drweb.com/show/?i=5976&lng=en&c=9 *** Norton Security: Symantec bestätigt Ende von Norton Antivirus *** --------------------------------------------- Norton Antivirus wird es als Einzelprodukt von Symantec nicht mehr geben. Nur bestehende Einzellizenzen lassen sich verlängern. --------------------------------------------- http://www.golem.de/news/norton-security-symantec-bestaetigt-ende-von-norto… *** Google zahlt 15.000 US-Dollar für Chrome-Exploits *** --------------------------------------------- Das Unternehmen hat die Maximalsumme verdreifacht, die es an Entdecker von Chrome-Lücke auszahlt. Ausserdem winkt nun ein Eintrag in die Google Hall of Fame. --------------------------------------------- http://www.heise.de/security/meldung/Google-zahlt-15-000-US-Dollar-fuer-Chr…

1 0

Tageszusammenfassung - Mittwoch 1-10-2014
by Daily end-of-shift report 01 Oct '14

01 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-09-2014 18:00 − Mittwoch 01-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How RAM Scrapers Work: The Sneaky Tools Behind the Latest Credit Card Hacks *** --------------------------------------------- In the world of hacking, every malicious tool has its heyday---that period when it rules the underground forums and media headlines and is the challenger keeping computer security pros on their toes. Viruses and worms have each had their day in the spotlight. Remote-access Trojans, which allow a hacker to .. --------------------------------------------- http://www.wired.com/2014/09/ram-scrapers-how-they-work/ *** Node.js eval() code execution *** --------------------------------------------- Node.js could allow a remote attacker to execute arbitrary code on the system, caused by the improper validation of input prior to being used in an eval() call. An attacker could exploit this vulnerability to inject and execute arbitrary PHP code on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96728 *** Advertising firms struggle to kill malvertisements *** --------------------------------------------- One provider finds a vulnerable advertising tool that allowed attackers access .. --------------------------------------------- http://arstechnica.com/security/2014/09/advertising-firms-struggle-to-kill-… *** Gedanken nach meinem shellshock *** --------------------------------------------- Zum Thema Shellshock ist mir heute nach diesem Artikel wiederholt richtig klar geworden, dass das ganze dieses mal nicht so einfach ist wie Heartbleed - die Diversität mit der sich bash bugs (bzw. shell mis-interpretationen) verstecken ist interessant!Nach lesen des Artikels kann man sich .. --------------------------------------------- http://www.cert.at/services/blog/20140930221128-1263.html *** Several vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. --------------------------------------------- http://www.typo3.org/news/article/several-vulnerabilities-in-extension-phpm… *** Splunk Enterprise 6.1.4 and 5.0.10 address four vulnerabilities *** --------------------------------------------- Splunk Enterprise versions 6.1.4 and 5.0.10 address the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88585, SPL-88587, SPL-88588, CVE-2014-3511) Persistent cross-site scripting (XSS) via .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANHS *** Attackers exploiting Shellshock (CVE-2014-6721) in the wild *** --------------------------------------------- Yesterday, a new vulnerability affecting Bash (CVE-2014-6271) was published. The new vulnerability allows attackers to execute arbitrary commands formatting an environmental variable using a specific format. It affects Bash (the Bourne Again SHell), the default command shell for Linux and .. --------------------------------------------- https://www.alienvault.com/open-threat-exchange/blog/attackers-exploiting-s… *** TimThumb is No Longer Supported or Maintained *** --------------------------------------------- http://www.binarymoon.co.uk/2014/09/timthumb-end-life/ *** Multiple vulnerabilities in HP products *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Multiple product vulnerabilities: all TP-Link "2-series" switches, all TP-Link VxWorks-based product *** --------------------------------------------- Telnet is available and cannot be disabled (confirmed by vendor) SSHv1 enabled by default if SSH is enabled (confirmed by vendor) --------------------------------------------- http://seclists.org/fulldisclosure/2014/Oct/6 *** SchneiderWEB Server Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides firmware updates for a directory traversal vulnerability in Schneider Electric's SchneiderWEB, a web HMI. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-273-01 *** Rockwell Micrologix 1400 DNP3 DOS Vulnerability *** --------------------------------------------- This advisory provides a Rockwell Automation firmware revision that mitigates .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-254-02 *** Firefox/Chrome: BERserk hätte verhindert werden können *** --------------------------------------------- Die Sicherheitslücke BERserk ist nur deshalb ein Problem, weil einige Zertifizierungsstellen sich nicht an gängige Empfehlungen für RSA-Schlüssel halten. Mit BERserk akzeptieren Firefox und Chrome gefälschte Zertifikate. --------------------------------------------- http://www.golem.de/news/firefox-chrome-berserk-haette-verhindert-werden-ko… *** Studie: Malware ist Hauptgefährdung für Unternehmens-IT *** --------------------------------------------- Laut der aktuellen /Microsoft-Sicherheitsstudie hat die Bedrohung der Unternehmens-IT durch Malware die bisherige Nummer .. --------------------------------------------- http://www.heise.de/security/meldung/Studie-Malware-ist-Hauptgefaehrdung-fu… *** Sicherheitslücke in Xen-Hypervisor betraf Cloud-Anbieter *** --------------------------------------------- Ein Programmierfehler in der Virtualisierungssoftware zwang Amazon und Rackspace, zahlreiche virtuelle Maschinen neu zu starten. Inzwischen ist die Lücke in der freien Software geschlossen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-Xen-Hypervisor-be… *** Critical FreePBX RCE Vulnerability (ALL Versions) *** --------------------------------------------- We have been made aware of a critical Zero-Day Remote Code Execution and Privilege Escalation exploit within the legacy 'FreePBX ARI Framework module/Asterisk Recording Interface (ARI)'. This affects any user who has installed FreePBX prior to version .. --------------------------------------------- http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versi…

1 0

Tageszusammenfassung - Dienstag 30-09-2014
by Daily end-of-shift report 30 Sep '14

30 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-09-2014 18:00 − Dienstag 30-09-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash *** --------------------------------------------- Last Updated: 29 Sep 2014 --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10648 *** We Take Your Privacy and Security. Seriously. *** --------------------------------------------- "Please note that [COMPANY NAME] takes the security of your personal data very seriously." If youve been on the Internet for any length of time, chances are very good that youve received at least one breach notification email or letter that includes some version of this obligatory line. But as far as lines go, this one is about as convincing as the classic break-up line, "Its not you, its me." --------------------------------------------- http://krebsonsecurity.com/2014/09/we-take-your-privacy-and-security-seriou… *** Splunk response to "shellshock" vulnerabilities *** --------------------------------------------- Description Splunk response to "shellshock" vulnerabilities: Splunk Enterprise response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Enterprise response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Cloud response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk MINT response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Storm response... --------------------------------------------- http://www.splunk.com/view/SP-CAAANJN *** WPScan Vulnerability Database a New WordPress Security Resource *** --------------------------------------------- Researcher Ryan Dewhurst released the WPScan Vulnerability Database, a database housing security vulnerabilities in WordPress core code, plug-ins and themes. Its available for pen-testers, WordPress administrators and developers. --------------------------------------------- http://threatpost.com/wpscan-vulnerability-database-a-new-wordpress-securit… *** Cisco WebEx Meetings Server Arbitrary Download Vulnerability *** --------------------------------------------- CVE-2014-3395 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... *** --------------------------------------------- Background: CVE-2014-6271 + CVE-2014-7169 During the mayhem of bash 0day remote execution vulnerability CVE-2014-6271 and CVE-2014-7169, not for bragging but as a FYI, I happened to be the first who reversed for the first ELF malware spotted used in the wild. The rough disassembly analysis and summary I wrote and posted in Virus Total & Kernel Mode here --> [-1-] [-2-] credit) (the credit is all for her for links to find this malware, for the swift sensoring & alert, and thanks for... --------------------------------------------- http://blog.malwaremustdie.org/2014/09/linux-elf-bash-0day-fun-has-only-jus… *** gnome-shell printscreen key security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96713 *** Apple schließt Shellshock-Lücken in OS X - teilweise *** --------------------------------------------- Update für die Unix-Shell Bash veröffentlicht - Scheint aber nur die ersten zwei aufgetauchten Lücken zu bereinigen --------------------------------------------- http://derstandard.at/2000006210412 *** remote syslog PRI vulnerability *** --------------------------------------------- Sysklogd is mildly affected. Having a quick look at the current git master branch, the wrong action may be applied to messages with invalid facility. ... Rsyslogd experiences the same problem as sysklogd. However, more severe effects can occur, BUT NOT WITH THE DEFAULT CONFIGURATION. The most likely and thus important attack is a remote DoS. Some of the additional tables are writable and can cause considerable misadressing. ... --------------------------------------------- http://www.rsyslog.com/security-advisories/ *** [20140904] - Core - Denial of Service *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Low Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Exploit type: Denial of Service Reported Date: 2014-September-24 Fixed Date: 2014-September-30 CVE Number: CVE-2014-7229 Description Inadequate checking allowed the potential for a denial of service attack. Affected Installs Joomla! CMS versions 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Solution Upgrade to version 2.5.26, 3.2.6, or... --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/MWxjsJYnk9U/596-20140904-c… *** [20140903] - Core - Remote File Inclusion *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Exploit type: Remote File Inclusion Reported Date: 2014-September-24 Fixed Date: 2014-September-30 CVE Number: CVE-2014-7228 Description Inadequate checking allowed the potential for remote files to be executed. Affected Installs Joomla! CMS versions 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Solution Upgrade to version 2.5.26,... --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/NTyZcpJMN00/595-20140903-c… *** IBM Sterling Connect:Direct for UNIX is affected by multiple OpenSSL vulnerabilities(CVE-2014-3508, CVE-2014-3511) *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported on 6 August 2014 by the OpenSSL Project. CVE(s): CVE-2014-3508 and CVE-2014-3511 Affected product(s) and affected version(s): IBM Sterling Connect:Direct for UNIX 4.0.00 - All versions prior to 4.0.00 Fix 131 IBM Sterling Connect:Direct for UNIX 4.1.0 - All versions prior to 4.1.0.4 iFix 33 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_sterling_connect_… *** IBM Security Bulletin: Open Redirection in IBM Tivoli Federated Identity Manager (CVE-2014-3097) *** --------------------------------------------- In certain cases, IBM Tivoli Federated Identity Manager does not handle end user provided data before using that data to construct an HTTP redirect request. CVE(s): CVE-2014-3097 Affected product(s) and affected version(s): IBM Tivoli Federated Identity Manager 6.2.0, 6.2.1, 6.2.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21684852 X-Force Database:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM InfoSphere Guardium Database Activity Monitoring (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by IBM InfoSphere Guardium Database Activity Monitoring. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s):... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Shell command injection and cross-site scripting vulnerabilities in Access Manager for Mobile and Access Manager for Web (CVE-2014-4823, CVE-2014-6079) *** --------------------------------------------- IBM Security Access Manager for Mobile and IBM Security Access Manager for Web could be affected by a command injection vulnerability and allow a cross site scripting attack. CVE(s): CVE-2014-4823 and CVE-2014-6079 Affected product(s) and affected version(s): IBM Security Access Manager for Mobile 8. - Firmware versions 8.0.0.0, 8.0.0.1, 8.0.0.3, and 8.0.0.4. IBM Security Access Manager for Web 7.0 and 8.0 - Firmware versions 7.0, 7.0.0.1, 7.0.0.2, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Denial of Service when using e-community single sign on in IBM Security Access Manager for Web (CVE-2014-4809) *** --------------------------------------------- When using e-community single sign on (ECSSO), the WebSEAL component of IBM Security Access Manager for Web could become unresponsive under certain circumstances, possibly resulting in denial of service. CVE(s): CVE-2014-4809 Affected product(s) and affected version(s): IBM Security Access Manager for Web version 7.0 appliance: All firmware versions. IBM Security Access Manager for Web version 8.0: Firmware versions 8.0.0.2, 8.0.0.3, and 8.0.0.4 Refer to the following reference URLs for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Abgeschlossen: Wartungsarbeiten Dienstag 30. September 2014 *** --------------------------------------------- Update: Die Wartungsarbeiten wurden gegen 10h abgeschlossen; insgesamt kam es zu Ausfallszeiten von etwa 15 Minuten. --------------------------------------------- http://www.cert.at/services/blog/20140929105226-1254.html

1 0

Tageszusammenfassung - Montag 29-09-2014
by Daily end-of-shift report 29 Sep '14

29 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-09-2014 18:00 − Montag 29-09-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Wartungsarbeiten Dienstag 30. September 2014 *** --------------------------------------------- Wir werden am Dienstag, 30. Sep. 2014, ab etwa 9h, Wartungsarbeiten an unserer Firewall vornehmen. Dadurch wird es zu Ausfällen aller öffentlich erreichbaren Internet-Services von CERT.at (zum Beispiel Webserver, Mail, Mailing-Listen, RSS-/Atom-Feeds etc.) kommen. Mails gehen selbstverständlich in dieser Zeit nicht verloren, es kann nur zu Verzögerungen bei Zustellung/Beantwortung kommen. Für die Webseite wird... --------------------------------------------- http://www.cert.at/services/blog/20140929105226-1254.html *** Vuln: Go TLS Server Implementation Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70156 *** Oracle - Alert for CVE-2014-7169 "Bash" *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-23032… *** Bash Command Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a vulnerability in Bash, which is part of Unix-based operating systems. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-269-01 *** Shellshock: Immer mehr Lücken in Bash *** --------------------------------------------- Die ersten Fehlerkorrekturen für die Shellshock-Lücke in Bash waren unvollständig. Inzwischen ist von fünf verschiedenen Sicherheitslücken die Rede. --------------------------------------------- http://www.golem.de/news/shellshock-immer-mehr-luecken-in-bash-1409-109483-… *** DSA-3038 libvirt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3038 *** Shellshock in the Wild *** --------------------------------------------- Michael Lin, James Bennett and David Bianco The exploitation of the BASH bug, now widely referred to as "Shellshock", is in full swing. Attackers have mobilized - multiple proof-of-concept scripts are available, including a Metasploit module, making this vulnerability very accessible. The... --------------------------------------------- http://www.fireeye.com/blog/uncategorized/2014/09/shellshock-in-the-wild.ht… *** iOS 8: Nutzung zufallsgenerierter MAC-Adressen ist eingeschränkt *** --------------------------------------------- Apples iOS 8 bringt eine Sicherheitsfunktion mit, die dem Nutzer mehr Anonymität verschaffen soll. Die Geräte mit iOS 8 wechseln ständig die MAC-Adresse, so dass ein Tracken individueller Nutzer unmöglich wird. Doch nicht jedes iOS-8-fähige Gerät kann das. --------------------------------------------- http://www.golem.de/news/ios-8-nutzung-zufallsgenerierter-mac-adressen-ist-… *** Fraud shop OVERSTOCKED with stolen credit cards *** --------------------------------------------- Supply, meet demand: prices crash Infamous carding store Rescator.cc is so chock-full of stolen credit cards from recent high-profile breaches that its gutting its prices due to overstocking. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/29/fraud_shop_… *** AVM: Sicherheitslücke in Fritzbox wird wieder ausgenutzt *** --------------------------------------------- Fritzbox-Nutzer, die die gepatchte Sicherheitslücke für unerlaubten Fernzugriff nicht geschlossen haben, werden wieder angegriffen. AVM rät, die Patches jetzt schnell aufzuspielen, doch eine Auto-Updatefunktion gibt es noch nicht lange. --------------------------------------------- http://www.golem.de/news/avm-alte-sicherheitsluecke-in-fritzbox-wird-wieder… *** HPSBNS03111 rev.1 - HP NonStop Servers running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running Bash Shell . This is the Bash Shell vulnerability known as "ShellShock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DHCP Client Bash Environment Variable Code Injection *** --------------------------------------------- Topic: DHCP Client Bash Environment Variable Code Injection Risk: High Text:## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-fr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090152 *** LSE entdeckt kritische Schwachstelle in Perl *** --------------------------------------------- Mit der vom Identity-Management-Experten festgestellten Lücke in der Spracherweiterung Data::Dumper soll sich durch Anlegen großer Datenstrukturen ein Stack Overflow erzeugen lassen. --------------------------------------------- http://www.heise.de/security/meldung/LSE-entdeckt-kritische-Schwachstelle-i… *** HTTPS: Kostenlose TLS-Verschlüsselung bei Cloudflare *** --------------------------------------------- Cloudflare aktiviert künftig bei allen Kunden kostenlos verschlüsselte HTTPS-Verbindungen. Damit verdoppelt sich die Zahl der Webseiten im Netz, die verschlüsselt erreichbar sind. --------------------------------------------- http://www.golem.de/news/https-kostenlose-tls-verschluesselung-bei-cloudfla… *** iOS 8 verrät Drittanbieter-Apps, mit wem man telefoniert *** --------------------------------------------- Die beiden Forscher Andreas Kurtz und Markus Troßbach haben jede Menge Lücken in iOS entdeckt, durch die Drittanbieter-Apps etwa heimlich Fotos schießen oder das Telefonieverhalten ausspionieren können. Einige davon hat Apple geschlossen - andere nicht. --------------------------------------------- http://www.heise.de/security/meldung/iOS-8-verraet-Drittanbieter-Apps-mit-w… *** FBI to Open Up Malware Investigator Portal to External Researchers *** --------------------------------------------- SEATTLE - The FBI has developed an internal malware-analysis tool, somewhat akin to the systems used by antimalware companies, and plans to open the system up to external security researchers, academics and others. The system is known as Malware Investigator and is designed to allow FBI agents and other authorized law enforcement users to upload suspicious files. --------------------------------------------- http://threatpost.com/fbi-to-open-up-malware-investigator-portal-to-externa… *** Shellshock: A Collection of Exploits seen in the wild, (Mon, Sep 29th) *** --------------------------------------------- Ever since the shellshock vulnerablity has been announced, we have seen a large number of scans probing it. Here is a quick review of exploits that our honeypots and live servers have seen so far: 1 - Simple "vulnerability checks" that used custom User-Agents: () { 0v3r1d3;};echo \x22Content-type: text/plain\x22; echo; uname -a; () { :;}; echo Shellshock: Vulnerable () { :;};echo content-type:text/plain;echo;echo [random string];echo;exit () { :;}; /bin/bash -c "echo --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18725&rss

1 0

Tageszusammenfassung - Freitag 26-09-2014
by Daily end-of-shift report 26 Sep '14

26 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-09-2014 18:00 − Freitag 26-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Patching Bash Vulnerability a Challenge for ICS, SCADA *** --------------------------------------------- Experts are concerned that many Linux-based industrial control systems and embedded systems could be too steep a patching challenge and remain in the crosshairs of the Bash vulnerability. --------------------------------------------- http://threatpost.com/patching-bash-vulnerability-a-challenge-for-ics-scada… *** Bash Vulnerability (Shellshock) Exploit Emerges in the Wild, Leads to BASHLITE Malware *** --------------------------------------------- Just several hours after the news on the bash vulnerability (covered under CVE-2014-7169) broke out; it was reportedly being exploited in the wild already. This vulnerability can allow execution of arbitrary code thus compromising the security of systems. Some of the possible scenarios that attackers can do range from changing the contents of web server and... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-OM1T28JyB8/ *** Linux ELF bash 0day: The fun has only just begun... *** --------------------------------------------- Background: CVE-2014-6271 + CVE-2014-7169 During the mayhem of bash 0day remote execution vulnerability CVE-2014-6271 and CVE-2014-7169, not for bragging but as a FYI, I happened to be the first who reversed for the first ELF malware spotted used in the wild. The assembly analysis and summary I wrote and posted in here --> [-1-] [-2-] The fun has only just begun...Yes. Today I was informed there is another payload distributed, thanks to my good friend, Father Robin Jackson (credit): Which... --------------------------------------------- http://blog.malwaremustdie.org/2014/09/linux-elf-bash-0day-fun-has-only-jus… *** Bad boy builds beastly Bash bug botnet - boxen battered *** --------------------------------------------- DDoS zombie army found in the wild hours after flaw surfaces Mere hours after its discovery, the Shell Shock Bash vulnerability was exploited by an attacker to build a botnet. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/26/bad_guy_bui… *** Vulnerabilities in LibVNCServer *** --------------------------------------------- --------------------------------------------- LibVNCServer CVE-2014-6054 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70094 --------------------------------------------- libVNCserver CVE-2014-6051 Integer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70093 --------------------------------------------- LibVNCServer CVE-2014-6053 Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70092 --------------------------------------------- LibVNCServer CVE-2014-6052 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70091 *** JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell command injection vulnerability in Bash (CVE-2014-6271, CVE-2014-7169) *** --------------------------------------------- Products vulnerable to remote exploitation risks: Junos Space is vulnerable in all versions. JSA Series (STRM) devices are vulnerable in all versions. --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10648&actp=RSS *** GNU Bash Environmental Variable Command Injection Vulnerability *** --------------------------------------------- cisco-sa-20140926-bash --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3035 bash *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3035 *** TYPO3-EXT-SA-2014-011: Several vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** Bugtraq: [SECURITY] [DSA 3036-1] mediawiki security update *** --------------------------------------------- [SECURITY] [DSA 3036-1] mediawiki security update --------------------------------------------- http://www.securityfocus.com/archive/1/533552

1 0

Tageszusammenfassung - Donnerstag 25-09-2014
by Daily end-of-shift report 25 Sep '14

25 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-09-2014 18:00 − Donnerstag 25-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Shellshock Bash Vulnerability *** --------------------------------------------- Current event - 1.0 of post This is a current event and as such this blog post is subject to change over the course of the next few days as we perform further supplementary research and analysis by NCC Group's Cyber Defence Operations and Security Consulting divisions. v1.0 - initial version Background Yesterday (24 September) CVE-2014-6271 was released with a corresponding patch for Bash (a common Linux shell). The risk arises from this vulnerability because of certain use cases. The use... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/09/shellshock-bash-vulnerability/ *** Update on CVE-2014-6271: Vulnerability in bash (shellshock), (Thu, Sep 25th) *** --------------------------------------------- (this diary will be updated with links to relevant resources shortly) Yesterday, a vulnerability in bash was announced, that was originally found by,Stephane Schazelas. The vulnerability allows for arbitrary code execution in,bash by setting specific environment variables. Later, Travis Ormandy released,a second exploit that will work on patched systems, demonstration that the,patch released yesterday is incomplete. What is the impact of the vulnerability? At first, the vulnerability doesnt... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18707&rss *** Bash-Lücke: ShellShock ist noch nicht ausgestanden *** --------------------------------------------- Die Sicherheitslücke in der Linux-Shell Bash, die nun unter dem Namen "ShellShock" firmiert, wird bereits als der schlimmere Bruder von Heartbleed bezeichnet. Sicher ist, dass der am Mittwoch ausgelieferte Patch weitere Lücken enthält. --------------------------------------------- http://www.heise.de/security/meldung/Bash-Luecke-ShellShock-ist-noch-nicht-… *** "Bash" (CVE-2014-6271) vulnerability - Q&A *** --------------------------------------------- The "bash" vulnerability is an extremely powerful vulnerability due to its high impact and the ease with which it can be exploited. --------------------------------------------- https://securelist.com/blog/research/66673/bash-cve-2014-6271-vulnerability… *** Bug in Bash shell creates big security hole on anything with *nix in it [Updated] *** --------------------------------------------- Could allow attackers to execute code on Linux, Unix, and Mac OS X. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/94xcSgjPriY/ *** Bash Exploit Reported, First Round of Patches Incomplete *** --------------------------------------------- Reports of the first in-the-wild exploits targeting the Bash vulnerability have surfaced, as have complaints the first patches for the bug are incomplete. --------------------------------------------- http://threatpost.com/bash-exploit-reported-first-round-of-patches-incomple… *** RSA-Signaturen: Acht Jahre alte Sicherheitslücke kehrt zurück *** --------------------------------------------- In der NSS-Bibliothek ist eine Sicherheitslücke entdeckt worden, mit der sich RSA-Signaturen fälschen lassen. Betroffen sind die Browser Chrome und Firefox, für die bereits Updates erschienen sind. Es handelt sich um eine Variante der Bleichenbacher-Attacke von 2006. --------------------------------------------- http://www.golem.de/news/rsa-signaturen-acht-jahre-alte-sicherheitsluecke-k… *** iOS-Sicherheitslücke ermöglicht Keylogging in Apps mit integriertem Browser *** --------------------------------------------- Einem Entwickler ist aufgefallen, dass Apple offenbar beim Trennen von Prozessen geschlampt hat. Bietet eine App eine Browser-Ansicht, kann diese von der App selbst beobachtet werden. --------------------------------------------- http://www.heise.de/security/meldung/iOS-Sicherheitsluecke-ermoeglicht-Keyl… *** An Analysis of the CAs trusted by iOS 8.0 *** --------------------------------------------- iOS 8.0 ships with a number of trusted certificates (also known as "root certificates" or "certificate authorities"), which iOS implicitly trusts. The root certificates are used to trust intermediate certificates, and the intermediate certificates are used to trust web site certificates. When you go to a web site using HTTPS, or an app makes a secure connection to something on the Internet (like your mail server), the web site (or mail server, or whatever) gives iOS its... --------------------------------------------- http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by-ios-8-0/ *** GNU bash Environment Variable Processing Flaw Lets Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030890 *** DSA-3032 bash *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3032 *** Security Advisories for Cisco IOS Software *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified Communications Domain Manager glibc Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletin: Vulnerability in IBM Java SDKs and IBM Java Runtime Technology Edition affecting Rational Functional Tester (CVE-2014-3086) *** --------------------------------------------- Multiple vulnerabilities exist in IBM SDKs Java Technology Edition and IBM Runtime Environment Java Technology Edition that are used by Rational Functional Tester (RFT). These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-3086 Affected product(s) and affected version(s): Rational Functional Tester version 8.2.2 and later Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool OMNIbus (CVE-2014-4263, CVE-2014-4244) *** --------------------------------------------- There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Versions 5, 6, and 7 that are used by Tivoli Netcool OMNIbus. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Tivoli Netcool/OMNIbus 7.3.0 Tivoli Netcool/OMNIbus 7.3.1 Tivoli Netcool/OMNIbus 7.4.0 Tivoli Netcool/OMNIbus 8.1.0 Refer to the following reference URLs for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- https://www.drupal.org/node/2344383 https://www.drupal.org/node/2344369 https://www.drupal.org/node/2344363 https://www.drupal.org/node/2344389 *** Mozilla Network Security Services certificates security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96194 *** HPSBST03103 rev.1 - HP Storage EVA Command View Suite running OpenSSL, Remote Unauthorized Access, Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Storage Enterprise Virtual Array (EVA) Command View Suite. The vulnerability could be exploited to allow remote unauthorized access and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Bugtraq: Two SQL Injections in All In One WP Security WordPress plugin *** --------------------------------------------- http://www.securityfocus.com/archive/1/533519 *** TYPO3-EXT-SA-2014-012: Several vulnerabilities in extension JobControl (dmmjobcontrol) *** --------------------------------------------- It has been discovered that the extension "JobControl" (dmmjobcontrol) is susceptible to Cross-Site Scripting and SQL Injection. --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** Bugtraq: LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/533543

1 0

Tageszusammenfassung - Mittwoch 24-09-2014
by Daily end-of-shift report 24 Sep '14

24 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-09-2014 18:00 − Mittwoch 24-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-055 - Important: Vulnerabilities in Microsoft Lync Server Could Allow Denial of Service (2990928) - Version: 3.0 *** --------------------------------------------- Revisions: V1.0 (September 9, 2014): Bulletin published. V2.0 (September 15, 2014): Bulletin revised to remove Download Center links for Microsoft security update 2982385 for Microsoft Lync Server 2010. See the Update FAQ for details. V3.0 (September 23, 2014): Bulletin rereleased to announce the reoffering of the 2982385 security update file (server.msp) for Microsoft Lync Server 2010. See the Update FAQ for details. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-055 *** Website Malware - Curious .htaccess Conditional Redirect Case *** --------------------------------------------- I really enjoy when I see a different kind of conditional redirect, check this one out: The special thing about this one is the usage of a not so common .htaccess feature in malware: variables. In the first part it set the conditions for user-agents, nothing new, but the afterward rules are interesting: RewriteRule .*Read More --------------------------------------------- http://blog.sucuri.net/2014/09/website-malware-curious-htaccess-conditional… *** Apt: Buffer Overflow in Debians Paketmanagement *** --------------------------------------------- Im von Debian und Ubuntu verwendeten Paketmanagement Apt wurde ein sicherheitskritischer Fehler entdeckt. Es ist bereits das zweite Mal in kurzer Zeit dass Apt Sicherheitsprobleme hat. --------------------------------------------- http://www.golem.de/news/apt-buffer-overflow-in-debians-paketmanagement-140… *** Microsoft Starts Online Services Bug Bounty *** --------------------------------------------- Microsoft today launched the Microsoft Online Services Bug Bounty Program which will pay out a minimum of $500 for vulnerabilities found in its cloud services such as Office 365. --------------------------------------------- http://threatpost.com/microsoft-starts-online-services-bug-bounty/108486 *** jQuery.com Compromise: The Dangers of Third Party Hosted Content, (Tue, Sep 23rd) *** --------------------------------------------- jQuery is a popular Javascript framework, used by many websites (including isc.sans.edu) . jQuery provides many features, like easy access to webservices as well as advanced user interface features. When using jQuery, sites have the option to download and host the complete code, or let jQuery.com and its CDN (Content Delivery Network) host the code. There are two advantages in allowing jQuery.com to host the code: Performance: Code is typically delivered faster, and a user may already have the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18699&rss *** Auch Mozilla verabschiedet sich langsam von SHA-1 *** --------------------------------------------- Die Entwickler der freien Web-Browsers Firefox wollen den angreifbaren Hash-Algorithmus in Zukunft nicht mehr für verschlüsselte Verbindungen akzeptieren. Server-Betreibern bleibt jedoch noch Zeit für die Umstellung. --------------------------------------------- http://www.heise.de/security/meldung/Auch-Mozilla-verabschiedet-sich-langsa… *** Remote exploit vulnerability in bash CVE-2014-6271 *** --------------------------------------------- A remotely exploitable vulnerability has been discovered in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271. This affects Debian as well as other Linux distributions. If you have have Microsoft Services for UNIX you will need to patch ASAP. Bash supports exporting she variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process. From Debian:Current bash versions use an --------------------------------------------- http://www.csoonline.com/article/2687265/application-security/remote-exploi… *** Bugtraq: CVE-2014-6603 suricata 2.0.3 Out-of-bounds access in SSH parser *** --------------------------------------------- http://www.securityfocus.com/archive/1/533515 *** Huawei Security Advisory - CSRF Vulnerabilities in Multiple Products *** --------------------------------------------- Cross-site request forgery (CSRF) vulnerabilities are discovered in multiple products, including FusionManager (Vulnerability ID: HWPSIRT-2014-0408) and USG firewall series (Vulnerability ID: HWPSIRT-2014-0406). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Huawei Security Advisory - Information Leakage Vulnerability via MPLS Ping in VRP Platform *** --------------------------------------------- Information leakage vulnerability exists in several devices using VRP platform, because the MPLS LSP Ping service is bound to unnecessary interfaces, which can cause the leak of IP addresses of devices (Vulnerability ID: HWPSIRT-2014-0418). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Hikashop Extension for Joomla! *** --------------------------------------------- Advisory for: Hikashop for Joomla! Security Risk: High (DREAD score : 7/10) Vulnerability: Object Injection / Remote Code Execution Updated Version: 2.3.2 In a routine audit of our Website Firewall we discovered a serious vulnerability within the Hikashop ecommerce product for Joomla! allowing remote code execution on the vulnerable website[s]. What are the risks? ThisRead More --------------------------------------------- http://blog.sucuri.net/2014/09/security-advisory-hikashop-extension-for-joo…

1 0

Tageszusammenfassung - Dienstag 23-09-2014
by Daily end-of-shift report 23 Sep '14

23 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-09-2014 18:00 − Dienstag 23-09-2014 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Cyber Campaigns *** --------------------------------------------- This website simply lists multiple cyber-espionage and cyber-attack campaigns. These campaigns have successfully compromised hundreds of government entities and global corporations in over 50 countries. Click on any of the links below to access more detailed information regarding these cyber campaigns. If you see one missing, just let me know. --------------------------------------------- http://cybercampaigns.net/ *** Whonix Anonymous Operating System Version 9 Released *** --------------------------------------------- Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. --------------------------------------------- https://www.whonix.org/blog/whonix-anonymous-9-released *** UK banks hook themselves up to real-time cop data feed *** --------------------------------------------- Not like the movies: Law enforcement is on it... UK banks will receive real-time warnings about threats to their customers accounts as well as the overall integrity of their banking systems from a new financial crime alert system. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/23/uk_bank_fra… *** HPSBPI03107 rev.1 - Certain HP LaserJet Printers, MFPs and Certain HP OfficeJet Enterprise Printers using OpenSSL, Remote Unauthorized Access *** --------------------------------------------- A potential security vulnerability has been identified with certain HP LaserJet Printers, MFPs and certain HP OfficeJet Enterprise Printers using OpenSSL. The vulnerability could be exploited remotely to allow remote unauthorized access. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** BIND 9.8.8, 9.9.6 and 9.10.1 Release Notes *** --------------------------------------------- https://kb.isc.org/article/AA-01211/81/BIND-9.8.8-Release-Notes.html https://kb.isc.org/article/AA-01210/81/BIND-9.9.6-Release-Notes.html https://kb.isc.org/article/AA-01209/81/BIND-9.10.1-Release-Notes.html *** Bugtraq: Glype proxy cookie jar path traversal allows code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/533504 *** Security Advisory-Screen Capture Vulnerability on Huawei Ascend P6 Mobile Phones *** --------------------------------------------- Sep 23, 2014 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TYPO3 CMS 4.5.36, 6.1.11 and 6.2.5 released *** --------------------------------------------- All versions are maintenance releases and contain bug fixes. --------------------------------------------- https://typo3.org/news/article/typo3-cms-4536-6111-and-625-released/ *** [20140901] - Core - XSS Vulnerability *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 3.2.0 through 3.2.4, 3.3.0 through 3.3.3 Exploit type: XSS Vulnerability Reported Date: 2014-August-27 Fixed Date: 2014-September-23 CVE Number: CVE-2014-6631 Description Inadequate escaping leads to XSS vulnerability in com_media. Affected Installs Joomla! CMS versions 3.2.0 through 3.2.4 and 3.3.0 through 3.3.3 Solution Upgrade to version 3.2.5 or 3.3.4 Contact The JSST at the Joomla! Security Center. Reported By: Dingjie (Daniel) --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/EiyFsQIjpu4/593-20140901-c… *** [20140902] - Core - Unauthorised Logins *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3 Exploit type: Unauthorised Logins Reported Date: 2014-September-09 Fixed Date: 2014-September-23 CVE Number: CVE-2014-6632 Description Inadequate checking allowed unauthorised logins via LDAP authentication. Affected Installs Joomla! CMS versions 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3 Solution --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/uFCKpt1YcxU/594-20140902-c… *** XEN Security Advisories *** ------------------------------- *** Race condition in HVMOP_track_dirty_vram *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-104.html *** Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-105.html *** Missing privilege level checks in x86 emulation of software interrupts *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-106.html

1 0

Tageszusammenfassung - Montag 22-09-2014
by Daily end-of-shift report 22 Sep '14

22 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-09-2014 18:00 − Montag 22-09-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Tiny Tinba Trojan Could Pose Big Threat *** --------------------------------------------- In July 2014, the original source code of Tinba was made public in an underground forum. This leaked version comes with complete documentation and full source code. This follows other source code leaks from much more infamous and prevalent threats, which researchers worry that attackers could use as the basis for new versions. Similar to... --------------------------------------------- http://www.seculert.com/blog/2014/09/tiny-tinba-trojan-could-pose-big-threa… *** Apple Pay: A Security Analysis *** --------------------------------------------- Has Apple taken a bite out of hackers' arsenals? The company is betting on it. Its recent announcement about a new secure payment option has the retail and tech worlds buzzing. If Apple can implement its near-field communication (NFC) payment... --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-pay-a-security-analysis… *** How to secure your new iPhone in three simple steps *** --------------------------------------------- Summary: Symantec recommends best practices to keep your Apple ID account and iPhone safe. --------------------------------------------- http://www.symantec.com/connect/blogs/how-secure-your-new-iphone-three-simp… *** Conditional Malicious iFrame Targeting WordPress Web Sites *** --------------------------------------------- We have an email, labs(a)sucuri.net where we receive multiple questions a day about various forms of malware. One of the most common questions happen when our Free Security Scanner, SiteCheck, detects a spam injection or a hidden iframe and the user is unable to locate the infection in the source code. It's not until we... --------------------------------------------- http://blog.sucuri.net/2014/09/conditional-malicious-iframe-targeting-wordp… *** PHP Fixes Several Bugs in Version 5.4 and 5.5, (Fri, Sep 19th) *** --------------------------------------------- PHP announced the released of version 5.5.17 and 5.4.33. Ten bugs were fixed in version 5.4.33 and 15 bugs were fixed in version 5.5.17. All PHP users are encouraged to upgrade.The latest version are available for download here. [1] http://php.net/ChangeLog-5.php#5.4.33 [2] http://php.net/ChangeLog-5.php#5.5.17 [3] http://windows.php.net/download ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18683&rss *** CipherShed Fork from TrueCrypt Project, Support Windows, Mac OS and Linux - https://ciphershed.org, (Fri, Sep 19th) *** --------------------------------------------- ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18677&rss *** New OWASP Testing guide version 4! Check https://www.owasp.org/images/1/19/OTGv4.pdf, (Sat, Sep 20th) *** --------------------------------------------- Manuel Humberto Santander Peláez SANS Internet Storm Center - Handler Twitter: (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18687&rss *** CloudFlare ditches private SSL keys for better security *** --------------------------------------------- Sorry, spooks, we cant decrypt this for you CloudFlare has announced the outcome of what it says is two years work - switching on Keyless SSL - which lets customers encrypt their web traffic via the companys services without having to hand over their private SSL keys. --------------------------------------------- http://www.theregister.co.uk/2014/09/22/cloudflare_ditches_keys_for_better_… *** Holzleim: Fingerabdrucksensor des iPhone 6 ausgetrickst *** --------------------------------------------- Mit einer simpel angefertigten Kopie hat Ben Schlabs von den SRLabs den Fingerabdrucksensor des iPhone 6 getäuscht. Da Apple unter iOS 8 auch Drittanbieter diese Authentifizierungsmethode nutzen lässt, ist dies brisanter als beim iPhone 5S. --------------------------------------------- http://www.golem.de/news/holzleim-fingerabdrucksensor-des-iphone-6-ausgetri… *** VB2014 preview: Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam *** --------------------------------------------- Jérôme Segura looks at recent developments in malicious cold calls. In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we are looking at some of the research that will be presented at the event. Today, in the final entry in this series, we look at the paper Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam, by Jérôme Segura (Malwarebytes).Two years ago, at VB2012 in Dallas, I... --------------------------------------------- https://www.virusbtn.com/blog/2014/09_22.xml *** Doubleclick und Zedo lieferten virenverseuchte Werbung aus *** --------------------------------------------- Das große Werbenetzwerk Zedo und die Google-Tochter Doubleclick sollen nach Angaben eines Antivirenherstellers fast einen Monat lang Schadcode über ihre Werbung verteilt haben. Auch größere Webseiten wie Last.fm waren betroffen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Doubleclick-und-Zedo-lieferten-viren… *** iOS 7.1.x Exploit Released (CVE-2014-4377), (Mon, Sep 22nd) *** --------------------------------------------- Havent upgraded to iOS 8 yet? Aside from a lot of new features, Apple also fixed a number of security vulnerabilities in iOS 8. For example CVE-2014-4377, a memory corrupion issue in iOSs core graphics library. An exploit is now available for this vulnerability. NOTE: I have not verified yet that the exploit is working / genuine. We will not link at this point to the exploit code, but basic Google Fu should allow you to find it. The author claims that the exploit is "compleatly reliable --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18693&rss *** Datenleck: WhatsApp petzt Online-Status *** --------------------------------------------- Ob und wie oft man WhatsApp öffnet, will man unter Umständen lieber für sich behalten. Der Betreiber macht diese Information allerdings für jedermann zugänglich, der die Nummer kennt. Selbst, wenn man dies in den Datenschutz-Einstellungen deaktiviert hat. --------------------------------------------- http://www.heise.de/security/meldung/Datenleck-WhatsApp-petzt-Online-Status… *** VU#730964: FortiNet FortiGate and FortiWiFi appliances contain multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#730964 FortiNet FortiGate and FortiWiFi appliances contain multiple vulnerabilities Original Release date: 19 Sep 2014 | Last revised: 19 Sep 2014 Overview Fortinet FortiGate and FortiWiFi appliances are susceptible to man-in-the-middle attacks (CWE-300) and a heap-based overflow vulnerability (CWE-122). Description Fortinet FortiGate and FortiWiFi 4.00.6 and possibly earlier versions are susceptible to man-in-the-middle attacks (CWE-300) and a heap-based overflow... --------------------------------------------- http://www.kb.cert.org/vuls/id/730964 *** Cisco Nexus 1000V Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-3367 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pure_application_… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins for ClearQuest *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Asterisk PJSIP channel denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96073

1 0

Tageszusammenfassung - Freitag 19-09-2014
by Daily end-of-shift report 19 Sep '14

19 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-09-2014 18:00 − Freitag 19-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** WordFence WordPress Security Plugin Pushes a Security Update *** --------------------------------------------- If you are one of the many users of the WordPress Security Plugin, WordFence, we highly encourage you to update. They recently pushed out an important security update that .. --------------------------------------------- http://blog.sucuri.net/2014/09/security-disclosure-the-wordfence-wordpress-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** CosmicDuke and the latest political news *** --------------------------------------------- After we had published the CosmicDuke report in July 2014, we continued to actively follow the malware. Today, we discovered two new samples that both leverage timely, political topics to deceive the recipient into opening .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002745.html *** Nuclear exploit kit - complete infection cycle *** --------------------------------------------- Zscaler ThreatLabZ has been seeing a steady increase in the Nuclear Exploit Kit (EK) traffic over the past few weeks. The detection of malicious activity performed by this EK remains low, due to usage of dynamic content and heavy .. --------------------------------------------- http://research.zscaler.com/2014/09/nuclear-exploit-kit-complete-infection.… *** Web Scan looking for /info/whitelist.pac, (Fri, Sep 19th) *** --------------------------------------------- Nathan reported today that he has been seeing a new trend of web scanning against his webservers looking for /info/whitelist.pac. The scanning he has observed is over SSL. He has been .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18675 *** Asterisk res_fax_spandsp Module Processing Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030876 *** Asterisk SIP SUBSCRIBE Type Handling Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030875 *** Android ist in Zukunft standardmässig verschlüsselt *** --------------------------------------------- Wie Google offiziell bekannt gegeben hat, wird die Verschlüsselungsfunktion in Android L erstmals ab Werk eingeschaltet sein. --------------------------------------------- http://futurezone.at/produkte/android-ist-in-zukunft-standardmaessig-versch… *** Advantech WebAccess Vulnerabilities *** --------------------------------------------- Researcher Ricardo Narvaja of Core Security Technologies has identified several buffer overflow vulnerabilities in Advantech's WebAccess application. Advantech has produced a patch that mitigates these vulnerabilities. The researcher has .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-261-01 *** Bugtraq: CVE ID Syntax Change - Deadline Approaching *** --------------------------------------------- http://www.securityfocus.com/archive/1/533478 *** How to Detect SQL Injection Attacks *** --------------------------------------------- SQL Injection (SQLi) attacks have been around for over a decade. You might wonder why they are still so prevalent. The main reason is that they still work on quite a few web application targets. In fact, according to Veracode's 2014 State of Security Software Report , SQL injection vulnerabilities still .. --------------------------------------------- http://thehackernews.com/2014/09/how-to-detect-sql-injection-attacks.html *** Hackerangriff auf Home Depot: 56 Millionen Kreditkarten betroffen *** --------------------------------------------- Hacker sind weiter auf Beutezug durch den US-Einzelhandel: Erst verschafften sie sich Zugriff auf rund 40 Millionen Bankkarten bei Target-Supermärkten, jetzt könnten bei der Baumarktkette Home Depot 56 Millionen Karten betroffen sein. --------------------------------------------- http://www.heise.de/security/meldung/Hackerangriff-auf-Home-Depot-56-Millio… *** Cloudflare: TLS-Verbindungen ohne Schlüssel sollen Banken schützen *** --------------------------------------------- Cloudflare bietet Kunden künftig ein neues Feature namens Keyless SSL, mit dem der Teil des TLS-Handshakes, der den privaten Schlüssel benötigt, ausgelagert werden kann. Damit können Unternehmen die Kontrolle über den Schlüssel behalten. --------------------------------------------- http://www.golem.de/news/cloudflare-tls-verbindungen-ohne-schluessel-sollen… *** XSS: Cross-Site-Scripting über DNS-Records *** --------------------------------------------- Eine besonders kreative Variante einer Cross-Site-Scripting-Lücke macht auf der Webseite Hacker News die Runde: Mittels eines TXT-DNS-Records lässt sich auf zahlreichen Webseiten Javascript einfügen. --------------------------------------------- http://www.golem.de/news/xss-cross-site-scripting-ueber-dns-records-1409-10…

1 0

Tageszusammenfassung - Donnerstag 18-09-2014
by Daily end-of-shift report 18 Sep '14

18 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-09-2014 18:00 − Donnerstag 18-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** How Cops Can Still Pull Data Off Your Locked iPhone, In Spite Of Apple *** --------------------------------------------- A reminder to iPhone owners cheering Apple's latest privacy win: Just because Apple will no longer help police to turn your smartphone inside out doesn't mean it can prevent the cops from vivisecting the device on their own. On Wednesday evening Apple made news .. --------------------------------------------- http://www.wired.com/2014/09/apple-iphone-security/ *** SA-CONTRIB-2014-091 - Survey Builder - Cross Site Scripting (XSS) *** --------------------------------------------- When viewing surveys at "/surveys", the survey titles printed out are not sanitized. Any potentially dangerous code in the survey titles is also rendered. This vulnerability is mitigated by the fact that a user must have the "Create Survey" permission .. --------------------------------------------- https://www.drupal.org/node/2340069 *** SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS) *** --------------------------------------------- Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must .. --------------------------------------------- https://www.drupal.org/node/2340029 *** Bugtraq: APPLE-SA-2014-09-17-2 Apple TV 7 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533468 *** D-BUS Buffer Overflow and Multiple Processing Flaws Let Local Users Obtain Elevated Privileges and Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030864 *** Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1030868 *** Open Web App Security Project releases new app dev opus *** --------------------------------------------- The global security community has completed an 18-month effort to produce a guide it is hoped will boost the standard of web application testing and address new and dangerous technologies. Version 4 of the Open Web App Security Projects (OWASPs) Testing Guide was produced by more than 60 security bods from around the world with a core lead team of four. --------------------------------------------- http://www.theregister.co.uk/2014/09/18/guide_to_obliterating_web_apps_publ… *** Yokogawa CENTUM and Exaopc Vulnerability *** --------------------------------------------- Tod Beardsley of Rapid7 Inc., and Jim Denaro of CipherLaw, have identified an authentication vulnerability and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 series and Exaopc products. JPCERT and Yokogawa have mitigated this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-260-01

1 0

Tageszusammenfassung - Mittwoch 17-09-2014
by Daily end-of-shift report 17 Sep '14

17 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-09-2014 18:00 − Mittwoch 17-09-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** https://yourfakebank.support -- TLD confusion starts!, (Tue, Sep 16th) *** --------------------------------------------- Pretty much ever since the new top level domain (TLD) ".biz" went online a couple years ago, and the only ones buying domains in this space were the scammers, we kinda knew what would happen when ICANNs latest folly and money-grab went live. It looks like a number of the "new" top level domains, like ".support", ".club", etc have now come online. And again, it seems like only the crooks are buying. We are currently investigating a wave of phishing emails --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18651&rss *** Hintergrund: Nach Snowden: Wenig Schlaf für Kryptoforscher *** --------------------------------------------- Bei der Internet Engineering Task Force in Toronto stellte Lange vor kurzem einen Überblick über elliptische Kurven Verschlüsselung vor und riet dringend, sich für neuere Varianten zu entscheiden. Sie sprach am Rande der Veranstaltung mit heise Security. --------------------------------------------- http://www.heise.de/security/artikel/Nach-Snowden-Wenig-Schlaf-fuer-Kryptof… *** Virus activity overview: Adware and other security events of August 2014 *** --------------------------------------------- September 1, 2014 The last summer month of 2014 witnessed not only a large number of encryption Trojans in action but also a myriad of malicious programs displaying annoying (and sometimes fraudulent) ads in an effort to generate revenue for the criminals behind them. Also at summers end, Chinese attackers intensified their efforts to port certain Linux malware programs to Windows. In addition, security researchers discovered new threats to Android. Viruses Statistics collected by Dr.Web --------------------------------------------- http://news.drweb.com/show/?i=5935&lng=en&c=9 *** Netzwerkanalyse-Tool Message Analyzer in Version 1.1 veröffentlicht *** --------------------------------------------- Microsoft hat sein Sniffing- und Analysetool Message Analyzer in der Version 1.1 herausgebracht. Die neue Fassung schneidet unter anderem Netzwerkdaten aus der Ferne mit oder entschlüsselt SSL-gesicherte Datenströme. --------------------------------------------- http://www.heise.de/newsticker/meldung/Netzwerkanalyse-Tool-Message-Analyze… *** Understanding the WordPress Security Plugin Ecosystem *** --------------------------------------------- As a child, did you ever play that game where you sit in a circle and one person is responsible for whispering something into one persons ear, and that message gets relayed around the circle? Wasn't it always funny to see what the final message received would be? Oh and how it would have morphed as it was processed and conveyed by each individual in the group. This is what I see when I look at the WordPress Security Ecosystem. --------------------------------------------- http://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-… *** FreeBSD Denial of Service advisory (CVE-2004-0230), (Tue, Sep 16th) *** --------------------------------------------- A vulnerability has been discovered by Johnathan Looney at the Juniper SIRT in FreeBSD (base for Junos and many other products) in the way that FreeBSD processes certain TCP packets (https://www.freebsd.org/security/advisories/FreeBSD-SA-14:19.tcp.asc) If you send TCP SYN packets for an existing connection (i.e. the correct source IP, source port, destination IP, destination port combination) the operating system will tear down the connection. The attack is similar to the "slipping in the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18657&rss *** EMC Documentum Content Server Flaws Let Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030855 *** Bugtraq: Android Bluetooth Pairing Packet Processing Vulnerability (by wangzq from NCNIPC) *** --------------------------------------------- http://www.securityfocus.com/archive/1/533462 *** DSA-3025-1 apt -- security update *** --------------------------------------------- It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490). For the stable distribution (wheezy), these problems have been fixed in version... --------------------------------------------- https://www.debian.org/security/2014/dsa-3025 *** Schneider Electric SCADA Expert ClearSCADA Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for three vulnerabilities in Schneider Electric's StruxureWare SCADA Expert ClearSCADA. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-259-01 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 16-09-2014
by Daily end-of-shift report 16 Sep '14

16 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-09-2014 18:00 − Dienstag 16-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security updates available for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1130 *** THREE QUARTERS of droid phones open to web page spy bug *** --------------------------------------------- Metasploit module gobbles KitKat SOP slop A Metasploit module has been developed to easily exploit a dangerous flaw in 75 percent of Android devices that allows attackers to hijack a users open websites. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open… *** Attackers tapping on SNMP door to see if its open *** --------------------------------------------- SANS spots new, dumb attack Googles DNS IP address is being spoofed by an attacker, apparently in an attempt to DDoS hosts vulnerable to a flaw in the SNMP protocol. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/attackers_tapping_on_snmp_door_to_s… *** Kindle durch versteckte Codes in E-Books gefährdet *** --------------------------------------------- Durch eine Sicherheitslücke im E-Reader Kindle können Angreifer an die Daten von Amazon-Kunden gelangen. Die Lücke tritt zum zweiten Mal auf. --------------------------------------------- http://futurezone.at/digital-life/kindle-durch-versteckte-codes-in-e-books-… *** Encrypt-then-MAC für TLS standardisiert *** --------------------------------------------- Eine neue TLS-Erweiterung ermöglicht es, die Reihenfolge zwischen Authentifizierung und Verschlüsselung zu ändern. Die bisherige Methode führte zu Sicherheitsproblemen wie der Lucky-Thirteen-Attacke. ... Gegen die Lucky-Thirteen-Attacke wurden Workarounds in die gängigen Browser und TLS-Bibliotheken eingebaut, aber trotzdem gab es den Wunsch, das Problem generell zu beheben. --------------------------------------------- http://www.golem.de/news/verschluesselung-encrypt-then-mac-fuer-tls-standar… *** Ungestopftes Datenleck in Androids Open-Source-Browser *** --------------------------------------------- Eine Lücke im AOSP-Browser von Android erlaubt es Webseiten die Daten anderer Seiten auszulesen. Die App wird in fast allen Android-Versionen vor Kit Kat mitgeliefert und dient vielen Custom-ROMs ebenfalls als Standard-Browser. --------------------------------------------- http://www.heise.de/security/meldung/Ungestopftes-Datenleck-in-Androids-Ope… *** AppLock Vulnerability Leaves Configuration Files Open for Exploit *** --------------------------------------------- We have previously discussed about certain file locker apps that fail to do hide files properly. We recently came across yet another file locker app, AppLock, which has the same issue. However, the vulnerability concerning this app goes beyond improperly hiding files - the vulnerability can .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/applock-vulnerab… *** Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account *** --------------------------------------------- At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the .. --------------------------------------------- http://thehackernews.com/2014/09/twitter-vulnerability-allows-hacker-to_16.… *** Metasploit gems from scratch *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/09/16/metasploi…

1 0

Tageszusammenfassung - Montag 15-09-2014
by Daily end-of-shift report 15 Sep '14

15 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-09-2014 18:00 − Montag 15-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Squid Off-by-One in snmpHandleUdp() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can send a specially crafted UDP SNMP packet to trigger an off-by-one memory error in snmpHandleUdp() and potentially execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030838 *** Rooted SSH/SFTP Daemon Default Login Credentials *** --------------------------------------------- The software comes pre-configured with a default login of User: root Password: abc123. This weak password would easily be guessed leading to root compromise of the android system. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090066 *** WordPress Photo Album Plus 5.4.4 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090061 *** Malware 'Eskimo' hat es auf Steam-Konten abgesehen *** --------------------------------------------- Die Schadsoftware wird hauptsächlich im Twitch-Chat verbreitet - Guthaben sowie Items werden nach Hack übertragen --------------------------------------------- http://derstandard.at/2000005543386 *** IRC: Chatnetzwerk Freenode gehackt *** --------------------------------------------- Die Betreiber des IRC-Netzwerks Freenode haben eine Kompromittierung ihrer Server festgestellt. Alle Nutzer sollten vorsorglich ihr Passwort ändern. --------------------------------------------- http://www.golem.de/news/irc-chatnetzwerk-freenode-wurde-gehackt-1409-10923… *** Multiple vulnerabilities in IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pureapplication_s… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Trustwave.com: 2014 Business Password Analysis *** --------------------------------------------- We set out to determine how easily we could crack a sample of 626,718 hashed passwords we collected during thousands of network penetration tests performed in 2013 and some performed in 2014. ... We recovered more than half of the passwords within just the first .. --------------------------------------------- https://gsr.trustwave.com/topics/business-password-analysis/2014-business-p… *** Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls *** --------------------------------------------- Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls --------------------------------------------- http://www.securitytracker.com/id/1030839 *** Hacking Canon Pixma Printers - Doomed Encryption *** --------------------------------------------- This blog post is another in the series demonstrating current insecurities in devices categorised as the 'Internet of Things'. This instalment will reveal how the firmware on Canon Pixma printers (used in the home and by SMEs) can be modified from the Internet to run custom code. ... For demonstration purposes I decided to get Doom running on the printer (Doom as in the classic 90s computer game). --------------------------------------------- http://www.contextis.co.uk/resources/blog/hacking-canon-pixma-printers-doom… *** Bugtraq: Open-Xchange Security Advisory 2014-09-15 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533443 *** [Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered *** --------------------------------------------- Our web honeypots picked up some interesting attack traffic. The initial web application attack vector (PHP-CGI vulnerability) is not new, the malware payload is. We wanted to get this information out to the community quickly due to the following combined threat elements - Active exploit attempts to upload/install the malware The overall low detection rates among AV vendors The malware is actively being sold in underground .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/honeypot-alert-bossabotv2-irc-botnetbitc…

1 0

Tageszusammenfassung - Freitag 12-09-2014
by Daily end-of-shift report 12 Sep '14

12 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-09-2014 18:00 − Freitag 12-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Hacker publishes tech support phone scammer slammer *** --------------------------------------------- Security pro Matthew Weeks has released a Metasploit module that can take over computers running the Ammyy Admin remote control software popular among "Hi this is Microsoft, theres a problem with your computer" tech support scammers. Weeks day job is director at Root9b, but hes taken time to detail a zero-day flaw in Ammyy Admin he hopes will be used to fight back against tech support scammers. --------------------------------------------- http://www.theregister.co.uk/2014/09/12/phone_scammer_slammer/ *** Cisco Unified Communications Manager glibc Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the GNU C library of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, local attacker to input crafted data to cause a heap-based buffer overflow. The vulnerability is due to incorrect sanitization of data. An attacker could exploit this vulnerability by setting an environment variable to a malicious value. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Schneider Electric VAMPSET Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's VAMPSET software product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-254-01 *** Ecava Integraxor SCADA Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Ecava Integraxor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-224-01 *** Linux Kernel logi_dj_recv_destroy_djhid_device buffer overflow *** --------------------------------------------- Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the logi_dj_recv_destroy_djhid_device function. By sending an overly long string, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95928 *** DNS cache poisoning used to steal emails *** --------------------------------------------- Does this happen in practice? CERT/CC researchers Jonathan Spring and Leigh Metcalf have evidence to suggest that it does. Using passive DNS data, they found a number of incorrect responses for A records belonging to mail servers of the big three webmail providers (Gmail, Yahoo! and Hotmail). Even though an increasing number of emails are sent over encrypted connections (using STARTTLS), there isnt really a way for the receiving mail server to enforce this, as HSTS does for secure HTTP --------------------------------------------- https://www.virusbtn.com/blog/2014/09_12.xml?rss *** Multiple security bulletins for IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 11-09-2014
by Daily end-of-shift report 11 Sep '14

11 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-09-2014 18:00 − Donnerstag 11-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** iOS 8 stopft Hintertüren weitestgehend *** --------------------------------------------- Apple hat die für Diagnosezwecke gedachten Systemdienste in iOS 8 grösstenteils abgeschottet, berichtet ein Sicherheitsforscher. Bislang lassen sich darüber zahlreiche Nutzerdaten auslesen. --------------------------------------------- http://www.heise.de/security/meldung/iOS-8-stopft-Hintertueren-weitestgehen… *** Multiple vulnerabilities in Juniper products *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10646 http://kb.juniper.net/index?page=content&id=JSA10645 http://kb.juniper.net/index?page=content&id=JSA10647 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-4762; CVE-2014-4792) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Apache Warns of Tomcat Remote Code Execution Vulnerability *** --------------------------------------------- Some older versions of Apache Tomcat, the company's open source web server and servlet container, are vulnerable to remote code execution. --------------------------------------------- http://threatpost.com/apache-warns-of-tomcat-remote-code-execution-vulnerab… *** IBM Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family (CVE-2014-4811) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** AIX OpenSSL Denial of Service due to double free *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_openssl_denial_of… *** Cisco Unified Communications Manager GLIBC Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco TelePresence System MXP Series Software Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure *** --------------------------------------------- Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerce_order module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered .. --------------------------------------------- https://www.drupal.org/node/2336357 *** Oracle MySQL Server MyISAM code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95881 *** Swiss economy makes online security its priority *** --------------------------------------------- Switzerland is one of the safest countries in the world. To make also the Internet a secure place in Switzerland, the Swiss online economy has started the Swiss Internet .. --------------------------------------------- http://securityblog.switch.ch/2014/09/11/swiss-economy-makes-online-securit… *** SHA1 deprecation: what you need to know *** --------------------------------------------- The news is that SHA1, a very popular hashing function, is on the way out. Strictly speaking, this development is not new. The first signs of weaknesses in SHA1 appeared (almost) ten years ago. In 2012, some calculations showed how breaking SHA1 is becoming feasible for those who can afford it. In November 2013, Microsoft announced that they wouldnt be accepting SHA1 certificates after 2016. --------------------------------------------- http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.h… *** Tabnabbing: A New Type of Phishing Attack *** --------------------------------------------- Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site. What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise. --------------------------------------------- http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/ *** Sicherheitslücke in vielen WordPress-Themes *** --------------------------------------------- Ein Fehler im beliebten Plug-in Slider Revolution erlaubt es, beliebige Dateien vom Webserver herunterzuladen. Damit kann ein Angreifer im schlimmsten Fall den ganzen Server kompromittieren. Das Plug-in ist in einer grossen Zahl von Themes fest verbaut. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-vielen-WordPress-… *** A system that facilitates malware identification in smartphones *** --------------------------------------------- The tool, developed by these UC3M researchers, baptized DENDROID and detailed in a study published in the review Expert Systems with Applications, allows security analysts to scrutinize a large quantity of apps to determine the origins of a malware sample and the family to which it belongs. --------------------------------------------- http://www.alphagalileo.org/ViewItem.aspx?ItemId=145206 *** Home Articles PCI Updates Skimming Prevention Guide - Best Practices for Protecting Merchants from POS Attacks *** --------------------------------------------- At a time when retailers are seeing a surge in point-of-sale breaches, The PCI Security Standards Council has released an update to its guidance for merchants on protecting against card skimming attacks in POS environments. --------------------------------------------- http://www.bankinfosecurity.co.uk/pci-updates-skimming-prevention-guide-a-7… *** Key Flaw Enables Recovery of Files Encrypted by TorrentLocker *** --------------------------------------------- Crypto ransomware, a relatively unknown phenomenon a couple of years ago, has exploded into one of the nastier malware problems for Internet users. Variants such as CryptoLocker and CryptoWall have been siphoning money from victims for some time, and now researchers have dissected a newer .. --------------------------------------------- http://threatpost.com/key-flaw-enables-recovery-of-files-encrypted-by-torre…

1 0

Tageszusammenfassung - Mittwoch 10-09-2014
by Daily end-of-shift report 10 Sep '14

10 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-09-2014 18:00 − Mittwoch 10-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-21) *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions ... CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb14-21.html *** Assessing risk for the September 2014 security updates *** --------------------------------------------- Today we released four security bulletins addressing 42 unique CVE's. One bulletin has a maximum severity rating of Critical and the other three have maximum severity Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-se… *** MSRT September 2014 - Zemot *** --------------------------------------------- This month we added the Win32/Zemot family to the Malicious Software Removal Tool. The Zemot family of trojan downloaders are frequently used by malware with a number of different payloads. We started seeing activity from TrojanDownloader:Win32/Upatre.B in late 2013 and identified this threat as the main distributor of the click fraud malware PWS:Win32/Zbot.gen!AP and PWS:Win32/Zbot.CF. We renamed the downloader to Zemot in May 2014. Recently, other malware such as Win32/Rovnix, --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/09/msrt-september-2014-zemo… *** Microsoft IIS Web Server - CMD Process Contributing to Website Reinfections *** --------------------------------------------- We often spend a lot of time talking about application level malware, but from time to time we do like to dabble in the ever so interesting web server infections as well. It is one of those things that comes with the job. Today, we're going to chat about an interesting reinfection case in which the client was running their website on a Microsoft's Internet Information Services (IIS) web server. Yes, contrary to popular belief many organizations, especially large enterprise --------------------------------------------- http://blog.sucuri.net/2014/09/microsof-iis-web-server-cmd-process-contribu… *** VMware vSphere product updates to third party libraries *** --------------------------------------------- The Apache Struts library is updated to address a security issue. This issue may lead to remote code execution after authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-0114 to this issue. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0008.html *** The September 2014 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. Topics: - Inside information on government Trojans used internationally published on Twitter - Page not found: Network blocking in in Switzerland and neighbouring countries - Breaking bad - malvertising ransomware: ZeroLocker / CryptoLocker / CryptoWall / SynoLocker - Canvas or cookies - choosing between Scylla and Charybdis - The Clipboard: Interesting presentations, articles and videos --------------------------------------------- http://securityblog.switch.ch/2014/09/10/the-september-2014-issue-of-our-sw…

1 0

Tageszusammenfassung - Dienstag 9-09-2014
by Daily end-of-shift report 09 Sep '14

09 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-09-2014 18:00 − Dienstag 09-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Cisco Unified Computing System E-Series Blade Servers Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. The vulnerability is due to a failure to properly handle a crafted SSH packet. An attacker could exploit this vulnerability by sending a crafted packet to the SSH server running on the Cisco IMC of an affected device, which could result in the Cisco IMC becoming unresponsive. The operating system running on the blade will be unaffected. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software DHCPv6 Denial Of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the DHCPv6 server process on an affected device to crash. The vulnerability is due to incorrect handling of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending a malformed DHCPv6 packet to an affected device configured with DHCPv6 server functionality. An exploit could allow the attacker to cause the DHCPv6 process on the device to crash. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netgear ProSafe Plus Configuration Utility information disclosure *** --------------------------------------------- Netgear ProSafe Plus Configuration Utility could allow a remote attacker to obtain sensitive information, caused by the storing of passwords in plaintext within the backup file. An attacker could exploit this vulnerability using the configuration backup file to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95780 *** Researchers reveal security issues in Android apps *** --------------------------------------------- On Monday, the University of New Haven revealed its first video in a series of security findings. --------------------------------------------- http://www.scmagazine.com/researchers-reveal-security-issues-in-android-app… *** Why Google Is Pushing For a Web Free of SHA-1 *** --------------------------------------------- An anonymous reader writes: Google recently announced Chrome will be gradually phasing out support for certificates using SHA-1 encryption. They said, "We need to ensure that by the time an attack against SHA-1 is demonstrated publicly, the web has already moved away from it." Developer Eric Mill has written up a post explaining why SHA-1 is dangerously weak, and why moving browsers away from acceptance of SHA-1 is a lengthy, but important process. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ME5Z29v_gGw/story01.htm *** Salesforce: Oh no! Dyre RATs are thirsty for our customers logins *** --------------------------------------------- But attacks werent the cause of server outage, were told Salesforce has warned that miscreants are trying to infect its customers with a remote access trojan (RAT) dubbed Dyre that siphons off Salesforce.com login data. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/08/salesforcec… *** H1 2014 Threat Report *** --------------------------------------------- Our latest Threat Report is now available. The report includes our statistics, incidents calendar and threatscape summaries for H1(Q1+Q2) 2014. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002741.html *** QEMU VGA Emulator Bug Lets Local Guest Users Obtain Potentially Sensitive Information from the Host System *** --------------------------------------------- Description: A vulnerability was reported in QEMU. A local user on a guest system can obtain potentially sensitive information from the host system. A guest system Graphics Output Protocol driver can set a high resolution to trigger a flaw in the VGA emulator and obtain host memory contents. Impact: A local user on a guest system can obtain potentially sensitive information from the host system memory. --------------------------------------------- http://www.securitytracker.com/id/1030817 *** Enigmail PGP plugin forgets to encrypt mail sent as blind copies *** --------------------------------------------- User now waiting for the bad guys come and get me with their water-boards Enigmail has patched a hole in the worlds most popular PGP email platform that caused mail to be sent unencrypted when all security check boxes were ticked. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/09/enigmail_en… *** Kaspersky Internet Security Android App Certificate Validation Flaw Lets Remote Users Spoof Servers *** --------------------------------------------- A vulnerability was reported in Kaspersky Internet Security app for Android. A remote user can spoof servers. The application (com.kms.free) does not verify X.509 certificates from SSL servers. A remote user with the ability conduct a man-in-the-middle attack can supply a specially crafted certificate to spoof an SSL server obtain or modify sensitive information --------------------------------------------- http://www.securitytracker.com/id/1030815 *** OpenSSL Security Policy *** --------------------------------------------- Recent flaws have captured the attention of the media and highlighted how much of the internet infrastructure is based on OpenSSL. Weve never published our policy on how we internally handle security issues; that process being based on experience and has evolved over the years. --------------------------------------------- https://www.openssl.org/about/secpolicy.html *** 'Google Dorking' - Waking Up Web Admins Everywhere *** --------------------------------------------- Last July, the US Department of Homeland Security warned of a new kind of criminal attack: 'Google dorking'. This refers to asking Google for things they have found via special search operators. Let's look closely and see what this is. Google finds things online using a program that accesses web sites: the Google web crawler, called ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/DdLfN3jTMhw/ *** How a DNS Sinkhole Can Protect Against Malware *** --------------------------------------------- The Domain Name Service (DNS) is an integral part of Internet access. It translates human-recognized domain names into computer-readable IP addresses in order to facilitate online communication and connection between devices. ... And one of the best ways to gain control is via DNS itself, in order to disrupt malware transmission at the very point of connection. A DNS sinkhole, or sinkhole server, gives organizations this control in order to prevent internal access to malicious websites. --------------------------------------------- http://resources.infosecinstitute.com/dns-sinkhole-can-protect-malware/ *** Threat Spotlight: 'Kyle and Stan' Malvertising Network Threatens Windows and Mac Users With Mutating Malware *** --------------------------------------------- Once the victim gets redirected to the final URL, the website automatically starts the download of a unique piece of malware for every user. The file is a bundle of legitimate software, like a media-player, and compiles malware and a unique-to-every-user configuration into the downloaded file. The attackers are purely relying on social engineering techniques, in order to get the user to install the software package. No drive-by exploits are being used thus far. --------------------------------------------- https://blogs.cisco.com/security/kyle-and-stan/ *** Modern anti-spam and E2E crypto *** --------------------------------------------- ... asked me to write up some thoughts on how spam filtering and fully end to end crypto would interact, so its all available in one message instead of scattered over other threads. Specifically he asked for brain dumps on: - how does antispam currently work at large email providers - how would widespread E2E crypto affect this - what are the options for moving things to the client (and pros, cons) - is this feasible for email? --------------------------------------------- https://moderncrypto.org/mail-archive/messaging/2014/000780.html *** Research Finds No Large Scale Heartbleed Exploit Attempts Before Vulnerability Disclosure *** --------------------------------------------- In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations - perhaps the NSA - that had known about the bug for some time and had been using it for targeted attacks. A definitive answer to that question may never come, but ... --------------------------------------------- http://threatpost.com/research-finds-no-large-scale-heartbleed-exploit-atte… *** UPDATE: Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- UPDATE: The security update for Adobe Reader and Acrobat has been re-scheduled from September 9, 2014 to the week of September 15, 2014. This delay was necessary to address issues identified during routine regression testing. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1121

1 0

Tageszusammenfassung - Montag 8-09-2014
by Daily end-of-shift report 08 Sep '14

08 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-09-2014 18:00 − Montag 08-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Apple IDs targeted by Kelihos botnet phishing campaign *** --------------------------------------------- Botnet targets Apple customers, launching phishing email campaign to lure victims into disclosing their Apple IDs and passwords. Days after numerous celebrities were found to have their iCloud accounts compromised, a major botnet has turned its attention to Apple customers, launching a phishing email campaign .. --------------------------------------------- http://www.symantec.com/connect/blogs/apple-ids-targeted-kelihos-botnet-phi… *** USB firmware: An upcoming threat for home and enterprise users *** --------------------------------------------- Every year, thousands of hackers and security researchers from around the world descend on Las Vegas to attend the annual Black Hat security conference. The conference boasts top notch security presentations from industry leaders - often centered on breaking computer security. Although many of the presentations are on breaking things, most of the .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/02/usb-firmware-an-upcoming… *** Stupid Spammer Tricks - Reversing Characters *** --------------------------------------------- Spammers engaged in phishing attacks constantly try to get their emails past spam filters. They try many different tactics, and these can include taking advantage of HTML coding characteristics. These HTML tricks can make the email look normal when rendered in a mail client, but the actual .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/stupid-spammer-tricks-reversing-characte… *** Mozilla 1024-Bit Cert Deprecation Leaves 107,000 Sites Untrusted *** --------------------------------------------- Mozilla has deprecated 1024-bit RSA certificate authority certificates in Firefox 32 and Thunderbird. While there are pluses to the move such as a requirement for longer, stronger keys, at least 107,000 websites will no longer be trusted by Mozilla. Data from HD Moores Project Sonar, which .. --------------------------------------------- http://it.slashdot.org/story/14/09/05/2120246/mozilla-1024-bit-cert-depreca… *** Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Nuclear Exploit Kit and Flash CVE-2014-0515 *** --------------------------------------------- For this blog, wed like to walk you through a recent attack involving Nuclear Exploit Kit (EK) that we analyzed. It was found leveraging CVE-2014-0515, a buffer overflow in Adobe Flash Player discovered in April 2014. Nuclear Exploit kit .. --------------------------------------------- http://research.zscaler.com/2014/09/nuclear-exploit-kit-and-flash-cve-2014.… *** WPS-Sicherheitslücke: Wahrscheinlich wenige Router betroffen *** --------------------------------------------- Auf Anfrage von heise Netze haben sich einige Hersteller von in Deutschland verbreiteten Routern zur Sicherheitslücke in WPS-PIN geäussert, bei der sich die Zugangsnummer offline errechnen lässt. --------------------------------------------- http://www.heise.de/security/meldung/WPS-Sicherheitsluecke-Wahrscheinlich-w… *** Popular Photo Sharing Website Likes.com Vulnerable To Multiple Critical Flaws *** --------------------------------------------- Likes.com, one of the emerging social networking site and popular image browsing platform, is found vulnerable to several critical vulnerabilities that could allow an attacker to completely delete users' account in just one click. Likes.com is a social networking website that helps you to connect .. --------------------------------------------- http://thehackernews.com/2014/09/popular-photo-sharing-website.html *** Demasking Google Users With a Timing Attack *** --------------------------------------------- A 3rd party site can determine if a website viewer has access to a particular Google Drive document. ... How it works: The attack is straightforward. A malicious page repeatedly instantiates an image whose source points at the URL of a Google Drive document. If that document is viewable by the .. --------------------------------------------- http://blog.andrewcantino.com/blog/2014/09/04/demasking-google-users-with-a… *** Bugtraq: [security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Execution of Arbitrary Code and Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533370 *** iCloud: Apple verschickt neue Warnhinweise *** --------------------------------------------- Nach den aus iCloud-Accounts entwendeten Promi-Nacktfotos hat Apple damit begonnen, neue Benachrichtigungen zu versenden, wenn auf den Cloud-Dienst zugegriffen wird. Weitere Schutzfunktionen sind angekündigt. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Apple-verschickt-neue-Warnhinwe…

1 0

Tageszusammenfassung - Freitag 5-09-2014
by Daily end-of-shift report 05 Sep '14

05 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-09-2014 18:00 − Freitag 05-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 5 things you should know about email unsubscribe links before you click *** --------------------------------------------- We all get emails we don't want and cleaning them up can be as easy as clicking unsubscribe at the bottom of the email. However, some of those handy little links can cause more trouble than they solve. --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/04/5-things-you-should-know-about-e… *** Google acceleration of SHA-1 deprecation draws resistance *** --------------------------------------------- Google said Chrome 39, to be released within 12 weeks, will treat some sites as untrusted, accelerating the transition and user woes. --------------------------------------------- http://www.scmagazine.com/google-acceleration-of-sha-1-deprecation-draws-re… *** Fresh phish served with a helping of AES *** --------------------------------------------- Attempts to use encryption to make analysis of phishing websites more difficult may be a sign of things to come. Obfuscated phishing sites are nothing new. Various techniques such as JavaScript encryption tools (which offer very primitive obfuscation), data URIs (where the page content is mostly Base64-encoded), and .. --------------------------------------------- http://www.symantec.com/connect/blogs/fresh-phish-served-helping-aes *** Researchers discover two SQL injection flaws in WordPress security plugin *** --------------------------------------------- High-Tech Bridge discovered two SQL injection vulnerabilities in All In One WordPress Security and Firewall plugin and notified the vendor. --------------------------------------------- http://www.scmagazine.com/researchers-discover-two-sql-injection-flaws-in-w… *** Malware Bypasses Chrome Extension Security Feature *** --------------------------------------------- Originally created to extend a browser's functionality, browser extensions have become yet another tool for cybercriminals' schemes. Earlier this year, Google has addressed the issue of malicious browser extensions by .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malware-bypasses… *** Red Hat Enterprise Virtualization Manager 3.4.2 update *** --------------------------------------------- It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the .. --------------------------------------------- https://rhn.redhat.com/errata/RHSA-2014-1161.html *** Microsoft Security Bulletin Advance Notification for September 2014 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on September 9, 2014. ... The following table summarizes the security bulletins for this month in order of severity. Bulletin 1.. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-SEP *** renotification Security Advisory for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, September 9, 2014 for Adobe Reader and Acrobat for Windows and Macintosh .. --------------------------------------------- http://helpx.adobe.com/security/products/reader/apsb14-20.html *** Apple verspricht mehr Sicherheit nach Hacker-Angriff *** --------------------------------------------- Apple-Nutzer sollen künftig über Versuche zur Passwortänderung informiert werden, um Datendiebstahl zu verhindern. --------------------------------------------- http://futurezone.at/digital-life/apple-verspricht-mehr-sicherheit-nach-hac… *** Apache POI 3.10.1-20140818 security issues with OOXML *** --------------------------------------------- The Apache POI project is pleased to announce the release of POI 3.10.1-20140818. This release is a bugfix release to fix two... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090022 *** Security of Password Managers *** --------------------------------------------- At USENIX Security this year there were two papers studying the security of password managers: David Silver, Suman Jana, and Dan Boneh, "Password Managers: Attacks and Defenses." Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song, "The Emperors New Password Manager: Security Analysis of Web-based Password Managers." Its interesting work, especially because it looks at security problems in something that .. --------------------------------------------- https://www.schneier.com/blog/archives/2014/09/security_of_pas.html *** BankAPI - What is it? *** --------------------------------------------- BankAPI is a secure decentralized messaging system to send files/messages between banks and other types of financial institutions. There is a reference implementation of the protocol which can be used off-the-shelf, which is production grade quality and is not only for testing and demonstration, although it .. --------------------------------------------- https://github.com/trustly/bankapi/ *** Remote-Code-Execution-Lücke in F5 BigIP *** --------------------------------------------- Im Hochverfügbarkeits-Modus wiesen die Load-Balancer der Firma F5 ein Sicherheitsproblem auf, das Angreifern die volle Kontrolle über das System ermöglicht. Der Hersteller bessert nach. --------------------------------------------- http://www.heise.de/security/meldung/Remote-Code-Execution-Luecke-in-F5-Big…

1 0

Tageszusammenfassung - Donnerstag 4-09-2014
by Daily end-of-shift report 04 Sep '14

04 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-09-2014 18:00 − Donnerstag 04-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part one *** --------------------------------------------- Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud.It is unlikely that anyone still thinks that cybercrime is performed by 16-year-old kids who write short pieces of code that wreak havoc all over the world, but if you do still hold that belief, it wont hurt to take a look behind the scenes of a modern botnet operation. Todays botnets show how cybercrime has become a professional industry in which many tactics seen in the legitimate e-commerce and IT service --------------------------------------------- http://www.virusbtn.com/blog/2014/09_03.xml *** [webapps] - vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34526 *** WordPress Plugins Bogged Down with CSRF, XSS Vulnerabilities *** --------------------------------------------- A handful of bugs, mostly XSS and CSRF vulnerabilities, have been plaguing at least eight different Wordpress plugins as of late. --------------------------------------------- http://threatpost.com/wordpress-plugins-bogged-down-with-csrf-xss-vulnerabi… *** CERT/CC Enumerates Android App SSL Validation Failures *** --------------------------------------------- The CERT Coordination Center at Carnegie Mellon today released a list of Android applications hosted on Google Play and Amazon that it says fail to validate SSL certificates over HTTPS. --------------------------------------------- http://threatpost.com/certcc-enumerates-android-app-ssl-validation-failures… *** Splunk Enterprise 6.0.6 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.0.6 addresses the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88587, CVE-2014-3511) Reflective cross-site scripting (XSS) referer header vulnerability (SPL-85360) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANE2 *** Identifying Firewalls from the Outside-In. Or, "Theres Gold in them thar UDP ports!", (Thu, Sep 4th) *** --------------------------------------------- In a penetration test, often the key to bypassing a security control is as simple as knowing identifying the platform its implemented on. In other words, its a lot easier to get past something if you know what it is. For instance, quite often youll be probing a set of perimeter addresses, and if there are no vulnerable hosts NAT-ed out for you, you might start .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18617 *** Mozilla Firefox <v32 Secret Leak PoC *** --------------------------------------------- Depending on a variety of factors, problems like that may leak secrets across web origins, or more prosaically, may help attackers bypass security measures such as ASLR. This code is a proof of concept for versions prior to 32. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090017 *** heap overflow in procmails formail utility *** --------------------------------------------- prcomails formail utility is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when parsing addresses with unbalanced quotes. By sending an overly long argument, a remote attacker could overflow a buffer .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95688 *** Kostenloses G-Data-Tool schützt vor BadUSB-Angriffen *** --------------------------------------------- Der G Data USB Keyboard Guard kontrolliert neu an den PC angeschlossene Tastaturen. Der Anwender kann damit entscheiden, ob er diese tatsächlich benutzen will oder ob er einen Angriff befürchtet und das Gerät lieber aussperrt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kostenloses-G-Data-Tool-schuetzt-vor… *** Akamai warnt vor Linux-Server-Botnet *** --------------------------------------------- Mit einer Sicherheitswarnung mit "Risikofaktor: Hoch" warnt Netzwerk-Spezialist Akamai vor einem Botnetz aus Linux-Servern, das verteilte DoS-Attacken durchführt, um andere Server in die Knie zu zwingen. --------------------------------------------- http://www.heise.de/security/meldung/Akamai-warnt-vor-Linux-Server-Botnet-2… *** zAnti - Android Penetration Testing Toolkit (Free!) *** --------------------------------------------- zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks - including rogue access points. --------------------------------------------- http://hack-tools.blackploit.com/2014/09/zanti-android-penetration-testing.… *** New file-encrypting ransomware called CryptoGraphic Locker *** --------------------------------------------- A new file-encrypting ransomware was discovered today by BartBlaze called CryptoGraphic Locker. Just like other encrypting ransomware, this infection will scan your your data files and encrypt them so that they are unusable. The infection will then display a ransom note that requires you to purchase .. --------------------------------------------- http://www.bleepingcomputer.com/forums/t/546749/new-file-encrypting-ransomw… *** Apple OS X: Security Through Obscurity is becoming an Absurdity *** --------------------------------------------- Today's blog on a new Mac malware is a reminder that attackers go where the money is. Apple usage within the enterprise is growing rapidly, with 52 percent of newly issued computers being Macs according to Forrester. Forrester also .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-os-x-security-through-o… *** Forced to Adapt: XSLCmd Backdoor Now on OS X *** --------------------------------------------- Introduction FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd - OSX.XSLCmd - which is designed to compromise Apple OS X systems. This .. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2014/09/forced-to-ad… *** VU#855836: Arris Touchstone cable modem information leakage vulnerabiliity *** --------------------------------------------- Arris Touchstone DG950A cable modem enables SNMP public access by default. Description CWE-200 - Information ExposureThe Arris Touchstone DG950A cable modem running software version 7.10.131 was found to expose sensitive .. --------------------------------------------- http://www.kb.cert.org/vuls/id/855836 *** Semalt botnet hijacked nearly 300k computers *** --------------------------------------------- The "Semalt" botnet is quickly spreading across the Internet, Incapsula researchers warn. The botnet is named after a Ukrainian startup that poses as a legitimate online SEO service, and it currently numbers around 290,000 malware infected machines that continually spam millions of websites in a large-scale, referrer spam campaign. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2857

1 0

Tageszusammenfassung - Mittwoch 3-09-2014
by Daily end-of-shift report 03 Sep '14

03 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-09-2014 18:00 − Mittwoch 03-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Bugtraq: Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathnames *** --------------------------------------------- Microsoft Office 2010 registers the following command lines with unquoted pathnames containing spaces for various supported file types: --------------------------------------------- http://www.securityfocus.com/archive/1/533317 *** Quick Analysis of a DDoS Attack Using SSDP *** --------------------------------------------- Last week, one of our many clients came under an interesting attack. Enough that it was flagged for human intervention. The interesting aspect of the case was that it was a multi-faceted DDoS attack. The first issue we noticed was a Layer 7, HTTP Flood Attack, Distributed Denial of Service (DDoS) attack ... --------------------------------------------- http://blog.sucuri.net/2014/09/quick-analysis-of-a-ddos-attack-using-ssdp.h… *** New international cybercrime unit, J-CAT, launches pilot program *** --------------------------------------------- A new European cybercrime organization, the Joint Cybercrime Action Taskforce (J-CAT), announced the launch of its six-month pilot program yesterday. The group will investigate global cybercrime threats and targets, according to a release. The Federal Bureau of Investigation (FBI) and the U.K.'s National Crime Agency (NCA) have partnered up to create the unit. Other countries, including Canada and Australia, have signed on to the initiative. --------------------------------------------- http://www.scmagazine.com/new-international-cybercrime-unit-j-cat-launches-… *** ShadowServer Scans Confirm Scale of Netis Threat *** --------------------------------------------- Our friends at the ShadowServer Foundation are now scanning for the Netcore/Netis router backdoor which we found in August. Their findings are in line with what we published then: that the vast majority of those affected in China, with more than a million scanned IP addresses currently affected by this threat. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CSrl4YNzdgE/ *** Firefox 32 released, time to update *** --------------------------------------------- Firefox 32 released, time to update - now with support for Public Certificate Pinning. Release notes here: https://www.mozilla.org/en-US/firefox/32.0/releasenotes/ --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18609&rss *** IBM Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758) *** --------------------------------------------- When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. CVE(s): CVE-2014-4758 Affected product(s) and affected version(s): IBM Business Process Manager Standard V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Express V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Advanced V7.5.x, 8.0.x 8.5.x IBM WebSphere Lombardi Edition V7.2.x --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Mozilla Firefox for Android file: Protocol Lets Remote Users Obtain Potentially Sensitive Information in Certain Cases *** --------------------------------------------- A vulnerability was reported in Mozilla Firefox for Android. A remote user can obtain potentially sensitive information from the target user's system in certain cases. A remote user can create a specially crafted 'file:' URL that, when loaded by the target user, will access a local file in the Firefox profile directory and copy the data to the SD card without user intervention. A local application can then access the data. --------------------------------------------- http://www.securitytracker.com/id/1030792 *** LogAnalyzer 3.6.5 Cross Site Scripting *** --------------------------------------------- It was found that an XSS injection is possible on a syslog server running LogAnalyzer version 3.6.5. by changing the hostname of any entity logging to syslog server with LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary syslog message, a client-side script injection execution is possible. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090008 *** Exploit PHP's mail() to get remote code execution *** --------------------------------------------- While searching around the web for new nifty tricks I stumbled across this post about how to get remote code exeution exploiting PHP's mail() function. First, I must say that this is only going to happen under some really rare circustances. Never the less, it's really something to think about and keep an eye out for. I will explain an example scenario which I think could be a real life scenario later in this article. --------------------------------------------- http://securitysucks.info/exploit-phps-mail-to-get-remote-code-execution/ *** Tests compare Mac OS X anti-malware products *** --------------------------------------------- Every day, independent test lab AV-TEST.org captures more than 400,000 new malware samples for Windows and 5,000 new samples for Android. For the Mac they identify less than 100 per month. But there is malware out there for the Mac and it does hit users in the real world, if less often and less intensely than on the PC. ... Thats why AV-TEST just completed a test of 18 products in this space --------------------------------------------- http://www.zdnet.com/tests-compare-mac-os-x-anti-malware-products-700003317… *** Xen Project Maintenance Releases Available (Versions 4.4.1, 4.3.3, 4.2.5) *** --------------------------------------------- Vulnerabilities fixed: Xen 4.4.1 CVE-2014-2599 CVE-2014-3125 CVE-2014-3124 CVE-2014-2915 CVE-2014-2986 CVE-2014-3714 CVE-2014-3715 CVE-2014-3716 CVE-2014-3717 CVE-2014-3967 CVE-2014-3968 CVE-2014-3969 CVE-2014-4021 CVE-2014-4022 CVE-2014-5147 CVE-2014-5148 Xen 4.2.5 + 4.3.3 CVE-2014-2599 CVE-2014-3124 CVE-2014-3967 CVE-2014-3968 CVE-2014-4021 Apart from those there are many further bug fixes and improvements. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-09/msg00000.html *** ZDI-14-301: SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-301/

1 0

Tageszusammenfassung - Dienstag 2-09-2014
by Daily end-of-shift report 02 Sep '14

02 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-09-2014 18:00 − Dienstag 02-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Bugtraq: Avira License Application - Cross Site Request Forgery Vulnerability *** --------------------------------------------- An independent Vulnerability Laboratory Researcher discovered a cross site request forgery vulnerability in the official Avira license account system web-application. --------------------------------------------- http://www.securityfocus.com/archive/1/533288 *** Dodging Browser Zero Days - Changing your Orgs Default Browser Centrally *** --------------------------------------------- In a recent story about "whats a sysadmin to do?", we suggested that since our browsers seem to take turns with zero days lately, that system administrator should have processes in place to prepare for when their corporate standard browser has a major vulnerability that doesnt yet have .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18601 *** [webapps] - WordPress Slideshow Gallery Plugin 1.4.6 - Shell Upload Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/34514 *** [webapps] - Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download *** --------------------------------------------- http://www.exploit-db.com/exploits/34511 *** Net-snmp SNMP Trap Processing Flaw Lets Remote Users Crash snmptrapd *** --------------------------------------------- http://www.securitytracker.com/id/1030789 *** Industrial software website used in watering hole attack *** --------------------------------------------- AlienVault Labs has discovered a watering hole attack thats using a framework developed for reconnaissance as the primary infection vector.The criminals responsible for the incident compromised an unnamed industrial software firms website, suggesting the potential for future attacks against .. --------------------------------------------- http://www.csoonline.com/article/2600772/data-protection/industrial-softwar… *** The Secret Life of SIM Cards *** --------------------------------------------- SIM cards can do more than just authenticate your phone with your carrier. Small apps can be installed and run directly on the SIM separate from and without knowledge of the phone OS. ... This talk, based on our experience building SIM apps for the Toorcamp GSM network, explains what (U)SIM Toolkit Applications are, how they work, and how to develop them. --------------------------------------------- http://www.ehacking.net/2014/08/the-secret-life-of-sim-cards.html *** IPv6 insecurities on 'IPv4-only' networks *** --------------------------------------------- When people hear about IPv6-specific security issues, they frequently tend to rate this as an argument in favour of delaying or avoiding IPv6 deployment on their enterprise or campus network. Even without IPv6 being consciously deployed, however, some of the IPv6-related security issues were already introduced to most networks many years ago. --------------------------------------------- http://securityblog.switch.ch/2014/08/26/ipv6-insecurities-on-ipv4-only-net… *** Using WPS on your Wi-Fi router may be even more dangerous than you think *** --------------------------------------------- In 2011, a researcher found that WPS was 10,000 times easier to crack than it was supposed to be. Now, another researcher has found that cracking it may be 10,000 times easier again... --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dange… *** TYPO3-EXT-SA-2014-010: Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: cwt_feedit, eu_ldap, flatmgr, jh_opengraphprotocol, ke_dompdf, lumophpinclude, news_pack, sb_akronymmanager, st_address_ma, weeaar_googlesitemap,. wt_directory --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** A Google Site Meant to Protect You Is Helping Hackers Attack You *** --------------------------------------------- It's long been suspected that hackers and nation-state spies are using Google's antivirus site to test their tools before unleashing them on victims. Now Brandon Dixon, an independent security researcher, has caught them in the act, tracking several high-profile hacking groups - including, surprisingly, two well-known nation-state teams - as they used VirusTotal to hone their code and develop their tradecraft. --------------------------------------------- http://www.wired.com/2014/09/how-hackers-use-virustotal

1 0

Tageszusammenfassung - Montag 1-09-2014
by Daily end-of-shift report 01 Sep '14

01 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-08-2014 18:00 − Montag 01-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CryptoWall's Haul: $1M in Six Months *** --------------------------------------------- The CryptoWall ransomware has proven to be a profitable criminal enterprise, netting more than $1.1 million in six months. More than 1,600 victims have surfaced and more than 5 billion files have been encrypted. --------------------------------------------- http://threatpost.com/cryptowalls-haul-1m-in-six-months/107978 *** Kindle App for Android SSL certificate spoofing *** --------------------------------------------- Kindle App for Android could allow a remote attacker to conduct spoofing attacks, caused by the improper verification of SSL certificates. By persuading a victim to visit a Web site containing a specially-crafted certificate, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to cause the victim to accept spoofed certificates. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95617 *** Glibc Heap Overflow in __gconv_translit_find() Lets Local Users Gain Elevated Privileges *** --------------------------------------------- A local user can set a specially crafted CHARSET environment variable value to trigger an off-by-one memory error and resulting heap overflow in __gconv_translit_find() and execute arbitrary code on the target system. The local user may be able to cause a set user id (setuid) root application that uses this environment variable to execute code with root privileges. --------------------------------------------- http://www.securitytracker.com/id/1030786 *** F5 Unauthenticated rsync access to Remote Root Code Execution *** --------------------------------------------- When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080148 *** 1900/UDP (SSDP) Scanning and DDOS, (Sun, Aug 31st) *** --------------------------------------------- Over the last few weeks we have detected a significant increase in both scanning for 1900/UDP and a huge increase of 1900/UDP being used for amplified reflective DDOS attacks. 1900/UDP is the Simple Service Discovery Protocol (SSDP) which is a part of Universal Plug and Play (UPnP). The limited information available to me indicates that the majority of the devices that are .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18599 *** Rubbish WPS config sees WiFi router keys popped in seconds *** --------------------------------------------- Another day, another way in to your home router Passwords within routers sold by chipset manufacturer Broadcom and an unnamed vendor can be accessed within seconds thanks to weak or absent key randomisation, security bod Dominique Bongard has claimed. --------------------------------------------- http://www.theregister.co.uk/2014/09/01/wps_flaw_leaves_home_routers_vulner… *** Lynis 1.6.0 - Security auditing tool for Unix/Linux systems *** --------------------------------------------- Lynis is an open source security auditing tool. Primary goal is to help users with auditing and hardening of Unix and Linux based systems. The software is .. --------------------------------------------- http://hack-tools.blackploit.com/2014/08/lynis-160-security-auditing-tool-f… *** Mozilla: An die 100.000 Nutzerdaten unabsichtlich offengelegt *** --------------------------------------------- Zweite grosse Datenpanne innerhalb eines Monats beim Firefox-Hersteller --------------------------------------------- http://derstandard.at/2000005015299 *** Dircrypt: Ransomware liefert Schlüssel mit *** --------------------------------------------- Eine Analyse der Ransomware Dircrypt hat ergeben, dass die verschlüsselten Dateien des Erpressungstrojaners offenbar den Schlüssel mitliefern. Allerdings nur für einen Teil der Daten. --------------------------------------------- http://www.golem.de/news/dircrypt-ransomware-liefert-schluessel-mit-1409-10… *** APWG Q2 2014 report, phishing is even more dangerous *** --------------------------------------------- The APWG has published its new report related to phishing activities in the period April - June 2014, the document titled 'Phishing Activity Trends Report, 2nd Quarter 2014' states that online payment services and crypto-currency sites are .. --------------------------------------------- http://securityaffairs.co/wordpress/27935/cyber-crime/apwg-q2-2014-report.h…

1 0

Tageszusammenfassung - Freitag 29-08-2014
by Daily end-of-shift report 29 Aug '14

29 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-08-2014 18:00 − Freitag 29-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Heartbleed is the gift that keeps on giving as servers remain unpatched *** --------------------------------------------- An average of 7,000 attacks continue to seek out servers vulnerable to the bug. --------------------------------------------- http://arstechnica.com/security/2014/08/heartbleed-is-the-gift-that-keeps-o… *** PCI Council urges retailers to defend against Backoff POS attacks *** --------------------------------------------- The warning comes soon after the Secret Service and DHS issues a warning on the threat. --------------------------------------------- http://www.scmagazine.com/pci-council-urges-retailers-to-defend-against-bac… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Django REMOTE_USER header security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95569 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js is affected by CVE-2014-5256 *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks *** --------------------------------------------- A few days ago we detected a watering hole campaign in a website owned by one big industrial company.The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing.The attackers were able to compromise the website and include code that loaded a malicious Javascript .. --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissanc… *** Squid Range Header Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030779 *** F5 BIG-IP ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030778 *** F5 Enterprise Manager ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030777 *** Sinkholing the Backoff POS Trojan *** --------------------------------------------- There is currently a lot of buzz about the Backoff point-of-sale Trojan that is designed to steal credit card information from computers that have POS terminals attached. --------------------------------------------- https://securelist.com/blog/research/66305/sinkholing-the-backoff-pos-troja… *** Nearly 100k Bugzilla Users Affected by Data Disclosure *** --------------------------------------------- The email addresses and encrypted passwords of nearly 100,000 users of Mozilla's Bugzilla system were left on a publicly accessible server for several months earlier this year, the company said. The disclosure comes just a few weeks after Mozilla advised members of its Mozilla Developer .. --------------------------------------------- http://threatpost.com/nearly-100k-bugzilla-users-affected-by-data-disclosur…

1 0

Tageszusammenfassung - Donnerstag 28-08-2014
by Daily end-of-shift report 28 Aug '14

28 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-08-2014 18:00 − Donnerstag 28-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CG Automation Improper Input Validation *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CG Automation ePAQ-9410 Substation Gateway DNP3 protocol components. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-01 *** Schneider Electric Wonderware Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric Wonderware Information Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-02 *** Mobile Security Roundup 1H 2014 *** --------------------------------------------- The first half of this year has been quite eventful for the mobile threat landscape. Sure, we had an idea the state of affairs from 2013 would continue on to this year, but we didn't know just to what extent. From ballooning mobile malware/high risk app numbers to vulnerabilities upon vulnerabilities, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-security-… *** MS14-045 - Important: Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2984615) - Version: 3.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-045 *** Cisco 1800 Series ISDN Basic Rate Interface Denial of Service *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cybercriminals Leverage Rumored Windows 9 Developer Preview Release With Social Engineering *** --------------------------------------------- We're seeing schemes that are taking advantage of the buzz around the upcoming developer preview release of Windows 9 this September. One of the threats we saw was found using some combinations of keywords like Windows 9, free, leak and download in popular search engines. It involves a potentially malicious .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-l… *** My WordPress Website Was Hacked *** --------------------------------------------- Before you freak out, allow me to clarify. It was one of several honeypots we have running. The honeypots are spread across the most commonly employed hosting companies. From Virtual Private Servers (VPS) to shared environments, to managed environments. In most instances we pay and .. --------------------------------------------- http://blog.sucuri.net/2014/08/my-wordpress-website-was-hacked.html *** One More Day of Trolling in POS Memory, (Wed, Aug 27th) *** --------------------------------------------- Further to the recent story on Memory Trolling for PCI data, I was able to spend one more day fishing in memory, I dug a bit deeper and come up with more fun Credit Card / Memory goodness with our friend the Point of Sale application. First of all, just searching for credit card numbers returns a lot of duplicates, as indicated in yesterdays .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18589 *** Smarthome: Die Ifa wird zur Messe der Sicherheitslücken *** --------------------------------------------- Auf der Internationalen Funkausstellung in Berlin (Ifa) wird das Smarthome zu einem grossen Thema. Kaspersky Lab warnt jetzt erneut vor potenziellen Sicherheitslücken im Heimnetz, und ein Blick in vergangene Meldungen zeigt, dass die .. --------------------------------------------- http://www.golem.de/news/smarthome-die-ifa-wird-zur-messe-der-sicherheitslu… *** [2014-08-28] Cross-Site Scripting vulnerabilities in F5 BIG-IP *** --------------------------------------------- Attacker can steal other users sessions, impersonate other users and to gain unauthorized access to the admin interface. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** LibreOffice 4.3.1/ .2.6-secfix *** --------------------------------------------- The Document Foundation announces LibreOffice 4.3.1, the first minor release of LibreOffice 4.3 "fresh" family, with over 100 fixes (including patches for two CVEs, backported to LibreOffice 4.2.6-secfix, which is also available for download now). --------------------------------------------- http://listarchives.documentfoundation.org/www/announce/msg00199.html *** Microsoft gibt Problem-Patch eine zweite Chance *** --------------------------------------------- Zumindest eine der vier zurückgezogenen Patches steht mit neuer KB-Nummer wieder zur Installation bereit. Er schliesst Lücken in Windows, durch die sich ein Angreifer höhere Rechte verschaffen kann. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-gibt-Problem-Patch-eine-zwei… *** Srizbi kernel-mode spambot reappears as Pitou *** --------------------------------------------- Malware possibly still in the brewing stage.In November 2007, we published an article by Kimmo Kasslin (F-Secure) and Elia Florio (Symantec), in which they analysed the Srizbi trojan, notable for being the first malware found in the wild that operated fully in kernel mode. It appears .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_28.xml?rss *** eCrime Research Symposium 2014 *** --------------------------------------------- The APWG is pleased to present eCrime 2014, a combined event that includes the 2014 Fall General Meeting, and eCrime Researchers Symposium. ... This eCrime Congress will include a one-day, members-only meeting on September 23rd and two full days of open sessions thereafter of programming that will be open to both members and non-members. --------------------------------------------- http://ecrimeresearch.org/events/ecrime2014/ *** Firefox soll falsche SSL-Zertifikate enttarnen *** --------------------------------------------- Auch Mozillas Browser wird künftig etwa beim Besuch von Google.com überprüfen, ob das ausgelieferte SSL-Zertifikat von einem Herausgeber stammt, den der Dienst üblicherweise benutzt. --------------------------------------------- http://www.heise.de/security/meldung/Firefox-soll-falsche-SSL-Zertifikate-e…

1 0

Tageszusammenfassung - Mittwoch 27-08-2014
by Daily end-of-shift report 27 Aug '14

27 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-08-2014 18:00 − Mittwoch 27-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Not all Java from java.com is legitimate *** --------------------------------------------- Isn't it ironic getting a Java exploit via java.com, the primary source for one of the most common used browser plugins? Current malvertising campaigns are able to do this. This blog post details a relatively new trend: real-time advertisement bidding platforms being infiltrated by cyber criminals spreading malware. --------------------------------------------- http://blog.fox-it.com/2014/08/27/malvertising-not-all-java-from-java-com-i… *** Multiple Cross-Site Scripting Vulnerabilities in Transport Gateway for Smart Call Home *** --------------------------------------------- A vulnerability in the web framework of Cisco Transport Gateway for Smart Call Home (TG-SCH) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netflix Open Source Security Tools Solve Range of Challenges *** --------------------------------------------- Netflix engineers released two new application security tools to open source this week, a continuing effort from the streaming services company. --------------------------------------------- http://threatpost.com/netflix-open-source-security-tools-solve-range-of-cha… *** ZDI-14-296: Novell Groupwise Administration Server FileUploadServlet poLibMaintenanceFileSave Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-296/ *** VMware Support Tool temporary files denial of service *** --------------------------------------------- VMware Support Tool is vulnerable to a denial of service, caused by a symlink attack. Temporary files are created insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system and cause a denial of service. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95493 *** VMware Support Tool /tmp directory information disclosure *** --------------------------------------------- VMware Support Tool could allow a local attacker to obtain sensitive information, caused by insecure permissions being set for the /tmp directory. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95494 *** Vulnerability in Citrix CloudPlatform Virtual Router could result in unauthorised access to network resources *** --------------------------------------------- A vulnerability has been identified in the virtual router component of Citrix CloudPlatform, formerly known as Citrix CloudStack, that could allow .. --------------------------------------------- http://support.citrix.com/article/CTX140989 *** Citrix CloudPlatform Virtual Router Firewall Bug Lets Remote Users Access Network Resources *** --------------------------------------------- A vulnerability was reported in Citrix CloudPlatform Virtual Router. A remote user can bypass access controls to access network resources. --------------------------------------------- http://www.securitytracker.com/id/1030762 *** Google says - patch your Chrome *** --------------------------------------------- 64-bit browser loads cat vids FIFTEEN PERCENT faster! Google has dropped 50 patches for its flagship Chrome browser plugging holes and handed $30,000 to a lone bug hunter who reported a dangerous sandbox-busting attack. --------------------------------------------- www.theregister.co.uk/2014/08/27/goog_says_patch_your_chrome/ *** PCI Council wants YOU to give it things to DO *** --------------------------------------------- How about enforcing PCI DSS? Crusaders at the Payment Card Industry Security Standards Council have called for submissions into projects for 2015. --------------------------------------------- www.theregister.co.uk/2014/08/27/pci_council_wants_you_to_give_it_things_to… *** RSA Identity Management and Governance Authentication Flaw Lets Remote Users Bypass Authentication to Gain Access to the Target System *** --------------------------------------------- A vulnerability was reported in RSA Identity Management and Governance. A remote user can bypass authentication to gain access to the target system. --------------------------------------------- http://www.securitytracker.com/id/1030759 *** Sicherheitsupdate für Synology-Netzwerkspeicher *** --------------------------------------------- Auch ein NAS ist meist ein Linux-Server, der gehegt und gepflegt werden muss - insbesondere dann, wenn es über das Internet erreichbar ist. Synology hat deshalb unter anderem OpenSSL auf den aktuellen Stand gebracht und damit diverse Lücken geschlossen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsupdate-fuer-Synology-Netzwe… *** VB2014 preview: Methods of malware persistence on Mac OS X *** --------------------------------------------- Patrick Wardle shows that OS X users really have something to worry about.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. Today, .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_27.xml *** IBM: Heartbleed Attacks Thousands of Servers Daily *** --------------------------------------------- The 2014 IBM X-Force Threat Intelligence Quarterly takes a look back at Heartbleed and how organizations were affected by it. --------------------------------------------- http://threatpost.com/ibm-heartbleed-attacks-thousands-of-servers-daily/107… *** ZDI-14-297: Juniper Network and Security Manager XDB Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper Network and Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-297/

1 0

Tageszusammenfassung - Dienstag 26-08-2014
by Daily end-of-shift report 26 Aug '14

26 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-08-2014 18:00 − Dienstag 26-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Barracuda Networks Web Security Flex multiple modules cross-site scripting *** --------------------------------------------- Barracuda Networks Web Security Flex is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by multiple modules. A remote attacker could exploit this vulnerability using the Domain Alias, LDAP Host or Bind DN/Username field to inject malicious script into a Web page which would be .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95445 *** Trolling Memory for Credit Cards in POS / PCI Environments, (Tue, Aug 26th) *** --------------------------------------------- In a recent penetration test, I was able to parlay a network oversight into access to a point of sale terminal. Given the discussions these days, the next step for me was an obvious one - memory analysis. My first step was to drive to the store I had compromised and purchase an .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18579 *** Point of Sale Terminal Protection - "Fortress PCI at the Mall", (Tue, Aug 26th) *** --------------------------------------------- This is a very broad topic, but over the last few months Ive seen some really nicly protected PCI termainls. Especially since many POS environments are still running Windows XP, this is an important topic to discuss. Things that Ive seen done very well: First of all, only allow access to the POS app - retail staff generally dont require access to email or the internet, at .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18581 *** Netis Routers Leave Wide Open Backdoor *** --------------------------------------------- Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-le… *** Attack flogged through shiny-clicky social media buttons *** --------------------------------------------- 66,000 users popped by malicious Flash fudging add-on Web admins beware: social media buttons that load scripts from unknown external sites could see your sites foisting the FlashPack exploit .. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/26/ek_flogged_… *** Glibc: Fehlerhaftes Null-Byte führt zu Root-Zugriff *** --------------------------------------------- Mitgliedern von Googles Project Zero ist es gelungen, einen kleinen Fehler in der Glibc auszunutzen, um unter einem Linux-System Root-Zugriff zu erhalten. Dafür mussten zahlreiche Hürden überwunden werden. --------------------------------------------- http://www.golem.de/news/glibc-fehlerhaftes-null-byte-fuehrt-zu-root-zugrif…

1 0

Tageszusammenfassung - Montag 25-08-2014
by Daily end-of-shift report 25 Aug '14

25 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-08-2014 18:00 − Montag 25-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Stiffed by Synolocker ransomware crims? Try F-Secures python tool *** --------------------------------------------- Unlock key doesnt always fit, says security biz Security firm F-Secure has released a tool to decrypt data scrambled by the Synolocker malware - assuming youve obtained the decryption key from the crooks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/23/f_secure_sy… *** QEMU ACPI PCI code execution *** --------------------------------------------- QEMU could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds access error in ACPI PCI hotplug interface. An attacker could exploit this vulnerability to corrupt QEMU process memory and obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95419 *** HP Service Manager Bugs Let Remote Users Gain Elevated Privileges, Modify Data, and Deny Service and Conduct Cross-Site Scripting and Cross-Site Requset Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030756 *** OpenOffice Targeted Data Exposure Using Crafted OLE Objects *** --------------------------------------------- The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080102 *** OpenOffice 4.1.0 Calc Command Injection *** --------------------------------------------- The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080101 *** Fortinet FortiGate Flaw in FortiManager Protocol Service Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030753 *** NIST to sysadmins: clean up your SSH mess *** --------------------------------------------- Too many keys, too badly managed - NIST has taken a look at how companies use Secure Shell (SSH), and doesnt much like what it sees. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/25/nist_to_sys… *** Ransomware mit leistungsfähigen Password Stealer *** --------------------------------------------- Ransomware auch als 'WinLocker' bekannt, sind nach wie vor in unserem digitalen Alltag gegenwärtig und wird zudem von Cyberkriminellen mit weiteren und komplexeren Funktionen ausgestattet. Um an Informationen zu Funktionen und evtl. Hintermänner dieser Ransomware zu gelangen, haben Experten von Avast bei der neusten Generation dieser Malware, Indizien zu leistungsfähigen Modulen u.a. zum Diebstahl von Passwort und Zugangsdaten gefunden. --------------------------------------------- http://blog.botfrei.de/2014/08/ransomware-mit-leistungsfaehigen-password-st…

1 0

Tageszusammenfassung - Freitag 22-08-2014
by Daily end-of-shift report 22 Aug '14

22 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-08-2014 18:00 − Freitag 22-08-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Lua vararg functions buffer overflow *** --------------------------------------------- Lua is vulnerable to a buffer overflow, caused by improper bounds checking by vararg functions. By sending an overly long string argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95390 *** Researchers create privacy wrapper for Android Web apps *** --------------------------------------------- Users can wrap Facebook and other apps to better control their privacy and security, according to researchers from North Carolina State University. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/mQ5PZ77i084/ *** Malicious app can get past Android WITHOUT PERMISSIONS *** --------------------------------------------- Be careful what you install, say boffins. Again. Researchers presenting at Usenix have lifted the lid on yet another Android vulnerability: the way apps use memory can be exploited to leak private information with a success rate between 82 and 92 per cent of the time. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/22/malicious_a… *** Security Advisory - Remote Security Bypass Vulnerability on Huawei Android Devices *** --------------------------------------------- SA No: Huawei-SA-20140821-Android Android version 4.1.1 - 4.4.2 is prone to a remote security bypass vulnerability (CVE-2013-6272): A vulnerability in the Android system allows an attacker to initiate or terminate arbitrary calls without the call_phone permission. After investigation we confirm that some Huawei smartphone and tablet products are affected. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** RTFM 0day in iOS apps: G+, Gmail, FB Messenger, etc. *** --------------------------------------------- Normal people spend their nights watching movies, reading articles, socializing or (yes, I know its odd) sleeping. I spend my nights reading RFCs and pentesting various applications/services. --------------------------------------------- http://algorithm.dk/posts/rtfm-0day-in-ios-apps-g-gmail-fb-messenger-etc *** PHP 5.5.16 is released *** --------------------------------------------- The PHP Development Team announces the immediate availability of PHP 5.5.16. This release fixes several bugs against PHP 5.5.15 and resolves CVE-2014-3538, CVE-2014-3587, CVE-2014-2497, CVE-2014-5120 and CVE-2014-3597. All PHP users are encouraged to upgrade to this new version. --------------------------------------------- http://php.net/archive/2014.php

1 0

Tageszusammenfassung - Donnerstag 21-08-2014
by Daily end-of-shift report 21 Aug '14

21 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-08-2014 18:00 − Donnerstag 21-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco WebEx MeetMeNow Server Directory Traversal Vulnerability *** --------------------------------------------- A vulnerability in a PHP file in the Cisco WebEx MeetMeNow Server could allow an authenticated, remote attacker to obtain the contents of arbitrary files on an affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** The fall of rogue antivirus software brings new methods to light *** --------------------------------------------- Rogue antivirus software has been a part of the malware ecosystem for many years now - Win32/SpySheriff and Win32/FakeRean date all the way back to 2007. These rogues, and the many that have followed them throughout the years, generally mislead and scare users into paying a fee for "cleaning" false detections that the software claims to have found on the machine. They often use dozens .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/08/19/the-fall-of-rogue-antivi… *** Researchers build security framework for Android *** --------------------------------------------- University researchers have modified the Android operating system to let developers plug in enterprise-class security enhancements that would normally require overhauling a mobile devices firmware.The code added to the OS is called the Android Security Modules (ASM) framework, which is described .. --------------------------------------------- http://www.csoonline.com/article/2474691/mobile-security/researchers-build-… *** Britischer Geheimdienst GCHQ entwickelt Hackerspiel mit *** --------------------------------------------- Im Browserspiel soll getestet werden, wie gut sich die Briten mit Online-Sicherheit auskennen. Dabei soll es Wettbewerbe geben, bei denen Nachwuchs rekrutiert wird. --------------------------------------------- http://futurezone.at/digital-life/britischer-geheimdienst-gchq-entwickelt-h… *** 5 excuses for doing nothing about computer security *** --------------------------------------------- Sadly, as were sure you have found, once a friend or family member has latched onto a security avoidance excuse, it can be hard to talk them round. So, here are five excuses that we hear a lot, both from individuals and from small businesses, together with some points you can use to argue back that security really does matter. --------------------------------------------- http://nakedsecurity.sophos.com/2014/08/20/5-excuses-for-doing-nothing-abou… *** Need a green traffic light all the way home? Easy with insecure street signals, say researchers *** --------------------------------------------- "While other deployments may use different wireless radios or even wired connections between intersections we have no reason to believe there are any fundamental differences between the network we studied and other traffic signal systems," the researchers concluded. "We believe that many traffic infrastructure .. --------------------------------------------- http://www.theregister.co.uk/2014/08/20/sick_of_slow_commuting_americas_tra… *** IoT: How I hacked my home *** --------------------------------------------- A typical modern home can have around five devices connected to the local network which aren't computers, tablets or cellphones. As users in a connected digital environment we need to ask ourselves: Are the devices connected to my network vulnerable? What could an attacker actually do if these devices were compromised? Is my home 'hackable?' --------------------------------------------- https://securelist.com/analysis/publications/66207/iot-how-i-hacked-my-home/

1 0

Tageszusammenfassung - Mittwoch 20-08-2014
by Daily end-of-shift report 20 Aug '14

20 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-08-2014 18:00 − Mittwoch 20-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Apache OFBiz cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95356 *** The Administrator of Things (AoT) - A Side Effect of Smartification *** --------------------------------------------- In an earlier article, we talked about the ongoing smartification of the home - the natural tendency of households to accumulate more intelligent devices over time. While this has its benefits, the residents of smart homes also need to invest their time and energy to maintain these devices. These requirements will only grow as more... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5chS0C_DSr4/ *** RSA Archer GRC Platform 5.5 SP1 Privilege Escalation / CSRF / Access Bypass *** --------------------------------------------- Topic: RSA Archer GRC Platform 5.5 SP1 Privilege Escalation / CSRF / Access Bypass Risk: Medium Text:ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2014-071 CVE Identifier: CVE-20... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080085 *** "El Machete" *** --------------------------------------------- "Machete" is a targeted attack campaign with Spanish speaking roots. Most of the victims are located in Venezuela, Ecuador, , Colombia, Peru, Russia, Cuba, and Spain. Targets include high-level profiles, including intelligence services, military, embassies and government institutions. --------------------------------------------- https://securelist.com/blog/research/66108/el-machete/ *** Microsoft zieht weitere Windows-Updates zurück *** --------------------------------------------- Nutzer klagen über Bluescreens und weitere Probleme --------------------------------------------- http://derstandard.at/2000004536290 *** Vernetzte Geräte: Tausende Sicherheitslücken entdeckt *** --------------------------------------------- In mehr als 140.000 Geräten haben Forscher teils schwerwiegende Sicherheitslücken entdeckt, darunter Zero-Day-Exploits, hartcodierte Passwörter und private Schlüssel. --------------------------------------------- http://www.golem.de/news/vernetzte-geraete-tausende-sicherheitsluecken-entd… *** Bugtraq: [security bulletin] HPSBUX03091 SSRT101667 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533176 *** Bugtraq: Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533180 *** Bugtraq: CVE-2014-5307 - Privilege Escalation in Panda Security Products *** --------------------------------------------- http://www.securityfocus.com/archive/1/533182 *** Bugtraq: CVE-2014-4973 - Privilege Escalation in ESET Windows Products *** --------------------------------------------- Versions 5.0 - 7.0 of ESET Smart Security and ESET Endpoint Security products for Windows XP OS allow a low privileged user to execute code as SYSTEM by exploiting a vulnerability in the ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver also mentioned as Personal Firewall module Build 1183 (20140214) and prior. --------------------------------------------- http://www.securityfocus.com/archive/1/533184 *** Aktuelle Masche: Krimineller "Blog-Klau" verärgert viele Betreiber *** --------------------------------------------- Unbekannte spiegeln derzeit dutzende deutsche Blogs und versuchen, mit den gekaperten Inhalten illegal Kasse zu machen. --------------------------------------------- http://www.heise.de/security/meldung/Aktuelle-Masche-Krimineller-Blog-Klau-… *** Zertifikate: Google will vor SHA-1 warnen *** --------------------------------------------- Google will Zertifikate, die mit SHA-1 signiert sind, bis spätestens 2017 loswerden. Der Chrome-Browser wird bald entsprechende Warnungen anzeigen. SHA-1 gilt schon seit einigen Jahren als potentiell unsicher. --------------------------------------------- http://www.golem.de/news/zertifikate-google-will-vor-sha-1-warnen-1408-1087… *** Multiple Vulnerabilities in various IBM Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_libxml2_vulnerabi… https://www-304.ibm.com/connections/blogs/PSIRT/entry/vulnerability_in_aix_… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/multiple_vulnerabilit… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 19-08-2014
by Daily end-of-shift report 19 Aug '14

19 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-08-2014 18:00 − Dienstag 19-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** New Attack Binds Malware in Parallel to Software Downloads *** --------------------------------------------- Open source software distribution systems that lack security processes and integrity checks are prone to a new attack that binds malware to a download without modifying the original application. --------------------------------------------- http://threatpost.com/new-attack-binds-malware-in-parallel-to-software-down… *** Microsofts Windows 8 App Store Is Full of Scamware *** --------------------------------------------- Deathspawner writes Windows 8 brought a lot to the table, with one of its most major features being its app store. However, its not a feature that Microsoft seems too intent on keeping clean. As it is today, the store is completely littered with misleading apps and outright scamware. The unfortunate thing is that .. --------------------------------------------- http://beta.slashdot.org/story/206067 *** Virenscanner: Testlabor analysiert das fehlende Prozent *** --------------------------------------------- In Labortests erkennen fast alle Virenscanner stets über 99 Prozent der Schädlinge. Doch genau das fehlende Prozent kann den Unterschied machen, wie die Verbreitung der durchgeschlüpften Dateien zeigt. --------------------------------------------- http://www.heise.de/security/meldung/Virenscanner-Testlabor-analysiert-das-… *** Part 2: Is your home network unwittingly contributing to NTP DDOS attacks?, (Sun, Aug 17th) *** --------------------------------------------- This diary follows from Part 1, published on Sunday August 17, 2014. How is it possible that with no port forwarding enabled through the firewall that Internet originated NTP requests were getting past the firewall to the misconfigured NTP server? The reason why these packets are passing .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18549&rss *** Stuxnet: Geschlossene Sicherheitslücke gefährdet noch immer Millionen *** --------------------------------------------- Experten führen die hohen Zahlen auf eine mangelnde Wartung von Servern zurück --------------------------------------------- http://derstandard.at/2000004498863 *** APT Gang Branches Out to Medical Espionage in Community Health Breach *** --------------------------------------------- The Community Health Systems data breach has been tied to a Chinese APT gang that has branched out to medical espionage, stealing patient data in an effort to target intelligence on medical device development. --------------------------------------------- http://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-communi… *** Multipe vulnerabilities in EMC Documentum products *** --------------------------------------------- http://www.securityfocus.com/archive/1/533161 http://www.securityfocus.com/archive/1/533160 http://www.securityfocus.com/archive/1/533159 http://www.securityfocus.com/archive/1/533162 *** DSA-3006 xen *** --------------------------------------------- http://www.debian.org/security/2014/dsa-3006 *** FreeNAS password security bypass *** --------------------------------------------- FreeNAS could allow a remote attacker to bypass security restrictions, caused by the use of a blank password by the Web admin. An attacker could exploit this vulnerability to reset the admin password and gain full administrative access to the device. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95326 *** Apache HttpComponents certificate spoofing *** --------------------------------------------- Apache HttpComponents could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the Subject's Common Name (CN) or SubjectAltName field of certificates. By persuading a victim to visit a Web site containing a .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95327 *** Cisco NX-OS Software SNMP Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the Simple Network Management Protocol (SNMP) module of Cisco NX-OS Software could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to a failure to respond to invalid requests in the same manner when specifying a VLAN ID. An attacker could exploit this vulnerability by making a large number of requests to .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Montag 18-08-2014
by Daily end-of-shift report 18 Aug '14

18 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-08-2014 18:00 − Montag 18-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Microsoft zieht Updates zurück *** --------------------------------------------- Mit insgesamt vier der am letzten Patchday veröffentlichten Updates für Windows gibt es offenbar Probleme. Microsoft hat jetzt reagiert und warnt davor, sie einzuspielen. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-zieht-Updates-zurueck-229417… *** Suspicious Login Message Faked, Distributes Backdoor *** --------------------------------------------- Legitimate services are often used by cybercriminals to try and make their attacks more convincing. Recently, I spotted attacks that used services and platforms like Google Drive and Dropbox in order to look less suspicious to unwary users. I received a spammed message like the one shown right below that supposedly came from Gmail itself. It warned me that someone logged... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/hhVGnlO7Tzs/ *** ZDI-14-295: AlienVault OSSIM av-centerd Util.pm remote_task Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-295/ *** ZDI-14-294: AlienVault OSSIM av-centerd Util.pm get_license Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-294/ *** Siemens OpenSSL Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03A Siemens OpenSSL Vulnerabilities that was published July 23, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens OpenSSL cryptographic software library affecting several Siemens industrial products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03B *** Siemens SIMATIC S7-1500 CPU Denial of Service *** --------------------------------------------- Siemens produced a new firmware version that mitigates a denial of service vulnerability in SIMATIC S7-1500 CPU. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-226-01 *** 7 Places to Check for Signs of a Targeted Attack in Your Network *** --------------------------------------------- Targeted attacks are designed to circumvent existing policies and solutions within the target network, thus making their detection a big challenge. As we've stressed in our previous entry about common misconceptions about targeted attacks, there is no one-size-fits-all solution against it; enterprises need to arm themselves with protection that can provide sensors where needed, as well as IT... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/NhRVtViIRDU/ *** Security: Lücken in Update-Servern gefährden Millionen Router *** --------------------------------------------- Über mehrere Schwachstellen in den Auto Configuration Servern von Providern könnten Angreifer manipulierte Firmware an Millionen Router verteilen. Außerdem gibt es Fehler im dazugehörigen Kommunikationsprotokoll. --------------------------------------------- http://www.golem.de/news/security-luecken-in-update-servern-gefaehrden-mill… *** Internet Explorer: Veraltete ActiveX-Steuerelemente werden später blockiert *** --------------------------------------------- Microsoft verschiebt das Blockieren veralteter Versionen von Java und Co. auf September. Der Grund sind Beschwerden einiger Admins. --------------------------------------------- http://www.heise.de/security/meldung/Internet-Explorer-Veraltete-ActiveX-St… *** Kein Mailversand: Spamhaus listet Web.de, GMX und 1&1 *** --------------------------------------------- Spamhaus hat heute versehentlich die Mailserver von United Internet gelistet. Der Mailversand ist für einige Stunden nicht möglich gewesen. (Spam, E-Mail) --------------------------------------------- http://www.golem.de/news/mailserver-spamhaus-listet-web-de-gmx-und-1-1-1408… *** VB2014 preview: Optimized mal-ops. Hack the ad network like a boss *** --------------------------------------------- Researchers Vadim Kotov and Rahul Kashyap to discuss how advertisements are the new exploit kits.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. In the second of this series, we look at the paper Optimized mal-ops. Hack the ad network like a boss, from Vadim Kotov and Rahul Kashyap, two researchers from Bromium."We conclude that ad networks could be leveraged to aid, or even be --------------------------------------------- http://www.virusbtn.com/blog/2014/08_15.xml?rss *** Ebola fear used as bait, leads to malware infection *** --------------------------------------------- Summary: Ebola news is bait for attackers to steal login credentials and install Trojan.Zbot, W32.Spyrat, and Backdoor.Breut malware. --------------------------------------------- http://www.symantec.com/connect/blogs/ebola-fear-used-bait-leads-malware-in… *** FinFisher & Co. machen harmlose Katzenvideos zur Waffe für Cyber-Attacken *** --------------------------------------------- Ein Forscher hat im Detail beschrieben, wie Angreifer mit Zugriff auf die Netzwerkinfrastruktur eines Internet-Providers Trojaner in den Traffic der Nutzer einschleusen können, ohne dass die Opfer etwas bemerken. --------------------------------------------- http://www.heise.de/security/meldung/FinFisher-Co-machen-harmlose-Katzenvid… *** Part 1: Is your home network unwittingly contributing to NTP DDOS attacks?, (Sun, Aug 17th) *** --------------------------------------------- For the last year or so, I have been investigating UDP DDOS attacks. In this diary I would like to spotlight a somewhat surprising scenario where a manufacturer's misconfiguration on a popular consumer device combined with a design decision in a home gateway router may make you an unwitting accomplice in amplified NTP reflection DDOS attacks. This is part 1 of the story. I will publish the conclusion Tuesday August 19th. Background Today almost every house has consumer broadband services. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18547&rss *** Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability, (Sat, Aug 16th) *** --------------------------------------------- With Windows malware getting so much attention nowadays, its easy to forget that attackers also target other OS platforms. Lets take a look at a recent attempt to install an IRC bot written in Perl by exploiting a vulnerability in PHP. The Initial Probe The web server received the initial probe from 46.41.128.231, an IP address that at the time was not flagged as malicious on various blacklists: HEAD / HTTP/1.0 The connection lacked the headers typically present in an HTTP request, which is why... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18543&rss *** ZeroLocker wont come to your rescue *** --------------------------------------------- In recent times weve been seeing a lot of file-encrypting ransomware activity. One of the new ones weve seen pop up in the last couple weeks is called ZeroLocker. Theres indication the C&C configuration contains some errors which would prevent... --------------------------------------------- https://securelist.com/blog/incidents/66135/zerolocker-wont-come-to-your-re…

1 0

Tageszusammenfassung - Donnerstag 14-08-2014
by Daily end-of-shift report 14 Aug '14

14 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-08-2014 18:00 − Donnerstag 14-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Safari: Apple behebt diverse Sicherheitslücken *** --------------------------------------------- Der Hersteller hat in der Nacht zum Donnerstag seinen hauseigenen Browser für verschiedene Betriebssysteme aktualisiert. Für Entwickler stellte Apple außerdem eine weitere Vorschauversion von OS X 10.9.5 bereit. --------------------------------------------- http://www.heise.de/security/meldung/Safari-Apple-behebt-diverse-Sicherheit… *** Vulnerability in Spotify Android App May Lead to Phishing *** --------------------------------------------- We have discovered a vulnerability that affects versions of the Spotify app for Android older than 1.1.1. If exploited, the vulnerability can allow bad guys to control what is being displayed on the app interface. This vulnerability can be potentially abused by cybercriminals to launch phishing attacks that may result to information loss or theft. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/ZJMVGX3NMwk/ *** Portal: Tor für mobile Router *** --------------------------------------------- Anonymes Surfen mit Tor ist noch sicherer, wenn die Software nicht auf dem eigenen Rechner läuft. Die Software Portal integriert Tor in der Firmware Openwrt und lässt sich so auf ausgewählten mobilen Routern nutzen. --------------------------------------------- http://www.golem.de/news/portal-tor-fuer-mobile-router-1408-108575-rss.html *** Tiny Malware PoC: Malware Without IAT, DATA OR Resource Section *** --------------------------------------------- Have you ever wondered about having an EXE without any entry in IAT (Import Address Table) at all? Well, I knew that its possible, but never saw an actual exe file without IAT entry. So I developed an application which is 1,536 bytes and still does basic annoying malware things. --------------------------------------------- http://www.codeandsec.com/PoC-Tiny-Malware-Without-IAT-DATA-Or-Resource-Sec… *** SAMHAIN v3.1.2 Released *** --------------------------------------------- The Samhain host-based intrusion detection system (HIDS) provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. Samhain been designed to monitor multiple hosts with potentially different operating systems, providingcentralized logging and maintenance, although it can also be used as standalone application on a single host. --------------------------------------------- http://www.toolswatch.org/2014/08/samhain-v3-1-2-released/ *** ZeroLocker *** --------------------------------------------- Recently in the news we saw FireEye and Fox-IT provide the ability to decrypt files encrypted by older crpytolocker variants. They used the command and control servers seized by the FBI during operation Tovar. Since they have access to those RSA keys they essentially have the password required for every single file encrypted by a Cryptolocker variant that used Evgeniy Bogachev's botnet. --------------------------------------------- http://www.webroot.com/blog/2014/08/14/zero-locker/ *** JSA10643 - 2014-08 Security Bulletin: Juniper Secure Analytics (JSA)/Security Threat Response Manager (STRM): Multiple vulnerabilities resolved by third party software upgrades. *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10643&actp=RSS *** JSA10642 - 2014-08 Security Bulletin: Network and Security Manager NSM: Multiple vulnerabilities *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10642&actp=RSS *** Disqus 2.7.5 Cross Site Request Forgery / Cross Site Scripting *** --------------------------------------------- Topic: Disqus 2.7.5 Cross Site Request Forgery / Cross Site Scripting Risk: Medium Text:<!-- Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5 Blog post explainer: https://www.nikcub.com/posts/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080064 *** Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Information *** --------------------------------------------- http://www.securitytracker.com/id/1030732 *** SSA-310688 (Last Update 2014-08-14): Denial-of-Service Vulnerability in SIMATIC S7-1500 CPU *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-234763 (Last Update 2014-08-14): OpenSSL Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… Next End-of-Shift report on 2014-08-18

1 0

Tageszusammenfassung - Mittwoch 13-08-2014
by Daily end-of-shift report 13 Aug '14

13 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-08-2014 18:00 − Mittwoch 13-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** (Updated 2014/8/13) Syria offline - initial analysis of BGP (and explanation) *** --------------------------------------------- This blog post evolved over time - initially it was a mere scratchpad for notes during our initial research between 2012/11/29 and 11/30. Later, after Syria was back online again, I added a summary and some potential explanations of what might have happened at the end of this blog post. UPDATE 2014/8/13: It seems it was the NSA that hacked a router, according to Snowden. Scroll to the end for links. --------------------------------------------- http://www.cert.at/services/blog/20121129184048-616.html *** MS14-AUG - Microsoft Security Bulletin Summary for August 2014 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for August 2014. With the release of the security bulletins for August 2014, this bulletin summary replaces the bulletin advance notification originally issued August 7, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-AUG *** Assessing risk for the August 2014 security updates *** --------------------------------------------- Today we released nine security bulletins addressing 40 unique CVEs. Two bulletins have a maximum severity rating of Critical while the other seven have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max exploit-ability Likely first 30 days impact Platform mitigations and key notes MS14-051 (Internet Explorer) Victim browses --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/08/12/assessing-risk-for-the-au… *** Microsoft-Patchday: 26 Lücken im Internet Explorer gestopft *** --------------------------------------------- Wie am zweiten Dienstag im Monat üblich, hat Microsoft eine Reihe von Sicherheitslücken im Internet Explorer, in Windows und in anderen Produkten geschlossen. Für den IE gibt es 26 einzelne Patches, eine Lücke wird bereits von Angreifern aktiv genutzt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Microsoft-Patchday-26-Luecken-im-Int… *** Cisco Unified Communications Manager and Cisco Unified Presence Server SQL Injection Vulnerability *** --------------------------------------------- CVE-2014-3339 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Study: Firmware Plagued By Poor Encryption and Backdoors *** --------------------------------------------- itwbennett writes: The first large-scale analysis of firmware has revealed poor security practices that could present opportunities for hackers probing the Internet of Things. Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin. In one instance, the researchers found a Linux kernel that was 10... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-X--LranmlI/story01.htm *** Fifteen zero days found in hacker router comp romp *** --------------------------------------------- Four routers rooted in SOHOpelessly Broken challenge DEF CON Researchers have unveiled 15 zero day vulnerabilities in four home and small business routers as part of the SOHOpelessly Broken hacker competition in DEF CON this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/13/fifteen_zer… *** Black Hat USA 2014 talk about hypervisor security *** --------------------------------------------- This week I presented at Black Hat USA. The talk is titled "Poacher turned gatekeeper: lessons learned from eight years of breaking hypervisors". The main points were: Describe the attack surface of Type 1 and Type 2 hypervisors Show that despite not being 100% bulletproof, hypervisors are still the best usable way to isolate potentially... --------------------------------------------- http://labs.bromium.com/2014/08/11/black-hat-usa-2014-talk-about-hypervisor… *** Wireless Auditing, Intrusion Detection & Prevention System *** --------------------------------------------- WAIDPS is an open source wireless swissknife written in Python and work on Linux environment. This is a multipurpose tools designed for audit (penetration testing) networks, detect wireless intrusion (WEP/WPA/WPS attacks) and also intrusion prevention (stopping station from associating to access point). --------------------------------------------- http://www.ehacking.net/2014/08/wireless-auditing-intrusion-detection.html *** SSA-635659 (Last Update 2014-08-14): Heartbleed Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Gefälschtes Tor-Browser-Bundle mit Trojaner *** --------------------------------------------- Eine täuschend echte Kopie der Seite torproject.org verteilt einen Trojaner. Der Student Julien Voisin hat ihn zerlegt - und konnte Kontakt zu den Verantwortlichen herstellen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Gefaelschtes-Tor-Browser-Bundle-mit-… *** Ältere Versionen von Disqus für WordPress angreifbar *** --------------------------------------------- Ein Sicherheitsforscher hat Sicherheitslücken im beliebten Disqus-Plug-in für WordPress entdeckt. Administratoren sollten sicherstellen, dass die entsprechenden Updates installiert sind. --------------------------------------------- http://www.heise.de/security/meldung/Aeltere-Versionen-von-Disqus-fuer-Word… *** New Metasploit 4.10: Credentials Are the New Exploits *** --------------------------------------------- We’ve given credentials a new boost with Metasploit 4.10. It’s now easier to manage, reuse and report on credentials as part of a penetration test. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/08/13/credentia…

1 0

Tageszusammenfassung - Dienstag 12-08-2014
by Daily end-of-shift report 12 Aug '14

12 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-08-2014 18:00 − Dienstag 12-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB14-18: Security updates available for Adobe Flash Player http://helpx.adobe.com/security/products/flash-player/apsb14-18.html APSB14-19: Security updates available for Adobe Reader and Acrobat http://helpx.adobe.com/security/products/reader/apsb14-19.html Customers of the affected products should consult the relevant Security Bulletin(s) for details. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1118 *** Cisco Unified Communications Manager SIP Subsystem Vulnerability *** --------------------------------------------- CVE-2014-3337 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Manager CTIManager Vulnerability *** --------------------------------------------- CVE-2014-3338 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Two new Gameover Zeus variants in the wild *** --------------------------------------------- About two months after botnet takedown efforts, new versions of the malware have surfaced in the U.S. and abroad. --------------------------------------------- http://www.scmagazine.com/two-new-gameover-zeus-variants-in-the-wild/articl… *** Millions of PCs Affected by Mysterious Computrace Backdoor *** --------------------------------------------- Absolute Softwares anti-theft Computrace software is mysteriously installed on brand new machines, nearly impossible to remove, and exploitable. --------------------------------------------- http://threatpost.com/millions-of-pcs-affected-by-mysterious-computrace-bac… *** NIST wants better SCADA security *** --------------------------------------------- Preparing the way for a test lab Americas National Institute of Standards and Technology (NIST) wants to take a hand in addressing the SCADA industry's chronic insecurity, by building a test bed for industrial control systems. --------------------------------------------- http://www.theregister.co.uk/2014/08/12/nist_wants_better_scada_security/ *** Command Injection allows Unauthenticated Command Bypass on multiple D-Link products *** --------------------------------------------- The DNS-315L DNS-320L, DNS-327L, DNS-340L, and DNS-345 have been identifed as having a vulnerability in their Web-GUI application that allows malicious users to gain access to the device configuraiton, device operating system, and stored file without requiring log-in credentials. --------------------------------------------- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10042 *** 2Q 2014 Security Roundup: Turning the Tables on Cyber Attacks *** --------------------------------------------- The incidents that cropped up in the months of April to June 2014 - from the data breaches, DDoS attacks, to malware improvements and threats to privacy - highlighted the need for enterprises to craft a more strategic response against and in anticipation of security threats. There were plenty of threats to be found in the quarter. There was... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Cf4i9ouVNiM/ *** How to hack a Macbook using just USB *** --------------------------------------------- Yesterday, at the 2014 DEF CON hackers conference in Las Vegas, security researchers Joe Fitzpatrick and Miles Crabil demonstrated how they could directly access the memory of Apple Macbook devices using a piece of hardware they built to plug into the computer's own USB slot. --------------------------------------------- http://www.techly.com.au/2014/08/12/hack-macbook-using-just-usb/ *** BlackBerry Z10 erlaubte freien Zugriff über das WLAN *** --------------------------------------------- Sicherheitsforscher haben eine Lücke öffentlich gemacht, die es einem Angreifer erlaubte, auf Daten auf dem BlackBerry Z10 zuzugreifen. Der eingebaute File-Server erlaubte Zugriff auf den Telefonspeicher, ohne nach einem Passwort zu fragen. --------------------------------------------- http://www.heise.de/security/meldung/BlackBerry-Z10-erlaubte-freien-Zugriff…

1 0

Tageszusammenfassung - Montag 11-08-2014
by Daily end-of-shift report 11 Aug '14

11 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-08-2014 18:00 − Montag 11-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco Unity Connection SQL Injection Vulnerability *** --------------------------------------------- CVE-2014-3336 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Splunk Bugs Permit Remote Cross-Site Scripting and Remote Authenticated Directory Traversal Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030690 *** Incident Response with Triage-ir, (Sun, Aug 10th) *** --------------------------------------------- In many cases having a full disk image is not an option during an incident. Imagine that you are suspecting that you have dozen of infected or compromised system. Can you spend 2-3 hours to make a forensic copy of hard disks hundred computers? In such situation fast forensics is the solution for such situation. Instead of copying everything collecting some files that may contain an evidence can solve this issue. In this diary I am going to talk about an application that will collect most of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18509&rss *** Verifying preferred SSL/TLS ciphers with Nmap, (Mon, Aug 11th) *** --------------------------------------------- In last year or two, there has been a lot of talk regarding correct usage of SSL/TLS ciphers on web servers. Due to various incidents more or less known incidents, web sites today should use PFS (Perfect Forward Secrecy), a mechanism that is used when an SSL/TLS connection is established and symmetric keys exchanged. PFS ensures that, in case an attacker obtains the server's private key, he cannot decrypt previous SSL/TLS connections to that server. If PFS is not used (if RSA is used to --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18513&rss *** WordHound erzeugt maßgeschneiderte Wörterbücher für Passwort-Knacker *** --------------------------------------------- Wörterbuch-Attacken auf Passwort-Hashes dauern lange und sind nicht immer erfolgreich. Schneidet man die durchzuprobierenden Passwörter aber auf das Ziel zurecht, sind selbst vergleichbar komplizierte Kennwörter unter Umständen nicht mehr sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/WordHound-erzeugt-massgeschneiderte-… *** You cannot cyberhijack an airplane, but you can create mischief *** --------------------------------------------- Hacking a plane and taking control of the aircraft is a considerably scary prospect, but two speakers at DefCon 22 in Las Vegas quashed the notion and put worries to rest. --------------------------------------------- http://www.scmagazine.com/defcon-you-cannot-cyberhijack-an-airplane-but-you… *** Cybercrime Report: Soziale Netzwerke zunehmend betroffen *** --------------------------------------------- 2013 wurden in Österreich 11.199 Fälle von Cybercrime angezeigt. Als Motive sieht das Bundeskriminalamt finanzielle Interessen, Langeweile und Hacktivism. [...] Neue Technologien werden in Zukunft weiterhin neue Erscheinungsformen von Cyberkriminalität begünstigen, heißt es im Report. Genannt wurde der Einsatz von "NFC" (Near Field Communication) zur Durchführung kontaktloser Zahlungsvorgänge, aber auch Verkehrsmittel, die mit der Möglichkeit zur Netzwerk-Kommunikation ausgestattet werden, wie zum Beispiel Smart-Vehicles und Drohnen, warnt der Bericht abschließend. --------------------------------------------- http://futurezone.at/netzpolitik/cybercrime-report-soziale-netzwerke-zunehm…

1 0

Tageszusammenfassung - Freitag 8-08-2014
by Daily end-of-shift report 08 Aug '14

08 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-08-2014 18:00 − Freitag 08-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Massives Datenleck *** --------------------------------------------- Massives Datenleck | 6. August 2014Diverse Medien berichten, dass eine kriminelle Gruppe aus Russland eine gigantische Zahl an Zugangsdaten erbeutet hat. Siehe u.a.: New York Times, Slate, WSJ, DerStandard, Futurezone, Heise, ... | Woher die Credentials wirklich stammen (die Geschichte mit dem Botnet und SQL-Injection klingt ein bisschen nach einem Bericht aus 2013), ist auch nicht restlos geklärt: In anderen Fällen war das eine Mischung aus diversen Kampagnen, sowohl Einbrüchen in... --------------------------------------------- http://www.cert.at/services/blog/20140806143111-1213.html *** Black Hat USA Talks: Investigating PowerShell Attacks *** --------------------------------------------- Threat actors are always eager to adopt new tools, tactics, and procedures that can help them evade detection and conduct their mission. Incident responders from Mandiant have observed increasing use of PowerShell by targeted attackers to conduct command-and-control in compromised... --------------------------------------------- http://www.fireeye.com/blog/technical/2014/08/black-hat-usa-talks-investiga… *** IETF will selbst elliptische Kurven standardisieren *** --------------------------------------------- Künftig will die IETF nicht mehr nur einfach die von der NIST empfohlenen Krypto-Standards übernehmen, sondern eigene schaffen. Die NIST hingegen versucht weiterhin, ihr ramponiertes Image als unabhängige Instanz zu retten. --------------------------------------------- http://www.heise.de/security/meldung/IETF-will-selbst-elliptische-Kurven-st… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server July 2014 CPU *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244, Affected product(s) and affected version(s): IBM Java SDK shipped with IBM WebSphere Application Server Version 8.5.0.0 through 8.5.5.2, Version 8.0.0.0 through 8.0.0.9, Version 7.0.0.0 through 7.0.0.33, Version 6.1.0.0 through 6.1.0.47 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Checking for vulnerabilities in the Smart Grid System, (Thu, Aug 7th) *** --------------------------------------------- SCADA systems are not composed the same way as regular IT systems. Therefore, the risk and vulnerability assessment cannot be performed as it is done for any other IT system. The most important differences are: SCADA Pentesting should not be done in production environment: SCADA devices are very fragile and some activities that could pose harmless to regular IT environments could be catastrophic to the process availability. Think of massive blackouts or no water supply for a city. SCADA --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18499&rss *** Wordpress: Defektes Plugin erlaubt Admin-Zugriff *** --------------------------------------------- Das Wordpress-Plugin Custom Contacts Form hat einen Fehler, der es Angreifern erlaubt, administrative Rechte über eine Webseite zu erhalten. Es gibt bereits einen Patch. --------------------------------------------- http://www.golem.de/news/wordpress-defektes-plugin-erlaubt-admin-zugriff-14… *** Analyzing the Fake ID Android vulnerability *** --------------------------------------------- In this video shot at Black Hat 2014 in Las Vegas, Jeff Forristal of Bluebox Security sits with Danielle Walker, reporter at SC Magazine, to discuss the Fake ID Android vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Tp9gYIOHaFg/ *** Black Hat 2014: 75 Prozent aller mobilen Kassensysteme verwundbar *** --------------------------------------------- Knapp drei viertel aller gängigen mobilen Terminals zum Auslesen von Kreditkarten basieren auf der selben Hard- und Software. Forscher haben demonstriert, wie sie die Geräte unter Kontrolle bringen und so dem Kartenmissbrauch Tür und Tor öffnen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Black-Hat-2014-75-Prozent-aller-mobi… *** Patchday: Microsoft behebt kritische Lücken in Windows und IE *** --------------------------------------------- Am kommenden Patchday veröffentlicht Microsoft insgesammt neun Sicherheitsupdates, davon sind zwei als "kritisch" und sieben weitere als "wichtig" markiert. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-behebt-kritische-… *** Microsoft: Keine Updates mehr für ältere Internet Explorer *** --------------------------------------------- Ab Anfang 2016 will Microsoft ältere Internet-Explorer-Versionen nicht mehr unterstützen. Bis dahin sollten Windows-Nutzer den Webbrowser aktualisieren, um weiterhin Updates zu erhalten. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-Keine-Updates-mehr-fuer-aelt… *** How to Use Your Cat to Hack Your Neighbor's Wi-Fi *** --------------------------------------------- Late last month, a Siamese cat named Coco went wandering in his suburban Washington, DC neighborhood. He spent three hours exploring nearby backyards. He killed a mouse, whose carcass he thoughtfully brought home to his octogenarian owner, Nancy. And while he was out, Coco mapped dozens of his neighbors' Wi-Fi networks, identifying four routers that used... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/3d4f7cee/sc/10/l/0L0Swired0N0C20A… *** HPSBHF03084 rev.1 HP PCs with UEFI Firmware, Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilies have been identified with certain HP PCs with UEFI Firmware. The vulnerabilities could be exploited to allow execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03087 SSRT101413 rev.1 - HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX CIFS-Server (Samba). The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Neues Sysinternals-Tool hilft bei der Malware-Suche *** --------------------------------------------- Mit dem Programm Sysmon ist die beliebte Werkzeugsammlung von Microsoft Sysinternals um ein neues Tool zum Aufspüren verdächtiger Aktivitäten auf Windows-Rechnern gewachsen. --------------------------------------------- http://www.heise.de/security/meldung/Neues-Sysinternals-Tool-hilft-bei-der-…

1 0

Tageszusammenfassung - Donnerstag 7-08-2014
by Daily end-of-shift report 07 Aug '14

07 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-08-2014 18:00 − Donnerstag 07-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco IOS Software and Cisco IOS XE Software EnergyWise Crafted Packet Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20140806-energywise --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Security expert calls home routers a clear and present danger *** --------------------------------------------- In Black Hat Q&A, In-Q-Tel CISO says home routers are "critical infrastructure." --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/iXnyWy8k6JU/ *** Black Hat 2014: Netzbetreiber-Software zum Fernsteuern von Mobilgeräten erlaubt Missbrauch *** --------------------------------------------- Auf zwei Milliarden Mobilfunkgeräten läuft eine verwundbare Software, die Netzbetreibern zum Kontrollieren der Geräte dient. Mit geringem Aufwand können Angreifer die Geräte unbemerkt aus der Ferne manipulieren und so beispielsweise Datenverkehr mitschneiden. --------------------------------------------- http://www.heise.de/security/meldung/Black-Hat-2014-Netzbetreiber-Software-… *** Internet Explorer begins blocking out-of-date ActiveX controls *** --------------------------------------------- As part of our ongoing commitment to delivering a more secure browser, starting August 12th Internet Explorer will block out-of-date ActiveX controls. ActiveX controls are small apps that let Web sites provide content, like videos and games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-bloc… *** Cisco 2014 Midyear Security Report: Exposing Weak Links to Strengthen the Security Chain *** --------------------------------------------- You may be thinking, "What could have possibly changed since January?" True to form, the attacker community continues to evolve, innovate, and think up new ways to discover and exploit weak links in the security chain. Also true to form, they sometimes simply use tried and true methods to exploit some of the same old vulnerabilities that continue to present themselves. --------------------------------------------- https://blogs.cisco.com/security/cisco-2014-midyear-security-report-exposin… *** Securing VoIP systems *** --------------------------------------------- Countermeasures for these security issues are given below in greater detail: - Encryption - Firewalls - Traffic Analysis - Improved network Security - Authentication mechanisms - Apply appropriate patches - Turn off unnecessary protocols... --------------------------------------------- http://resources.infosecinstitute.com/securing-voip-systems/ *** Jetzt updaten: Ältere Synology NAS-Geräte anfällig für Ransomware *** --------------------------------------------- Der NAS-Hersteller Synology hat Details zu der Lücke bekannt gegeben, die der Erpressungs-Trojaner SynoLocker ausnutzt, um die Daten seiner Opfer zu verschlüsseln. Nach Informationen des Herstellers betrifft das Sicherheitsproblem nur ältere Firmware-Versionen und wurde im Dezember 2013 behoben. Die DiskStation-Manager-Software (DSM) Version 4.3-3810 oder älter soll betroffen sein, ein Update auf DSM 5.0 soll Abhilfe schaffen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Jetzt-updaten-Aeltere-Synology-NAS-G… *** OpenSSL-Updates - diesmal nicht ganz so schlimm *** --------------------------------------------- Die OpenSSL-Entwickler beseitigen neun Sicherheitslücken, die meisten von Google-Forschern entdeckt. Allerdings ist diesmal nichts wirklich dramatisches dabei. --------------------------------------------- http://www.heise.de/newsticker/meldung/OpenSSL-Updates-diesmal-nicht-ganz-s… *** Hintergrund: Politische Lösungen für eine sichere Zukunft der Kommunikation *** --------------------------------------------- Nach den Snowden-Enthüllungen steht eine Diskussion an, was wir zukünftig besser machen können, um Spionage und großflächige Massenüberwachung zu verhindern. Neben der besserer Technik braucht es da auch neue politische Ansätze, meint Linus Neumann. --------------------------------------------- http://www.heise.de/security/artikel/Politische-Loesungen-fuer-eine-sichere… *** Security Notice-Statement on 9 OpenSSL Vulnerabilities *** --------------------------------------------- Aug 07, 2014 20:29 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 6-08-2014
by Daily end-of-shift report 06 Aug '14

06 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-08-2014 18:00 − Mittwoch 06-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Another Bypass Identified in PayPal 2FA *** --------------------------------------------- A security researcher has uncovered a simple method for bypassing the two-factor authentication mechanism that PayPal uses to protect accounts that are tied to eBay accounts. The vulnerability is related to the way that the login flow works when a user is prompted to connect her eBay account to her PayPal account. The eBay and... --------------------------------------------- http://threatpost.com/another-bypass-identified-in-paypal-2fa/107605 *** Mozilla zukünftig mit zentralen Sperrlisten *** --------------------------------------------- Sichere Internet-Verbindungen erfordern Mechanismen, kompromittierte Zertifikate als ungültig zu erklären. Die aktuellen Verfahren dazu funktionieren jedoch nicht. Zukünftig soll das bei Firefox und Co die OneCRL richten. --------------------------------------------- http://www.heise.de/security/meldung/Mozilla-zukuenftig-mit-zentralen-Sperr… *** Researchers release CryptoLocker decryption tool *** --------------------------------------------- Tool uses private keys found in database of victims.The CryptoLocker ransomware is one of the nastiest pieces of malware to have targeted Internet users in recent years. The malware uses strong file encryption (more particularly, AES encryption with a key that has been encrypted using an RSA-2048 private key) to deny the user access to their files unless they pay a ransom of around US$300. At a time when we often seem to be learning about accidental or intentional vulnerabilities in encryption,... --------------------------------------------- http://www.virusbtn.com/blog/2014/08_06.xml?rss *** CipherShed *** --------------------------------------------- CipherShed is free (as in free-of-charge and free-speech) encryption software for keeping your data secure and private. It started as a fork of the now-discontinued TrueCrypt Project. --------------------------------------------- http://n0where.net/ciphershed/ *** Web-Fu - Chrome extension for pentesting web applications *** --------------------------------------------- Chrome extension for pentesting web applications. Web-fu Is a web hacking tool focused on discovering and exploiting web vulnerabilitites. --------------------------------------------- http://hack-tools.blackploit.com/2014/08/web-fu-chrome-extension-for-pentes…

1 0

Tageszusammenfassung - Dienstag 5-08-2014
by Daily end-of-shift report 05 Aug '14

05 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-08-2014 18:00 − Dienstag 05-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Synology - erste Informationen bezüglich "Synolocker" *** --------------------------------------------- Special Notes SynoLocker Message Issue - If NAS is not infected: First, close all open ports for external access for now. Backup the data on the DiskStation and update DSM to the latest version. Synology will provide further information as soon as possible if you are vulnerable. If NAS is infected, first do not trust (and ignore) any unauthorized, non-Synology messages or emails. Hard shut down the DiskStation to prevent any further issues. --------------------------------------------- https://myds.synology.com/support/support_form.php?lang=us *** Synolocker: Why OFFLINE Backups are important, (Tue, Aug 5th) *** --------------------------------------------- One current threat causing a lot of sleepless nights to victims is "Cryptolocker" like malware. Various variations of this type of malware are still haunting small businesses and home users by encrypting files and asking for ransom to obtain the decryption key. Your best defense against this type of malware is a good backup. Shadow volume copies may help, but arent always available and complete. In particular for small businesses, various simple NAS systems have become popular over --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18481&rss *** Ubuntu-Sperrbildschirm verliert Tastatureingaben *** --------------------------------------------- Eine jetzt geschlossene Sicherheitslücke im Sperrbildschirm der Linux-Distribution Ubuntu könnte zur Folge haben, dass Nutzer ihr Passwort aus Versehen öffentlich im Internet bekanntgeben. --------------------------------------------- http://www.heise.de/newsticker/meldung/Ubuntu-Sperrbildschirm-verliert-Tast… *** Barracuda Web Application Firewall Reusable URL-Based Authentication Tokens Let Remote Users Bypass Authentication *** --------------------------------------------- http://www.securitytracker.com/id/1030665 *** Evernote Patches Vulnerability in Android App *** --------------------------------------------- We have previously discussed an Android vulnerability that may lead to user data being captured or used to launch attacks. We discovered that the popular Android app for Evernote contained the said vulnerability. We disclosed the details to Evernote, and they took action by issuing an update to the Android version of their app. Evernote has added additional... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/BBLQmuk3RrQ/ *** Symantec Endpoint Protection Local Client Application Device Control Buffer Overflow *** --------------------------------------------- Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSEP Local Client ADC Buffer Overflow- Medium6.... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Bugtraq: SEC Consult SA-20140805-0 :: Multiple vulnerabilities in Readsoft Invoice Processing and Process Director *** --------------------------------------------- http://www.securityfocus.com/archive/1/533024 *** A Peek Into the Lions Den - The Magnitude [aka PopAds] Exploit Kit *** --------------------------------------------- Recently we managed to have an unusual peek into the content that is used on the servers of the prevalent exploit kit, Magnitude. In this blog post we'll review its most up-to-date administration panel and capabilities, as well as review some infection statistics provided by Magnitude over the course of several weeks. These days, after the arrest of Paunch, Blackhole exploit kit creator, exploit kit developers and sellers have learned their lesson regarding doing business in the --------------------------------------------- http://blog.spiderlabs.com/2014/08/a-peek-into-the-lions-den-the-magnitude-… *** Vulnerability in Spotify Android App May Lead to Phishing *** --------------------------------------------- We have discovered a vulnerability that affects versions of the Spotify app for Android older than 1.1.1. If exploited, the vulnerability can allow bad guys to control what is being displayed on the app interface. This vulnerability can be potentially abused by cybercriminals to launch phishing attacks that may result to information loss or theft. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/GZKakDZwRhw/

1 0

Tageszusammenfassung - Montag 4-08-2014
by Daily end-of-shift report 04 Aug '14

04 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 01-08-2014 18:00 − Montag 04-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** ZDI-14-273: AlienVault OSSIM av-centerd Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-273/ *** Remote code execution on Android devices *** --------------------------------------------- You walk into a coffee shop and take a seat. While waiting for your coffee, you take out your smartphone and start playing a game you downloaded the other day. Later, you go to work and check your email in the elevator. Without you knowing, an attacker has just gained a foothold in your corporate... --------------------------------------------- http://labs.bromium.com/2014/07/31/remote-code-execution-on-android-devices/ *** POWELIKS: Malware Hides In Windows Registry *** --------------------------------------------- We spotted a malware that hides all its malicious codes in the Windows Registry. The said tactic provides evasion and stealth mechanisms to the malware, which Trend Micro detects as TROJ_POWELIKS.A. When executed, TROJ_POWELIKS.A downloads files, which can cause further system infection. Systems affected by this malware risk being infected by other malware, thus causing further... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OEAKGdXwSnc/ *** All Samba 4.x.x are vulnerable to a remote code execution vulnerability in the nmbd NetBIOS name services daemon, (Sat, Aug 2nd) *** --------------------------------------------- A remote code execution in nmbd (the NetBIOS name services daemon) has been found in Samba versions 4.0.0 to 4.1.10. ( assgined CVE-2014-3560) and a patch has been release by the team at samba.org. Heres the details from http://www.samba.org/samba/security/CVE-2014-3560 =========== Description =========== All current versions of Samba 4.x.x are vulnerable to a remote code execution vulnerability in the nmbd NetBIOS name services daemon. A malicious browser can send packets that may overwrite --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18471&rss *** TP-Link TL-WR740N v4 arbitrary shell command execution *** --------------------------------------------- Topic: TP-Link TL-WR740N v4 arbitrary shell command execution Risk: High Text:# Exploit Title: TP-Link TL-WR740N v4 router (FW-Ver. 3.16.6 Build 130529 Rel.47286n) arbitrary shell command execution # Dat... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080013 *** Verschlüsselungstrojaner attackiert Synology-Speichersysteme *** --------------------------------------------- Cyber-Erpresser haben einen neuen, direkten Weg gefunden, um das digitale Hab und Gut ihrer Opfer als Geisel zu nehmen: Sie nutzen eine Sicherheitslücke in der NAS-Firmware, um den gesamten Netzwerkspeicher zu verschlüsseln. --------------------------------------------- http://www.heise.de/newsticker/meldung/Verschluesselungstrojaner-attackiert… *** China boots Kaspersky and Symantec off security contractor list *** --------------------------------------------- Foreign firms dropped from roll of approved infosec vendors Kaspersky Labs and Symantec have both been booted off China's list of approved security vendors for government agencies, as the country continues to tighten up against foreign tech firms in the wake of the NSA indiscriminate surveillance revelations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/04/kaspersky_s… *** Bugtraq: ownCloud Unencrypted Private Key Exposure *** --------------------------------------------- http://www.securityfocus.com/archive/1/533010 *** Backdoor Techniques in Targeted Attacks *** --------------------------------------------- Backdoors are an essential part of targeted attacks, as they allow an external threat actor to exercise control over any compromised machines. These allow the threat actor to collect information and move laterally within the targeted organization. Our investigations into various targeted attacks have showed that a wide variety of tactics are used by backdoors to carry out... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fHW4IPov8YE/ *** IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM WebSphere Real Time *** --------------------------------------------- Java SE issues disclosed in the Oracle July 2014 Critical Patch Update, plus 1 additional vulnerability CVE(s): CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4209, CVE-2014-4220, CVE-2014-4268, CVE-2014-4218, CVE-2014-4252, CVE-2014-4266, CVE-2014-4265, CVE-2014-4221, CVE-2014-4263, CVE-2014-4244 and CVE-2014-4208 Affected product(s) and affected version(s): IBM WebSphere Real Time Version 3 Service Refresh 7 and earlier Refer to the following reference URLs for --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Security vulnerabilities in Apache Tomcat in Rational DOORS Web Access *** --------------------------------------------- The Apache Tomcat application server in installations of IBM Rational DOORS Web Access version contains security vulnerabilities. CVE(s): CVE-2013-4322, CVE-2013-4590, CVE-2014-0096, CVE-2014-0099 and CVE-2014-0119 Affected product(s) and affected version(s): Rational DOORS Web Access version 9.6.0.x, 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.4 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 1-08-2014
by Daily end-of-shift report 01 Aug '14

01 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 31-07-2014 18:00 − Freitag 01-08-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Russian ransomware author takes the easy route *** --------------------------------------------- Symantec Security Response has observed a new variant of ransomcrypt malware which is easy to update and uses open source components to encrypt files. The variant, detected as Trojan.Ransomcrypt.L, uses a legitimate open source implementation of the OpenPGP standard to encrypt files on the victim’s computer. The threat then displays a ransom notice in Russian, asking the user to pay in order to unlock the files. --------------------------------------------- http://www.symantec.com/connect/blogs/russian-ransomware-author-takes-easy-… *** Announcing EMET 5.0 *** --------------------------------------------- Today, we are excited to announce the general availability of the Enhanced Mitigation Experience Toolkit (EMET) 5.0. As many of you already know, EMET is a free tool, designed to help customers with their defense in depth strategies against cyberattacks, by helping detect and block exploitation techniques .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/07/31/announcing-emet-v5.aspx *** Backoff - Technical Analysis *** --------------------------------------------- As discussed in the an advisory published by US-CERT, Trustwave SpiderLabs has discovered a previously unidentified family of Point of Sale (PoS) malware. This blog post serves as a technical analysis of the Backoff malware family. While a number .. --------------------------------------------- http://blog.spiderlabs.com/2014/07/backoff-technical-analysis.html *** BadUSB: Wenn USB-Geräte böse werden *** --------------------------------------------- Wer die Firmware eines USB-Sticks kontrolliert, kann den zu einem perfekten Trojaner umfunktionieren. Deutsche Forscher zeigen, dass das komplett via Software möglich ist und sich damit ganz neue Infektions-Szenarien eröffnen. --------------------------------------------- http://www.heise.de/security/meldung/BadUSB-Wenn-USB-Geraete-boese-werden-2… *** Backups - The Forgotten Website Security Pillar *** --------------------------------------------- I travel a lot (a lot might actually be an understatement these days), but the travel always revolves around a couple common threads - namely website security education and awareness. In these travels, regardless of the community I am engaging with, there are always common questions .. --------------------------------------------- http://blog.sucuri.net/2014/07/backups-the-forgotten-website-security-pilla… *** The Severe Flaw Found in Certain File Locker Apps *** --------------------------------------------- Protecting data has always been one of the most important aspects of our digital life. Given the amount of activity done on smartphones, this is especially rings true for smartphones. While users may use the built-in privacy and security settings of their devices, others take it a step further and employ security .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-severe-flaw-… *** MediaWiki Input Validation Flaws Permit Cross-Site Scripting and Clickjacking Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030660 *** Offensive Security reports of Symantec Endpoint Protection zero-day vulnerability (July 2014) *** --------------------------------------------- This Knowledge Base article will be updated as further information becomes available. Please subscribe to this document to receive update notifications automatically. To mitigate this issue while research is underway and solutions are being identified, uninstall or disable the sysplant driver. --------------------------------------------- http://www.symantec.com/business/support/index?page=content&id=TECH223338 *** Backdoor.Gates: Also Works for Windows *** --------------------------------------------- We have received reports about a Linux malware known as Backdoor.Gates. Analysis showed that this malware has the following features .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002728.html *** SubSTATION Server Telegyr 8979 Master Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for a Buffer Overflow Vulnerability in the SUBNET Solutions Inc (SUBNET), SubSTATION Server 2, Telegyr 8979 Master .. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-196-01 *** Yes, Hackers Could Build an iPhone Botnet - Thanks to Windows *** --------------------------------------------- A reminder to Apple and smug iPhone owners: Just because iOS has never been the victim of a widespread malware outbreak doesn't mean mass iPhone hacking isn't still possible. Now one group of security researchers plans .. --------------------------------------------- http://www.wired.com/2014/08/yes-hackers-could-build-an-iphone-botnetthanks… *** Citadel Malware Variant Allows Attackers Remote Access, Even After Removal *** --------------------------------------------- A new variant of the Citadel banking Trojan has been discovered where the attackers are using Windows remote shell commands to be enable Remote Desktop Protocol access, even if the malware is discovered and removed. --------------------------------------------- http://threatpost.com/citadel-malware-variant-allows-attackers-remote-acces…

1 0

Tageszusammenfassung - Donnerstag 31-07-2014
by Daily end-of-shift report 31 Jul '14

31 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-07-2014 18:00 − Donnerstag 31-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Innominate mGuard Unauthorized Leakage of System Data *** --------------------------------------------- Exploitation of this vulnerability could allow a remote unauthenticated user access to release configuration information. While this is a minor vulnerability, it represents a method for further network reconnaissance. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-189-02 *** How safe is your quantified self? Tracking, monitoring, and wearable tech *** --------------------------------------------- Self-tracking enthusiasts are generating a torrent of personal information through apps and devices. Is this data safe from prying eyes? --------------------------------------------- http://www.symantec.com/connect/blogs/how-safe-your-quantified-self-trackin… *** Why the Security of USB Is Fundamentally Broken *** --------------------------------------------- Computer users pass around USB sticks like silicon business cards. Although we know they often carry malware infections, we depend on antivirus scans and the occasional reformatting to keep our thumbdrives from becoming the carrier for the .. --------------------------------------------- http://www.wired.com/2014/07/usb-security/ *** TA14-212A: Backoff Point-of-Sale Malware *** --------------------------------------------- “Backoff” is a family of PoS malware and has been discovered recently. The malware family has been witnessed on at least three separate forensic investigations. Researchers have identified three primary variants to the “Backoff” malware including .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-212A *** Takedowns: Touchdown or Turnover? *** --------------------------------------------- Over the last several months malware takedowns have made headlines. But what is really involved in such an operation? The recent takedowns have been a collaborative effort mostly between the private sector and government entities, with academic researchers also playing a role. While some operations included arrests, and others included a civil lawsuit, .. --------------------------------------------- http://www.seculert.com/blog/2014/07/takedowns-touchdown-or-turnover.html *** 3 security mistakes small companies make and how to avoid them *** --------------------------------------------- Dedicated IT staff are a luxury most very small businesses do without but those organisations still need to find a way to secure their computers against cyber ciminals who arent looking to cut them a break just because they're small. --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/31/3-security-mistakes-small-compan… *** How to Hunt Down Phishing Kits *** --------------------------------------------- Sites like phishtank and clean-mx act as crowdsourced phishing detection and validation. By knowing how to look, you can consistently find interesting information about how attackers work, and the tools they use to conduct phishing campaigns. This post will give an example of how phishing kits are used, how to find them, as well as show a case study into other .. --------------------------------------------- https://jordan-wright.github.io/blog/2014/07/30/how-to-hunt-down-phishing-k… *** Spy of the Tiger *** --------------------------------------------- A recent report documents a group of attackers known as 'PittyTiger' that appears to have been active since at least 2011; however, they may have been operating as far back as 2008. We have been monitoring the activities of this .. --------------------------------------------- http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-th… *** Angriff auf Videospiele-Hersteller: Hacker haben es auf Quellcode abgesehen *** --------------------------------------------- Die Hacker der "Threat Group 3279" sind seit Jahren aktiv und versuchen, Quellcode von Spielen zu stehlen und die Sicherheitsvorkehrungen der dazugehörigen DRM-Systeme zu knacken. Die Gruppe soll aus China stammen. --------------------------------------------- http://www.heise.de/security/meldung/Angriff-auf-Videospiele-Hersteller-Hac…

1 0

Tageszusammenfassung - Mittwoch 30-07-2014
by Daily end-of-shift report 30 Jul '14

30 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-07-2014 18:00 − Mittwoch 30-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** 22 Jump Street, Transformers Are Top Movie Lures for Summer *** --------------------------------------------- Summertime has become synonymous with blockbuster movies. Unfortunately, these movies have become a go-to social engineering lure used by cybercriminals. Just like in previous years, Trend Micro engineers searched for possible threats related to movies released during the summer. This year, 22 Jump Street was the top movie used for social .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/22-jump-street-t… *** Google Android Certificate Chain Validation Flaw Lets Applications Gain Elevated Privileges *** --------------------------------------------- The software does not properly validate an application's certificate chain. An application can supply a specially crafted application identity certificate to impersonate a privileged application and gain access to vendor-specific device administration extensions. --------------------------------------------- http://www.securitytracker.com/id/1030654 *** Erpressungs-Trojaner CTB-Locker verschlüsselt sicher und verwischt Spuren *** --------------------------------------------- Wenn man diesem Schädling zum Opfer fällt, gibt es wenig Hoffnung für die eigenen Daten. Diese sind mit State-of-the-Art-Verschlüsselung gesichert und der Trojaner kommuniziert nur verschlüsselt über das Tor-Netz mit seinen Kontrollservern. --------------------------------------------- http://www.heise.de/security/meldung/Erpressungs-Trojaner-CTB-Locker-versch… *** Symantec Endpoint Protection 0day *** --------------------------------------------- In a recent engagement, we had the opportunity to audit the Symantec Antivirus Endpoint Protection solution, where we found a multitude of vulnerabilities. Some of these made it to CERT, while others have been scheduled for review during our upcoming AWE course at Black Hat 2014, Las Vegas. Ironically, the same software that was meant to protect the organization under review was the reason for its compromise. --------------------------------------------- http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ *** Scan Shows Possible Heartbleed Fix Failures *** --------------------------------------------- Of more than 1,600 Global 2000 firms, only 3% of their public-facing servers have been fully and properly locked down from the Heartbleed vulnerability that was first revealed .. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/vulnerability-manageme… *** Tor security advisory: "relay early" traffic confirmation attack *** --------------------------------------------- On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks. --------------------------------------------- https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-… *** Internet of Things: Kreditkartennummern und das Passwort 1234 *** --------------------------------------------- Hersteller von vernetzten Geräten gehen sorglos mit deren Sicherheit um. Kaputte Webinterfaces, überflüssige Kreditkarteninformationen und zu einfache Passwörter wie 1234 machen viele Geräte angreifbar. --------------------------------------------- http://www.golem.de/news/internet-of-things-kreditkartennummern-und-das-pas… *** Multiple vulnerabilities in Kunena Forum Extension for Joomla *** --------------------------------------------- http://www.securityfocus.com/archive/1/532933 http://www.securityfocus.com/archive/1/532932 *** Multiple vulnerabilities in SAP products *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94932 http://xforce.iss.net/xforce/xfdb/94931 http://xforce.iss.net/xforce/xfdb/94930 http://xforce.iss.net/xforce/xfdb/94922 http://xforce.iss.net/xforce/xfdb/94923 http://xforce.iss.net/xforce/xfdb/94921

1 0

Tageszusammenfassung - Dienstag 29-07-2014
by Daily end-of-shift report 29 Jul '14

29 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-07-2014 18:00 − Dienstag 29-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Critroni/Onion - Newest Addition to Encrypting Ransomware *** --------------------------------------------- In my last blog post about a week ago, I talked about how Cryptolocker and the like are not dead and we will continue to see more of them in action. It's a successful 'business model' and I don't see it going away anytime soon. Not even a few days after my post a new encrypting ransomware emerged. This .. --------------------------------------------- http://www.webroot.com/blog/2014/07/25/critroni-new-encrypting-ransomware/ *** Interesting HTTP User Agent "chroot-apach0day", (Mon, Jul 28th) *** --------------------------------------------- Our reader Robin submitted the following detect: Ive got a site that was scanned this morning by a tool that left these entries in the logs: [HTTP_USER_AGENT] => chroot-apach0day .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18453 *** Cisco Prime Data Center Network Manager Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030652 *** Hacker klauten Pläne für Israels Raketenschild "Iron Dome" *** --------------------------------------------- Bei einem Hackerangriff auf drei israelische Waffenschmieden sollen Hacker der chinesischen Regierung in den Jahren 2011 und 2012 haufenweise wichtige Daten zu dem Raketenabwehrsystem erbeutet haben. Die Angreifer sollen der Spezialeinheit 61398 angehören. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-klauten-Plaene-fuer-Israels-Rak… *** Android crypto blunder exposes users to highly privileged malware *** --------------------------------------------- The majority of devices running Google's Android operating system are susceptible to hacks that allow malicious apps to bypass a key security sandbox so they can steal user credentials, read e-mail, and access payment histories and other sensitive data, researchers have warned. --------------------------------------------- http://arstechnica.com/security/2014/07/android-crypto-blunder-exposes-user… *** Changes in the Asprox Botnet *** --------------------------------------------- In this blog post, we took a quick overview of Asprox's functions and saw the updates that it has made to its C&C code. With added RSA encryption, another C&C command, and updated messaging format, it does not look like Asprox will stop evolving. We will continue to monitor Asprox for any changes and will keep you updated. --------------------------------------------- https://blog.fortinet.com/Changes-in-the-Asprox-Botnet/ *** How Cybercrime Exploits Digital Certificates *** --------------------------------------------- Security experts recognize 2011 as the worst year for certification authorities. The number of successful attacks against major companies reported during the year has no precedent, many of them had serious consequences. --------------------------------------------- http://resources.infosecinstitute.com/cybercrime-exploits-digital-certifica… *** Security: Antivirenscanner machen Rechner unsicher *** --------------------------------------------- Ein Datenexperte hat sich aktuelle Virenscanner angesehen. Viele seien durch einfache Fehler angreifbar, meint er. Da sie tief ins System eingreifen, stellen sie eine besondere Gefahr dar - obwohl sie eigentlich schützen sollen. --------------------------------------------- http://www.golem.de/news/security-antivirenscanner-machen-rechner-unsicher-… *** Elasticsearch-Lücke verwandelt Amazon-Cloud-Server in DDoS-Zombies *** --------------------------------------------- Durch eine Sicherheitslücke in einer älteren Elasticsearch-Version können Angreifer beliebigen Schadcode ausführen. Das wird momentan dazu genutzt, Server in Amazons EC2-Cloud zu kapern und für DDoS-Angriffe zu missbrauchen. --------------------------------------------- http://www.heise.de/security/meldung/Elasticsearch-Luecke-verwandelt-Amazon… *** Multiple vulnerabilities in Oxwall 1.7.0 *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070156 http://cxsecurity.com/issue/WLB-2014070155

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily