- Daily - CERT.at

Tageszusammenfassung - Mittwoch 25-02-2015
by Daily end-of-shift report 25 Feb '15

25 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-02-2015 18:00 − Mittwoch 25-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory - WP-Slimstat 3.9.5 and lower *** --------------------------------------------- Advisory for: WP-Slimstat Security Risk: Very high Exploitation level: Remote DREAD Score: 8/10 Vulnerability: Weak Cryptographic keys leading to SQL injections Patched Version: 3.9.6 WP-Slimstat's users should update as soon as possible! During a routine audit for our WAF, we discovered a security bug that an attacker could, by breaking the plugin's weak "secret" key, use to perform a SQL... --------------------------------------------- http://blog.sucuri.net/2015/02/security-advisory-wp-slimstat-3-9-5-and-lowe… *** Finding Unknown Malware *** --------------------------------------------- If you have ever been given the mission to "Find Evil" on a compromised system, you understand the enormity of that tasking. In this technical presentation, Alissa will introduce sound methodology for identifying malware, using strategies based on "Knowing Normal", "Data Reduction" and "Least Frequency of Occurrence" in order to identify malicious binaries and common methods of persistence. The skills and tools presented here will aid in efficient... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/24/finding-unknown-malw… *** A new strain of banking trojan VAWTRAK uses Macros and abuses Windows PowerShell *** --------------------------------------------- Security experts at TrendMicro observed significant improvements in VAWTRAK banking trojan which couples use malicious macros and Windows PowerShell. Early 2015 the Microsoft Malware Protection Center (MMPC) issued an alert about a surge in the infections of malware using macros to spread their malicious code. The experts MMPC have observed a significant increase in enable-macros ... --------------------------------------------- http://securityaffairs.co/wordpress/34107/cyber-crime/vawtrak-uses-macros-w… *** Scanning Internet-exposed Modbus devices for fun & fun *** --------------------------------------------- [...] here is a scan I have run against the whole IPv4 address space, looking for Internet-exposed Modbus services. --------------------------------------------- http://pierre.droids-corp.org/blog/html/2015/02/24/scanning_internet_expose… *** "Surreptitiously Weakening Cryptographic Systems" *** --------------------------------------------- New paper: "Surreptitiously Weakening Cryptographic Systems," by Bruce Schneier, Matthew Fredrikson, Tadayoshi Kohno, and Thomas Ristenpart. Abstract: Revelations over the past couple of years highlight the importance of understanding malicious and surreptitious weakening of cryptographic systems. We provide an overview of this domain, using a number of historical examples to drive development of a weaknesses taxonomy. This allows comparing different... --------------------------------------------- https://www.schneier.com/blog/archives/2015/02/surreptitiously_1.html *** Mozilla Thunderbird Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031792 *** Mozilla Firefox Multiple Flaws Let Remote Users Deny Service, Execute Arbitrary Code, Bypass Security Restrictions, and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031791 *** FreeBSD IGMP Integer Overflow Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031798 *** Splunk Enterprise 6.2.2 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.2.2 addresses two vulnerabilities Multiple vulnerabilities in OpenSSL prior to 1.0.1k (SPL-95203, CVE-2014-3572, CVE-2015-0204) Splunk Web crashes due to specific HTTP requests (SPL-93754) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in... --------------------------------------------- http://www.splunk.com/view/SP-CAAANV8 *** Software Toolbox Top Server Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Software Toolbox Top Server application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-01 *** Kepware Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Kepware Technologies DNP Master Driver for the KEPServerEX Communications Platform. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-02 *** Schneider Electric Invensys Positioner Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Device Type Manager software for Schneider Electric's Invensys SRD Control Valve Positioner product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-03 *** HPSBMU03260 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP System Management Homepage running OpenSSL on Linux and Windows. This vulnerability is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletins *** --------------------------------------------- Rational Reporting for Development Intelligence - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697194 AppScan Enterprise can be affected by multiple vulnerabilities (CVE-2014-6136, CVE-2014-8918) http://www.ibm.com/support/docview.wss?uid=swg21697249 Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697034 Rational Reporting for Development Intelligence - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697035 Tivoli Storage Manager client encryption key password vulnerability (CVE-2014-4818) http://www.ibm.com/support/docview.wss?uid=swg21697022 Tivoli Common Reporting(TCR) iFixes for Security Vulnerability http://www.ibm.com/support/docview.wss?uid=swg21695800 Multiple vulnerabilities in IBM Java SDK affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-3566, CVE-2014-6457, CVE-2014-6468) http://www.ibm.com/support/docview.wss?uid=swg21697112 Vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3513 and CVE-2014-3567) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097159 Rational Insight - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697193 --------------------------------------------- *** Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Dienstag 24-02-2015
by Daily end-of-shift report 24 Feb '15

24 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-02-2015 18:00 − Dienstag 24-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Open Source Threat Intelligence - Developing a Threat intelligence program using open source tools and public sources *** --------------------------------------------- Overview of building a threat intelligence program outlining the processes, tasks and activities associated with the development of a functional intelligence program. Developing an Open Source Threat Intelligence Program from Open Source Tools and Public Sources is aimed at bringing business value and technical mitigation efforts, while dispelling common myths like "We're too small", "Who would attack us, we make widgets?" and "We have nothing anyone would... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/23/open-source-threat-i… *** RIG Exploit Kit - Diving Deeper into the Infrastructure *** --------------------------------------------- Following our previous blog post about the leaking of the RIG exploit kits source code, we dug deeper into the architecture that facilitates the massive infections using RIG. The screen shot below diagrams RIGs infrastructure. RIG Exploit Kit Infrastructure Most... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%e2%80%… *** Insider threats continue to dominate *** --------------------------------------------- Ordinary employees, privileged users and the supply chain - such as contractors and third party service providers - are all conduits for a traditional insider threat, according to Vormetric. But the s... --------------------------------------------- http://www.net-security.org/secworld.php?id=17993 *** Overview of handheld malware for 2014 *** --------------------------------------------- February 24, 2015 Russian anti-virus company Doctor Web presents its 2014 overview of malware for handheld devices. The last year proved to be rather turbulent and rich in terms of information security events. We witnessed the emergence of a variety of new malicious applications for Android. In particular, the number of banking Trojans whose numerous modifications attacked devices in many countries increased significantly. Furthermore, 2014 saw the discovery of the first ransomware programs as... --------------------------------------------- http://news.drweb.com/show/?i=9222&lng=en&c=9 *** Bypassing Windows Lock Screen via Flash Screensaver *** --------------------------------------------- bypass windows lock screen We have recently discovered an easy method to bypass the Windows Lock screen when a flash screensaver is running. The method allows an attacker to gain unauthorized access to a user’s Windows session if he has physical access to a locked machine. --------------------------------------------- http://securitycafe.ro/2015/02/23/bypassing-windows-lock-screen-via-flash-s… *** Windows Exploit Mitigation Technology - Part 2 *** --------------------------------------------- In Part 1, we explained GS cookies and Safe SEH. If you haven't read that part, it is highly recommended to read it first. The Enhanced Mitigation Experience Toolkit, or EMET, is rudimentally a shield or a shell that runs over Windows applications and protects them, regardless of how those applications have authentically been coded... --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology… *** Announcing TYPO3 CMS 7.1 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS 7.1, the second version within the CMS 7 development cycle. --------------------------------------------- http://typo3.org/news/article/typo3-cms-71-released-home-improvement/ *** DSA-3171 samba - security update *** --------------------------------------------- Richard van Eeden of Microsoft Vulnerability Research discovered thatSamba, a SMB/CIFS file, print, and login server for Unix, contains aflaw in the netlogon server code which allows remote code execution withroot privileges from an unauthenticated connection. --------------------------------------------- https://www.debian.org/security/2015/dsa-3171 *** DSA-3170 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a denial of service, information leaks or privilegeescalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3170

1 0

Tageszusammenfassung - Montag 23-02-2015
by Daily end-of-shift report 23 Feb '15

23 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-02-2015 18:00 − Montag 23-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Wichtige Sicherheitsupdates für PHP *** --------------------------------------------- Neue PHP-Versionen schließen unter anderem eine kritische Sicherheitslücke, zu der bereits ein Exploit kursiert. Admins sollten daher keine Zeit verlieren. --------------------------------------------- http://heise.de/-2557586 *** Data Traffic & Network Security *** --------------------------------------------- Introduction Last year - dubbed "the Year of the Hack" - saw numerous major cyber attacks against prominent corporations, including JP Morgan bank and Sony Pictures Entertainment. And after Target in 2013, another retailer, Home Depot, suffered a data breach with more than 56 million credit cards stolen. The consequences of these incidents can be... --------------------------------------------- http://resources.infosecinstitute.com/data-traffic-network-security/ *** Flaw makes Cisco routing hardware vulnerable to DoS attacks *** --------------------------------------------- A serious vulnerability affecting the software of some of Ciscos routing hardware systems for telecommunications and Internet service providers could be exploited to mount DoS attacks, the company ha... --------------------------------------------- http://www.net-security.org/secworld.php?id=17990 *** Samba vulnerability (CVE-2015-0240) *** --------------------------------------------- CVE-2015-0240 is a security flaw in the smbd file server daemon. It can be exploited by a malicious Samba client, by sending specially-crafted packets to the Samba server. No authenticated is required to exploit this flaw. It can result in remotely controlled execution of arbitrary code as root. --------------------------------------------- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-024… *** Superfish not the only app using Komodias SSL-busting code *** --------------------------------------------- As Lenovo backtracked on its initial position that the Superfish adware pre-installed on some of its notebooks is not a security danger, and released a security advisory about the "vulnerability" that... --------------------------------------------- http://www.net-security.org/secworld.php?id=17991 *** Privdog: Comodo-Adware hebelt HTTPS-Sicherheit aus *** --------------------------------------------- Die Adware Privdog hebelt ähnlich wie Superfish den Schutz von HTTPS komplett aus. Pikant daran: Privdog wurde von Comodo verbreitet, einer der größten Zertifizierungsstellen für TLS-Zertifikate. --------------------------------------------- http://www.golem.de/news/privdog-comodo-adware-hebelt-https-sicherheit-aus-… *** FireEye shares details on Masque Attack II affecting iOS devices *** --------------------------------------------- Masque Attack II entails bypassing an iOS prompt for trust and app URL scheme hijacking, FireEye said. --------------------------------------------- http://www.scmagazine.com/fireeye-shares-details-on-masque-attack-ii-affect… *** Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0631 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS Software HTTP Redirect Vulnerability *** --------------------------------------------- CVE-2015-0624 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletins *** --------------------------------------------- Tivoli Storage Manager Stack-based Buffer Overflow Elevation of Privilege: CVE-2014-6184 http://www.ibm.com/support/docview.wss?uid=swg21695878 Vulnerability in SSLv3 affects Tivoli Storage Manager for Virtual Environments 7.1 and FlashCopy Manager for VMware 4.1 (CVE-2014-3566) http://www.ibm.com/support/docview.wss?uid=swg21690828 OpenSSL vulnerabilities announced August 6th 2014 affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (9 CVEs) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097073 Vulnerabilities in OpenSSL. Juniper EX Series Network Switches sold by IBM for use in IBM Products. (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097126 --------------------------------------------- *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-050-01 *** Vibe 3.4 - Hot Patch 1 *** --------------------------------------------- Abstract: This patch addresses the Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability and also provides a number of general bug fixes for Novell Vibe 3.4.Document ID: 5198730Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:NV-Vibe60DayEval-001.xml (719 bytes)NV-Vibe10Usr-001.xml (730 bytes)novell-vibe-3.4.0-windows.zip (185.69 MB)readme-Vibe-3.4-HP1.txt (4.13 kB)novell-vibe-3.4.0-linux.tar (187.8 MB)Products:Vibe 3.4Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=EaNhJs2Offs~ *** Bugtraq: iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:\Program Files\... *** --------------------------------------------- http://www.securityfocus.com/archive/1/534728 *** MyBB 1.8.3 Multiple stored XSS-vulnerabilities *** --------------------------------------------- Topic: MyBB 1.8.3 Multiple stored XSS-vulnerabilities Risk: Low Text: The researchers adamziaja, Devilshakerz, DingjieYang and me found multiple stored XSS-vulnerabilities in the administrative ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020109 *** DSA-3169 eglibc - security update *** --------------------------------------------- Several vulnerabilities have been fixed in eglibc, Debians version ofthe GNU C library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3169 *** DSA-3164 typo3-src - security update *** --------------------------------------------- Pierrick Caillon discovered that the authentication could be bypassed inthe Typo 3 content management system. Please refer to the upstreamadvisory for additional information: --------------------------------------------- https://www.debian.org/security/2015/dsa-3164 *** Security Advisory: Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. Fixed versions: Versions 1.3.8 and 1.4.3 disable sandboxing for Groovy by default. As a consequence, dynamic script execution is disabled for Groovy. CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://securityvulns.com/docs31742.html *** HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Denial of Service (DoS), or Other Vulnerabilties *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Freitag 20-02-2015
by Daily end-of-shift report 20 Feb '15

20 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-02-2015 18:00 − Freitag 20-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Gemalto hack - lessons learned *** --------------------------------------------- In der Nacht auf FR, 20.2.2015 ist die nächste Bombe aus den Snowden leaks eingeschlagen: der niederländische Chipkartenhersteller Gemalto ist zumindest im Zeitraum Jänner 2010 bis März 2010 von GCHQ und NSA gehackt worden. Hierbei sind angeblich .. --------------------------------------------- https://www.cert.at/services/blog/20150220150747-1386.html *** Superfish - Eine Zusammenfassung *** --------------------------------------------- Die meisten im Handel erhältlichen Notebooks werden mit einer vorinstallierten Version von Windows in Kombination mit weiterer "nützlicher" Software - gemeinhin als "Bloatware" bezeichnet - ausgeliefert. Für die meisten Leute ist diese auf Notebooks vorinstallierte Bloatware .. --------------------------------------------- http://www.cert.at/services/blog/20150220162905-1395.html *** The Great SIM Heist - How Spies Stole the Keys to the Encryption Castle *** --------------------------------------------- American and british spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden. --------------------------------------------- https://firstlook.org/theintercept/2015/02/19/great-sim-heist/ *** Hackers now popping Cisco VPN portals *** --------------------------------------------- Crackers are popping customised Cisco virtual private networks, stealing credentials and spraying malware using a flaw reported by Aussie hacker Alec Stuart-Muirk, the company warns. Organisations running the Cisco Clientless SSL .. --------------------------------------------- http://www.theregister.co.uk/2015/02/20/hackers_popping_cisco_vpn_portals/ *** Suit Up and Protect WordPress *** --------------------------------------------- In the final part of the series, I am going to show a few practical tips and tricks for protecting your WordPress blog. --------------------------------------------- https://blog.gaborszathmari.me/2015/02/19/suit-up-and-protect-wordpress/ *** Evil CSS injection bug warning: Dont let hackers cross paths with your website (The Register) *** --------------------------------------------- http://www.theregister.co.uk/2015/02/20/prssi_web_vuln/ *** Filme, Musik, Logindaten: 190.000 Festplatten sind ungesichert im Netz *** --------------------------------------------- Junger Informatiker grast das Netz mit eigenem Tool ab und wundert sich über "Fahrlässigkeit" --------------------------------------------- http://derstandard.at/2000011951714 *** 'TNT' gang has released a new hardware TDoS tool in the criminal underground *** --------------------------------------------- Telephone DDoS attacks are on the rise, the criminal group known as 'TNT' gang has released a new hardware tool in the underground ecosystem. The IntelCrawler cyber threat intelligence company has discovered a new advanced tool, dubbed .. --------------------------------------------- http://securityaffairs.co/wordpress/33867/cyber-crime/tnt-gang-released-tdo… *** IETF verbietet RC4-Verschlüsselung in TLS *** --------------------------------------------- Das Gremium für Internet-Standards will den Einsatz des als geknackt betrachteten Verschlüsselungsverfahrens RC4 offenbar den Garaus machen. --------------------------------------------- http://heise.de/-2556520 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Donnerstag 19-02-2015
by Daily end-of-shift report 19 Feb '15

19 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-02-2015 18:00 − Donnerstag 19-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** SA-CONTRIB-2015-052 - RESTful Web Services - Access Bypass *** --------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The RESTWS Basic Auth submodule doesn't sufficiently disable page caching for ... --------------------------------------------- https://www.drupal.org/node/2428863 *** SA-CONTRIB-2015-048 - Avatar Uploader - Arbitrary PHP code execution *** --------------------------------------------- Avatar Uploader module provides an alternative way to upload user pictures. The module doesn't sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal's normal file upload protections to .. --------------------------------------------- https://www.drupal.org/node/2428793 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** BIND: A Problem with Trust Anchor Management Can Cause named to Crash *** --------------------------------------------- BIND servers which are configured to perform DNSSEC validation and which are using managed-keys (which occurs implicitly when using "dnssec-validation auto;" or "dnssec-lookaside auto;") may terminate with an assertion failure when . --------------------------------------------- https://kb.isc.org/article/AA-01235/0 *** OWASP AppSensor - implement real-time intrusion detection within in your software *** --------------------------------------------- Free, open source, DevOps friendly and cloud compatible AppSensor provides real-time application-layer attack detection and response. --------------------------------------------- https://www.owasp.org/images/8/8e/Appsensor_intro_for_developers.pdf *** Lenovo-Laptops durch Superfish-Adware angreifbar *** --------------------------------------------- Eine Adware namens Superfish wird offenbar schon seit mehreren Monaten auf Laptops von Lenovo ausgeliefert. Diese fügt Werbung in fremde Webseiten ein und installiert dafür ein Root-Zertifikat - eine riesige Sicherheitslücke. --------------------------------------------- http://www.golem.de/news/adware-lenovo-laptops-durch-superfish-adware-angre… *** Macros? Really?! *** --------------------------------------------- .. macro-based malware is now making a "successful" comeback. Last week, we saw a significant Dridex malware run that was using macros in Excel files (.XLSM), and earlier this week, the crooks behind the banking spyware "Vawtraq" started to spam the usual "Fedex Package" and "Tax Refund" emails, .. --------------------------------------------- https://isc.sans.edu/diary/Macros%3F+Really%3F!/19349 *** Automating Removal of Java Obfuscation *** --------------------------------------------- In this post we detail a method to improve analysis of Java code for a particular obfuscator, we document the process that was followed and demonstrate the results of automating our method. Obscurity will not stop an attacker and once the method is known, methodology can be developed to automate the process. --------------------------------------------- http://www.contextis.com/resources/blog/automating-removal-java-obfuscation/ *** IETF: RC4 in TLS offiziell nicht mehr erlaubt *** --------------------------------------------- Die RC4-Verschlüsselung darf laut dem neuen RFC 7465 nicht mehr für TLS-Verbindungen genutzt werden. Der Algorithmus gilt schon lange als problematisch, Details über neue Angriffe sollen in Kürze veröffentlicht werden. --------------------------------------------- http://www.golem.de/news/ietf-rc4-in-tls-offiziell-nicht-mehr-erlaubt-1502-… *** Cross-Site Tracing (XST): The misunderstood vulnerability *** --------------------------------------------- Alas, the 'XS' in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript. (Thankfully, character encoding attacks have avoided the term Cross-Site Unicode, XSU.) Although XST attacks rely on browser scripting .. --------------------------------------------- http://deadliestwebattacks.com/2010/05/18/cross-site-tracing-xst-the-misund… *** Duplicator 0.5.8 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7799 *** Technology doping: Competitive advantage by abusing security flaws in smart sports equipment *** --------------------------------------------- The term 'Technology doping' has recently been used [1] to mean the practice of gaining a competitive advantage through using sports equipment e.g. The LZR Racer bodysuit [2] that was used by many of the swimmers during the Beijing Olympics, resulting in world records being broken. Shortly afterwards, FINA (Federation Internationale de Natation), the international .. --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/technology-doping-competitive-adva… *** l+f: Geklonte SSH-Schlüssel sind böse *** --------------------------------------------- Tausende von Geräten im Netz verwenden ein und den selben SSH-Schlüssel. Das birgt Gefahren. --------------------------------------------- http://heise.de/-2555229 *** Erpressungs-Software im Aufstieg: Wenn Daten zur Geisel werden *** --------------------------------------------- Immer mehr Kriminelle setzen auf "Ransomware", um Lösegeld zu erpressen. Ihr nächstes Ziel: Mobiltelefone. --------------------------------------------- http://derstandard.at/2000011389615

1 0

Tageszusammenfassung - Mittwoch 18-02-2015
by Daily end-of-shift report 18 Feb '15

18 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-02-2015 18:00 − Mittwoch 18-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Sicher surfen trotz Android 4.3 *** --------------------------------------------- Der WebView-Bug von Android 4.3 könnte sich stärker auswirken als bisher bekannt. Auch wenn die Angriffsszenarien bisher nur theoretische Proof-of-Concepts sind, sollten Sie ein paar Vorsichtsmaßnahmen ergreifen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicher-surfen-trotz-Android-4-3-2552… *** Bug des Tages: Der FreeBSD-Zufallszahlengenerator war ... *** --------------------------------------------- Bug des Tages: Der FreeBSD-Zufallszahlengenerator war seit vier Monaten kaputt. Das betrifft glaube ich nur FreeBSD-current. Wer in der Zeit PGP- oder SSH- oder sonstige Krypto-Keys generiert hat, sollte die dann wohl auch mal zurückrufen und neue machen. --------------------------------------------- http://blog.fefe.de/?ts=aa1d7111 *** Fuzzing for MS15-010 *** --------------------------------------------- Intro This past Patch Tuesday Microsoft released MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution. This patch addressed multiple privately reported vulnerabilities in .. --------------------------------------------- http://blog.beyondtrust.com/fuzzing-for-ms15-010 *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-01 *** Siemens SIMATIC WinCC TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC WinCC TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-02 *** Yokogawa HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library utilized in Yokogawa's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-03 *** D-Link DSL-2640B DNS hijacking *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/100955 *** Duplicate SSH Keys Everywhere *** --------------------------------------------- Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. --------------------------------------------- https://blog.shodan.io/duplicate-ssh-keys-everywhere/ *** Beware of fake Facebook "Copyright Violations" warnings *** --------------------------------------------- The latest Facebook-themed phishing messages doing rounds are trying to trick users into believing they are "making copyright violations" on their Facebook page. "Please review your .. --------------------------------------------- http://www.net-security.org/secworld.php *** Microsoft wirbt mit Sicherheit nach ISO 27018 *** --------------------------------------------- Microsofts Cloud-Dienste Office 365 und Dynamics CRM Online sind von dem British Standards Institute (BSI) nach den Sicherheitsstandards zertifiziert worden, wie sie in ISO/IEC 27018 definiert sind. Diese Standards sollen für Microsoft weltweit gelten. Azure hat bereits eine solche .. --------------------------------------------- http://www.golem.de/news/cloud-dienste-microsoft-wirbt-mit-sicherheit-nach-… *** Kippo Modifications - New Features *** --------------------------------------------- Since summer last year I've been working on extensions and contributions to the well known Kippo honeypot developed by desaster. ... New Features: SFTP support, Exec support, SSH tunnelling (direct-tcpip) support, SSH Fingerprint .. --------------------------------------------- http://www.micheloosterhof.com/kippo-modifications/ *** ENISA's recommendations for Certifying ICS/SCADA professionals *** --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa2019s-recommendations-… *** Die Geister, die ich rief: Netgear-Router über Genie-App angreifbar *** --------------------------------------------- Eine Reihe von Netgear-Routerm plaudern durch die Schnittstelle für die Fernwartungs-App Genie wichtige Informationen über das eigene Netzwerk aus. Unter anderem können Angreifer aus dem Netz so Passwörter auslesen. --------------------------------------------- http://heise.de/-2553224

1 0

Tageszusammenfassung - Dienstag 17-02-2015
by Daily end-of-shift report 17 Feb '15

17 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-02-2015 18:00 − Dienstag 17-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** HITBSecConf2015 Amsterdam *** --------------------------------------------- Held once again at De Beurs van Berlage, HITB2015AMS takes place from the 26th till the 29th of May 2015 and runs alongside HITB Haxpo - our 3-day technology expo for hackers, makers, builders and breakers. --------------------------------------------- http://conference.hitb.org/hitbsecconf2015ams/ *** Anunak (aka Carbanak) Update *** --------------------------------------------- ... basically Anunak is the name the malware author gave to the main malware used in these attacks. Carbanak is the name the AV industry gave to this malware, which is a combination of the .. --------------------------------------------- http://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/ *** HTTP Strict Transport Security comes to Internet Explorer *** --------------------------------------------- As part of our ongoing commitment to help build an interoperable, secure web that just works, were excited to announce support for HTTP Strict Transport Security (HSTS) in Internet Explorer. This change can be previewed using Internet Explorer in the Windows 10 Technical Preview, and will come to Project Spartan in a later update. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-securit… *** TYPO3-EXT-SA-2015-005: Cross-Site Scripting in extension Gridelements (gridelements) *** --------------------------------------------- The extension fails to properly escape user input in HTML context. Backend Editor permissions with access to any text field within any data table are required to exploit this vulnerability. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** MongoDB: Tipps für sichere Benutzung veröffentlicht *** --------------------------------------------- Nach Schlagzeilen über ungesicherte Online-Installationen der Datenbank MongoDB gibt der Hersteller der kommerziellen Variante Sicherheits-Empfehlungen. Sie zeigen, wie man die populäre Software ohne Datenleck übers Netz nutzen kann. --------------------------------------------- http://www.heise.de/newsticker/meldung/MongoDB-Tipps-fuer-sichere-Benutzung… *** TYPO3: Important Security-Bulletin Pre-Announcement *** --------------------------------------------- A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. --------------------------------------------- http://typo3.org/news/article/important-security-bulletin-pre-announcement/ *** Bericht: Lightning-Anschluss gehackt *** --------------------------------------------- Einem Entwickler hat es geschafft, den von Apple verwendeten Sicherheitschip für die Anschlusskabel von iPhone und Co. teilweise zu entschlüsseln und eine serielle Konsole aufzurufen. Das könnte zu ganz neuen Angriffsformen führen. --------------------------------------------- http://heise.de/-2550921 *** Defeating TrueCrypt: Practical Attacks against TrueCrypt Security *** --------------------------------------------- The need to defend confidentiality of our sensitive information against persistently rising cyber threats has turned most of us toward using encryption on a daily basis. This is facilitated by easy-to-use GUI tools like TrueCrypt that offer advanced encryption without hassles. TrueCrypt .. --------------------------------------------- http://resources.infosecinstitute.com/defeating-truecrypt-practical-attacks… *** SSA-315836 (Last Update 2015-02-17): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V12 and V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Vawtrack malware peddlers turn to malicious macros *** --------------------------------------------- Cybercriminals spreading new versions of the Vawtrak banking Trojan are the latest ones to use the once again popular macro-based attack. Popular in the early 2000s, this type of attack was abandon... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2967 *** APT Groups Emerging in Middle East *** --------------------------------------------- Since security researchers and vendors began exposing the inner workings of APT groups a few years ago, virtually all of the operations that have been made public have been the work of attackers in Europe, Asia or North America. But .. --------------------------------------------- http://threatpost.com/apt-groups-emerging-in-middle-east/111124 *** Inside nls_933w.dll, the Equation APT Persistence Module *** --------------------------------------------- The persistence module used by the Equation APT Group uncovered by researchers at Kaspersky Lab has been called the ultimate cyberattack tool. --------------------------------------------- http://threatpost.com/inside-nls_933w-dll-the-equation-apt-persistence-modu… *** Keeping Up with SSL *** --------------------------------------------- SSL is becoming an evermore important aspect of serving and consuming content on the Internet, so its only fit that Shodan extends the information that it gathers for every SSL-capable service. The banners for SSL services, such as HTTPS, have included the certificate in PEM format for a long time and youve been able to access that data through the REST API or real-time stream. --------------------------------------------- https://blog.shodan.io/ssl-update/

1 0

Tageszusammenfassung - Montag 16-02-2015
by Daily end-of-shift report 16 Feb '15

16 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-02-2015 18:00 − Montag 16-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Microsoft February Patch Failures Continue: KB3023607 vs. Cisco AnyConnect Client *** --------------------------------------------- Another patch released by Microsoft this month is causing problems. This time it is KB3023607,which was supposed to mitigate the POODLE vulnerability. Once applied, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19331 *** PostgreSQL Bugs Let Remote Authenticated Users Obtain Potentially Sensitive Information, Execute Arbitrary Code, and Deny Service *** --------------------------------------------- Several vulnerabilities were reported in PostgreSQL. A remote authenticated user can execute arbitrary code on the target system. A remote authenticated user can cause denial of service conditions. A remote authenticated user can obtain .. --------------------------------------------- http://www.securitytracker.com/id/1031742 *** SSA-234789 (Last Update 2015-02-13): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerShell: Better phishing for all! *** --------------------------------------------- PowerShell is able to import functions from any DLL, this allows you to use functions like VirtualAlloc, memset and CreateThread. This will allow you to allocate executable memory, fill it with your program and execute it. --------------------------------------------- http://d.uijn.nl/?p=116 *** Analysis of the Fancybox-For-WordPress Vulnerability *** --------------------------------------------- We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the details explaining how attackers could use this .. --------------------------------------------- http://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulne… *** Probleme mit Windows RT: Microsoft zieht PowerPoint-Patch zurück *** --------------------------------------------- Per Patch wollte Microsoft die Stabilität von PowerPoint verbessern. Nutzer von Windows RT-Geräten hatten jedoch nach der Installation des Patches berichtet, dass sich Powerpoint nicht mehr starten lasse. Jetzt hat Microsoft den Patch zurückgezogen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Probleme-mit-Windows-RT-Microsoft-zi… *** Sicherheitslücke in Gruppenrichtlinien: Mit dem Patchen allein ist es nicht getan *** --------------------------------------------- Admins aufgepasst: Eines der am Februar-Patchday ausgelieferten Updates schützt nur, wenn man eine Reihe von Anweisungen befolgt. Tut man das nicht, bleibt die Infrastruktur für Man-in-the-Middle-Angriffe anfällig. --------------------------------------------- http://heise.de/-2550209 *** The Great Bank Heist, or Death by 1,000 Cuts? *** --------------------------------------------- I received a number of media requests and emails from readers over the weekend to comment on a front-page New York Times story about an organized gang of cybercriminals pulling off 'one of the largest bank heists ever.' Turns out, I reported on this gang's activities in December 2014, although my story ran minus many of the superlatives in the Times piece. --------------------------------------------- http://krebsonsecurity.com/2015/02/the-great-bank-heist-or-death-by-1000-cu… *** The research: Mobile Internet traffic hijacking via GTP and GRX *** --------------------------------------------- Most users assume that mobile network access is much safer because a big mobile-telecoms provider will protect subscribers. Unfortunately, as practice shows, mobile Internet is a great opportunity for the attacker. --------------------------------------------- http://blog.ptsecurity.com/2015/02/the-research-mobile-internet-traffic.html *** Angriffsziel Bitcoinbörse: Bter und Exco.in gehackt *** --------------------------------------------- Die Jagdsaison auf Bitcoinbörsen scheint wieder loszugehen: Unbekannte haben die Handelsplattform Bter um Coins im Wert von fast 1,5 Millionen Euro erleichtern können. Die Börse Exco.in wurde gleich aller Bitcoins beraubt. --------------------------------------------- http://heise.de/-2550175

1 0

Tageszusammenfassung - Freitag 13-02-2015
by Daily end-of-shift report 13 Feb '15

13 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-02-2015 18:00 − Freitag 13-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Open-Xchange Access Control Flaw Lets Remote Authenticated Users Access Restricted Files *** --------------------------------------------- A vulnerability was reported in Open-Xchange. A remote authenticated user can access certain files on the target system. A remote authenticated user with access to publications can access shared files without permission to access them. --------------------------------------------- http://www.securitytracker.com/id/1031744 *** Security Advisory-Information Leakage Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- MeWidget is a plug-in of Huawei Emotion UI. The MeWidget module on Huawei smartphone P7 has a vulnerability that could lead to the disclosure of contact information. Attackers can obtain the name and URI information of mobile phone users through the malware installed on the smartphones. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Apple: Zwei-Faktor-Schutz für iMessage und FaceTime *** --------------------------------------------- Apple bietet ab sofort die Zwei-Faktor-Authentifizierung auch für seine Dienste FaceTime und iMessage an. Dieses schützt das Konto mit einem zweiten Passwort. --------------------------------------------- http://futurezone.at/digital-life/apple-zwei-faktor-schutz-fuer-imessage-un… *** NetGear WNDR Authentication Bypass / Information Disclosure *** --------------------------------------------- .. viewing and setting of certain router parameters, such as: WLAN credentials and SSIDs. Connected clients. Guest WLAN credentials and SSIDs. Parental control settings. ... As this SOAP service is called via the built-in HTTP / CGI daemon, unauthenticated queries will be answered from the WAN if remote management has been enabled on the device. As a result, affected devices can be interrogated and hijacked with as little as a well placed HTTP query. --------------------------------------------- https://github.com/darkarnium/secpub/blob/master/NetGear/SOAPWNDR/README.md *** vBulletin XSS (Cross-Site Scripting) Security Vulnerabilities *** --------------------------------------------- Vulnerable Versions: 5.1.3, 5.0.5, 4.2.2, 3.8.7, 3.6.7, 3.6.0, 3.5.4 Vulnerability Details: vBulletin has a security problem. It can be exploited by XSS attacks. The vulnerability occurs at "forum/help" page. Add "hash symbol" first. Then add script at the end of it. CVE Reference: CVE-2014-9469 CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) --------------------------------------------- http://securityrelated.blogspot.co.at/2015/02/cve-2014-9469-vbulletin-xss-c… *** Netatmo Weather Station Sends WPA Passwords In the Clear *** --------------------------------------------- UnderAttack writes The SANS Internet Storm Center is writing that Netatmo weather stations will send the users WPA password in the clear back to Netatmo. Netatmo states that this is some forgotten debug code that was left in the device. Overall, the device doesnt bother with encryption, but sends all data, not just the password, in the clear. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-VdGyumpxjY/story01.htm *** Windows Exploit Mitigation Technology - Part 1 *** --------------------------------------------- The spree of exploits on Windows has led to the creation of a certain type of exploit protection mechanism on Windows. Protection from things like buffer overflow, heap overwrite and return originated exploits have been deployed on Windows compilers and OS. --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology…

1 0

Tageszusammenfassung - Donnerstag 12-02-2015
by Daily end-of-shift report 12 Feb '15

12 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-02-2015 18:00 − Donnerstag 12-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Advantech EKI-1200 Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Advantech EKI-1200 product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-041-01 *** MSRT February: Escad and NukeSped *** --------------------------------------------- This month we added three new families to the Microsoft Malicious Software Removal Tool (MSRT) to help protect our customers: Win32/Escad, Win32/Jinupd and Win32/NukeSped. While this blog focuses on Escad and NukeSped, we want to note that Jinupd is point-of-sale malware that steals sensitive data, such as credit card information and sends it to a malicious hacker. The Escad and NukeSped malware families have backdoor capabilities that have been used as part of targeted attacks. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/10/msrt-february-escad-and-… *** February 2015 Updates *** --------------------------------------------- Today, as part of Update Tuesday, we released nine security bulletins - three rated Critical and six rated Important in severity, to address 56 unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. We encourage you to apply all of these updates. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/02/10/february-2015-updates.as… *** A Crypto Trick That Makes Software Nearly Impossible to Reverse-Engineer *** --------------------------------------------- Software reverse engineering, the art of pulling programs apart to figure out how they work, is what makes it possible for sophisticated hackers to scour code for exploitable bugs. It's also what allows those same hackers' dangerous malware to be deconstructed and neutered. Now a new encryption trick could make both those tasks much, much harder. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/434d3df8/sc/4/l/0L0Swired0N0C20A1… *** Decrypting TLS Browser Traffic With Wireshark - The Easy Way *** --------------------------------------------- It turns out that Firefox and the development version of Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. Read on to learn how to set this up. --------------------------------------------- https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wiresh… *** Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. ... CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://www.securityfocus.com/archive/1/534689 *** NIST requests final comments on ICS security guide *** --------------------------------------------- Included in the final draft are updates on ICS vulnerabilities and risk management practices, along with information on security capabilities and tools for industrial control systems. Also added to the guide were methods for aligning guidance with other ICS security standards and guidelines. --------------------------------------------- http://www.scmagazine.com/nist-requests-final-comments-on-ics-security-guid… *** Pannen-Patch: Microsoft probierts noch mal *** --------------------------------------------- Unangekündigt hat Microsoft erneut damit begonnen, den Patch KB3001652 über Windows Update zu verteilen. Im ersten Anlauf hatte das Unternehmen damit zahlreiche Rechner lahm gelegt. Unterdessen beschweren sich Nutzer über einen weiteren Patch. --------------------------------------------- http://www.heise.de/newsticker/meldung/Pannen-Patch-Microsoft-probierts-noc… *** Cisco Security Advisories *** --------------------------------------------- Cisco IOS Software Access Control List Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 11-02-2015
by Daily end-of-shift report 11 Feb '15

11 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-02-2015 18:00 − Mittwoch 11-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** MS15-FEB - Microsoft Security Bulletin Summary for February 2015 - Version: 1.0 *** --------------------------------------------- MS15-009 Security Update for Internet Explorer MS15-010 Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution MS15-011 Vulnerability in Group Policy Could Allow Remote Code Execution MS15-012 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution MS15-013 Vulnerability in Microsoft Office Could Allow Security Feature Bypass MS15-014 Vulnerability in Group Policy Could Allow Security Feature Bypass MS15-015 Vulnerability in Microsoft Windows Could Allow Elevation of Privilege MS15-016 Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure MS15-017 Vulnerability in Virtual Machine Manager Could Allow Elevation of Privilege --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-FEB *** Vorsicht! Microsoft-Patch legt Rechner lahm *** --------------------------------------------- An seinem Februar-Patchday schließt Microsoft 56 Lücken - und beschert Windows-Nutzern auch neue Probleme. Durch ein älteres Update, das nun automatisch verteilt wird, hängt der Rechner beim Installieren fest. --------------------------------------------- http://heise.de/-2545913 *** SSL Is Officially Declared Dead *** --------------------------------------------- On January 30, 2015, QSAs received the latest edition of the Council's Assessor Newsletter. Buried in that edition was the following statement. "The impacting change is related to several vulnerabilities in the SSL protocol. Because of this, no version of SSL meets PCI SSCs definition of strong cryptography, and updates to the standards are needed to address this issue." ... Therefore, those of you still using SSL to secure transmissions containing cardholder data (CHD) need to ... --------------------------------------------- https://pciguru.wordpress.com/2015/02/07/ssl-is-officially-declared-dead/ *** MS15-011 & MS15-014: Hardening Group Policy *** --------------------------------------------- Today we are releasing MS15-011 & MS15-014 which harden group policy and address network access vulnerabilities that can be used to achieve remote code execution (RCE) in domain networks. The MS15-014 update addresses an issue in Group Policy update which can be used to disable client-side global SMB Signing requirements, bypassing an existing security feature built into the product. MS15-011 adds new functionality, hardening network file access to block access to untrusted, attacker --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-har… *** Internet of Thieves: All that shiny home security gear is crap, warns HP *** --------------------------------------------- If you can monitor your house across the web, so can everyone else In a recent study, every connected home security system tested by HP contained significant vulnerabilities, including but not limited to password security, encryption, and authentication issues. --------------------------------------------- http://www.theregister.co.uk/2015/02/10/iot_home_insecurity/ *** ZDI-15-041: Samsung Security Manager ActiveMQ Broker Service DELETE Method Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to delete files of their choosing from systems running vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-041/ *** Security Advisory- Local Denial of Service Vulnerability in Huawei Ascend P7 *** --------------------------------------------- Huawei Ascend P7 (Sophia-L09) uses Android 4.4, which is the upgrade version of EMUI 3.0. The phone module crashes when a third-party app sends specific broadcast messages or enables specific UIs. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7 *** --------------------------------------------- Android versions earlier than 5.0 are affected by the vulnerability, which allows an attacker to escalate privilege. Huawei Mate7 is affected by the vulnerability CVE-2014-7911 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Offene Key-Value Stores *** --------------------------------------------- Offene Key-Value Stores11. Februar 2015Wie Heise berichtet wurden in den letzten Tagen von einer Gruppe Studenten zehntausende vollständig ungesicherte Instanzen der NoSQL-Datenbank MongoDB im Internet entdeckt. In den meisten Fällen war nicht nur lesender Zugriff sondern auch die Manipulation von Datensätzen möglich. --------------------------------------------- http://www.cert.at/services/blog/20150211085411-1367.html *** Research, Low-Level, Vulnerabilities, Exploitation *** --------------------------------------------- Today, Microsoft released their latest Patch Tuesday. This Patch includes a fix for vulnerability CVE-2015-0057, an IMPORTANT-rated exploitable vulnerability which we responsibly disclosed to Microsoft a few months ago. As part of our research, we revealed this privilege escalation vulnerability which, if exploited, enables a threat actor to complete control of a Windows machine. --------------------------------------------- http://breakingmalware.com/vulnerabilities/one-bit-rule-bypassing-windows-1… *** Google Play Store X-Frame-Options (XFO) Gaps Enable Android Remote Code Execution (RCE) *** --------------------------------------------- Due to a lack of complete coverage for X-Frame-Options (XFO) support on Googles Play Store web application domain, a malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers, to remotely install and launch the main intent of an arbitrary Play Store provided Android package (APK). Affected Platforms: Many versions of Android 4.3 (Jelly Bean) and earlier ship ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/10/r7-2015-0… *** NetFlow Collection and Analysis Using NFCAPD, Python, and Splunk *** --------------------------------------------- NetFlow data is often collected for network monitoring and management, but it has many applications for the security analyst. NetFlow data can be used to identify variations from established traffic baselines, traffic originating from critical systems, and communications with known bad external hosts. Many edge devices support the generation of NetFlow data, but the collection and analysis often requires commercial tools. Options based on open source and free tools will allow an analyst to ... --------------------------------------------- https://www.sans.org/reading-room/whitepapers/incident/netflow-collection-a… *** Firmware: Hacker veröffentlicht Anleitung für UEFI-Rootkits *** --------------------------------------------- Ein russischer Hacker hat eine Anleitung veröffentlicht, wie Rootkits über manipulierte UEFIs eingepflanzt werden können. Wie leicht es ist, aktuelle UEFI-Implementierungen anzugreifen, hatten Hacker bereits auf dem 31C3 demonstriert. --------------------------------------------- http://www.golem.de/news/firmware-hacker-veroeffentlicht-anleitung-fuer-uef… *** Cisco Security Advisories *** --------------------------------------------- Cisco Secure Access Control System SQL Injection Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS ACL Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco TelePresence IX5000 Series Web Management Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 10-02-2015
by Daily end-of-shift report 10 Feb '15

10 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-02-2015 18:00 − Dienstag 10-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Safer Internet Day: BSI-Poster für mehr Sicherheit im Netz *** --------------------------------------------- Mit 40 "leicht umsetzbaren" Tipps sollen Internetnutzer die allermeisten Standardangriffe im Internet abwehren können, meint das Bundesamt für Sicherheit in der Informationstechnik. Deswegen hat es die auf Postern zusammengefasst und online gestellt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Safer-Internet-Day-BSI-Poster-fuer-m… *** European Cyber Security Month reporting to the benefit of EU citizen *** --------------------------------------------- ENISA publishes a report on the deployment of the European Cyber Security Month. The objective of this report is to: * Present its preparatory work * Carry out an objective evaluation * Draw conclusions that can be used in future editions of the ECSM --------------------------------------------- http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-r… *** TR-32 - key-value store and NoSQL security recommendations *** --------------------------------------------- Key-value stores, caches or NoSQL databases became an important piece of software in today's internet and web services. In contrast to conventional DB sytems, the security model of NoSQL data stores is often very limited due to their inherent nature to be used within internal trusted networks. Strong attention should be given to the configuration of key-value stores especially regarding their access from the Internet. --------------------------------------------- http://www.circl.lu/pub/tr-32/ *** PlugX, Go-To Malware for Targeted Attacks, More Prominent Than Ever *** --------------------------------------------- The popular remote access tool PlugX enjoyed an ascent in popularity in 2014 and is now a go-to malware for attack groups. --------------------------------------------- http://threatpost.com/plugx-go-to-malware-for-targeted-attacks-more-promine… *** Cisco Security Advisories *** --------------------------------------------- Cisco Prime Infrastructure Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Software Zone-Based Firewall Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Software Kernel Timer Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Prime Security Manager Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Shell Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 9-02-2015
by Daily end-of-shift report 09 Feb '15

09 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-02-2015 18:00 − Montag 09-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Analyzing Angler: The World's Most Sophisticated Exploit Kit *** --------------------------------------------- Anglers unique obfuscation, ability to detect antivirus and virtual machines, encrypted payload and fileless infection have some calling it the most sophisticated exploit kit. --------------------------------------------- http://threatpost.com/analyzing-angler-the-worlds-most-sophisticated-exploi… *** Bindead - a static analysis tool for binaries. *** --------------------------------------------- Bindead is an analyzer for executable machine code. It features a disassembler that translates machine code bits into an assembler like language (RREIL) that in turn is then analyzed by the static analysis component using abstract interpretation. As Bindead operates on the machine code level, it can be used without having the source code of the program to be analyzed. In fact, the purpose of Bindead is to help with the reverse engineering of executable code or binaries. --------------------------------------------- https://bitbucket.org/mihaila/bindead/wiki/Home *** ENISA: Threat Landscape for Smart Home and Media Convergence *** --------------------------------------------- The study identifies threats to all asset classes, across the several alternative design pathways to smart homes. As it develops, the smart home will exhibit a high cyber security risk profile for the individual context, with additional systematic effects on broader information security. --------------------------------------------- https://www.enisa.europa.eu/activities/risk-management/evolving-threat-envi… *** Online Windows Binary Analyzer *** --------------------------------------------- http://labs.nccgroup.com/NCCGroupWindowsBinaryAnalyzer/ *** Firmware Forensics: Diffs, Timelines, ELFs and Backdoors *** --------------------------------------------- This post covers some common techniques that I use to analyze and reverse firmware images. These techniques are particularly useful to dissect malicious firmwares, spot backdoors and detect unwanted modifications. --------------------------------------------- http://w00tsec.blogspot.co.at/2015/02/firmware-forensics-diffs-timelines-el… *** Moodle Directory Traversal Flaw Lets Remote Users View Arbitrary Files *** --------------------------------------------- A vulnerability was reported in Moodle. A remote user can view files on the target system. The software does not properly validate user-supplied input to some scripts that serve JavaScript. A remote user can supply a specially crafted request containing the '../' string to view files on target system that are located outside of the document directory. --------------------------------------------- http://www.securitytracker.com/id/1031712 *** Cisco Security Advisories *** --------------------------------------------- Cisco AsyncOS Software Uuencode Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vunerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… --------------------------------------------- Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013…

1 0

Tageszusammenfassung - Freitag 6-02-2015
by Daily end-of-shift report 06 Feb '15

06 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-02-2015 18:00 − Freitag 06-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Filmkan: Mysterious Turkish Botnet Grows Through Facebook *** --------------------------------------------- On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/02/filmkan-mysterious-turki… *** Microsoft: Firmen entdecken Cyberattacken erst nach 243 Tagen *** --------------------------------------------- Firmen brauchen nach Angaben von Microsoft durchschnittlich 243 Tage, um eine Cyberattacke auf ihr Netzwerk zu entdecken. "Sie haben 243 Tage lang .. --------------------------------------------- http://derstandard.at/2000011347067 *** Revetons design refreshed - Winter 2015 *** --------------------------------------------- Those days Reveton is mainly pushed on adult traffic via "standalone" CVE-2015-0311 flash (posing as advert) calling an Xtea encoded stream. After not far from 2 years with the same design it's now showing some .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/02/RevetonWinter2015.html *** The Anthem Breach: What We Know Now *** --------------------------------------------- I learned about the breach directly from the CEO before all the hype and speculation hit. This is the level of caring and responsibility I personally expect as an Anthem customer. So now that the news is out there, let's talk about the technical aspects of the breach. --------------------------------------------- http://blog.beyondtrust.com/the-anthem-breach-what-we-know-now *** GE and MACTek HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01 *** Pepperl+Fuchs Hart Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device DTM library utilized in Pepperl+Fuchs' HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-02 *** CodeWrights GmbH HART Device DTM Vulnerability (Update C) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01B CodeWrights GmbH HART DTM Vulnerability that was published January 27, 2015, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01C *** Datenschutz: Wie sicher ist die IP-Telefonie? *** --------------------------------------------- Können Dritte ohne großen Aufwand IP-Telefonate mithören? Die Antwort ist wie so oft: Jein. Denn trotz mangelnder Verschlüsselung ist die IP-Telefonie nicht ganz so unsicher wie behauptet - zumindest ist es für Angreifer schwierig, Telefonate abzuhören. --------------------------------------------- http://www.golem.de/news/datenschutz-wie-sicher-ist-die-ip-telefonie-1502-1… *** Preparing for the unknown - A peek into Cyber Europe *** --------------------------------------------- ENISA is supporting Member States to cope with major cybersecurity crises with its flagship Cyber Europe programme. Five years after the first ever European wide cyber exercise, Cyber Europe evolved into a unique multinational crisis simulation which immerses participants into the unknown. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/preparing-for-the-unknown-a-pee… *** 7 Best WordPress Security Plugins *** --------------------------------------------- WordPress is the most popular blogging platform in the world. Millions of websites including various popular blogs are using WordPress as a content publishing platform. So, hackers are also more interested in hacking .. --------------------------------------------- http://resources.infosecinstitute.com/7-best-wordpress-security-plugins/ *** Neue Spuren im Sony-Hack führen nach Russland *** --------------------------------------------- Neue Indizien im Fall des Sony-Hacks sollen belegen, dass russische Hacker in den Vorfall involviert sind. Einem Bericht zufolge haben diese aktuell immer noch Zugriff auf das Netzwerk von Sony Pictures Entertainment. --------------------------------------------- http://heise.de/-2543005 *** Fessleak malvertising campaign used to serve ransomware *** --------------------------------------------- Invincea has been monitoring the Fessleak campaign in which hackers leveraged Adobe Flash Player exploits and file-less infections to serve ransomware. --------------------------------------------- http://securityaffairs.co/wordpress/33153/cyber-crime/fessleak-malvertising…

1 0

Tageszusammenfassung - Donnerstag 5-02-2015
by Daily end-of-shift report 05 Feb '15

05 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-02-2015 18:00 − Donnerstag 05-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Zero-day in the Fancybox-for-WordPress Plugin *** --------------------------------------------- Our research team was alerted to a possible malware outbreak affecting many WordPress websites. All the infections had a similar malicious iframe from '203koko' injected into the website. We were also directed to a forum thread .. --------------------------------------------- http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugi… *** SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass *** --------------------------------------------- https://www.drupal.org/node/2420139 *** Analyzing CVE-2015-0313: The New Flash Player Zero Day *** --------------------------------------------- Adobe has started rolling out an update to Flash Player which fixes the zero-day vulnerability we discussed earlier this week. This particular vulnerability can be exploited .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-20… *** Russische Malware zielt auf iOS-Geräte, saugt alle Daten ab *** --------------------------------------------- Die IT-Sicherheitsfirma "TrendLabs" berichtet, dass eine SpyWare namens XAgent sich mittlerweile auf iPhone und iPads ausgebreitet hat. Bereits vergangenes Jahr war von dem Schadprogramm die Rede, damals griff die Anwendung Windows-Rechner in Regierungsorganisationen, .. --------------------------------------------- http://derstandard.at/2000011311181 *** Sicherheitsstandards ignoriert: BMW-Hack war vermeidbar *** --------------------------------------------- Der kürzlich bekannt gewordene Hack von Autos der Marke BMW wäre auf einfache Weise vermeidbar gewesen. Das Computermagazin c’t zeigt im Detail, wie der Autokonzern zentrale .. --------------------------------------------- http://derstandard.at/2000011322698 *** Flash Zero Days Dominate Exploit Landscape *** --------------------------------------------- The recent Flash zero-day vulnerabilities and exploits have uncovered the relatively quiet Hanjuan exploit kit, and further exposed the dangers of malvertising. --------------------------------------------- http://threatpost.com/flash-zero-days-dominate-exploit-landscape/110871 *** Internet Explorer Cross-Site Scripting Vulnerability Now Public *** --------------------------------------------- Security researcher David Leo has disclosed a new vulnerability in Microsoft Internet Explorer. The vulnerability allows the same origin policy of the browser to be violated. The same-origin policy restricts how a document or .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/internet-explore… *** Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited *** --------------------------------------------- This is the tale of an ongoing SSH brute forcing campaign, targeting servers and network devices, that distributes a new family of Linux rootkit malware named 'XOR.DDoS'. While typical DDoS bots are straightforward in operation and often programmed in a high-level script such as PHP or Perl, the XOR.DDoS family is programming in C/C++ and incorporates multiple .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.ht… *** Security updates available for Adobe Flash Player (APSB15-04) *** --------------------------------------------- A Security Bulletin (APSB15-04) has been published regarding security updates for Adobe Flash Player. These updates address CVE-2015-0313, which is being actively exploited in the wild via drive-by-download attacks against systems .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1175

1 0

Tageszusammenfassung - Mittwoch 4-02-2015
by Daily end-of-shift report 04 Feb '15

04 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-02-2015 18:00 − Mittwoch 04-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New Wave of CTB-Locker/Critroni Ransomware Hitting Victims *** --------------------------------------------- There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto .. --------------------------------------------- http://threatpost.com/new-wave-of-ctb-lockercritroni-ransomware-hitting-vic… *** Advisory - Dangerous "nonce" leak in UpdraftPlus *** --------------------------------------------- Advisory for: UpdraftPlus Security Risk: High Exploitation level: Remote DREAD Score: 7/10 Vulnerability: Privilege Escalation Patched Version: 1.9.51 If you're a user of the UpdraftPlus plugin for WordPress, now is the time to update. During .. --------------------------------------------- http://blog.sucuri.net/2015/02/advisory-dangerous-nonce-leak-in-updraftplus… *** UpdraftPlus <= 1.9.50 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7781 *** 1,800 Domains Overtaken by Flash Zero Day *** --------------------------------------------- Researchers at Cisco say that a Flash zero day exploit has compromised 1,800 domains, the majority of those during a 48-hour period last week. --------------------------------------------- http://threatpost.com/1800-domains-overtaken-by-flash-zero-day/110835 *** Multiple vulnerabilities in Cisco Unified IP Phone 9900 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code *** --------------------------------------------- MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code --------------------------------------------- http://www.securitytracker.com/id/1031691 *** Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a user impersonation vulnerability in the Siemens SCALANCE X-200IRT Switch Family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-01 *** Siemens Ruggedcom WIN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in the Siemens Ruggedcom WIN firmware. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-02 *** An In-depth analysis of the Fiesta Exploit Kit: An infection in 2015 *** --------------------------------------------- A while ago I blogged about the Fiesta exploit kit, this was back in September 2013 [Fiesta Exploit Kit analysis serving MSIE exploit CVE-2013-2551] in this blog I focused on the integration of the MSIE exploit and parts of the landing page. --------------------------------------------- http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-e… *** Play Store: Weit verbreitete Apps zeigen Adware verzögert an *** --------------------------------------------- Apps aus Googles Play Store mit Downloadzahlen von stellenweise über 5 Millionen beinhalten Adware, die den Nutzer zu dubiosen Appstores oder Anwendungen mit Premium-SMS-Versand weiterleiten. Interessant ist dabei die Art und Weise, wie die Werbung an den Nutzer gebracht wird. --------------------------------------------- http://www.golem.de/news/play-store-weit-verbreitete-apps-zeigen-adware-ver… *** Threat Analysis Template For BYOD Applications *** --------------------------------------------- Your IT department is certainly not at a loss when it comes to worrying about BYOD applications. Indeed, the list of threats to enterprise applications and the data they contain is a long one, and security professionals are .. --------------------------------------------- http://resources.infosecinstitute.com/threat-analysis-template-byod-applica… *** So schützen Sie sich vor der Flash-Lücke *** --------------------------------------------- Während Adobe weiterhin keine konkreten Schutzmaßnahmen kennt oder nennt, rät das BSI ganz klar zur Deinstallation des Flash Player. Wer nicht handelt und Flash weiterhin aktiv lässt, geht ein großes Risiko ein. --------------------------------------------- http://heise.de/-2539858 *** Cisco WebEx Meetings Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Pawn Storm Update: iOS Espionage App Found *** --------------------------------------------- In our continued research on Operation Pawn Storm, we found one interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack. Background .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat…

1 0

Tageszusammenfassung - Dienstag 3-02-2015
by Daily end-of-shift report 03 Feb '15

03 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-02-2015 18:00 − Dienstag 03-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco Anyconnect and Cisco HostScan Web Launch XSS Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client and Cisco Host Scan could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the client when AnyConnect is launched through the web interface. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Integrated Management Controller of the Cisco Unified Computing System C-Series Rack Servers could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Remember Me Safely - Secure Long-Term Authentication Strategies *** --------------------------------------------- Lets say you have a web application with a user authentication system, wherein users must provide a username (or email address) and password to access certain resources. Lets also say that its properly designed (it uses .. --------------------------------------------- https://resonantcore.net/blog/2015/02/remember-me-safely-secure-long-term-a… *** How a penetration test helps you meet PCI compliance guidelines *** --------------------------------------------- In order to protect credit card data, sometimes businesses have to think like a hacker. Every year, merchants who transmit, process, or store payment card data must conduct a suite of security test... --------------------------------------------- http://www.net-security.org/article.php?id=2213 *** Trotz Update: Adobe warnt vor neuer Flash Player-Lücke *** --------------------------------------------- Nachdem vor einer Woche kritische Sicherheitslücken geschlossen wurden, muss Adobe erneut warnen --------------------------------------------- http://derstandard.at/2000011209756 *** DSA-3151 python-django - security update *** --------------------------------------------- Several vulnerabilities were discovered in Django, a high-level Pythonweb development framework. The Common Vulnerabilities and Exposuresproject identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3151 *** Creative Evasion Technique Against Website Firewalls *** --------------------------------------------- During one of our recent in-house Capture The Flag (CTF) events, I was playing with the idea of what could be done with Non-Breaking Spaces. I really wanted to win and surely there had to be a way through the existing evasion controls. This post is going to be a bit code-heavy for most end-users,Read More --------------------------------------------- http://blog.sucuri.net/2015/02/creative-evasion-technique-against-website-f… *** XSS, XFS, Open Redirect Vulnerabilities Found on About.com (SecurityWeek) *** --------------------------------------------- http://www.securityweek.com/xss-xfs-open-redirect-vulnerabilities-found-abo… *** Beware of emails pushing Google Chrome updates! *** --------------------------------------------- Google Chrome users are being actively targeted with a spam email campaign impersonating the Internet giant, urging them to download a newer version of the popular browser because theirs .. --------------------------------------------- http://www.net-security.org/malware_news.php *** Online-Erpresser verschlüsseln Datenbank und fordern 50.000 US-Dollar Lösegeld *** --------------------------------------------- Sicherheitsexperten habe eine perfide Erpressungsmasche entdeckt: Die Täter manipulieren Web-Dienste so, dass sie die von den Nutzern eingegebenen Daten verschlüsselt speichern. --------------------------------------------- http://heise.de/-2535621 *** Low VirusTotal detection rates for new malware, do they matter? *** --------------------------------------------- It is not as important as is often suggested - and doesn't mean the malware is allowed to execute.It is fairly common these days for security researchers to write about new malware attacks and point to low anti-virus detection rates when the affected sample is uploaded to VirusTotals multi-AV .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_03.xml? *** Google belohnt auch Sicherheitsforscher, die keine Lücken finden *** --------------------------------------------- Wer nach neuen Schwachstellen sucht, weiss nie, ob sich die investierte Zeit rechnet. Bei traditionellen Bug Bounties winkt schliesslich nur im Erfolgsfall Bares. Google experimentiert nun mit einem neuen Ansatz. --------------------------------------------- http://heise.de/-2535890 *** Dumping Git Data from Misconfigured Web Servers *** --------------------------------------------- Every so often when performing a penetration test against a web application or a range of external/internal servers I come across publicly accessible .git directories. Git is a revision control tool that helps keep track of .. --------------------------------------------- https://blog.netspi.com/dumping-git-data-from-misconfigured-web-servers/

1 0

Tageszusammenfassung - Montag 2-02-2015
by Daily end-of-shift report 02 Feb '15

02 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-01-2015 18:00 − Montag 02-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory for Adobe Flash Player (APSA15-02) *** --------------------------------------------- A Security Advisory (APSA15-02) has been published regarding a critical vulnerability (CVE-2015-0313) in Adobe Flash Player 16.0.0.296 and earlier versions for Windows, Macintosh and Linux. We are aware of reports that this .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1171 *** Cisco NX-OS Software TACACS+ Command Authorization Vulnerability *** --------------------------------------------- The vulnerability is due to incorrect processing of very long command-line interface (CLI) commands by the TACACS+ command authorization feature. An attacker could exploit this vulnerability by being locally authenticated and executing a long CLI command that is subject to command authorization. An exploit could allow the attacker to cause the device to reload. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cobham Sailor 900 VSAT Buffer Overflow Vulnerability *** --------------------------------------------- This alert provides early notice of uncoordinated buffer overflow vulnerability disclosure of the Cobham Sailor 900 VSAT. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-15-030-01 *** Analysis Of An Interesting Windows Kernel Change Mitigating Vulnerabilities In Some Security Products *** --------------------------------------------- Last year I started researching into the Windows kernel to get a better understanding of privilege escalation vulnerabilities. Vulnerabilities in the kernel are a serious issue as they could be used to bypass browsers sandboxes and end up compromising the entire system. In general most people .. --------------------------------------------- https://www.greyhathacker.net/?p=818 *** Akamai's state of the internet security *** --------------------------------------------- A significant increase in the number of DDoS attacks was measured in Q4 2014: a 57 percent increase compared to last quarter and a 90 percent increase compared to Q4 2013. No attack size records were broken. A new attack vector using a Christmas tree packet generated one of the quarters nine largest attacks. --------------------------------------------- http://www.stateoftheinternet.com/downloads/pdfs/2014-internet-security-rep… *** Check autorun entries with VirusTotal - Autoruns v13 *** --------------------------------------------- Version 13 of Autoruns which was release January 29, 2015 includes a very handy feature to check unknown autorun entries with Virustotal 'automatically'. It's integrated .. --------------------------------------------- http://infected.io/41/check-autorun-entries-with-virustotal-autoruns-v13 *** HipChat Security Notice and Password Reset *** --------------------------------------------- Atlassian's security team has discovered and blocked suspicious activity on the HipChat service that resulted in unauthorized access to names, usernames, email addresses, and encrypted passwords for a very small percentage (<2%) of our users. We have no evidence that any payment information was accessed. --------------------------------------------- https://blog.hipchat.com/2015/02/01/hipchat-security-notice-and-password-re… *** Dshell *** --------------------------------------------- An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. Key features: Robust stream reassembly IPv4 and IPv6 support Custom output handlers Chainable decoders --------------------------------------------- https://github.com/USArmyResearchLab/Dshell *** Multiple vulnerabilities in Wordpress-plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7777 https://wpvulndb.com/vulnerabilities/7779 https://wpvulndb.com/vulnerabilities/7778 *** RansomWeb ransomware targets companies databases *** --------------------------------------------- Encryption first added as a patch, key only removed when all backups are encrypted.Make backups, they said. Then you wont have to worry about ransomware, they said.Ransomware has quickly become one of the most frustrating kinds of cyber attack. We all know that our devices could suddenly die, and if .. --------------------------------------------- http://www.virusbtn.com/blog/2015/02_02.xml *** Internet Explorer 11 lässt Webseiten Anwender ausspionieren *** --------------------------------------------- Sicherheitsexperten haben eine Schwachstelle im Internet Explorer 11 gefunden, über die Angreifer Webseiten so manipulieren können, dass sie den Anwender ausspionieren. Ein Patch lässt noch auf sich warten – andere Web-Browser sind aber nicht anfällig. --------------------------------------------- http://heise.de/-2534975 *** Flash-Player deaktivieren! Schon wieder Angriffe auf ungepatchte Lücke *** --------------------------------------------- Und täglich grüßt die Flash-Lücke: Nur eine Woche war Ruhe, jetzt ist die nächste kritische Schwachstelle aufgetaucht. Da diese bereits ausgenutzt wird, sollte Flash wieder ein mal abgeschaltet werden. --------------------------------------------- http://heise.de/-2535100 *** OpenSSH: Key-Rotation für die Secure Shell *** --------------------------------------------- Bei der nächsten Version von OpenSSH wird es möglich sein, Server-Keys mit einem automatisierten Verfahren zu rotieren. Bislang ließen sich Schlüssel bei SSH nur mit viel .. --------------------------------------------- http://www.golem.de/news/openssh-key-rotation-fuer-die-secure-shell-1502-11…

1 0

Tageszusammenfassung - Freitag 30-01-2015
by Daily end-of-shift report 30 Jan '15

30 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-01-2015 18:00 − Freitag 30-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** The Vast World of Fraudulent Routing *** --------------------------------------------- As network security engineers have attempted to categorize blocks of IP addresses associated with spam or malware for subsequent filtering at their firewalls, the bad guys have had to evolve to continue to target their victims. Since routing ... --------------------------------------------- http://research.dyn.com/2015/01/vast-world-of-fraudulent-routing/ *** Neue Outlook-App: Microsoft liest auch bei Firmenmails mit *** --------------------------------------------- Neue App für Android und iOS mit zweifelhafter Funktionalität - Exchange- und iCloud-Passwörter online gespeichert --------------------------------------------- http://derstandard.at/2000011053283 *** The Internet of Dangerous Things *** --------------------------------------------- Distributed denial-of-service (DDoS) attacks designed to silence end users and sideline Web sites grew with alarming frequency and size last year, according to new data released this week. Those findings dovetail quite closely with .. --------------------------------------------- http://krebsonsecurity.com/2015/01/the-internet-of-dangerous-things/ *** Microsoft Publishes Information Sharing Guidelines *** --------------------------------------------- Microsoft publishes a framework and guidelines on how to effectively set up and operate threat information sharing exchanges in hopes that organizations will actually share data. --------------------------------------------- http://threatpost.com/microsoft-publishes-information-sharing-guidelines/11… *** Blubrry PowerPress <= 6.0 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7773 *** Honeywell HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-029-01 *** Multiple vulnerabilities in Cisco WebEx Meetings *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** D-Link routers vulnerable to DNS hijacking *** --------------------------------------------- Todor Donev, a member of the Ethical Hacker research team, says that the vulnerability is found in the ZynOS firmware of the device, D-Links DSL-2740R ADSL modem/wireless router. The firmware in question is implemented in many networking equipment manufactured by D-Link, TP-Link Technologies and ZTE, he noted ... Donev hasnt notified D-Link of this flaw, but has released exploit code for the flaw in a security advisory. --------------------------------------------- http://www.net-security.org/secworld.php?id=17888 *** Drei neue Versionen von Safari: Sicherheitslücken geschlossen *** --------------------------------------------- Für OS X 10.10, OS X 10.9 und OS X 10.8 stehen Updates für den Apple-Browser zur Verfügung. Sie beheben vor allem Sicherheitslücken. --------------------------------------------- http://heise.de/-2530322 *** Nearly half of all DDoS attacks uses multiple attack vectors *** --------------------------------------------- Akamai released a new security report that provides analysis and insight into the global attack threat landscape including DDoS attacks. Akamai observed a 52 percent increase in average peak band... --------------------------------------------- http://www.net-security.org/secworld.php?id=17896 *** GHOST glibc Vulnerability Affects WordPress and PHP applications *** --------------------------------------------- ... security researchers have discovered that PHP applications, including the WordPress Content Management System (CMS), could also be affected by the bug. ... According to the Sucuri researcher Marc-Alexandre Montpas, GHOST vulnerability could be a big issue for WordPress CMS, as it uses wp_http_validate_url() function to validate every pingback post URL. --------------------------------------------- http://thehackernews.com/2015/01/ghost-linux-security-vulnerability_29.html *** BMW-Patzer schürt Angst vor Hackerangriffen auf Autos *** --------------------------------------------- Schwachstelle beim deutschen Autohersteller inzwischen behoben - --------------------------------------------- http://derstandard.at/2000011080438 *** We got hacked! Now what? *** --------------------------------------------- Almost a year ago, I experienced my first real security incident. The companys bulletin board was compromised and it was my job to oversee and coordinate the incident response. The teams and I where pretty much thrown into the cold water, as weve never experienced an incident of that size before. --------------------------------------------- https://www.hashtagsecurity.com/we-got-hacked-now-what/ *** Vertipper-Domains als Geschäftsmodell *** --------------------------------------------- Einer Studie zufolge können Markeninhaber kaum verhindern, dass sogenannte Typosquatter Internet-Domains registrieren, die dem eigenen Namen nur fast entsprechen. --------------------------------------------- http://heise.de/-2533708

1 0

Tageszusammenfassung - Donnerstag 29-01-2015
by Daily end-of-shift report 29 Jan '15

29 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-01-2015 18:00 − Donnerstag 29-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** IT-Security-Links #69 *** --------------------------------------------- Trojan.Tubrosa is a new click-fraud malware. The attackers compromise victims' computers via Spam campaigns to use them to automatically inflate their YouTube video views. The malware .. --------------------------------------------- http://securityblog.switch.ch/2015/01/27/it-security-links-69/ *** Asterisk Project Security Advisory - AST-2015-002 *** --------------------------------------------- CVE-2014-8150 reported an HTTP request injection vulnerability in libcURL. Asterisk uses libcURL in its func_curl.so module (the CURL() dialplan function), as well as its res_config_curl.so (cURL realtime backend) modules. Since Asterisk .. --------------------------------------------- http://downloads.asterisk.org/pub/security/AST-2015-002.html *** ENISA Cloud Certification Schemes Metaframework *** --------------------------------------------- ENISA publishes a meta-framework and an online tool to help customers with cloud security when buying cloud services. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-cloud-certification-s… *** Debian Security Advisory DSA-3143-1 virtualbox -- security update *** --------------------------------------------- CVE-2015-0377, CVE-2015-0418. Two vulnerabilities have been discovered in VirtualBox, a x86 virtualisation solution, which might result in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3143 *** CVE-2015-0311 (Flash up to 16.0.0.287) integrating Exploit Kits *** --------------------------------------------- Patched with Flash 16.0.0.296 the CVE-2015-0311 has been first seen exploited by Angler EK ( 2015-01-20 ) , soon after used in "standalone" mode in huge malvert campaign (pushing either Reveton, either Bedep (doing adfraud and .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/cve-2015-0311-flash-up-to-1600287…

1 0

Tageszusammenfassung - Mittwoch 28-01-2015
by Daily end-of-shift report 28 Jan '15

28 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-01-2015 18:00 − Mittwoch 28-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer - Version: 36.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2755801 *** USN-2486-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Several vulnerabilities were discovered in the OpenJDK JRE related to information disclosure, data integrity and availability. An attacker could exploit these to cause a denial .. --------------------------------------------- http://www.ubuntu.com/usn/usn-2486-1/ *** VMware Security Advisories - 1 New, 1 Updated, (Wed, Jan 28th) *** --------------------------------------------- VMware has released an new and updated security advisory today. The two security advisories, listed below, address numerous vulnerabilities in the VMware .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19241 *** Magnetrol HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CodeWrights GmbH HART DTM library utilized by some Magnetrol products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-01 *** Schneider Electric Multiple Products Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's SoMove Lite software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-027-02 *** CodeWrights GmbH HART DTM Vulnerability (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01A CodeWrights GmbH HART DTM Vulnerability that was published January 13, 2015, on the ICS-CERT web site. This updated advisory provides mitigation details for an improper input validation vulnerability in CodeWrights .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01B *** Bug in ultra secure BlackPhone let attackers decrypt texts, stalk users *** --------------------------------------------- A recently fixed vulnerability in the BlackPhone instant messaging application gave attackers the ability to decrypt messages, steal contacts, and control vital functions of the device, which is marketed as a more secure way to protect communications from government and criminal snoops. --------------------------------------------- http://arstechnica.com/security/2015/01/bug-in-ultra-secure-blackphone-let-… *** CVE-2015-0016: Escaping the Internet Explorer Sandbox *** --------------------------------------------- I analyzed this vulnerability (designated as CVE-2015-0016) because it may be the first vulnerability in the wild that showed the capability to escape the Internet Explorer sandbox. As sandboxing represents a key part of exploit mitigation techniques, any exploit that can break established sandboxes is worth a second look. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-es… *** Multiple vulnerabilities in the FreeBSD kernel code *** --------------------------------------------- Francisco Falcon from the Core Exploit Writers Team found multiple vulnerabilities in the FreeBSD kernel code that implements the vt console driver (previously known as Newcons) and the .. --------------------------------------------- http://www.net-security.org/secworld.php?id=17882 *** Neue Apple-TV-Software behebt zahlreiche Sicherheitslücken *** --------------------------------------------- Neben iOS 8.1.3 und OS X 10.10.2 hat Apple am Dienstagabend auch noch ein Update der Software seiner Multimediabox veröffentlicht. Neue Funktionen hat die offenbar nicht, dafür jede Menge Fixes. --------------------------------------------- http://heise.de/-2530119 *** Apple security updates 27 Jan 2015 *** --------------------------------------------- http://support.apple.com/en-us/HT1222

1 0

Tageszusammenfassung - Dienstag 27-01-2015
by Daily end-of-shift report 27 Jan '15

27 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-01-2015 18:00 − Dienstag 27-01-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Java is the biggest vulnerability for US computers *** --------------------------------------------- Oracles Java poses the single biggest security risk to US desktops, according to a new report from Copenhagen-based security vendor Secunia ApS, because of its penetration rate, number of vulnerabilities, and patch status.According to the report, 48 percent of users arent running the .. --------------------------------------------- http://www.csoonline.com/article/2875535/application-security/java-is-the-b… *** Beyond "fake invoice" scams - crooks can get money out of real invoices, too! *** --------------------------------------------- If I told you to change your record of a suppliers bank account so I got all the payments, would you do so? 1000s of companies did, and didnt spot the misdirected payments until an average of $100,000 had gone west... --------------------------------------------- https://nakedsecurity.sophos.com/2015/01/26/beyond-fake-invoice-scams-crook… *** ENISA draws the Cyber Threat Landscape 2014: 15 top cyber threats, cyber threat agents, cyber-attack methods and threat trends for emerging technology areas *** --------------------------------------------- ENISA's Threat Landscape 2014 (ETL 2014) published today is the third yearly report in sequence, consolidating and analysing the top cyber threats and the evolution, encountered in 2014. ENISA Threat Landscape 2014, an activity contributing towards achieving the objectives formulated in the Cyber Security Strategy for the EU, stresses the importance of threat analysis and the identification of emerging trends in cyber security. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-draws-the-cyber-threa… *** Critical glibc update (CVE-2015-0235) in gethostbyname() calls *** --------------------------------------------- A heap-based buffer overflow was found in glibc's __nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call either of these functions could use this flaw to execute arbitrary code with the permissions of the user running the application. --------------------------------------------- http://ma.ttias.be/critical-glibc-update-cve-2015-0235-gethostbyname-calls/ *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe is aware of reports that CVE-2015-0311 is actively being exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows 8.1 and below. Adobe recommends .. --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb15-03.html

1 0

Tageszusammenfassung - Montag 26-01-2015
by Daily end-of-shift report 26 Jan '15

26 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-01-2015 18:00 − Montag 26-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** System Center Endpoint Protection support for Windows Server 2003 *** --------------------------------------------- >From July 14, 2015, Windows Server 2003 will cease to be a supported operating system. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/23/system-center-endpoint-p… *** Sicherheitslücke in Millionen Android-Geräten: Google empfiehlt Chrome oder Firefox als Abhilfe *** --------------------------------------------- Scharfe Kritik gibt es seit bekannt wurde, dass Google Sicherheitslücken im alten Standard-Browser von Android nicht mehr schließen will. Die Abhilfe, die Google nun empfiehlt, ist nicht so recht befriedigend. --------------------------------------------- http://heise.de/-2528130 *** OS X 10.10.2: Apple patcht "Thunderstrike"-Angriff und Googles Zeroday-Lücken *** --------------------------------------------- In der jüngsten Yosemite-Beta sollen gleich mehrere problematische Fehler behoben sein. Wann die Finalversion erscheint, bleibt unklar. Der Entdeckter von "Thunderstrike" kritisierte Apple. --------------------------------------------- http://www.heise.de/newsticker/meldung/OS-X-10-10-2-Apple-patcht-Thunderstr… *** Firewall-Update: IPFire 2.15 auf Core Update 86 aktualisiert *** --------------------------------------------- Die Aktualisierung stopft etliche Sicherheitslücken in diversen Paketen. Die Entwickler empfehlen daher dringend, das Update umgehend einzuspielen und die Firewall anschließend neu zu starten. --------------------------------------------- http://heise.de/-2528391 *** Adobe stiftet Verwirrung mit falschen Versionsangaben für Flash *** --------------------------------------------- Die Flash-Macher haben die kritische Lücke in ihrer Software endlich geschlossen. Leider vermitteln sie auf der offiziellen Flash-Webseite noch den Eindruck, die verwundbare Version wäre die neueste und damit sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/Adobe-stiftet-Verwirrung-mit-falsche… *** Factsheet: Help! My website is vulnerable to SQL injection *** --------------------------------------------- SQL injection is a popular and frequently used attack on websites, which attackers use to steal large volumes of (client) information. Although there are other types of attacks for capturing this information, SQL injection appears to be a frequently used method.A website becomes vulnerable to SQL injection when attackers are able to influence the queries sent by a website to a database. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Demystifying Cross-Site Request Forgery *** --------------------------------------------- Continuously ranked in the OWASP Top Ten, a large majority of the development community still doesnt understand Cross-Site Request Forgery (CSRF). After years of penetration tests and code reviews, my experiences show that a high percentage of applications, especially new applications, do not have proper CSRF protections in place. This post provides a refresher on CSRF and provides a common defense for this issue. --------------------------------------------- http://software-security.sans.org/blog/2015/01/23/demystifying-cross-site-r… *** Analyzing CVE-2015-0311: Flash Zero Day Vulnerability *** --------------------------------------------- Last week a major zero-day vulnerability (was found in Adobe Flash Player. Over the weekend, Adobe started releasing an update to fix the vulnerability: users who have enabled auto-update have already received the newest version (16.0.0.296). Our analysis has confirmed that the vulnerable code has been modified. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/2RZECpZzdak/ *** Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Network-Based Application Recognition (NBAR) protocol process of the Cisco 2900 Series Integrated Services Router could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability occurs when the NBAR process locks. An attacker could exploit this vulnerability by sending simple IP version 4 (IPv4) packets through the router. An exploit could allow the attacker to cause a DoS condition that would require a router restart. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Freitag 23-01-2015
by Daily end-of-shift report 23 Jan '15

23 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-01-2015 18:00 − Freitag 23-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Malvertising leading to Flash Zero Day via Angler Exploit Kit *** --------------------------------------------- Background As part of our daily research activity, we came across this blog mentioning an Angler Exploit Kit (EK) instance serving a possible zero day Adobe Flash exploit .. --------------------------------------------- http://research.zscaler.com/2015/01/malvertising-leading-to-flash-zero-day.… *** UPDATED: Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** New RATs Emerge from Leaked Njw0rm Source Code *** --------------------------------------------- In the middle of my research on the remote access Trojan (RAT) known as 'njrat' or 'Njw0rm', I stumbled upon dev-point.com, a site that disguises itself as a site for 'IT enthusiasts' but actually hosts various downloaders, different types of spyware, and RATs. I explored the site and found that they host .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-… *** Multiple vulerabilities in McAffee products *** --------------------------------------------- http://www.securitytracker.com/id/1031618 http://www.securitytracker.com/id/1031617 http://www.securitytracker.com/id/1031616 *** Google Apps Flaw Allowed Hacker to Hijack Account and Disable Two-factor Authentication *** --------------------------------------------- A critical cross-site scripting (XSS) vulnerability in the Google Apps administrator console allowed cyber criminals to force a Google Apps admins to execute just about .. --------------------------------------------- http://thehackernews.com/2015/01/google-account-hacking.html *** Google veröffentlicht weitere OS-X-Lücken *** --------------------------------------------- Im vergangenen Jahr gegründet, dreht Googles Project Zero derzeit so etwas wie eine Vorstellungstour bei den großen Softwareherstellern. Wenn auch wohl nicht ganz in deren Sinne. Nach einer Reihe von Fehlern in Microsofts Windows, ist nun offenbar Apples OS X an der Reihe. --------------------------------------------- http://derstandard.at/2000010780464 *** Microsoft lässt Server-2003-Lücke ungepatcht *** --------------------------------------------- Eine Sicherheitslücke im Netzwerkerkennungsdienst NLA von Windows Server 2003 wird nicht geschlossen, obwohl das Betriebssystem eigentlich noch Sicherheitsupdates erhalten sollte. --------------------------------------------- http://heise.de/-2526994 *** Scareware App Downloaded Over a Million Times from Google Play *** --------------------------------------------- We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/scareware-app-downloaded… *** Adobe will Flash-Lücke erst nächste Woche schliessen *** --------------------------------------------- Im Flash Player klafft eine kritische Lücke, über die Angreifer das System komplett übernehmen können. Diese wird bereits aktiv ausgenutzt. Adobe will sich trotzdem bis nächste Woche mit dem Patch Zeit lassen. --------------------------------------------- http://heise.de/-2527107 *** The Likelihood of Cyber-Terrorism Today *** --------------------------------------------- Introduction The virtual space has over time become something of real importance for business, politics, work, communities and communications. In becoming gradually more and more dependent and addicted to the Internet, .. --------------------------------------------- http://resources.infosecinstitute.com/likelihood-cyber-terrorism-today/ *** How Vulnerabilities Happen: Input Validation Problems, (Fri, Jan 23rd) *** --------------------------------------------- We would like to thank Richard Ackroyd of RandomStormfor reporting a critical input validation error in our site to us. As we have done before, here is how it happened so hopefully you can learn from it as well. Lets start with a bit of ,, --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19221 *** The Internet of Gas Station Tank Gauges *** --------------------------------------------- Automated tank gauges (ATGs) are used to monitor fuel tank inventory levels, track deliveries, raise alarms that indicate problems with the tank or gauge (such as a fuel spill), and to perform leak tests in accordance with environmental regulatory .. --------------------------------------------- https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet… *** Siemens SIMATIC S7-1200 CPU Web Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an open redirect vulnerability in the SIMATIC S7-1200 CPU family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-022-01 *** 1&1: Kundenportal akzeptierte jedes Passwort *** --------------------------------------------- Durch eine schwerwiegende Panne stand ein Reseller-Kundenportal von 1&1 sperrangelweit offen. Mit einem beliebigen Passwort bekam man administrativen Zugriff auf Hosting-Pakete und Domains - offenbar sogar auf 1und1.de, gmx.de und web.de. --------------------------------------------- http://heise.de/-2527421 *** Deja vu: PHP-Entwickler schliessen Sicherheitslücke zum zweiten Mal *** --------------------------------------------- Sicherheitsforscher Stefan Esser hat wieder zugeschlagen: Dieses Mal musste er eine von ihm entdeckte Lücke zweimal stopfen lassen. Diese erlaubt es, PHP-Applikationen unter bestimmten Bedingungen aus der Ferne anzugreifen. --------------------------------------------- http://heise.de/-2527525

1 0

Tageszusammenfassung - Donnerstag 22-01-2015
by Daily end-of-shift report 22 Jan '15

22 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-01-2015 18:00 − Donnerstag 22-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) *** --------------------------------------------- Wie der bekannte Sicherheitsforscher "Kafeine" in seinem Blog berichtet (http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…), scheint es eine neue, noch ungepatchte Sicherheitslücke im Adobe Flash Player zu geben, die aktiv von zumindest einem Exploit Kit ausgenützt wird. --------------------------------------------- https://cert.at/warnings/all/20150122.html *** Security updates available for Adobe Flash Player (APSB15-02) *** --------------------------------------------- A Security Bulletin (APSB15-02) has been published regarding security updates for Adobe Flash Player. These updates address a vulnerability (CVE-2015-0310) that could be used to circumvent memory randomization mitigations on the Windows platform. Adobe is aware of reports that an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1157 *** Security Advisory - Vulnerabilities in Pagelines/Platform theme for WordPress *** --------------------------------------------- Users of both the Pagelines and Platform themes should update as soon as possible. During a routine audit for our WAF, we found two dangerous issues: A Privilege Escalation vulnerability .. --------------------------------------------- http://blog.sucuri.net/2015/01/security-advisory-vulnerabilities-in-pagelin… *** Tubrosa threat drives millions of views to scammers' YouTube gaming videos *** --------------------------------------------- Cybercriminals are fraudulently earning advertising revenue by spreading click-fraud threat Trojan.Tubrosa, which sends compromised computers to their .. --------------------------------------------- http://www.symantec.com/connect/blogs/tubrosa-threat-drives-millions-views-… *** CTB-Locker Ransomware Includes Freemium Feature, Extends Deadline *** --------------------------------------------- Last July we came across a crypto-ransomware variant known as Critroni or Curve-Tor-Bitcoin (CTB) Locker. We observed recent improvements to the CTB malware, which now offer a 'free decryption' service, extended deadline to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ctb-locker-ranso… *** Multiple vulnerabilities in third-party Drupal-modules *** --------------------------------------------- https://www.drupal.org/node/2411737 https://www.drupal.org/node/2411539 https://www.drupal.org/node/2411527 *** Energy Harvesting: Tastatur erkennt Benutzer durch Eigenheiten beim Tippen *** --------------------------------------------- Tippe, und ich sage dir, wer du bist: Forscher in den USA und China haben eine Tastatur entwickelt, die ihren Besitzer am Tippen erkennt. Das könnte eine Ergänzung zu herkömmlichen Passwörtern sein. Die Tastatur gewinnt per Energy Harvesting elektrische Energie aus den Tippbewegungen. --------------------------------------------- http://www.golem.de/news/energy-harvesting-tastatur-erkennt-benutzer-durch-… *** Is 123456 Really The Most Common Password? *** --------------------------------------------- I recently worked with SplashData to compile their 2014 Worst Passwords List and yes, 123456 tops the list. In the data set of 3.3 million passwords I used for SplashData, almost 20,000 of those were in fact 123456. But how often do you really see people using that, or the second most common .. --------------------------------------------- https://xato.net/passwords/123456-common-password/ *** An analysis of Regins Hopscotch and Legspin *** --------------------------------------------- Perhaps one of the most interesting things we observed in the Regin malware operation are the forgotten codenames for some of its modules. We decided to analyse two of these modules in more detail. --------------------------------------------- http://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-a… *** Confluence Security Advisory - 2015-01-21 *** --------------------------------------------- We have discovered and fixed a vulnerability in our fork of WebWork. Attackers can use this vulnerability to execute Java code of their choice on systems that use this framework. The attacker needs to have an account and be able to access the Confluence web interface. --------------------------------------------- https://confluence.atlassian.com/display/DOC/Confluence+Security+Advisory+-… *** Yes, Every Freeware Download Site is Serving Crapware *** --------------------------------------------- When we wrote about what happens when you install the top ten apps from CNET Downloads, about half of the comments were from people saying, 'Well you should download from a trusted source.' The only problem is that there isn't a freeware download site that is free of crapware or adware. And here's the result of our investigation to prove it. --------------------------------------------- http://www.howtogeek.com/207692/yes-every-freeware-download-site-is-serving… *** Contact Form 3.82 - Unauthorized Language Manipulation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7761 *** Dataurization of URLs for A More Effective Phishing Campaign *** --------------------------------------------- Phishing with data: URIs is not a new idea. The concept is relatively simple, taking advantage of many user's inexperience with how data: URIs function in order to trick them into entering credentials into a phishing page. We've seen this .. --------------------------------------------- https://thehackerblog.com/dataurization-of-urls-for-a-more-effective-phishi…

1 0

Tageszusammenfassung - Mittwoch 21-01-2015
by Daily end-of-shift report 21 Jan '15

21 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-01-2015 18:00 − Mittwoch 21-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows Firewall Hook Enumeration *** --------------------------------------------- tl;dr: We're going look in detail at Microsoft Windows Firewall Hook drivers from Windows 2000, XP and 20003. This functionality was leverage ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/01/windows-firewall-hook-enumeration/ *** DSA-3133 privoxy - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3133 *** Siemens SCALANCE X-300/X408 Switch Family DOS Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for denial-of-service vulnerabilities in the Siemens SCALANCE X-300/X408 switch family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-01 *** Schneider Electric ETG3000 FactoryCast HMI Gateway Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in Schneider Electric's ETG3000 series FactoryCast HMI Gateways. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-020-02 *** Oracle Critical Patch Update Advisory - January 2015 *** --------------------------------------------- Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google publiziert ungepatchte Lücke in OS X 10.9.5 *** --------------------------------------------- Nachdem der Internetriese im Rahmen seiner Responsible-Disclosure-Politik in den vergangenen Monaten gleich drei offene Windows-Lücken öffentlich machte, ist nun erstmals auch Apple dran. Der Konzern hatte offenbar nicht in der geforderten Zeit reagiert. --------------------------------------------- http://heise.de/-2523449 *** Cisco 2015 Annual Security Report: Java ist sicherer geworden *** --------------------------------------------- 2013 war kein gutes Jahr für Java, denn etliche Sicherheitslücken sorgten für verunsicherte Anwender. Gut, dass Oracle offenbar die richtigen Weichen gestellt hat, denn im vergangenen Jahr wurden deutlich weniger Lücken festgestellt. --------------------------------------------- http://heise.de/-2523408 *** Windows Server 2003 Reaches End of Life In July *** --------------------------------------------- Several readers sent word that were now less than six months away from the end of support for Windows Server 2003. Though the operating systems usage peaked in 2009, it still runs on millions of machines, and many IT departments are just now starting to look at replacements. Although .. --------------------------------------------- http://tech.slashdot.org/story/15/01/21/0423229/windows-server-2003-reaches… *** Bash data exfiltration through DNS (using bash builtin functions) *** --------------------------------------------- After gaining 'blind' command execution access to a compromised Linux host, data exfiltration can be difficult when the system ibinbash2s protected by a firewall. --------------------------------------------- https://forsec.nl/2015/01/bash-data-exfiltration-through-dns-using-bash-bui… *** Discovering and remediating an active but disused botnet *** --------------------------------------------- On a network I help manage, we kept getting malicious DNS alerts for 'luna1.pw' on an appliance we had installed. Due to the way the network was configured, we were able to see the name request coming in but no traffic activity. This .. --------------------------------------------- http://colin.keigher.ca/2015/01/discovering-and-remediating-active-but.html *** rt-sa-2014-010 *** --------------------------------------------- The signature check of FRITZ!Box firmware images is flawed. Malicious code can be injected into firmware images without breaking the RSA signature. The code will be executed either if a manipulated firmware image is uploaded by the victim or if the victim confirms an update on the webinterface during a MITM attack. --------------------------------------------- https://www.redteam-pentesting.de/advisories/rt-sa-2014-010.txt *** Unpatched Vulnerability (0day) in Flash Player is being exploited by Angler EK *** --------------------------------------------- This is a fast post. I will update it heavily in the coming hours/days. I spotted an instance of Angler EK which is sending three different bullets targeting Flash Player : --------------------------------------------- http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-f…

1 0

Tageszusammenfassung - Dienstag 20-01-2015
by Daily end-of-shift report 20 Jan '15

20 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-01-2015 18:00 − Dienstag 20-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How Was Your Credit Card Stolen? *** --------------------------------------------- Almost once a week, I receive an email from a reader who has suffered credit card fraud and is seeking help figuring out which hacked merchant was responsible. I generally reply that this is a fruitless pursuit, and instead encourage readers to keep a close eye on their card statements and .. --------------------------------------------- http://krebsonsecurity.com/2015/01/how-was-your-credit-card-stolen/ *** Symantec Data Center Security: Server Advanced, Multiple Security Issues on Management Server and Protection Policies Rule Bypass *** --------------------------------------------- The management server for Symantec Critical System Protection (SCSP) 5.2.9 and Data Center Security: Server Advanced (SDCS:SA) 6.0.x is susceptible to security issues which could enable privileged access to the management server. Rules in the prevention policies could be bypassed if deployed to SCSP/SDCS:SA agents to restrict access to specific host functionality. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Verschlüsselung: Neue Angriffe auf RC4 *** --------------------------------------------- Zwei Forscherteams kündigen unabhängig voneinander an, bald neue Angriffe gegen den RC4-Verschlüsselungsalgorithmus vorzustellen. Knapp ein Prozent der Webserver setzt immer noch ausschließlich auf RC4. --------------------------------------------- http://www.golem.de/news/verschluesselung-neue-angriffe-auf-rc4-1501-111805… *** PlugX Malware Found in Official Releases of League of Legends, Path of Exile *** --------------------------------------------- Hacks in Taiwan (HITCON), a security conference hosted in that country, has discovered an attack involving several online games. Official releases of two popular online games were found to be compromised, downloading malware onto computers. HITCON worked with Trend Micro to provide a clean-up .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/plugx-malware-fo… *** Symantec Critical System Protection Multiple Flaws Let Remote Authenticated Users Execute Arbitrary Code, Inject SQL Commands, Conduct Cross-Site Scripting Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- Multiple vulnerabilities were reported in Symantec Critical System Protection. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. A remote authenticated .. --------------------------------------------- http://www.securitytracker.com/id/1031566 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- Multiple vulnerabilities were reported in Moodle. A remote user can cause denial of service conditions. A remote user can conduct cross-site scripting and cross-site request forgery attacks. A remote user can obtain potentially sensitive information. --------------------------------------------- http://www.securitytracker.com/id/1031557 *** F-Secure: Bios-Trojaner aufzuspüren, ist "fast aussichtslos" *** --------------------------------------------- Weil die Antivirenhersteller keine Muster von Regierungs-Malware haben, die PC-Komponenten auf Firmware-Ebene infiziert, können sie diese kaum entdecken. Mikko Hypponen von F-Secure sieht vor allem die Hardwarehersteller in der Pflicht. --------------------------------------------- http://www.golem.de/news/f-secure-bios-trojaner-aufzuspueren-ist-fast-aussi… *** Glorious Leaders Not-That-Glorious Malwares - Part 2 *** --------------------------------------------- This is second (and last) part of the analysis of Korean Central News Agency Malware. If you havent read the first part yet, I would suggest reading that first here. First of all I should mention that its not launch.exe and .. --------------------------------------------- https://www.codeandsec.com/Glorious-Leaders-Not-That-Glorious-Malwares-Part… *** Owning Modems And Routers Silently *** --------------------------------------------- Do you have cable internet? Own a surfboard modem? Since most of my buddies in AZ do, I sent them to this page and to my amusement, they got knocked off the net for a few minutes. How? Javascript. Specifically a CSRF in the Motorolla Surfboard. --------------------------------------------- http://www.gironsec.com/blog/2015/01/owning_modems_and_routers_silently/ *** Libavcodec: Fehler erlauben Codeausführung in VLC-Codecbibliothek *** --------------------------------------------- Speziell präparierte Videodateien können zur Codeausführung unter anderem in VLC genutzt werden. Dessen Entwickler verhalten sich aber zurückhaltend, zudem werfen die Berichte einige Fragen auf. --------------------------------------------- http://www.golem.de/news/libavcodec-fehler-erlauben-codeausfuehrung-in-vlc-… *** Go Static or Go Home - Inviting the Trojan Horse Inside *** --------------------------------------------- And then, after all that spending on all that complexity for defense, some of us go on to install a DCMS (Dynamic Content Management System) as our public-facing web server. This approach is like building a mighty walled city and then inviting the Trojan horse inside, or making Achilles invulnerable to harm except for his heel. --------------------------------------------- http://queue.acm.org/detail.cfm?id=2721993 *** ENISA Warns of Internet Vulnerabilities (InfoRiskToday) *** --------------------------------------------- The Internet infrastructure remains susceptible to a variety of threats, including routing attacks, DNS spoofing and poisoning attacks and distributed denial-of-service disruptions. But a number of best practices can help prevent related exploits, a new EU government study says. --------------------------------------------- http://www.inforisktoday.com/enisa-warns-internet-vulnerabilities-a-7814 *** Session Hijacking Cheat Sheet *** --------------------------------------------- 'Session Hijacking' is an old and routine topic in the field of application security. To make it more interesting, in this article, we are going to focus on different ways it can be performed. Introduction for beginners Web .. --------------------------------------------- http://resources.infosecinstitute.com/session-hijacking-cheat-sheet/ *** Paper: Nesting doll: unwrapping Vawtrak *** --------------------------------------------- Raul Alvarez unwraps the many layers of an increasingly prevalent banking trojan.Banking trojans remain one of the most prevalent kinds of malware. Among them, trojans based on Zeus have long been the most prevalent, but in recent months a relatively new trojan has been challenging the reign of Zeus: Vawtrak.Also known as Neverquest or Snifula, Vawtrak initially targeted users of Japanese banking systems, but it has since broadened its scope. In a recent paper (pdf), Sophos researcher James --------------------------------------------- http://www.virusbtn.com/blog/2015/01_20.xml *** GoDaddy CSRF Vulnerability Allows Domain Takeover *** --------------------------------------------- tl;dr: An attacker can leverage a CSRF vulnerability to take over domains registered with GoDaddy. The vulnerability has been patched. --------------------------------------------- http://breakingbits.net/2015/01/18/taking-over-godaddy-accounts-using-csrf/ *** Finding Privilege Escalation Flaws in Linux *** --------------------------------------------- We often tend to ignore privilege escalation flaws. In order to take advantage of these vulnerabilities, an attacker first needs to have access to the system itself. But in particular for systems that many users have access to, it can be difficult to monitor them all for compromised .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19207

1 0

Tageszusammenfassung - Montag 19-01-2015
by Daily end-of-shift report 19 Jan '15

19 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-01-2015 18:00 − Montag 19-01-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Survey says security products waste our time *** --------------------------------------------- A survey of information-technology professionals published on Friday found that the average large organization has to sift through nearly 17,000 malware alerts each week to find the 19 percent that are considered reliable. The efforts at .. --------------------------------------------- http://arstechnica.com/security/2015/01/survey-says-security-products-waste… *** A Lot of Security Purchases Remain Shelfware *** --------------------------------------------- Companies may be investing more in security, but many are either underutilizing their new purchases or not using them at all, an Osterman Research survey shows. --------------------------------------------- http://www.darkreading.com/a-lot-of-security-purchases-remain-shelfware/d/d… *** Report: Mercenaries Behind APT Attacks *** --------------------------------------------- An increasing number of sophisticated cyber-attacks are not being launched by governments - or their intelligence services - but rather by opportunistic mercenaries who sell whatever they can steal to the highest bidder, according to a new .. --------------------------------------------- http://www.inforisktoday.com/report-mercenaries-behind-apt-attacks-a-7806 *** Dridex Banking Trojan Begins 2015 with a Bang *** --------------------------------------------- In October, we called out a series of attacks installing the Dridex Trojan using macros in Microsoft Word documents. Those attacks continued over the last few ... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/dridex-banking-trojan-be… *** Use-after-Free: New Protections, and how to Defeat them *** --------------------------------------------- The Problem Memory corruption has plagued computers for decades, and these bugs can often be transformed into working cyber-attacks. Memory corruption is a situation where an attacker (malicious user of an application or network protocol) is .. --------------------------------------------- http://labs.bromium.com/2015/01/17/use-after-free-new-protections-and-how-t… *** Bypassing the Android PIN using fast tapping - Lock screens are still hard *** --------------------------------------------- It turns out that during that brief period we have access to the phone and if we time our actions right, we can start programs or change settings by quickly tapping on the screen. Surely it's a bit tedious to do so, but .. --------------------------------------------- http://itinsight.hu/en/posts/articles/2015-01-28-android-bypass/ *** New Guide by ENISA: Actionable Information for Security Incident Response *** --------------------------------------------- ENISA publishes a good practice guide on Actionable Information for Security Incident Response, aiming to provide a picture of the challenges national CERTs and other security organizations encounter ... --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/new-guide-by-enisa-actionab… *** VB2014 paper: OPSEC for security researchers *** --------------------------------------------- Vicente Diaz teaches researchers the basics of OPSEC.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added OPSEC for security researchers by Kaspersky researchers Vicente .. --------------------------------------------- http://www.virusbtn.com/blog/2015/01_19.xml *** DSA-3131 xdg-utils - security update *** --------------------------------------------- John Houwer discovered a way to cause xdg-open, a tool that automaticallyopens URLs in a users preferred application, to execute arbitrarycommands remotely. --------------------------------------------- https://www.debian.org/security/2015/dsa-3131 *** Hacked. A Short Story. *** --------------------------------------------- It all started when I was asked (as a freelancer) to configure exim4, so that newsletters would not fall into spam folders. They even sent me a link to a tutorial. I thought the work would take a couple of hours, including the DNS update, but I was wrong. After logging in as root, I started my favorite .. --------------------------------------------- http://kukuruku.co/hub/infosec/hacked-a-short-story-of-a-hack *** 2013-11-08: Remote code execution vulnerability in CAP 501 / CAP 505 / SMS 510 *** --------------------------------------------- http://search.abb.com/library/Download.aspx?DocumentID=1MRS757865&LanguageC… *** Tyupkin ATM Malware Analysis *** --------------------------------------------- Introduction Some time ago, Kaspersky discovered and reported a new type of malicious program called Tyupkin, which targets ATM machines by moving beyond targeting consumers with card skimmers that steal debit card numbers to directly getting cash .. --------------------------------------------- http://resources.infosecinstitute.com/tyupkin-atm-malware-analysis/ *** China: Attacke gegen Microsofts Outlook *** --------------------------------------------- Offenbar Versuch einer Man-in-the-Middle-Attacke - Angreifer wollten Verschlüsselung austricksen --------------------------------------------- http://derstandard.at/2000010596970 *** Certified Secure Advisory 14-01-2015-0.1 - PolarSSL *** --------------------------------------------- During a routine research session, Certified Secure found a "Use of uninitialized memory" vulnerability in the PolarSSL (https://polarssl.org) library. The vulnerability is present in the asn1_get_sequence_of routine that is .. --------------------------------------------- https://www.certifiedsecure.com/polarssl-advisory/ *** Traffic Patterns For CryptoWall 3.0 *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. Various sources have reported version 3 of CryptoWall has appeared [1] [2] [3]. This malware is currently seen from exploit kits and phishing emails. CryptoWall is one of many ransomware trojans that encrypt the personal files on your computer .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19203

1 0

Tageszusammenfassung - Freitag 16-01-2015
by Daily end-of-shift report 16 Jan '15

16 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-01-2015 18:00 − Freitag 16-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Definitions matter. For crying out loud, securobods, BE SPECIFIC - ENISA *** --------------------------------------------- Use your words or the DDoSers will GET you.... Definitions matter when your infrastructure is under threat says European Union Agency for Network and Information Security (ENISA). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/15/if_you_want… *** Critical Patch Update - January 2015 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2015, which will be released on Tuesday, January 20, 2015. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google AdWords Campaigns Hijacked by Malvertisers *** --------------------------------------------- Two Google AdWords campaigns have been hijacked by malvertisers and users are being redirected to fraud sites without even clicking the poisoned ads. --------------------------------------------- http://threatpost.com/google-adwords-campaigns-hijacked-by-malvertisers/110… *** Telekom-Tools für sichere Server-Konfiguration *** --------------------------------------------- Die Telekom nimmt Admins an die Hand und liefert kostenlose Tools, die bei der Härtung von nginx, MySQL und Co. helfen. --------------------------------------------- http://heise.de/-2517840 *** Sicherheitsfirmen warnen vor "Je Suis Charlie"-Trojaner *** --------------------------------------------- Vermeintliches Solidaritätsvideo lädt tatsächlich Schadsoftware auf den Rechner --------------------------------------------- http://derstandard.at/2000010489196 *** Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse *** --------------------------------------------- In particular we reveal that, even though 95 percent of the popular domains we investigated are actively targeted by typosquatters, only few trademark owners protect themselves against this practice by proactively registering their own typosquatting domains. A small fraction of those typosquatted domains -- such as gooogle.com for google.com -- were registered by the legitimate website in a bid to foil typosquatters. --------------------------------------------- https://lirias.kuleuven.be/bitstream/123456789/471369/3/typos-final.pdf *** Employee Threat Assessment Template for Large Organizations *** --------------------------------------------- Despite the popular image of the hacker cracking distant servers from his basement, studies show that people with legitimate access to your information pose an even bigger threat. And when information is stolen from within, it's often harder to trace and determine the extent of the problem. The larger your [...]The post Employee Threat Assessment Template for Large Organizations appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/employee-threat-assessment-template-l… *** Details zur kritischen Lücke im Telnet-Server von Windows *** --------------------------------------------- Auf einer chinesischen Website ist eine detaillierte Analyse der gerade erst gepatchten Telnet-Lücke aufgetaucht - und ein Proof-of-Concept. --------------------------------------------- http://heise.de/-2518951 *** Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Hosted WebEx Meeting Center Information Disclosure *** --------------------------------------------- CVE-2015-0590 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** T-Mobile Internet Manager UpdateCfg.ini SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99945 *** Alienvault OSSIM Web UI command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99951 *** Arbiter Systems 1094B GPS Clock Spoofing Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a GPS clock spoofing vulnerability in the Arbiter Systems 1094B clock. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01 *** GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation *** --------------------------------------------- This advisory provides mitigation details for a memory access violation vulnerability in GE's CIMPLICITY CimView application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02 *** Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag *** --------------------------------------------- Platform: Windows 7, 8.1 Update 32/64 bit Class: Security Bypass/Information Disclosure The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=128 *** DSA-3129 rpm - security update *** --------------------------------------------- Two vulnerabilities have been discovered in the RPM package manager. --------------------------------------------- https://www.debian.org/security/2015/dsa-3129 *** Information Disclosure in Direct Mail Subscription (direct_mail_subscription) *** --------------------------------------------- It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-in-direct-mail-sub… *** WiFi File Browser Pro v2.0.8 Code Execution Vulnerability *** --------------------------------------------- Topic: WiFi File Browser Pro v2.0.8 Code Execution Vulnerability Risk: High Text:Document Title: WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References (Source): == http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010087

1 0

Tageszusammenfassung - Donnerstag 15-01-2015
by Daily end-of-shift report 15 Jan '15

15 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-01-2015 18:00 − Donnerstag 15-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** CryptoWall 3.0 Uses I2P Anonymity Network For CC Communications (SecurityWeek) *** --------------------------------------------- Almost two months have passed since the developers of CryptoWall released an updated version of the threat, but now they’re back to work. The malware, distributed via spam and malvertising campaigns, helped cybercriminals make a lot of money last year so it’s not surprising that its authors continue improving it. --------------------------------------------- http://www.securityweek.com/cryptowall-30-uses-i2p-anonymity-network-cc-com… *** AdSense Abused with Malvertising Campaign *** --------------------------------------------- Last weekend we noticed a large number of requests to scan websites for malware because they randomly redirected to some "magazine" websites. Most of them mentioned the lemode-mgz .com site. In all cases, the symptoms were the same. Some users randomly got redirected when they clicked on links or loaded new pages. They all reported... --------------------------------------------- http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campaign.ht… *** Anatomy Of A Cyber-Physical Attack (Dark Reading) *** --------------------------------------------- "If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/anatomy-of-a-cyber-phy… *** Kritik an Apples Zwei-Faktor-Schutz *** --------------------------------------------- Apples zweistufige Bestätigung deckt mehrere Cloud-Dienste des Konzerns gar nicht ab, bemängelt eine Nutzerin - ein Angreifer könne auf diese Weise tiefe Einblicke erhalten. --------------------------------------------- http://heise.de/-2517903 *** Private Schlüssel: Gitrob sucht sensible Daten bei Github *** --------------------------------------------- Immer wieder tauchen Daten wie private Schlüssel oder Passwörter in Github-Repositories auf. Mit Hilfe von Gitrob sollen diese gefunden werden können, um sich besser zu schützen. Das öffnet aber auch die Möglichkeiten für einen interessanten Angriff. --------------------------------------------- http://www.golem.de/news/private-schluessel-gitrob-sucht-sensible-daten-bei… *** Security and Military Experts Fall For "Open" Wi-Fi *** --------------------------------------------- According to The Local, an English-language newspaper in Sweden, Gustav Nipe watched earlier this week as around 100 politicians, military officers and journalists logged into a network called “Open Guest” and proceeded to search for various non-work-related things including “forest hikes” and monitor eBay auctions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002783.html *** ATM: Attacking Multichannel Fraud (InfoRiskToday) *** --------------------------------------------- The increasing globalization of fraud perpetrated by sophisticated organized crime rings has spurred unprecedented growth in cross-channel attacks, security experts from three of the world's leading ATM manufacturers say. That's why ATM deployers can no longer build defenses that focus solely on the ATM channel, executives from Diebold Inc., Wincor Nixdorf AG and NCR Corp. say in this final part of an exclusive three-part interview with Information Security Media Group. --------------------------------------------- http://www.inforisktoday.com/interviews/atm-attacking-multichannel-fraud-i-… *** Patchday: Adobe schließt neun Lücken in Flash *** --------------------------------------------- Die Lücken, die Adobe nun in Flash geschlossen hat, betreffen alle Plattformen. Nutzer sollten die Updates schnellstmöglich installieren, da sie Angriffe aus dem Netz ermöglichen. --------------------------------------------- http://heise.de/-2517426 *** Cybercrime: Hacking als aufstrebender Wirtschaftszweig in Österreich *** --------------------------------------------- Internet-Sicherheitsbericht 2014 präsentiert - Ungeschützte Smartphones und Tablets als Ziele --------------------------------------------- http://derstandard.at/2000010445114 *** JSA10669 - 2015-01 Security Bulletin: Junos: Multiple vulnerabilities in libxml2 library *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10669&actp=RSS *** JSA10667 - 2015-01 Security Bulletin: Junos: Privilege escalation vulnerability (CVE-2014-6384) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10667&actp=RSS *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-8022 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability *** --------------------------------------------- CVE-2015-0591 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Simple Security plugin for WordPress wp-admin/users.php script cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99931 *** SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-022Project: nodeauthor (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module displays node author information in a jQuery slider.The module doesnt sufficiently sanitize Profile2 fields in a provided block.This vulnerability is mitigated by the fact that an attacker must have a user account allowed to --------------------------------------------- https://www.drupal.org/node/2407401 *** SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-021Project: Content Analysis (third-party module)Version: 6.xDate: 2014-January-14Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe Content Analysis module is an API designed to help modules that need to analyze content.The module fails to sanitize user input in log messages, leading to a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by the fact --------------------------------------------- https://www.drupal.org/node/2407395 *** SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-020Project: Contact form fields (third-party module)Version: 6.xDate: 2014-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Contact Form Fields module enables you to create additional fields to site-wide contact form.Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the --------------------------------------------- https://www.drupal.org/node/2407357 *** SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-018Project: Video (third-party module)Version: 7.xDate: 2015-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module enables you to upload, convert and playback videos.The module doesnt sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by --------------------------------------------- https://www.drupal.org/node/2407341 *** SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-015Project: Term merge (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to merge (synonymous) taxonomy terms among themselves.The module doesnt sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is --------------------------------------------- https://www.drupal.org/node/2407315 *** PHPKIT result cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99904

1 0

Tageszusammenfassung - Mittwoch 14-01-2015
by Daily end-of-shift report 14 Jan '15

14 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-01-2015 18:00 − Mittwoch 14-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AMD plugs firmware holes that allowed command injection *** --------------------------------------------- Bug your notherboard vendor for a fix, says boffin VID Chip maker AMD has patched holes across its firmware lines that could allow hackers to inject malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/14/amd_plugs_c… *** Hintergrund: Universeller SSL-Tester SSLyze *** --------------------------------------------- SSL mit Kommandozeilen-Tools von Hand zu testen, ist mühselig; SSLyze nimmt Admins viel dieser Arbeit ab. --------------------------------------------- http://www.heise.de/security/artikel/Universeller-SSL-Tester-SSLyze-2470008… *** Patchday: Microsoft stopft acht Lücken in Windows *** --------------------------------------------- Am Januar-Patchday überrascht die Firma damit, ausschließlich Lücken in Windows zu schließen. Für den Internet Explorer wird lediglich ein Patch vom Dezember noch einmal aufgewärmt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-stopft-acht-Lueck… *** MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ *** --------------------------------------------- BackgroundThe bash Shellshock vulnerability is still proven to be one of the fastest way to spread ELF malware infection to NIX boxes in internet, along with Linux system that is still serving the vulnerable version. This fact that is not knowing only by internet security folks, but by the threat actors themself. Previously we announced linux/Mayhem malwarere was utilizing the shellshock previously, and now ELF malware actors in China is starting to utilized set of tools to spread more... --------------------------------------------- http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. ... CVE number: CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb15-01.html *** Asus schließt kritische Router-Lücke *** --------------------------------------------- Liefert wenige Tage nach Bekanntwerden Updates für zahlreiche Geräte --------------------------------------------- http://derstandard.at/2000010378742 *** Amsterdam 2015 FIRST Technical Colloquium *** --------------------------------------------- The FIRST Amsterdam Technical Colloquium (TC) 2015 will be hosted by Cisco Systems in Amsterdam, Netherlands. The event will be a plenary style conference held on the 5th and 6th of May 2015, with optional, free training sessions on May 4th. FIRST is looking for speakers that would like to present at this Technical Colloquium. This is a GREAT opportunity to give something back to FIRST and the industry, while practicing your speaking skills and sharing your hard work. --------------------------------------------- http://www.first.org/events/colloquia/amsterdam2015 *** At this rate it will hit the launch codes in... 5.3 minutes. *** --------------------------------------------- Hello everyone, in this post I would like to analyze an Android application which purpose is to manage and generate passwords securely. On their Play Store page they claim to use DES to encrypt passwords on local device and that DES key is derivated from you PIN code... --------------------------------------------- https://bughardy.me/at-this-rate-it-will-hit-the-launch-codes-in-5-3-minute… *** MSRT January 2015 - Dyzap *** --------------------------------------------- This month we added the Win32/Emotet and Win32/Dyzap malware families to the Malicious Software Removal Tool. Both Emotet and Dyzap are trojans that steal personal information, including banking credentials. In a previous blog we detailed how Emotet targets German-language banking websites. In this blog, we will focus on Dyzap - another prevalent banking trojan that predominantly targets English-speaking countries. Dyzap variants target credentials for online banking, crypto... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/13/msrt-january-2015-dyzap.… *** 4 Mega-Vulnerabilities Hiding in Plain Sight (Dark Reading) *** --------------------------------------------- How four recently discovered, high-impact vulnerabilities provided "god mode" access to 90% of the Internet for 15 years, and what that means for the future. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/4-mega-vulnerabilities… *** Phony Oracle Patches Making the Rounds *** --------------------------------------------- Attackers are circulating fake fixes for Oracle error messages and the company is warning users not to download any patches that don't come directly from Oracle. --------------------------------------------- http://threatpost.com/phony-oracle-patches-making-the-rounds/110415 *** Akamai: Probleme mit alten SSL-Implementierungen *** --------------------------------------------- Akamai verarbeitet eine Billiarde an Verbindungen pro Jahr. Brian Sniffen gibt Einblicke, was das bedeutet - und welche Schwierigkeiten darin bestehen, alte SSL-Implementierungen auszusperren. (Akamai, Android) --------------------------------------------- http://www.golem.de/news/akamai-probleme-mit-alten-ssl-implementierungen-15… *** JSA10670 - 2015-01 Security Bulletin: Junos: Malformed BGP FlowSpec prefix triggers rpd crash (CVE-2014-6386) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10670&actp=RSS *** JSA10668 - 2015-01 Security Bulletin: Junos: Fragmented OSPFv3 packets with IPsec AH may trigger kernel crash (CVE-2014-6385) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10668&actp=RSS *** JSA10666 - 2015-01 Security Bulletin: Junos: Firewall filter fails to match on port (CVE-2014-6383) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10666&actp=RSS *** JSA10665 - 2015-01 Security Bulletin: Junos: jpppd core when MX Series router receives crafted PAP Authenticate-Request (CVE-2014-6382) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10665&actp=RSS *** Cisco ASA DHCPv6 Relay DoS Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability *** --------------------------------------------- CVE-2015-0579 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS ISQ XSS Vulnerability *** --------------------------------------------- CVE-2015-0577 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability *** --------------------------------------------- CVE-2014-3314 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VU#117604: Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication *** --------------------------------------------- Vulnerability Note VU#117604 Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication Original Release date: 13 Jan 2015 | Last revised: 13 Jan 2015 Overview Panasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive InformationPanasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data between the client and server. It has been reported that Active Directory --------------------------------------------- http://www.kb.cert.org/vuls/id/117604 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1031533 *** Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload *** --------------------------------------------- Topic: Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload Risk: High Text:Document Title: Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010071 *** Lexmark MarkVision Enterprise Arbitrary File Upload *** --------------------------------------------- This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A directory traversal in the fdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2. --------------------------------------------- http://www.exploit-db.com/exploits/35776/ *** Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness *** --------------------------------------------- This tool checks whether a BMC machine is vulnerable to CVE-2014-8272 (http://www.kb.cert.org/vuls/id/843044) by logging the TemporarySessionID/SessionID in each IPMI v1.5 session, and checking that these values are incremental... --------------------------------------------- http://www.exploit-db.com/exploits/35770/ *** Simple Security <= 1.1.5 - Two Cross-Site Scripting (XSS) Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7753

1 0

Tageszusammenfassung - Dienstag 13-01-2015
by Daily end-of-shift report 13 Jan '15

13 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-01-2015 18:00 − Dienstag 13-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Remember Corel? Its just entered .DLL hell *** --------------------------------------------- Hijack hole found in Corel Draw and other doodleware Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/13/hijack_hole… *** Windows logging cheat sheet - Win 7/Win 2008 or later *** --------------------------------------------- This "Windows Logging Cheat Sheet" is intended to help you get started setting up basic and necessary Windows Audit Policy and Logging. By no means is this list extensive; but it does include some very common items that should be enabled, configured, gathered and harvested for any Log Management Program. Start with these settings and add to it as you understand better what is in your logs and what you need. --------------------------------------------- http://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Log… *** Docker Secure Deployment Guidelines *** --------------------------------------------- The GitHub repository referenced below aims at providing some deployment guidelines for Docker developers and system administrators alike, that can be used to improve the security posture of Linux containers within a Dockerized environment. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guideli… *** Alert on unauthorized use of domain administrative account for Active Directory *** --------------------------------------------- At JPCERT/CC, we have observed multiple targeted attacks against domestic organizations where attackers intruded and stay within a corporate network for long periods of time and steal information. One characteristic of these attacks is that the attackers in the network steal credentials for the domain administrator account (herein, administrator account) in Active Directory, and leverage this administrator account to launch various attacks across the network. --------------------------------------------- https://www.jpcert.or.jp/english/at/2014/at140054.html *** Skeleton Key Malware Analysis *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers discovered malware that bypasses authentication on Active Directory (AD) systems that implement single-factor (password only) authentication. Threat actors can use a password of their choosing to authenticate as any user. ... Skeleton Key is deployed as an in-memory patch on a victims AD domain controllers to allow the threat actor to authenticate as any user, while legitimate users can continue to authenticate as normal. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-m… *** KeySweeper - Arduino-based Keylogger for Wireless Keyboards *** --------------------------------------------- Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any Microsoft wireless keyboard. MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device,... --------------------------------------------- http://thehackernews.com/2015/01/KeySweeper-Arduino-Keyboard-Keylogger.html *** Gitrob: Putting the Open Source in OSINT *** --------------------------------------------- Sometimes employees might publish things that should not be publicly available. Things that contain sensitive information or things that could even lead to direct compromise of a system. This can happen by accident or because the employee does not know the sensitivity of the information. Gitrob is a command line tool that can help organizations and security professionals find such sensitive information. --------------------------------------------- http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ *** Aggressive Riskware Installation on Amazon Kindle (and Android) *** --------------------------------------------- As malware continues to grow on Android (900K malicious samples and 1,300 new per day), we sometimes forget attacks can also affect other devices... like Amazons Kindle. The Kindle indeed runs Fire OS, a fork of Android. Thus, in several cases, Android malware also work on Fire OS, and reciprocally. Proof below. ... --------------------------------------------- http://blog.fortinet.com/post/aggressive-riskware-installation-on-amazon-ki… *** OSXCollector: Forensic Collection and Automated Analysis for OS X *** --------------------------------------------- OSXCollector is an open source forensic evidence collection and analysis toolkit for OS X. It was developed in-house at Yelp to automate the digital forensics and incident response (DFIR) our crack team of responders had been doing manually. --------------------------------------------- http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-an… *** ICS London 2015 *** --------------------------------------------- SANS ICS London 2015 hosts four dedicated training courses for those tasked with securing Industrial Control Systems. This specialist training event takes place at the Grand Connaught Rooms in Londons West End, from April 27th to May 2nd 2015. --------------------------------------------- https://www.sans.org/event/ics-london-2015 *** Millionen Android-Geräte mit Sicherheitslücken auf Lebenszeit *** --------------------------------------------- Eine Kernkomponente von Android wird auf Geräten mit älteren Versionen nicht mehr mit Patches versorgt. Dabei ist vor allem deren Standardbrowser Einfallstor für Angreifer. --------------------------------------------- http://www.heise.de/security/meldung/Millionen-Android-Geraete-mit-Sicherhe… *** [2015-01-13] Multiple critical vulnerabilities in all snom desktop IP phones *** --------------------------------------------- All snom desktop IP phones are affected by multiple critical security issues in all available firmware versions. Attackers are able to completely compromise the phone with root access rights and install backdoors to the device which will even survive a factory reset. Furthermore, tapping into phone calls or surveilling the room is possible. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Privilege Escalation & XSS & Missing Authentication in Ansible Tower *** --------------------------------------------- Attackers are able to elevate privileges and gain access to sensitive data of other organizations in Ansible Tower. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Cross site request forgery vulnerability in XBMC / Kodi *** --------------------------------------------- An attacker could potentially gain access to sensitive information stored on the system where XBMC / Kodi is installed by exploiting CSRF issues. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** VU#533140: Tianocore UEFI implementation reclaim function vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140 *** Cisco WebEx Meetings Server Information Disclosure Vulnerability *** --------------------------------------------- CVE-2015-0583 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** SSA-311299 (Last Update 2015-01-13): Vulnerabilities in iOS App SIMATIC WinCC Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** DFN-CERT-2015-0037 - Red Hat JBoss Data Virtualization: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0037/

1 0

Tageszusammenfassung - Montag 12-01-2015
by Daily end-of-shift report 12 Jan '15

12 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-01-2015 18:00 − Montag 12-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** SnoopSnitch Android app notifies users of IMSI catchers, SS7 attacks *** --------------------------------------------- SnoopSnitch requires a rooted device with a Qualcomm chipset that runs stock Android 4.1 or higher. --------------------------------------------- http://www.scmagazine.com/free-app-flags-attempts-to-spy-on-mobile-phones/a… *** Cisco WebEx Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SAP NetWeaver Business Client for HTML. A remote user can conduct cross-site scripting attacks. The Business Client for HTML component does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1031509 *** PLAID: Die seltsame Welt der ISO-Standards *** --------------------------------------------- Auf der Real World Crypto berichten Sicherheitsforscher über ihre Erfahrungen mit der ISO. Bei der Standardisierung des Authentifizierungsprotokolls PLAID offenbart sich teilweise eine erschreckende Unkenntnis in Sachen Kryptographie. --------------------------------------------- http://www.golem.de/news/plaid-die-seltsame-welt-der-iso-standards-1501-111… *** Dan J. Bernstein: Krypto-Algorithmen sicher designen *** --------------------------------------------- Der Kryptograph Dan Bernstein fordert auf der Real World Crypto seine Kollegen auf, kryptographische Algorithmen so zu designen, dass ein fehlerhafter Einsatz vermieden wird. Es sei keine gute Idee, immer den Programmierern die Schuld zu geben. --------------------------------------------- http://www.golem.de/news/dan-j-bernstein-krypto-algorithmen-sicher-designen… *** Google No Longer Provides Patches for WebView Jelly Bean and Prior *** --------------------------------------------- Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android's native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no… *** Securitys revamped index of pain readies for release *** --------------------------------------------- Comments sought on draft Common Vulnerability Scoring System 3.0 bug rating scheme The great unwashed has been afforded an opportunity to comment on a new scheme for classifying the severity of infosec vulnerabilities issued by the National Institute of Standards and Technology. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/12/securitys_r… *** Ntpdc Local Buffer Overflow *** --------------------------------------------- Alejandro Hdez (@nitr0usmx) recently tweeted about a trivial buffer overflow in ntpdc, a deprecated NTP query tool still available and packaged with any NTP install. He posted a screenshot of the crash as the result of a large buffer passed into a vulnerable gets call. After digging into it a bit, I decided it'd be a fun exploit to write, and it was. There are a few quarks to it that make it of particular interest, of which I've detailed below. --------------------------------------------- http://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/ *** Deciphering the landscape for Privacy by Design. ENISA publishes its recommendations for policy makers, data protection authorities and experts *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/deciphering-the-landscape-for-p… *** Windows Elevation of Privilege in User Profile Service *** --------------------------------------------- Platform: Windows 8.1 Update 32/64 bit (No other OS tested) When a user logs into a computer the User Profile Service is used to create certain directories and mount the user hives (as a normal user account cannot do so). ... However there seems to be a bug in the way it handles impersonation, the first few resources in the profile get created under the user's token, but this changes to impersonating Local System part of the way through. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=123 *** Do we need regular IT security fire drills? *** --------------------------------------------- IT security 'fire drills', supported by executive management and the risk committee should be conducted regularly in organizations, in order to understand the appropriate course of action in advance of a security breach. ... Organizations need to move beyond focusing purely on the prevention of security incidents, and start to concentrate on what they will do when an incident occurs. --------------------------------------------- http://www.net-security.org/secworld.php?id=17810 *** Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques *** --------------------------------------------- http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf *** Open-Source USB Exploitation Library - Teensyduino *** --------------------------------------------- What is Paensy? Paensy [pan-zee] is a combination of the word payload and Teensy - Paensy is an attacker-oriented, C-based library written for the development of Teensy devices. Paensy simplifies and optimizes mundane tasks and allows an easier platform for scripting. --------------------------------------------- http://malware.cat/?p=89 *** Protecting yourself from Powershell based VBA Macro Attacks *** --------------------------------------------- As some of you may know, I released a standalone Powershell script that will automatically generate a malicious VBA macro using different payloads and persistence methods. This can be found here: https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1 As a response, I have gotten a few questions from sysadmins about protecting their organizations from an attack like this. Since this type of attack relies on social engineering, there are only a handful of things you can do to --------------------------------------------- https://enigma0x3.wordpress.com/2015/01/11/protecting-yourself-from-powersh…

1 0

Tageszusammenfassung - Freitag 9-01-2015
by Daily end-of-shift report 09 Jan '15

09 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-01-2015 18:00 − Freitag 09-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AIX for penetration testers (SANS Reading Room) *** --------------------------------------------- AIX is a widely used operating system by banks, insurance companies, power stations and universities. The operating system handles various sensitive or critical information for these services. There is limited public information for penetration testers about AIX hacking, compared the other common operating systems like Windows or Linux. --------------------------------------------- https://www.sans.org/reading-room/whitepapers/unix/aix-penetration-testers-… *** Datenschutzpanne in Mac OS X Yosemite *** --------------------------------------------- Die Spotlight genannte Suchfunktion der aktuellen Mac-OS-X-Version hat erneut ein Datenschutzproblem: Stößt sie auf HTML-Mails, lädt sie ungefragt Inhalte aus externen Quellen nach - zur Freude der Spammer. --------------------------------------------- http://www.heise.de/security/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-… *** Netflix Credentials Targeted By Phishing Campaign *** --------------------------------------------- A new malicious email campaign has been observed by security researchers to target customers of Netflix by feeding them a message purporting to be an important notification from the media streaming service. ... Users are advised to check the legitimacy of the emails straight on the official page of the service and to avoid clicking on the provided link. All phishing messages can be forwarded to phishing(a)netflix.com for investigation. --------------------------------------------- http://news.softpedia.com/news/Netflix-Credentials-Targeted-By-Phishing-Cam… *** Microsoft advanced notification service changes. , (Fri, Jan 9th) *** --------------------------------------------- Quite a few of you have written in to let us know that Microsoft is changing the way in which they provide information (thanks to you all). ">You can read the full blog here --">/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx In a nutshell if you want to be advised in advance younow need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19167&rss *** Banking Trojans Disguised As ICS/SCADA Software Infecting Plants *** --------------------------------------------- Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products. A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet. --------------------------------------------- http://www.darkreading.com/attacks-breaches/banking-trojans-disguised-as-ic… *** OpenBSD Releases a Portable Version of OpenNTPD *** --------------------------------------------- Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues! --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/NJ1R-3x9MVI/story01.htm *** No, the Linux leap second bug WONT crash the web *** --------------------------------------------- Fear the fear, not the second There's a reason space missions don't launch on the day a leap second is added to international clocks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/09/leap_second… *** Asus-Router schutzlos bei Angriffen aus dem eigenen Netz *** --------------------------------------------- Mindestens die Router RT-AC66 und RT-N66U können von Angreifern aus dem LAN komplett gekapert werden. Wahrscheinlich sind weitere Modelle betroffen. Firmware-Updates, die das Loch stopfen, gibt es noch nicht. --------------------------------------------- http://www.heise.de/security/meldung/Asus-Router-schutzlos-bei-Angriffen-au… *** USN-2456-1: GNU cpio vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2456-18th January, 2015cpio vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummaryThe GNU cpio program could be made to crash or run programs if itopened a specially crafted file or received specially crafted input.Software description cpio - a program to manage archives of files DetailsMichal Zalewski discovered an out of bounds write issue in theprocess_copy_in... --------------------------------------------- http://www.ubuntu.com/usn/usn-2456-1/ *** Cisco Unified Communications Domain Manager Platform High CPU DoS Vulnerability *** --------------------------------------------- CVE-2014-8020 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Authentication Bypass Vulnerability *** --------------------------------------------- CVE-2014-8033 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-3122 curl - security update *** --------------------------------------------- Andrey Labunets of Facebook discovered that cURL, an URL transferlibrary, fails to properly handle URLs with embedded end-of-linecharacters. An attacker able to make an application using libcurl toaccess a specially crafted URL via an HTTP proxy could use this flaw todo additional requests in a way that was not intended, or insertadditional request headers into the request. --------------------------------------------- https://www.debian.org/security/2015/dsa-3122 *** DSA-3121 file - security update *** --------------------------------------------- Multiple security issues have been found in file, a tool/library todetermine a file type. Processing a malformed file could result indenial of service. Most of the changes are related to parsing ELFfiles. --------------------------------------------- https://www.debian.org/security/2015/dsa-3121 *** Emerson HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights HART DTM library utilized in Emerson's HART DTM. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-01-0 *** Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02 *** TP-Link TL-WR840N Cross Site Request Forgery *** --------------------------------------------- Topic: TP-Link TL-WR840N Cross Site Request Forgery Risk: Low Text:Classification: //Dell SecureWorks/Confidential - Limited External Distribution: # # * Title: TP-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010041 *** Wireshark Security Advisories *** --------------------------------------------- wnpa-sec-2015-05. TLS/SSL decryption crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-04. SMTP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-03. DEC DNA Routing Protocol dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-02. LPP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-01. WCCP dissector crash. Fixed in 1.12.3, 1.10.12. --------------------------------------------- https://www.wireshark.org/security/ *** Several vulnerabilities have been found in the third party TYPO3 extensions *** --------------------------------------------- extension "Content Rating": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… | extension "Content Rating Extbase": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins

1 0

Tageszusammenfassung - Donnerstag 8-01-2015
by Daily end-of-shift report 08 Jan '15

08 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-01-2015 18:00 − Donnerstag 08-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Why patch management is ALSO REQUIRED in ICS infrastructure, (Wed, Jan 7th) *** --------------------------------------------- Security patch management is a delicate issue in critical infrastructure. This is caused for the specific configuration, operating system version and related software required by the ICS platform. Most support contracts states that any modification outside the parameters stated by the manufacturer will void the relation and release manufacturer and seller from any responsibility about malfunction and any consequence on the industrial process. Unfortunately, when we talk about ICS software... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19157&rss *** Assessing the risk of POODLE, (Thu, Jan 8th) *** --------------------------------------------- One of the biggest security announcements in the last year was definitely the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, which marked the real end of SSLv3. In a contrast with many other previously identified vulnerabilities in encryption algorithms used by SSLv3, this vulnerability is viable, and can be exploited by an attacker without jumping over too many obstacles or requiring large resources the POODLE vulnerability is real. While this raised quite a bit of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19159&rss *** wmap - A Chrome Extension for Taking Screenshots of Web Services In Bulk *** --------------------------------------------- wmap is a Chrome extension written mostly in JavaScript which uses the Chrome browser to generate HTML screenshot reports of web services. --------------------------------------------- http://thehackerblog.com/wmap-a-chrome-extension-for-taking-screenshots-of-… *** B-Sides Ljubljana *** --------------------------------------------- First Security B-Sides Ljubljana is about to *happen*. BSides is community driven information security conference that will be held March 12th in Ljubljana, Slovenia, day after Cloud Security Alliance CEE Summit 2015. Call for papers is now online. --------------------------------------------- http://bsidesljubljana.si/ *** Bypassing OpenSSL Certificate Pinning in iOS Apps *** --------------------------------------------- When mobile applications communicate with an API or web service, this should generally happen via TLS/SSL (e.g., HTTPS). ... Since any of the CAs may issue a certificate for any hostname/server, security-conscious applications should "pin" the expected server certificate in the application, i.e., not accept any certificate but the one issued by the known-good CA which the application developer uses. --------------------------------------------- http://chargen.matasano.com/chargen/2015/1/6/bypassing-openssl-certificate-… *** PowerShell Toolkit: PowerSploit *** --------------------------------------------- PowerSploit is a collection of PowerShell scripts which can prove to be very useful during some exploitation and mostly post-exploitation phases of a penetration test. To get the latest version of PowerSploit, visit this URL: https://github.com/mattifestation/PowerSploit If you have GIT, then you can simply run the following command to get... --------------------------------------------- http://resources.infosecinstitute.com/powershell-toolkit-powersploit/ *** Using Free Tools To Detect Attacks On ICS/SCADA Networks *** --------------------------------------------- ICS/SCADA experts say open-source network security monitoring software is a simple and cheap way to catch hackers targeting plant operations. --------------------------------------------- http://www.darkreading.com/perimeter/using-free-tools-to-detect-attacks-on-… *** State of the Internet: Attack traffic, DDoS, IPv4 and IPv6 *** --------------------------------------------- Akamai today released its latest State of the Internet report, which provides insight into key global statistics such as connection speeds and broadband adoption across fixed and mobile networks, over... --------------------------------------------- http://www.net-security.org/secworld.php?id=17798 *** Windows exploitation in 2014 *** --------------------------------------------- Today, we published our research about Windows exploitation in 2014. This report contains interesting information about vulnerabilities in Microsoft Windows and Office patched over the course of the year, drive-by download attacks and mitigation techniques. --------------------------------------------- http://www.welivesecurity.com/2015/01/08/windows-exploitation-2014/ *** Netskope Cloud Report - January 2015 *** --------------------------------------------- In this quarterly Netskope Cloud Report, a key find in that as many as 15 percent of business users have had their credentials compromised. Since up to half of users re-use passwords for multiple accounts, the likelihood of users logging into business-critical apps with these credentials is high, putting business-sensitive data at risk. --------------------------------------------- https://www.netskope.com/reports/netskope-cloud-report-january-2015/ *** Deobfuscating Malicious Macros Using Python *** --------------------------------------------- Over the past few weeks, weve observed cybercriminals spamming users, particularly in the UK, using document files embedded with malicious macros masquerading as invoices. The attachment is either a Word or an Excel document file. Here are some examples incorporating brands based in the UK: Users must enable macros in order for these malicious documents to work. In some cases, the documents include instructions for enabling macros. You may think of document macro viruses as a thing... --------------------------------------------- http://blog.spiderlabs.com/2015/01/tips-for-deobfuscating-the-malicious-mac… *** vBulletin Releases Serious Vulnerability in VBSEO *** --------------------------------------------- The vBulletin team sent an email yesterday to all their clients about a potential security vulnerability on VBSEO. VBSEO is widely used SEO module for vBulletin that was discontinued last year. This makes the problem worse, no patches will be released for it. If you are using VBSEO, you have 3 options: Completely remove VBSEO... --------------------------------------------- http://blog.sucuri.net/2015/01/serious-vulnerability-on-vbseo.html *** Aviator Going Open Source *** --------------------------------------------- One of the most frequent criticisms we've heard at WhiteHat Security about Aviator is that it's not open source. There were a great many reasons why we didn't start off that way, not the least of which was getting the legal framework in place to allow it, but we also didn't want our efforts to... --------------------------------------------- https://blog.whitehatsec.com/aviator-going-open-source/ *** Evolving Microsofts Advance Notification Service in 2015 *** --------------------------------------------- Our Advance Notification Service (ANS) was created more than a decade ago as part of Update Tuesday to broadly communicate in advance, about the security updates being released for Microsoft products and services each month. Over the years, technology environments and customer needs have evolved, prompting us to evaluate our existing information and distribution channels. This desire to improve is why customers may have seen us introduce myBulletins to provide bulletin reports tailored to... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/01/07/evolving-advance-notific… *** OpenSSL Fixes Eight Security Vulnerabilities *** --------------------------------------------- The OpenSSL Project has released several new versions of the software that fix eight security vulnerabilities, including several certificate issues and a couple of denial-of-service flaws. The patches included in OpenSSL 1.0.0p, 1.0.1k and 0.98zd are not for critical or high-risk vulnerabilities, but they do fix some interesting vulnerabilities. Two of the bugs are rated moderate and the other... --------------------------------------------- http://threatpost.com/openssl-fixes-eight-security-vulnerabilities/110279 https://www.openssl.org/news/secadv_20150108.txt *** Cisco Secure Access Control Server Privilege Escalation Vulnerability *** --------------------------------------------- CVE-2014-8027 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- CVE-2014-8028 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Open Redirect Vulnerability *** --------------------------------------------- CVE-2014-8029 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Brother MFC-J4410DW Cross Site Scripting *** --------------------------------------------- Topic: Brother MFC-J4410DW Cross Site Scripting Risk: Low Text:Class Cross-Site Scripting Remote Yes Disclosed 9th October 2014 Published 7th January 2015 Credit Dave Daly of Dionach (vu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010034 *** Pirelli Router WPA weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99682 *** SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-010Project: Log Watcher (third-party module)Version: 6.xDate: 2015-January-07Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionLog Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types.The report administration links are not properly protected from CSRF. A malicious user could cause a log --------------------------------------------- https://www.drupal.org/node/2403463 *** SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-007Project: htaccess (third-party module)Version: 7.xDate: 2015-January-07Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Htaccess module allows the creation and deployment of .htaccess files based on custom settings.Some administration links were not properly protected from Cross Site Request Forgery (CSRF). A malicious user could cause an administrator to deploy or --------------------------------------------- https://www.drupal.org/node/2403445 *** SA-CONTRIB-2015-005 - WikiWiki - SQL injection *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-005Project: WikiWiki (third-party module)Version: 6.xDate: 2015-January-07Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: SQL InjectionDescriptionWikiWiki module gives you one place to create, share and find wiki pages in your site.The module did not sanitize user input inside a database query thereby leading to a SQL Injection vulnerability.CVE identifier(s) issuedA CVE identifier will be requested, and --------------------------------------------- https://www.drupal.org/node/2403375

1 0

Tageszusammenfassung - Mittwoch 7-01-2015
by Daily end-of-shift report 07 Jan '15

07 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-01-2015 18:00 − Mittwoch 07-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Debunking Myths Around Industrial Control Systems Cybersecurity *** --------------------------------------------- General awareness for the need to improve cybersecurity in industrial control systems (ICS) has increased significantly in recent years, but there are still plenty of misconceptions. A recent incident that can be used to highlight... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/debunking-myths-around-i… *** Who's Attacking Whom? Realtime Attack Trackers *** --------------------------------------------- It seems nearly every day were reading about Internet attacks aimed at knocking sites offline and breaking into networks, but its often difficult to visualize this type of activity. In this post, well take a look at multiple services for tracking online attacks and attackers around the globe and in real-time. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qZhz3RO9frg/ *** l+f: SSH mit Alu-Hut *** --------------------------------------------- Wer der NSA das Leben schwer machen will, kann das Fernwartungsprotokoll mit einigen Handgriffen auf der Kommandozeile abhärten. --------------------------------------------- http://www.heise.de/security/meldung/l-f-SSH-mit-Alu-Hut-2512471.html *** Inside Cryptowall 2.0 Ransomware *** --------------------------------------------- An analysis of Cryptowall 2.0 reveals that the ransomware relies on complex encryption routines and sandbox detection capabilities to survive. It also uses Tor for command and control, and can execute on 32- and 64-bit systems. --------------------------------------------- http://threatpost.com/inside-cryptowall-2-0-ransomware/110228 *** New Variant of Emotet Banking Malware targets German Users *** --------------------------------------------- A new Spam email campaign making the rounds in Germany are delivering a new variant of a powerful banking malware, a financial threat designed to steal users' online banking credentials, according to security researchers from Microsoft. The malware, identified as Emotet, was first spotted last June by security vendors at Trend Micro. The most standout features of Emotet is its network... --------------------------------------------- http://thehackernews.com/2015/01/emotet-banking-malware.html *** Linux DDoS Trojan hiding itself with an embedded rootkit *** --------------------------------------------- At the end of September 2014, a new threat for the Linux operating system dubbed XOR.DDoS forming a botnet for distributed denial-of-service attacks was reported ... In this blog post, we will describe the installation steps, the rootkit itself, and the communication protocol for getting attack commands. --------------------------------------------- https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-e… *** AOL Advertising Network Abused to Distribute Malware *** --------------------------------------------- Security researchers have uncovered a malvertising campaign used to distribute malware to visitors of The Huffington Post website, as well as several other sites, through malicious advertisements served over the AOL advertising network. At the end of last year, Cyphort Labs, security firm specialized in detecting malware threats, came across some malicious advertisements that were being --------------------------------------------- http://thehackernews.com/2015/01/aol-advertising-network-abused-to_6.html *** SPARTA - Network Infrastructure Penetration Testing Tool *** --------------------------------------------- SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenient way. If little time is spent setting up commands and tools, more time can be spent focusing on analysing results. --------------------------------------------- http://hack-tools.blackploit.com/2015/01/sparta-network-infrastructure.html *** Malformed AndroidManifest.xml in Apps Can Crash Mobile Devices *** --------------------------------------------- Every Android app comprises of several components, including something called the AndroidManifest.xml file or the manifest file. This manifest file contains essential information for apps, "information the system must have before it can run any of the app's code." We came across a vulnerability related to the manifest file that may cause an affected device... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malformed-androi… *** Interview with NYU-Poly's Professor Justin Cappos: Security Lessons From Retail Breaches *** --------------------------------------------- In our discussion, Professor Cappos has a lot to say about weaknesses with our current approach to password-based security as well as new technologies that can be applied to credit card transactions. ... Cappos offers some very practical advice on securing systems. --------------------------------------------- http://blog.varonis.com/conversation-nyu-polys-professor-justin-cappos-data… *** Is now the time to deploy embedded hypervisors for BYOD security? *** --------------------------------------------- The operating systems deployed on smartphones and tables, such as Apple IOS or Google Android, are designed as single-user platforms that dont offer much of the security or virtualization technology ... There are a number of approaches that seem viable to address the challenge including the following: ... Making enterprise or personal applications execute in a virtual machine that could either have sharply curtailed access to the device and the data it contains --------------------------------------------- http://www.zdnet.com/article/is-now-the-time-to-deploy-embedded-hypervisors… *** Spam Nation, book review: Inside todays cybercrime ecosystem *** --------------------------------------------- In Spam Nation, Krebs tells the tale of the Pharma Wars, in which duelling Russian spam kings squabble over territory, hacking each others systems, paying police to investigate each other. The even larger story is the economic conditions that fuel all this. Who clicks on these ads? --------------------------------------------- http://www.zdnet.com/article/spam-nation-book-review-inside-todays-cybercri… *** Twitter AnomalyDetection tool goes open source *** --------------------------------------------- Twitter has opened up suspicious activity tracker AnomalyDetection to developers. The social media giant said on Tuesday the tool, dubbed AnomalyDetection, is used by the firms team to detect unusual traffic events including traffic spikes and surges, as well as the presence of spam bots. --------------------------------------------- http://www.zdnet.com/article/twitter-anomalydetection-tool-goes-open-source/ *** CVE-2014-7911 - A Deep Dive Analysis of Android System Service Vulnerability and Exploitation *** --------------------------------------------- In this post we discuss CVE-2014-7911 and the various techniques that can be used to achieve privilege escalation. We also examine how some of these techniques can be blocked using several security mechanisms. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-… *** The Connections Between MiniDuke, CosmicDuke and OnionDuke *** --------------------------------------------- In September, we blogged about CosmicDuke leveraging timely, political topics to deceive the recipient into opening the malicious document. After a more detailed analysis of the files we made two major discoveries. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002780.html *** DNS-Blacklist AHBL stellt Betrieb ein *** --------------------------------------------- Die DNS-Blacklist Abusive Hosts Blocking List (AHBL) stellt ihre Dienste endgültig ein. Wer sie befragt, erhält grundsätzlich einen Treffer als Antwort. Administratoren von Mailservern müssen jetzt handeln. --------------------------------------------- http://www.heise.de/newsticker/meldung/DNS-Blacklist-AHBL-stellt-Betrieb-ei… *** US-Cert warnt vor weiteren UEFI-BIOS-Lücken *** --------------------------------------------- Durch neue Lücken kann man die Schutzmechanismen abermals austricksen. Angreifer könnten so tief im System ein Bootkit verankern, dem kein Virenscanner etwas anhaben kann. Wieder sollen BIOS-Updates helfen. --------------------------------------------- http://www.heise.de/security/meldung/US-Cert-warnt-vor-weiteren-UEFI-BIOS-L… *** JSA10663 - Out of Cycle Security Bulletin: Multiple vulnerabilities in NTP *** --------------------------------------------- Product Affected: Junos OS, NSM Series devices, NSMXpress and NSM server software. | Problem: NTP.org has published a security advisory for six vulnerabilities resolved in ntpd (NTP daemon) that have been assigned four CVE IDs. In the worst case, some of these issues may allow remote unauthenticated attackers to execute code with the privileges of ntpd or cause a denial of service condition. --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10663 *** Open-Xchange XHTML File Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031488 *** Mantis BugTracker 1.2.17 XSS / DoS / Redirect *** --------------------------------------------- Topic: Mantis BugTracker 1.2.17 XSS / DoS / Redirect Risk: Medium Text:Mantis BugTracker 1.2.17 multiple security vulnerabilities. ****************************************************************... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010024 *** Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting *** --------------------------------------------- Topic: Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting Risk: Low Text:Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35512 (Bug ID) Vulnerability ty... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010020 *** DFN-CERT-2015-0005/ - ISC BIND: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle in BIND ermöglicht einem entfernten, nicht authentifizierten Angreifer einen Denial-of-Service-Zustand zu bewirken. Die Schwachstelle wird mit einem Update auf Version 9.9.6P1 für die SUSE Linux Enterprise 11 SP3 Produkte Software Development Kit, Server, Server für VMware und Desktop behoben. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0005/ *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM QRadar SIEM (CVE-2014-3567, CVE-2014-3568, CVE-2014-3508, CVE-2014-3511) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVEs. CVE(s): CVE-2014-3567 , CVE-2014-3568 , CVE-2014-3511 and CVE-2014-3508 ... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691210 *** IBM Security Bulletin: Connect:Enterprise For UNIX and Connect:Enterprise clients are affected by the POODLE and OpenSSL vulnerabilities (CVE-2014-3566, CVE-2014-3567) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in Connect:Enterprise For UNIX, Connect:Enterprise Command Line Client, Connect:Enterprise HTTP Option, and... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21690537 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Master Data Management (CVE-2014-3511, CVE-2014-3507, CVE-2014-3506, CVE-2014-3505 ) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on August 6th, 2014 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Master Data Management. IBM InfoSphere Master Data Management has addressed the applicable CVEs provided by OpenSSL. CVE(s):... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691162 *** EMC Documentum Web Development Kit cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99632 *** EMC Documentum Web Development Kit weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99636 *** Apache Traffic Server HttpTransact Boundary Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031499 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Operational Decision Manager, WebSphere ILOG JRules and WebSphere Business Events (CVE-2014-6506, CVE-2014-6511, CVE-2014-6457, CVE-2014-6558, CVE-2014-3065) *** --------------------------------------------- There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM Operational Decision Manager (ODM), IBM ILOG JRules and IBM WebSphere Business Events (WBE). These issues were disclosed as part of the IBM... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21693686 *** DFN-CERT-2015-0012 - Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Use-after-Free-Schwachstelle in Xen ermöglicht einem lokalen, nicht authentifizierten Angreifer Denial-of-Service-Angriffe durchzuführen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0012/ *** DFN-CERT-2015-0013 - Exiv2: Eine Schwachstelle ermöglicht Denial-of-Service-Angriffe *** --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann durch einen langen 'IKEY INFO Tag' Wert in einer AVI-Datei einen Absturz der Anwendung verursachen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0013/ *** ZDI-15-006: ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-006/

1 0

Tageszusammenfassung - Montag 5-01-2015
by Daily end-of-shift report 05 Jan '15

05 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-01-2015 18:00 − Montag 05-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Before you enable those macros... *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has recently seen an increasing number of threats using macros to spread their malicious code. This technique uses spam emails and social engineering to infect a system. Using macros in Microsoft Office can help increase productivity by automating some processes. However, malware authors have also exploited these capabilities. Since Microsoft set the default setting to "Disable all macros with notification", the number of macro-related... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/02/before-you-enable-those-… *** OpenSSL Cookbook *** --------------------------------------------- A short book that covers the most frequently used OpenSSL features and commands, by Ivan Ristić. OpenSSL Cookbook is a free ebook built around one chapter from Bulletproof SSL and TLS, a larger work that teaches how to deploy secure servers and web applications. --------------------------------------------- https://www.feistyduck.com/books/openssl-cookbook/ *** Defensible network architecture, (Mon, Jan 5th) *** --------------------------------------------- For the nearly 20 years since Zwicky, Cooper and Chapman first wrote about Firewalls the firewall has been the primary defense mechanism of nearly every entity attached to the Internet. While perimeter protection is still important in the modern enterprise, the fact is that the nature of Internet business has vastly changed and the crunchy perimeter and squishy inside approach has long since become outdated. You can two aspects of your business model that you cannot do without and which can give... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19141&rss *** Snooker WPA secrets with this WiFi tool *** --------------------------------------------- Jammed and canned Crypto geek George Chatzisofroniou has published a WiFi social engineering tool used to steal credentials and credit cards from users of secure wireless networks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/05/snooker_wpa… *** Hard disk hacking *** --------------------------------------------- ... Research like this has been done before for various bits of hardware: from PCI extension cards to embedded controllers in laptops to even Apple keyboards. Usually the research has been done in order to prove the hackability of these devices can lead to compromised software, so I decided to take the same approach: for this hack, I wanted to make a hard disk that could bypass software security. --------------------------------------------- http://spritesmods.com/?art=hddhack&page=1 *** Sicherheitslücke: Bitcoinbörse Bitstamp stellt vorerst Betrieb ein *** --------------------------------------------- Schon wieder eine Bitcoinbörse gehackt? Der Anbieter Bitstamp ist wegen einer kompromittierten Wallet fürs erste offline gegangen. Nutzer sollten keinesfalls Coins auf alte Einzahladressen überweisen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-Bitcoinboerse-Bitsta… *** Several Electronic Arts Origin accounts hacked *** --------------------------------------------- Many gamers are finding purchases that they never made their accounts for Electronic Arts Origin service. Once again the gaming industry under attack. --------------------------------------------- http://securityaffairs.co/wordpress/31799/cyber-crime/electronic-arts-origi… *** Active Directory Recycle Bin: What is it, and how can I use it? *** --------------------------------------------- Remember the Windows 95 Recycle Bin? It was a big leap forward to recovering "deleted" files. Well, it turns out that Active Directory has it's own Recycle Bin for users, groups and computers, and it's called... wait for it.. the Active Directory Recycle Bin. Here's the good news about the Active Directory Recycle bin:... --------------------------------------------- http://blog.beyondtrust.com/active-directory-recycle-bin-what-is-it-and-how… *** Openwall 3.1 Released With Fixes for Shellshock, POODLE Attack *** --------------------------------------------- The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact Linux distribution for servers, appliances and... --------------------------------------------- http://threatpost.com/openwall-3-1-released-with-fixes-for-shellshock-poodl… *** ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution *** --------------------------------------------- Topic: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution # Date: 2014-10-11 # Vend... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010009 *** USN-2450-1: strongSwan vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2450-15th January, 2015 | strongswan vulnerability | A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS | Summary | strongSwan could be made to crash or run programs if it received specially crafted network traffic. | Software description | strongswan - IPsec VPN solution | Details | Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2payloads that contained the Diffie-Hellman group 1025. A remote attackercould use this... --------------------------------------------- http://www.ubuntu.com/usn/usn-2450-1/ *** VU#976132: Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script *** --------------------------------------------- Vulnerability Note VU#976132 Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections. Description According to Rafal Wojtczuk and Corey Kallenberg of The MITRE Corporation:"During the UEFI S3 Resume... --------------------------------------------- http://www.kb.cert.org/vuls/id/976132 *** VU#766164: Intel BIOS locking mechanism contains race condition that enables write protection bypass *** --------------------------------------------- Vulnerability Note VU#766164 Intel BIOS locking mechanism contains race condition that enables write protection bypass Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview A race condition exists in Intel chipsets that rely solely on the BIOS_CNTL.BIOSWE and BIOS_CNTL.BLE bits as a BIOS write locking mechanism. Successful exploitation of this vulnerability may result in a bypass of this locking mechanism. Description CWE-362: Concurrent Execution using Shared Resource with... --------------------------------------------- http://www.kb.cert.org/vuls/id/766164 *** VU#533140: UEFI EDK1 vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140

1 0

Tageszusammenfassung - Freitag 2-01-2015
by Daily end-of-shift report 02 Jan '15

02 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-12-2014 18:00 − Freitag 02-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Miss a talk from the 31st CCC this year? No worries - theyre all already available online. (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qvuog/miss_a_talk_from_the_31st_cc… *** Wordpress 4.1 XSS & CSRF Web Vulnerability *** --------------------------------------------- The Hackyard Security Group Researcher-Team leaded by 0x0A discovered a cross site request forgery issue and a cross site vulnerability in the Wordpress 4.1 --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120203 *** Log Analysis for Web Attacks: A Beginner's Guide *** --------------------------------------------- It is often the case that web applications face suspicious activities due to various reasons, such as a kid scanning a website using an automated vulnerability scanner or a person trying to fuzz a parameter for SQL Injection, etc. In many such cases, logs on the webserver have to the webserver have to be analyzed to figure out what is going on. If it is a serious case, it may require a forensic investigation. Apart from this, there are other scenarios as well. --------------------------------------------- http://resources.infosecinstitute.com/log-analysis-web-attacks-beginners-gu… *** Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability *** --------------------------------------------- An anonymous reader writes "Googles security research database has after a 90 day timeout automatically undisclosed a Windows 8.1 vulnerability which Microsoft hasnt yet patched. By design the system call NtApphelpCacheControl() in ahcache.sys allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Q5qBW3crGPY/story01.htm *** 2014 Website Defacements *** --------------------------------------------- Defacements are the most visual and obvious hack that a website can suffer from. They also come parcelled with their own exquisite sense of dread. Nothing gives that gut-wrenching feeling of "I've been hacked" more than seeing this: Most malware that we see on a daily basis is driven by some desire to profit offRead More --------------------------------------------- http://blog.sucuri.net/2015/01/website-hacks-defacements-2014.html *** Spamhaus Botnet Summary 2014 *** --------------------------------------------- As 2014 ends, Spamhaus reviews the botnet threats that it detected in the past year, and provides facts and useful suggestions for ISPs and web hosts on the front lines of the battle against cybercrime. To nobodys surprise, botnet activity appears to be increasing. The majority of detected botnets are targeted at obtaining and exploiting banking and financial information. Botnet controllers (C&Cs) are hosted disproportionately on ISPs with understaffed abuse departments, inadequate abuse --------------------------------------------- http://www.spamhaus.org/news/article/720/spamhaus-botnet-summary-2014 *** Phil Zimmerman (PGP), Ladar Levison (Lavabit), & Team release Secure Email Protocol DIME *** --------------------------------------------- Full specs here: https://darkmail.info/downloads/dark-internet-mail-environment-december-201… (PDF) Full source code (libraries) here: https://github.com/lavabit/ Website: http://darkmail.info/ --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qu2er/phil_zimmerman_pgp_ladar_lev… *** Trojan-horse hardware - a student prank demonstrates how easy it is to substitute a PIC for a dumb logic chip (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2r3cfs/trojanhorse_hardware_a_stude… *** Introduction to RFID Security *** --------------------------------------------- The main problem with RFID is related to its frequency. Someone with specific tools and enough knowledge on RFID (including complete documentation) could analyze the working frequency of an RFID tag and then decode the data or perform an attack such as cloning the RFID or doing a Denial-of-Service attack. --------------------------------------------- http://resources.infosecinstitute.com/introduction-rfid-security/ *** Hackers claim theyve found a frighteningly easy way to hack your iCloud account (Yahoo Security) *** --------------------------------------------- ... a hacker known as Pr0x13 has released a tool called iDict on GitHub that is capable of bypassing restrictions and authentication on any iCloud account, potentially giving hackers unfettered access to iOS devices. --------------------------------------------- http://news.yahoo.com/hackers-claim-ve-found-frighteningly-easy-way-hack-15…

1 0

Tageszusammenfassung - Dienstag 30-12-2014
by Daily end-of-shift report 30 Dec '14

30 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-12-2014 18:00 − Dienstag 30-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Can malware and hackers really cause giant physical disasters? *** --------------------------------------------- Could you really have a hacker or malware initiated meltdown? Yes, says the 2014 report of the German Office for Information Security... --------------------------------------------- https://nakedsecurity.sophos.com/2014/12/29/can-malware-and-hackers-really-… *** Will 2015 be the year we finally do something about DDoS? *** --------------------------------------------- Among the events of the past few days during the holidays was a DDoS attack on Sonys Playstation network and on Xbox Lives network. The attack was reportedly carried out by a group called Lizard Squad and by all measures is not .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19127 *** WhyDoWork AdSense 1.2 - XSS and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7733 *** Open Season on VNC Servers Around the World *** --------------------------------------------- VNC, or Virtual Network Computing, is a way to control computers remotely across a network. Often times computers running VNC servers are on internal networks with firewalls protecting them from outside users. No one wants a malicious user to remotely connect to their computer and have their way with their computer, right? --------------------------------------------- https://medium.com/@kylestev/open-season-on-vnc-servers-around-the-world-4b… *** Stallman: Freie Software ist die Basis für IT-Sicherheit *** --------------------------------------------- Der Vater der Freien-Software-Gemeinde, Richard Stallman, hat auf dem 31C3 freie Software zum 'notwendigen Fundament der Cybersicherheit' erklärt. Proprietäre Programme entwickelten sich immer mehr zu Malware. --------------------------------------------- http://www.heise.de/security/meldung/Stallman-Freie-Software-ist-die-Basis-… *** Expect more ransomware and extortionware in 2015 *** --------------------------------------------- While we can expect to see the return of some of the issues we faced in 2014, there are still a number of new threats that we need to be aware of in the year to come. --------------------------------------------- http://www.scmagazine.com/expect-more-ransomware-and-extortionware-in-2015/… *** 31C3: Wie man ein Chemiewerk hackt *** --------------------------------------------- Die Sicherheit von Industrieanlagen wird oft beschworen, die Praxis lässt aber viel zu wünschen übrig. Beim CCC-Congress in Hamburg zeigten Hacker, wie man Industrieanlagen lahmlegen und Millionenschäden verursachen kann. --------------------------------------------- http://www.heise.de/security/meldung/31C3-Wie-man-ein-Chemiewerk-hackt-2507… *** Researchers Find 64-bit Version of Havex RAT *** --------------------------------------------- Trend Micro researchers have come across a 64-bit version of Havex, a remote access tool that has been used in cyber espionage campaigns aimed at industrial control systems. --------------------------------------------- http://www.securityweek.com/researchers-find-64-bit-version-havex-rat *** Save Our Souls (SOS) *** --------------------------------------------- Natural disasters are unexpected events that can cause severe financial and environmental loss as well as the loss of human life. As an enterprise, it is our responsibility to ensure that proper recovery strategies are in place, just .. --------------------------------------------- http://resources.infosecinstitute.com/save-souls-sos/ *** Sicherheit: BKA schaltet Botnetz mit tausenden Rechnern ab *** --------------------------------------------- Mehr als die Hälfte der Rechner eines vom BKA zerschlagenen Botnetzes sollen in Deutschland gestanden haben. In Zusammenarbeit mit dem BSI, dem Fraunhofer Institut und Antivirenherstellern wurden die betroffenen Nutzer informiert. --------------------------------------------- http://www.golem.de/news/sicherheit-bka-schaltet-botnetz-mit-tausenden-rech… *** 4G Security: Hacking USB Modem and SIM Card via SMS *** --------------------------------------------- Telecommunications operators are pushing fast and cheap 4G communications technology. Yet only the chosen few know just how insecure it is. While researching the security level of 4G communications, Positive Technologies experts managed to uncover USB modem vulnerabilities that allow a potential attacker to gain full control of the connected computer as .. --------------------------------------------- http://blog.ptsecurity.com/2014/12/4g-security-hacking-usb-modem-and-sim.ht… Next End-of-Shift report on 2015-01-02

1 0

Tageszusammenfassung - Montag 29-12-2014
by Daily end-of-shift report 29 Dec '14

29 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-12-2014 18:00 − Montag 29-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DSA-3110 mediawiki - security update *** --------------------------------------------- A flaw was discovered in mediawiki, a wiki engine: thumb.php outputswikitext messages as raw HTML, potentially leading to cross-sitescripting (XSS). --------------------------------------------- https://www.debian.org/security/2014/dsa-3110 *** Multiple vulnerabilities in Info-ZIP UnZip *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99371 http://xforce.iss.net/xforce/xfdb/99373 http://xforce.iss.net/xforce/xfdb/99372 *** Evolution of Banking Malwares *** --------------------------------------------- Why are malware authors so interested in banking malware? Simply because this is where the money is! Nowadays, banking malware, specifically banking Trojans, are reaching alarming new levels of sophistication. Each day, new names .. --------------------------------------------- http://resources.infosecinstitute.com/evolution-banking-malwares-part-1/ http://resources.infosecinstitute.com/evolution-banking-malwares-part-2/ *** New Malware Campaign - WPcache-Blogger - Affects Thousands more WordPress Websites via RevSlider *** --------------------------------------------- If SoakSoak wasn't enough, we are starting to see a new malware campaign leveraging the RevSlider vulnerability and compromising thousands of WordPress sites in the last few days. --------------------------------------------- http://blog.sucuri.net/2014/12/new-malware-campaign-wpcache-blogger-affects… *** IBM Security AppScan Enterprise Bugs Let Remote Users Conduct Cross-Site Scrpting Attacks and Gain Full Control of the Target System *** --------------------------------------------- Several vulnerabilities were reported in IBM Security AppScan Enterprise. A remote user can execute arbitrary code on the target system. A remote authenticated user can execute arbitrary code on the target system. A remote user can conduct cross-site scripting attacks. --------------------------------------------- http://www.securitytracker.com/id/1031427 *** Multiple vulnerabilities in IPCop *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99397 http://xforce.iss.net/xforce/xfdb/99396 http://xforce.iss.net/xforce/xfdb/99398 *** ICANN: Phishing-Angriff keine Gefahr für die Rootzone *** --------------------------------------------- Von dem in der vergangenen Woche bekannt gewordenen Phishing-Angriff auf die ICANN ging keine Gefahr für die Sicherheit der Rootzone aus, versichert die Internetverwaltung. Dennoch könnte der Vorfall der ICANN politisch schaden. --------------------------------------------- http://www.heise.de/security/meldung/ICANN-Phishing-Angriff-keine-Gefahr-fu… *** ISC.org website hacked: Scan your PC for malware if you stopped by *** --------------------------------------------- Cryptographically signed BIND, DHCP code safe, were told The website for the Internet Systems Consortium, which develops the BIND DNS and ISC DHCP tools and runs some DNS root servers, has been hacked. --------------------------------------------- http://www.theregister.co.uk/2014/12/26/isc_org_hacked/ *** Vawtrak challenges almighty ZeuS as king of the botnets (The Register) *** --------------------------------------------- Crooks behind Vawtrak, a dangerous banking Trojan, are ramping up its reach and sophistication, security firms have warned. Vawtrak currently .. --------------------------------------------- http://www.theregister.co.uk/2014/12/27/vawtrak_challenges_almighty_zeus_as… *** Online-Banking und SS7-Hack: SMS-TANs sind unsicher *** --------------------------------------------- Gleich drei Vorträge am ersten Tag des jährlichen Chaos-Kongresses widmen sich Hacks rund um Mobilfunkstandards. Bereits jetzt ist klar: Sicherheitsanwendungen, die auf SMS setzen, werden unbrauchbar. Der gute alte TAN-Zettel aus Papier dürfte mehr Sicherheit bieten. --------------------------------------------- http://www.golem.de/news/online-banking-und-ss7-hack-sms-tans-sind-unsicher… *** Wieso ein Foto ausreicht, um Fingerabdruckscanner auszutricksen *** --------------------------------------------- Wissenschaftler verwendeten Foto von Händen der deutschen Verteidigungsministerin um Fingerabdruck-Attrappe zu erstellen --------------------------------------------- http://derstandard.at/2000009814288 *** Honey Pot Entertainment - SSH, (Sat, Dec 27th) *** --------------------------------------------- The Christmas period is a nice time to play with some honeypots and share some of the info they have been collecting. Currently I only have two functioning, both of them are located in the US. Each receives 20K or more login attempts per day. Im using a standard kippo installation, running as a non root user and using authbindto run the honeypoton port 22. Results are sent to a logging server for collection. One of the honeypots has no valid password so it will always fail Im mainly interested --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19121&rss *** 31C3: Thunderstrike greift MacBooks über Thunderbolt an *** --------------------------------------------- Über eine EFI-Schwachstelle lässt sich die Firmware von MacBooks manipulieren. Einmal infiziert,lässt sich der Schädling nicht einmal durch den Austausch der Festplatte entfernen. --------------------------------------------- http://www.heise.de/security/meldung/31C3-Thunderstrike-greift-MacBooks-ueb… *** C-Programmierung: Schutz für Code Pointer *** --------------------------------------------- Bugs in der Speicherverwaltung von C-Programmen gehören zu den häufigsten Sicherheitslücken. Da es aussichtslos sein dürfte, alle Lücken zu beheben, hat Mathias Prayer eine Strategie vorgestellt, mit der sich die meisten verhindern lassen. --------------------------------------------- http://www.golem.de/news/c-programmierung-schutz-fuer-code-pointer-1412-111… *** Rocket Kitten: Die Geschichte einer Malware-Analyse *** --------------------------------------------- Mit der Analyse von Malware für eine großflächige Spearphising-Attacke konnten Datenexperten die Angreifer enttarnen. In detektivischer Kleinarbeit haben sie dabei ausgefeilte Komponenten aufgedeckt und ein Land hinter dem Angriff ausgemacht. --------------------------------------------- http://www.golem.de/news/rocket-kitten-die-geschichte-einer-malware-analyse… *** Bots übernehmen Herrschaft über das Internet *** --------------------------------------------- 56 Prozent aller Webseitenbesuche nicht mehr von Menschen – Zunahme an gefährlichen Algorithmen --------------------------------------------- http://derstandard.at/2000009572838 *** Directory traversal vulnerabilities in multiple Wordpress themes *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99444 http://xforce.iss.net/xforce/xfdb/99452 http://xforce.iss.net/xforce/xfdb/99449 http://xforce.iss.net/xforce/xfdb/99447 http://xforce.iss.net/xforce/xfdb/99445 *** Massive Sicherheitslücken bei Kredit- und Bankomatkarten enthüllt *** --------------------------------------------- IT-Sicherheitsforscher zeigen am 31C3, dass Systeme trotz PIN einfach zu knacken sind .. --------------------------------------------- http://derstandard.at/2000009849645 *** Null Byte Injection in PHP *** --------------------------------------------- The null character is a control character with the value zero. It is presented in many character sets such as ASCII (American Standard Code of for Information Interchange), Unicode (Universal Character Set) and EBCDIC .. --------------------------------------------- http://resources.infosecinstitute.com/null-byte-injection-php/ *** Lücken in Industrieanlagen: Nicht nur Banken und Webseiten sollen verteidigt werden *** --------------------------------------------- Hacker sollen sich nicht mehr um die Sicherheit des Geldes und Daten von anderen kümmern. Stattdessen gilt es, den Fokus auf Industrieanlagen zu richten, auch, um Menschenleben zu schützen. (31C3, Netzwerk) --------------------------------------------- http://www.golem.de/news/luecken-in-industrieanlagen-nicht-nur-banken-und-w… *** Prying Eyes: Inside the NSAs War on Internet Security *** --------------------------------------------- US and British intelligence agencies undertake every effort imaginable to crack all types of encrypted Internet communication. The cloud, it seems, is full of holes. The good news: New Snowden documents show that some forms of encryption still cause problems for the NSA. --------------------------------------------- http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-interne…

1 0

Tageszusammenfassung - Dienstag 23-12-2014
by Daily end-of-shift report 23 Dec '14

23 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-12-2014 18:00 − Dienstag 23-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco Jabber Guest Server *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SoakSoak Campaign Evolves - New Wave of Attacks *** --------------------------------------------- Since Sunday, we have seen a new wave of SoakSoak reinfections. The Javascript continues to evolve and load other scripts in order to infect additional websites. We have updates for concerned webmasters looking to stay on top of the threat and .. --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-new-wave-evolution-attacks.html *** Apache CXF Certificate Validation Flaw Lets Remote Users Spoof SSL Servers *** --------------------------------------------- Apache CXF Certificate Validation Flaw Lets Remote Users Spoof SSL Servers. A remote user with the ability to conduct a man-in-the-middle attack can supply a specially crafted host name in an X.509 certificate subject's .. --------------------------------------------- http://www.securitytracker.com/id/1031419 *** Multiple vulnerabilities in VDG products *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99331 http://xforce.iss.net/xforce/xfdb/99334 http://xforce.iss.net/xforce/xfdb/99333 http://xforce.iss.net/xforce/xfdb/99332 *** Anunak: So geht Bankraub im 21. Jahrhundert *** --------------------------------------------- Die Security-Spezialisten von Fox-IT und Group-IB dokumentieren die Aktivitäten einer russischen Bande, die in die Netze von Banken eingebrochen ist und von dort aus Geldautomaten ausgeräumt hat. Rund 25 Millionen Dollar haben die so geklaut. --------------------------------------------- http://www.heise.de/security/meldung/Anunak-So-geht-Bankraub-im-21-Jahrhund… *** Top Facebook scams and malware attacks *** --------------------------------------------- Millions of people fell for Facebook scams in 2014. Though security experts, companies and tech-savvy users guard against Facebook cyber attacks, many unwary users continue to fall victim to scams on ... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2935 *** BSI-Kryptohandys: Kaum Anschluss unter dieser Nummer *** --------------------------------------------- Die Geräte sind angeblich sehr sicher und gewiss sehr teuer. Doch weil die vom BSI zertifizierten Kryptohandys viele Nachteile haben, liegen sie häufig in den Schubladen. Muss das so sein? --------------------------------------------- http://www.golem.de/news/bsi-kryptohandys-kaum-anschluss-unter-dieser-numme… *** NTP Daemon unter OS X: Kurzfristiges Update schließt Zeitserver-Sicherheitslücke *** --------------------------------------------- Apple hat ein Sicherheitsupdate für OS X veröffentlicht, das jeder installieren sollte. Geschlossen wird damit eine unangenehme Sicherheitslücke im Dienst für das Network Time Protocol. --------------------------------------------- http://www.golem.de/news/ntp-daemon-unter-os-x-kurzfristiges-update-schlies… *** Linux-Kernel: Live Patching soll im Frühjahr 2015 bereitstehen *** --------------------------------------------- Die Kernel-Entwickler wollen die Live-Patching-Technik mit Linux 3.20 im kommenden Frühjahr veröffentlichen. Zuvor soll der Code in Linux-Next aufgenommen werden. Ob dies tatsächlich geschieht, steht noch aus. --------------------------------------------- http://www.golem.de/news/linux-kernel-live-patching-soll-im-fruehjahr-2015-… *** Patches Not Cure-all for Shellshock *** --------------------------------------------- Earlier this year, Linux system administrators all over the world had to deal with the Shellshock vulnerability, which could lead to malicious code being run on Linux systems. Servers running various web services were at particular risk. By now, most major distributions have been able to .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/patches-not-cure… Next End-of-Shift report on 2014-12-29

1 0

Tageszusammenfassung - Montag 22-12-2014
by Daily end-of-shift report 22 Dec '14

22 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-12-2014 18:00 − Montag 22-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** TA14-353A: Targeted Destructive Malware *** --------------------------------------------- Original release date: December 19, 2014 Systems Affected Microsoft Windows Overview US-CERT was recently notified by a trusted third party of cyber threat actors using a Server Message Block (SMB) Worm Tool to conduct cyber exploitation activities targeting a major entertainment .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-353A *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** iTwitter <= 0.04 - XSS & CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7729 *** Network Time Protocol Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities within the Network Time Protocol (NTP). --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-353-01 *** Post to Twitter <= 0.7 CSRF & XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7730 *** Which NTP Servers do You Need to Patch? *** --------------------------------------------- While people generally know where their real NTP servers are, all to often they dont know that theyve got a raft of accidental NTP servers - boxes that have NTP enabled without the system maintainers knowing about it. Common servers .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19095 *** Tor-Projekt wappnet sich gegen möglichen Angriff *** --------------------------------------------- Das Tor-Projekt befürchtet eine Beschlagnahmung wichtiger Infrastruktur-Server, die das Anonymisierungsnetz unbenutzbar machen könnte. Einem anonymen Tipp zufolge stehe diese schon in wenigen Tagen bevor. --------------------------------------------- http://www.heise.de/security/meldung/Tor-Projekt-wappnet-sich-gegen-moeglic… *** Compromised Wordpress sites serving multiple malware payloads *** --------------------------------------------- During our daily log monitoring process, we observe many interesting threat events. One such event led to a compromised WordPress site campaign, which was found to serve multiple malware families including Upatre/Hencitor/Extrat Xtreme .. --------------------------------------------- http://research.zscaler.com/2014/12/compromised-wordpress-sites-serving.html *** Neue NTP-Versionen fixen Fehler im Zeit-Server *** --------------------------------------------- Mit nur einem Paket könnte ein Angreifer Zeit-Server mit dem NTP-Dienst übernehmen. Admins sollten ihre Konfiguration checken und bei Bedarf das Abhilfe versprechende Update so schnell wie möglich einspielen. --------------------------------------------- http://www.heise.de/security/meldung/Neue-NTP-Versionen-fixen-Fehler-im-Zei… *** Südkorea führt Übungen zur Hacker-Abwehr an Atomkraftwerken durch *** --------------------------------------------- Nach der Enthüllung geschützter Informationen über zwei südkoreanische Atomreaktoren im Internet hat der Betreiber eine zweitägige Übungen zur Abwehr von Cyber-Attacken begonnen. Die Übungen würden an vier von 23 Reaktorstandorten im Land durchgeführt, teilte eine Sprecherin der staatlichen Koreanischen Wasser- und Atomenergie-Gesellschaft (KHNP) am Montag mit. --------------------------------------------- http://derstandard.at/2000009692066 *** Pattern-Based Approach for In-Memory ShellCodes Detection *** --------------------------------------------- Introduction During an analysis, it can be really useful to know some common instructions with which malware, and more specifically shellcodes, achieve their goals. As we can imagine, these sets of common instructions could be used .. --------------------------------------------- http://resources.infosecinstitute.com/pattern-based-approach-memory-shellco… *** Is this URL safe? Hiding Malware in Plain Sight From Online Scanners *** --------------------------------------------- There are serveral sites which offer scanning a URL for malware. One should expect that these sites emulate a real browser good enough so that their rating can be trusted. Unfortunatly this is not the case. --------------------------------------------- http://noxxi.de/research/content-encoding-online-scanner.html *** Mikl-Leitner will Cybercrime-Gesetz bis 2018 *** --------------------------------------------- Ein Cybercrime-Gesetz soll bis zum Ende dieser Legislaturperiode, also 2018, beschlossen werden. Dieses Ziel nannte Innenministerin Johanna Mikl-Leitner (ÖVP) bei einer Pressekonferenz am Montag in Wien. Anlass war die Präsentation der Erkenntnisse aus einem Planspiel, bei dem es um einen Hackerangriff auf den Flughafen Wien und einen Erpressungsversuch mit terroristischem Hintergrund ging. --------------------------------------------- http://derstandard.at/2000009710328 *** PHP 5.6.3 unserialize() execute arbitrary code *** --------------------------------------------- A while ago the function "process_nested_data" was changed to better handle object properties. Before it was possible to create numeric object properties which would cause .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120160

1 0

Tageszusammenfassung - Freitag 19-12-2014
by Daily end-of-shift report 19 Dec '14

19 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-12-2014 18:00 − Freitag 19-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Misfortune Cookie crumbles router security: 12 MILLION+ in hijack risk *** --------------------------------------------- Homes, businesses menaced by vulnerable software exposed to the internet Infosec biz Check Point says it has discovered a critical software vulnerability that allows hackers to hijack home and small business broadband routers across the web. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/18/misfortune_… *** Metasploit Weekly Wrapup: Get the 411 *** --------------------------------------------- This week, we released Metasploit version 4.11 to the world -- feel free to download it here if you're the sort that prefers the binary install over the somewhat Byzantine procedure for setting up a development environment. Which you should be, because the binary installers (for Windows and Linux) have all the dependencies baked in and you don't have to monkey around with much to get going. The two major features with this release center around reorganizing the bruteforce workflow to make things more sensible and usable for larger-scale password audits, and much better visualization on figuring out where the weak link is/was in the organization under test when stolen credentials were used to extend control. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/12/18/metasploi… *** Vulnerability announced: update your Git clients *** --------------------------------------------- A critical Git security vulnerability has been announced today, affecting all versions of the official Git client and all related software that interacts with Git repositories, including GitHub for Windows and GitHub for Mac. Because this is a client-side only vulnerability, github.com and GitHub Enterprise are not directly affected. The vulnerability concerns Git and Git-compatible clients that access Git repositories in a case-insensitive or case-normalizing filesystem. --------------------------------------------- https://github.com/blog/1938-vulnerability-announced-update-your-git-clients *** How Cybercriminals Dodge Email Authentication *** --------------------------------------------- Email authentication and validation is one method that is used to help bring down the levels of spam and phishing by identifying senders so that malicious emails can be identified and discarded. Two frameworks are in common usage today; these are SPF and DKIM. SPF (Sender Policy Framework): Defined in RFC 7208, SPF provides a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/27Kj0gN8uNo/ *** Smart grid security certification in Europe: Challenges and Recommendations *** --------------------------------------------- ENISA issues today a report on Smart grid security certification in Europe targeted at EU Member States (MS), the Commission, certification bodies and the private sector; with information on several certification approaches across the EU and other MS and EFTA countries. It describes the specific European situation, and discusses the advantages and challenges towards a more harmonised certification practice. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/smart-grid-security-certifi… *** USBDriveby Device Can Install Backdoor, Override DNS Settings in Seconds *** --------------------------------------------- Samy Kamkar has a special talent for turning seemingly innocuous things into rather terrifying attack tools. First it was an inexpensive drone that Kamkar turned into a flying hacking platform with his Skyjack research, and now it's a $20 USB microcontroller that Kamkar has loaded with code that can install a backdoor on a target machine in... --------------------------------------------- http://threatpost.com/usbdriveby-device-can-install-backdoor-override-dns-s… *** TA14-352A: Server Message Block (SMB) Worm Tool *** --------------------------------------------- Unknown cyber-threat actors have been identified employing sophisticated malware, and Indicators of Compromise (IOC) have been provided to mitigate this threat. --------------------------------------------- http://www.exploitthis.com/2014/12/ta14-352a-server-message-block-smb-worm-… *** Save the date: ENISA Workshop on EU Threat Landscape *** --------------------------------------------- 24th February 2015, Hotel Metropole, Brussels --------------------------------------------- http://www.enisa.europa.eu/media/news-items/save-the-date-enisa-workshop-on… *** SS7 Vulnerabilities *** --------------------------------------------- There are security vulnerability in the phone-call routing protocol called SS7. The flaws discovered by the German researchers are actually functions built into SS7 for other purposes -- such as keeping calls connected as users speed down highways, switching from cell tower to cell tower -- that hackers can repurpose for surveillance because of the lax security on the network.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/ss7_vulnerabili.html *** Information-stealing Vawtrak malware evolves, becomes more evasive *** --------------------------------------------- SophosLabs has recently observed some cunning changes made by the authors of the dangerous banking malware Vawtrak. James Wyke explains. --------------------------------------------- https://nakedsecurity.sophos.com/2014/12/19/information-stealing-vawtrak-ma… *** Emerson Patches Series of Flaws in Controllers Used in Oil and Gas Pipelines *** --------------------------------------------- Researchers have identified a wide range of vulnerabilities in remote terminal units manufactured by Emerson Process Management that are widely used in oil and gas pipelines and other applications. The vulnerabilities include a number of hidden functions in the RTUs, an authentication bypass and hardcoded credentials. All of the vulnerabilities are remotely exploitable and an... --------------------------------------------- http://threatpost.com/emerson-patches-series-of-flaws-in-controllers-used-i… *** Novell - Patches for GroupWise and eDirectory *** --------------------------------------------- https://download.novell.com/Download?buildid=tveSooKDw3Q~ https://download.novell.com/Download?buildid=mdWLZGP0Glk~ https://download.novell.com/Download?buildid=gHTDteZoK34~ https://download.novell.com/Download?buildid=3dJODsdcDKE~ *** Subversion mod_dav_svn URI Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031403 *** Subversion mod_dav_svn REPORT Request Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031402 *** Honeywell Experion PKS Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in Honeywell's Experion Process Knowledge System (EPKS) application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-352-01 *** Innominate mGuard Privilege Escalation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a privilege escalation vulnerability affecting all mGuard devices. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-352-02 *** Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities (Update C) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-329-02B Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published December 11, 2014, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-02C *** Emerson ROC800 Multiple Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-13-259-01A Emerson ROC800 Multiple Vulnerabilities that was published December 2, 2014, on the NCCIC/ICS CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-13-259-01B *** [2014-12-19] XSS & Memory Disclosure vulnerabilities in NetIQ eDirectory NDS iMonitor *** --------------------------------------------- Two vulnerabilities in the NetIQ eDirectory iMonitor allow an attacker to take over a user session and potentially leak sensitive data. An attacker could compromise an administrative account and e.g. tamper a centralized user database. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Live Forms <= 1.2.0 - Unauthenticated Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7728

1 0

Tageszusammenfassung - Donnerstag 18-12-2014
by Daily end-of-shift report 18 Dec '14

18 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-12-2014 18:00 − Donnerstag 18-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Is the polkit Grinch Going to Steal your Christmas?, (Wed, Dec 17th) *** --------------------------------------------- Alert Logic published a widely publizised blog outlining a common configuration problem with Polkit. To help with dissemination, Alert Logic named the vulnerability Grinch [1] . In some ways, this isnt so much a vulnerability, as more a common overlypermissive configuration of many Linux systems. It could easily be leveraged to escalate privileges beyond the intent of the polkitconfiguration. Lets first step back: In the beginning, there was sudo. Sudo served the Unix community well for many... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19077&rss *** Application Threat and Usage Report 2014 *** --------------------------------------------- The Application Usage And Threat Report provides an analysis of applications and their link to cyber threats within the enterprise. The report summarizes network traffic assessments performed wor... --------------------------------------------- http://www.net-security.org/secworld.php?id=17609 *** Erfolgreicher Angriff auf Internet-Verwaltung ICANN *** --------------------------------------------- U.a. wurde ein zentrales System, das zur Organisation bei der Einführung der neuen Top Level Domains dient, bei einem Angriff auf die ICANN kompromittiert. Die ICANN dient als Oberaufsicht über die Verwaltung von Netz-Ressourcen wie DNS und IP-Adressen. --------------------------------------------- http://www.heise.de/security/meldung/Erfolgreicher-Angriff-auf-Internet-Ver… *** Your Browser is (not) Locked *** --------------------------------------------- Most ransomware has a binary file that needs to be executed before it can infect your PC. Ransomware usually relies on social engineering or exploits to infect unsuspecting users. However, some malware authors are bypassing this requirement with a new trick - browser lockers. Unlike traditional ransomware threats that lock the entire desktop, browser lockers only lock the web browser of an infected PC. Most other malware needs a user (or other malware) to manually run it. Browser lockers... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/12/17/your-browser-is-not-lock… *** Chthonic: a New Modification of ZeuS *** --------------------------------------------- In the fall of 2014, we discovered a new banking Trojan, which caught our attention for two reasons... --------------------------------------------- http://securelist.com/blog/virus-watch/68176/chthonic-a-new-modification-of… *** Ars Technica readers urged to change passwords in wake of hack *** --------------------------------------------- In case you havent heard already, Ars Technica got hacked over the weekend, so if you are a subscribed reader now would be a good time to change your password. "At 20:00 CT on December 14, an Inte... --------------------------------------------- http://www.net-security.org/secworld.php?id=17768 *** PhpBB-Webserver geknackt, Zugangsdaten kopiert *** --------------------------------------------- Die PhpBB-Server wurden kompromittiert und sind momentan offline. Die Angreifer haben es geschafft, den Foren-Zugang eines Administrators zu kapern. --------------------------------------------- http://www.heise.de/security/meldung/PhpBB-Webserver-geknackt-Zugangsdaten-… *** Android Hacking and Security, Part 17: Cracking Android App Binaries *** --------------------------------------------- In this article, we will see how a developer can perform basic checks to programmatically detect if the app is running on an emulator and stop executing the app if an emulator is detected. We will then see how an attacker can easily bypass these checks by using some freely... --------------------------------------------- http://resources.infosecinstitute.com/android-hacking-security-part-17-crac… *** Alina POS malware "sparks" off a new variant *** --------------------------------------------- Alina is a well-documented family of malware used to scrape Credit Card (CC) data from Point of Sale (POS) software. We published a series of in-depth write-ups on the capabilities Alina possesses as well as the progression of the versions. Xylitol has a nice write-up on the Command and Control (C&C) aspects of Alina. In this blog post I'd like to discuss a variant that first cropped up in late 2013 and has been seen in the wild as recent as a month ago. Some anti-virus companies have --------------------------------------------- http://blog.spiderlabs.com/2014/12/alina-pos-malware-sparks-off-a-new-varia… *** Patch-Debakel: Microsoft bessert bei IE-Update nach *** --------------------------------------------- Die Serie an verbockten Patches scheint nicht abzureissen. Jetzt muss Microsoft bei einem Update für den Internet Explorer nachbessern, nachdem IE-11-Nutzer über Probleme mit Dialogboxen auf Webseiten geklagt hatten. --------------------------------------------- http://www.heise.de/security/meldung/Patch-Debakel-Microsoft-bessert-bei-IE… *** Exploit Kit Evolution During 2014 - Nuclear Pack, (Thu, Dec 18th) *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. Nuclear exploit kit (also known as Nuclear Pack) has been around for years. Version 2.0 of Nuclear Pack was reported in 2012 [1] [2]. Blogs like malware.dontneedcoffee.com have mentioned version 3.0 of Nuclear Pack in posts during 2013 [3] [4]. This month, Nuclear Pack changed its traffic patterns. The changes are significant enough that I wonder if Nuclear Pack is at version 4. Or is this merely an evolution of version 3, as weve seen throughout --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19081&rss *** VU#843044: Multiple Dell iDRAC IPMI v1.5 implementations use insufficiently random session ID values *** --------------------------------------------- Vulnerability Note VU#843044 Multiple Dell iDRAC IPMI v1.5 implementations use insufficiently random session ID values Original Release date: 18 Dec 2014 | Last revised: 18 Dec 2014 Overview The Intelligent Platform Management Interface (IPMI) v1.5 implementations in multiple Dell iDRAC releases are vulnerable to arbitrary command injection due to use of insufficiently random session ID values. Description CWE-330: Use of Insufficiently Random Values - CVE-2014-8272The IPMI v1.5... --------------------------------------------- http://www.kb.cert.org/vuls/id/843044 *** Cisco IronPort ESA Subject Header Length Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-8016 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Adaptive Security Appliance DOM Cross-Site Scripting Vulnerability in WebVPN Portal *** --------------------------------------------- CVE-2014-8012 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-8014 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cross-Site Scripting vulnerability in wfGallery (wf_gallery) *** --------------------------------------------- It has been discovered that the extension "wfGallery" (wf_gallery) is susceptible to Cross-Site Scripting. --------------------------------------------- http://www.typo3.org/news/article/cross-site-scripting-vulnerability-in-wfg… *** SA-CONTRIB-2014-128 - Organic Groups Menu - Access bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-128Project: OG Menu (third-party module)Version: 6.x, 7.xDate: 2014-December-17Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass, Information DisclosureDescriptionThis module enables you to associate menus with Organic Groups (OG). It allows you to create one or more menus per group, configure and apply menu permissions in a group context, add/edit menu links directly from the entity... --------------------------------------------- https://www.drupal.org/node/2395049 *** SA-CONTRIB-2014-127 - School Administration - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-127Project: School Administration (third-party module)Version: 7.xDate: 2014-December-17Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionSchool Administration module enables you to keep records of all students and staff. With inner modules, it aims to be a complete school administration system.The module failed to sanitize some node titles in messages, leading to a... --------------------------------------------- https://www.drupal.org/node/2395015 *** SA-CONTRIB-2014-126 - Open Atrium - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-126Project: Open Atrium (third-party module)Version: 7.xDate: 2014-12-17Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass, Cross Site Request Forgery, Multiple vulnerabilitiesDescriptionThis distribution enables you to create an intranet.Several of the sub modules included do not prevent CSRF on several menu callbacks.Open Atrium Discussion also does not exit correctly after... --------------------------------------------- https://www.drupal.org/node/2394979 *** Novell NetIQ Access Manager 4.0 Support Pack 1 Hot Fix 3 4.0.1-132 *** --------------------------------------------- Abstract: NetIQ Access Manager 4.0 Support Pack 1 Hot Fix 3 build (version4.0.1-132). This file contains updates for services contained in the NetIQ Access Manager 4.0 product and requires 4.0 SP1 to be installed as a minimum. NetIQ recommends that all customers running Access Manager 4.0 release code apply this patch. The purpose of the patch is to provide a bundle of fixes for issues that have surfaced since NetIQ Access Manager 4.0 SP1 was released. These fixes include updates to the Access... --------------------------------------------- https://download.novell.com/Download?buildid=i7RBltaqcVw~ *** [2014-12-18] Multiple critical vulnerabilities in VDG Security SENSE (formerly DIVA) *** --------------------------------------------- Attackers are able to fully compromise the VDG Sense video management system by gaining highest system level access rights as multiple critical vulnerabilities exist. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-12-18] OS command execution vulnerability in GParted *** --------------------------------------------- GParted does not properly sanitize strings before passing them as parameters to an OS command. Under certain conditions an attacker is able to execute system commands as user "root" by tricking a victim into using GParted to e.g. format a USB drive. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-12-18] Multiple high risk vulnerabilities in NetIQ Access Manager *** --------------------------------------------- A vulnerability in the NetIQ Access Manager allows an authenticated attacker to read local files. Moreover, several web based issues (CSRF, persistent and non-persistent XSS) allow an attacker to hijack the session of an administrator or user. An information disclosure vulnerability allows an attacker to gather internal information including service passwords. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014…

1 0

Tageszusammenfassung - Mittwoch 17-12-2014
by Daily end-of-shift report 17 Dec '14

17 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-12-2014 18:00 − Mittwoch 17-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Schadcode nutzt Monate alte WordPress-Lücke aus *** --------------------------------------------- Der Schädling namens SoakSoak hat hunderttausende Webseiten über das Plug-in Slider Revolution befallen und spioniert die Server aus. In einigen Fällen werden auch Besucher per Drive-By-Download infiziert. --------------------------------------------- http://www.heise.de/security/meldung/Schadcode-nutzt-Monate-alte-WordPress-… *** Firefox, IE11 zero-day bugs possibly targeted in SoakSoak WordPress malware attacks *** --------------------------------------------- Attackers exploiting a bug in the Slider Revolution plugin to compromise WordPress websites with malware may also be targeting zero-day vulnerabilities in Firefox and Internet Explorer 11. --------------------------------------------- http://www.scmagazine.com/firefox-ie11-zero-day-bugs-possibly-targeted-in-s… *** Some Memory Forensic with Forensic Suite (Volatility plugins), (Tue, Dec 16th) *** --------------------------------------------- In previous diaries we have talked about memory forensics and how important it is. In this diary I will talk about a new volatility plugins called Forensic Suite written by Dave Lasalle. The suite has 14 plugins and they cover different area of memory forensics The Forensics Suite can be obtain from: http://downloads.volatilityfoundation.org/contest/2014/DaveLasalle_Forensic… . In this diary I will talk about some of the plugins Firefox history: To test this plugin first I browsed the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19071&rss *** URL flaw discovered for airline mobile boarding passes *** --------------------------------------------- A URL flaw that impacts mobile boarding passes for airlines, such as Southwest and Delta, was discovered on Tuesday. --------------------------------------------- http://www.scmagazine.com/url-flaw-discovered-for-airline-mobile-boarding-p… *** Impact of Linux bug grinch spans servers, workstations, Android devices and more *** --------------------------------------------- Alert Logic discovered the bug, which is susceptible to exploitation due to the default installation process used by Linux. --------------------------------------------- http://www.scmagazine.com/impact-of-linux-bug-grinch-spans-servers-workstat… *** Comparing OpenBSD with FreeBSD - securitywise *** --------------------------------------------- OpenBSD and FreeBSD are both great OS that I admire and use. OpenBSD is considered more secure since it is its main goal, but FreeBSD can be tweaked to be pretty well hardened as well. Depending on the forums or to who we ask, we will have different opinions. But what are the facts? Which OS is more secure and why? --------------------------------------------- http://networkfilter.blogspot.co.at/2014/12/security-openbsd-vs-freebsd.html *** SSL Labs end of year 2014 updates *** --------------------------------------------- >From the SSL/TLS perspective, 2014 was quite an eventful year. The best way to describe what we at SSL Labs did is we kept running to stay in the same place. What I mean by this is that we spent a lot of time reacting to high profile vulnerabilities: Hearbleed, the ChangeCipherSpec protocol issue in OpenSSL, POODLE (against SSL 3 in October and against TLS in December), and others. Ultimately, this has been a very successful year for us, with millions of assessments carried out. --------------------------------------------- http://blog.ivanristic.com/2014/12/ssl-labs-end-of-year-updates.html *** Top 5 malware attacks: 35 reused components *** --------------------------------------------- CyActive identified the top five malware that returned the highest ROI for hackers with the least effort per dollar - achieved by recycling code and using the same methods from previous malware attack... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2932 *** Protecting the underground electronic communications infrastructure *** --------------------------------------------- ENISA has released a new report on the Protection of Underground Electronic Communications Infrastructure. This report - targeted at Member States (MS), public institutions, owners of underground comm... --------------------------------------------- http://www.net-security.org/secworld.php?id=17763 *** The Abandoned Side of the Internet: Hijacking Internet Resources When Domain Names Expire *** --------------------------------------------- In this paper, we discuss an attacker model that accounts for the hijacking of network ownership information stored in Regional Internet Registry (RIR) databases. We show that such threats emerge from abandoned Internet resources (e.g., IP address blocks, AS numbers). When DNS names expire, attackers gain the opportunity to take resource ownership by re-registering domain names that are referenced by corresponding RIR database objects. --------------------------------------------- http://arxiv.org/abs/1412.5052 *** How the FBI Unmasked Tor Users *** --------------------------------------------- Kevin Poulson has a good article up on Wired about how the FBI used a Metasploit variant to identify Tor users.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/how_the_fbi_unm.html *** Fast Flux Networks Working and Detection, Part 1 *** --------------------------------------------- Introduction In this series of articles, we will learn about a not-so-new type of attack, but one of the most difficult attacks to control. Yes, we will lean about the demon Fast Flux!! In this article, we will learn about what exactly Fast Flux is, types of Fast Flux, and [...]The post Fast Flux Networks Working and Detection, Part 1 appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/fast-flux-networks-working-detection-… *** What's New in Exploit Kits in 2014 *** --------------------------------------------- Around this time in 2013, the most commonly used exploit kit - the Blackhole Exploit Kit - was shut down after its creator, Paunch, was arrested by law enforcement. Since then, a variety of exploit kits has emerged and have been used by cybercriminals. The emergence of so many replacements has also meant that there... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/N44vwrIcGrM/ *** Researchers warn of new OphionLocker ransomware *** --------------------------------------------- OphionLocker doesnt diverge much from previous ransomware schemes, although it does generate a unique hardware ID based on the first hard drives serial number, the motherboards serial number and other information. --------------------------------------------- www.scmagazine.com/ophionlocker-discovered-in-the-wild-update-provided-on-t… *** Certified pre-pw0ned Android Smartphones: Coolpad Firmware Backdoor, (Wed, Dec 17th) *** --------------------------------------------- Researchers at Palo Alto found that many ROM images used for Android smart phones manufactured by Coolpad contain a backdoor, giving an attacker full control of the device. Palo Alto named the backdoor Coolreaper. With Android, it is very common for manufacturers to install additional applications. But these applications are installed on top of the Android operating system. In this case, Coolpad integrated additional functionality into the firmware of the device. This backdoor was then used by --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19075&rss *** BSI-Sicherheitsbericht: Erfolgreiche Cyber-Attacke auf deutsches Stahlwerk *** --------------------------------------------- Bei einem bislang unbekannten Angriff beschädigten die Angreifer einen Hochofen schwer. Doch neben den gezielten Angriffen auf Industrieanlagen bilanziert das BSI auch eine steigende Gefahr für Endanwender. --------------------------------------------- http://www.heise.de/security/meldung/BSI-Sicherheitsbericht-Erfolgreiche-Cy… *** Meet FlashFlood, the lightweight script that causes websites to falter *** --------------------------------------------- Bringing big database-driven sites to their knees just got a little easier. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/ir5Zy4m-thY/ *** iCloud-Daten: Forensik-Software verspricht umfangreichen Zugriff *** --------------------------------------------- Die vermutlich auch für den iCloud-Promi-Hack genutzte Forensik-Software "Phone Breaker" erweitert die Möglichkeiten, bei Apples Cloud-Dienst gespeicherte Nutzerdaten auszulesen. Unterstützung zum Fremdzugriff auf iCloud Drive soll folgen. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Daten-Forensik-Software-verspri… *** Cisco ISB8320-E High-Definition IP-Only DVR Remote Unauthenticated Access Vulnerability *** --------------------------------------------- CVE-2014-8006 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Symantec Web Gateway OS Authenticated Command Injection *** --------------------------------------------- Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSymantec Web Gateway Operating System Command Injection - Low... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** IBM Business Process Manager cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98418 *** IBM WebSphere Process Server, IBM WebSphere Enterprise Service Bus, IBM Business Process Manager information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98488 *** IBM Business Process Manager security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95724 *** HP Security Bulletins *** --------------------------------------------- [security bulletin] HPSBMU03221 rev.1 - HP Connect-IT running SSLv3, Remote Disclosure of Information --------------------------------------------- http://www.securityfocus.com/archive/1/534259 [security bulletin] HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Code Execution --------------------------------------------- http://www.securityfocus.com/archive/1/534262 [security bulletin] HPSBOV03226 rev.1 - HP TCP/IP Services for OpenVMS, BIND 9 Resolver, Multiple Remote Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/534261 [security bulletin] HPSBOV03225 rev.1 - HP OpenVMS running POP, Remote Denial of Service (DoS) --------------------------------------------- http://www.securityfocus.com/archive/1/534260 *** Patches for Novell Products *** --------------------------------------------- https://download.novell.com/Download?buildid=3dJODsdcDKE~ https://download.novell.com/Download?buildid=STisn28FRWs~ https://download.novell.com/Download?buildid=q4S96klvwhE~ https://download.novell.com/Download?buildid=Mh8CRo1Ljh8~ https://download.novell.com/Download?buildid=nlOmW2y333Q~ https://download.novell.com/Download?buildid=anuuh6CDWX8~ *** DSA-3105 heirloom-mailx - security update *** --------------------------------------------- Two security vulnerabilities were discovered in Heirloom mailx, animplementation of the mail command: --------------------------------------------- https://www.debian.org/security/2014/dsa-3105 *** DSA-3104 bsd-mailx - security update *** --------------------------------------------- It was discovered that bsd-mailx, an implementation of the mailcommand, had an undocumented feature which treats syntactically validemail addresses as shell commands to execute. --------------------------------------------- https://www.debian.org/security/2014/dsa-3104 *** SSA-134508 (Last Update 2014-12-16): Vulnerabilities in SIMATIC WinCC, PCS 7 and WinCC in TIA Portal *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** iWifi For Chat 1.1 Denial Of Service *** --------------------------------------------- Topic: iWifi For Chat 1.1 Denial Of Service Risk: Medium Text:Document Title: iWifi for Chat v1.1 iOS - Denial of Service Vulnerability References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120110 *** iUSB 1.2 Arbitrary Code Execution *** --------------------------------------------- Topic: iUSB 1.2 Arbitrary Code Execution Risk: High Text:Document Title: iUSB v1.2 iOS - Arbitrary Code Execution Vulnerability References (Source): == http://www.... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120109 *** Bugtraq: [REVIVE-SA-2014-002] Revive Adserver 3.0.6 and 3.1.0 fix multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/534264 *** Security Advisory-Multiple Vulnerabilities in Huawei eSpace Desktop Product *** --------------------------------------------- Dec 17, 2014 16:09 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Schneider Electric ProClima Command Injection Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for command injection vulnerabilities in Schneider Electrics ProClima software package. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-350-01 *** Bird Feeder <= 1.2.3 CSRF & XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7727 *** DB Backup <= 4.5 - Path Traversal File Access *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7726

1 0

Tageszusammenfassung - Dienstag 16-12-2014
by Daily end-of-shift report 16 Dec '14

16 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-12-2014 18:00 − Dienstag 16-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Is POODLE Back for Another Byte? *** --------------------------------------------- [...] The problem is a number of other TLS implementations are optimized for performance by verifying only that the first byte of padding matches the number of padding bytes. Such implementations would accept any value for the second and subsequent padding bytes. What's worse is that the adversary doesn't need to artificially downgrade the connection to SSLv3 to exploit this issue, so the barriers to execution are lower. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2014/12/is_poodle_back_fora.ht… *** RevSlider Vulnerability Leads To Massive WordPress SoakSoak Compromise *** --------------------------------------------- Yesterday we disclosed a large malware campaign targeting and compromising over 100,000 WordPress sites, and growing by the hour. It was named SoakSoak due to the first domain used in the malware redirection path (soaksoak.ru). After a bit more time investigating this issue, we were able to confirm that the attack vector is the RevSlider... --------------------------------------------- http://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wor… *** SoakSoak: Payload Analysis - Evolution of Compromised Sites - IE 11 *** --------------------------------------------- Thousands of WordPress sites has been hit by the SoakSoak attack lately. At this moment we know quite a lot about it. It uses the RevSlider vulnerability as a point of penetration. Then uploads a backdoor and infects all websites that share the same server account (so sites that don't use the RevSlider plugin can... --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-payload-analysis-evolution-of-compr… *** Google Blacklists WordPress Sites Peddling SoakSoak Malware *** --------------------------------------------- Up to 100,000 sites hosted on WordPress may be vulnerable to new campaign thats pushing malware and multiple exploit kits to the browser. --------------------------------------------- http://threatpost.com/google-blacklists-wordpress-sites-peddling-soaksoak-m… *** Safari 8.0.2 Still Supporting SSLv3 with Block Ciphers, (Mon, Dec 15th) *** --------------------------------------------- In October, Apple released Security Update 2014-005, specifically with the intend to address the POODLE issue [1]. The description with the update stated: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling CBC cipher suites when TLS connection... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19067&rss *** ENISA CERT training programme now available online *** --------------------------------------------- ENISA has launched a new section on its website introducing the ENISA CERT training programme. In the new section, you can find all the publicly available training resources and the training courses currently provided by ENISA. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-cert-training-programme-n… *** SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-8730 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Internet-Sicherheit: Auch Cisco mit Poodle-Problemen *** --------------------------------------------- Ausgerechnet Firewalls und Load-Balancing-Erweiterungen des Netzwerkgeräte-Herstellers pfuschen bei der Umsetzung von TLS - und werden damit ebenfalls anfällig für Poodle-Angriffe auf die Verschlüsselung. --------------------------------------------- http://www.heise.de/security/meldung/Internet-Sicherheit-Auch-Cisco-mit-Poo… *** Android Hacking and Security, Part 16: Broken Cryptography *** --------------------------------------------- Introduction In this article, we will discuss broken cryptography in Android applications. Broken cryptography attacks come into the picture when an app developer wants to take advantage of encryption in his application. This article covers the possible ways where vulnerabilities associated with broken cryptography may be introduced in Android apps. [...]The post Android Hacking and Security, Part 16: Broken Cryptography appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/android-hacking-security-part-16-brok… *** F5 Security Advisory: Linux kernel SCTP vulnerabilities CVE-2014-3673 and CVE-2014-3687 *** --------------------------------------------- (SOL15910) - Remote attackers may be able to cause a denial-of-service (DoS) using malformed or duplicate ASCONF chunk. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/900/sol15910.html *** Security Advisory 2014-06: Incomplete Access Control *** --------------------------------------------- An attacker with valid OTRS credentials could access and manipulate ticket data of other users via the GenericInterface, if a ticket webservice is configured and not additionally secured. --------------------------------------------- https://www.otrs.com/security-advisory-2014-06-incomplete-access-control/ *** Apache Buffer Overflow in mod_proxy_fcgi Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031371 *** SSA-831997 (Last Update 2014-12-15): Denial-of-Service Vulnerability in Ruggedcom ROS-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** CA Release Automation Multiple Flaws Permit Cross-Site Scripting, Cross-Site Request Forgery, and SQL Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031375 *** DokuWiki conf/mime.conf cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99291 *** Python TLS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99294 *** CA LISA Multiple Vulns *** --------------------------------------------- Topic: CA LISA Multiple Vulns Risk: Medium Text:CA20141215-01: Security Notice for CA LISA Release Automation Issued: December 15, 2014 CA Technologies Support is alerti... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120097 *** Bugtraq: [Onapsis Security Advisory 2014-034] SAP Business Objects Search Token Privilege Escalation via CORBA *** --------------------------------------------- http://www.securityfocus.com/archive/1/534249 *** Better Search <= 1.3.4 - Reflective XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7725 *** WP Construction Mode <= 1.91 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7724 *** Sliding Social Icons <= 1.61 - CSRF & Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7723 *** Bugtraq: "Ettercap 8.0 - 8.1" multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/534248

1 0

Tageszusammenfassung - Montag 15-12-2014
by Daily end-of-shift report 15 Dec '14

15 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-12-2014 18:00 − Montag 15-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ICS-CERT: BlackEnergy may be infecting WinCC systems lacking recent patch *** --------------------------------------------- BlackEnergy malware may be exploiting a vulnerability in Siemens SIMATIC WinCC software that was patched in early November. --------------------------------------------- http://www.scmagazine.com/ics-cert-urges-wincc-users-others-to-update-softw… *** BGP Hijacking Continues, Despite the Ability To Prevent It *** --------------------------------------------- An anonymous reader writes: BGPMon reports on a recent route hijacking event by Syria. These events continue, despite the ability to detect and prevent improper route origination: Resource Public Key Infrastructure. RPKI is technology that allows an operator to validate the proper relationship between an IP prefix and an Autonomous System. That is, assuming you can collect the certificates. ARIN requires operators accept something called the Relying Party Agreement. But the provider community... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/hl_eP152_h0/story01.htm *** Batten down the patches: New vuln found in Docker container tech *** --------------------------------------------- Last months patch brought new privilege escalation flaw More security woes plagued users of the Docker application containerization tech for Linux this week, after an earlier security patch was found to have introduced a brand-new critical vulnerability in the software. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/12/docker_vuln… *** Cisco to release flying pig - Snort 3.0 *** --------------------------------------------- Sourcefires been making bacon, now wants you to fry it Ciscos going to release a flying pig. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/12/cisco_to_re… *** Worm Backdoors and Secures QNAP Network Storage Devices, (Sun, Dec 14th) *** --------------------------------------------- Shellshock is far from over, with many devices still not patched andout there ready for exploitation. One set of thedevices receiving a lot of attention recently are QNAP disk storage systems. QNAP released a patch in early October, but applying the patch is not automatic and far from trivial for many users[1]. Our reader Erichsubmitted a link to an interesting Pastebin post with code commonly used in these scans [2] The attack targets a QNAP CGI script, /cgi-bin/authLogin.cgi, a well known... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19061&rss *** SoakSoak Malware Compromises 100,000+ WordPress Websites *** --------------------------------------------- This Sunday has started with a bang. Google has blacklisted over 11,000 domains with this latest malware campaign from SoakSoak.ru: Our analysis is showing impacts in the order of 100s of thousands of WordPress specific websites. We cannot confirm the exact vector, but preliminary analysis is showing correlation with the Revslider vulnerability we reported a... --------------------------------------------- http://blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpres… *** Man in the Middle attack vs. Cloudflares Universal SSL *** --------------------------------------------- MitM attacks are a class of security attacks that involve the compromise of the authentication of a secure connection. In essence, an attacker builds a transparent tunnel between the client and the server, but makes sure that the client negotiates the secure connection with the attacker, instead of the intended server. Thus the client instead of having a secure connection to the server, has a secure connection to the attacker, which in turn has set up its own secure connection to the server, so... --------------------------------------------- http://blog.ricardomacas.com/index.php?controller=post&action=view&id_post=4 *** 10th Annual ICS Security Summit - Orlando *** --------------------------------------------- For SCADA, Industrial Automation, and Control System Security Join us for the 10th anniversary of the Annual SANS ICS Security Summit. The Summit is the premier event to attend in 2015 for ICS cybersecurity practitioners and managers. This years summit will feature hands-on training courses focused on Attacking and Defending ICS environments, Industry specific pre-summit events, and an action packed summit agenda with the release of ICS security tools and the popular security kit for Summit --------------------------------------------- https://www.sans.org/event/ics-security-summit-2015 *** Vulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege (3009712) *** --------------------------------------------- V3.0 (December 12, 2014): Rereleased bulletin to announce the reoffering of Microsoft security update 2986475 for Microsoft Exchange Server 2010 Service Pack 3. The rereleased update addresses a known issue in the original offering. Customers who uninstalled the original update should install the updated version of 2986475 at the earliest opportunity. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-075 *** Two newcomers in the exploit kit market *** --------------------------------------------- Exploit kits are a great means to an end for malware distributors, who either buy them or rent them in order to widely disseminate their malicious wares. Its no wonder then that unscrupulous developers are always trying to enter the market currently cornered by Angler, Nuclear, FlashEK, Fiesta, SweetOrange, and others popular exploit kits. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2929 *** RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect *** --------------------------------------------- Topic: RSA Authentication Manager 8.0 / 8.1 Unvalidated Redirect Risk: Low Text:ESA-2014-173: RSA Authentication Manager Unvalidated Redirect Vulnerability EMC Identifier: ESA-2014-173 CVE Identifier:... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120080 *** RSA Archer GRC Platform 5.x Cross Site Scripting *** --------------------------------------------- Topic: RSA Archer GRC Platform 5.x Cross Site Scripting Risk: Low Text:ESA-2014-163: RSA Archer GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2014-163 CVE Identifier: See b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120079 *** EMC Isilon InsightIQ Cross Site Scripting *** --------------------------------------------- Topic: EMC Isilon InsightIQ Cross Site Scripting Risk: Low Text:ESA-2014-164: EMC Isilon InsightIQ Cross-Site Scripting Vulnerability EMC Identifier: ESA-2014-164 CVE Identifier: CVE-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120078 *** Cisco Prime Security Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-3364 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass *** --------------------------------------------- Topic: Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Risk: Medium Text:Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit Vendor: Soitec Product web page: http://ww... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120086 *** Multiple vulnerabilities in InfiniteWP Admin Panel *** --------------------------------------------- InfiniteWP (http://www.infinitewp.com/) allows an administrator to manage multiple Wordpress sites from one control panel. According to the InfiniteWP homepage, it is used on over 317,000 Wordpress sites. The InfiniteWP Admin Panel contains a number of vulnerabilities that can be exploited by an unauthenticated remote attacker. These vulnerabilities allow taking over managed Wordpress sites by leaking secret InfiniteWP client keys, allow SQL injection, allow cracking of InfiniteWP admin --------------------------------------------- http://seclists.org/fulldisclosure/2014/Dec/43 *** Bugtraq: Vulnerabilities in Ekahau Real-Time Location Tracking System [MZ-14-01] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534241 *** [dos] - phpMyAdmin 4.0.x, 4.1.x, 4.2.x - DoS *** --------------------------------------------- http://www.exploit-db.com/exploits/35539 *** Multiple vulnerabilities in BibTex Publications (si_bibtex) *** --------------------------------------------- It has been discovered that the extension "BibTex Publications" (si_bibtex) is susceptible to Cross-Site Scripting and SQL Injection. --------------------------------------------- http://www.typo3.org/news/article/multiple-vulnerabilities-in-bibtex-public… *** Multiple vulnerabilities in Drag Drop Mass Upload (ameos_dragndropupload) *** --------------------------------------------- It has been discovered that the extension "Drag Drop Mass Upload" (ameos_dragndropupload) is susceptible to Cross-Site Scripting, Cross-Site Request Forgery and Improper Access Control. --------------------------------------------- http://www.typo3.org/news/article/improper-access-control-in-drag-drop-mass… *** Security Advisory-SSLv3 POODLE Vulnerability in Huawei Products *** --------------------------------------------- Dec 15, 2014 18:30 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** SEO Redirection <= 2.2 - Unauthenticated Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7722 *** Lightbox Photo Gallery 1.0 - CSRF/XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7719 *** WP-FB-AutoConnect <= 4.0.5 - XSS/CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7721 *** Timed Popup <= 1.3 - CSRF & Stored XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7720 *** Bugtraq: CVE-2014-2026 Reflected Cross-Site Scripting (XSS) in "Intrexx Professional" *** --------------------------------------------- http://www.securityfocus.com/archive/1/534230 *** Bugtraq: CVE-2014-2025 Remote Code Execution (RCE) in "Intrexx Professional" *** --------------------------------------------- http://www.securityfocus.com/archive/1/534229

1 0

Tageszusammenfassung - Freitag 12-12-2014
by Daily end-of-shift report 12 Dec '14

12 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-12-2014 18:00 − Freitag 12-12-2014 18:00 Handler: Alexander Riepl Co-Handler: Otmar Lendl *** Archie and Astrum: New Players in the Exploit Kit Market *** --------------------------------------------- Thu, 11 Dec 2014 17:10:55 +0200 --------------------------------------------- https://www.f-secure.com/weblog/archives/00002776.html *** Researcher: Lax Crossdomain Policy Puts Yahoo Mail At Risk *** --------------------------------------------- A security researcher disclosed a problem with a loose cross-domain policy for Flash requests on Yahoo Mail that puts email content and contacts at risk. --------------------------------------------- http://threatpost.com/researcher-lax-crossdomain-policy-puts-yahoo-mail-at-… *** DSA-3098 graphviz - security update *** --------------------------------------------- Joshua Rogers discovered a format string vulnerability in the yyerrorfunction in lib/cgraph/scan.l in Graphviz, a rich set of graph drawingtools. An attacker could use this flaw to cause graphviz to crash orpossibly execute arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3098 *** ZDI-14-424: Honeywell OPOS Suite HWOPOSScale.ocx Open Method Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell OPOS Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/8tlo_ZfI4BE/ *** ZDI-14-423: Honeywell OPOS Suite HWOPOSSCANNER.ocx Open Method Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Honeywell OPOS Suite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ZDVuupIJS6Q/ *** ZDI-14-422: ManageEngine NetFlow Analyzer CollectorConfInfoServlet COLLECTOR_ID Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sBfZBCsAKl4/ *** ZDI-14-421: ManageEngine Password Manager Pro UploadAccountActivities filename Directory Traversal Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to create a denial of service condition on vulnerable installations of ManageEngine Password Manager Pro. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/agLsqjzz9u4/ *** ZDI-14-420: ManageEngine Desktop Central MSP NativeAppServlet UDID JSON Object Code Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/YGf1aa88_QM/ *** Targeted Phishing Against GoDaddy Customers *** --------------------------------------------- I do get a lot of phishing emails, we all do, but as security professionals we tend to recognize them immediately. Either the syntax is wrong, or it's missing a name. When you get them from a bank you don't even deal with that's a pretty good clue. However, when the phishing is well doneRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/uan3MNQ2J9g/targeted-phishing… *** Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-329-02A Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published December 2, 2014, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-02B *** Wire transfer spam spreads Upatre *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) is currently monitoring a spam email campaign that is using a wire transfer claim to spread Trojan:Win32/Upatre. It is important to note that customers running up-to-date Microsoft security software are protected from this threat. Additionally, customers with Microsoft Active Protection Service Community (MAPS) enabled also benefit from our cloud protection service. Upatre typically uses spam email campaigns to spread and then downloads other --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/12/11/wire-transfer-spam-sprea… *** Digitaler Anschlag: Cyber-Attacke soll Ölpipeline zerstört haben *** --------------------------------------------- Ein Cyber-Angriff soll 2008 die Explosion einer Ölpipeline in der Türkei verursacht haben, wie anonyme Quellen berichten. Es gibt dafür aber nur Indizien. (Cyberwar, Virus) --------------------------------------------- http://www.golem.de/news/digitaler-anschlag-cyber-attacke-soll-oelpipeline-… *** Cross-Signed Certificates Crashes Android *** --------------------------------------------- We have discovered a vulnerability in Android that affects how cross-signed certificates are handled. No current Android release correctly handles these certificates, which are created when two certificates are signed with a looped certificate chain (certificate A signs certificate B; certificate B signs certificate A). We've already notified Google about this vulnerability, and there is no fix Post from: Trendlabs Security Intelligence Blog - by Trend MicroCross-Signed --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/K85aQffE_W0/ *** Microsoft: Neues Zertifikats-Update, noch ein zurückgezogener Patch *** --------------------------------------------- Microsoft hat ein neues Zertifikats-Update für Windows 7 und Server 2008 ausgeliefert, das die Update-Probleme beheben soll. In der Zwischenzeit musste allerdings der dritte Patch in wenigen Tagen zurückgezogen werden, da er Silverlight zerschossen hatte. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-Neues-Zertifikats-Update-noc… *** Office für Mac 2011: Microsoft beseitigt kritische Schwachstelle *** --------------------------------------------- Das Update für die OS-X-Version der Büro-Suite soll eine Sicherheitslücke in Word beseitigen, die das Einschleusen und Ausführen von Schadcode erlaubt. Auch ein kleineres Problem wird behoben. --------------------------------------------- http://www.heise.de/security/meldung/Office-fuer-Mac-2011-Microsoft-beseiti… *** Microsoft pulls Patch Tuesday fix - "Outlook can't connect to Exchange" *** --------------------------------------------- Part of Patch Tuesday is now only partly available as Microsoft recalls its already-delayed Exchange 2010 update. Paul Ducklin takes a look... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/pyrMdTGYdYo/ *** DFN-CERT-2014-1647/">MantisBT: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- 12.12.2014 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2014-1647/ *** OphionLocker: Joining in the Ransomware Race *** --------------------------------------------- Fri, 12 Dec 2014 16:32:35 +0200 --------------------------------------------- https://www.f-secure.com/weblog/archives/00002777.html *** SSL-Lücke: Der POODLE beißt Windows Phone 7 *** --------------------------------------------- Windows Phone 7 kann Mails nur mit dem uralten SSL-Protokoll Version 3 abholen. Das wird aber von vielen Mailservern wegen der POODLE-Lücke nicht mehr angeboten. Auf Abhilfe können Nutzer wohl nicht hoffen. (Windows Phone, E-Mail) --------------------------------------------- http://www.golem.de/news/ssl-luecke-der-poodle-beisst-windows-phone-7-1412-…

1 0

Tageszusammenfassung - Donnerstag 11-12-2014
by Daily end-of-shift report 11 Dec '14

11 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-12-2014 18:00 − Donnerstag 11-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Critical vulnerability affecting HD FLV Player *** --------------------------------------------- We've been notified of a critical vulnerability affecting the HD FLV Player plugin for Joomla!, WordPress and custom websites. It was silently patched on Joomla! and WordPress, leaving the custom website version vulnerable. Furthermore, websites .. --------------------------------------------- http://blog.sucuri.net/2014/12/critical-vulnerability-in-joomla-hd-flv-play… *** Underground black market: Thriving trade in stolen data, malware, and attack services *** --------------------------------------------- The underground market is still booming after recent major data breaches. The price of stolen email accounts has dropped substantially, but the value of .. --------------------------------------------- http://www.symantec.com/connect/blogs/underground-black-market-thriving-tra… *** Odd new ssh scanning, possibly for D-Link devices, (Wed, Dec 10th) *** --------------------------------------------- I noticed it in my own logs overnight and also had a couple of readers (both named Paul) report some odd new ssh scanning overnight. The scanning involves many sites, likely a botnet, attempting to ssh in as 3 users, D-Link, admin, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19055 *** Microsoft Enables Removal of SSL 3.0 Fallback In IE *** --------------------------------------------- Microsoft has given Windows admins the option to remove the SSL 3.0 fallback from Internet Explorer. By disabling SSL 3.0, IE is no longer vulnerable to POODLE attacks. --------------------------------------------- http://threatpost.com/microsoft-enables-removal-of-ssl-3-0-fallback-in-ie/1… *** FreeBSD Buffer Overflow in libc stdio Lets Local Users Deny Service or Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031343 *** FreeBSD file(1) and libmagic(3) File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031344 *** WordPress Uninstall <= 1.1 - WordPress Deletion via CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7715 *** Mysterious Turla Linux backdoor also for Solaris? *** --------------------------------------------- There has been numerous reports about the mysterious Linux backdoor connected to Turla, an APT family. The malware has some pretty interesting features, the most interesting being its ability to sniff the network interface. More specifically, it .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002775.html *** Regin *** --------------------------------------------- Wir haben in der Woche ab dem 24. November 2014 zum Thema Regin regelmässige Status-Updates an die GovCERT Constituency (in unserer Rolle als GovCERT Austria), die potentiell betroffenen Sektoren (im Rahmen des ATC) und den CERT-Verbund verschickt.Dieser Blogpost stellt unsere Timeline .. --------------------------------------------- http://www.cert.at/services/blog/20141211105745-1339.html *** Patch-Debakel: Microsoft zieht erneut Update zurück *** --------------------------------------------- Nach einem fehlerhaften Rollup-Update für Exchange musste Microsoft nun auch einen Patch für die Root-Zertifikate in Windows zurückziehen. Probleme mit Updates und Patches hatte Microsoft in letzter Zeit des öfteren. --------------------------------------------- http://www.heise.de/security/meldung/Patch-Debakel-Microsoft-zieht-erneut-U… *** Cyber-Spionage: Auf Roter Oktober folgt Cloud Atlas *** --------------------------------------------- Eine neue Angriffswelle mit gezielten Attacken droht: Cloud Atlas soll die nächste digitale Spionagekampagne sein. Die Malware sei eine aktualisierte Variante von Roter Oktober, sagen IT-Sicherheitsexperten. --------------------------------------------- http://www.golem.de/news/cyber-spionage-auf-roter-oktober-folgt-cloud-atlas…

1 0

Tageszusammenfassung - Mittwoch 10-12-2014
by Daily end-of-shift report 10 Dec '14

10 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-12-2014 18:00 − Mittwoch 10-12-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1149 *** VMSA-2014-0013 *** --------------------------------------------- VMware vCloud Automation Center product updates address a critical remote privilege escalation vulnerability. VMware vCloud Automation Center has a remote privilege escalation vulnerability. This issue may allow an authenticated vCAC user to obtain administrative access to vCenter Server. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0013.html *** MS14-DEC - Microsoft Security Bulletin Summary for December 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-DEC *** Multiple vulnerabilities in SAP SQL Anywhere *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-415/ http://www.zerodayinitiative.com/advisories/ZDI-14-414/ http://www.zerodayinitiative.com/advisories/ZDI-14-413/ http://www.zerodayinitiative.com/advisories/ZDI-14-412/ *** ZDI-14-411: Lexmark MarkVision Enterprise ReportDownloadServlet Information Disclosure Vulnerability *** --------------------------------------------- The specific flaw exists within the ReportDownloadServlet class. The class contains a method that does not properly sanitize input allowing for directory traversal. An attacker can leverage this vulnerability to read files under the context of SYSTEM. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-411/ *** ZDI-14-410: Lexmark MarkVision Enterprise GfdFileUploadServlet Remote Code Execution Vulnerability *** --------------------------------------------- The specific flaw exists within the GfdFileUploadServlet class. The class contains a method that does not properly sanitize input allowing for directory traversal. An attacker can leverage this vulnerability to write files under the context of SYSTEM and achieve remote code execution. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-410/ *** X Multiple Memory Corruption Flaws Let Remote Users Deny Service and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031326 *** Yokogawa FAST/TOOLS XML External Entity *** --------------------------------------------- This advisory provides mitigation details for an XML external entity processing vulnerability in the Yokogawa FAST/TOOLS application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-343-01 *** Trihedral VTScada Integer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an integer overflow vulnerability in Trihedral Engineering Ltd's VTScada application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-343-02 *** .Bank hires Symantec to check credentials *** --------------------------------------------- Soon you might be able to trust that financial email The launch of new .bank domain names is one step closer with the announcement that Symantec has been chosen to act as the credentials verifier for the top-level domain .. --------------------------------------------- http://www.theregister.co.uk/2014/12/10/bank_hires_symantec_to_check_creden… *** Nach Hack: Sony-Sicherheitszertifikat zur Malware-Tarnung genutzt *** --------------------------------------------- Es ist wohl der verheerendste Angriff auf die IT-Sicherheit eines Unternehmens, den es je gegeben hat. Seit Tagen tauchen immer neue interne Informationen aus dem Netzwerk von Sony Pictures auf. Neben bislang .. --------------------------------------------- http://derstandard.at/2000009194439 *** Cloud Atlas: RedOctober APT is back in style *** --------------------------------------------- Two years ago, we published our research into RedOctober, a complex cyber-espionage operation targeting diplomatic embassies worldwide. We named it RedOctober because we started this investigation in October 2012, an unusually hot month. --------------------------------------------- http://securelist.com/blog/research/68083/cloud-atlas-redoctober-apt-is-bac… *** DFN-CERT-2014-1622: Red Hat Package Manager (RPM): Zwei Schwachstellen ermöglichen die Ausführung beliebiger Befehle *** --------------------------------------------- Zwei Schwachstellen im Red Hat Package Manager (RPM) ermöglichen einem entfernten, nicht authentisierten Angreifer die Ausführung beliebiger Befehle während der Paketinstallation und damit die Übernahme des Systems. Die Schwachstelle .. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2014-1622/ *** F5 BIG-IP SSLv3 Decoding Function Lets Remote Users Decrypt TLS Traffic *** --------------------------------------------- A vulnerability was reported in F5 BIG-IP. A remote user can decrypt TLS sessions in certain cases. The system may accept incorrect TLS padding when terminating TLSv1 CBC connections. A remote user can with the ability to conduct a man-in-the-middle attack can force a client to use a vulnerable SSLv3 decoding function with TLS and then conduct a BEAST-style of attack to decrypt portions of the session. --------------------------------------------- http://www.securitytracker.com/id/1031338 *** Link spoofing and cache poisoning vulnerabilities in TYPO3 CMS *** --------------------------------------------- An attacker could forge a request, which modifies anchor only links on the homepage of a TYPO3 installation in a way that they point to arbitrary domains, if the .. --------------------------------------------- http://www.typo3.org/news/article/link-spoofing-and-cache-poisoning-vulnera… *** Störungen bei 1&1-Webhosting wegen DDos-Attacke *** --------------------------------------------- Weil das DNS-System von 1&1 angegriffen wird, sind sowohl Webhosting als auch Mail von 1&1 zeitweise nicht über Domains erreichbar. --------------------------------------------- http://www.heise.de/security/meldung/Stoerungen-bei-1-1-Webhosting-wegen-DD… *** Sony Pictures wurde vor Angriff auf IT-Infrastruktur angeblich erpresst *** --------------------------------------------- Die Umstände des Hacker-Angriffs auf Sony Pictures werden immer verwirrender. Eine Geldforderung legt einen kriminellen Hintergrund nahe. Zugleich fordern die Hacker aber angeblich auch, die Nordkorea-Komödie "The Interview" zu stoppen. --------------------------------------------- http://www.heise.de/security/meldung/Sony-Pictures-wurde-vor-Angriff-auf-IT… *** X.ORG: Wieder Jahrzente alte Lücken im X-Server *** --------------------------------------------- Der X-Server ist von 13 Sicherheitslücken betroffen, die sich auf verschiedene Implementierungen auswirken können. Die älteste reicht fast 30 Jahre in die erste Version von X11 zurück. Andeutungen auf die Fehler gab es bereits auf dem 30C3 vor einem Jahr. --------------------------------------------- http://www.golem.de/news/x-org-wieder-jahrzente-alte-luecken-im-x-server-14…

1 0

Tageszusammenfassung - Dienstag 9-12-2014
by Daily end-of-shift report 09 Dec '14

09 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-12-2014 18:00 − Dienstag 09-12-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Advance Notification Service for the December 2014 Security Bulletin Release *** --------------------------------------------- Today, we provide advance notification for the release of seven Security Bulletins. Three of these updates are rated Critical and four are rated as Important in severity. These updates are for Microsoft Windows, Internet Explorer (IE), Office and Exchange. As per our monthly process, we've scheduled the Security Bulletin release for the second Tuesday of the month, December 9, 2014, at approximately 10 a.m. PDT. Until then, please review the ANS summary page for more information to help... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/12/04/advance-notification-ser… *** Leveraging the WordPress Platform for SPAM *** --------------------------------------------- We've all seen WordPress comment and pingback spam, but thanks to strict moderation regimes and brilliant WordPress plugins that focus strictly on SPAM comments, comment spam isn't a major problem for most websites these days. I have seen however, a new trend starting to emerge when it comes to spam involving WordPress. In recent years... --------------------------------------------- http://blog.sucuri.net/2014/12/leveraging-the-wordpress-platform-for-spam.h… *** SSLv3: Kaspersky-Software hebelt Schutz vor Poodle-Lücke aus *** --------------------------------------------- Das Paket Kaspersky Internet Security kann auch bei Browsern, die unsichere Verbindungen per SSLv3 nicht unterstützen, das veraltete Protokoll dennoch aktivieren. Patchen will das der Hersteller erst 2015, es gibt aber schon jetzt eine einfache Lösung. --------------------------------------------- http://www.golem.de/news/sslv3-kaspersky-software-hebelt-schutz-vor-poodle-… *** Sicherheitslücken: Java-Sandbox-Ausbrüche in Googles App Engine *** --------------------------------------------- Ein Forscherteam hat diverse Möglichkeiten und Lücken gefunden, aus der Java-Sandbox von Googles App Engine auszubrechen. Dadurch seien sogar beliebige Systemaufrufe im darunter liegenden Betriebssystem möglich. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-java-sandbox-ausbrueche-in-goog… *** DNS-Server BIND, PowerDNS und Unbound droht Endlosschleife *** --------------------------------------------- Eine Sicherheitslücke in den drei DNS-Servern kann dazu ausgenutzt werden, die Software lahmzulegen. Dazu muss ein Angreifer allerdings die Zonen manipulieren oder einen bösartigen DNS-Resolver einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/DNS-Server-BIND-PowerDNS-und-Unbound-d… *** The Penquin Turla - A Turla/Snake/Uroburos Malware for Linux *** --------------------------------------------- So far, every single Turla sample weve encountered was designed for the Microsoft Windows family, 32 and 64 bit operating systems. The newly discovered Turla sample is unusual in the fact that its the first Turla sample targeting the Linux operating system that we have discovered. --------------------------------------------- https://securelist.com/blog/research/67962/the-penquin-turla-2/ *** Setting Up Your Gadgets Securely *** --------------------------------------------- I'm sure that many of us will take home brand new iPhones and Android devices and set it up just the way we want our personal devices to be. We should take a minute to remember, however, that because these devices are so personal to us, the damage a hacked smartphone can do to is significant. Imagine what would happen if a hacker stole your personal data. We don't have to imagine, however, as this has happened to many users in 2014. At the very least, this is embarrassing to the user... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/setting-up-your-… *** Social Engineering improvements keep Rogues/FakeAV a viable scam *** --------------------------------------------- The threat landscape has been accustomed to rogues for a while now. They've been rampant for the past few years and there likely isn't any end in sight to this scam. These aren't complex pieces of malware by any means and typically don't fool the average experienced user, but that's because they're aimed at the inexperienced user. We're going to take a look at some of the improvements seen recently in the latest round of FakeAVs that lead to their success. --------------------------------------------- http://www.webroot.com/blog/2014/12/05/social-engineering-improvements-keep… *** MediaWiki unspecified cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99151 *** MediaWiki unspecified code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99152 *** [Xen-announce] Xen Security Advisory 114 (CVE-2014-9065, CVE-2014-9066) - p2m lock starvation *** --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-12/msg00001.html *** [TYPO3-announce] Announcing TYPO3 CMS 6.2.8 LTS *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS version 6.2.8 LTS, which is now ready for you to download. This version is maintenance releases and contains bug fixes. The packages can be downloaded here: http://typo3.org/download/ --------------------------------------------- http://typo3.org/news/article/typo3-cms-628-released/ *** Multiple vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting, Denial of Service and Local File Inclusion. --------------------------------------------- http://www.typo3.org/news/article/multiple-vulnerabilities-in-extension-php…

1 0

Tageszusammenfassung - Freitag 5-12-2014
by Daily end-of-shift report 05 Dec '14

05 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-12-2014 18:00 − Freitag 05-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-DEC - Microsoft Security Bulletin Advance Notification for December 2014 - Version: 1.0 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on December 9, 2014. This bulletin advance notification will be replaced with the December bulletin summary on December 9, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-DEC *** Missing Exchange Patch Expected Among December Patch Tuesday Bulletins *** --------------------------------------------- Microsofts December 2014 advanced Patch Tuesday notification includes three critical bulletins and a missing Exchange patch originally scheduled for November. --------------------------------------------- http://threatpost.com/missing-exchange-patch-expected-among-december-patch-… *** Details Emerge on Sony Wiper Malware Destover *** --------------------------------------------- Kaspersky Lab has published an analysis of Destover, the wiper malware used in the attacks against Sony Pictures Entertainment, and its similarities to Shamoon and DarkSeoul. --------------------------------------------- http://threatpost.com/details-emerge-on-sony-wiper-malware-destover/109727 *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-28) *** --------------------------------------------- December 4, 2014 --------------------------------------------- http://blogs.adobe.com/psirt/?p=1147 *** Upcoming Adobe Reader, Acrobat Update to Patch Sandbox Escape *** --------------------------------------------- Adobe announced security updates for Reader and Acrobat that likely include patches for a sandbox escape vulnerability. Googles Project Zero released details and exploit code earlier this week. --------------------------------------------- http://threatpost.com/upcoming-adobe-reader-acrobat-update-to-patch-sandbox… *** Weekly Metasploit Wrapup: On Unicorns and Wizards *** --------------------------------------------- This week, we shipped a brand new exploit for the "unicorn" bug in Microsoft Internet Explorer, CVE-2014-6332, not-so-prosaically entitled, Microsoft Internet Explorer Windows OLE Automation Array Remote Code Execution. This is a big deal client-side vulnerability for the usual reason that Internet Explorer 11 accounts for about a quarter of browser traffic today; nearly always, remote code execution bugs in latest IE are usually particularly dangerous to leave unpatched in your environment. The buzz around this bug, though, is that it's been exploitable... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/12/04/weekly-me… *** Schwachstelle: Yosemite schreibt Firefox-Eingaben mit *** --------------------------------------------- Unter Mac OS X 10.10 werden sämtliche Eingaben im Browser Firefox protokolliert. Mozilla spricht von einer schweren Schwachstelle, die in der aktuellen Version des Browsers geschlossen ist. Die Protokolldateien sind allgemein zugänglich und sollten gelöscht werden. --------------------------------------------- http://www.golem.de/news/schwachstelle-yosemite-schreibt-firefox-eingaben-m… *** Demo-Exploit für kritische Kerberos-Lücke in Windows Server *** --------------------------------------------- Höchste Zeit zu patchen: Mit dem Python Kerberos Exploitation Kit können sich Angreifer sonst zum Enterprise-Admin machen. --------------------------------------------- http://www.heise.de/security/meldung/Demo-Exploit-fuer-kritische-Kerberos-L… *** ZDI-14-403: (0Day) Microsoft Internet Explorer display:run-in Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-403/ *** ZDI: (0Day) 3S Pocketnet Tech VMS PocketNetNVRMediaClientAxCtrl.NVRMediaViewer.1 multiple Vulnerabilities *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-393 http://www.zerodayinitiative.com/advisories/ZDI-14-394 http://www.zerodayinitiative.com/advisories/ZDI-14-395 http://www.zerodayinitiative.com/advisories/ZDI-14-396 http://www.zerodayinitiative.com/advisories/ZDI-14-397 *** DSA-3090 iceweasel - security update *** --------------------------------------------- Multiple security issues have been found in Iceweasel, Debians versionof the Mozilla Firefox web browser: Multiple memory safety errors, bufferoverflows, use-after-frees and other implementation errors may lead tothe execution of arbitrary code, the bypass of security restrictions ordenial of service. --------------------------------------------- https://www.debian.org/security/2014/dsa-3090 *** Security Advisory: libxml2 vulnerability CVE-2014-3660 *** --------------------------------------------- (SOL15872) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15872.htm… *** Novell Patches and Security Updates *** --------------------------------------------- https://download.novell.com/Download?buildid=gV_oiDtqRV0~ https://download.novell.com/Download?buildid=vPrLP1Ai9zY~ https://download.novell.com/Download?buildid=GuVaYIx6DDo~ https://download.novell.com/Download?buildid=lHQCbRDbSMI~ https://download.novell.com/Download?buildid=Tlic28DXD3o~ https://download.novell.com/Download?buildid=zhVqTr2nsdg~ *** MediaWiki Bugs Permit Cross-Site Request Forgery and API Code Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031301 *** Security Advisories for VMware vSphere *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://www.vmware.com/security/advisories/VMSA-2014-0008.html http://www.vmware.com/security/advisories/VMSA-2014-0002.html *** HPSBUX03218 SSRT101770 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03205 rev.1 - HP Insight Remote Support Clients running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Insight Remote Support Clients running SSLv3 which may impact WBEM, WS-MAN and WMI connections from monitored devices to a HP Insight Remote Support Central Management Server (CMS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… Next End-of-Shift report on 2014-12-09

1 0

Tageszusammenfassung - Donnerstag 4-12-2014
by Daily end-of-shift report 04 Dec '14

04 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-12-2014 18:00 − Donnerstag 04-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** An Analysis of the "Destructive" Malware Behind FBI Warnings *** --------------------------------------------- TrendLabs engineers were recently able to obtain a malware sample of the "destructive malware" described in reports about the Federal Bureau of Investigation (FBI) warning to U.S. businesses last December 2. According to Reuters, the FBI issued a warning to businesses to remain vigilant against this new "destructive" malware in the wake of the recent Sony Pictures... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/ZsHCPcPYoQk/ *** Sony Got Hacked Hard: What We Know and Don't Know So Far *** --------------------------------------------- A week into the Sony hack, however, there is a lot of rampant speculation but few solid facts. Here's a look at what we do and don't know about what's turning out to be the biggest hack of the year. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/41179d61/sc/28/l/0L0Swired0N0C20A… *** Automating Incident data collection with Python, (Thu, Dec 4th) *** --------------------------------------------- One of my favorite Python modules isImpacketby the guys at Core Labs. Among other things it allows me to create Python scripts that can speak to Windows computers over SMB. I can use it to map network drives, kill processes on a remote machine and much more. During an incident having the ability to reach out to allthe machines in your environment to list or kill processes is very useful. Python andImpacketmake this very easy. Check it out. After installing Impacketall of the awesome modules are... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19025&rss *** Escaping the Internet Explorer Sandbox: Analyzing CVE-2014-6349 *** --------------------------------------------- Applications that have been frequently targeted by exploits frequently add sandboxes to their features in order to harden their defenses against these attacks. To carry out a successful exploit, an attacker will have to breach these sandboxes to run malicious code. As a result, researchers will pay particular attention to exploits that are able to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OnnBY6zHrlw/ *** Android Hacking and Security, Part 15: Hacking Android Apps Using Backup Techniques *** --------------------------------------------- In the previous article, we had an introduction on how to analyze Android application specific data using Android backup techniques. This article builds on the previous article. We are going to see how local data storage or basic checks that are performed on a local device can be exploited on... --------------------------------------------- http://resources.infosecinstitute.com/android-hacking-security-part-15-hack… *** WebSocket Security Issues *** --------------------------------------------- Overview In this article, we will dive into the concept of WebSocket introduced in HTML 5, security issues around the WebSocket model, and the best practices that should be adopted to address security issues around WebSocket. Before going straight to security, let's refresh our concepts on WebSocket. Why Websocket and... --------------------------------------------- http://resources.infosecinstitute.com/websocket-security-issues/ *** Avoiding Mod Security False Positives with White-listing *** --------------------------------------------- We have already discussed in my previous articles how to configure Mod Security Firewall with OWASP rules and also analysed the different types of logs which Mod Security generates. While analysing the logs, we have seen that the OWASP rules generate a lot of false positive results, as these rules [...]The post Avoiding Mod Security False Positives with White-listing appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/avoiding-mod-security-false-positives… *** Apple veröffentlicht Updates für Safari-Browser - und zieht sie wieder zurück *** --------------------------------------------- Laut Apple soll Safari 8.0.1 unter anderem Fehler im Zusammenhang mit iCloud-Diensten beheben. Gleichzeitig wurden Safari 6.2.1 und 7.1.1 für ältere OS-X-Versionen veröffentlicht. Apple hat die Updates allerdings kommentarlos offline genommen. --------------------------------------------- http://www.heise.de/security/meldung/Apple-veroeffentlicht-Updates-fuer-Saf… *** Quantum Attack on Public-Key Algorithm *** --------------------------------------------- This talk (and paper) describe a lattice-based public-key algorithm called Soliloquy developed by GCHQ, and a quantum-computer attack on it. News article.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/quantum_attack_.html *** The TYPO3 community publishes TYPO3 CMS 7.0 *** --------------------------------------------- Following our new release cycle, TYPO3 CMS 7.0 is the first sprint release on our way towards the final 7 LTS which will be released in fall 2015. 7.0 will not receive regular bugfix releases, an upgrade to 7.1 should be installed after its release in around 8 weeks instead - see our roadmap for more details. --------------------------------------------- https://typo3.org/news/article/the-typo3-community-publishes-typo3-cms-70-a… *** Cisco Unified Computing System (UCS) Manager Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-8009 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SA-CONTRIB-2014-117 - Hierarchical Select - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-117Project: Hierarchical Select (third-party module)Version: 6.xDate: 2014-December-03Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescriptionThe Hierarchical Select module provides a "hierarchical_select" form element, which is a greatly enhanced way for letting the user select items in a taxonomy. The module does not sanitize some of the user-supplied data... --------------------------------------------- https://www.drupal.org/node/2386615 *** SA-CONTRIB-2014-116 -Webform Invitation - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-116Project: Webform Invitation (third-party module)Version: 7.xDate: 2014-December-03Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to create custom invitation codes for Webforms.The module failed to sanitize node titles.This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new... --------------------------------------------- https://www.drupal.org/node/2386387 *** Security Advisory - High Severity - WordPress Download Manager *** --------------------------------------------- Advisory for: WordPress Download Manager Security Risk: Very High Exploitation level: Easy/Remote DREAD Score: 9/10 Vulnerability: Code Execution / Remote File Inclusion Risk Version: Read More --------------------------------------------- http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-do… *** Security Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products *** --------------------------------------------- Dec 04, 2014 18:26 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** DSA-3086 tcpdump - security update *** --------------------------------------------- Several vulnerabilities have been discovered in tcpdump, a command-line network traffic analyzer. These vulnerabilities might result in denial of service, leaking sensitive information from memory or, potentially, execution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3086 *** DSA-3089 jasper - security update *** --------------------------------------------- Josh Duart of the Google Security Team discovered heap-based bufferoverflow flaws in JasPer, a library for manipulating JPEG-2000 files,which could lead to denial of service (application crash) or theexecution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2014/dsa-3089 *** DSA-3088 qemu-kvm - security update *** --------------------------------------------- Paolo Bonzini of Red Hat discovered that the blit region checks wereinsufficient in the Cirrus VGA emulator in qemu-kvm, a fullvirtualization solution on x86 hardware. A privileged guest user coulduse this flaw to write into qemu address space on the host, potentiallyescalating their privileges to those of the qemu host process. --------------------------------------------- https://www.debian.org/security/2014/dsa-3088 *** DSA-3087 qemu - security update *** --------------------------------------------- Paolo Bonzini of Red Hat discovered that the blit region checks wereinsufficient in the Cirrus VGA emulator in qemu, a fast processoremulator. A privileged guest user could use this flaw to write into qemuaddress space on the host, potentially escalating their privileges tothose of the qemu host process. --------------------------------------------- https://www.debian.org/security/2014/dsa-3087 *** GNU cpio Heap Overflow in process_copy_in() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031285

1 0

Tageszusammenfassung - Mittwoch 3-12-2014
by Daily end-of-shift report 03 Dec '14

03 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-12-2014 18:00 − Mittwoch 03-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Shodan Add-on for Firefox *** --------------------------------------------- It's now possible to see what information Shodan has available on a server from within Firefox thanks to the new Shodan add-on created by @PaulWebSec and @romainletendart! It's a minimalistic yet powerful add-on to see what the website you're visiting is exposing to the Internet. And the add-on will also tell you other information about the IP,... --------------------------------------------- http://shodanio.wordpress.com/2014/12/02/shodan-add-on-for-firefox/ *** Böse Schlüssel werden zum Problem für GnuPG *** --------------------------------------------- Ein Forscherteam hat demonstriert, wie einfach sich die IDs zu GnuPG-Schlüsseln fälschen lassen und kurzerhand böse Duplikate des kompletten Strong-Sets erzeugt. Das umfasst rund 50.000 besonders eng vernetzte und vertrauenswürdige Schlüssel. --------------------------------------------- http://www.heise.de/security/meldung/Boese-Schluessel-werden-zum-Problem-fu… *** IBM Fixes Serious Code Execution Bug in Endpoint Manager Product *** --------------------------------------------- IBM has fixed a serious vulnerability in its Endpoint Manager product that could allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. The vulnerability lies in the Endpoint Manager for Mobile Devices component of the product and the researchers who discovered it said the bug could be used to compromise not... --------------------------------------------- http://threatpost.com/ibm-fixes-serious-code-execution-bug-in-endpoint-mana… *** An interesting case of the CVE-2014-8439 exploit *** --------------------------------------------- We have recently seen an exploit targeting the Adobe Flash Player vulnerability CVE-2014-8439 (we detect it as Exploit:SWF/Axpergle). This exploit is being integrated into multiple exploit kits, including the Nuclear exploit kit (Exploit:JS/Neclu) and the Angler exploit kit (Exploit:JS/Axpergle). Adobe released a patch in November to address this exploit (APSB14-26). Coincidentally, our investigation shows that Adobe released a patch to address a different exploit and that patch appears to... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/12/02/an-interesting-case-of-t… *** Keeping Your Website Safe From WordPress's XSS Vulnerability *** --------------------------------------------- Last month, a Finnish IT company by the name of Klikki Oy identified a critical vulnerability in WordPress - one which has been present in the platform for approximately four years. It allows attackers to enter comments which include malicious JavaScript. Once the script in these comments is executed, the attacker could then do anything from infecting the PCs of visitors to completely hijacking the website; locking the original administrator out of their account. --------------------------------------------- http://www.ahosting.net/blog/keeping-your-website-safe-from-wordpresss-xss-… *** A Physical Security Policy Can Save Your Company Thousands of Dollars *** --------------------------------------------- Investments in cybersecurity and physical security are proportionally connected to your organization's improved financial picture for a long-term perspective. Our digital lives are getting smaller as technology simplifies our communications, but cyber attacks are also prevalent. While the Internet radically changes the way organizations operate globally, from handling sensitive data to offshore outsourcing of IT architecture, the payoffs of security are significant and can't be... --------------------------------------------- http://resources.infosecinstitute.com/physical-security-policy-can-save-com… *** Samurai Web Testing Framework 3.0 - LiveCD Web Pen-testing Environment *** --------------------------------------------- The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test. --------------------------------------------- http://hack-tools.blackploit.com/2014/12/samurai-web-testing-framework-30-l… *** New LusyPOS malware is a cross between Dexter and Chewbacca *** --------------------------------------------- A new piece of Point-of-Sale RAM scraping malware has been submitted to VirusTotal and analyzed by researchers, who found that its a cross between two older and different POS malware families and is offered for sale on underground markets for $2,000. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2926 *** The Future of Auditory Surveillance *** --------------------------------------------- Interesting essay on the future of speech recognition, microphone miniaturization, and the future ubiquity of auditory surveillance.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/12/the_future_of_a.html *** DSA-3084 openvpn *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3084 *** Bugtraq: ESA-2014-156: EMC Documentum Content Server Insecure Direct Object Reference Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/534135 *** Bugtraq: ESA-2014-160: RSA Adaptive Authentication (On-Premise) Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/534136 *** F5 Security Advisories *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15147.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15158.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/300/sol15329.htm… *** Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-329-02 Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities that was published November 25, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for two vulnerabilities within products utilizing the Siemens WinCC application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-329-02A *** Elipse SCADA DNP3 Denial of Service *** --------------------------------------------- Independent researchers Adam Crain and Chris Sistrunk have identified a DNP3 denial of service vulnerability in the Elipse SCADA application. Elipse has produced a new version of the DNP3 driver that mitigates this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-303-02 *** Emerson ROC800 Multiple Vulnerabilities (Update A) *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities affecting the Emerson Process Management's ROC800 remote terminal units (RTUs) products (ROC800, ROC800L, and DL8000). --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-13-259-01A *** Yokogawa CENTUM and Exaopc Vulnerability (Update A) *** --------------------------------------------- Tod Beardsley of Rapid7 Inc. and Jim Denaro of CipherLaw have identified an authentication vulnerability and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 series and Exaopc products. JPCERT and Yokogawa have mitigated this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_powerkvm_2_issues… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 2-12-2014
by Daily end-of-shift report 02 Dec '14

02 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-12-2014 18:00 − Dienstag 02-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Researcher Releases Database of Known-Good ICS and SCADA Files *** --------------------------------------------- A prominent security researcher has put together a new database of hundreds of thousands of known-good files from ICS and SCADA software vendors in an effort to help users and other researchers identify legitimate files and home in on potentially malicious ones. The database, known as WhiteScope, comprises nearly 350,000 files, including executables and DLLs,... --------------------------------------------- http://threatpost.com/researcher-releases-database-of-known-good-ics-and-sc… *** CVE-2014-1824 - A New Windows Fuzzing Target *** --------------------------------------------- As time progresses, due to constant fuzzing and auditing many common Microsoft products are becoming reasonably hard targets to fuzz and find interesting crashes. There are two solutions to this: write a better fuzzer (http://lcamtuf.coredump.cx/afl/) or pick a less audited target. In a search for less audited attack surface, we are brought to MS14-038, Vulnerability... --------------------------------------------- http://blog.beyondtrust.com/cve-2014-1824-searching-for-windows-attack-surf… *** Kritische Lücke legt OpenVPN-Server lahm *** --------------------------------------------- Wer einen OpenVPN-Server betreibt, sollte diesen umgehend auf den aktuellen Stand bringen. Durch eine Schwachstelle können Angreifer dessen Erreichbarkeit erheblich beeinträchtigen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Luecke-legt-OpenVPN-Server-l… *** Operation DeathClick *** --------------------------------------------- The era of spear phishing and the waterhole attack, which uses social engineering, has come to an end. Hackers are now moving their tricky brains towards targeted Malvertising - a type of attack that uses online advertising to spread malware. A recent campaign termed "Operation death click" displays a new form of cyber-attack focused on specific targets. The attack is also defined as micro targeted malvertising. In this newly targeted variation of malvertising, the hackers are --------------------------------------------- http://resources.infosecinstitute.com/operation-deathclick/ *** 3Q 2014 Security Roundup: Vulnerabilities Under Attack *** --------------------------------------------- Our report on the threats seen in 3Q 2014 shows us that once again, software vulnerabilities are the most favored cybercriminal targets. Following the second quarter's infamous Heartbleed vulnerability came another serious vulnerability in open-source software: Shellshock. Having gone unnoticed for years, the Shellshock incident suggests that there might be more vulnerabilities in Bash or in... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/4qiLKTUdqhM/ *** Betrügerische E-Mails im Namen des Finanzministeriums in Umlauf *** --------------------------------------------- Täuschend echte Phishing-Masken in Design von FinanzOnline --------------------------------------------- http://derstandard.at/2000008913504 *** JSA10607 - 2014-01 Security Bulletin: Junos: Memory-consumption DoS attack possible when xnm-ssl or xnm-clear-text service enabled (CVE-2014-0613) *** --------------------------------------------- Product Affected: This issue can affect any product or platform running Junos OS. Problem: When xnm-ssl or xnm-clear-text is enabled within the [edit system services] hierarchy level of the Junos configuration, an unauthenticated, remote user could exploit the XNM command processor to consume excessive amounts of memory. This, in turn, could lead to system instability or other performance issues. --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10607 *** Security advisory - High severity - InfiniteWP Client WordPress plugin *** --------------------------------------------- Advisory for: InfiniteWP Client for WordPress Security Risk: High (DREAD score : 8/10) Exploitation level: Easy/Remote Vulnerability: Privilege escalation and potential Object Injection vulnerability. Patched Version: 1.3.8 If you're using the InfiniteWP WordPress Client plugin to manage your website, now is a good time to update. While doing a routine audit of our Website FirewallRead More --------------------------------------------- http://blog.sucuri.net/2014/12/security-advisory-high-severity-infinitewp-c… *** Security Bulletin: Unauthenticated Remote Code Execution in IBM Endpoint Manager Mobile Device Management (CVE-2014-6140) *** --------------------------------------------- A vulnerability exists in IBM Endpoint Manager Mobile Device Management component, where an attacker could misuse cookies to execute arbitrary code. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691701 *** Security Advisory: PHP vulnerability CVE-2013-2110 *** --------------------------------------------- (SOL15876) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15876.htm… *** Security Advisory: SOAP parser vulnerability CVE-2013-1824 *** --------------------------------------------- (SOL15879) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15879.htm… *** Yokogawa FAST/TOOLS XML information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99018 *** EntryPass N5200 Credential Disclosure *** --------------------------------------------- Topic: EntryPass N5200 Credential Disclosure Risk: Low Text:Advisory: EntryPass N5200 Credentials Disclosure EntryPass N5200 Active Network Control Panels allow the unauthenticated do... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120010 *** 1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting *** --------------------------------------------- Topic: 1830 Photonic Service Switch PSS-32/16/4 Cross Site Scripting Risk: Low Text: # # # SWISSCOM CSIRT ADVISORY - http://www.swisscom.com/security # # # # CVE ID: ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120009 *** Security Advisory-Multiple Vulnerabilities on Huawei P2 product *** --------------------------------------------- Dec 02, 2014 15:22 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Montag 1-12-2014
by Daily end-of-shift report 01 Dec '14

01 Dec '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-11-2014 18:00 − Montag 01-12-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** [Update] (Keine) Sicherheitsheitslücke in Ciscos H.264-Modul für Firefox *** --------------------------------------------- Cisco hat eine Sicherheitswarnung wegen seines jüngst für Firefox bereitgestellten Video-Codecs herausgegeben. [update]Allerdings soll dies nicht die im aktuellen Webbrowser verwendete Version betreffen.[/update] --------------------------------------------- http://www.heise.de/security/meldung/Update-Keine-Sicherheitsheitsluecke-in… *** EVIL researchers dupe EVERY 32 bit GPG print *** --------------------------------------------- Keys fall in four seconds Researchers have found collision attacks for 32 bit GPG keys leaving the superseded technology well and truly dead. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/12/01/evil_resear… *** Critical denial of service vulnerability in OpenVPN servers *** --------------------------------------------- A critical denial of service security vulnerability affecting OpenVPN servers was recently brought to our attention. A fixed version of OpenVPN (2.3.6) will be released today/tomorrow (1st Dec 2014) at around 18:00 UTC. --------------------------------------------- https://forums.openvpn.net/topic17625.html *** FIN4: Stealing Insider Information for an Advantage in Stock Trading? *** --------------------------------------------- FireEye tracks a threat group that we call “FIN4,” whose intrusions seem to have a different objective: to obtain an edge in stock trading. FIN4 appears to conduct intrusions that are focused on a single objective: obtaining access to insider information capable of making or breaking the stock prices of public companies. The group specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and compliance personnel, and other individuals who would regularly discuss confidential, market-moving information. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.ht… *** ENISA survey: New Directions in securing personal Data *** --------------------------------------------- Under the growing interest in the areas of personal data protection and cryptography, ENISA has launched a project with the objective to detect the existing technological gaps in the fields. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-survey-new-directions-in-… *** Flushing out the Crypto Rats - Finding "Bad Encryption" on your Network, (Mon, Dec 1st) *** --------------------------------------------- Just when folks get around to implementing SSL, we need to retire SSL! Not a week goes buy that a client isnt asking me about SSL (or more usually TLS) vulnerabilities or finding issue son their network. In a recent case, my client had just finished a datacenter / PCI audit, and had one of his servers come up as using SSL 2.0, which of course has been deprecated since 1996 - the auditors recommendation was to update to SSL 3.0 (bad recommendation, keep reading on). When he then updated to SSL... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19009&rss *** AGbot DDoS Attacks Internet VNC Servers *** --------------------------------------------- Last week, our FortiGuard Labs Threat Intelligence system was able to capture a DDoS attack targeting internet VNC servers. The attack was raised by a brand new IrcBot, which we are detecting as W32/AGbot.AB!tr. Let's now dig into the details of this attack. --------------------------------------------- http://blog.fortinet.com/post/agbot-ddos-attacks-internet-vnc-servers *** Researchers identify POS malware targeting ticket machines, electronic kiosks *** --------------------------------------------- Electronic kiosks and ticketing systems are being targeted by a new type of point-of-sale (POS) threat known as "d4re|dev1|," which acts as an advanced backdoor with remote administration and has RAM scraping and keylogging features, according to IntelCrawler. --------------------------------------------- http://www.scmagazine.com/researchers-identify-pos-malware-targeting-ticket… *** Early version of new POS malware family spotted *** --------------------------------------------- A security researcher came across what appears to be a new family of point-of-sale malware that few antivirus programs were detecting. Nick Hoffman, a reverse engineer, wrote the Getmypass malware shares traits that are similar to other so-called RAM scrapers, which collect unencrypted payment card data held in a payment system's memory. --------------------------------------------- http://www.cio.com/article/2853274/early-version-of-new-pos-malware-family-… *** Sandbox Escape Bug in Adobe Reader Disclosed *** --------------------------------------------- Details and exploit code for a vulnerability in Adobe Reader have surfaced and the bug can be used to break out of the Reader sandbox and execute arbitrary code. The bug was discovered earlier this year by a member of Google's Project Zero and reported to Adobe, which made a change to Reader that made it... --------------------------------------------- http://threatpost.com/sandbox-escape-bug-in-adobe-reader-disclosed/109637 *** Using Shodan from the Command-Line *** --------------------------------------------- Have you ever needed to write a quick script to download data from Shodan? Or setup a cronjob to check what Shodan found on your network recently? How about getting a list of IPs out of the Shodan API? For the times where you'd like to have easy script-friendly access to Shodan there's now a new command-line tool appropriately called shodan. --------------------------------------------- http://shodanio.wordpress.com/2014/12/01/using-shodan-from-the-command-line/ *** l+f: Türsteuerung mit Hintertür *** --------------------------------------------- Beim Türsteuerungsmodul Entrypass N5200 ist der Name Programm: Rein kommt jeder - zumindest wenn er nicht durch die Tür sondern übers Netz kommt. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Tuersteuerung-mit-Hintertuer-24700… *** Dridex Phishing Campaign uses Malicious Word Documents, (Mon, Dec 1st) *** --------------------------------------------- This is a guest diary submitted by Brad Duncan. During the past few months, Botnet-based campaigns have sent waves of phishing emails associated with Dridex. Today, well examine a wave that occurred approximately 3 weeks ago. The emails contained malicious Word documents, and with macros enabled, these documents infected Windows computers with Dridex malware. Various people have posted about Dridex [1] [2], and some sites like Dynamoos blog [3] and TechHelpList [4] often report on these and --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19011&rss *** Malware: Gefälschte Telekom-Rechnungen mit vollständigen Kundennamen *** --------------------------------------------- Die seit November 2014 kursierenden Mails mit Malware in Form von Dateianhängen an vermeintlichen Rechnungen der Telekom haben eine neue Qualität erreicht. Die Empfänger werden darin nun mit ihrem Vor- und Nachnamen angesprochen. --------------------------------------------- http://www.golem.de/news/malware-gefaelschte-telekom-rechnungen-mit-vollsta… *** Clubbing Seals - Exploring the Ecosystem of Third-party Security Seals *** --------------------------------------------- Is this website secure? Well, it just contains statically generated content and holds no personal information, so most likely it is. But how would you be able to tell whether it actually is secure? This problem is exactly what security seal providers are trying to tackle. These seal providers offer a service which allows website owners to show their customers that their website is secure, and therefore safe to use. This works as follows:... --------------------------------------------- https://vagosec.org/2014/11/clubbing-seals/ *** Raiffeisen warnt vor Trojaner beim Online-Banking *** --------------------------------------------- Keine "Test-Überweisungen" durchführen --------------------------------------------- http://derstandard.at/2000008856256 *** DSA-3081 libvncserver *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3081 *** DSA-3080 openjdk-7 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3080 *** DSA-3083 mutt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3083 *** DSA-3082 flac *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3082 *** Security Notice-Statement on Multiple Vulnerabilities in Huawei P2 Smartphone *** --------------------------------------------- Nov 29, 2014 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Vuln: LibYAML and Perl YAML-LibYAML Module scanner.c Remote Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/71349 *** Bugtraq: CVE-2014-3809: Reflected XSS in Alcatel Lucent 1830 PSS-32/16/4 *** --------------------------------------------- http://www.securityfocus.com/archive/1/534124

1 0

Tageszusammenfassung - Freitag 28-11-2014
by Daily end-of-shift report 28 Nov '14

28 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-11-2014 18:00 − Freitag 28-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Syrian Electronic Army attack leads to malvertising, (Thu, Nov 27th) *** --------------------------------------------- A number of online services were impacted by what has been referred to by multiple sources as a redirection attack by Syrian Electronic Army (SEA) emanating from the Gigya CDN. Gigya explained the issue as follows: Gigya explained that earlier today at 06:45 EST, it noticed sporadic failures with access to our service. The organization than found a breach at its domain registrar, with the hackers modifying DNS entries and pointing them away from Gigyas CDN domain, instead redirecting to their... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19001&rss *** Worlds best threat detection pwned by HOBBIT *** --------------------------------------------- Forget nation-states, BAB0 is the stuff of savvy crims Some of the worlds best threat detection platforms have been bypassed by custom malware in a demonstration of the fallibility of single defence security. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/28/malware_cru… *** ENISA publishes the first framework on how to evaluate National Cyber Security Strategies *** --------------------------------------------- ENISA issues today an Evaluation Framework on National Cyber Security Strategies (NCSS) addressed to policy experts and government officials who design, implement and evaluate an NCSS policy. This work is strongly aligned with the EU Cyber Security Strategy (EU CSS) and aims to assist Member States in developing capabilities in the area of NCSS. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-publishes-the-first-f… *** CryptoPHP: Hinterlistiger Schadcode hat zehntausende Server infiziert *** --------------------------------------------- Der Schädling versteckt sich in raubkopierten Themes und Plug-ins für die Content-Management-Systeme Drupal, WordPress und Joomla. Einmal infiziert, wird der Server Teil eines Botnetzes, das Such-Rankings manipuliert. Zum Schaden der eigenen Seite. --------------------------------------------- http://www.heise.de/newsticker/meldung/CryptoPHP-Hinterlistiger-Schadcode-h… *** Kritische Updates für Siemens-Industriesteuerungen *** --------------------------------------------- Ein Update soll kritisches Sicherheitslücken in der Software Simatic WinCC schließen, die als Kontrollzentrum für die Überwachung und Steuerung industrieller Anlagen zum Einsatz kommt. Allerdings gibt es das Update noch nicht für alle Versionen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Updates-fuer-Siemens-Industr… *** Economic Failures of HTTPS Encryption *** --------------------------------------------- Interesting paper: "Security Collapse of the HTTPS Market." From the conclusion: Recent breaches at CAs have exposed several systemic vulnerabilities and market failures inherent in the current HTTPS authentication model: the security of the entire ecosystem suffers if any of the hundreds of CAs is compromised (weakest link); browsers are unable to revoke trust in major CAs ("too big to... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/economic_failur.html *** Fehler in H.264-Plugin könnte Firefox-Nutzer betreffen *** --------------------------------------------- [...] In dem dazugehörigen Bugreport bei Mozilla schreibt der Cisco-Angestellte Ethan Hugg, dass der Fehler in keiner Version des bisher für Firefox bereitgestellten OpenH.264-Moduls vorhanden ist. Noch führen die Mozilla-Hacker den Fehler allerdings nicht als offiziell behoben. Nachtrag vom 28. November 2014, 13:10 Uhr Laut Cisco sind Firefox-Nutzer nicht betroffen, wir haben den Artikel entsprechend angepasst. --------------------------------------------- http://www.golem.de/news/cisco-fehler-in-h-264-plugin-betrifft-alle-firefox… *** Bugtraq: Defense in depth -- the Microsoft way (part 22): no DEP in Windows filesystem (and ASLR barely used) *** --------------------------------------------- http://www.securityfocus.com/archive/1/534109

1 0

Tageszusammenfassung - Donnerstag 27-11-2014
by Daily end-of-shift report 27 Nov '14

27 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-11-2014 18:00 − Donnerstag 27-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** New anti-APT tools are no silver bullets: An independent test of APT attack detection appliances *** --------------------------------------------- New anti-APT tools are no silver bullets: An independent test of APT attack detection appliances CrySyS Lab, BME http://www.crysys.hu/ MRG-Effitas https://www.mrg-effitas.com/ November 26, 2014. The term Advanced Persistent Threat (APT) refers to a potential attacker that has the capability and the intent to carry out advanced attacks against specific high profile targets in order to [...] --------------------------------------------- http://blog.crysys.hu/2014/11/new-anti-apt-tools-are-no-silver-bullets-an-i… *** Adobe Reader sandbox popped says Google researcher *** --------------------------------------------- Yet another reason to make sure youve patched promptly and properly The Acrobat Reader Windows sandbox contains a vulnerability that could allow attackers to break out and gain higher privileges, Google security bod James Forshaw claims. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/27/adobe_reade… *** Crunch - Password Cracking Wordlist Generator *** --------------------------------------------- Features: crunch generates wordlists in both combination and permutation ways it can breakup output by number of lines or file size * now has resume support * pattern now supports number and symbols * pattern now supports upper and lower case characters separately * adds a status report when generating multiple files * new -l option for literal support of @,%^ * new -d option to limit duplicate characters see man file for details * now has unicode support... --------------------------------------------- http://hack-tools.blackploit.com/2014/11/crunch-password-cracking-wordlist.… *** SEC Risk Factors: How To Determine The Business Value Of Your Data To A Foreign Government *** --------------------------------------------- This white paper will explore where the SEC is headed on this issue and propose a novel solution that's both specific to the company and avoids the potential danger of revealing too much information about company vulnerabilities - the ability to verifiably assess the value of your intellectual property (IP) to a rival Nation State by establishing its Target Asset Value™. --------------------------------------------- http://jeffreycarr.blogspot.co.uk/2014/11/sec-risk-factors-how-to-determine… *** Factsheet HTTPS could be a lot more secure *** --------------------------------------------- HTTPS is a frequently used protocol for protecting web traffic against parties setting out to eavesdrop on or manipulate the traffic. Configuring HTTPS requires precision: there are many options, and by no means all of them are secure. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Cisco: Fehler in H.264-Plugin betrifft alle Firefox-Nutzer *** --------------------------------------------- Ein Fehler in der Speicherverwaltung des H.264-Plugins betrifft potentiell alle Firefox-Nutzer, da Mozilla dieses zwangsweise installiert. Besonders schwerwiegend ist der Fehler zwar nicht, er offenbart aber ein Problem in der Zusammenarbeit mit Cisco. --------------------------------------------- http://www.golem.de/news/cisco-fehler-in-h-264-plugin-betrifft-alle-firefox… *** l+f: Nur zwei Tage vom Patch zum Exploit-Kit *** --------------------------------------------- Der Zeitraum zwischen der Bekanntgabe einer Lücke durch einen Patch und deren aktiver Ausnutzung wird immer kürzer. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Nur-zwei-Tage-vom-Patch-zum-Exploi… *** Meta-Hack stört hunderte Medien-Webseiten *** --------------------------------------------- Auf hunderten großer Webseiten erschien am Donnerstag die Meldung "You have been hacked". Ursache war eine eingebettete Kommentarfunktion von Gigya. --------------------------------------------- http://www.heise.de/security/meldung/Meta-Hack-stoert-hunderte-Medien-Webse… *** TYPO3 CMS 4.5.38 and 6.2.7 released *** --------------------------------------------- The TYPO3 Community announces the versions 4.5.38 LTS and 6.2.7 LTS of the TYPO3 Enterprise Content Management System. All versions are maintenance releases and contain bug fixes. --------------------------------------------- https://typo3.org/news/article/typo3-cms-4538-and-627-released/ *** TYPO3-EXT-SA-2014-017: Improper Access Control in WebDav for filemounts (webdav) *** --------------------------------------------- It has been discovered that the extension "WebDav for filemounts" (webdav) is susceptible to Improper Access Control. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 2.0.0 Vulnerability Type: Improper Access Control Severity: Medium Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:P/A:N/E:H/RL:OF/RC:C --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** DSA-3077 openjdk-6 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3077 *** Cisco ASA SSL VPN Memory Consumption Error Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031269 *** Mutt Buffer Overflow in mutt_substrdup() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031266 *** Xen Security Advisory 112 (CVE-2014-8867) - Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor *** --------------------------------------------- Acceleration support for the "REP MOVS" instruction, when the first iteration accesses memory mapped I/O emulated internally in the hypervisor, incorrectly assumes that the whole range accessed is handled by the same hypervisor sub-component. Impact: A buggy or malicious HVM guest can crash the host. Mitigation: Running only PV guests will avoid this issue. There is no mitigation available for HVM guests. Resolution: Applying the appropriate attached patch resolves this issue. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00006.html *** Xen Security Advisory 111 (CVE-2014-8866) - Excessive checking in compatibility mode hypercall argument translation *** --------------------------------------------- Impact: A buggy or malicious HVM guest can crash the host. Mitigation: Running only PV guests will avoid this issue. There is no mitigation available for HVM guests on any version of Xen so far released by xenproject.org. Resolution: Applying the appropriate attached patch resolves this issue. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00005.html *** F5 Security Advisories *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15877.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15875.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15881.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15868.htm… https://support.f5.com:443/kb/en-us/solutions/public/15000/800/sol15885.htm…

1 0

Tageszusammenfassung - Mittwoch 26-11-2014
by Daily end-of-shift report 26 Nov '14

26 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-11-2014 18:00 − Mittwoch 26-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-26) *** --------------------------------------------- A Security Bulletin (APSB14-26) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1144 *** Brain Science and Browser Warnings *** --------------------------------------------- Computer users will click through browser warnings and security alerts in order to complete a task, but once theyre hacked, their behaviors change, a recent BYU study learned. --------------------------------------------- http://threatpost.com/brain-science-and-browser-warnings/109615 *** Multiple vulnerabilities in ARRIS VAP2500 *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-389/ http://www.zerodayinitiative.com/advisories/ZDI-14-388/ http://www.zerodayinitiative.com/advisories/ZDI-14-387/ *** DSA-3076 wireshark *** --------------------------------------------- Multiple vulnerabilities were discovered in the dissectors/parsers for SigComp UDVM, AMQP, NCP and TN5250, which could result in denial of service. --------------------------------------------- http://www.debian.org/security/2014/dsa-3076 *** ModSecurity Advanced Topic of the Week: Detecting Malware with Fuzzy Hashing *** --------------------------------------------- In the most recent release of ModSecurity v2.9.0-RC1, we introduced a new operator called @fuzzyHash which uses functionality from the ssdeep tool. This blog post will demonstrate a powerful use-case with ModSecurity which is identifying .. --------------------------------------------- http://blog.spiderlabs.com/2014/11/modsecurity-advanced-topic-of-the-week-d… *** Google Doc Embedder plugin for WordPress google-document-embedder\view.php SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98944 *** VB2014 paper: Labelling spam through the analysis of protocol patterns *** --------------------------------------------- What do your IP packet sizes say about whether youre a spammer?Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Labelling spam through the analysis .. --------------------------------------------- http://www.virusbtn.com/blog/2014/11_26.xml *** Typos Can have a Bigger Impact Than Expected *** --------------------------------------------- Have you ever thought about the cost of a typo? You know what I mean, a simple misspelling of a word somewhere on your website. Do you think there's a risk in that? You may have seen the Grammar Police all over your comments .. --------------------------------------------- http://blog.sucuri.net/2014/11/typos-can-have-a-bigger-impact-than-expected… *** Black Friday and Cyber Monday - 4 Scams To Watch Out For While Shopping *** --------------------------------------------- Holiday Shopping season is really an excited time for both shoppers and retailers, but unfortunately its a good time for cyber criminals and scammers as well. With Black Friday .. --------------------------------------------- http://thehackernews.com/2014/11/black-friday-and-cyber-monday-4-scams_26.h… *** Mängel beim Selbstschutz von Antiviren-Software *** --------------------------------------------- Nur 2 von 32 getesteten Antivirus-Produkten setzen eigentlich selbstverständliche Schutztechniken wie DLP und ASLR auch wirklich konsequent ein, stellte das deutsche Testlabor AV-Test fest. --------------------------------------------- http://www.heise.de/security/meldung/Maengel-beim-Selbstschutz-von-Antivire… *** CryptoPHP a week later: more than 23.000 sites affected *** --------------------------------------------- On November 20th we published our report on CryptoPHP. Since publishing we have, together with other parties, been busy dealing with the affected servers and taking down the CryptoPHP infrastructure. Sinkhole .. --------------------------------------------- http://blog.fox-it.com/2014/11/26/cryptophp-a-week-later-more-than-23-000-s… *** MatrikonOPC for DNP Unhandled C++ Exception *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-01 *** Siemens SIMANTIC WinCC, PCS7, and TIA Portal Vulnerabilities *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-329-02 *** Hintergrund: Schwachstellen-Scanner für Web-Applikationen *** --------------------------------------------- Ein guter Überblick präsentiert 16 Open-Source-Scanner für Web-Applikationen, die Lücken von XSS bis hin zu SQL-Injection aufspüren. --------------------------------------------- http://www.heise.de/security/artikel/Schwachstellen-Scanner-fuer-Web-Applik…

1 0

Tageszusammenfassung - Dienstag 25-11-2014
by Daily end-of-shift report 25 Nov '14

25 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-11-2014 18:00 − Dienstag 25-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Remote Code Execution in Popular Hikvision Surveillance DVR *** --------------------------------------------- A number Hikvision digital video recorders contain vulnerabilities that an attacker could remotely exploit in order to gain full control of those devices. --------------------------------------------- http://threatpost.com/remote-code-execution-in-popular-hikvision-surveillan… *** Multiple Dell SonicWALL products code execution *** --------------------------------------------- Multiple Dell SonicWALL products could allow a remote authenticated attacker to execute arbitrary code on the system, caused by the failure to validate user data prior to executing a command in the GMS ViewPoint .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98911 *** Obfuscated Flash Files Make Their Mark in Exploit Kits *** --------------------------------------------- In recent years, we noticed that more and more malicious Adobe Flash (.SWF) files are being incorporated into exploit kits like the Magnitude Exploit Kit, the Angler Exploit Kit, and the Sweet Orange Exploit Kit. However, we did some more .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malicious-flash-… *** The Other Side of Masque Attacks: Data Encryption Not Found in iOS Apps *** --------------------------------------------- Based on our research into the iOS threat Masque Attacks announced last week, Trend Micro researchers have found a new way that malicious apps installed through successful Masque Attacks can pose a threat to iOS devices: by accessing unencrypted data used by legitimate apps. According to reports, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-other-side-o… *** Docker docker pull privilege escalation *** --------------------------------------------- Docker could allow a remote attacker to gain elevated privileges on the system, caused by an error in the docker pull and the docker load operations. An attacker could exploit this vulnerability to gain elevated privileges on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98924 *** Docker image privilege escalation *** --------------------------------------------- Docker could allow a remote attacker to gain elevated privileges on the system, caused by the ability to modify the default run profile of containers by images. attacker could exploit this vulnerability to gain elevated privileges on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98925 *** WordPress wpDataTables 1.5.3 SQL Injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110163 *** WordPress wpDataTables 1.5.3 Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110162 *** [oCERT 2014-008] heap overflow, remote code execution in libFLAC *** --------------------------------------------- FLAC is an open source lossless audio codec supported by several software and music players. The libFLAC project, an open source library implementing reference encoders and decoders for native FLAC and Ogg FLAC audio content, suffers from multiple implementation issues. In particular, a stack overflow and a heap overflow condition, which may .. --------------------------------------------- http://www.ocert.org/advisories/ocert-2014-008.html *** Chrome läutet Ende für Browser-Plugins ein *** --------------------------------------------- Ab Jänner werden sämtliche NPAPI-Plugins blockiert - Silverlight und Java betroffen --------------------------------------------- http://derstandard.at/2000008592582 *** Hacker legen Sony Pictures komplett lahm *** --------------------------------------------- Unbekannte haben am Montag den Firmenbetrieb bei Sony Pictures zum Erliegen gebracht. Sie sollen sämtliche Computer im Firmennetz der Sony-Tochter gekapert haben. Auch das Play-Store-Konto von Sony soll betroffen sein. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-legen-Sony-Pictures-komplett-la… *** Secret Malware in European Union Attack Linked to U.S. and British Intelligence *** --------------------------------------------- Complex malware known as Regin is the suspected technology behind sophisticated cyberattacks conducted by U.S. and British intelligence agencies on the European Union and a Belgian telecommunications company, according to security industry sources and technical analysis conducted by The Intercept. --------------------------------------------- https://firstlook.org/theintercept/2014/11/24/secret-regin-malware-belgacom… *** EU-Experten: Exporte von Spähsoftware sollen stärker kontrolliert werden *** --------------------------------------------- Wirtschaftsminister Gabriel will den Export von Spähsoftware auf EU-Ebene einschränken. Erste Firmen suchen aber schon Wege, um der Exportkontrolle zu entgehen. --------------------------------------------- http://www.golem.de/news/eu-experten-exporte-von-spaehsoftware-sollen-staer…

1 0

Tageszusammenfassung - Montag 24-11-2014
by Daily end-of-shift report 24 Nov '14

24 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-11-2014 18:00 − Montag 24-11-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Website Malware Removal: Phishing *** --------------------------------------------- As we continue on our Malware Removal series we turn our attention to the increasing threat of Phishing infections. Just like a fisherman casts and reels with his fishing rod, a .. --------------------------------------------- http://blog.sucuri.net/2014/11/website-malware-removal-phishing.html *** Asterisk IP address security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98863 *** "NotCompatible": Die bisher hartnäckigste Android-Malware *** --------------------------------------------- Schadsoftware infiziert täglich 20.000 Geräte - Für Spam-Versand, Ticket-Kauf und Word-Press-Hacking --------------------------------------------- http://derstandard.at/2000008502545 *** DoubleDirect MitM Attack Targets Android, iOS and OS X Users *** --------------------------------------------- Security researchers have discovered a new type of "Man-in-the-Middle" (MitM) attack in the wild targeting smartphone and tablets users on devices running either iOS or Android around the world. The MitM attack, dubbed DoubleDirect, enables an attacker to redirect a victim's traffic of major websites .. --------------------------------------------- http://thehackernews.com/2014/11/doubledirect-mitm-attack-targets_22.html *** Spearphishing: Jeder Fünfte geht in die Falle *** --------------------------------------------- IT-Benutzer sind gutgläubig. Ein Rabattversprechen reicht, um jede Menge Passwörter einzusammeln. Auf der Wiener Security-Konferenz Deepsec wurden erschreckende Zahlen aus der Praxis verraten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Spearphishing-Jeder-Fuenfte-geht-in-… *** A Nightmare on Malware Street *** --------------------------------------------- Another ransomware has been spotted in the wild lately, branded as CoinVault. This one involves some interesting details worth mentioning, including the peculiar characteristic of offering the free decryption of one of the hostage files a.. --------------------------------------------- http://securelist.com/blog/virus-watch/67699/a-nightmare-on-malware-street/ *** ClamA libclamav/pe.c buffer overflow *** --------------------------------------------- ClamAV is vulnerable to a Heap Based buffer overflow, caused by improper bounds checking by the libclamav/pe.c file. A local attacker could overflow a buffer and execute arbitrary code on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98882 *** Crypto protocols held back by legacy, says ENISA *** --------------------------------------------- EU takes the microscope to security The EU Agency for Network Information and Security (ENISA) has updated its 2013 crypto guidelines, designed to help developers protect personal information in line with EU law, and has sternly told crypto .. --------------------------------------------- http://www.theregister.co.uk/2014/11/24/crypto_protocols_held_back_by_legac… *** Symantec reseachers find Regin malware, label it the new Stuxnet *** --------------------------------------------- Government probably penned peerless p0wn cannon aimed at Russian and Saudi targets An advanced malware instance said to be as sophisticated as Stuxnet and Duqu has has been detected attacking the top end of town and has .. --------------------------------------------- http://www.theregister.co.uk/2014/11/24/regin/ *** Triggering MS14-066 *** --------------------------------------------- Microsoft addressed CVE-2014-6321 this Patch Tuesday, which has been hyped as the next Heartbleed. This vulnerability (actually at least 2 vulnerabilities) promises remote code execution in applications that use the SChannel Security .. --------------------------------------------- http://blog.beyondtrust.com/triggering-ms14-066 *** Hacking RFID Payment Cards Made Possible with Android App *** --------------------------------------------- We recently encountered a high-risk Android app detected as ANDROIDOS_STIP.A in Chile. This app, found distributed through forums and blogs, can be used to hack into the user's RFID bus transit card to recharge the credits. What is the mechanism .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-rfid-pay… *** Protecting Against Unknown Software Vulnerabilities *** --------------------------------------------- Bugs exist in every piece of code. It is suggested that for every 1,000 lines of code, there are on average 1 to 5 bugs to be found. Some of these bugs can have a security implications, these are known as vulnerabilities. These vulnerabilities can be used to exploit and compromise your server, your siteRead More --------------------------------------------- http://blog.sucuri.net/2014/11/protecting-against-unknown-software-vulnerab… *** Linux-Distribution: Less ist ein mögliches Einfallstor *** --------------------------------------------- Das Tool Less wird unter Linux oft benutzt, um in Verbindung mit anderen Tools etwa Dateien zu öffnen. Damit würden viele Fehler und Sicherheitslücken provoziert, meint ein profilierter Hacker. --------------------------------------------- http://www.golem.de/news/linux-distribution-less-als-moegliches-einfallstor… *** Drupal-Update schiebt Session-Klau den Riegel vor *** --------------------------------------------- Die Entwickler des Open-Source CMS haben zwei Sicherheitslücken in Drupal 6 und 7 geschlossen. Die Schwachstellen können missbraucht werden, um Sessions angemeldeter Benutzer zu stehlen und um den Server lahmzulegen. --------------------------------------------- http://www.heise.de/security/meldung/Drupal-Update-schiebt-Session-Klau-den…

1 0

Tageszusammenfassung - Freitag 21-11-2014
by Daily end-of-shift report 21 Nov '14

21 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-11-2014 18:00 − Freitag 21-11-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Rich Telemetry for Cyber Incident Response and Malicious Code Analysis on Microsoft Windows *** --------------------------------------------- 5..4..3..2..1..launch Earlier this week we launched the first product from the research and development efforts of the NCC Group Security Labs team. NCC Group Security Labs is a combined centre within NCC Group which brings together experts from Security Technical Assurance, Security Research, Cyber Defence Operations and Security Software Development to work on innovative software solutions for real-world cyber security problems. The Problem The world of Cyber Defence Operations involves, in... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/11/rich-telemetry-for-cyber-incident-… *** Securing Personal Data: ENISA guidelines on Cryptographic solutions *** --------------------------------------------- ENISA is launching two reports today. The “Algorithms, key size and parameters” report of 2014 is a reference document providing a set of guidelines to decision makers, in particular specialists designing and implementing cryptographic solutions for personal data protection within commercial organisations or governmental services for citizens. The “Study on cryptographic protocols” provides an implementation perspective, covering guidelines regarding protocols required to protect commercial online communications containing personal data. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/securing-personal-data-enis… *** Weekly Metasploit Wrapup: Exploiting Mobile Security Software *** --------------------------------------------- Exploiting Security Software: Android Edition --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/21/weekly-me… *** VB2014 paper: Sweeping the IP space: the hunt for evil on the Internet *** --------------------------------------------- Dhia Mahjoub explains how the topology of the AS graph can be used to uncover hotspots of maliciousness.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Sweeping the IP space: the hunt for evil on the Internet by OpenDNS researcher Dhia Mahjoub.The Internet is often described as a network of networks. These individual networks are called Autonomous Systems (AS): collections of IPv4 and IPv6 network... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_21.xml?rss *** WordPress 4.0.1 Update Patches Critical XSS Vulnerability *** --------------------------------------------- The latest version of WordPress, 4.0.1, patches a critical cross-site scripting vulnerability in comment fields that enables admin-level control over a website. --------------------------------------------- http://threatpost.com/wordpress-4-0-1-update-patches-critical-xss-vulnerabi… *** The Internet of Things (IoT) will fail if security has no context *** --------------------------------------------- The Internet of Things requires a new way of thinking and acting, one that will protect a business and help it grow. --------------------------------------------- http://www.scmagazine.com/the-internet-of-things-iot-will-fail-if-security-… *** Detekt - Free Anti-Malware Tool To Detect Govt. Surveillance Malware *** --------------------------------------------- Human rights experts and Privacy International have launched a free tool allowing users to scan their computers for surveillance spyware, typically used by governments and other organizations to spy on human rights activists and journalists around the world. This free-of-charge anti-surveillance tool, called Detekt, is an open source software app released in partnership with Human rights... --------------------------------------------- http://thehackernews.com/2014/11/detekt-free-anti-malware-tool-to-detect_20… *** Most Targeted Attacks Exploit Privileged Accounts *** --------------------------------------------- Most targeted attacks exploit privileged account access according to a new report commissioned by the security firm CyberArk. --------------------------------------------- http://threatpost.com/most-targeted-attacks-exploit-privileged-accounts/109… *** Security Advisory - High severity - WP-Statistics WordPress Plugin *** --------------------------------------------- Advisory for: WordPress WP-Statistics Plugin Security Risk: High (DREAD score : 7/10) Exploitation level: Easy/Remote Vulnerability: Stored XSS which executes on the administration panel. Patched Version: 8.3.1 If you're using the WP-Statistics WordPress plugin on your website, now is the time to update. While doing a routine audit for our Website Firewall product, we discovered... --------------------------------------------- http://blog.sucuri.net/2014/11/security-advisory-high-severity-wp-statistic… *** Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities *** --------------------------------------------- Description Splunk Enterprise versions 6.0.7 and 5.0.11 address three vulnerabilities OpenSSL session ticket memory leak (SPL-91947, CVE-2014-3567) TLS protocol enhancements related to POODLE (SPL-92062,CVE-2014-3566) Persistent cross-site scripting (XSS) via Dashboard (SPL-89216, CVE-2014-5466) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product... --------------------------------------------- http://www.splunk.com/view/SP-CAAANST *** GNU C Library wordexp() command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98852 *** PCRE pcre_exec.c buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98854 *** Multiple Huawei HiLink products cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98858 *** Asterisk DB Dialplan Function Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031251 *** Asterisk CONFBRIDGE Lets Remote Authenticated Users Execute Arbitrary System Commands *** --------------------------------------------- http://www.securitytracker.com/id/1031250 *** Asterisk ConfBridge State Transition Error Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031247 *** Asterisk PJSIP Channel Driver Flaw in res_pjsip_refer Module Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031249 *** Asterisk PJSIP Channel Driver Race Condition Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031248 *** Asterisk PJSIP ACL Bug Lets Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1031246 *** HPSBHF03052 rev.2 - HP Network Products running OpenSSL, Multiple Remote Vulnerabilities *** --------------------------------------------- Version:1 (rev.1) - 20 June 2014 Initial release Version:2 (rev.2) - 20 November 2014 Removed iMC Platform Products, 5900 virtual switch, and Router 8800 products. Further analysis revealed that those products as not vulnerable. Added additional products. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04347622 *** ZDI-14-385: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-385/

1 0

Tageszusammenfassung - Donnerstag 20-11-2014
by Daily end-of-shift report 20 Nov '14

20 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-11-2014 18:00 − Donnerstag 20-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ROVNIX Infects Systems with Password-Protected Macros *** --------------------------------------------- We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX. Though a fairly old method for infection, cybercriminals realized that using malicious macros work... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/0rtiBt3T3E4/ *** Citadel Variant Targets Password Managers *** --------------------------------------------- Some Citadel-infected computers have received a new configuration file, a keylogger triggered to go after the master passwords from three leading password management tools. --------------------------------------------- http://threatpost.com/citadel-variant-targets-password-managers/109493 *** CryptoPHP: Analysis of a hidden threat inside popular content management systems *** --------------------------------------------- CryptoPHP is a threat that uses backdoored Joomla, WordPress and Drupal themes and plug-ins to compromise webservers on a large scale. By publishing pirated themes and plug-ins free for anyone to use instead of having to pay for them, the CryptoPHP actor is social engineering site administrators into installing the included backdoor on their server. --------------------------------------------- http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-ins… *** An inside look: gathering and analyzing the SIR data *** --------------------------------------------- At the Microsoft Malware Protection Center, threat data is a critical source of information to help protect our customers. We use it to understand what's going on in the overall malware ecosystem, determine the best way to protect our customers, and find the most effective way to deliver that protection. We also use the data to produce a number of reports to help our customers. This includes our bi-annual Security Intelligence Report (SIR). This blog post gives you a behind-the-scenes... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/19/an-inside-look-gathering… *** Annual Privacy Forum 2014 materials and APF2015 - Call for partnership *** --------------------------------------------- ENISA's Information Security and Data Protection Unit announces the commencement of preparations for the Annual Privacy Forum of 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2014-mater… *** Electronic Arts: Datenpanne bei Origin *** --------------------------------------------- Einblicke in persönliche Daten von anderen Nutzern zeigt derzeit Origin, das Onlineportal von Electronic Arts, beim Zugriff auf die Foren an. --------------------------------------------- http://www.golem.de/news/electronic-arts-datenpanne-bei-origin-1411-110689-… *** How Splitting A Computer Into Multiple Realities Can Protect You From Hackers *** --------------------------------------------- Eight years ago, polish hacker Joanna Rutkowska was experimenting with rootkits - tough-to-detect spyware that infects the deepest level of a computer's operating system - when she came up with a devious notion: What if, instead of putting spyware inside a victim's computer, you put the victim's computer inside the spyware? At the time, a technology known... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/40ab9794/sc/4/l/0L0Swired0N0C20A1… *** Vulnerabilities identified in three Advantech products *** --------------------------------------------- Researchers with Core Security have identified vulnerabilities in three products manufactured by Advantech, some of which can be exploited remotely. --------------------------------------------- http://www.scmagazine.com/vulnerabilities-identified-in-three-advantech-pro… *** Bugtraq: [CORE-2014-0009] - Advantech EKI-6340 Command Injection *** --------------------------------------------- http://www.securityfocus.com/archive/1/534021 *** Bugtraq: [CORE-2014-0008] - Advantech AdamView Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534022 *** Bugtraq: [CORE-2014-0010] - Advantech WebAccess Stack-based Buffer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/534023 *** Drupal Patches Denial of Service Vulnerability; Details Disclosed *** --------------------------------------------- Drupal has released a patched a denial of service and account hijacking vulnerability, details of which were disclosed by the researchers who discovered the issue. --------------------------------------------- http://threatpost.com/drupal-patches-denial-of-service-vulnerability-detail… *** Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2014-006Project: Drupal core Version: 6.x, 7.xDate: 2014-November-19Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescriptionSession hijacking (Drupal 6 and 7)A specially crafted request can give a user access to another users session, allowing an attacker to hijack a random session.This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS... --------------------------------------------- https://www.drupal.org/SA-CORE-2014-006 *** DRUPAL Security Advisories for Third-Party Modules *** --------------------------------------------- https://www.drupal.org/node/2378287 https://www.drupal.org/node/2378279 https://www.drupal.org/node/2378441 https://www.drupal.org/node/2378401 https://www.drupal.org/node/2378367 *** R7-2014-18: Hikvision DVR Devices - Multiple Vulnerabilities *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/19/r7-2014-1… *** Paid Memberships Pro plugin for WordPress getfile.php directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98805 *** Lsyncd default-rsyncssh.lua command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98806 *** Security Advisory-App Validity Check Bypass Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- Nov 20, 2014 14:53 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Vuln: MantisBT core/file_api.php Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/71104 *** Xen Security Advisory 113 - Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling *** --------------------------------------------- An error handling path in the processing of MMU_MACHPHYS_UPDATE failed to drop a page reference which was acquired in an earlier processing step. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00003.html *** IBM Security Network Protection Shell Command Injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98519 *** IBM Security Bulletins related to POODLE *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 19-11-2014
by Daily end-of-shift report 19 Nov '14

19 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-11-2014 18:00 − Mittwoch 19-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-068 - Critical: Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) - Version: 1.0 *** --------------------------------------------- This security update resolves a privately reported vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers. An attacker must have valid domain credentials to... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-068 *** Additional information about CVE-2014-6324 *** --------------------------------------------- Today Microsoft released update MS14-068 to address CVE-2014-6324, a Windows Kerberos implementation elevation of privilege vulnerability that is being exploited in-the-wild in limited, targeted attacks. The goal of this blog post is to provide additional information about the vulnerability, update priority, and detection guidance for defenders. Microsoft recommends customers apply this update to their domain controllers as quickly as possible. Vulnerability Details CVE-2014-6324 allows... --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-ab… *** Google Removes SSLv3 Fallback Support From Chrome *** --------------------------------------------- Google has released Chrome 39, fixing 42 security vulnerabilities and removing support for the fallback to SSLv3, the component that was the target of the POODLE attack revealed last month. When the POODLE attack was disclosed by several Google researchers in October, the company said that it had added a change to Chrome that would... --------------------------------------------- http://threatpost.com/google-removes-sslv3-fallback-support-from-chrome/109… *** A New Free CA *** --------------------------------------------- Announcing Lets Encrypt, a new free certificate authority. This is a joint project of EFF, Mozilla, Cisco, Akamai, and the University of Michigan. This is an absolutely fantastic idea. The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server youre actually talking to is the server you intended to talk to. For many server operators,... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html *** Survey: real-time SIEM solutions help orgs detect attacks within minutes *** --------------------------------------------- Real-time security information and event management solutions help organizations detect targeted attacks and advanced persistent threats within minutes, according to a McAfee survey. --------------------------------------------- http://www.scmagazine.com/survey-real-time-siem-solutions-help-orgs-detect-… *** POWELIKS Levels Up With New Autostart Mechanism *** --------------------------------------------- Last August, we wrote about POWELIKS's malware routines that are known for hiding its malicious codes in the registry entry as part of its evasion tactics. In the newer samples we spotted, malware detected as TROJ_POWELIKS.B employed a new autostart mechanism and removes users' privileges in viewing the registry's content. As a result, users won't be able to suspect that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/zurdvNxST00/ *** Pan-European Cyber Security Competition organised by ENISA *** --------------------------------------------- Today (19 November 2014) the European Union Agency for Network and Information Security (ENISA) is happy to announce the planning of the 1st pan-European Cyber Security Competition in 2015. The competition is organised jointly in collaboration with experienced organisations from EU Member States for students. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/pan-european-cyber-security-com… *** RSS Reveals Malware Injections *** --------------------------------------------- There are multiple different ways to detect invisible malware on a website: You can scrutinize the HTML code of web pages. Use external scanners like SiteCheck or UnmaskParasites. Get alerts from anti-viruses or search engines (both in search results and via their Webmaster Tools). Try to open web pages with different User-Agents and check for... --------------------------------------------- http://blog.sucuri.net/2014/11/rss-reveals-malware-injections.html *** Test Tool for Web App Security Scanners Released by Google *** --------------------------------------------- A new tool was open-sourced by Google on Tuesday, aiming at improving the efficiency of automated web security scanners by evaluating them with patterns of vulnerabilities already seen in the wild. --------------------------------------------- http://news.softpedia.com/news/Test-Tool-for-Web-App-Security-Scanners-Rele… *** Microsoft bessert beim SChannel-Patch nach *** --------------------------------------------- Still und heimlich haben die Windows-Macher am Dienstag mit dem Update außer der Reihe auch eine neue Revision des SChannel-Patches ausgeliefert. Diese soll die Probleme mit der TLS-Verschlüsselung und massive Performance-Einbußen bei SQL Server beheben. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-bessert-beim-SChannel-Patch-… *** Most advanced mobile botnet EVER is coming for your OFFICE Androids *** --------------------------------------------- NotCompatible A newly discovered variant of NotCompatible is establishing what has been called the most advanced mobile botnet yet created. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/19/android_bot… *** jQuery: Cross-Site-Scripting in Captcha-Beispielcode weit verbreitet *** --------------------------------------------- Ein populäres jQuery-Plugin liefert Code mit einer Cross-Site-Scripting-Lücke aus. Der verwundbare Code stammt ursprünglich von einem Beispielskript für Captchas, das auf sehr vielen Webseiten zu finden ist. --------------------------------------------- http://www.golem.de/news/jquery-cross-site-scripting-in-captcha-beispielcod… *** A Peek Inside a PoS Scammer's Toolbox *** --------------------------------------------- PoS malware has been receiving a tremendous amount of attention in the past two years with high profile incidents like Target, Home Depot, and Kmart. With the massive "Black Friday" shopping season coming up, PoS malware will surely get additional publicity. This high profile nature means, we constantly look for evolving PoS malware and look into their behavior... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/xF7gxViXP4A/ *** Nasty Security Bug Fixed in Android Lollipop 5.0 *** --------------------------------------------- There is a vulnerability in Android versions below 5.0 that could allow an attacker to bypass ASLR and run arbitrary code on a target device under certain circumstances. The bug was fixed in Lollipop, the newest version of the mobile OS, released earlier this week. The vulnerability lies in java.io.ObjectInputStream, which fails to check whether... --------------------------------------------- http://threatpost.com/nasty-security-bug-fixed-in-android-lollipop-5-0/1094… *** Cisco Unified Communications Manager IM and Presence Service Enumeration Vulnerability *** --------------------------------------------- CVE-2014-8000 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Multiple Samsung Galaxy Devices knox code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98780 *** Google Chrome pdfium code execution *** --------------------------------------------- Google Chrome pdfium code execution --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98790 *** Bugtraq: [SECURITY] [DSA 3074-2] php5 regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/534018 *** Bugtraq: Reflected Cross-Site Scripting (XSS) in Simple Email Form Joomla Extension *** --------------------------------------------- http://www.securityfocus.com/archive/1/534017

1 0

Tageszusammenfassung - Dienstag 18-11-2014
by Daily end-of-shift report 18 Nov '14

18 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-11-2014 18:00 − Dienstag 18-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Out-of-band release for Security Bulletin MS14-068 *** --------------------------------------------- On Tuesday, November 18, 2014, at approximately 10 a.m. PST, we will release an out-of-band security update to address a vulnerability in Windows. We strongly encourage customers to apply this update as soon as possible, following the directions in the security bulletin. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/11/18/out-of-band-release-for-… *** VB2014 paper: Optimized mal-ops. Hack the ad network like a boss *** --------------------------------------------- Why buying ad space makes perfect sense for those wanting to spread malware.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Optimized mal-ops. Hack the ad network like a boss by Bromium researchers Vadim Kotov and Rahul Kashyap.Malicious advertisements (malvertising) go back more than a decade, yet in recent months we have seen a surge in these attacks, including the Kyle and Stan campaign, which... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_18.xml?rss *** l+f: Lücken bei BitTorrent Sync *** --------------------------------------------- Ein Security-Audit hat eine Reihe kleinerer und größerer Lücken im Filesharing-Dienst gefunden. --------------------------------------------- http://www.heise.de/security/meldung/l-f-Luecken-bei-BitTorrent-Sync-245985… *** Matsnu Botnet DGA Discovers Power of Words *** --------------------------------------------- The Matsnu botnet has deployed a new domain generation algorithm that builds domain names from a list of nouns and verbs. The plain English phrases help the DGA elude detection. --------------------------------------------- http://threatpost.com/matsnu-botnet-dga-discovers-power-of-words/109426 *** Cisco Releases Security Analytics Framework to Open Source *** --------------------------------------------- Ciscos OpenSOC, a security analytics framework, has been released to open source. --------------------------------------------- http://threatpost.com/cisco-releases-security-analytics-framework-to-open-s… *** The NSAs Efforts to Ban Cryptographic Research in the 1970s *** --------------------------------------------- New article on the NSAs efforts to control academic cryptographic research in the 1970s. It includes new interviews with public-key cryptography inventor Martin Hellman and then NSA-director Bobby Inman.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/11/the_nsas_effort.html *** Flashpack Exploit Kit Used in Free Ads, Leads to Malware Delivery Mechanism *** --------------------------------------------- In the entry FlashPack Exploit Leads to New Family of Malware, we tackled the Flashpack exploit kit and how it uses three URLs namely (http://{malicious domain}/[a-z]{3}[0-9]{10,12}/loxotrap.php, http://{malicious domain}/[0-9,a-z]{6,10}/load0515p6jse9.php, http://{malicious domain}/[a-z]{3}[0-9]{10,12}/ldcigar.php) as its landing site. We monitored the abovementioned URLs and found out that the FlashPack exploit kit is now using free ads to distribute malware such as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-FQFl818dVo/ *** IT threat evolution Q3 2014 *** --------------------------------------------- Kaspersky Lab products detected and neutralized a total of 1,325,106,041 threats in the third quarter of 2014. Our solutions blocked 696,977 attacks that attempted to launch malware capable of stealing money from online banking accounts. Were detected 74,489 new malicious mobile programs, including 7010 mobile banking Trojans. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/67637/it-threat-ev… *** Microsofts SChannel-Fix wird zum Problem-Patch *** --------------------------------------------- Microsoft hat bestätigt, dass der Patch für die Krypto-Funktion von Windows auf Servern zu Problemen führt. Es soll sowohl SQL Server als auch IIS beeinträchtigen. Das Update wird aber nach wie vor verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Microsofts-SChannel-Fix-wird-zum-Probl… *** Cisco IOS DLSw Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-7992 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Integrated Management Controller Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2014-7996 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Vuln: Check Point Security Gateway Multiple Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/67993 *** Rails Action Pack Bug Lets Remote Users Determine if Specified Files Exist on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1031217 *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031215 *** Tcpdump Multiple Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031235 *** Xen Security Advisory 110 (CVE-2014-8595) - Missing privilege level checks in x86 emulation of far branches *** --------------------------------------------- The emulation of far branch instructions (CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax) incompletely performs privilege checks. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00001.html *** Xen Security Advisory 109 (CVE-2014-8594) - Insufficient restrictions on certain MMU update hypercalls *** --------------------------------------------- MMU update operations targeting page tables are intended to be used on PV guests only. The lack of a respective check made it possible for such operations to access certain function pointers which remain NULL when the target guest is using Hardware Assisted Paging (HAP). --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-11/msg00002.html *** Apple Security Advisories *** --------------------------------------------- APPLE-SA-2014-11-17-1 iOS 8.1.1 APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1 APPLE-SA-2014-11-17-3 Apple TV 7.0.2 --------------------------------------------- http://support.apple.com/kb/HT1222 *** IBM Security Bulletins related to a Vulnerability in SSLv3 (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Montag 17-11-2014
by Daily end-of-shift report 17 Nov '14

17 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-11-2014 18:00 − Montag 17-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Microsoft Updates MS14-066, (Sun, Nov 16th) *** --------------------------------------------- Microsoft updated MS14-066 to warn users about some problems caused by the additional ciphers added with the update [1]. It appears that clients who may not support these ciphers may fail to connect at all. The quick fix is to remove the ciphers by editing the respective registry entry (see the KB article link below for more details). One user reported to us performance issues when connecting from MSFT Access to SQL Server, which are related to these ciphers. Sadly, MS14-066hasnt been --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18957&rss *** EVERYTHING needs crypto says Internet Architecture Board *** --------------------------------------------- Calls for all new protocols to protect privacy, all the time, everywhere The Internet Architecture Board (IAB) has called for encryption to become the norm for all internet traffic. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/16/net_gurus_f… *** "Maskierte Apps": Apple veröffentlicht Sicherheitsrichtlinien für App-Installation *** --------------------------------------------- Mit Enterprise-Zertifikaten signierte Apps lassen sich am App Store vorbei auf iOS-Geräten installieren. Angreifer können das nutzen, um Apps durch manipulierte Versionen zu ersetzen. Mit Tipps will Apple Nutzer für Malware sensibilisieren. --------------------------------------------- http://www.heise.de/security/meldung/Maskierte-Apps-Apple-veroeffentlicht-S… *** 91. Treffen der IETF: Das Kapern von BGP-Routen verhindern *** --------------------------------------------- Immer wieder wird Internet-Verkehr unbemerkt über seltsame Wege zum eigentlichen Ziel umgeleitet. Ob es sich um Abhör-Aktionen handelt oder nur um Pannen, ist oft unklar. Nun könnten Netzbetreiber ein Mittel dagegen in die Hand bekommen. --------------------------------------------- http://www.heise.de/newsticker/meldung/91-Treffen-der-IETF-Das-Kapern-von-B… *** Attack reveals 81 percent of Tor users but admins call for calm *** --------------------------------------------- Cisco Netflow a handy tool for cheapskate attackers The Tor project has urged calm after new research found 81 percent of users could be identified using Ciscos NetFlow tool. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/deanonymiza… *** WinShock PoC clocked: But DONT PANIC... Its no Heartbleed *** --------------------------------------------- SChannel exploit opens an easily closed door Security researchers have released a proof-of-concept exploit against the SChannel crypto library flaw patched by Microsoft last week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/ms_schannel… *** Jetzt patchen: Details zur SChannel-Lücke in Windows im Umlauf *** --------------------------------------------- Administratoren sollten Patches für die kritische Sicherheitslücke in Windows, die Microsoft letzte Woche geschlossen hat, umgehend einspielen. Ansonsten riskieren sie, dass Angreifer über das Netz Schadcode einschleusen. --------------------------------------------- http://www.heise.de/security/meldung/Jetzt-patchen-Details-zur-SChannel-Lue… *** Book review: Bulletproof SSL and TLS *** --------------------------------------------- Must-read for anyone working with one of the Internets most important protocols.I was reading Ivan Ristićs book Bulletproof SSL and TLS when rumours started to appear about an attack against SSL 3.0, which would soon become commonly known as the POODLE attack. Thanks to the book, I was quickly able to read up on the differences between SSL 3.0 and its successor, TLS 1.0, which wasnt vulnerable to the attack. Elsewhere in the book, a few pages are dedicated to protocol downgrade attacks,... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_17.xml?rss *** Holy cow! Fasthosts outage blamed on DDoS hack attack AND Windows 2003 vuln *** --------------------------------------------- Monday, bloody Monday Fasthosts five-hour collapse today has been blamed on a Distributed Denial of Service attack and a security flaw spotted on its Windows 2003 shared web server kit. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/17/fasthosts_o… *** Comedy spam blunder raises a smile to start the week *** --------------------------------------------- We all get lots of spam. Enough, even with junk folders and spam filters, to be more than merely annoying. So heres a spamming mistake to make you smile... --------------------------------------------- https://nakedsecurity.sophos.com/2014/11/17/comedy-spam-blunder-raises-a-sm… *** Cisco Aironet DHCP Denial of Service Vulnerabilty *** --------------------------------------------- CVE-2014-7997 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Aironet EAP Debugging Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-7998 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SSA-860967 (Last Update 2014-11-14): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Hot fix to address POODLE SSLv3 vunerability on Designer 4.0.2 AU5 SVN HTTPS access *** --------------------------------------------- Abstract: Designer 4.0.2 uses SSLv3 to access SVN repositories over HTTPS, making it vulnerable to the poodle weakness in the SSL protocol (CVE-2014-3566). This hot fix addresses the issue by disabling SSLv3 and allowing usage of TLSv1 instead.Document ID: 5195492Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:Designer402AU5HF1.zip (2.09 MB)Products:Identity Manager 4.0.2Identity Manager Roles Based Provisioning Module 4.0.2Designer for Identity... --------------------------------------------- https://download.novell.com/Download?buildid=NjOScYlrw_E~ *** Hot Patch 2 for Novell Messenger 2.2 (security fixes to Messengers server and client components) *** --------------------------------------------- https://download.novell.com/Download?buildid=I2DgXp6pwVY~ https://download.novell.com/Download?buildid=sJ4Wcd1G7Bo~ https://download.novell.com/Download?buildid=66t5njTLVmk~ *** DSA-3073 libgcrypt11 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3073 *** Vuln: GnuTLS CVE-2014-8564 Multiple Heap Corruption Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/71003 *** HPSBGN03192 rev.1 - HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Remote Device Access: Instant Customer Access Server (iCAS) running OpenSSL. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. SSLv3 is enabled by default in the current HP iCAS client software. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Security Bulletin: IBM Systems Director (ISD) is affected by vulnerability in the Console Login Window (CVE-2013-5423) *** --------------------------------------------- IBM Systems Director is affected by a vulnerability in the Console Login Window (CVE-2013-5423). CVE(s): CVE-2013-5423 Affected product(s) and affected version(s): Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096563 X-Force Database: http://xforce.iss.net/xforce/xfdb/87485 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect GPFS V3.5 for Windows (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- OpenSSL vulnerabilities along with SSL 3 Fallback protection (TLS_FALLBACK_SCSV) were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by GPFS V3.5 for Windows. GPFS V3.5 for Windows has addressed the applicable CVEs and included the SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV) provided by OpenSSL. CVE(s): CVE-2014-3513, CVE-2014-3567 and CVE-2014-3568 Affected product(s) and affected version(s): OpenSSH for GPFS V3.5 for Windows Refer to the following reference --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins: Vulnerability in SSLv3 affects multiple products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_vul… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** [webapps] - MyBB Forums 1.8.2 - Stored XSS Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/35266

1 0

Tageszusammenfassung - Freitag 14-11-2014
by Daily end-of-shift report 14 Nov '14

14 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-11-2014 18:00 − Freitag 14-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Network Hijackers Exploit Technical Loophole *** --------------------------------------------- Spammers have been working methodically to hijack large chunks of Internet real estate by exploiting a technical and bureaucratic loophole in the way that various regions of the globe keep track of the worlds Internet address ranges. --------------------------------------------- http://krebsonsecurity.com/2014/11/network-hijackers-exploit-technical-loop… *** BASHLITE Affects Devices Running on BusyBox *** --------------------------------------------- When news of the Shellshock vulnerability broke out at the end of September, we spotted several attacks that leveraged the said vulnerability, thus manifesting the prevalence or even evolution on how attackers used the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects… *** OnionDuke: APT Attacks Via the Tor Network *** --------------------------------------------- Recently, research was published identifying a Tor exit node, located in Russia, that was consistently and maliciously modifying any uncompressed Windows executables downloaded through it. Naturally this piqued our interest, so we decided to peer down the rabbit hole. Suffice to say, the hole was a lot deeper than we expected! In fact, it went all the way .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002764.html *** The Art of Website Malware Removal - The Basics *** --------------------------------------------- When talking about defense against malicious hacks, the attack vector is a common topic for Information Security (InfoSec) professionals. The primary concern is to understand the anatomy of the attack and prevent it from happening .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-art-of-website-malware-removal-the-basic… *** Android 5: Lollipop verschlüsselt - noch besser *** --------------------------------------------- Mehr Sicherheit für persönliche Daten: Ab Android 5.0 aktiviert Google die automatische Verschlüsselung. Es ist nur eine von vielen zusätzlichen Sicherheitsfunktionen in Lollipop. --------------------------------------------- http://www.golem.de/news/android-5-lollipop-verschluesselt-noch-besser-1411… *** Gefälschte iOS-Apps: Apple sind keine Angriffe bekannt *** --------------------------------------------- Apple sieht nach einer Warnung vor Hacker-Angriffen mit gefälschten iOS-Apps keinen akuten Handlungsbedarf. "Uns sind keine Kunden bekannt, die von einer solchen Attacke betroffen gewesen wären", erklärte der Konzern gegenüber .. --------------------------------------------- http://www.heise.de/security/meldung/Gefaelschte-iOS-Apps-Apple-sind-keine-… *** Son of Stuxnet - The Digital Hunt for Duqu, a Dangerous and Cunning U.S.-Israeli Spy Virus *** --------------------------------------------- Boldizsar Bencsath took a bite from his sandwich and stared at his computer screen. The software he was trying to install on his machine was taking forever to load, and he still had a dozen things to do before the Fall 2011 semester began at the Budapest University of Technology and Economics, where .. --------------------------------------------- https://firstlook.org/theintercept/2014/11/12/stuxnet/ *** Android und iPhone beim Mobile Pwn2Own gefällt *** --------------------------------------------- Alle drei grossen Mobil-Betriebssysteme sind bei der diesjährigen Mobile-Ausgabe von HPs Pwn2Own-Wettbewerb erfolgreichen Hacks zum Opfer gefallen. Der Angriff auf Windows Phone ist dabei allerdings im Vergleich noch eher harmlos. --------------------------------------------- http://www.heise.de/security/meldung/Android-und-iPhone-beim-Mobile-Pwn2Own… *** SChannel Update and Experimental Vulnerability Scanner (MS14-066), (Fri, Nov 14th) *** --------------------------------------------- Just a quick update on the SChannel problem (MS14-066, CVE-2014-6321). So far, there is still no public available exploit for the vulnerability, and details are still sparse. But apparently, there is some progress in developing a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18953

1 0

Tageszusammenfassung - Donnerstag 13-11-2014
by Daily end-of-shift report 13 Nov '14

13 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-11-2014 18:00 − Donnerstag 13-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DNSSEC mit zu kurzen RSA-Schlüsseln *** --------------------------------------------- Unter anderem bei DNSSEC kommen noch sehr oft RSA-Schlüssel mit 1024 Bit zum Einsatz. Das könnte noch gefährlicher sein, als bisher angenommen, warnen Kryptologen. --------------------------------------------- http://www.heise.de/security/meldung/DNSSEC-mit-zu-kurzen-RSA-Schluesseln-2… *** Microsoft Patchday November 2014 *** --------------------------------------------- Normalerweise schreiben wir nichts über die monatlichen Patchdays von Microsoft: wir schreiben ja auch nicht, wenn ein heller Feuerball in der Früh im Osten über den Horizont steigt. Fast jeder IT Verantwortliche kennt das monatliche Spiel: Lesen, bewerten, eventuell testen dann der Rollout der Patches auf Server und Clients. Dieses .. --------------------------------------------- http://www.cert.at/services/blog/20141112130155-1300.html *** Evolution of Upatre Trojan Downloader *** --------------------------------------------- Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. We are also seeing Exploit Kits being used as a vector for Upatre infections in the wild. --------------------------------------------- http://research.zscaler.com/2014/11/evolution-of-upatre-trojan-downloader.h… *** SA-CONTRIB-2014-109 - Freelinking - Cross Site Scripting (XSS) *** --------------------------------------------- The Freelinking module implements a filter framework for easier creation of HTML links to other pages on the site or to external sites. The module does not sanitize the node title when providing a link to the node, opening a Cross Site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2373981 *** SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass *** --------------------------------------------- The Webform component module enables site admins to limit visibility or editability of webform components based on user roles. The module doesn't sufficiently check that disabled component values are not modified upon submission of the form. --------------------------------------------- https://www.drupal.org/node/2373973 *** SA-CONTRIB-2014-107 - Scheduler - Cross Site Scripting *** --------------------------------------------- The Scheduler module allows nodes to be published and unpublished on specified dates. The module allows administrators to provide additional help text on the content editing form when scheduling is enabled. The module doesn't sufficiently filter the help text which could lead to a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an .. --------------------------------------------- https://www.drupal.org/node/2373961 *** Annus HORRIBILIS! ALL the main TLS stacks now officially pwned in 2014 *** --------------------------------------------- Critical crypto 0-day not the worst of mega Nov patch batch The appearance of a critical vuln in Microsoft SChannel - patched as part of this years bumper November Patch Tuesday - means that every major TLS stack has now fallen to a critical flaw at some time during this year. --------------------------------------------- http://www.theregister.co.uk/2014/11/12/ms_crypto_library_megaflaw/ *** Use Protection if Peering Promiscuously *** --------------------------------------------- Last week, I wrote a blog post discussing the dangers of BGP routing leaks between peers, illustrating the problem using examples of recent snafus between China Telecom and Russia’s Vimpelcom. This follow-up blog post provides three additional examples of misbehaving peers and further demonstrates the impact unmonitored routes can have on Internet performance .. --------------------------------------------- http://research.dyn.com/2014/11/use-protection-if-peering-promiscuously/ *** Microsoft stopft ein fast zwei Jahrzehnte altes Sicherheitsloch *** --------------------------------------------- Microsoft hat eine seit fast zwei Jahrzehnten existierende Sicherheitslücke in seinem Windows-Betriebssystem gestopft. Microsoft stufte das Problem in einem am Mittwoch veröffentlichten Sicherheitshinweis als "ernst" ein und stellte ein Update zur Verfügung. --------------------------------------------- http://derstandard.at/2000008083067 *** Phisher zielen auf Apple-Pay-Interessenten ab *** --------------------------------------------- Mit einer auf deutschsprachige Nutzer ausgelegten E-Mail wird derzeit nach Apple-ID-Accounts geangelt. Sie laden vorgeblich zur Registrierung für den bislang nur in den USA verfügbaren iPhone-Bezahldienst ein. --------------------------------------------- http://www.heise.de/security/meldung/Phisher-zielen-auf-Apple-Pay-Interesse…

1 0

Tageszusammenfassung - Mittwoch 12-11-2014
by Daily end-of-shift report 12 Nov '14

12 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-11-2014 18:00 − Mittwoch 12-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-24) *** --------------------------------------------- A Security Bulletin (APSB14-24) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the security bulletin. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1141 *** MS14-NOV - Microsoft Security Bulletin Summary for November 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-NOV *** Assessing Risk for the November 2014 Security Updates *** --------------------------------------------- Today we released fourteen security bulletins addressing 33 unique CVEs. Four bulletins have a maximum severity rating of Critical, eight have a maximum severity rating of Important, and two have a maximum severity rating of Moderate. This table is designed to help you prioritize .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-no… *** Erpressung mit Kinderpornos: Exploit-Kit Angler verteilt Android-Trojaner *** --------------------------------------------- Ein Virenforscher hat einen perfiden Schädling entdeckt, der Android-Nutzer mit kinderpornografischem Material zu erpressen versucht. Er wird bereits über das verbreitete Exploit-Kit Angler verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Erpressung-mit-Kinderpornos-Exploit-Ki… *** Rockwell Automation Connected Components Workbench ActiveX Component Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two custom ActiveX Component vulnerabilities in Rockwell Automation's Connected Components Workbench application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-294-01 *** Security: Dutzende Schwachstellen in Newsletter-Diensten behoben *** --------------------------------------------- Die Sicherheitslücken reichen von XSS-Fehlern über unsichere Formulare bis hin zu SQL-Injection-Schwachstellen: In drei weit verbreiteten E-Mail-Marketing- und Newsletter-Diensten haben IT-Sicherheitsexperten zahlreiche Schwachstellen entdeckt. Sie sind in Absprache mit den Herstellern inzwischen behoben worden. --------------------------------------------- http://www.golem.de/news/security-dutzende-schwachstellen-in-newsletter-die… *** MSRT November 2014 - Tofsee *** --------------------------------------------- This month we added the Win32/Tofsee and Win32/Zoxpng malware families to the Malicious Software Removal Tool. Zoxpng is a backdoor component that can execute remote commands from a malicious hacker. It is related to Win32/Hikiti and the other threats added to the MSRT last .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/11/msrt-november-2014-tofse… *** The Psychology Behind Why Websites Get Hacked *** --------------------------------------------- It's an everyday conversation for security professionals that interact with everyday website owners. The one where we have to explain that just because everything seems fine, doesn't mean that the best security practices .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-psychology-behind-why-websites-get-hacke… *** Bugtraq: CVE-2014-8731 - RCE in phpMemcachedAdmin <=1.2.2 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533968 *** SAP Governance, Risk and Compliance (SAP GRC) Multiple Critical Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110071 *** Expired antimalware software is nearly as unsafe as having no protection at all *** --------------------------------------------- Analyzing data to find the root cause of infections has been a long-standing focus of the MMPC. One area weve been investigating is the correlation between endpoint protection and infection rates. Back in version 14 of the Security Intelligence Report (SIRv14), we first published data on infection .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/11/12/expired-antimalware-soft… *** Only Half of USB Devices Have an Unpatchable Flaw, But No One Knows Which Half *** --------------------------------------------- After testing the USB controller chips of all eight major manufacturers, the researcher who first discovered BadUSB has some good news and some bad news. The post .. --------------------------------------------- http://www.wired.com/2014/11/badusb-only-affects-half-of-usbs/

1 0

Tageszusammenfassung - Dienstag 11-11-2014
by Daily end-of-shift report 11 Nov '14

11 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-11-2014 18:00 − Dienstag 11-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Communications Manager Remote Mobile Access Subsystem Vulnerability *** --------------------------------------------- A vulnerability in the Remote Mobile Access Subsystem in Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to supply a crafted Transport Layer Security (TLS) certificate that may be accepted by the affected device. The vulnerability is due to improper validation of the SAN field of a TLS certificate. An attacker could exploit this vulnerability by impersonating a VCS core device and supplying a certificate signed by a certificate authority trusted by the Cisco Unified CM that contains crafted values in the SAN field. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Lessons Learn from attacks on Kippo honeypots, (Mon, Nov 10th) *** --------------------------------------------- A number of my fellow Handlers have discussed Kippo, a SSH honeypot that can record adversarial behaviour, be it human or machine. Normal behaviour against my set of Kippo honeypots is randomly predictable; a mixture of known bad IP ranges, researchers or from behind TOR scanning and probing, would be attackers manually entering information from their jump boxes .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18935 *** Hackerangriff auf US-Post *** --------------------------------------------- Der staatliche US Postal Service ist Opfer eines Hackerangriffs geworden. Dabei hätten die Angreifer möglicherweise Zugriff auf persönliche Daten von mehr als 800.000 Beschäftigten sowie von Kunden erhalten, die den Kundendienst per Mail oder Telefon kontaktiert hätten, teilte das Unternehmen .. --------------------------------------------- http://derstandard.at/2000007973390 *** iOS: Schwachstelle erlaubt Installation manipulierter Apps *** --------------------------------------------- Zum zweiten Mal innerhalb weniger Tage entdeckten Datenexperten eine potenzielle Angriffsmethode für Malware in Apples mobilem Betriebssystem iOS. Die IT-Sicherheitsfirma Fireeye warnt vor einer Infizierung von iPhones oder iPads mit einer Methode namens Masque Attack, die auch ohne Jailbreak funktioniert. Dabei .. --------------------------------------------- http://www.golem.de/news/ios-schwachstelle-erlaubt-installation-manipuliert… *** Operation Poisoned Handover: Unveiling Ties Between APT Activity in Hong Kong's Pro-Democracy Movement *** --------------------------------------------- As the pro-democracy movement in Hong Kong has continued, we've been watching for indications of confrontation taking place in cyberspace. Protests began in September and have continued to escalate. In recent weeks, attackers have launched .. --------------------------------------------- http://www.fireeye.com/blog/technical/2014/11/operation-poisoned-handover-u… *** Old-time phishing scams are working just fine, Google finds *** --------------------------------------------- A new Google study has found that the true masterpieces of phishing are successful 45% of the time. Its just another example of how phishers may be old dogs, but they can sure learn new tricks. --------------------------------------------- http://nakedsecurity.sophos.com/2014/11/11/old-time-phishing-scams-are-work… *** Stuxnet: Zero Victims *** --------------------------------------------- We collected Stuxnet files for two years. After analyzing more than 2,000 of these files, we were able to identify the organizations that were the first victims of the worms different variants in 2009 and 2010. Perhaps an analysis of their activity can explain why they became "patients zero" (the original, or zero, victims). --------------------------------------------- http://securelist.com/analysis/publications/67483/stuxnet-zero-victims/ *** Important EMET 5.1 Update. Apply before Patches today, (Tue, Nov 11th) *** --------------------------------------------- Microsoft yesterday release EMET 5.1 . One particular sentence in Microsofts blog post suggests that you should apply this update (if you are using EMET) BEFORE you apply the Interent Explorer patch Microsoft is going to release in a couple of hours: ">If you are using Internet Explorer 11, either on Windows 7 or Windows 8.1, and have deployed EMET 5.0, it is .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18939

1 0

Tageszusammenfassung - Montag 10-11-2014
by Daily end-of-shift report 10 Nov '14

10 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-11-2014 18:00 − Montag 10-11-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** WireLurker zielt auch als Windows-Trojaner auf iOS-Geräte ab *** --------------------------------------------- Nebem dem Mac-Trojaner haben Sicherheitsforscher inzwischen auch eine Windows-Ausführung aufgespürt. Sie hat es ebenfalls auf angeschlossene iPhones oder iPads abgesehen und schleust auf diesen Malware ein. --------------------------------------------- http://www.heise.de/security/meldung/WireLurker-zielt-auch-als-Windows-Troj… *** VU#432608: IBM Notes Traveler for Android transmits user credentials over HTTP *** --------------------------------------------- The IBM Notes Traveler application for Android does not enforce the use of HTTPS for transmitting user credentials, which can allow an attacker to obtain this information. --------------------------------------------- http://www.kb.cert.org/vuls/id/432608 *** Malicious iframe Injector Found in Adobe Flash File (.SWF) *** --------------------------------------------- Finding malware in Adobe Flash files (.swf) is nothing new, but it usually affects personal computers, not servers. Typically, a hidden iframe is used to drop a binary browser exploit with .SWF files, infecting the client machine. This time we saw the opposite, where a binary .SWF file injects an invisible iframe. This .. --------------------------------------------- http://blog.sucuri.net/2014/11/malicious-injector-in-swf-adobe-flash-file.h… *** Keine Entwarnung beim Router-Farming *** --------------------------------------------- Laut Mitarbeitern der tschechichen CZ.NIC Labs gibt es weltweit mehr als eine halbe Million Router, die ihre Konfiguration und damit das Zugangspasswort unbemerkt herausgeben. Angreifer können Nutzer der Router auf Phishing-Seiten umleiten. --------------------------------------------- http://www.heise.de/security/meldung/Keine-Entwarnung-beim-Router-Farming-2… *** Security: Bilder tausender unsicherer Webcams im Internet zu sehen *** --------------------------------------------- Menschen zu Hause in ihrem Fernsehsessel oder bei der Arbeit am Rechner: Das zeigt eine Webseite - ohne dass die Betroffenen davon wissen. Die unbekannten Betreiber haben dafür weltweit tausende Webcams angezapft. (Datenschutz, Netzwerk) --------------------------------------------- http://www.golem.de/news/security-tausende-unsichere-webcams-im-internet-zu… *** Einfache Lösung zum Live-Patching des Linux-Kernels *** --------------------------------------------- Red-Hat- und Suse-Mitarbeiter arbeiten gemeinsam an einer Live-Patching-Lösung für den Linux-Kernel. Erster Code wurde jetzt veröffentlicht, kann aber weniger Lücken stopfen als Kpatch und kGraft. --------------------------------------------- http://www.heise.de/security/meldung/Einfache-Loesung-zum-Live-Patching-des… *** BND-Kauf von Zero Days: CCC warnt vor "Mitmischen im Schwachstellen-Schwarzmarkt" *** --------------------------------------------- "An Dreistigkeit kaum zu überbieten": Der Chaos Computer Club kritisiert die angeblichen Pläne des BND zum Ankauf von bislang unbekannten Sicherheitslücken. Das Geld liesse sich viel besser verwenden. --------------------------------------------- http://www.golem.de/news/bnd-kauf-von-zero-days-ccc-warnt-vor-mitmischen-im… *** The Dangers of Hosted Scripts - Hacked jQuery Timers *** --------------------------------------------- Google blacklisted a client's website claiming that malicious content was being displayed from forogozoropoto.2waky.com. A scan didn't reveal anything suspicious. The next step was to check all third-party scripts on the website. Soon we found the offending script. It was hxxp://jquery.offput.ca/js/jquery.timers.js - a jQuery Timers plugin that was .. --------------------------------------------- http://blog.sucuri.net/2014/11/the-dangers-of-hosted-scripts-hacked-jquery-… *** Removing Wirelurker from Your iOS or OSX Device *** --------------------------------------------- In an earlier blog post, we tackled what Wirelurker malware is and its security implications and risks for iOS and OSX devices. Within hours of the discovery of this malware, a Windows-based malware (detected as TROJ_WIRELURK.A) that performs the same attack was also seen in the wild. In this blog post, we'dd like .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/removing-wirelur… *** Angriff im Hotel-Netz *** --------------------------------------------- Unter dem Namen Darkhotel berichtet Kaspersky über eine Gruppe von Angreifern mit einer ungewöhnlichen Vorgehensweise: Sie attackieren ihre Opfer auf Auslandsreisen im Netz des Hotels. --------------------------------------------- http://www.heise.de/security/meldung/Angriff-im-Hotel-Netz-2445108.html *** TA14-310A: Microsoft Ending Support for Windows Server 2003 Operating System *** --------------------------------------------- Microsoft is ending support for the Windows Server 2003 operating system on July 14, 2015.[1] After this date, this product will no longer receive:Security patches that help protect PCs from harmful viruses, spyware, and other malicious software. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-310A *** Verschlüsselung: Parallele Angriffe auf RSA-Schlüssel mit 1.024 Bit *** --------------------------------------------- Kurze RSA-Schlüssel lassen sich schneller und günstiger brechen, wenn man einen Angriff auf viele Schlüssel gleichzeitig durchführt. Insbesondere bei DNSSEC sind RSA-Schlüssel mit 1.024 Bit noch in breitem Einsatz. --------------------------------------------- http://www.golem.de/news/verschluesselung-parallele-angriffe-auf-rsa-schlue… *** EMET 5.1 is available *** --------------------------------------------- Today, we're releasing the Enhanced Mitigation Experience Toolkit (EMET) 5.1 which will continue to improve your security posture by providing increased application compatibility and hardened mitigations. You can download EMET 5.1 from microsoft.com/emet. Following is the list of the main changes and improvements: Several application compatibility issues .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/11/10/emet-5-1-is-available.aspx

1 0

Tageszusammenfassung - Freitag 7-11-2014
by Daily end-of-shift report 07 Nov '14

07 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-11-2014 18:00 − Freitag 07-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Crypto 101 - free book resource, (Thu, Nov 6th) *** --------------------------------------------- Regular reader and contributor Gebhard sent us a pointer to Crypto 101, an introductory course on cryptography, freely available for programmers of all ages and skill levels byLaurens Van Houtven (lvh) available for everyone, for free, forever. Its a pre-release PDF read of a project that will be released in more formats later. The Crypto 101 course allows you to learn by doing and includes everything you need to understand complete systems such as SSL/TLS: block ciphers, stream ciphers, hash... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18925&rss *** Metasploit Weekly Wrapup: Another Android Universal XSS *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/11/06/metasploi… *** Navy gunners unphased by "integer overflow bug" concerns *** --------------------------------------------- Today, Naked Security received an out-of-the-ordinary email... ..from a vacationing coder with a penchant for fitting geekiness into regular life! We loved his story. We think you will too. --------------------------------------------- http://nakedsecurity.sophos.com/2014/11/06/navy-gunners-unphased-by-integer… *** Slides zum Thema DDoS *** --------------------------------------------- Slides zum Thema DDoS | 5. November 2014 | Das Abwehramt des österreichischen Bundesheeres veranstaltet jedes Jahr eine Konferenz zum Thema IKT-Sicherheit. Dieses Jahr wurde ich eingeladen, einen Vortrag zum Thema DDoS zu halten.In meiner Präsentaion verweise ich auf diverse externe Dokumente, daher wurde ich gebeten, die Slides zum zum Download anzubieten. Autor: Otmar Lendl --------------------------------------------- http://www.cert.at/services/blog/20141105124802-1293.html *** Advance Notification Service for the November 2014 Security Bulletin Release *** --------------------------------------------- Today, we provide advance notification for the release of 16 Security Bulletins. Five of these updates are rated Critical, nine are rated as Important, and two are rated Moderate in severity. These updates are for Microsoft Windows, Internet Explorer, Office, Exchange, .NET Framework, Internet Information Services (IIS), Remote Desktop Protocol (RDP), Active Directory Federation Services (ADFS), Input Method Editor (IME) (Japanese), and Kernel Mode Driver (KMD). As per our monthly process, weve --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/11/06/advance-notification-ser… *** Chinese Routing Errors Redirect Russian Traffic *** --------------------------------------------- In recent weeks, Russian President Vladimir Putin announced a plan to enact measures to protect the Internet of Russia. In a speech to the Russian National Security Council he said, "we need to greatly improve the security of domestic communications networks and information resources." Perhaps he should add Internet routing security to his list because,... --------------------------------------------- http://research.dyn.com/2014/11/chinese-routing-errors-redirect-russian-tra… *** Frankfurt | 04.12.2014 - SAVE us from IP Spoofing and Prefix Hijacking *** --------------------------------------------- DDoS reflection attacks are promoted by IP spoofing and there have been several incidents in the last couple of years where huge networks or whole countries were disconnected from the internet after BGP hijacking. Nevertheless there are countermeasure like RPKI, BCP38 and S.A.V.E that not only protect your network but also help to create a more robust internet. Matthias Wählisch (FU Berlin) and Gert Döring (Space.Net) are going to present these approaches and open the discussion with... --------------------------------------------- http://de-cix.eco.de/2014/events/4-12-frankfurt-spoofing-and-hijacking.html *** Security Holes in Corporate Networks: Network Vulnerabilities *** --------------------------------------------- In this blogpost, we will review in detail the possible vectors for an attack launched on a corporate network from an infected computer within it. --------------------------------------------- http://securelist.com/blog/research/67452/security-holes-in-corporate-netwo… *** Combat Blackhat SEO Infections with SEO Insights *** --------------------------------------------- Blackhat SEO spam is the plague of the internet, and the big search engines take it seriously. One of the worst spam tactics on the internet is becoming more common every day: innocent websites are hacked, and their best pages begin linking to spam. These Blackhat SEO spam tactics are fighting for expensive, high-competition keywords... --------------------------------------------- http://blog.sucuri.net/2014/11/combat-blackhat-seo-infections-with-seo-insi… *** Macro malware on the rise again *** --------------------------------------------- Users taught that having to enable enhanced security features is no big deal.When I joined Virus Bulletin almost eight years ago, macro viruses were already a thing of the past, like porn diallers or viruses that did funny things to the characters on your screen: threats that were once a real problem, but that we didnt have to worry about any longer.A few years ago, I even heard a malware researcher bemoan the fact that "kids these days" didnt even know how to analyse macro viruses. --------------------------------------------- http://www.virusbtn.com/blog/2014/11_07.xml?rss *** Yosemite Beta *** --------------------------------------------- When we first announced that future versions of GPGMail would be available for a small fee, we were pretty scared about the reactions. Despite our expectations, weve received mostly positive responses and we would really like to thank you for that. Today were happy to announce that the first beta of GPGMail for Yosemite is finally ready. --------------------------------------------- https://gpgtools.org/?yosemite *** GnuPG unterstützt Krypto auf Elliptischen Kurven *** --------------------------------------------- Das soeben veröffentlichte Release GnuPG 2.1.0 bringt einige neue Funktionen, bessere Abläufe und es schneidet auch ein paar alte Zöpfe ab. Der 2.0er-Zweig wird als stabile Version weiter gepflegt. --------------------------------------------- http://www.heise.de/security/meldung/GnuPG-unterstuetzt-Krypto-auf-Elliptis… *** Belkin flings out patch after Metasploit module turns guests to admins *** --------------------------------------------- Open guest networks turned on by default Belkin has patched a vulnerability in a dual band router that allowed attackers on guest networks to gain root access using an automated tool. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/07/belkin_flin… *** VB2014 video: Attack points in health apps & wearable devices - how safe is your quantified self? *** --------------------------------------------- Health apps and wearable devices found to make many basic security mistakes."I know a lot of you have a Fitbit device."The geeks attending VB conferences tend to like their gadgets, and many of them have the latest ones, so the claim made by Candid Wüest at the beginning of his VB2014 last-minute presentation Attack points in health apps & wearable devices - how safe is your quantified self? was bound to be accurate. But the Symantec researcher really did know how many... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_07a.xml?rss *** Security: Tausende unsichere Webcams im Internet zu sehen *** --------------------------------------------- Über tausende Webcams sind derzeit Menschen zu Hause in ihrem Fernsehsessel oder bei der Arbeit am Rechner zu sehen - ohne dass sie davon wissen. Die unbekannten Betreiber einer Webseite haben dafür weltweit Überwachungskameras angezapft. --------------------------------------------- http://www.golem.de/news/security-tausende-unsichere-webcams-im-internet-zu… *** Vuln: requests-kerberos requests_kerberos/kerberos_.py Remote Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70909 *** SOL15792: Path MTU discovery vulnerability CVE-2004-1060 *** --------------------------------------------- Description: Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) discovery (PMTUD), allow remote attackers to cause a denial of service (network throughput reduction for TCP connections) via forged ICMP ("Fragmentation Needed and Dont Fragment was Set") packets with a low next-hop MTU value, aka the "Path MTU discovery attack." (CVE-2004-1060) Impact: The BIG-IP system may be vulnerable to denial-of-service (DoS) attacks. --------------------------------------------- https://support.f5.com/kb/en-us/solutions/public/15000/700/sol15792.html *** Bugtraq: Open-Xchange Security Advisory 2014-11-07 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533936 *** [R1] OpenSSL Vulnerabilities (20141015) Affect Tenable Products *** --------------------------------------------- November 7, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-11 *** RSA Web Threat Detection SQL Injection *** --------------------------------------------- Topic: RSA Web Threat Detection SQL Injection Risk: Medium Text:ESA-2014-135: RSA Web Threat Detection SQL Injection Vulnerability EMC Identifier: ESA-2014-135 CVE Identifier: C... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110032 *** PHP date_from_ISO8601() buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98522 *** DSA-3067 qemu-kvm *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3067 *** DSA-3066 qemu *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3066 *** DSA-3065 libxml-security-java *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3065 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 6-11-2014
by Daily end-of-shift report 06 Nov '14

06 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-11-2014 18:00 − Donnerstag 06-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Retefe with a new twist *** --------------------------------------------- A few months ago, we blogged about the banking trojan Retefe (Blog post in German) that was and still is targeting Switzerland. First off, Retefe is different because it only targets Switzerland, Austria and Sweden (and sometimes Japan). Contrast this... --------------------------------------------- http://securityblog.switch.ch/2014/11/05/retefe-with-a-new-twist/ *** ENISA calls for Expression of Interest for Membership of the Permanent Stakeholders' Group *** --------------------------------------------- The Executive Director of European Union Agency for Network and Information Security (ENISA) calls for Expression of Interest for Membership of the Permanent Stakeholders' Group (PSG) to be assigned from February 2015 to August 2017. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-calls-for-expression-… *** New ENISA report on Cyber Crisis Cooperation and Management *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa-publishes-new-report-on-c… *** WireLurker malware infects iOS devices through OS X *** --------------------------------------------- Non-jailbroken devices infected via enterprise provisioning program.Researchers at Palo Alto Networks have published a research paper (PDF) analysing the WireLurker malware that runs on Mac OS X, and which is then used to further infect iOS devices connected to an infected machine.WireLurker is found to have infected 467 apps on the Maiyadi App Store, a third-party store based in China. Infected apps have been downloaded more than 350,000 times. Malware targeting OS X has become increasingly... --------------------------------------------- http://www.virusbtn.com/blog/2014/11_06.xml?rss *** VB2014 paper: DMARC - how to use it to improve your email reputation *** --------------------------------------------- Terry Zink presents case study in which he describes setting a DMARC policy for Microsoft.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added DMARC - how to use it to improve your email reputation, by Microsofts Terry Zink.Email is a 30-year-old protocol, designed at a time when the Internet was much smaller and you could basically trust anyone. As a consequence, spammers and phishers can easily send email --------------------------------------------- http://www.virusbtn.com/blog/2014/11_06a.xml?rss *** ZMap 1.2.1 - The Internet Scanner *** --------------------------------------------- ZMap is an open-source network scanner that enables researchers to easily perform Internet-wide network studies. With a single machine and a well provisioned network uplink, ZMap is capable of performing a complete scan of the IPv4 address space in under 45 minutes, approaching the theoretical limit of gigabit Ethernet. --------------------------------------------- http://hack-tools.blackploit.com/2014/11/zmap-121-internet-scanner.html *** ICMP Reverse Shell *** --------------------------------------------- A reverse shell is a type of shell in which the target machine communicates back to the attacking machine. The attacking machine has a listener port on which it receives the connection, which by using, code or command execution is achieved. --------------------------------------------- http://resources.infosecinstitute.com/icmp-reverse-shell/ *** ZDI-14-373: Trend Micro InterScan Web Security Virtual Appliance Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to read files from the underlying operating system on vulnerable installations of Trend Micro InterScan Web Security Virtual Appliance web application authentication is required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-373/ *** Vuln: Dell EqualLogic CVE-2013-3304 Directory Traversal Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70760 *** Bugtraq: ESA-2014-135: RSA Web Threat Detection SQL Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533912 *** Bugtraq: [The ManageOwnage Series, part VI]: 0day database info and superuser credential disclosure in EventLog Analyser *** --------------------------------------------- http://www.securityfocus.com/archive/1/533916 *** Cisco Unity Connection Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-7988 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** [R1] PHP Integer Overflow Affects Tenables SecurityCenter *** --------------------------------------------- November 5, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-10 *** [2014-11-06] XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection *** --------------------------------------------- Attackers are able to perform denial-of-service attacks against the Endpoint Protection Manager which directly impacts the effectiveness of the client-side endpoint protection. Furthermore, session identifiers of users can be stolen to impersonate them and gain unauthorized access to the server. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** IBM Security Bulletin: Security vulnerabilities in Node.js modules affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-6394, CVE-2014-7191) *** --------------------------------------------- Security vulnerabilities have been reported for some dependent Node.js modules. IBM Business Process Manager includes a stand-alone tool for editing configuration properties files that is based on open source Node.js technology. CVE(s): CVE-2014-6394 and CVE-2014-7191 Affected product(s) and affected version(s): IBM Business Process Manager Express V8.5.5 IBM Business Process Manager Standard V8.5.5 IBM Business Process Manager Advanced V8.5.5 Refer to the following reference --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple Reflected XSS Vulnerabilities in Tivoli Netcool/Impact *** --------------------------------------------- IBM Tivoli Netcool Impact is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. CVE(s): CVE-2014-6161 Affected product(s) and affected version(s): IBM Tivoli Netcool Impact 6.1.1 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21689130 X-Force Database: http://xforce.iss.net/xforce/xfdb/97710 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 5-11-2014
by Daily end-of-shift report 05 Nov '14

05 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-11-2014 18:00 − Mittwoch 05-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tool Tip: vFeed, (Wed, Nov 5th) *** --------------------------------------------- I have had a number of occasions lately to use or talk about vFeed from Toolswatch.org (@toolwatch). NJ a useful Python CLI tool that pulls CVEs and other Mitre datasets. From the vFeed Github repo: vFeed framework is an open source naming scheme concept that provides extra structured detailed third-party references and technical characteristics for a CVE entry through an extensible XML schema. It also improves the reliability of CVEs by providing a flexible and comprehensive vocabulary for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18917&rss *** Perfider Schädling haust in der Registry *** --------------------------------------------- Viren sind typischerweise in Dateien Zuhause, die mal besser und mal schlechter auf dem System versteckt sind. Ein neuer Trojaner kommt ohne Dateien aus, wodurch man ihn schwer aufspüren kann. Er wird seit kurzem auch über ein Exploit-Kit verteilt. --------------------------------------------- http://www.heise.de/security/meldung/Perfider-Schaedling-haust-in-der-Regis… *** Which Messaging Technologies Are Truly Safe and Secure? *** --------------------------------------------- In the face of widespread Internet data collection and surveillance, we need a secure and practical means of talking to each other from our phones and computers. Many companies offer "secure messaging" products - but how can users know if these systems actually secure? The Electronic Frontier Foundation (EFF) released its Secure Messaging Scorecard today, evaluating dozens of messaging technologies on a range of security best practices. --------------------------------------------- https://www.eff.org/press/releases/which-messaging-technologies-are-truly-s… *** Crypto collision used to hijack Windows Update goes mainstream *** --------------------------------------------- Final nail in the coffin for the MD5 hash The cryptographic hash collision attack used by cyberspies to subvert Microsofts Windows Update has gone mainstream, revealing that MD5 is hopelessly broken. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/11/05/md5_hash_co… *** New Phishing Technique Outfoxes Site Owners: Operation Huyao *** --------------------------------------------- We've found a new phishing technique targeting online shopping sites that may significantly change the threat landscape for phishing sites. Conventional phishing sites require an attacker to replicate the targeted site; a more accurate copy is more likely to fool intended victims. This technique we found allows for the creation of nearly perfect copies... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/SfVy0fROxfs/ *** Novembers Issue of the OUCH Newsletter is available, covering Social Engineering! http://www.securingthehuman.org/ouch, (Wed, Nov 5th) *** --------------------------------------------- -- Alex Stanford - GIAC GWEB GSEC, Research Operations Manager, SANS Internet Storm Center (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18921&rss *** Mehr Updates gegen die UEFI-Sicherheitslücke *** --------------------------------------------- Für die vor Monaten entdeckte Sicherheitslücke in UEFI-Firmware stellen nun mehr PC- und Mainboard-Hersteller Patches bereit, andere geben Entwarnung - und manche forschen noch. --------------------------------------------- http://www.heise.de/newsticker/meldung/Mehr-Updates-gegen-die-UEFI-Sicherhe… *** .onion-Domains: Falsches Zertifikat für Tor-Facebook *** --------------------------------------------- Einem Sicherheitsforscher ist es gelungen, ein gefälschtes Zertifikat für die .onion-URL von Facebook ausstellen zu lassen. Facebook ist seit kurzem über das Tor-Netzwerk erreichbar. (Soziales Netz, Facebook) --------------------------------------------- http://www.golem.de/news/onion-domains-falsches-zertifikat-fuer-tor-faceboo… *** Bugtraq: CVE-2014-6617 Softing FG-100 Backdoor Account *** --------------------------------------------- http://www.securityfocus.com/archive/1/533902 *** Bugtraq: KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read *** --------------------------------------------- KL-001-2014-004 : VMWare vmx86.sys Arbitrary Kernel Read --------------------------------------------- http://www.securityfocus.com/archive/1/533901 *** Cross-Site Scripting vulnerability in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting. --------------------------------------------- http://www.typo3.org/news/article/cross-site-scripting-vulnerability-in-ext… *** Advisory (ICSA-14-308-01) ABB RobotStudio and Test Signal Viewer DLL Hijack Vulnerability *** --------------------------------------------- Ivan Sanchez of WiseSecurity Team has identified a dll hijack vulnerability in the ABB RobotStudio and Test Signal Viewer applications. ABB has produced new versions that mitigate this vulnerability. Mr. Sanchez has tested the new version to validate that it resolves the vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-308-01 *** Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF *** --------------------------------------------- Topic: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF Risk: Medium Text:<!-- # Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF # Exploit author: Emmanuel Law # Public ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014110021 *** Multiple Vulnerabilities in Cisco Small Business RV Series Routers *** --------------------------------------------- cisco-sa-20141105-rv --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3064 php5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3064 *** FreeBSD setlogin() Lets Local Users Obtain Portions of Kernel Memory *** --------------------------------------------- http://www.securitytracker.com/id/1031169 *** FreeBSD OpenSSH Child Process Deadlock Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031168 *** IBM Security Bulletins related to POODLE (CVE-2014-3566) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 4-11-2014
by Daily end-of-shift report 04 Nov '14

04 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-11-2014 18:00 − Dienstag 04-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Smuggler - An interactive 802.11 wireless shell without the need for authentication or association *** --------------------------------------------- I've always been fascinated by wireless communications. The ability to launch seemingly invisible packets of information up into the air without even the need to consider aerodynamics itself seems like some kind of magic. In my quest to become a wireless wizard I started looking at the 802.11 wireless protocol to find out a little more about it. I had always noticed when looking at wireless management frames in various packet dumps that a wealth of additional (and somewhat optional)... --------------------------------------------- http://blog.spiderlabs.com/2014/11/smuggler-an-interactive-80211-wireless-s… *** Some samples in Rotten Tomato campaign not effectively executed *** --------------------------------------------- Researchers at Sophos provided additional details on the malware used in the attacks. --------------------------------------------- http://www.scmagazine.com/some-samples-in-rotten-tomato-campaign-not-effect… *** Whois someone else?, (Tue, Nov 4th) *** --------------------------------------------- A couple of weeks ago, I already covered the situation where a cloud IP address gets re-assigned, and the new owner still sees some of your traffic. Recently, one of our clients had the opposite problem: They had changed their Internet provider, and had held on to the old address range for a decent decay time. They even confirmed with a week-long packet capture that there was no afterglow on the link, and then dismantled the setup. Until last week, when they got an annoyed rant into their... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18911&rss *** New version of Backoff detected, malware variant dubbed ROM *** --------------------------------------------- Researchers at Fortinet detailed the new variant on Monday, and urged businesses to keep their AV up to date. --------------------------------------------- http://www.scmagazine.com/new-version-of-backoff-detected-malware-variant-d… *** Practical Reflected File Download and JSONP *** --------------------------------------------- This week introduced us to a new web attack vector, which the researcher dubbed "Reflected File Download" [RFD] . It's a very interesting attack which has potential to do some severe damage, especially in social engineering contexts. Full details of the reflected file download attack can be found here:... --------------------------------------------- http://blog.davidvassallo.me/2014/11/02/practical-reflected-file-download-a… *** Content Security Policy Builder *** --------------------------------------------- Content Security Policy is a new HTML5 web security feature. Your website can now explicitly tell browsers what sources of content - images, scripts, frames etc - are to be trusted. A new Content-Security-Policy HTTP header is used to announce that policy. --------------------------------------------- https://cspbuilder.info/static/ *** Exploiting CVE-2014-4113 on Windows 8.1 *** --------------------------------------------- On the 14th of October 2014 both CrowdStrike1 and FireEye2 published a blog post describing a new zero-day privilege escalation vulnerability on Windows. The CrowdStrike article explains that this new vulnerability was identified in the process of tracking a supposedly highly advanced adversary group named HURRICANE PANDA and has been actively exploited in the wild for at least five month. ... So I was curious if and how the vulnerability might be exploitable on the most current version of... --------------------------------------------- http://dl.packetstormsecurity.net/papers/attack/CVE-2014-4113.pdf *** Google Releases Nogotofail Tool to Test Network Security *** --------------------------------------------- The last year has produced a rogues' gallery of vulnerabilities in transport layer security implementations and new attacks on the key protocols, from Heartbleed to the Apple gotofail flaw to the recent POODLE attack. To help developers and security researchers identify applications that are vulnerable to known SSL/TLS attacks and configuration problems, Google is releasing a... --------------------------------------------- http://threatpost.com/google-releases-nogotofail-tool-to-test-network-secur… *** Customer confusion over new(ish) gTLDs targeting financial services *** --------------------------------------------- Introduction For the last decade and a bit, banking customers have been relentlessly targeted by professional phishers with a never-ending barrage of deceitful emails, malicious websites and unstoppable crimeware - each campaign seeking to relieve the victim of their online banking credentials and funds. In the battle for the high-ground, many client-side and server-side security technologies have been invented and consequently circumvented over the years. Now we're about to enter a... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/11/customer-confusion-over-newish-gtl… *** Linksys Patches (Most) Routers Running SMART Wi-Fi Firmware *** --------------------------------------------- Linksys released updates for routers running its SMART Wi-Fi firmware, patching vulnerabilities leading to credential theft and information disclosure. Two popular models, however, remain unpatched. --------------------------------------------- http://threatpost.com/linksys-patches-most-routers-running-smart-wi-fi-firm… *** GNU Binutils peXXigen.c denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/98420 *** ZDI-14-371: (0Day) Denon AVR-3313CI Friendlyname Persistent Cross-Site Scripting Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to insert persistent JavaScript on vulnerable installations of the Denon AVR-3313CI audio/video receivers web portal. Authentication is not required to persist the attack. However, user interaction is required to exploit this vulnerability in that the target must visit a malicious page. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-371/ *** ZDI-14-372: (0Day) Visual Mining NetCharts Server File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Visual Mining NetCharts Server. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-372/ *** Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability *** --------------------------------------------- cisco-sa-20130109-uipphone --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3063 quassel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3063 *** DSA-3062 wget *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3062

1 0

Tageszusammenfassung - Montag 3-11-2014
by Daily end-of-shift report 03 Nov '14

03 Nov '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 31-10-2014 18:00 − Montag 03-11-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** CVE-2014-4115 Analysis: Malicious USB Disks Allow For Possible Whole System Control *** --------------------------------------------- One of the bulletins that was part of the October 2014 Patch Tuesday cycle was MS14-063 which fixed a vulnerability in the FAT32 disk partition driver that could allow for an attacker to gain administrator rights on affected systems, with only a USB disk with a specially modified file system. This vulnerability as also designated... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/E2Ur54TO5Qo/ *** CSAM Month of False Positives: Appropriately Weighting False and True Positives, (Fri, Oct 31st) *** --------------------------------------------- This is a guest diary submitted by Chris Sanders. We will gladly forward any responses or please use our comment/forum section to comment publicly.">">If you work with any type of IDS, IPS, or other">detection technology then you have to deal with false positives. One">common">mistake I see people make when managing their indicators and rules is">relying">solely on the rate of false positives that are observed. While... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18905&rss *** CVE-2012-0158 continues to be used in targeted attacks *** --------------------------------------------- 30-month old vulnerability still a popular way to infect systems.If all you have to worry about are zero-day vulnerabilities, you have got things pretty well sorted. Although it is true that sometimes zero-days are being used to deliver malware (such as the recent use of CVE-2014-4114 by the SandWorm group), in many cases even the more targeted attacks get away with using older, long patched vulnerabilities, exploiting the fact that many users and organisations dont patch as quickly as they --------------------------------------------- http://www.virusbtn.com/blog/2014/10_31a.xml?rss *** Reversing D-Link's WPS Pin Algorithm *** --------------------------------------------- While perusing the latest firmware for D-Link's DIR-810L 80211ac router, I found an interesting bit of code in sbin/ncc, a binary which provides back-end services used by many other processes on the device, including the HTTP and UPnP servers: I first began examining this particular piece of code with the... --------------------------------------------- http://www.devttys0.com/2014/10/reversing-d-links-wps-pin-algorithm/ *** Adobe: Aktuelle Flash-Sicherheitslücken bereits in Exploit-Kits *** --------------------------------------------- Es wird wieder Zeit, sich bei Sicherheitslücken verstärkt um Adobes Flashplayer zu kümmern. Zwei gerade erst abgesicherte und gefährliche Sicherheitslöcher sind bereits in aktuelle Exploit-Kits integriert worden. Eset glaubt sogar, dass Flash nun wieder Java in der Beliebtheitsskala ablöst. --------------------------------------------- http://www.golem.de/news/adobe-aktuelle-flash-sicherheitsluecken-bereits-in… *** justniffer a Packet Analysis Tool, (Mon, Nov 3rd) *** --------------------------------------------- Are you looking for another packet sniffer? justniffer is a packet sniffer with some interesting features. According to the author, this packet sniffer can rebuild and save HTTP file content sent over the network. It uses portions of Linux kernel source code for handling all TCP/IP stuff. Precisely, it uses a slightly modified version of the libnids libraries that already include a modified version of Linux code in a more reusable way.[1] The tarball can be downloaded here and a package is --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18907&rss *** BE2 Custom Plugins, Router Abuse, and Target Profiles *** --------------------------------------------- The BlackEnergy malware is crimeware turned APT tool and is used in significant geopolitical operations lightly documented over the past year. An even more interesting part of the BlackEnergy story is the relatively unknown custom plugin capabilities to attack ARM... --------------------------------------------- http://securelist.com/blog/research/67353/be2-custom-plugins-router-abuse-a… *** Security: Sicherheitslücke in Mac OS X 10.10 entdeckt *** --------------------------------------------- In Mac OS X 10.10 und 10.8.5 befindet sich eine Sicherheitslücke, die die Übernahme des gesamten Systems ermöglicht. Details hat ihr Entdecker noch nicht veröffentlicht - in Absprache mit Apple. --------------------------------------------- http://www.golem.de/news/security-sicherheitsluecke-in-mac-os-x-10-10-entde… *** OpenBSD 5.6 kickt OpenSSL *** --------------------------------------------- Mit der neuen Version des freien Unix steigen die OpenBSD-Macher von OpenSSL auf LibreSSL um. Dazu kommen zahlreiche kleinere Verbesserungen. --------------------------------------------- http://www.heise.de/newsticker/meldung/OpenBSD-5-6-kickt-OpenSSL-2441288.ht… *** Hacking Team: Handbücher zeigen Infektion Über Code Injection und WLAN *** --------------------------------------------- "Internetüberwachung leicht gemacht": Die italienische Firma Hacking Team gilt neben Finfisher als bekanntester Hersteller von Spionagesoftware. Nun veröffentlichte Handbücher zeigen die Möglichkeiten der Überwachung. --------------------------------------------- http://www.golem.de/news/hacking-team-handbuecher-zeigen-infektion-ueber-co… *** RDP Replay *** --------------------------------------------- Here at Context we work hard to keep our clients safe. During routine client monitoring our analysts noticed some suspicious RDP traffic. It was suspicious for two reasons. Firstly the client was not in the habit of using RDP, and secondly it had a Chinese keyboard layout. This information is available in the ClientData handshake message of non-SSL traffic, and can easily be seen in wireshark. --------------------------------------------- http://contextis.com/resources/blog/rdp-replay/ *** l+f: Analyse des Drupal-Desasters *** --------------------------------------------- Wie konnte das nur passieren? Müssen wir alle sterben? --------------------------------------------- http://www.heise.de/security/meldung/l-f-Analyse-des-Drupal-Desasters-24414… *** Visa: Kreditkarten-Lücke ermöglicht Abbuchen von einer Million Dollar per NFC *** --------------------------------------------- Mittels präpariertem Terminal - Forscher stellen Leck auf Sicherheitskonferenz vor - Visa beschwichtigt --------------------------------------------- http://derstandard.at/2000007655779 *** Ongoing Sophisticated Malware Campaign Compromising ICS (Update A) *** --------------------------------------------- This alert update is a follow-up to the original NCCIC/ICS-CERT Alert titled ICS-ALERT-14-281-01 Ongoing Sophisticated Malware Campaign Compromising ICS that was published October 28, 2014, on the ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-281-01A *** Bugtraq: [SE-2014-01] Missing patches / inaccurate information regarding Oracle Oct CPU *** --------------------------------------------- http://www.securityfocus.com/archive/1/533862 *** HP CM3530 Color LaserJet Printer Lets Remote Users Access Data and Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031153 *** CBI Referral Manager <= 1.2.1 Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-11-01T18:57:24 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7654 *** GB Gallery Slideshow 1.5 - SQL Injection *** --------------------------------------------- 2014-11-02T13:12:44 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7655 *** Vuln: MantisBT Incomplete Fix Multiple SQL Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/70856 *** VU#210620: uIP and lwIP DNS resolver vulnerable to cache poisoning *** --------------------------------------------- Vulnerability Note VU#210620 uIP and lwIP DNS resolver vulnerable to cache poisoning Original Release date: 03 Nov 2014 | Last revised: 03 Nov 2014 Overview The DNS resolver implemented in uIP and lwIP is vulnerable to cache poisoning due to non-randomized transaction IDs (TXIDs) and source port reuse. Description CWE-330: Use of Insufficiently Random Values - CVE-2014-4883The DNS resolver implemented in all versions of uIP, as well as lwIP versions 1.4.1 and earlier, is vulnerable to cache... --------------------------------------------- http://www.kb.cert.org/vuls/id/210620 *** IBM Security Bulletin: Weaker than expected security with Liberty Repository affecting Rational Application Developer for WebSphere Software (CVE-2014-4767) *** --------------------------------------------- The WebSphere Application Server Liberty profile could provide weaker than expected security when installing features via the Liberty Repository. A remote attacker could exploit this vulnerability using a man-in-the-middle technique to cause the installation of malicious code. CVE(s): CVE-2014-4767 Affected product(s) and affected version(s): IBM Rational Application Developer for WebSphere Software 9.1.0.1 Refer to the following reference URLs for remediation and additional --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple Security vulnerabilities found in WebSphere Commerce XML External Entity (XXE) Processing (CVE-2014-4834, CVE-2014-4769 ) *** --------------------------------------------- IBM WebSphere Commerce Enterprise, Professional, Express and Developer is vulnerable to a denial of service, caused by issues with detecting recursion during entity expansion. CVE(s): CVE-2014-4834 and CVE-2014-4769 Affected product(s) and affected version(s): WebSphere Commerce V6.0 and V7.0 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors *** --------------------------------------------- There are multiple vulnerabilities in OpenSSL that is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139). These issues were disclosed on August 6, 2014 by the OpenSSL Project. CVE(s): CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512 and CVE-2014-5139 Affected... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM Notes Traveler for Android client explicit warning against use of HTTP (CVE-2014-6130) *** --------------------------------------------- The IBM Notes Traveler client for Android devices allows the end user to connect to their Traveler server over HTTPS (using SSL) or the open HTTP standard. At present, the client application does not explicitly warn the end user if the Traveler administrator has chosen the insecure HTTP variant as the transport medium. CVE(s): CVE-2014-6130 Affected product(s) and affected version(s): All releases of IBM Notes Traveler for Android prior to version 9.0.1.3. Refer to the following... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM Tivoli NetView for z/OS (distributed components) affected by multiple vulnerabilities that have been identified in IBM Runtime Environment, Java Technology Edition, Versions 6 & 7 (CVE-2014-4263 and *** --------------------------------------------- Vulnerabilities have been identified in IBM Runtime Environment, Java Technology Edition, Versions 6 and 7, utilized by IBM Tivoli NetView for z/OS distributed components. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): This vulnerability is known to affect IBM Tivoli NetView for z/OS v5.3, 5.4, 6.1, 6.2 & 6.2.1 in certain distributed components. Releases/systems/configurations not known to be affected: IBM Tivoli NetView for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 31-10-2014
by Daily end-of-shift report 31 Oct '14

31 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-10-2014 18:00 − Freitag 31-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/: CVE-2014-3371 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security Advisory - Medium Severity - WP eCommerce WordPress Plugin *** --------------------------------------------- If you're using the popular WP eCommerce WordPress plugin (2,900,000 downloads), you should update it right away. During a routine audit for our Website Firewall (WAF), we .. --------------------------------------------- http://blog.sucuri.net/2014/10/security-advisory-medium-severity-wp-ecommer… *** Nordex NC2 XSS Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site scripting vulnerability in the Nordex Control 2 (NC2) application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-303-01 *** Meinberg Radio Clocks LANTIME M-Series XSS *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Meinberg Radio Clocks LANTIME M-Series XSS. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-01 *** Accuenergy Acuvim II Authentication Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two authentication vulnerabilities within the Accuenergy AXM-NET Ethernet module's web server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-275-02 *** [2014-10-31] XXE and XSS vulnerabilities in Scalix Web Access *** --------------------------------------------- Scalix Web Access is vulnerable to XML external entity injection (XXE) and reflected cross site scripting (XSS) attacks. An unauthenticated attacker can get read access to the filesystem of the Scalix Web Access host and thus obtain sensitive information. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Spotting Malicious Injections in Otherwise Benign Code *** --------------------------------------------- Being able to spot suspicious code, and then determine whether it is benign or malicious is a very important skill for a security researcher. Every day we scan through megabytes of HTML, JS and PHP. It's quite easy to miss something bad, especially .. --------------------------------------------- http://blog.sucuri.net/2014/10/spotting-malicious-injections-in-otherwise-b… *** Setting HoneyTraps with ModSecurity: Adding Fake Cookies *** --------------------------------------------- This blog post continues with the topic of setting "HoneyTraps" within your web applications to catch attackers. Please review the previous posts for more .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/setting-honeytraps-with-modsecurity-addi… *** Facebook geht ins Tor-Netz *** --------------------------------------------- Das soziale Netz will zukünftig eine Nutzung der Dienste auch über das Anonymisierungsnetz Tor möglich machen. Dafür setzt der Konzern einen eigenen Onion-Dienst im Tor-Netz auf. --------------------------------------------- http://www.heise.de/security/meldung/Facebook-geht-ins-Tor-Netz-2440221.html *** Schwachstellen in Samsung Knox *** --------------------------------------------- Bei einer Analyse von der auf vielen Geräten vorinstallierten Security-App Samsung Knox Personal kamen Mängel ans Licht. Der Hersteller erklärte die App für überholt, Ersatz gibt es allerdings nur für zwei aktuelle Spitzengeräte. --------------------------------------------- http://www.heise.de/security/meldung/Schwachstellen-in-Samsung-Knox-2440119… *** Google to kill off SSL 3.0 in Chrome 40 *** --------------------------------------------- Google plans to remove support for the aging Secure Sockets Layer (SSL) version 3.0 protocol in Google Chrome 40, which is expected to ship in about two months.The decision comes after Google security researchers recently discovered a dangerous design flaw in SSL 3.0. Dubbed "POODLE," the vulnerability .. --------------------------------------------- http://www.csoonline.com/article/2841837/application-security/google-to-kil…

1 0

Tageszusammenfassung - Donnerstag 30-10-2014
by Daily end-of-shift report 30 Oct '14

30 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-10-2014 18:00 − Donnerstag 30-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** An In-Depth Look Into Malicious Browser Extensions *** --------------------------------------------- Malicious browser extensions bring about security risks as these often lead to system infection and unwanted spamming on Facebook. Based on our data, these attacks have notably affected users in Brazil. We have previously reported that cybercriminals are putting malicious browsers in the official Chrome .. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/mNBK1Z4Uhdo/ *** Cyberangriffe: Neue Spyware kommuniziert über Gmail-Entwürfe *** --------------------------------------------- Eine neue Malware nutzt die Entwurfsfunktion von Googles E-Mail-Dienst, um Befehle zu empfangen und Daten auszulesen. Wer betroffen ist, lässt sich nur schwer feststellen. --------------------------------------------- http://www.golem.de/news/cyberangriffe-neue-spyware-kommuniziert-ueber-gmai… *** SQL-Injection: Sicherheitslücke erlaubt Zugriff auf Sony-Kundendaten *** --------------------------------------------- Eine SQL-Injection-Lücke erlaubt den Zugriff auf Kundendaten des Playstation Networks. Sony wurde bereits vor zwei Wochen über die Sicherheitslücke informiert, sie wurde jedoch bisher nicht geschlossen. Es ist nicht der erste Vorfall im Playstation-Network. --------------------------------------------- http://www.golem.de/news/sql-injection-sicherheitsluecke-erlaubt-zugriff-au… *** Popular Science Website Infected, Serving Malware *** --------------------------------------------- The website of Popular Science magazine was found infecting users with malware via the RIG exploit kit. --------------------------------------------- http://threatpost.com/popular-science-website-infected-serving-malware/1090… *** Poodle: Microsoft "fixt" SSLv3-Verschlüsselung *** --------------------------------------------- Mit einem von Microsoft bereit gestellten "Fix it" kann man den kaputten Verschlüsselungsstandard SSLv3 im Internet Explorer einfach abschalten. Doch die Schnellhilfe hat ihre Tücken. --------------------------------------------- http://www.heise.de/security/meldung/Poodle-Microsoft-fixt-SSLv3-Verschlues… *** Assume 'Every Drupal 7 Site Was Compromised' Unless Patched By Oct. 15 *** --------------------------------------------- The maintainers of the Drupal content management system are warning users that any site owners who haven't patched a critical vulnerability in Drupal Core disclosed earlier this month should consider their sites to be .. --------------------------------------------- http://threatpost.com/assume-every-drupal-7-site-was-compromised-unless-pat… *** Cyber Europe 2014: 29 europäische Länder testen Handlungsfähigkeit gegen Cyberattacken *** --------------------------------------------- Gegen grenzüberschreitende Cyber-Bedrohungen arbeiten die Europäische Sicherheitsbehörde ENISA, die EU-Mitgliedsstaaten und die Industrie Hand in Hand. Heute läuten sie Phase 2 des bislang grössten europäischen Cyber-Security-Tests ein. --------------------------------------------- http://www.heise.de/security/meldung/Cyber-Europe-2014-29-europaeische-Laen… *** Grafikkarte funkt Passwörter durch die Gegend *** --------------------------------------------- Forscher haben eine Grafikkarte zum UKW-Sender umfunktioniert, das Monitorkabel dient als Antenne. So können sie Air Gap überwinden und Daten an Geräte senden, die eigentlich gar nicht untereinander vernetzt sind. --------------------------------------------- http://www.heise.de/security/meldung/Grafikkarte-funkt-Passwoerter-durch-di… *** Reflected File Download - A New Web Attack Vector *** --------------------------------------------- On October 2014 as part of my talk at the Black Hat Europe 2014 event, I presented a new web attack vector that enables attackers to gain complete control over a victim's machine by virtually downloading a file from trusted .. --------------------------------------------- http://blog.spiderlabs.com/2014/10/reflected-file-download-the-white-paper.… *** APT28 - State Sponsored Russian Hacker Group *** --------------------------------------------- Nearly a decade-long cyber espionage group that targeted a variety of Eastern European governments and security-related organizations including the North Atlantic Treaty Organization (NATO) has been exposed by a security research firm. The US intelligence firm FireEye released its latest Advanced Persistent .. --------------------------------------------- http://thehackernews.com/2014/10/APT28-Russian-hacker-cyber-espionage.html *** Ausnutzung der Windows-Sandworm-Lücke eskaliert *** --------------------------------------------- Kriminelle nutzen die zunächst im Rahmen gezielter Attacken auf NATO-Einrichtungen und Regierungen eingesetzte Sicherheitslücke in Windows nun, um grossflächig Online-Banking-Trojaner zu verteilen. --------------------------------------------- http://www.heise.de/security/meldung/Ausnutzung-der-Windows-Sandworm-Luecke…

1 0

Tageszusammenfassung - Mittwoch 29-10-2014
by Daily end-of-shift report 29 Oct '14

29 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-10-2014 18:00 − Mittwoch 29-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The dangers of opening suspicious emails: Crowti ransomware *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has seen a spike in number of detections for threats in the Win32/Crowti ransomware this month as the result of new malware campaigns. Crowti is a family of ransomware that when encountered will attempt to encrypt the files on your PC, and then ask for payment .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/28/the-dangers-of-opening-s… *** Ongoing Sophisticated Malware Campaign Compromising ICS *** --------------------------------------------- NCCIC/ICS-CERT has identified a sophisticated malware campaign that has compromised numerous industrial control systems (ICSs) environments using a variant of the BlackEnergy malware. Analysis indicates that this campaign has .. --------------------------------------------- https://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-281-01 *** Multiple vulnerabilities in Tuleap *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100177 http://cxsecurity.com/issue/WLB-2014100176 http://cxsecurity.com/issue/WLB-2014100175 *** Weisses Haus: Russische Hacker angeblich in US-Regierungsnetz eingedrungen *** --------------------------------------------- Angriffe auf die Computernetze von Regierungen kommen weltweit tagtäglich vor. Hackern ist es nun offenbar gelungen, in das nicht abgeschirmte Netz des Weissen Hauses einzudringen. --------------------------------------------- http://www.golem.de/news/weisses-haus-russische-hacker-angeblich-in-us-regi… *** Microsoft integriert Data Loss Prevention in Cloud- und Office-Produkte *** --------------------------------------------- Mit der Ausweitung seiner Sicherheits-Features auf weitere Produkte und Dienste will der Redmonder Konzern für Unternehmen den Verlust vertraulicher Daten weitestmöglich einschränken. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-integriert-Data-Loss-Prevent… *** [2014-10-29] Multiple critical vulnerabilities in Vizensoft Admin Panel *** --------------------------------------------- Attackers are able to completely compromise the web application built upon Vizensoft CMS as they can gain access to the system and database level and manage the website as an admin without prior authentication. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-10-29] Persistent cross site scripting in Confluence RefinedWiki Original Theme *** --------------------------------------------- By exploiting this vulnerability, users that are able to create or edit content, can attack other users of confluence. An attacker might be able to gain access to otherwise protected information in confluence. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Codeausführung: FTP-Client-Lücke in BSDs, Mac OS X und Linux-Distributionen *** --------------------------------------------- Eine Sicherheitslücke in dem FTP-Client von NetBSD erlaubt mit einem angepassten Server das Ausführen von Code auf dem Rechner. Betroffen davon sind wohl verschiedene BSD-Derivate, Mac OS X sowie Linux-Distributionen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/codeausfuehrung-ftp-client-luecke-in-bsds-mac-os-x… *** Threat Introduced via Browser Extensions *** --------------------------------------------- We love investigating unusual hacks. There are so many ways to compromise a website, but often it's the same thing. When we see malicious code on web pages, our usual suspects are: Vulnerabilities in website software Trojanized software .. --------------------------------------------- http://blog.sucuri.net/2014/10/threat-introduced-via-browser-extensions.html *** AirHopper: Offline-PC schickt Passwort per UKW an Offline-Handy *** --------------------------------------------- Israelische Security-Forscher haben einen neuen Weg für eine Seitenkanalattacke auf PCs gefunden. Mit einem Smartphone und einem Desktoprechner, die beide keine Onlineverbindung haben, können sie ein eingetipptes Passwort mitlesen. --------------------------------------------- http://www.golem.de/news/airhopper-offline-pc-schickt-passwort-per-ukw-an-o…

1 0

Tageszusammenfassung - Dienstag 28-10-2014
by Daily end-of-shift report 28 Oct '14

28 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-10-2014 18:00 − Dienstag 28-10-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** ddosfrei.de: neue Providerinitiative für sichere Server *** --------------------------------------------- Mit über 3.500 Angriffen pro Jahr zählen DDoS-Attacken (Distributed Denial of Service-Attacken) laut dem Bundesamt für Sicherheit in der Informationstechnik (BSI) zu den grössten Gefahren für die IT-Sicherheit in Deutschland, Tendenz steigend. Dabei handelt es sich um von vielen Rechnern gleichzeitig erfolgende .. --------------------------------------------- http://www.eco.de/2014/news/ddosfrei-de-neue-initiative-fuer-sichere-server… *** TA14-300A: Phishing Campaign Linked with "Dyre" Banking Malware *** --------------------------------------------- Since mid-October 2014, a phishing campaign has targeted a wide variety of recipients while employing the Dyre/Dyreza banking malware. Elements of this phishing campaign vary from target to target including senders, attachments, exploits, themes, and payload(s) .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-300A *** wget Default FTP Retrieval Method Lets Remote Users Create Arbitrary Files and Directories *** --------------------------------------------- http://www.securitytracker.com/id/1031121 *** TSX improves timing attacks against KASLR *** --------------------------------------------- Mega biblion mega kakon .. and similarly a long blog is a nuisance, so I managed to squeeze the essence of it into a single sentence, the title. If it is not entirely clear, read on. SMEP A typical privilege escalation exploit based on a kernel vulnerability works by corrupting the kernel .. --------------------------------------------- http://labs.bromium.com/2014/10/27/tsx-improves-timing-attacks-against-kasl… *** Immer Ärger mit Samsung-Dienst "Find My Mobile" *** --------------------------------------------- Erneut wurde ein Sicherheitsproblem in dem Dienst bekannt. Durch die Schwachstelle können Angreifer die Android-Geräte von Samsung unter Umständen aus der Ferne mit einem beliebigen Code sperren. --------------------------------------------- http://www.heise.de/security/meldung/Immer-Aerger-mit-Samsung-Dienst-Find-M… *** Verizon: Permaä-Cookie in manipulierten Datenpaketen *** --------------------------------------------- Die Datenpakete der Kunden des US-Mobilfunkanbieters Verizon enthalten eine eindeutige Identifikationsnummer. Damit sollen einzelne Personen von Verizons Werbekunden identifiziert werden können. Die Aktion läuft bereits seit zwei Jahren, wurde jedoch erst jetzt aufgedeckt. --------------------------------------------- http://www.golem.de/news/verizon-perma-cookie-in-manipulierten-datenpaketen… *** Untersuchung: Deutlich mehr Phishing-Attacken auf Apple-Nutzer *** --------------------------------------------- Laut einem Sicherheitsunternehmen nahmen die Angriffe auf iCloud- und iTunes-Konten im letzten Quartal um fast 250 Prozent zu. --------------------------------------------- http://www.heise.de/security/meldung/Untersuchung-Deutlich-mehr-Phishing-At… *** VB2014 paper: Hiding the network behind the network. Botnet proxy business model *** --------------------------------------------- Cristina Vatamanu and her colleagues describe how botherders keep their C&C servers hidden.Over the next few months, we will be sharing VB2014 conference papers as well as video recordings of the presentations. Today, we have added Hiding the network behind the network. Botnet proxy business model .. --------------------------------------------- http://www.virusbtn.com/blog/2014/10_28.xml

1 0

Tageszusammenfassung - Montag 27-10-2014
by Daily end-of-shift report 27 Oct '14

27 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-10-2014 18:00 − Montag 27-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** OpenBSD ELF denial of service *** --------------------------------------------- OpenBSD is vulnerable to a denial of service. A local attacker could exploit this vulnerability using a malicious ELF executable to cause a kernel panic. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97747 *** A Tale of Two Powerpoint Vulnerabilities *** --------------------------------------------- It's been already a week after the announcement of the CVE-2014-4114 vulnerability, and the tally of the exploiters have only increased. There are even .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002756.html *** Amplification DDoS attacks most popular, according to Symantec *** --------------------------------------------- The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August. --------------------------------------------- http://www.scmagazine.com/distributed-denial-of-service-attacks-are-increas… *** OwnCloud Dev Requests Removal From Ubuntu Repos Over Security Holes *** --------------------------------------------- ownCloud developer Lukas Reschke has sent an email to the Ubuntu Devel mailing list, requesting that ownCloud (server) is removed from the Ubuntu repositories because the package is old and there are multiple critical security bugs for .. --------------------------------------------- http://linux.slashdot.org/story/14/10/25/0046256/owncloud-dev-requests-remo… *** iTunes 12.0.1 for Windows DLL Hijacking *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100154 *** Shellshock-Angriffe auf Mailserver *** --------------------------------------------- Nach Informationen von heise Security versuchen Cyber-Kriminelle derzeit vermehrt, durch die Shellshock-Lücken in Mailserver einzudringen. Server-Betreiber sollten umgehend handeln. --------------------------------------------- http://www.heise.de/security/meldung/Shellshock-Angriffe-auf-Mailserver-243… *** WordPress Count-per-Day Plugin (notes.php) Remote Code Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100161 *** WordPress Download Manager Plugin Arbitrary File Download *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100160 *** Sipgate und Fidor Bank: DDoS-Angriffe waren Erpressungsversuch *** --------------------------------------------- Mit dem gross angelegten DDoS-Angriff gegen Sipgate sollte Geld erpresst werden. Auch die Fidor Bank aus München war betroffen. --------------------------------------------- http://www.golem.de/news/sipgate-und-fidor-bank-ddos-angriffe-waren-erpress… *** ASP Backdoors? Sure! It's not just about PHP *** --------------------------------------------- I recently came to the realization that it might appear that we're partial to PHP and WordPress. This realization has brought about an overwhelming need to correct that perception. While they do make up an interesting percentage, there are various .. --------------------------------------------- http://blog.sucuri.net/2014/10/asp-backdoors-its-not-all-about-php.html

1 0

Tageszusammenfassung - Freitag 24-10-2014
by Daily end-of-shift report 24 Oct '14

24 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-10-2014 18:00 − Freitag 24-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Operation Pawn Storm: Putting Outlook Web Access Users at Risk *** --------------------------------------------- In our recently released report, Operation Pawn Storm, we talked about an operation that involved three attack scenarios. For this post, we will talk about the third scenario: phishing emails that redirect victims to fake Outlook Web Access login pages. What's most notable about this is that it is simple, effective, and can be easily replicated. Through one... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CrAgUjYrv14/ *** Has the "Sandworm" zero-day exploit burrowed back to the surface? *** --------------------------------------------- You may have noticed that Microsoft recently published a Security Advisory that sounds a lot like the "Sandworm" vulnerability all over again. Paul Ducklin explains... --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/24/has-the-sandworm-exploit-burrowe… *** The Insecurity of Things : Part One *** --------------------------------------------- Everyday we read about some newfangled internet connected device being released. Things we use everyday are being made "smart" with some rushed-to-production software embedded in a cheap micro-controller. Fitness trackers, smoke alarms, televisions, cars, wall-outlets, even water-bottles. Internet connected-water bottles? What a time to be alive! --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-one *** The Insecurity of Things: Part Two *** --------------------------------------------- When we last left off, we were setting the stage for sharing what the Interns found in a handful of "IOT" or internet connected devices they purchased. So well be starting with a simple one. One that only required simple techniques to compromise it. This first device is a "Smart"-Home Controller. For a bit of background on whats going on here, please see "Part One" of this series otherwise were going to jump right in but first a disclaimer:... --------------------------------------------- http://www.xipiter.com/musings/the-insecurity-of-things-part-two *** The Case of the Modified Binaries *** --------------------------------------------- After creating and using a new exitmap module, I found downloaded binaries being patched through a Tor exit node in Russia. Tor is a wonderful tool for protecting the identity of journalists, their sources, and even regular users around the world; however, anonymity does not guarantee security. --------------------------------------------- http://www.leviathansecurity.com/blog/the-case-of-the-modified-binaries/ *** Sipgate: Dienste nach DDoS-Angriff wiederhergestellt *** --------------------------------------------- Nachdem Sipgate über Nacht seine Dienste teilweise wiederhergestellt hatte, ist das Unternehmen am Freitagmorgen erneut einem DDoS-Angriff ausgesetzt worden. Jetzt sollen die Dienste wieder funktionieren. --------------------------------------------- http://www.golem.de/news/sipgate-dienste-nach-ddos-angriff-wiederhergestell… *** QuickTime-Update für Windows schließt Bündel an Sicherheitslücken *** --------------------------------------------- Insgesamt vier Fehler steckten in der Windows-Version von Apples Multimedia-Unterstützung, die sich von Angreifern über manipulierte Dateien ausnützen lassen sollen. --------------------------------------------- http://www.heise.de/security/meldung/QuickTime-Update-fuer-Windows-schliess… *** Manipulating WordPress Plugin Functions to Inject Malware *** --------------------------------------------- Most authors of website malware usually rely on the same tricks, making it easy for malware researchers to spot obfuscated code, random files that don't belong, and malicious lines injected at the top of a file. However, it can become difficult when the malware is buried deep within the lines of code on normal files. --------------------------------------------- http://blog.sucuri.net/2014/10/manipulating-wordpress-plugin-functions-to-i… *** Filr 1.1 - Security Update 1 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.1.0 appliance.Document ID: 5194317Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.1.0.654.HP.txt (1.26 kB)Filr-1.1.0.654.HP.zip (5.64 MB)Products:Filr 1.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=3wpN2nVj2D8~ *** Filr - Security Update 3 *** --------------------------------------------- Abstract: This patch addresses the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability on the Filr 1.0.0 and 1.0.1 appliances.Document ID: 5194316Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:readme-Filr-1.0.0-SU3.txt (2.49 kB)readme-Filr-1.0.1-SU3.txt (2.49 kB)Filr-1.0.0-SU3.zip (5.64 MB)Filr-1.0.1-SU3.zip (5.64 MB)Products:Filr 1.0Filr 1.0.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_N6A9M3Jvig~ *** Cisco IOS and IOS XE Software Ethernet Connectivity Fault Management Vulnerability *** --------------------------------------------- CVE-2014-3409 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Bugtraq: [SECURITY] [DSA 3055-1] pidgin security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/533797 *** ZDI-14-368: Apple OS X GateKeeper Bypass Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-368/

1 0

Tageszusammenfassung - Donnerstag 23-10-2014
by Daily end-of-shift report 23 Oct '14

23 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-10-2014 18:00 − Donnerstag 23-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** New CVE-2014-4114 Attacks Seen One Week After Fix *** --------------------------------------------- Despite the availability of fixes related to the Sandworm vulnerability (CVE-2014-4114), we are still seeing new attacks related to this flaw. These attacks contain a new routine that could prevent detection. A New Evasion Technique In our analysis of the vulnerability, we noted this detail:... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/BYhEqtnNGxs/ *** NIST to hypervisor admins: secure your systems *** --------------------------------------------- Hypervisor security draft open for comment US standards body the National Institute of Standards and Technology (NIST) has laid out the basics of hypervisor security in a draft publication released for comment on 20 October. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/nist_to_hyp… *** Kommentar zur UEFI-Lücke: Sie lernen es einfach nicht *** --------------------------------------------- Sicherheitsexperten haben eine kritische Lücke entdeckt, die in vielen UEFI-Firmware-Versionen klafft - vor fast einem Jahr. Doch viele PC- und Mainboard-Hersteller wissen bisher nichts davon. Das ist untragbar. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kommentar-zur-UEFI-Luecke-Sie-lernen… *** Linux Container Security *** --------------------------------------------- First, read these slides. Done? Good.Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].Does this mean containers provide reduced security? --------------------------------------------- http://mjg59.dreamwidth.org/33170.html *** Xen says its security policies might be buggier than its software *** --------------------------------------------- Users didnt know if they were allowed to patch bug behind world cloud reboot The Xen project has asked for help to ensure future bugs arent as disruptive as the XSA-108 flaw that saw major cloud operators reboot an awful lot of servers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/23/xen_says_it… *** A look at a phishing website *** --------------------------------------------- Yesterday we came across a phishing website under .ch where we were able to download the phishing kit. A phishing kit is an archive file which contains all the relevant files for hosting a phishing website. In this case, the... --------------------------------------------- http://securityblog.switch.ch/2014/10/23/a-look-at-a-phishing-website/ *** Cisco Patches Three-Year-Old Telnet Remote Code Execution Bug in Security Appliances *** --------------------------------------------- There is a severe remote code execution vulnerability in a number of Cisco's security appliances, a bug that was first disclosed nearly three years ago. The vulnerability is in Telnet and there has been a Metasploit module available to exploit it for years. The FreeBSD Project first disclosed the vulnerability in telnet in December 2011... --------------------------------------------- http://threatpost.com/cisco-patches-three-year-old-telnet-remote-code-execu… *** Sicherheit: Apple verbietet SSLv3 für Push-Server *** --------------------------------------------- Entwickler, die den Apple-Push-Notification-Dienst nutzen, dürfen ab Ende des Monats nur noch TLS einsetzen. Grund ist die problematische "Poodle"-Lücke. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheit-Apple-verbietet-SSLv3-fuer-… *** APPLE-SA-2014-10-22-1 QuickTime 7.7.6 *** --------------------------------------------- https://support.apple.com/kb/HT6493 *** VMSA-2014-0011 *** --------------------------------------------- VMware vSphere Data Protection product update addresses a critical information disclosure vulnerability. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0011.html *** TCP Vulnerabilities in Multiple Non-IOS Cisco Products *** --------------------------------------------- cisco-sa-20040420-tcp-nonios --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Wireshark Multiple Dissector Bugs Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031111 *** [R2] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** SA-CONTRIB-2014-102 - Document - Cross Site Scripting *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-102Project: Document (third-party module)Version: 6.x, 7.xDate: 2014-October-08Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionDocument module is a basic Document Management System for Drupal. Cross Site Scripting (XSS)The module wasnt sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to --------------------------------------------- https://www.drupal.org/node/2361617 *** SA-CONTRIB-2014-101 - Ubercart - Cross Site Request Forgery *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-101Project: Ubercart (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 13/25 ( Moderately Critical) AC:None/A:Admin/CI:None/II:Some/E:Proof/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Ubercart module provides a shopping cart and e-commerce features for Drupal.Cross Site Request Forgery (CSRF)The country administration links are not properly protected. A malicious user could trick a store administrator into enabling or --------------------------------------------- https://www.drupal.org/node/2361613 *** SA-CONTRIB-2014-100 - Bad Behavior - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-100Project: Bad Behavior (third-party module)Version: 6.x, 7.xDate: 2014-October-22Security risk: 15/25 ( Critical) AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionThis module enables you to to target any malicious software directed at a Web site, whether it be a spambot, ill-designed search engine bot, or system crackers. It blocks such access and then logs their attempts.Information DisclosureThe module --------------------------------------------- https://www.drupal.org/node/2361611 *** IBM Security Bulletins for SSLv3 Vulnerability (POODLE) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Other IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Mittwoch 22-10-2014
by Daily end-of-shift report 22 Oct '14

22 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-10-2014 18:00 − Mittwoch 22-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory 3010060 released *** --------------------------------------------- Today, we released Security Advisory 3010060 to provide additional protections regarding limited, targeted attacks directed at Microsoft Windows customers. A cyberattacker could cause remote code execution if someone is tricked into opening a maliciously-crafted PowerPoint document that contains an infected Object Linking and Embedding (OLE) file. As part of this Security Advisory, we have included an easy, one-click Fix it solution to address the known cyberattack. Please review the... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/21/security-advisory-301006… *** Android NFC hack allow users to have free rides in public transportation *** --------------------------------------------- More and more people keep talking about the feature of payments via NFC. The problem in this particular case is that somebody reversed the "Tarjeta BIP!" cards and found a means to re-charge them for free. --------------------------------------------- http://securelist.com/blog/virus-watch/67283/android-nfc-hack-allow-users-t… *** SSL-Verschlüsselung: Noch viel Arbeit für Mail-Provider und Banken *** --------------------------------------------- heise Security hat getestet und festgestellt, dass einige Mail-Provider bereits auf die jüngsten Angriffe auf Verschlüsselung reagiert haben - aber längst nicht alle. Schlimmer noch sieht es bei den Servern für das Online-Banking via HBCI aus. --------------------------------------------- http://www.heise.de/security/meldung/SSL-Verschluesselung-Noch-viel-Arbeit-… *** Malvertising Payload Targets Home Routers *** --------------------------------------------- A few weeks ago we wrote about compromised websites being used to attack your web routers at home by changing DNS settings. In that scenario the attackers embedded iFrames to do the heavy lifting, the short fall with this method is they require a website to inject the iFrame. As is often the case, tacticsRead More --------------------------------------------- http://blog.sucuri.net/2014/10/malvertising-payload-targets-home-routers.ht… *** Gezielte Angriffe über Onlinewerbung *** --------------------------------------------- Datendiebe haben offenbar mit manipulierter Onlinewerbung Rüstungs- und Luftfahrtkonzerne angegriffen. Die Werbung konnte über das so genannte Real Time Bidding gezielt platziert werden. --------------------------------------------- http://www.golem.de/news/phishing-gezielte-angriffe-ueber-onlinewerbung-141… *** Netzangriffe: DDoS-Botnetz weitet sich ungebremst aus *** --------------------------------------------- Ein kürzlich entdecktes Botnetz für DDoS-Angriffe breitet sich nach Angaben von Experten ungehemmt aus. Inzwischen seien auch Windows-Server gefährdet. Der Zweck der darüber gefahrenen Angriffe bleibt aber unklar. --------------------------------------------- http://www.golem.de/news/netzangriffe-ddos-botnetz-weitet-sich-ungebremst-a… *** Hostile Subdomain Takeover using Heroku/Github/Desk + more *** --------------------------------------------- Hackers can claim subdomains with the help of external services. This attack is practically non-traceable, and affects at least 17 large service providers and multiple domains are affected. Find out if you are one of them by using our quick tool, or go through your DNS-entries and remove all which are active and unused OR pointing to External Services which you do not use anymore. --------------------------------------------- http://blog.detectify.com/post/100600514143/hostile-subdomain-takeover-usin… *** TYPO3 CMS 4.5.37, 4.7.20, 6.1.12 and 6.2.6 released *** --------------------------------------------- IMPORTANT: These versions include important security fixes to the TYPO3 core. A security announcement has just been released: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… --------------------------------------------- https://typo3.org/news/article/typo3-cms-4537-4720-6112-and-626-released/ *** Security_Advisory-DLL Hijacking Vulnerability on Huawei USB Modem products *** --------------------------------------------- Oct 21, 2014 20:23 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack (CVE-2014-3566) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled by default in IBM WebSphere MQ. CVE(s): CVE-2014-3566 Affected product(s) and affected version(s): The vulnerability affects all versions and releases of IBM WebSphere MQ, IBM WebSphere MQ Internet Pass-Thru and IBM Mobile Messaging and M2M Client Pack. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Bugtraq: FreeBSD Security Advisories *** --------------------------------------------- http://www.securityfocus.com/archive/1/533773 http://www.securityfocus.com/archive/1/533772 http://www.securityfocus.com/archive/1/533771 http://www.securityfocus.com/archive/1/533770 *** Bugtraq: File Manager v4.2.10 iOS - Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533778 *** Files Document & PDF Reader for iOS Ordner Erstellen code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97698

1 0

Tageszusammenfassung - Dienstag 21-10-2014
by Daily end-of-shift report 21 Oct '14

21 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-10-2014 18:00 − Dienstag 21-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple Multiple Security Updates, (Mon, Oct 20th) *** --------------------------------------------- Apple released security update today for iOS 8 and Apple TV 7. iOS 8.1 (APPLE-SA-2014-10-20-1 iOS 8.1) is now available for iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later, to addresses the following: Bluetooth CVE-2014-4448 House Arrest CVE-2014-4448 iCloud Data Access CVE-2014-4449 Keyboards CVE-2014-4450 Secure Transport CVE-2014-3566 Apple TV 7.0.1 (APPLE-SA-2014-10-20-2 Apple TV 7.0.1) is now available for Apple TV 3rd generation and later, to address the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18857&rss *** Palo Alto Networks boxes spray firewall creds across the net *** --------------------------------------------- Crummy configurations to blame, Moore hardening offered as remedy Misconfigured user identities for Palo Alto Networks firewalls are leaking onto the public web potentially exposing customer services including VPN and webmail, says security luminary HD Moore. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/21/palo_alto_c… *** Download-Sicherheit: Blackberry muss App-Store nachbessern *** --------------------------------------------- Wegen fehlender Sicherung der Downloads aus Blackberry World, dem offiziellen App Store für alle Blackberry-10-Modelle, hätte ein Angreifer ganz leicht Schadsoftware auf die Geräte schmuggeln können. --------------------------------------------- http://www.heise.de/security/meldung/Download-Sicherheit-Blackberry-muss-Ap… *** CSAM Month of False Positives: Ghosts in the Pentest Report, (Tue, Oct 21st) *** --------------------------------------------- As part of most vulnerability assessments and penetration tests against a website, we almost always run some kind of scanner. Burp (commercial) and ZAP (free from OWASP) are two commonly used scanners. Once youve done a few website assessments, you start to get a feel for what pages and fields are likely candidates for exploit. But especially if its a vulnerability assessment, where youre trying to cover as many issues as possible (and exploits might even be out of scope), its always a safe bet --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18861&rss *** Delivering Malicious Android Apps Hidden In Image Files *** --------------------------------------------- An anonymous reader writes "Researchers have found a way to deliver a malicious app to Android users by hiding it into what seems to be an encrypted image file, which is then delivered via a legitimate, seemingly innocuous wrapper app. Fortinet malware researcher Axelle Apvrille and reverse engineer Ange Albertini created a custom tool they dubbed AngeCryption, which allows them to encrypt the payload Android application package (APK) and make it look like an image (PNG, JPG) file. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/mKMqgWAvhIM/story01.htm *** Google Adds Hardware Security Key For Account Protection *** --------------------------------------------- Google is introducing an improved two-factor authentication system for Gmail and its other services that uses a tiny hardware token that will only work on legitimate Google sites. The new Security Key system is meant to help defeat attacks that rely on highly plausible fake sites that are designed to capture users' credentials. Attackers often go... --------------------------------------------- http://threatpost.com/google-adds-hardware-security-key-for-account-protect… *** R7-2014-17: NAT-PMP Implementation and Configuration Vulnerabilities *** --------------------------------------------- In the summer of 2014, Rapid7 Labs started scanning the public Internet for NAT-PMP as part of Project Sonar. NAT-PMP is a protocol implemented by many SOHO-class routers and networking devices that allows firewall and routing rules to be manipulated to enable internal, assumed trusted users behind a NAT device to allow external users to access internal TCP and UDP services for things like Apple's Back to My Mac and file/media sharing services. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/21/r7-2014-1… *** Denial-of-service attacks - short but strong *** --------------------------------------------- DDoS amplification attacks continue to increase as attackers experiment with new protocols. Summary: DDoS amplification attacks continue to increase as attackers experiment with new protocols. read more --------------------------------------------- http://www.symantec.com/connect/blogs/denial-service-attacks-short-strong *** [R1] SSLv3 Protocol Vulnerability Affects Tenable Products (POODLE) *** --------------------------------------------- October 19, 2014 --------------------------------------------- http://www.tenable.com/security/tns-2014-09 *** Vuln: Zend Framework CVE-2014-8088 Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70378 *** DSA-3054 mysql-5.5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3054 *** Asterisk SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic *** --------------------------------------------- http://www.securitytracker.com/id/1031078 *** HP Security Bulletins *** --------------------------------------------- http://www.securityfocus.com/archive/1/533732 http://www.securityfocus.com/archive/1/533733 http://www.securityfocus.com/archive/1/533736 http://www.securityfocus.com/archive/1/533737 http://www.securityfocus.com/archive/1/533738 http://www.securityfocus.com/archive/1/533739 http://www.securityfocus.com/archive/1/533740 http://www.securityfocus.com/archive/1/533742 http://www.securityfocus.com/archive/1/533754

1 0

Tageszusammenfassung - Montag 20-10-2014
by Daily end-of-shift report 20 Oct '14

20 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-10-2014 18:00 − Montag 20-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Erneut Sicherheitsupdates für PHP *** --------------------------------------------- Zum zweiten Mal im laufenden Monat veröffentlichten die PHP-Entwickler sicherheitsrelevante Patches für ihr Projekt. Allein im Versionszweig 5.6 haben sie vier Schwachstellen beseitigt. --------------------------------------------- http://www.heise.de/security/meldung/Erneut-Sicherheitsupdates-fuer-PHP-242… *** Spike in Malware Attacks on Aging ATMs *** --------------------------------------------- This author has long been fascinated with ATM skimmers, custom-made fraud devices designed to steal card data and PINs from unsuspecting users of compromised cash machines. But a recent spike in malicious software capable of infecting and jackpotting ATMs is shifting the focus away from innovative, high-tech skimming devices toward the rapidly aging ATM infrastructure in the United States and abroad. --------------------------------------------- http://krebsonsecurity.com/2014/10/spike-in-malware-attacks-on-aging-atms/ *** Breaking International Voicemail Security via VVM Exploitation *** --------------------------------------------- A few days ago, I gave a presentation at Ruxcon about breaking international voicemail security. Whilst the crowd and conference were absolutely amazing - my overall research, I think has a much wider scope in the terms of whom it could affect. This blog post acts as a technical writeup and companion to my slides presented at Ruxcon. TL;DR Briefly put, through researching the visual voicemail protocol, we were able to document a number of different vulnerabilities, including some which affected... --------------------------------------------- https://shubh.am/breaking-international-voicemail-security-via-vvm-exploita… *** Availability of SHA-2 Hashing Algorithm for Windows 7 and Windows Server 2008 R2 *** --------------------------------------------- V1.0 (October 14, 2014): Advisory published. V2.0 (October 17, 2014): Removed Download Center links for Microsoft security update 2949927. Microsoft recommends that customers experiencing issues uninstall this update. Microsoft is investigating behavior associated with this update, and will update the advisory when more information becomes available. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/2949927 *** An Analysis of A Windows Kernel-Mode Vulnerability (CVE-2014-4113) *** --------------------------------------------- Three zero-day vulnerabilities - CVE-2014-4114, CVE-2014-4148, and CVE-2014-4113 - were reported last week and patched by Microsoft in their October 2014 Patch Tuesday. CVE-2014-4114, also known as the Sandworm vulnerability, can enable attackers to easily craft malware payloads when exploited. This particular vulnerability has been linked to targeted attacks against European sectors and industries. In addition, our researchers found that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/vwOtSBJrH3I/ *** Smart Lock Devices: Security Risks and Opportunities *** --------------------------------------------- Security is one of the top concerns when consumers consider buying smart devices. With cybercrime making the headlines every day, one has to think: is this smart device vulnerable to cyber attacks? Are these technologies secure enough for us to rely on them in our everyday lives? A good example of a technology that we need... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gtATHkHYNv4/ *** Black Hat Europe - day 2 *** --------------------------------------------- IPv6 versus IDPS, XSS in WYSIWYG editors, and reflected file downloads.After a busy first day, I was somewhat glad that the talks on the second day of Black Hat Europe appealed slightly less to my personal tastes and interests, as this gave me a chance to meet some old and new friends, and to have those conversations that perhaps form the heart of a security conference.I did attend three talks though, each of which was very interesting.Early in the morning, Antonios Atlasis, Enno Rey and Rafael... --------------------------------------------- http://www.virusbtn.com/blog/2014/10_20.xml?rss *** Dropbox-Server als Phishing-Helfer *** --------------------------------------------- Phishing-Mails verweisen meist auf dubiose Domains - nicht so in diesem Fall: Datensammler nutzen eine offizielle Dropbox-Domain, um Zugangsdaten aller Art abzugreifen. --------------------------------------------- http://www.heise.de/security/meldung/Dropbox-Server-als-Phishing-Helfer-242… *** Soundsquatting Unraveled: Homophone-based Domain Squatting *** --------------------------------------------- The Domain Name System (DNS) plays a vital role in the operation of the Internet. Over the years, it has been a primary target for malicious users looking for vulnerabilities in its protocol and infrastructure. Some examples include cache poisoning attacks, vulnerable DNS server implementations, and bogus user interactions. Taking advantage of users' spelling mistakes... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Jv_ckUgwnAs/ *** Targeted Attack Protection via Network Topology Alteration *** --------------------------------------------- When it comes to targeted attacks, attackers are not omniscient. They need to gather information in the early stages to know the target they may gather information from various sources of intelligence, like Google, Whois, Twitter, and Facebook. They may gather data such as email addresses, IP ranges, and contact lists. These will then be used as... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/75OKb_Lt8XA/ *** Microsoft MSRT October Update, (Sun, Oct 19th) *** --------------------------------------------- This past week Microsoft MSRT push contains detections/removals for several widely used APT tools. The coalition (led by Novetta) that brought about the inclusions of these tools in this month MSRT, are encouraging enterprises to push/execute this month MSRT update. Some of malware included in this month MSRT update have a preliminary report posted here. If you are using either Snort or Sourcefire, the ruleIDs to detect some of the threat/family in this month MSRT release are listed below and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18853&rss *** Staying in control of your browser: New detection changes *** --------------------------------------------- This week we made some important changes to how we detect browser modifiers and adware. These changes are designed to better protect your browsing experience. We have already blogged about the changes to the behaviors we detect as adware. I will explain the changes to our browser modifier detections below. Our objective criteria has all the details about how and why we detect unwanted software. Unacceptable behaviors There are two new browser modifier behaviors that we detect: Bypassing --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/17/staying-in-control-of-yo… *** Drupal SQL Injection Attempts in the Wild *** --------------------------------------------- Less than 48 hours ago, the Drupal team released an update (version 7.32) for a serious security vulnerability (SQL injection) that affected all versions of Drupal 7.x. In our last post, we talked about the vulnerability and that we expected to see attacks starting very soon due to how severe and easy it was to... --------------------------------------------- http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wild.ht… *** Metasploit Weekly Wrapup: POODLE Mitigations *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/10/17/metasploi… *** OpenX multiple open redirect *** --------------------------------------------- OpenX could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the adclick.php and the ck.php scripts. By sending a specially-crafted URL, an attacker could exploit this vulnerability using the dest and _maxdest parameters to redirect a victim to arbitrary Web sites. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97621 *** VMSA-2014-0010.13 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** Rich Counter 1.1.5 - Cross Site Scripting (XSS) *** --------------------------------------------- 2014-10-18T19:45:31 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7648 *** Information Disclosure vulnerability in Dynamic Content Elements (dce) *** --------------------------------------------- It has been discovered that the extension "Dynamic Content Elements" (dce) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-vulnerability-in-d… *** DSA-3050 iceweasel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3050 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Service Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Service Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685122 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-4244, CVE-2014-4263) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 that is used by Rational Performance Tester and were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Rational Performance Tester versions 8.1 - 8.6 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21685121 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Sametime Classic Meeting Record and Playback File Vulnerability (CVE-2014-4766) *** --------------------------------------------- A vulnerability in the Record and Playback (RAP) file that is exported by Classic Meeting (CVE-2014-4766). CVE(s): CVE-2014-4766 Affected product(s) and affected version(s): IBM Sametime Classic Meeting Server versions 8.0.x and 8.5.x Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21687361 X-Force Database: http://xforce.iss.net/xforce/xfdb/94793 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 17-10-2014
by Daily end-of-shift report 17 Oct '14

17 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-10-2014 18:00 − Freitag 17-10-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Logging SSL, (Thu, Oct 16th) *** --------------------------------------------- With POODLE behind us, it is time to get ready for the next SSL firedrill. One of the questions that keeps coming up is which ciphers and SSL/TLS versions are actually in use. If you decide to turn off SSLv3 or not depends a lot on who needs it, and it is an important answer to have ready should tomorrow some other cipher turn out to be too weak. But keep in mind that it is not just numbers that matter. You also need to figure out who the outliers are and how important (or dangerous?) they are. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18847&rss *** Bad news, fandroids: He who controls the IPC tool, controls the DROID *** --------------------------------------------- A security flaw in a core message-passing mechanism leaves every Android device potentially vulnerable to attack, security researchers warned on Thursday. The flaw relates to Binder, Android's inter-process communication (IPC) tool. The message passing mechanism for Android devices acts as a communications hub on smartphones and tablets running the Google-developed mobile OS, making it a prime target for Android malware developers. --------------------------------------------- http://www.theregister.co.uk/2014/10/16/android_messaging_mechanism_securit… *** SAP Netweaver Enqueue Server denial of service *** --------------------------------------------- SAP Netweaver is vulnerable to a denial of service. By sending a specially-crafted SAP Enqueue Server packet to remote TCP port 32NN, a remote attacker could exploit this vulnerability to cause the system to become unresponsive. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/97610 *** Close means close: New adware detection criteria *** --------------------------------------------- In April we introduced the rules that software developers should follow when creating advertisements to avoid being detected by Microsoft security products as adware. These rules are designed to keep our customers in control of their Internet browsing experience. Since then, we have had great success working with some companies through our developer contact process. At the same time we have started to see other advertising programs trying to bend and even circumvent our rules. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/10/16/close-means-close-new-ad… *** Siemens RuggedCom ROX-based Devices Certificate Verification Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-135-03 Siemens RuggedCom ROX-Based Devices Certificate Verification Vulnerability that was published May 15, 2014, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an incorrect certificate verification in Siemens RuggedCom ROX based devices. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-135-03A *** Siemens OpenSSL Vulnerabilities (Update F) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03E Siemens OpenSSL Vulnerabilities that was published October 15, 2014, on the NCCIC/ICS-CERT web site. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03F *** IOServer Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an out of bound read vulnerability in the IOServer application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-289-01 *** Fox DataDiode Proxy Server CSRF Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on September 26, 2014, and is being released to the ICS-CERT web site. This advisory provides mitigation details for a Cross-Site Request Forgery (CSRF) in the proxy server web administration interface for the Fox DataDiode Appliance Proxy Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-269-02 *** Black Hat Europe - day 1 *** --------------------------------------------- Programme packed with interesting talks.Though the prestige of Black Hat Europe doesnt compare to that of its American parent conference, and the event certainly doesnt dominate the debate on Twitter in quite the same way, more than 800 security experts descended on Amsterdam this week where, in the RAI Convention Centre, the 14th edition of Black Hat Europe is taking place.The conference opened with a keynote from Adi Shamir (perhaps still best known as the S in the RSA protocol) on side --------------------------------------------- http://www.virusbtn.com/blog/2014/10_17.xml?rss *** Abusing TZ for fun (and little profit) *** --------------------------------------------- Topic: Abusing TZ for fun (and little profit) Risk: Low Text: By default, sudo preserves the TZ variable[1] from users environment. This is a bad idea on glibc systems, where TZ can be abused to trick the program to read an arbitrary file. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100107 *** Denial of Service vulnerability in extension Calendar Base (cal) *** --------------------------------------------- It has been discovered that the extension "Calendar Base" (cal) is susceptible to Denial of Service. --------------------------------------------- http://www.typo3.org/news/article/several-vulnerabilities-in-extension-cale… *** Hacking Smart Electricity Meters To Cut Power Bills *** --------------------------------------------- Smart devices are growing at an exponential pace with the increase in connecting devices embedded in cars, retail systems, refrigerators, televisions and countless other things people use in their everyday life, but security and privacy are the key issues for such applications, which still face some enormous number of challenges. --------------------------------------------- http://thehackernews.com/2014/10/hacking-smart-electricity-meters-to-cut.ht… *** Apple Updates (not just Yosemite), (Fri, Oct 17th) *** --------------------------------------------- Apple yesterday released the latest version of its operating system, OS X 10.10 Yosemite. As usual, the new version of the operating system does include a number of security related bug fixes, and Apple released these fixes for older versions of OS X today. This update, Security Update 2014-005 is available for versions of OS X back to 10.8.5 (Mountain Lion). Among the long list of fixes, here a couple of highlights: Apple doesnt turn off SSLv3 in this release, but restricts it to non-CBC --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18851&rss

1 0

Tageszusammenfassung - Donnerstag 16-10-2014
by Daily end-of-shift report 16 Oct '14

16 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-10-2014 18:00 − Donnerstag 16-10-2014 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Multiple Vulnerabilities in Cisco TelePresence Video Communication Server and Cisco Expressway Software *** --------------------------------------------- cisco-sa-20141015-vcs --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability *** --------------------------------------------- cisco-sa-20141015-poodle --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** JSA10656 - 2014-10 Out of Cycle Security Bulletin: Multiple products affected by SSL "POODLE" vulnerability (CVE-2014-3566) *** --------------------------------------------- --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10656&actp=RSS *** SA-CONTRIB-2014-098 - CKEditor - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-098Project: CKEditor - WYSIWYG HTML editor (third-party module)Version: 6.x, 7.xDate: 2014-October-15Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) - a visual HTML editor, sometimes called WYSIWYG editor.Both --------------------------------------------- https://www.drupal.org/node/2357029 *** [DSA 3052-1] wpa security update *** --------------------------------------------- CVE ID : CVE-2014-3686 Jouni Malinen discovered an input sanitization issue in the wpa_cli and hostapd_cli tools included in the wpa package. A remote wifi system within range could provide a crafted string triggering arbitrary code execution running with privileges of the affected wpa_cli or hostapd_cli process. --------------------------------------------- https://lists.debian.org/debian-security-announce/2014/msg00238.html *** The October 2014 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: Same again? Fingerprint sensor on new iPhone 6 hacked using same method as for previous model Up in the air: --------------------------------------------- http://securityblog.switch.ch/2014/10/15/the-october-2014-issue-of-our-swit… *** MindshaRE: Statically Extracting Malware C2s Using Capstone Engine *** --------------------------------------------- I decided to share a technique I've been playing around with to pull C2 and other configuration information out of malware that does not store all of its configuration information in a set structure or in the resource section ... Being able to statically extract this information becomes important in the event that the malware does not run properly in your sandbox, the C2s are down or you don?t have thetime / sandbox bandwidth to manually run and extract the information from network indicators. --------------------------------------------- https://www.arbornetworks.com/asert/2014/10/mindshare-statically-extracting… *** C&C Botnet Detection over SSL *** --------------------------------------------- ...we have designed, implemented and validated a method to detect botnet C&C communication channels over SSL, the security protocol standard de-facto. ... Our analysis also indicates that 0.6% of the SSL connections were broken. --------------------------------------------- http://essay.utwente.nl/65667/1/Riccardo_Bortolameotti_MasterThesis.pdf *** VB2014 paper: DNSSEC - how far have we come? *** --------------------------------------------- Nick Sullivan describes how DNSSEC uses cryptography to add authentication and integrity to DNS responses.Over the next months, we will be sharing conference papers as well as video recordings of the presentations. Today, we have added DNSSEC - how far have we come? by CloudFlares Nick Sullivan.It is rather scary to think about how much of the Internet depends on DNS, and how little guarantee that protocol provides about its responses being correct. The Kaminsky attack is well mitigated these --------------------------------------------- http://www.virusbtn.com/blog/2014/10_16.xml?rss *** Factsheet Vulnerability in libxml2 *** --------------------------------------------- On 16 October 2014, a vulnerability was reported in libxml2, a library for the processing of eXtensible Markup Language (XML). XML is a language for the exchange of structured information between applications. Attackers can use this vulnerability to disrupt the availability of (web) applications through a so called Denial-of-Service (DoS) attack. --------------------------------------------- http://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fact… *** POODLE attack takes bytes out of your encrypted data - heres what to do *** --------------------------------------------- Heartbleed, Shellshock, Sandworm...and now POODLE. Its a security hole that could let crooks read your encrypted web traffic. Paul Ducklin takes you through how it works, and what you can do to avoid it, in plain (well, plain-ish) English... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/nyUmrkuhxuM/

1 0

Tageszusammenfassung - Mittwoch 15-10-2014
by Daily end-of-shift report 15 Oct '14

15 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-10-2014 18:00 − Mittwoch 15-10-2014 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Accessing Risk for the October 2014 Security Updates *** --------------------------------------------- Today we released eight security bulletins addressing 24 unique CVE's. Three bulletins have a maximum severity rating of Critical, and five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max exploitability Platform mitigations and key notes MS14-058 (Kernel mode drivers [win32k.sys]) Attacker loads a malicious --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/10/14/accessing-risk-for-the-oc… *** MS14-OCT - Microsoft Security Bulletin Summary for October 2014 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for October 2014. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-OCT *** More Details About CVE-2014-4073 Elevation of Privilege Vulnerability *** --------------------------------------------- Today Microsoft shipped MS14-057 to the .NET Framework in order to resolve an Elevation of Privilege vulnerability in the ClickOnce deployment service. While this update fixes this service, developers using Managed Distributed Component Object Model (a .NET wrapped around DCOM) need to take immediate action to ensure their applications are secure. Managed DCOM is an inherently unsafe way to perform communication between processes of different trust levels. Microsoft recommends moving --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/10/14/more-details-about-cve-20… *** BlackBerry 10 Devices Open to Bug That Allows Malicious App Installation *** --------------------------------------------- BlackBerry has patched a vulnerability in its BlackBerry 10 devices that could allow an attacker to intercept users' traffic to and from the BlackBerry World app store and potentially install malware on a targeted device. The vulnerability is a weakness in the integrity checking system that BlackBerry uses to verify the apps that users download. --------------------------------------------- http://threatpost.com/blackberry-10-devices-open-to-bug-that-allows-malicio… *** An Analysis of Windows Zero-day Vulnerability "CVE-2014-4114" aka "Sandworm" *** --------------------------------------------- Prior to the release of Microsoft's monthly patch Tuesday, a new zero-day exploiting Windows vulnerability covered in CVE-2014-4114 was reported by iSight. The said vulnerability affects desktop and server versions of Vista and Sever 2008 to current versions. It was believed to be associated in cyber attacks related to NATO by Russian cyber espionage group. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jSCRsk2zaNU/ *** Analysis of Linux Backdoor Used In Freenode Hack *** --------------------------------------------- An anonymous reader writes "A detailed analysis has been done of the Linux backdoor used in the freenode hack. It employed port knocking and encryption to provide security against others using it. This seems a little more sophisticated than your average black-hat hacker. Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/K3FWymutqls/story01.htm *** Siemens OpenSSL Vulnerabilities (Update D) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03C Siemens OpenSSL Vulnerabilities that was published August 21, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens OpenSSL cryptographic software library affecting several Siemens industrial products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03D *** Oracle stopft kritische Lücken in Java *** --------------------------------------------- Oracle hat mit seinem Oktober-Update 154 Sicherheitsupdates veröffentlicht, die fast alle Produkte des Unternehmens abdecken. Aber besonders die Sicherheitsupdates für Java sollten laut der Firma so schnell wie möglich installiert werden. --------------------------------------------- http://www.heise.de/security/meldung/Oracle-stopft-kritische-Luecken-in-Jav… *** Security Advisory 3009008 released *** --------------------------------------------- Today, we released Security Advisory 3009008 to address a vulnerability in Secure Sockets Layer (SSL) 3.0 which could allow information disclosure. This is an industry-wide vulnerability that affects the protocol itself, and is not specific to Microsoft's implementation of SSL or the Windows operating system. This advisory provides guidance for customers so that they can disable SSL 3.0 in the browser. Customers should be aware that once they disable SSL 3.0, if they visit a website that --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/14/security-advisory-300900… *** October 2014 Updates *** --------------------------------------------- Today, as part of Update Tuesday, we released eight security updates three rated Critical and five rated Important - to address 24 Common Vulnerabilities & Exposures (CVEs) in Windows, Office, .NET Framework, .ASP.NET, and Internet Explorer (IE). We encourage you to apply all of these updates, but for those who need to prioritize deployment planning, we recommend focusing on the Critical updates first. Here's an overview slide and video of the security updates released today: --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/10/14/october-2014-updates.aspx *** [2014-10-15] Potential Cross-Site Scripting in ADF Faces *** --------------------------------------------- The Oracle ADF Faces framework fails to encode certain characters in the goButton component. This may lead to Cross-Site Scripting vulnerabilities in applications that use this component. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Bugtraq: two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other) *** --------------------------------------------- two browser mem disclosure bugs (CVE-2014-1580 and CVE-something-or-other) --------------------------------------------- http://www.securityfocus.com/archive/1/533692 *** Java Reflection API Woes Resurface in Latest Oracle Patches *** --------------------------------------------- Oracles Critical Patch update addresses 154 vulnerabilities, many of which are remotely exploitable. Security Explorations of Poland, meanwhile, published details on a number of Java flaws in the Java Reflection API. --------------------------------------------- http://threatpost.com/java-reflection-api-woes-resurface-in-latest-oracle-p… *** Bugtraq: Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin *** --------------------------------------------- Multiple Cross-Site Scripting (XSS) in WP Google Maps WordPress Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/533699 *** Bugtraq: Paypal Inc MultiOrderShipping API - Filter Bypass & Persistent XML Vulnerability *** --------------------------------------------- Paypal Inc MultiOrderShipping API - Filter Bypass & Persistent XML Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/533698 *** OpenSSL Releases OpenSSL 1.0.1j, 1.0.0o and 0.9.8zc, (Wed, Oct 15th) *** --------------------------------------------- This update to the OpenSSL Library addresses 3 vulnerabilities. One of these is the POODLE vulnerability announced yesterday. CVE-2014-3513: A memory leak in parsing DTLS SRTPmessages can lead to a denial of service. You are vulnerable, unless you specificly compiled your OpenSSL library with the OPENSSL_NO_SRTP option. All 1.0.1 versions of OpenSSL are affected. CVE-2014-3567: Another memory leak that can lead to a DoS attack. In this case, memory is not free up if an SSL session ticket fails --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18835&rss

1 0

Tageszusammenfassung - Dienstag 14-10-2014
by Daily end-of-shift report 14 Oct '14

14 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-10-2014 18:00 − Dienstag 14-10-2014 18:00 Handler: Stefan Lenzhofer Co-Handler: Otmar Lendl *** Developer of hacked Snapchat web app says "Snappening" claims are hoax *** --------------------------------------------- 500 MB of images pulled from third-party site, but no user data was attached. --------------------------------------------- http://arstechnica.com/security/2014/10/developer-of-hacked-snapchat-web-ap… *** VB2014 paper: The evolution of webinjects *** --------------------------------------------- Jean-Ian Boutin looks at the increased commoditization of webinjects.Virus Bulletin has always been about sharing information, and the Virus Bulletin conference is an important part of that. We would love to be able to share some of the discussions attendees had during the lunch and coffee breaks, the late-night or early-morning meetings in the hotel lobby, and the inspiration one gets from being around such bright minds.Of course, we are unable to do that. But what we can do is share some of --------------------------------------------- http://www.virusbtn.com/blog/2014/10_13.xml?rss *** Cisco AsycnOS Software ZIP Filtering By-Pass Vulnerability *** --------------------------------------------- CVE-2014-3381 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Exploring and Exploiting iOS Web Browsers *** --------------------------------------------- Today we begin a three-post series about mobile security. We start with a discussion of vulnerabilities in iOS web browsers. Later this week well cover jailbreaking and the detection of it. While the release and adoption of iOS 8 may plug some of the holes discussed in this post, many users will continue to use iOS 7 for some time and may remain vulnerable. In Q1 2014, the market share of web traffic from mobile browsers exceeded 30% [1], and it is constantly growing. According to data provided --------------------------------------------- http://blog.spiderlabs.com/2014/10/exploring-and-exploiting-ios-web-browser… *** VMSA-2014-0010.12 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** A Code Signature Plugin for IDA *** --------------------------------------------- When reversing embedded code, it is often the case that completely different devices are built around a common code base, either due to code re-use by the vendor, or through the use of third-party software; this is especially true of devices running the same Real Time Operating System. For example, ... --------------------------------------------- http://www.devttys0.com/2014/10/a-code-signature-plugin-for-ida/ *** vBulletin Input Validation Flaw in XMLRPC API Lets Remote Users Inject SQL Commands *** --------------------------------------------- vBulletin Input Validation Flaw in XMLRPC API Lets Remote Users Inject SQL Commands --------------------------------------------- http://www.securitytracker.com/id/1031001 *** vBulletin Input Validation Flaw in XMLRPC API Permits Cross-Site Scripting Attacks *** --------------------------------------------- vBulletin Input Validation Flaw in XMLRPC API Permits Cross-Site Scripting Attacks --------------------------------------------- http://www.securitytracker.com/id/1031000 *** iSIGHT discovers zero-day vulnerability CVE-2014-4114 *** --------------------------------------------- Zero-day impacting all versions of Microsoft Windows used in Russian cyber-espionage campaign targeting NATO, European Union, Telecommunications and Energy sectors. --------------------------------------------- http://www.isightpartners.com/2014/10/cve-2014-4114/ *** HTTPS-Zertifikate: Key Pinning schützt vor bösartigen Zertifizierungsstellen *** --------------------------------------------- Eine bislang wenig beachtete HTTPS-Erweiterung mit dem Namen HTTP Public Key Pinning (HPKP) steht kurz vor ihrer Standardisierung. Durch Public Key Pinning könnten viele Probleme mit den Zertifizierungsstellen gelöst werden. (Google, Browser) --------------------------------------------- http://www.golem.de/news/https-zertifikate-key-pinning-schuetzt-vor-boesart… *** Windows-Exploit: Russische Hacker greifen angeblich Nato und Regierungen an *** --------------------------------------------- Russische Hacker sollen in den vergangenen Jahren zahlreiche Ziele im Westen und in der Ukraine angegriffen haben. Sie nutzten dabei offenbar eine Sicherheitslücke aus, die in allen aktuellen Windows-Versionen bestehen und am Dienstag gepatcht werden soll. (Microsoft, Datenschutz) --------------------------------------------- http://www.golem.de/news/windows-exploit-russische-hacker-greifen-angeblich… *** Truly scary SSL 3.0 vuln to be revealed soon: sources *** --------------------------------------------- So worrying, no ones breathing a word until patch is out Gird your loins, sysadmins: The Register has learned that news of yet another major security vulnerability - this time in SSL 3.0 - is probably imminent. --------------------------------------------- http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_… *** Angeblich 7 Millionen Dropbox-Passwörter im Umlauf *** --------------------------------------------- Hacker wollen Millionen von Passwörtern für Dropbox-Accounts abgegriffen haben. Diese sollen gegen Bitcoins nun veröffentlicht werden. Dropbox streitet ab, dass die Daten echt sind. --------------------------------------------- http://www.heise.de/security/meldung/Angeblich-7-Millionen-Dropbox-Passwoer… *** VeraCrypt a Worthy TrueCrypt Alternative *** --------------------------------------------- If youre reluctant to continue using TrueCrypt now that the open source encryption project has been abandoned, and you dont want to wait for the CipherShed fork to mature, one alternative thats well worth investigating is VeraCrypt. --------------------------------------------- http://www.esecurityplanet.com/open-source-security/veracrypt-a-worthy-true… *** Apache mod_cache Null Pointer Dereference Lets Remote Users Deny Service *** --------------------------------------------- Apache mod_cache Null Pointer Dereference Lets Remote Users Deny Service --------------------------------------------- http://www.securitytracker.com/id/1031005 *** Analysis of the Linux backdoor used in freenode IRC network compromise *** --------------------------------------------- Background freenode is a large IRC network providing services to Free and Open Source Software communities, and in September the freenode staff team blogged about a potential compromise of an IRC server. NCC Group's Cyber Defence Operations team provided pro bono digital forensic and reverse engineering services to assist the freenode infrastructure team with their incident response activities. In this post we discuss a subset of the information we documented about one of the components --------------------------------------------- https://www.nccgroup.com/en/blog/2014/10/analysis-of-the-linux-backdoor-use… *** [webapps] - Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities *** --------------------------------------------- Bosch Security Systems DVR 630/650/670 Series - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/34956 *** YouTube Ads Lead To Exploit Kits, Hit US Victims *** --------------------------------------------- Malicious ads are a common method of sending users to sites that contain malicious code. Recently, however, these ads have showed up on a new attack platform: YouTube. Over the past few months, we have been monitoring a malicious campaign that used malicious ads to direct users to various malicious sites. Users in the United States have .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/youtube-ads-lead… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM SAN b-type Switches (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by IBM SAN b-type Switches. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s): IBM MTM: 2499-816 IBM System --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Endpoint Manager for Remote Control. CVE-2014-3511, CVE-2014-5139 *** --------------------------------------------- There are multiple vulnerabilities in OpenSSL that is used by IBM Endpoint Manager for Remote Control. These issues were disclosed on August 6, 2014 by the OpenSSL Project. CVE(s): CVE-2014-3511 and CVE-2014-5139 Affected product(s) and affected version(s): IBM Endpoint Manager for Remote Control version 9.1.0. Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21682034 X-Force --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect IBM Endpoint Manager for Remote Control *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 Service Refresh 7 and earlier, and IBM Runtime Environment Java Technology Edition, Version 7 Service Refresh 7 and earlier, that is used by IBM Endpoint Manager for Remote Control. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4209, CVE-2014-4220, --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.35 *** --------------------------------------------- Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 7.0.0.35, IBM WebSphere Application Server Hypervisor 7.0.0.35 and IBM HTTP Server 7.0.0.35. CVE(s): CVE-2014-3021, CVE-2014-3083, CVE-2014-0226, CVE-2014-0231, CVE-2014-0118, CVE-2013-5704, CVE-2014-4770 and CVE-2014-4816 Affected product(s) and affected version(s): Version 8.5 Full Profile and Liberty Profile Version 8 Version 7 Refer to the following reference URLs for remediation and --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Jailbreak Detection Methods *** --------------------------------------------- This post concludes our three-part series about mobile security. Todays post will outline some options for detecting jailbroken devices, should you choose to do so. Yesterday, we asked whether blocking an apps execution on jailbroken devices was worth it. Earlier this week, we described some vulnerabilities in iOS web browsers. Many iOS applications contain some sort of jailbreak detection mechanism. Some of the detection mechanisms can be bypassed by attackers (sometimes easily), whereas --------------------------------------------- http://blog.spiderlabs.com/2014/10/jailbreak-detection-methods.html *** Executing Apps on Jailbroken Devices *** --------------------------------------------- This post is part two of a three-part series about mobile security. Todays post will discuss the execution of apps on jailbroken devices. Yesterday, we described some vulnerabilities in iOS web browsers. Tomorrow, well explore detecting jailbroken devices. --------------------------------------------- http://blog.spiderlabs.com/2014/10/executing-apps-on-jailbroken-devices.html *** 5 steps to lock down your webmail account *** --------------------------------------------- For most people Gmail, Outlook.com or Yahoo! Mail is their main personal account. Here are some of the most important steps to keep unwanted people out of your web-based email account. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/14/5-steps-to-lock-down-your-webmai…

1 0

Tageszusammenfassung - Montag 13-10-2014
by Daily end-of-shift report 13 Oct '14

13 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-10-2014 18:00 − Montag 13-10-2014 18:00 Handler: Stefan Lenzhofer Co-Handler: Otmar Lendl *** Poor punctuation leads to Windows shell vulnerability *** --------------------------------------------- An attack on Windows scripts shows that quotation marks aren't just for writers. --------------------------------------------- http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-s… *** Researchers observe new type of SYN flood DDoS attack *** --------------------------------------------- Researchers with Radware are referring to the new type of distributed denial-of-service attack as a Tsunami SYN Flood Attack. --------------------------------------------- http://www.scmagazine.com/researchers-observe-new-type-of-syn-flood-ddos-at… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271,CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug"? or "Shellshock"? and two memory corruption vulnerabilities. Bash is used by IBM SDN VE. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s): IBM SDN VE, Unified Controller, VMware Edition: 1.2.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Malware overview: Threats to Mac OS X and other IT security hazards of September 2014 *** --------------------------------------------- October 2, 2014 In September, a number of new threats to Mac OS X were discovered by Doctor Webs security researchers. They included the complex backdoor Mac.BackDoor.iWorm as well as the Trojan Mac.BackDoor.Ventir.1 and the spyware program Mac.BackDoor.XSLCmd. Unexpectedly, gamers came under attack by Trojan.SteamBurglar which steals virtual game items from Steam users to later resell them to other players. As usual, plenty of virus definitions for malware programs geared towards Windows were --------------------------------------------- http://news.drweb.com/show/?i=5982&lng=en&c=9 *** Androids Cyanogenmod open to MitM attacks *** --------------------------------------------- Code re-use spells zero day for millions of modders More than 10 million users of the popular Cyanogen build of Android are exposed to man-in-the-middle (MitM) attacks thanks to reuse of vulnerable sample code. --------------------------------------------- http://www.theregister.co.uk/2014/10/13/androids_cyanogenmod_open_to_mitm_a… *** Adobe, Microsoft, Oracle: Oktober-Patchtag wird aufwendiger als sonst *** --------------------------------------------- Adobe, Microsoft und Oracle werden am kommenden Dienstagabend zahlreiche Patches veröffentlichen: Der Oktober-Patchtag bei allen drei Unternehmen überschneidet sich. Einerseits entlastet dies die Admins, andererseits müssen sie sich auf eine größere Patch-Menge einstellen. (Microsoft, Java) --------------------------------------------- http://www.golem.de/news/adobe-microsoft-oracle-oktober-patchtag-wird-aufwe… *** WordPress is the Most Attacked CMS: Report *** --------------------------------------------- Data security firm Imperva released its fifth annual Web Application Attack report (WAAR) this week, a study designed track the latest trends and cyber threats facing web applications. --------------------------------------------- http://www.securityweek.com/wordpress-most-attacked-cms-report *** SSA-860967 (Last Update 2014-10-13): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- SSA-860967 (Last Update 2014-10-13): GNU Bash Vulnerabilities in Siemens Industrial Products --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-234763 (Last Update 2014-10-13): OpenSSL Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- SSA-234763 (Last Update 2014-10-13): OpenSSL Vulnerabilities in Siemens Industrial Products --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-839231 (Last Update 2014-10-13): Incorrect Certificate Verification in Ruggedcom ROX-based Devices *** --------------------------------------------- SSA-839231 (Last Update 2014-10-13): Incorrect Certificate Verification in Ruggedcom ROX-based Devices --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PHP 5.6.1 schlie�t potentiell gef�hrlichen Puffer�berlauf *** --------------------------------------------- Die aktuelle PHP-Version behebt eine Reihe von Bugs, darunter auch eine von Stefan Esser entdeckte Sicherheitslücke. Diese ist einfach auszunutzen und kann missbraucht werden, um aus der Ferne Schadcode auszuführen. --------------------------------------------- http://www.heise.de/security/meldung/PHP-5-6-1-schliesst-potentiell-gefaehr… *** Mobile threats in September 2014 *** --------------------------------------------- October 2, 2014 As in previous months, in September Doctor Webs security researchers registered multiple attacks on handhelds. In particular, the Dr.Web virus database was expanded to include numerous definitions of threats to Android involving banking Trojans, ransomware, spies, and even a dangerous vandal Trojan, among others. Also added to the database was an entry for another malicious application that operates on jailbroken devices. The number of new malicious programs for Android and --------------------------------------------- http://news.drweb.com/show/?i=5983&lng=en&c=9 *** FinFisher Malware Analysis - Part 3 (Last) *** --------------------------------------------- I've already covered most parts of FinFisher malware in last two articles. This time, in this article, which is last article related to FinFisher, I'll cover last important tricks, methods and techniques used by FinFisher. So I'll make categorize them by subject:... --------------------------------------------- https://www.codeandsec.com/FinFisher-Malware-Analysis-Part-3 *** Who�s Watching Your WebEx? *** --------------------------------------------- KrebsOnSecurity spent a good part of the past week working with Cisco to alert more than four dozen companies -- many of them household names -- about regular corporate WebEx conference meetings that lack passwords and are thus open to anyone who wants to listen in. --------------------------------------------- http://krebsonsecurity.com/2014/10/whos-watching-your-webex *** Kmart becomes the latest retail data breach victim *** --------------------------------------------- Kmart has been confirmed as the latest retail chain to be breached after its parent company admitted that some customers� debit and credit card numbers had been compromised. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/13/kmart-becomes-the-latest-retail-…

1 0

Tageszusammenfassung - Freitag 10-10-2014
by Daily end-of-shift report 10 Oct '14

10 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-10-2014 18:00 − Freitag 10-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cisco addresses numerous vulnerabilities in ASA software *** --------------------------------------------- Many of the vulnerabilities can lead to a denial-of-service condition, but others could result in a full compromise of the affected system. --------------------------------------------- http://www.scmagazine.com/vulnerabilities-in-cisco-asa-software/article/376… *** CSAM: My servers started speaking IRC, and that is when I started to listen!, (Thu, Oct 9th) *** --------------------------------------------- Hassan submitted this story: While reviewing our IDS logs, we noticed an alert for IRC botnet traffic coming from multiple servers in a specific VLAN. Ouch! One thing I keep saying in our IDS Class: If your servers all for sudden start joining IRC channels, then they are either very bored, or very compromised. But lets see how it went for Hassan. Hassan had what every analyst wants: pcaps! So he looked at the full packet capture of the traffic: The traffic wasnt 100% IRC. But it looked... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18799&rss *** Critical Patch Update - October 2014 Pre-Release Announcement *** --------------------------------------------- Critical Patch Update - October 2014 Pre-Release Announcement --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html *** MS14-OCT - Microsoft Security Bulletin Advance Notification for October 2014 - Version: 1.0 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on October 14, 2014. This bulletin advance notification will be replaced with the October bulletin summary on October 14, 2014. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-OCT *** Signed Malware = Expensive "Oops" for HP *** --------------------------------------------- Computer and software industry maker HP is in the process of notifying customers about a seemingly harmless security incident in 2010 that nevertheless could prove expensive for the company to fix and present unique support problems for users of its older products. --------------------------------------------- http://krebsonsecurity.com/2014/10/signed-malware-is-expensive-oops-for-hp/ *** Malware analysts tell crooks to shape up and write decent code *** --------------------------------------------- Who writes their own crypto these days? Seriously! Blackhats beware: reverse engineers are laughing at your buggy advanced persistent threat (APT) malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/10/writing_bet… *** Zwei-Faktor-Authentifizierung: Apple erhöht die Sicherheit für iCloud *** --------------------------------------------- Apple weitet die Zwei-Faktor-Authentifizierung aus. Ab sofort sind anwendungsspezifische Passwörter für den Zugriff auf iCloud-Daten Pflicht. --------------------------------------------- http://www.golem.de/news/zwei-faktor-authentifizierung-apple-erhoeht-die-si… *** Crims zapped mobes, slabs we collared for evidence, wail cops *** --------------------------------------------- Dont worry, sarge, we got all the ... oh, WTF! You know that nifty remote wipe function that takes all the photos off your phone when it gets lost? Turns out criminals know about it too, and theyre using it to wipe phones taken by police as evidence. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/10/police_say_… *** WordPress Websites Continue to Get Hacked via MailPoet Plugin Vulnerability *** --------------------------------------------- The popular Mailpoet(wysija-newsletters) WordPress plugin had a serious file upload vulnerability a few months back, allowing an attacker to upload files to the vulnerable site. This issue was disclosed months ago, the MailPoet team patched it promptly. It seems though that many are still not getting the word, or blatantly not updating, because we areRead More --------------------------------------------- http://blog.sucuri.net/2014/10/wordpress-websites-continue-to-get-hacked-vi… *** May-August 2014 *** --------------------------------------------- The NCCIC/ICS-CERT Monitor for May-August 2014 is a summary of ICS-CERT activities for that period of time. --------------------------------------------- https://ics-cert.us-cert.gov//monitors/ICS-MM201408 *** TWiki Sandbox.pm File Validation Flaw Lets Remote Authenticated Users Upload Arbitrary Windows Apache Configuration Files *** --------------------------------------------- http://www.securitytracker.com/id/1030982 *** TWiki debugenableplugins Parameter Lets Remote Users View and Modify Files *** --------------------------------------------- http://www.securitytracker.com/id/1030981 *** VMSA-2014-0006.11 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** PayPal Inc BB #85 MB iOS 4.6 - Auth Bypass Vulnerability *** --------------------------------------------- The Vulnerability Laboratory Research Team discovered a security auth protection mechanism bypass vulnerability in the PayPal Inc iOS Mobile Application. --------------------------------------------- http://www.vulnerability-lab.com/get_content.php?id=895 *** Cisco Security Notices for Autonomic Networking Infrastructure *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** HPSBHF03136 rev.1 - HP TippingPoint NGFW running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP TippingPoint NGFW running OpenSSL. This is the OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU02895 SSRT101253 rev.4 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBNS03130 rev.1 - HP NonStop Development Environment for Eclipse (NSDEE) running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Development Environment for Eclipse (NSDEE) running Bash Shell . This is the Bash Shell vulnerability known as "ShellShock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBST03122 rev.1 - HP StoreAll Operating System Software running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP StoreAll Operating System Software running Bash Shell. This is the Bash Shell vulnerability known as "Shellshock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Seven (7) Vulnerabilities in OpenSSL affect IBM FlashSystem 840 and V840 (CVEs) *** --------------------------------------------- OpenSSL vulnerabilities affect the IBM FlashSystem 840 and V840 products. These vulnerabilities could allow a remote attacker to execute arbitrary code on the system, to obtain sensitive information, or cause of denial of service. CVE(s): CVE-2014-3509, CVE-2014-3506, CVE-2014-3507, CVE-2014-3511, CVE-2014-3505, CVE-2014-3510 and CVE-2014-3508 Affected product(s) and affected version(s): IBM FlashSystem 840: Machine Type 9840, model -AE1 (all supported releases before 1.1.2.7) Machine Type... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Six (6) Vulnerabilities in Network Security Services (NSS) & Netscape Portable Runtime (NSPR) affect IBM FlashSystem 840 and V840 (CVE-2013-1740, CVE-2014-1490, CVE-2014-1491, CVE-2014-1492, CVE-2014-1544, CVE-2014-1545) *** --------------------------------------------- NSS & NSPR vulnerabilities affect the IBM FlashSystem 840 and V840 products. These vulnerabilities could allow a remote attacker to execute arbitrary code, on the system, to obtain sensitive information, or cause Denial of Service. CVE(s): CVE-2013-1740, CVE-2014-1490, CVE-2014-1491, CVE-2014-1492, CVE-2014-1544 and CVE-2014-1545 Affected product(s) and affected version(s): IBM FlashSystem 840: Machine Type 9840, model -AE1 (all supported releases before 1.1.2.7) Machine Type 9843,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: IBM WebSphere MQ Telemetry Component - Potential authentication bypass vulnerability when using the JAASConfig property (CVE-2014-6116) *** --------------------------------------------- IBM WebSphere MQ contains a vulnerability in which authentication is bypassed by MQTT clients with the "JAASConfig" configuration property set. CVE(s): CVE-2014-6116 Affected product(s) and affected version(s): IBM WebSphere MQ Telemetry Component WebSphere MQ 8.0.0.1 downloaded prior to 24th September 2014 (Level: p000-001-L140910). To check your fix pack level, issue the command dspmqver and check the output of the Level option. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Proventia Network Security Controller is affected by multiple OpenSSL vulnerabilities *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported by the OpenSSL Project (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0160, CVE-2014-0076, CVE-2014-3508, CVE-2014-5139, CVE-2014-3509, CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512) CVE(s): CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470, CVE-2014-0160, CVE-2014-0076, CVE-2014-3508,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Remote Code Execution Vulnerability Security Bulletin: TRIRIGA Application Platform (CVE-2014-4840) *** --------------------------------------------- IBM TRIRIGA Application Platform could allow an attacker to execute code on the vulnerable server. An attacker could send a specially crafted URL to the server that would execute commands as the privileges of the unprivileged user running the server. CVE(s): CVE-2014-4840 Affected product(s) and affected version(s): The following Application Platform versions are affected. IBM TRIRIGA Application Platform 3.4.0 IBM TRIRIGA Application Platform 3.3.2 and 3.3.2.1 fix pack... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins for Products affected by Vulnerabilities in Bash *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 9-10-2014
by Daily end-of-shift report 09 Oct '14

09 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-10-2014 18:00 − Donnerstag 09-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Pricing Policies in the Cyber Criminal Underground *** --------------------------------------------- Underground markets are places on the Internet where criminal gangs offer a wide range of illegal products and services. Black markets are crowded places where single individuals or criminal organizations could acquire or rent products and services at very competitive prices. Like any other market, in black markets the relationship between supply and demand determines the price of the products. A growing number of highly specialized sellers are offering their wares, and the huge offer is... --------------------------------------------- http://resources.infosecinstitute.com/pricing-policies-cyber-criminal-under… *** Working Paper: Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005-2014 *** --------------------------------------------- Some 229 data breach incidents involved the personal records of people in Europe. Globally, all these incidents resulted in the loss of some 645 million records, though not all of these breaches exclusively involved people in Europe. Within Europe, we confirmed 200 cases involving people in Europe, and 227 million records lost in Europe... --------------------------------------------- http://www.databreaches.net/working-paper-data-breaches-in-europe-reported-… *** Bash Bug Saga Continues: Shellshock Exploit Via DHCP *** --------------------------------------------- The Bash vulnerability known as Shellshock can be exploited via several attack surfaces including web applications, DHCP, SIP, and SMTP. With multiple proofs of concept (including Metasploit code) available in the public domain, this vulnerability is being heavily exploited. Most discussion of Shellshock attacks have focused on attacks on web apps. There has been relatively... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/1tDC5sTfbUQ/ *** Android: Rund die Hälfte aller Geräte von Sicherheitslücke betroffen *** --------------------------------------------- 45 Prozent aller Android-Smartphones sind noch immer von einer vor wenigen Wochen entdeckten Sicherheitslücke im Smartphone-Browser betroffen. In Deutschland liegt die Zahl sogar deutlich höher. --------------------------------------------- http://www.golem.de/news/android-rund-die-haelfte-aller-geraete-von-sicherh… *** Flying Blind *** --------------------------------------------- With all the news about data breaches lately, it's not particularly surprising to wake up to headlines describing yet another one. What is perhaps a bit surprising, however, is the common theme that seems to exist in many of the... --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/10/flying-blind.html *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- cisco-sa-20141008-asa --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Juniper Junos Security Bulletins *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10655&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10654&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10653&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10652&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10651&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10650&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10649&actp=RSS *** Schneider Electric SCADA Expert ClearSCADA Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-259-01 Schneider Electric SCADA Expert ClearSCADA Vulnerabilities that was published September 16, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in Schneider Electric's StruxureWare SCADA Expert ClearSCADA. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-259-01A *** Siemens SIMATIC WinCC Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-205-02 Siemens SIMATIC WinCC Vulnerabilities that was published July 24, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens SIMATIC WinCC application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-205-02A *** Security_Advisory-9 OpenSSL Vulnerabilities on Huawei products *** --------------------------------------------- Oct 08, 2014 20:28 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** VMSA-2014-0010.10 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** SA-CONTRIB-2014-097 - nodeaccess - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-097Project: Nodeaccess (third-party module)Version: 6.x, 7.xDate: 2014-October-08Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:UncommonVulnerability: Access bypassDescriptionNodeaccess is a Drupal access control module which provides view, edit and delete access to nodes.This module enables you to inadvertently allow an author of a node view/edit/delete the node in question (who may not have access). The module --------------------------------------------- https://www.drupal.org/node/2352757 *** SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-096Project: OAuth2 Client (third-party module)Version: 7.xDate: 2014-October-08Security risk: 10/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionOAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication.Within its API code the Client class exposes variables in an error message, which originate from a third party source without --------------------------------------------- https://www.drupal.org/node/2352747 *** DSA-3048 apt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3048 *** OpenSSH <=6.6 SFTP misconfiguration exploit for 64bit Linux *** --------------------------------------------- OpenSSH lets you grant SFTP access to users without allowing full command execution using "ForceCommand internal-sftp". However, if you misconfigure the server and dont use ChrootDirectory, the user will be able to access all parts of the filesystem that he has access to - including procfs. On modern Linux kernels (>=2.6.39, I think), /proc/self/maps reveals the memory layout and /proc/self/mem lets you write to arbitrary memory positions. Combine those and you get easy RCE. --------------------------------------------- http://seclists.org/fulldisclosure/2014/Oct/35 *** Onapsis Security Advisories for SAP Products *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100052 http://cxsecurity.com/issue/WLB-2014100051 http://cxsecurity.com/issue/WLB-2014100050 http://cxsecurity.com/issue/WLB-2014100049 http://cxsecurity.com/issue/WLB-2014100048 http://cxsecurity.com/issue/WLB-2014100047 http://cxsecurity.com/issue/WLB-2014100046 *** Security Advisory-Memory Overflow Vulnerabilities on Huawei E5332 Webserver *** --------------------------------------------- Oct 09, 2014 11:51 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** HPSBMU03127 rev.1 - HP Operations Manager for UNIX, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP Operations Manager for UNIX. The vulnerability can be exploited remotely to execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU03110 rev.1 - HP Sprinter, Remote Execution of Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Sprinter. The vulnerabilities could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Spider Facebook 1.0.8 - SQL Injection *** --------------------------------------------- 2014-10-08T19:00:47 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7639 *** Contact Form DB 2.8.13 - 2 x Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-10-09T11:38:57 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7641 *** EWWW Image Optimizer 2.0.1 Cross-Site Scripting (XSS) *** --------------------------------------------- 2014-10-09T11:35:36 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7640

1 0

Tageszusammenfassung - Mittwoch 8-10-2014
by Daily end-of-shift report 08 Oct '14

08 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-10-2014 18:00 − Mittwoch 08-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ISACA announces entry-level cybersecurity certificate *** --------------------------------------------- A new cybersecurity certificate has been launched by global IT association ISACA thats intended for those looking to break into the field. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/C8kTkbciKh0/ *** Belkin Router Apocalypse: heartbeat.belkin.com outage taking routers down *** --------------------------------------------- According ot various reports, many users of Belkin routers had problems connecting to the internet as of last night. It appears that the router will occasionally ping">heartbeat.belkin.com to detect network connectivity. The heartbeat host is however not reachable for some hosts. Currently, the host responds to ICMP">As a workaround, you can add an entry to the routers host file pointing heartbeat.belkin.com to 127.0.0.1. This appears to remove the block. Also, the block only... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18779&rss *** Caution: Gaming fraud! *** --------------------------------------------- October 6, 2014 At the end of September, Doctor Web issued a report about the new Trojan program Trojan.SteamBurglar.1, which steals game items from Steam users, particularly Dota 2 fans. So far Doctor Webs security researchers have learnt about several dozen modifications of this malware. However, cybercriminals seeking to take advantage of massively multiplayer online role-playing game (MMORPG) players have other tools at their disposal to make illicit profit. In this post we will talk about... --------------------------------------------- http://news.drweb.com/show/?i=5987&lng=en&c=9 *** Arbor: DDoS Attacks Getting Bigger as Reflection Increases *** --------------------------------------------- New reflected distributed denial of service attack techniques are increasing the volume of each attack as well as the overall frequency of large-scale DDoS attacks. --------------------------------------------- http://threatpost.com/arbor-ddos-attacks-getting-bigger-as-reflection-incre… *** The facts about BadUSB *** --------------------------------------------- Introduction Since the BadUSB talk[1] by Karsten Nohl and Jakob Lell at Black Hat USA in August there has been much discussion about the implications of this class of USB attack. The discussions gained additional momentum when Adam Caudill and Brandon Wilson investigated the attack further and publicly released working code[2] at the DerbyCon security conference. This blog post is intended to dispel some of the misunderstandings that have arisen around BadUSB and provide some practical advice... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/10/the-facts-about-badusb/ *** Paper: The Hulk *** --------------------------------------------- Raul Alvarez studies cavity file infector.Most file infectors increase the length of the infected file, as the malicious code is added as a new section of the host file, or to the last section of that file. Cavity file infectors are different though: they infect files without increasing their size.Today, we publish a paper by Raul Alvarez, a researcher for Fortinet, in which he studies Win32/Huhk, a virus that implements cavity file infection.In the paper, Raul explains what happens when an... --------------------------------------------- http://www.virusbtn.com/blog/2014/10_08a.xml?rss *** "Tickende Zeitbombe": Windows XP noch immer verbreitet *** --------------------------------------------- Fast sieben Prozent aller deutschen Rechner mit Internetanschluss laufen noch unter Windows XP, ein halbes Jahr nach dem offiziellen Support-Ende. Dabei sind die Geräte nicht nur selbst gefährdet, sondern auch eine Gefahr für andere. --------------------------------------------- http://www.heise.de/newsticker/meldung/Tickende-Zeitbombe-Windows-XP-noch-i… *** remote syslog PRI vulnerability CVE-2014-3683 *** --------------------------------------------- While preparing a fix for CVE-2014-3634 for sysklogd, mancha discovered and privately reported that the initial rsyslog fix set was incomplete. It did not cover cases where PRI values > MAX_INT caused integer overflows resulting in negative values. --------------------------------------------- http://www.rsyslog.com/remote-syslog-pri-vulnerability-cve-2014-3683/ *** [R1] Tenable Nessus Web UI Scanned Content Stored XSS *** --------------------------------------------- The Nessus scanners web-based user interface (Web UI) was vulnerable to a stored cross-site scripting (XSS) attack. The issue was due to a security control being briefly removed due to a regression error. During this 48 hour window, one new build of the Web UI was released leading to the ability to inject arbitrary script code. This could be done by setting up a malicious web server that returned a crafted host header containing JavaScript. When Nessus scanned the web server, the input would be... --------------------------------------------- http://www.tenable.com/security/tns-2014-08 *** Alert for CVE-2014-7169 Bash "Shellshock" *** --------------------------------------------- Alert for CVE-2014-7169 Bash "Shellshock" --------------------------------------------- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-23032… *** Cisco Intrusion Prevention System MainApp Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-3402 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VMSA-2014-0010.9 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** Cuckoo Sandbox 1.1.1 *** --------------------------------------------- This is an immediate release of Cuckoo Sandbox 1.1.1, an hotfix for a security vulnerability discovered by Robert Michel from G-Data. The vulnerability is an arbitrary file upload from the guest virtual machines to the host system, which could potentially translate in command or code execution. It affects all versions of Cuckoo Sandbox from 0.6. --------------------------------------------- http://cuckoosandbox.org/2014-10-07-cuckoo-sandbox-111.html *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Wordfence <= 5.2.4 Multiple Vulnerabilities (XSS & Bypasses) *** --------------------------------------------- 2014-10-07T16:27:12 --------------------------------------------- https://wpvulndb.com/vulnerabilities/7636

1 0

Tageszusammenfassung - Dienstag 7-10-2014
by Daily end-of-shift report 07 Oct '14

07 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-10-2014 18:00 − Dienstag 07-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Confusion over SSL and 1024 bit keys, (Tue, Oct 7th) *** --------------------------------------------- Yesterday and today, a post on reddit.org caused quite a bit of uncertainty about the security of 1024 bit RSA keys if used with OpenSSL. The past referred to a presentation given at a cryptography conference, stating that 1024 Bit SSL keys can be factored with moderate resources ("20 minutes on a Laptop"). It was suggested that this is at least in part due to a bug in OpenSSL, which according to the post doesnt pick the random keys from the entire space available. It looks more and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18775&rss *** Yahoo says attackers looking for Shellshock found a different bug *** --------------------------------------------- Yahoo said Monday it has fixed a bug that was mistaken for the Shellshock flaw, but no user data was affected.Three of the companys servers with APIs (application programming interfaces) that provide live streaming for its Sports service "had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers," wrote Alex Stamos, Yahoos chief information security officer.Stamos wrote on the Hacker News website that the servers had been patched after the... --------------------------------------------- http://www.csoonline.com/article/2692375/security/yahoo-says-attackers-look… *** Tyupkin Malware Infects ATMs Worldwide *** --------------------------------------------- The Tyupkin malware, spotted on ATMs in Eastern Europe, allows criminals to make withdrawals of 40 banknotes at a time, researchers at Kaspersky Lab said. --------------------------------------------- http://threatpost.com/tyupkin-malware-infects-atms-in-eastern-europe/108734 *** Phishing with help from Compromised WordPress Sites *** --------------------------------------------- We get thousands of spam and phishing emails daily. We use good spam filters (along with Gmail) and that greatly reduces the noise in our inbox. Today though, one slipped through the crack and showed up in my personal inbox: As I went to mark the email as Spam, I decided to hover over the... --------------------------------------------- http://blog.sucuri.net/2014/10/phishing-with-help-from-compromised-wordpres… *** Huge Security Hole in ZPanel 10.1 *** --------------------------------------------- When it comes to managing a VPS, many of our customers would prefer to install some kind of control panel rather than do it all themselves from the command line. ZPanel is perhaps the most popular choice for this. We even offered ZPanel 10.1 as a pre-made image -- it was a very recent version (10.1.1 is the most recent at the time of writing), and there are no published security announcements relating to it. We thought it was safe. --------------------------------------------- https://chunkhost.com/blog/16/huge_security_hole_in_zpanel_10_1 *** MMD-0029-2015 - Warning of Mayhem shellshock attack *** --------------------------------------------- We afraid this wave will come during the "shellshock", and it did. The attack wave of "ELF .so malware library", and installer of a known botnet called as "Mayhem" just hit all of us. The attack came from various IP, their botnets into many NIX services, utilizing the shellshock web vulnerability scan method to download the remote installer written in Perl (replacing the previous PHP base infection). It obviously a different vector for Mayhem infection, we start --------------------------------------------- http://blog.malwaremustdie.org/2014/10/mmd-0029-2015-warning-of-mayhem.html *** Vulnerabilities in WordPress Themes an Plugins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7632 https://wpvulndb.com/vulnerabilities/7633 https://wpvulndb.com/vulnerabilities/7635 https://wpvulndb.com/vulnerabilities/7634 *** Distance Vector Multicast Routing Protocol Misuse *** --------------------------------------------- cisco-sr-20141006-dvmrp --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… *** CA Technologies GNU Bash Shellshock *** --------------------------------------------- Topic: CA Technologies GNU Bash Shellshock Risk: Low Text:CA20141001-01: Security Notice for Bash Shellshock Vulnerability Issued: October 01, 2014 Updated: October 03, 2014 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014100036 *** SSA-214365 (Last Update 2014-10-07): Vulnerabilities in SIMATIC WinCC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Bugzilla 4.0.14, 4.2.10, 4.4.5, and 4.5.5 Security Advisory *** --------------------------------------------- The following security issues have been discovered in Bugzilla: * The realname parameter is not correctly filtered on user account creation, which could lead to user data override. * Several places were found in the Bugzilla code where cross-site scripting attacks could be used to access sensitive information. * Private comments can be shown to flagmail recipients who arent in the insider group * Specially formatted values in a CSV search results export could be used in spreadsheet software... --------------------------------------------- http://www.bugzilla.org/security/4.0.14/ *** Bugtraq: OWTF 1.0 "Lionheart" released! *** --------------------------------------------- http://www.securityfocus.com/archive/1/533629 *** IBM Security Bulletin: Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187) *** --------------------------------------------- Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187). Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. IBM recommends that you review your entire environment to identify... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities had been identified in Oracle Database related to the RDBMS Core component. (CVE-2014-4236 and CVE-2014-4245) *** --------------------------------------------- Multiple vulnerabilities had been identified in Oracle Database that is consumed by Tivoli Netcool Perfomance Manager for Wireless. (CVE-2014-4236 and CVE-2014-4245 ) CVE(s): CVE-2014-4236 and CVE-2014-4245 Affected product(s) and affected version(s): Tivoli Netcool Performance Manager (TNPM) for Wireless version 1.4 and 1.3.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Vuln: phpMyAdmin CVE-2014-7217 Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/70252 *** VU#280844: Cryoserver Security Appliance vulnerable to privilege escalation *** --------------------------------------------- Vulnerability Note VU#280844 Cryoserver Security Appliance vulnerable to privilege escalation Original Release date: 07 Oct 2014 | Last revised: 07 Oct 2014 Overview Cryoserver Security Appliance 7.3.x vulnerable to privilege escalation Description CWE-264: Permissions, Privileges, and Access Controls Cryoserver Security Appliance 7.3.x does not properly assign permission to the /etc/init.d/cryoserver shell script and allows the default support account to modify it using the /bin/cryo-mgmt --------------------------------------------- http://www.kb.cert.org/vuls/id/280844 *** VU#121036: BMC Track-It! contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#121036 BMC Track-It! contains multiple vulnerabilities Original Release date: 07 Oct 2014 | Last revised: 07 Oct 2014 Overview BMC Track-It! version 11.3.0.355 contains multiple vulnerabilities Description CWE-306: Missing Authentication for Critical Function - CVE-2014-4872BMC Track-It! exposes several dangerous remote .NET services on port 9010 without authentication. .NET remoting allows a user to invoke methods remotely and retrieve their result. The exposed service --------------------------------------------- http://www.kb.cert.org/vuls/id/121036

1 0

Tageszusammenfassung - Montag 6-10-2014
by Daily end-of-shift report 06 Oct '14

06 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-10-2014 18:00 − Montag 06-10-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious, (Fri, Oct 3rd) *** --------------------------------------------- We all know that anti virus, the necessary evil of basic computer security, isnt a stranger to false positives. So no big surprise here when John is writing that he ran into such a false positive during an incident response: I was scanning a forensic drive image with clamav and scored a positive hit on a file. Great. ClamAV, a free anti-virus product. Of course, we dont trust it. So John did what most of use would have done, and submitted the suspect binary to Virustotal: Virustotal showed... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18759&rss *** Detecting irregular programs and services installed in your network, (Sun, Oct 5th) *** --------------------------------------------- When the corporate network becomes target, auditing for security policy compliance can be challenging if you dont have a software controlling irregular usage of administrator privilege granted and being used to install unauthorized software or to change configuration by installing services that could cause an interruption in network service. Examples of this possible issues are additional DHCP Servers (IPv4 and IPv6), Dropbox, Spotify or ARP scanning devices. We can use nmap to detect all... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18763&rss *** Testing for opened ports with firewalk technique, (Sat, Oct 4th) *** --------------------------------------------- There is an interesting way of knowing what kind of filters are placed in the gateway of a specific host. It is called firewalk and it is based on IP TTL expiration. The algorithm goes as follows: The entire route is determined using any of the traceroute techniques available A packet is sent with the TTL equal to the distance to the target If the packet times out, it is resent with the TTL equal to the distance to the target minus one. If an ICMP type 11 code 0 (Time-to-Live exceeded) is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18761&rss *** Shellshock-like Weakness May Affect Windows *** --------------------------------------------- A weakness in Windows, similar to Shellshock, may put Windows Server deployments at risk to remote code execution. --------------------------------------------- http://threatpost.com/shellshock-like-weakness-may-affect-windows/108696 *** Bugzilla Zero-Day Exposes Zero-Day Bugs *** --------------------------------------------- A previously unknown security flaw in Bugzilla -- a popular online bug-tracking tool used by Mozilla and many of the open source Linux distributions -- allows anyone to view detailed reports about unfixed vulnerabilities in a broad swath of software. Bugzilla is expected today to issue a fix for this very serious weakness, which potentially exposes a veritable gold mine of vulnerabilities that would be highly prized by cyber criminals and nation-state actors. --------------------------------------------- http://krebsonsecurity.com/2014/10/bugzilla-zero-day-exposes-zero-day-bugs/ *** Apple anti-malware update blocks new iWorm Mac botnet *** --------------------------------------------- Apple has updated its malware blacklisting system, known as XProtect, to block a Mac attack thought to have infected over 18,500 Macs. --------------------------------------------- http://www.zdnet.com/apple-anti-malware-update-blocks-new-iworm-mac-botnet-… *** Using the Windows 10 Technical Preview? Microsoft might be watching your every move to help with feedback *** --------------------------------------------- One of the main goals with the Windows 10 Technical Preview is for Microsoft to collect feedback to help shape the final version of the operating system, which is said to be coming sometime in summer 2015. The Technical Preview requires users to register with the Windows Insider Program, which allows users to submit their own feedback about the operating system... but is Microsoft collecting more than what you think youre submitting? --------------------------------------------- http://www.winbeta.org/news/using-windows-10-technical-preview-microsoft-mi… *** SEO poisoning attacks still impacting legitimate websites *** --------------------------------------------- After recently helping a client rid their website of SEO spam, security company Sucuri detailed how SEO poisoning attacks are still impacting legitimate websites. --------------------------------------------- http://www.scmagazine.com/attackers-use-seo-spam-to-improve-the-rankings-of… *** Uni boffins: Accurate Android AV app outperforms most rivals *** --------------------------------------------- ...Dont sweat, VXers, its STILL no use against obfuscated kit German researchers have built an Android app capable of detecting 94 percent of malware quick enough to run on mobile devices they say bests current offerings in effectiveness and description. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/10/06/uni_bods_sa… *** Bugtraq: BulletProof Security Wordpress v50.8 - POST Inject Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/533611 *** Bugtraq: CVE-2014-7277 Stored Server XSS in ZyXEL SBG-3300 Security Gateway *** --------------------------------------------- http://www.securityfocus.com/archive/1/533609 *** Bugtraq: CVE-2014-7278 DoS in ZyXEL SBG-3300 Security Gateway *** --------------------------------------------- http://www.securityfocus.com/archive/1/533610 *** Cisco IOS XR Software Compression ACL Bypass Vulnerability *** --------------------------------------------- CVE-2014-3396 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Password Disclosure Vulnerability *** --------------------------------------------- CVE-2014-3400 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco ASA Software Version Information Disclosure *** --------------------------------------------- CVE-2014-3398 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco ASA Software SharePoint RAMFS Integrity and Lua Injection Vulnerability *** --------------------------------------------- CVE-2014-3399 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletins: Vulnerabilities in Bash affect various Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Identity Assurance Solution Client (IASC) 3.1 Hotfix 2 *** --------------------------------------------- Abstract: This is an update to the shipping release of the Identity Assurance Solution Client (IASC) 3.1 also known as the Novell Enhanced Smart Card Method (NESCM). The IASC client 3.1 is a standalone method that provides smart card-based authentication for eDirectory. This Hotfix has been provided to address the following security vulnerabilities found in OpenSSL & CLDAP SDK: CVE-2014-0224 & CVE-2014-3508 (Bug 893314 / 892895) Files: NTLS.DLL, LDAPSSL.DLL Filename:... --------------------------------------------- https://download.novell.com/Download?buildid=s6M5LsksoOA~ *** Linux Kernel Seed Initialization Flaw Reduces Randomness in Certain Values and May Make TCP Sequence Numbers More Predictable *** --------------------------------------------- http://www.securitytracker.com/id/1030959 *** VMSA-2014-0010.7 *** --------------------------------------------- VMware product updates address critical Bash security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0010.html *** DSA-3046 mediawiki *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3046 *** Bugtraq: [SECURITY] [DSA 3044-1] qemu-kvm security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/533619 *** Bugtraq: [SECURITY] [DSA 3045-1] qemu security update *** --------------------------------------------- [SECURITY] [DSA 3045-1] qemu security update --------------------------------------------- http://www.securityfocus.com/archive/1/533621 *** SSA-860967 (Last Update 2014-10-06): GNU Bash Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** [remote] - OpenVPN 2.2.29 - ShellShock Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34879

1 0

Tageszusammenfassung - Freitag 3-10-2014
by Daily end-of-shift report 03 Oct '14

03 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-10-2014 18:00 − Freitag 03-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Why is your Mac all for sudden using Bing as a search engine?, (Thu, Oct 2nd) *** --------------------------------------------- Even as a Mac user, you may have heard about Bing, at least you may have seen it demonstrated in commercials [1]. But if your default search engine on your Mac is all for sudden switched to Bing, this may be due to another piece of legacy software that some Mac users may have a hard time living .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18753 *** ZDI-14-349: (0Day) Microsoft Internet Explorer ScriptEngine Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-349/ *** ZDI-14-346: (0Day) Apple OS X IOHIDSecurePromptClient Denial Of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-346/ *** Security incidents are up - and pricier! - but infosec budgets are dwindling *** --------------------------------------------- The number of security incidents is popping, as are associated costs to mop them up, according to a report from PcW. Global corporate security budgets, meanwhile, seem to be hiding in the closet, just hoping it all goes away. --------------------------------------------- http://nakedsecurity.sophos.com/2014/10/03/security-incidents-are-up-and-pr… *** OPSec for security researchers *** --------------------------------------------- Perfect OPSec is almost impossible. However implementing basic OPSec practices should become second nature for every researcher. You will be more careful and hopefully, avoid rookie mistakes like talking too much and bragging about your research. --------------------------------------------- https://securelist.com/blog/research/66911/opsec-for-security-researchers/ *** BadUSB: Der USB-Stick als digitale Waffe *** --------------------------------------------- Speicher gibt sich als anderes Gerät aus - Forscher veröffentlichen Anleitung und Werkzeuge im Internet --------------------------------------------- http://derstandard.at/2000006383347 *** US-Bericht: Über 80 Millionen Konten bei JPMorgan von Hacker-Angriff betroffen *** --------------------------------------------- Bei dem im August aufgedeckten Großangriff auf US-Amerikanische Banken, konten Hacker offenbar detaillierte Informationen von Kunden erbeuten. --------------------------------------------- http://www.heise.de/security/meldung/US-Bericht-Ueber-80-Millionen-Konten-b… *** Bugtraq: Elasticsearch vulnerability CVE-2014-6439 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533602 *** HPSBMU02895 SSRT101253 rev.3 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Command-injection vulnerability for COMMAND-Shell Scripts *** --------------------------------------------- What if we told you that a normal user in your network could take over the control of your Windows file-servers by just creating a special (but no so complex) directory-name in one of the directories he has access to? --------------------------------------------- http://www.thesecurityfactory.be/command-injection-windows.html

1 0

Tageszusammenfassung - Donnerstag 2-10-2014
by Daily end-of-shift report 02 Oct '14

02 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-10-2014 18:00 − Donnerstag 02-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Shellshock Aftershock for NAS Administrators *** --------------------------------------------- Summary FireEye has been monitoring Shellshock-related attacks closely since the vulnerability was first made public last week. Specifically, FireEye has observed attackers attempting to exploit the BASH remote code injection vulnerability against Network Attached Storage systems (NAS). These attacks .. --------------------------------------------- http://www.fireeye.com/blog/technical/2014/10/the-shellshock-aftershock-for… *** ZDI-14-335: Hewlett-Packard Network Node Manager ovopi.dll Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Network Node Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-335/ *** Vulnerabilities in Citrix Access Gateway Plug-in for Windows could result in arbitrary code execution *** --------------------------------------------- Vulnerabilities have been identified in an ActiveX based component of the Citrix Access Gateway Plug-in for Windows. The vulnerabilities, .. --------------------------------------------- http://support.citrix.com/article/CTX129902 *** The Mac.BackDoor.iWorm threat in detail *** --------------------------------------------- Doctor Webs security researchers have dissected the complex malicious program Mac.BackDoor.iWorm, a threat affecting computers running Mac OS X. As of September 29, 2014, 18,519 unique IP addresses were used by infected computers to connect the botnet created by hackers using this backdoor. The backdoor is unpacked into the directory /Library/Application Support/JavaW. Furthermore, using .. --------------------------------------------- http://news.drweb.com/show/?i=5977&lng=en&c=9 *** New Mac OS X botnet discovered *** --------------------------------------------- Doctor Webs security experts researched several new threats to Mac OS X. One of them turned out to be a complex multi-purpose backdoor that entered the virus database as Mac.BackDoor.iWorm. Criminals can issue commands that get this program to carry out a wide range of instructions on the infected machines. A statistical .. --------------------------------------------- http://news.drweb.com/show/?i=5976&lng=en&c=9 *** Norton Security: Symantec bestätigt Ende von Norton Antivirus *** --------------------------------------------- Norton Antivirus wird es als Einzelprodukt von Symantec nicht mehr geben. Nur bestehende Einzellizenzen lassen sich verlängern. --------------------------------------------- http://www.golem.de/news/norton-security-symantec-bestaetigt-ende-von-norto… *** Google zahlt 15.000 US-Dollar für Chrome-Exploits *** --------------------------------------------- Das Unternehmen hat die Maximalsumme verdreifacht, die es an Entdecker von Chrome-Lücke auszahlt. Ausserdem winkt nun ein Eintrag in die Google Hall of Fame. --------------------------------------------- http://www.heise.de/security/meldung/Google-zahlt-15-000-US-Dollar-fuer-Chr…

1 0

Tageszusammenfassung - Mittwoch 1-10-2014
by Daily end-of-shift report 01 Oct '14

01 Oct '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-09-2014 18:00 − Mittwoch 01-10-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How RAM Scrapers Work: The Sneaky Tools Behind the Latest Credit Card Hacks *** --------------------------------------------- In the world of hacking, every malicious tool has its heyday---that period when it rules the underground forums and media headlines and is the challenger keeping computer security pros on their toes. Viruses and worms have each had their day in the spotlight. Remote-access Trojans, which allow a hacker to .. --------------------------------------------- http://www.wired.com/2014/09/ram-scrapers-how-they-work/ *** Node.js eval() code execution *** --------------------------------------------- Node.js could allow a remote attacker to execute arbitrary code on the system, caused by the improper validation of input prior to being used in an eval() call. An attacker could exploit this vulnerability to inject and execute arbitrary PHP code on the system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96728 *** Advertising firms struggle to kill malvertisements *** --------------------------------------------- One provider finds a vulnerable advertising tool that allowed attackers access .. --------------------------------------------- http://arstechnica.com/security/2014/09/advertising-firms-struggle-to-kill-… *** Gedanken nach meinem shellshock *** --------------------------------------------- Zum Thema Shellshock ist mir heute nach diesem Artikel wiederholt richtig klar geworden, dass das ganze dieses mal nicht so einfach ist wie Heartbleed - die Diversität mit der sich bash bugs (bzw. shell mis-interpretationen) verstecken ist interessant!Nach lesen des Artikels kann man sich .. --------------------------------------------- http://www.cert.at/services/blog/20140930221128-1263.html *** Several vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. --------------------------------------------- http://www.typo3.org/news/article/several-vulnerabilities-in-extension-phpm… *** Splunk Enterprise 6.1.4 and 5.0.10 address four vulnerabilities *** --------------------------------------------- Splunk Enterprise versions 6.1.4 and 5.0.10 address the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88585, SPL-88587, SPL-88588, CVE-2014-3511) Persistent cross-site scripting (XSS) via .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANHS *** Attackers exploiting Shellshock (CVE-2014-6721) in the wild *** --------------------------------------------- Yesterday, a new vulnerability affecting Bash (CVE-2014-6271) was published. The new vulnerability allows attackers to execute arbitrary commands formatting an environmental variable using a specific format. It affects Bash (the Bourne Again SHell), the default command shell for Linux and .. --------------------------------------------- https://www.alienvault.com/open-threat-exchange/blog/attackers-exploiting-s… *** TimThumb is No Longer Supported or Maintained *** --------------------------------------------- http://www.binarymoon.co.uk/2014/09/timthumb-end-life/ *** Multiple vulnerabilities in HP products *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Multiple product vulnerabilities: all TP-Link "2-series" switches, all TP-Link VxWorks-based product *** --------------------------------------------- Telnet is available and cannot be disabled (confirmed by vendor) SSHv1 enabled by default if SSH is enabled (confirmed by vendor) --------------------------------------------- http://seclists.org/fulldisclosure/2014/Oct/6 *** SchneiderWEB Server Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides firmware updates for a directory traversal vulnerability in Schneider Electric's SchneiderWEB, a web HMI. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-273-01 *** Rockwell Micrologix 1400 DNP3 DOS Vulnerability *** --------------------------------------------- This advisory provides a Rockwell Automation firmware revision that mitigates .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-254-02 *** Firefox/Chrome: BERserk hätte verhindert werden können *** --------------------------------------------- Die Sicherheitslücke BERserk ist nur deshalb ein Problem, weil einige Zertifizierungsstellen sich nicht an gängige Empfehlungen für RSA-Schlüssel halten. Mit BERserk akzeptieren Firefox und Chrome gefälschte Zertifikate. --------------------------------------------- http://www.golem.de/news/firefox-chrome-berserk-haette-verhindert-werden-ko… *** Studie: Malware ist Hauptgefährdung für Unternehmens-IT *** --------------------------------------------- Laut der aktuellen /Microsoft-Sicherheitsstudie hat die Bedrohung der Unternehmens-IT durch Malware die bisherige Nummer .. --------------------------------------------- http://www.heise.de/security/meldung/Studie-Malware-ist-Hauptgefaehrdung-fu… *** Sicherheitslücke in Xen-Hypervisor betraf Cloud-Anbieter *** --------------------------------------------- Ein Programmierfehler in der Virtualisierungssoftware zwang Amazon und Rackspace, zahlreiche virtuelle Maschinen neu zu starten. Inzwischen ist die Lücke in der freien Software geschlossen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-Xen-Hypervisor-be… *** Critical FreePBX RCE Vulnerability (ALL Versions) *** --------------------------------------------- We have been made aware of a critical Zero-Day Remote Code Execution and Privilege Escalation exploit within the legacy 'FreePBX ARI Framework module/Asterisk Recording Interface (ARI)'. This affects any user who has installed FreePBX prior to version .. --------------------------------------------- http://community.freepbx.org/t/critical-freepbx-rce-vulnerability-all-versi…

1 0

Tageszusammenfassung - Dienstag 30-09-2014
by Daily end-of-shift report 30 Sep '14

30 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-09-2014 18:00 − Dienstag 30-09-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash *** --------------------------------------------- Last Updated: 29 Sep 2014 --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10648 *** We Take Your Privacy and Security. Seriously. *** --------------------------------------------- "Please note that [COMPANY NAME] takes the security of your personal data very seriously." If youve been on the Internet for any length of time, chances are very good that youve received at least one breach notification email or letter that includes some version of this obligatory line. But as far as lines go, this one is about as convincing as the classic break-up line, "Its not you, its me." --------------------------------------------- http://krebsonsecurity.com/2014/09/we-take-your-privacy-and-security-seriou… *** Splunk response to "shellshock" vulnerabilities *** --------------------------------------------- Description Splunk response to "shellshock" vulnerabilities: Splunk Enterprise response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Enterprise response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Cloud response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk MINT response to Bash "shellshock" parsing attack (CVE-2014-6271, CVE-2014-7169) Splunk Storm response... --------------------------------------------- http://www.splunk.com/view/SP-CAAANJN *** WPScan Vulnerability Database a New WordPress Security Resource *** --------------------------------------------- Researcher Ryan Dewhurst released the WPScan Vulnerability Database, a database housing security vulnerabilities in WordPress core code, plug-ins and themes. Its available for pen-testers, WordPress administrators and developers. --------------------------------------------- http://threatpost.com/wpscan-vulnerability-database-a-new-wordpress-securit… *** Cisco WebEx Meetings Server Arbitrary Download Vulnerability *** --------------------------------------------- CVE-2014-3395 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun... *** --------------------------------------------- Background: CVE-2014-6271 + CVE-2014-7169 During the mayhem of bash 0day remote execution vulnerability CVE-2014-6271 and CVE-2014-7169, not for bragging but as a FYI, I happened to be the first who reversed for the first ELF malware spotted used in the wild. The rough disassembly analysis and summary I wrote and posted in Virus Total & Kernel Mode here --> [-1-] [-2-] credit) (the credit is all for her for links to find this malware, for the swift sensoring & alert, and thanks for... --------------------------------------------- http://blog.malwaremustdie.org/2014/09/linux-elf-bash-0day-fun-has-only-jus… *** gnome-shell printscreen key security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96713 *** Apple schließt Shellshock-Lücken in OS X - teilweise *** --------------------------------------------- Update für die Unix-Shell Bash veröffentlicht - Scheint aber nur die ersten zwei aufgetauchten Lücken zu bereinigen --------------------------------------------- http://derstandard.at/2000006210412 *** remote syslog PRI vulnerability *** --------------------------------------------- Sysklogd is mildly affected. Having a quick look at the current git master branch, the wrong action may be applied to messages with invalid facility. ... Rsyslogd experiences the same problem as sysklogd. However, more severe effects can occur, BUT NOT WITH THE DEFAULT CONFIGURATION. The most likely and thus important attack is a remote DoS. Some of the additional tables are writable and can cause considerable misadressing. ... --------------------------------------------- http://www.rsyslog.com/security-advisories/ *** [20140904] - Core - Denial of Service *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Low Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Exploit type: Denial of Service Reported Date: 2014-September-24 Fixed Date: 2014-September-30 CVE Number: CVE-2014-7229 Description Inadequate checking allowed the potential for a denial of service attack. Affected Installs Joomla! CMS versions 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Solution Upgrade to version 2.5.26, 3.2.6, or... --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/MWxjsJYnk9U/596-20140904-c… *** [20140903] - Core - Remote File Inclusion *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Exploit type: Remote File Inclusion Reported Date: 2014-September-24 Fixed Date: 2014-September-30 CVE Number: CVE-2014-7228 Description Inadequate checking allowed the potential for remote files to be executed. Affected Installs Joomla! CMS versions 2.5.4 through 2.5.25, 3.2.5 and earlier 3.x versions, 3.3.0 through 3.3.4 Solution Upgrade to version 2.5.26,... --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/NTyZcpJMN00/595-20140903-c… *** IBM Sterling Connect:Direct for UNIX is affected by multiple OpenSSL vulnerabilities(CVE-2014-3508, CVE-2014-3511) *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported on 6 August 2014 by the OpenSSL Project. CVE(s): CVE-2014-3508 and CVE-2014-3511 Affected product(s) and affected version(s): IBM Sterling Connect:Direct for UNIX 4.0.00 - All versions prior to 4.0.00 Fix 131 IBM Sterling Connect:Direct for UNIX 4.1.0 - All versions prior to 4.1.0.4 iFix 33 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_sterling_connect_… *** IBM Security Bulletin: Open Redirection in IBM Tivoli Federated Identity Manager (CVE-2014-3097) *** --------------------------------------------- In certain cases, IBM Tivoli Federated Identity Manager does not handle end user provided data before using that data to construct an HTTP redirect request. CVE(s): CVE-2014-3097 Affected product(s) and affected version(s): IBM Tivoli Federated Identity Manager 6.2.0, 6.2.1, 6.2.2 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21684852 X-Force Database:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Vulnerabilities in Bash affect IBM InfoSphere Guardium Database Activity Monitoring (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) *** --------------------------------------------- Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by IBM InfoSphere Guardium Database Activity Monitoring. CVE(s): CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 Affected product(s) and affected version(s):... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Shell command injection and cross-site scripting vulnerabilities in Access Manager for Mobile and Access Manager for Web (CVE-2014-4823, CVE-2014-6079) *** --------------------------------------------- IBM Security Access Manager for Mobile and IBM Security Access Manager for Web could be affected by a command injection vulnerability and allow a cross site scripting attack. CVE(s): CVE-2014-4823 and CVE-2014-6079 Affected product(s) and affected version(s): IBM Security Access Manager for Mobile 8. - Firmware versions 8.0.0.0, 8.0.0.1, 8.0.0.3, and 8.0.0.4. IBM Security Access Manager for Web 7.0 and 8.0 - Firmware versions 7.0, 7.0.0.1, 7.0.0.2, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6,... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Denial of Service when using e-community single sign on in IBM Security Access Manager for Web (CVE-2014-4809) *** --------------------------------------------- When using e-community single sign on (ECSSO), the WebSEAL component of IBM Security Access Manager for Web could become unresponsive under certain circumstances, possibly resulting in denial of service. CVE(s): CVE-2014-4809 Affected product(s) and affected version(s): IBM Security Access Manager for Web version 7.0 appliance: All firmware versions. IBM Security Access Manager for Web version 8.0: Firmware versions 8.0.0.2, 8.0.0.3, and 8.0.0.4 Refer to the following reference URLs for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Abgeschlossen: Wartungsarbeiten Dienstag 30. September 2014 *** --------------------------------------------- Update: Die Wartungsarbeiten wurden gegen 10h abgeschlossen; insgesamt kam es zu Ausfallszeiten von etwa 15 Minuten. --------------------------------------------- http://www.cert.at/services/blog/20140929105226-1254.html

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily