- Daily - CERT.at

Tageszusammenfassung - Montag 29-09-2014
by Daily end-of-shift report 29 Sep '14

29 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-09-2014 18:00 − Montag 29-09-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Wartungsarbeiten Dienstag 30. September 2014 *** --------------------------------------------- Wir werden am Dienstag, 30. Sep. 2014, ab etwa 9h, Wartungsarbeiten an unserer Firewall vornehmen. Dadurch wird es zu Ausfällen aller öffentlich erreichbaren Internet-Services von CERT.at (zum Beispiel Webserver, Mail, Mailing-Listen, RSS-/Atom-Feeds etc.) kommen. Mails gehen selbstverständlich in dieser Zeit nicht verloren, es kann nur zu Verzögerungen bei Zustellung/Beantwortung kommen. Für die Webseite wird... --------------------------------------------- http://www.cert.at/services/blog/20140929105226-1254.html *** Vuln: Go TLS Server Implementation Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/70156 *** Oracle - Alert for CVE-2014-7169 "Bash" *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-23032… *** Bash Command Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a vulnerability in Bash, which is part of Unix-based operating systems. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-269-01 *** Shellshock: Immer mehr Lücken in Bash *** --------------------------------------------- Die ersten Fehlerkorrekturen für die Shellshock-Lücke in Bash waren unvollständig. Inzwischen ist von fünf verschiedenen Sicherheitslücken die Rede. --------------------------------------------- http://www.golem.de/news/shellshock-immer-mehr-luecken-in-bash-1409-109483-… *** DSA-3038 libvirt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3038 *** Shellshock in the Wild *** --------------------------------------------- Michael Lin, James Bennett and David Bianco The exploitation of the BASH bug, now widely referred to as "Shellshock", is in full swing. Attackers have mobilized - multiple proof-of-concept scripts are available, including a Metasploit module, making this vulnerability very accessible. The... --------------------------------------------- http://www.fireeye.com/blog/uncategorized/2014/09/shellshock-in-the-wild.ht… *** iOS 8: Nutzung zufallsgenerierter MAC-Adressen ist eingeschränkt *** --------------------------------------------- Apples iOS 8 bringt eine Sicherheitsfunktion mit, die dem Nutzer mehr Anonymität verschaffen soll. Die Geräte mit iOS 8 wechseln ständig die MAC-Adresse, so dass ein Tracken individueller Nutzer unmöglich wird. Doch nicht jedes iOS-8-fähige Gerät kann das. --------------------------------------------- http://www.golem.de/news/ios-8-nutzung-zufallsgenerierter-mac-adressen-ist-… *** Fraud shop OVERSTOCKED with stolen credit cards *** --------------------------------------------- Supply, meet demand: prices crash Infamous carding store Rescator.cc is so chock-full of stolen credit cards from recent high-profile breaches that its gutting its prices due to overstocking. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/29/fraud_shop_… *** AVM: Sicherheitslücke in Fritzbox wird wieder ausgenutzt *** --------------------------------------------- Fritzbox-Nutzer, die die gepatchte Sicherheitslücke für unerlaubten Fernzugriff nicht geschlossen haben, werden wieder angegriffen. AVM rät, die Patches jetzt schnell aufzuspielen, doch eine Auto-Updatefunktion gibt es noch nicht lange. --------------------------------------------- http://www.golem.de/news/avm-alte-sicherheitsluecke-in-fritzbox-wird-wieder… *** HPSBNS03111 rev.1 - HP NonStop Servers running Bash Shell, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP NonStop Servers running Bash Shell . This is the Bash Shell vulnerability known as "ShellShock" which could be exploited remotely to allow execution of code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** DHCP Client Bash Environment Variable Code Injection *** --------------------------------------------- Topic: DHCP Client Bash Environment Variable Code Injection Risk: High Text:## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-fr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090152 *** LSE entdeckt kritische Schwachstelle in Perl *** --------------------------------------------- Mit der vom Identity-Management-Experten festgestellten Lücke in der Spracherweiterung Data::Dumper soll sich durch Anlegen großer Datenstrukturen ein Stack Overflow erzeugen lassen. --------------------------------------------- http://www.heise.de/security/meldung/LSE-entdeckt-kritische-Schwachstelle-i… *** HTTPS: Kostenlose TLS-Verschlüsselung bei Cloudflare *** --------------------------------------------- Cloudflare aktiviert künftig bei allen Kunden kostenlos verschlüsselte HTTPS-Verbindungen. Damit verdoppelt sich die Zahl der Webseiten im Netz, die verschlüsselt erreichbar sind. --------------------------------------------- http://www.golem.de/news/https-kostenlose-tls-verschluesselung-bei-cloudfla… *** iOS 8 verrät Drittanbieter-Apps, mit wem man telefoniert *** --------------------------------------------- Die beiden Forscher Andreas Kurtz und Markus Troßbach haben jede Menge Lücken in iOS entdeckt, durch die Drittanbieter-Apps etwa heimlich Fotos schießen oder das Telefonieverhalten ausspionieren können. Einige davon hat Apple geschlossen - andere nicht. --------------------------------------------- http://www.heise.de/security/meldung/iOS-8-verraet-Drittanbieter-Apps-mit-w… *** FBI to Open Up Malware Investigator Portal to External Researchers *** --------------------------------------------- SEATTLE - The FBI has developed an internal malware-analysis tool, somewhat akin to the systems used by antimalware companies, and plans to open the system up to external security researchers, academics and others. The system is known as Malware Investigator and is designed to allow FBI agents and other authorized law enforcement users to upload suspicious files. --------------------------------------------- http://threatpost.com/fbi-to-open-up-malware-investigator-portal-to-externa… *** Shellshock: A Collection of Exploits seen in the wild, (Mon, Sep 29th) *** --------------------------------------------- Ever since the shellshock vulnerablity has been announced, we have seen a large number of scans probing it. Here is a quick review of exploits that our honeypots and live servers have seen so far: 1 - Simple "vulnerability checks" that used custom User-Agents: () { 0v3r1d3;};echo \x22Content-type: text/plain\x22; echo; uname -a; () { :;}; echo Shellshock: Vulnerable () { :;};echo content-type:text/plain;echo;echo [random string];echo;exit () { :;}; /bin/bash -c "echo --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18725&rss

1 0

Tageszusammenfassung - Freitag 26-09-2014
by Daily end-of-shift report 26 Sep '14

26 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-09-2014 18:00 − Freitag 26-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Patching Bash Vulnerability a Challenge for ICS, SCADA *** --------------------------------------------- Experts are concerned that many Linux-based industrial control systems and embedded systems could be too steep a patching challenge and remain in the crosshairs of the Bash vulnerability. --------------------------------------------- http://threatpost.com/patching-bash-vulnerability-a-challenge-for-ics-scada… *** Bash Vulnerability (Shellshock) Exploit Emerges in the Wild, Leads to BASHLITE Malware *** --------------------------------------------- Just several hours after the news on the bash vulnerability (covered under CVE-2014-7169) broke out; it was reportedly being exploited in the wild already. This vulnerability can allow execution of arbitrary code thus compromising the security of systems. Some of the possible scenarios that attackers can do range from changing the contents of web server and... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-OM1T28JyB8/ *** Linux ELF bash 0day: The fun has only just begun... *** --------------------------------------------- Background: CVE-2014-6271 + CVE-2014-7169 During the mayhem of bash 0day remote execution vulnerability CVE-2014-6271 and CVE-2014-7169, not for bragging but as a FYI, I happened to be the first who reversed for the first ELF malware spotted used in the wild. The assembly analysis and summary I wrote and posted in here --> [-1-] [-2-] The fun has only just begun...Yes. Today I was informed there is another payload distributed, thanks to my good friend, Father Robin Jackson (credit): Which... --------------------------------------------- http://blog.malwaremustdie.org/2014/09/linux-elf-bash-0day-fun-has-only-jus… *** Bad boy builds beastly Bash bug botnet - boxen battered *** --------------------------------------------- DDoS zombie army found in the wild hours after flaw surfaces Mere hours after its discovery, the Shell Shock Bash vulnerability was exploited by an attacker to build a botnet. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/26/bad_guy_bui… *** Vulnerabilities in LibVNCServer *** --------------------------------------------- --------------------------------------------- LibVNCServer CVE-2014-6054 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70094 --------------------------------------------- libVNCserver CVE-2014-6051 Integer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70093 --------------------------------------------- LibVNCServer CVE-2014-6053 Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70092 --------------------------------------------- LibVNCServer CVE-2014-6052 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/70091 *** JSA10648 - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell command injection vulnerability in Bash (CVE-2014-6271, CVE-2014-7169) *** --------------------------------------------- Products vulnerable to remote exploitation risks: Junos Space is vulnerable in all versions. JSA Series (STRM) devices are vulnerable in all versions. --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10648&actp=RSS *** GNU Bash Environmental Variable Command Injection Vulnerability *** --------------------------------------------- cisco-sa-20140926-bash --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3035 bash *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3035 *** TYPO3-EXT-SA-2014-011: Several vulnerabilities in extension phpMyAdmin (phpmyadmin) *** --------------------------------------------- It has been discovered that the extension "phpMyAdmin" (phpmyadmin) is susceptible to Cross-Site Scripting and Cross-Site Request Forgery. --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** Bugtraq: [SECURITY] [DSA 3036-1] mediawiki security update *** --------------------------------------------- [SECURITY] [DSA 3036-1] mediawiki security update --------------------------------------------- http://www.securityfocus.com/archive/1/533552

1 0

Tageszusammenfassung - Donnerstag 25-09-2014
by Daily end-of-shift report 25 Sep '14

25 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-09-2014 18:00 − Donnerstag 25-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Shellshock Bash Vulnerability *** --------------------------------------------- Current event - 1.0 of post This is a current event and as such this blog post is subject to change over the course of the next few days as we perform further supplementary research and analysis by NCC Group's Cyber Defence Operations and Security Consulting divisions. v1.0 - initial version Background Yesterday (24 September) CVE-2014-6271 was released with a corresponding patch for Bash (a common Linux shell). The risk arises from this vulnerability because of certain use cases. The use... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/09/shellshock-bash-vulnerability/ *** Update on CVE-2014-6271: Vulnerability in bash (shellshock), (Thu, Sep 25th) *** --------------------------------------------- (this diary will be updated with links to relevant resources shortly) Yesterday, a vulnerability in bash was announced, that was originally found by,Stephane Schazelas. The vulnerability allows for arbitrary code execution in,bash by setting specific environment variables. Later, Travis Ormandy released,a second exploit that will work on patched systems, demonstration that the,patch released yesterday is incomplete. What is the impact of the vulnerability? At first, the vulnerability doesnt... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18707&rss *** Bash-Lücke: ShellShock ist noch nicht ausgestanden *** --------------------------------------------- Die Sicherheitslücke in der Linux-Shell Bash, die nun unter dem Namen "ShellShock" firmiert, wird bereits als der schlimmere Bruder von Heartbleed bezeichnet. Sicher ist, dass der am Mittwoch ausgelieferte Patch weitere Lücken enthält. --------------------------------------------- http://www.heise.de/security/meldung/Bash-Luecke-ShellShock-ist-noch-nicht-… *** "Bash" (CVE-2014-6271) vulnerability - Q&A *** --------------------------------------------- The "bash" vulnerability is an extremely powerful vulnerability due to its high impact and the ease with which it can be exploited. --------------------------------------------- https://securelist.com/blog/research/66673/bash-cve-2014-6271-vulnerability… *** Bug in Bash shell creates big security hole on anything with *nix in it [Updated] *** --------------------------------------------- Could allow attackers to execute code on Linux, Unix, and Mac OS X. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/94xcSgjPriY/ *** Bash Exploit Reported, First Round of Patches Incomplete *** --------------------------------------------- Reports of the first in-the-wild exploits targeting the Bash vulnerability have surfaced, as have complaints the first patches for the bug are incomplete. --------------------------------------------- http://threatpost.com/bash-exploit-reported-first-round-of-patches-incomple… *** RSA-Signaturen: Acht Jahre alte Sicherheitslücke kehrt zurück *** --------------------------------------------- In der NSS-Bibliothek ist eine Sicherheitslücke entdeckt worden, mit der sich RSA-Signaturen fälschen lassen. Betroffen sind die Browser Chrome und Firefox, für die bereits Updates erschienen sind. Es handelt sich um eine Variante der Bleichenbacher-Attacke von 2006. --------------------------------------------- http://www.golem.de/news/rsa-signaturen-acht-jahre-alte-sicherheitsluecke-k… *** iOS-Sicherheitslücke ermöglicht Keylogging in Apps mit integriertem Browser *** --------------------------------------------- Einem Entwickler ist aufgefallen, dass Apple offenbar beim Trennen von Prozessen geschlampt hat. Bietet eine App eine Browser-Ansicht, kann diese von der App selbst beobachtet werden. --------------------------------------------- http://www.heise.de/security/meldung/iOS-Sicherheitsluecke-ermoeglicht-Keyl… *** An Analysis of the CAs trusted by iOS 8.0 *** --------------------------------------------- iOS 8.0 ships with a number of trusted certificates (also known as "root certificates" or "certificate authorities"), which iOS implicitly trusts. The root certificates are used to trust intermediate certificates, and the intermediate certificates are used to trust web site certificates. When you go to a web site using HTTPS, or an app makes a secure connection to something on the Internet (like your mail server), the web site (or mail server, or whatever) gives iOS its... --------------------------------------------- http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by-ios-8-0/ *** GNU bash Environment Variable Processing Flaw Lets Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030890 *** DSA-3032 bash *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-3032 *** Security Advisories for Cisco IOS Software *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified Communications Domain Manager glibc Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletin: Vulnerability in IBM Java SDKs and IBM Java Runtime Technology Edition affecting Rational Functional Tester (CVE-2014-3086) *** --------------------------------------------- Multiple vulnerabilities exist in IBM SDKs Java Technology Edition and IBM Runtime Environment Java Technology Edition that are used by Rational Functional Tester (RFT). These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-3086 Affected product(s) and affected version(s): Rational Functional Tester version 8.2.2 and later Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin:... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool OMNIbus (CVE-2014-4263, CVE-2014-4244) *** --------------------------------------------- There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Versions 5, 6, and 7 that are used by Tivoli Netcool OMNIbus. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244 Affected product(s) and affected version(s): Tivoli Netcool/OMNIbus 7.3.0 Tivoli Netcool/OMNIbus 7.3.1 Tivoli Netcool/OMNIbus 7.4.0 Tivoli Netcool/OMNIbus 8.1.0 Refer to the following reference URLs for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- https://www.drupal.org/node/2344383 https://www.drupal.org/node/2344369 https://www.drupal.org/node/2344363 https://www.drupal.org/node/2344389 *** Mozilla Network Security Services certificates security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96194 *** HPSBST03103 rev.1 - HP Storage EVA Command View Suite running OpenSSL, Remote Unauthorized Access, Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Storage Enterprise Virtual Array (EVA) Command View Suite. The vulnerability could be exploited to allow remote unauthorized access and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Bugtraq: Two SQL Injections in All In One WP Security WordPress plugin *** --------------------------------------------- http://www.securityfocus.com/archive/1/533519 *** TYPO3-EXT-SA-2014-012: Several vulnerabilities in extension JobControl (dmmjobcontrol) *** --------------------------------------------- It has been discovered that the extension "JobControl" (dmmjobcontrol) is susceptible to Cross-Site Scripting and SQL Injection. --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** Bugtraq: LSE Leading Security Experts GmbH - LSE-2014-06-10 - Perl CORE - Deep Recursion Stack Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/533543

1 0

Tageszusammenfassung - Mittwoch 24-09-2014
by Daily end-of-shift report 24 Sep '14

24 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-09-2014 18:00 − Mittwoch 24-09-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS14-055 - Important: Vulnerabilities in Microsoft Lync Server Could Allow Denial of Service (2990928) - Version: 3.0 *** --------------------------------------------- Revisions: V1.0 (September 9, 2014): Bulletin published. V2.0 (September 15, 2014): Bulletin revised to remove Download Center links for Microsoft security update 2982385 for Microsoft Lync Server 2010. See the Update FAQ for details. V3.0 (September 23, 2014): Bulletin rereleased to announce the reoffering of the 2982385 security update file (server.msp) for Microsoft Lync Server 2010. See the Update FAQ for details. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-055 *** Website Malware - Curious .htaccess Conditional Redirect Case *** --------------------------------------------- I really enjoy when I see a different kind of conditional redirect, check this one out: The special thing about this one is the usage of a not so common .htaccess feature in malware: variables. In the first part it set the conditions for user-agents, nothing new, but the afterward rules are interesting: RewriteRule .*Read More --------------------------------------------- http://blog.sucuri.net/2014/09/website-malware-curious-htaccess-conditional… *** Apt: Buffer Overflow in Debians Paketmanagement *** --------------------------------------------- Im von Debian und Ubuntu verwendeten Paketmanagement Apt wurde ein sicherheitskritischer Fehler entdeckt. Es ist bereits das zweite Mal in kurzer Zeit dass Apt Sicherheitsprobleme hat. --------------------------------------------- http://www.golem.de/news/apt-buffer-overflow-in-debians-paketmanagement-140… *** Microsoft Starts Online Services Bug Bounty *** --------------------------------------------- Microsoft today launched the Microsoft Online Services Bug Bounty Program which will pay out a minimum of $500 for vulnerabilities found in its cloud services such as Office 365. --------------------------------------------- http://threatpost.com/microsoft-starts-online-services-bug-bounty/108486 *** jQuery.com Compromise: The Dangers of Third Party Hosted Content, (Tue, Sep 23rd) *** --------------------------------------------- jQuery is a popular Javascript framework, used by many websites (including isc.sans.edu) . jQuery provides many features, like easy access to webservices as well as advanced user interface features. When using jQuery, sites have the option to download and host the complete code, or let jQuery.com and its CDN (Content Delivery Network) host the code. There are two advantages in allowing jQuery.com to host the code: Performance: Code is typically delivered faster, and a user may already have the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18699&rss *** Auch Mozilla verabschiedet sich langsam von SHA-1 *** --------------------------------------------- Die Entwickler der freien Web-Browsers Firefox wollen den angreifbaren Hash-Algorithmus in Zukunft nicht mehr für verschlüsselte Verbindungen akzeptieren. Server-Betreibern bleibt jedoch noch Zeit für die Umstellung. --------------------------------------------- http://www.heise.de/security/meldung/Auch-Mozilla-verabschiedet-sich-langsa… *** Remote exploit vulnerability in bash CVE-2014-6271 *** --------------------------------------------- A remotely exploitable vulnerability has been discovered in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271. This affects Debian as well as other Linux distributions. If you have have Microsoft Services for UNIX you will need to patch ASAP. Bash supports exporting she variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process. From Debian:Current bash versions use an --------------------------------------------- http://www.csoonline.com/article/2687265/application-security/remote-exploi… *** Bugtraq: CVE-2014-6603 suricata 2.0.3 Out-of-bounds access in SSH parser *** --------------------------------------------- http://www.securityfocus.com/archive/1/533515 *** Huawei Security Advisory - CSRF Vulnerabilities in Multiple Products *** --------------------------------------------- Cross-site request forgery (CSRF) vulnerabilities are discovered in multiple products, including FusionManager (Vulnerability ID: HWPSIRT-2014-0408) and USG firewall series (Vulnerability ID: HWPSIRT-2014-0406). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Huawei Security Advisory - Information Leakage Vulnerability via MPLS Ping in VRP Platform *** --------------------------------------------- Information leakage vulnerability exists in several devices using VRP platform, because the MPLS LSP Ping service is bound to unnecessary interfaces, which can cause the leak of IP addresses of devices (Vulnerability ID: HWPSIRT-2014-0418). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Hikashop Extension for Joomla! *** --------------------------------------------- Advisory for: Hikashop for Joomla! Security Risk: High (DREAD score : 7/10) Vulnerability: Object Injection / Remote Code Execution Updated Version: 2.3.2 In a routine audit of our Website Firewall we discovered a serious vulnerability within the Hikashop ecommerce product for Joomla! allowing remote code execution on the vulnerable website[s]. What are the risks? ThisRead More --------------------------------------------- http://blog.sucuri.net/2014/09/security-advisory-hikashop-extension-for-joo…

1 0

Tageszusammenfassung - Dienstag 23-09-2014
by Daily end-of-shift report 23 Sep '14

23 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-09-2014 18:00 − Dienstag 23-09-2014 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Cyber Campaigns *** --------------------------------------------- This website simply lists multiple cyber-espionage and cyber-attack campaigns. These campaigns have successfully compromised hundreds of government entities and global corporations in over 50 countries. Click on any of the links below to access more detailed information regarding these cyber campaigns. If you see one missing, just let me know. --------------------------------------------- http://cybercampaigns.net/ *** Whonix Anonymous Operating System Version 9 Released *** --------------------------------------------- Whonix is an operating system focused on anonymity, privacy and security. It's based on the Tor anonymity network, Debian GNU/Linux and security by isolation. DNS leaks are impossible, and not even malware with root privileges can find out the user's real IP. --------------------------------------------- https://www.whonix.org/blog/whonix-anonymous-9-released *** UK banks hook themselves up to real-time cop data feed *** --------------------------------------------- Not like the movies: Law enforcement is on it... UK banks will receive real-time warnings about threats to their customers accounts as well as the overall integrity of their banking systems from a new financial crime alert system. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/23/uk_bank_fra… *** HPSBPI03107 rev.1 - Certain HP LaserJet Printers, MFPs and Certain HP OfficeJet Enterprise Printers using OpenSSL, Remote Unauthorized Access *** --------------------------------------------- A potential security vulnerability has been identified with certain HP LaserJet Printers, MFPs and certain HP OfficeJet Enterprise Printers using OpenSSL. The vulnerability could be exploited remotely to allow remote unauthorized access. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** BIND 9.8.8, 9.9.6 and 9.10.1 Release Notes *** --------------------------------------------- https://kb.isc.org/article/AA-01211/81/BIND-9.8.8-Release-Notes.html https://kb.isc.org/article/AA-01210/81/BIND-9.9.6-Release-Notes.html https://kb.isc.org/article/AA-01209/81/BIND-9.10.1-Release-Notes.html *** Bugtraq: Glype proxy cookie jar path traversal allows code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/533504 *** Security Advisory-Screen Capture Vulnerability on Huawei Ascend P6 Mobile Phones *** --------------------------------------------- Sep 23, 2014 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** TYPO3 CMS 4.5.36, 6.1.11 and 6.2.5 released *** --------------------------------------------- All versions are maintenance releases and contain bug fixes. --------------------------------------------- https://typo3.org/news/article/typo3-cms-4536-6111-and-625-released/ *** [20140901] - Core - XSS Vulnerability *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 3.2.0 through 3.2.4, 3.3.0 through 3.3.3 Exploit type: XSS Vulnerability Reported Date: 2014-August-27 Fixed Date: 2014-September-23 CVE Number: CVE-2014-6631 Description Inadequate escaping leads to XSS vulnerability in com_media. Affected Installs Joomla! CMS versions 3.2.0 through 3.2.4 and 3.3.0 through 3.3.3 Solution Upgrade to version 3.2.5 or 3.3.4 Contact The JSST at the Joomla! Security Center. Reported By: Dingjie (Daniel) --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/EiyFsQIjpu4/593-20140901-c… *** [20140902] - Core - Unauthorised Logins *** --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Moderate Versions: 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3 Exploit type: Unauthorised Logins Reported Date: 2014-September-09 Fixed Date: 2014-September-23 CVE Number: CVE-2014-6632 Description Inadequate checking allowed unauthorised logins via LDAP authentication. Affected Installs Joomla! CMS versions 2.5.24 and earlier 2.5.x versions, 3.2.4 and earlier 3.x versions, 3.3.0 through 3.3.3 Solution --------------------------------------------- http://feeds.joomla.org/~r/JoomlaSecurityNews/~3/uFCKpt1YcxU/594-20140902-c… *** XEN Security Advisories *** ------------------------------- *** Race condition in HVMOP_track_dirty_vram *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-104.html *** Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-105.html *** Missing privilege level checks in x86 emulation of software interrupts *** --------------------------------------------- http://xenbits.xen.org/xsa/advisory-106.html

1 0

Tageszusammenfassung - Montag 22-09-2014
by Daily end-of-shift report 22 Sep '14

22 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-09-2014 18:00 − Montag 22-09-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Tiny Tinba Trojan Could Pose Big Threat *** --------------------------------------------- In July 2014, the original source code of Tinba was made public in an underground forum. This leaked version comes with complete documentation and full source code. This follows other source code leaks from much more infamous and prevalent threats, which researchers worry that attackers could use as the basis for new versions. Similar to... --------------------------------------------- http://www.seculert.com/blog/2014/09/tiny-tinba-trojan-could-pose-big-threa… *** Apple Pay: A Security Analysis *** --------------------------------------------- Has Apple taken a bite out of hackers' arsenals? The company is betting on it. Its recent announcement about a new secure payment option has the retail and tech worlds buzzing. If Apple can implement its near-field communication (NFC) payment... --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-pay-a-security-analysis… *** How to secure your new iPhone in three simple steps *** --------------------------------------------- Summary: Symantec recommends best practices to keep your Apple ID account and iPhone safe. --------------------------------------------- http://www.symantec.com/connect/blogs/how-secure-your-new-iphone-three-simp… *** Conditional Malicious iFrame Targeting WordPress Web Sites *** --------------------------------------------- We have an email, labs(a)sucuri.net where we receive multiple questions a day about various forms of malware. One of the most common questions happen when our Free Security Scanner, SiteCheck, detects a spam injection or a hidden iframe and the user is unable to locate the infection in the source code. It's not until we... --------------------------------------------- http://blog.sucuri.net/2014/09/conditional-malicious-iframe-targeting-wordp… *** PHP Fixes Several Bugs in Version 5.4 and 5.5, (Fri, Sep 19th) *** --------------------------------------------- PHP announced the released of version 5.5.17 and 5.4.33. Ten bugs were fixed in version 5.4.33 and 15 bugs were fixed in version 5.5.17. All PHP users are encouraged to upgrade.The latest version are available for download here. [1] http://php.net/ChangeLog-5.php#5.4.33 [2] http://php.net/ChangeLog-5.php#5.5.17 [3] http://windows.php.net/download ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18683&rss *** CipherShed Fork from TrueCrypt Project, Support Windows, Mac OS and Linux - https://ciphershed.org, (Fri, Sep 19th) *** --------------------------------------------- ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18677&rss *** New OWASP Testing guide version 4! Check https://www.owasp.org/images/1/19/OTGv4.pdf, (Sat, Sep 20th) *** --------------------------------------------- Manuel Humberto Santander Peláez SANS Internet Storm Center - Handler Twitter: (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18687&rss *** CloudFlare ditches private SSL keys for better security *** --------------------------------------------- Sorry, spooks, we cant decrypt this for you CloudFlare has announced the outcome of what it says is two years work - switching on Keyless SSL - which lets customers encrypt their web traffic via the companys services without having to hand over their private SSL keys. --------------------------------------------- http://www.theregister.co.uk/2014/09/22/cloudflare_ditches_keys_for_better_… *** Holzleim: Fingerabdrucksensor des iPhone 6 ausgetrickst *** --------------------------------------------- Mit einer simpel angefertigten Kopie hat Ben Schlabs von den SRLabs den Fingerabdrucksensor des iPhone 6 getäuscht. Da Apple unter iOS 8 auch Drittanbieter diese Authentifizierungsmethode nutzen lässt, ist dies brisanter als beim iPhone 5S. --------------------------------------------- http://www.golem.de/news/holzleim-fingerabdrucksensor-des-iphone-6-ausgetri… *** VB2014 preview: Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam *** --------------------------------------------- Jérôme Segura looks at recent developments in malicious cold calls. In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we are looking at some of the research that will be presented at the event. Today, in the final entry in this series, we look at the paper Tech Support Scams 2.0: an inside look into the evolution of the classic Microsoft tech support scam, by Jérôme Segura (Malwarebytes).Two years ago, at VB2012 in Dallas, I... --------------------------------------------- https://www.virusbtn.com/blog/2014/09_22.xml *** Doubleclick und Zedo lieferten virenverseuchte Werbung aus *** --------------------------------------------- Das große Werbenetzwerk Zedo und die Google-Tochter Doubleclick sollen nach Angaben eines Antivirenherstellers fast einen Monat lang Schadcode über ihre Werbung verteilt haben. Auch größere Webseiten wie Last.fm waren betroffen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Doubleclick-und-Zedo-lieferten-viren… *** iOS 7.1.x Exploit Released (CVE-2014-4377), (Mon, Sep 22nd) *** --------------------------------------------- Havent upgraded to iOS 8 yet? Aside from a lot of new features, Apple also fixed a number of security vulnerabilities in iOS 8. For example CVE-2014-4377, a memory corrupion issue in iOSs core graphics library. An exploit is now available for this vulnerability. NOTE: I have not verified yet that the exploit is working / genuine. We will not link at this point to the exploit code, but basic Google Fu should allow you to find it. The author claims that the exploit is "compleatly reliable --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18693&rss *** Datenleck: WhatsApp petzt Online-Status *** --------------------------------------------- Ob und wie oft man WhatsApp öffnet, will man unter Umständen lieber für sich behalten. Der Betreiber macht diese Information allerdings für jedermann zugänglich, der die Nummer kennt. Selbst, wenn man dies in den Datenschutz-Einstellungen deaktiviert hat. --------------------------------------------- http://www.heise.de/security/meldung/Datenleck-WhatsApp-petzt-Online-Status… *** VU#730964: FortiNet FortiGate and FortiWiFi appliances contain multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#730964 FortiNet FortiGate and FortiWiFi appliances contain multiple vulnerabilities Original Release date: 19 Sep 2014 | Last revised: 19 Sep 2014 Overview Fortinet FortiGate and FortiWiFi appliances are susceptible to man-in-the-middle attacks (CWE-300) and a heap-based overflow vulnerability (CWE-122). Description Fortinet FortiGate and FortiWiFi 4.00.6 and possibly earlier versions are susceptible to man-in-the-middle attacks (CWE-300) and a heap-based overflow... --------------------------------------------- http://www.kb.cert.org/vuls/id/730964 *** Cisco Nexus 1000V Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-3367 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pure_application_… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletins for ClearQuest *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Asterisk PJSIP channel denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/96073

1 0

Tageszusammenfassung - Freitag 19-09-2014
by Daily end-of-shift report 19 Sep '14

19 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-09-2014 18:00 − Freitag 19-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** WordFence WordPress Security Plugin Pushes a Security Update *** --------------------------------------------- If you are one of the many users of the WordPress Security Plugin, WordFence, we highly encourage you to update. They recently pushed out an important security update that .. --------------------------------------------- http://blog.sucuri.net/2014/09/security-disclosure-the-wordfence-wordpress-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** CosmicDuke and the latest political news *** --------------------------------------------- After we had published the CosmicDuke report in July 2014, we continued to actively follow the malware. Today, we discovered two new samples that both leverage timely, political topics to deceive the recipient into opening .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002745.html *** Nuclear exploit kit - complete infection cycle *** --------------------------------------------- Zscaler ThreatLabZ has been seeing a steady increase in the Nuclear Exploit Kit (EK) traffic over the past few weeks. The detection of malicious activity performed by this EK remains low, due to usage of dynamic content and heavy .. --------------------------------------------- http://research.zscaler.com/2014/09/nuclear-exploit-kit-complete-infection.… *** Web Scan looking for /info/whitelist.pac, (Fri, Sep 19th) *** --------------------------------------------- Nathan reported today that he has been seeing a new trend of web scanning against his webservers looking for /info/whitelist.pac. The scanning he has observed is over SSL. He has been .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18675 *** Asterisk res_fax_spandsp Module Processing Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030876 *** Asterisk SIP SUBSCRIBE Type Handling Flaw Lets Remote Authenticated Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030875 *** Android ist in Zukunft standardmässig verschlüsselt *** --------------------------------------------- Wie Google offiziell bekannt gegeben hat, wird die Verschlüsselungsfunktion in Android L erstmals ab Werk eingeschaltet sein. --------------------------------------------- http://futurezone.at/produkte/android-ist-in-zukunft-standardmaessig-versch… *** Advantech WebAccess Vulnerabilities *** --------------------------------------------- Researcher Ricardo Narvaja of Core Security Technologies has identified several buffer overflow vulnerabilities in Advantech's WebAccess application. Advantech has produced a patch that mitigates these vulnerabilities. The researcher has .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-261-01 *** Bugtraq: CVE ID Syntax Change - Deadline Approaching *** --------------------------------------------- http://www.securityfocus.com/archive/1/533478 *** How to Detect SQL Injection Attacks *** --------------------------------------------- SQL Injection (SQLi) attacks have been around for over a decade. You might wonder why they are still so prevalent. The main reason is that they still work on quite a few web application targets. In fact, according to Veracode's 2014 State of Security Software Report , SQL injection vulnerabilities still .. --------------------------------------------- http://thehackernews.com/2014/09/how-to-detect-sql-injection-attacks.html *** Hackerangriff auf Home Depot: 56 Millionen Kreditkarten betroffen *** --------------------------------------------- Hacker sind weiter auf Beutezug durch den US-Einzelhandel: Erst verschafften sie sich Zugriff auf rund 40 Millionen Bankkarten bei Target-Supermärkten, jetzt könnten bei der Baumarktkette Home Depot 56 Millionen Karten betroffen sein. --------------------------------------------- http://www.heise.de/security/meldung/Hackerangriff-auf-Home-Depot-56-Millio… *** Cloudflare: TLS-Verbindungen ohne Schlüssel sollen Banken schützen *** --------------------------------------------- Cloudflare bietet Kunden künftig ein neues Feature namens Keyless SSL, mit dem der Teil des TLS-Handshakes, der den privaten Schlüssel benötigt, ausgelagert werden kann. Damit können Unternehmen die Kontrolle über den Schlüssel behalten. --------------------------------------------- http://www.golem.de/news/cloudflare-tls-verbindungen-ohne-schluessel-sollen… *** XSS: Cross-Site-Scripting über DNS-Records *** --------------------------------------------- Eine besonders kreative Variante einer Cross-Site-Scripting-Lücke macht auf der Webseite Hacker News die Runde: Mittels eines TXT-DNS-Records lässt sich auf zahlreichen Webseiten Javascript einfügen. --------------------------------------------- http://www.golem.de/news/xss-cross-site-scripting-ueber-dns-records-1409-10…

1 0

Tageszusammenfassung - Donnerstag 18-09-2014
by Daily end-of-shift report 18 Sep '14

18 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-09-2014 18:00 − Donnerstag 18-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** How Cops Can Still Pull Data Off Your Locked iPhone, In Spite Of Apple *** --------------------------------------------- A reminder to iPhone owners cheering Apple's latest privacy win: Just because Apple will no longer help police to turn your smartphone inside out doesn't mean it can prevent the cops from vivisecting the device on their own. On Wednesday evening Apple made news .. --------------------------------------------- http://www.wired.com/2014/09/apple-iphone-security/ *** SA-CONTRIB-2014-091 - Survey Builder - Cross Site Scripting (XSS) *** --------------------------------------------- When viewing surveys at "/surveys", the survey titles printed out are not sanitized. Any potentially dangerous code in the survey titles is also rendered. This vulnerability is mitigated by the fact that a user must have the "Create Survey" permission .. --------------------------------------------- https://www.drupal.org/node/2340069 *** SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS) *** --------------------------------------------- Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must .. --------------------------------------------- https://www.drupal.org/node/2340029 *** Bugtraq: APPLE-SA-2014-09-17-2 Apple TV 7 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533468 *** D-BUS Buffer Overflow and Multiple Processing Flaws Let Local Users Obtain Elevated Privileges and Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030864 *** Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1030868 *** Open Web App Security Project releases new app dev opus *** --------------------------------------------- The global security community has completed an 18-month effort to produce a guide it is hoped will boost the standard of web application testing and address new and dangerous technologies. Version 4 of the Open Web App Security Projects (OWASPs) Testing Guide was produced by more than 60 security bods from around the world with a core lead team of four. --------------------------------------------- http://www.theregister.co.uk/2014/09/18/guide_to_obliterating_web_apps_publ… *** Yokogawa CENTUM and Exaopc Vulnerability *** --------------------------------------------- Tod Beardsley of Rapid7 Inc., and Jim Denaro of CipherLaw, have identified an authentication vulnerability and released proof-of-concept (exploit) code for the Yokogawa CENTUM CS 3000 series and Exaopc products. JPCERT and Yokogawa have mitigated this vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-260-01

1 0

Tageszusammenfassung - Mittwoch 17-09-2014
by Daily end-of-shift report 17 Sep '14

17 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-09-2014 18:00 − Mittwoch 17-09-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** https://yourfakebank.support -- TLD confusion starts!, (Tue, Sep 16th) *** --------------------------------------------- Pretty much ever since the new top level domain (TLD) ".biz" went online a couple years ago, and the only ones buying domains in this space were the scammers, we kinda knew what would happen when ICANNs latest folly and money-grab went live. It looks like a number of the "new" top level domains, like ".support", ".club", etc have now come online. And again, it seems like only the crooks are buying. We are currently investigating a wave of phishing emails --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18651&rss *** Hintergrund: Nach Snowden: Wenig Schlaf für Kryptoforscher *** --------------------------------------------- Bei der Internet Engineering Task Force in Toronto stellte Lange vor kurzem einen Überblick über elliptische Kurven Verschlüsselung vor und riet dringend, sich für neuere Varianten zu entscheiden. Sie sprach am Rande der Veranstaltung mit heise Security. --------------------------------------------- http://www.heise.de/security/artikel/Nach-Snowden-Wenig-Schlaf-fuer-Kryptof… *** Virus activity overview: Adware and other security events of August 2014 *** --------------------------------------------- September 1, 2014 The last summer month of 2014 witnessed not only a large number of encryption Trojans in action but also a myriad of malicious programs displaying annoying (and sometimes fraudulent) ads in an effort to generate revenue for the criminals behind them. Also at summers end, Chinese attackers intensified their efforts to port certain Linux malware programs to Windows. In addition, security researchers discovered new threats to Android. Viruses Statistics collected by Dr.Web --------------------------------------------- http://news.drweb.com/show/?i=5935&lng=en&c=9 *** Netzwerkanalyse-Tool Message Analyzer in Version 1.1 veröffentlicht *** --------------------------------------------- Microsoft hat sein Sniffing- und Analysetool Message Analyzer in der Version 1.1 herausgebracht. Die neue Fassung schneidet unter anderem Netzwerkdaten aus der Ferne mit oder entschlüsselt SSL-gesicherte Datenströme. --------------------------------------------- http://www.heise.de/newsticker/meldung/Netzwerkanalyse-Tool-Message-Analyze… *** Understanding the WordPress Security Plugin Ecosystem *** --------------------------------------------- As a child, did you ever play that game where you sit in a circle and one person is responsible for whispering something into one persons ear, and that message gets relayed around the circle? Wasn't it always funny to see what the final message received would be? Oh and how it would have morphed as it was processed and conveyed by each individual in the group. This is what I see when I look at the WordPress Security Ecosystem. --------------------------------------------- http://blog.sucuri.net/2014/09/understanding-the-wordpress-security-plugin-… *** FreeBSD Denial of Service advisory (CVE-2004-0230), (Tue, Sep 16th) *** --------------------------------------------- A vulnerability has been discovered by Johnathan Looney at the Juniper SIRT in FreeBSD (base for Junos and many other products) in the way that FreeBSD processes certain TCP packets (https://www.freebsd.org/security/advisories/FreeBSD-SA-14:19.tcp.asc) If you send TCP SYN packets for an existing connection (i.e. the correct source IP, source port, destination IP, destination port combination) the operating system will tear down the connection. The attack is similar to the "slipping in the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18657&rss *** EMC Documentum Content Server Flaws Let Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030855 *** Bugtraq: Android Bluetooth Pairing Packet Processing Vulnerability (by wangzq from NCNIPC) *** --------------------------------------------- http://www.securityfocus.com/archive/1/533462 *** DSA-3025-1 apt -- security update *** --------------------------------------------- It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data (CVE-2014-0488), performs incorrect verification of 304 replies (CVE-2014-0487), does not perform the checksum check when the Acquire::GzipIndexes option is used (CVE-2014-0489) and does not properly perform validation for binary packages downloaded by the apt-get download command (CVE-2014-0490). For the stable distribution (wheezy), these problems have been fixed in version... --------------------------------------------- https://www.debian.org/security/2014/dsa-3025 *** Schneider Electric SCADA Expert ClearSCADA Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for three vulnerabilities in Schneider Electric's StruxureWare SCADA Expert ClearSCADA. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-259-01 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 16-09-2014
by Daily end-of-shift report 16 Sep '14

16 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-09-2014 18:00 − Dienstag 16-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security updates available for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1130 *** THREE QUARTERS of droid phones open to web page spy bug *** --------------------------------------------- Metasploit module gobbles KitKat SOP slop A Metasploit module has been developed to easily exploit a dangerous flaw in 75 percent of Android devices that allows attackers to hijack a users open websites. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open… *** Attackers tapping on SNMP door to see if its open *** --------------------------------------------- SANS spots new, dumb attack Googles DNS IP address is being spoofed by an attacker, apparently in an attempt to DDoS hosts vulnerable to a flaw in the SNMP protocol. --------------------------------------------- http://www.theregister.co.uk/2014/09/16/attackers_tapping_on_snmp_door_to_s… *** Kindle durch versteckte Codes in E-Books gefährdet *** --------------------------------------------- Durch eine Sicherheitslücke im E-Reader Kindle können Angreifer an die Daten von Amazon-Kunden gelangen. Die Lücke tritt zum zweiten Mal auf. --------------------------------------------- http://futurezone.at/digital-life/kindle-durch-versteckte-codes-in-e-books-… *** Encrypt-then-MAC für TLS standardisiert *** --------------------------------------------- Eine neue TLS-Erweiterung ermöglicht es, die Reihenfolge zwischen Authentifizierung und Verschlüsselung zu ändern. Die bisherige Methode führte zu Sicherheitsproblemen wie der Lucky-Thirteen-Attacke. ... Gegen die Lucky-Thirteen-Attacke wurden Workarounds in die gängigen Browser und TLS-Bibliotheken eingebaut, aber trotzdem gab es den Wunsch, das Problem generell zu beheben. --------------------------------------------- http://www.golem.de/news/verschluesselung-encrypt-then-mac-fuer-tls-standar… *** Ungestopftes Datenleck in Androids Open-Source-Browser *** --------------------------------------------- Eine Lücke im AOSP-Browser von Android erlaubt es Webseiten die Daten anderer Seiten auszulesen. Die App wird in fast allen Android-Versionen vor Kit Kat mitgeliefert und dient vielen Custom-ROMs ebenfalls als Standard-Browser. --------------------------------------------- http://www.heise.de/security/meldung/Ungestopftes-Datenleck-in-Androids-Ope… *** AppLock Vulnerability Leaves Configuration Files Open for Exploit *** --------------------------------------------- We have previously discussed about certain file locker apps that fail to do hide files properly. We recently came across yet another file locker app, AppLock, which has the same issue. However, the vulnerability concerning this app goes beyond improperly hiding files - the vulnerability can .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/applock-vulnerab… *** Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account *** --------------------------------------------- At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the .. --------------------------------------------- http://thehackernews.com/2014/09/twitter-vulnerability-allows-hacker-to_16.… *** Metasploit gems from scratch *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/09/16/metasploi…

1 0

Tageszusammenfassung - Montag 15-09-2014
by Daily end-of-shift report 15 Sep '14

15 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-09-2014 18:00 − Montag 15-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Squid Off-by-One in snmpHandleUdp() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can send a specially crafted UDP SNMP packet to trigger an off-by-one memory error in snmpHandleUdp() and potentially execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030838 *** Rooted SSH/SFTP Daemon Default Login Credentials *** --------------------------------------------- The software comes pre-configured with a default login of User: root Password: abc123. This weak password would easily be guessed leading to root compromise of the android system. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090066 *** WordPress Photo Album Plus 5.4.4 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090061 *** Malware 'Eskimo' hat es auf Steam-Konten abgesehen *** --------------------------------------------- Die Schadsoftware wird hauptsächlich im Twitch-Chat verbreitet - Guthaben sowie Items werden nach Hack übertragen --------------------------------------------- http://derstandard.at/2000005543386 *** IRC: Chatnetzwerk Freenode gehackt *** --------------------------------------------- Die Betreiber des IRC-Netzwerks Freenode haben eine Kompromittierung ihrer Server festgestellt. Alle Nutzer sollten vorsorglich ihr Passwort ändern. --------------------------------------------- http://www.golem.de/news/irc-chatnetzwerk-freenode-wurde-gehackt-1409-10923… *** Multiple vulnerabilities in IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_pureapplication_s… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Trustwave.com: 2014 Business Password Analysis *** --------------------------------------------- We set out to determine how easily we could crack a sample of 626,718 hashed passwords we collected during thousands of network penetration tests performed in 2013 and some performed in 2014. ... We recovered more than half of the passwords within just the first .. --------------------------------------------- https://gsr.trustwave.com/topics/business-password-analysis/2014-business-p… *** Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls *** --------------------------------------------- Moodle Bugs Let Remote Users Obtain Potentially Sensitive Information and Bypass Security Controls --------------------------------------------- http://www.securitytracker.com/id/1030839 *** Hacking Canon Pixma Printers - Doomed Encryption *** --------------------------------------------- This blog post is another in the series demonstrating current insecurities in devices categorised as the 'Internet of Things'. This instalment will reveal how the firmware on Canon Pixma printers (used in the home and by SMEs) can be modified from the Internet to run custom code. ... For demonstration purposes I decided to get Doom running on the printer (Doom as in the classic 90s computer game). --------------------------------------------- http://www.contextis.co.uk/resources/blog/hacking-canon-pixma-printers-doom… *** Bugtraq: Open-Xchange Security Advisory 2014-09-15 *** --------------------------------------------- http://www.securityfocus.com/archive/1/533443 *** [Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered *** --------------------------------------------- Our web honeypots picked up some interesting attack traffic. The initial web application attack vector (PHP-CGI vulnerability) is not new, the malware payload is. We wanted to get this information out to the community quickly due to the following combined threat elements - Active exploit attempts to upload/install the malware The overall low detection rates among AV vendors The malware is actively being sold in underground .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/honeypot-alert-bossabotv2-irc-botnetbitc…

1 0

Tageszusammenfassung - Freitag 12-09-2014
by Daily end-of-shift report 12 Sep '14

12 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-09-2014 18:00 − Freitag 12-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Hacker publishes tech support phone scammer slammer *** --------------------------------------------- Security pro Matthew Weeks has released a Metasploit module that can take over computers running the Ammyy Admin remote control software popular among "Hi this is Microsoft, theres a problem with your computer" tech support scammers. Weeks day job is director at Root9b, but hes taken time to detail a zero-day flaw in Ammyy Admin he hopes will be used to fight back against tech support scammers. --------------------------------------------- http://www.theregister.co.uk/2014/09/12/phone_scammer_slammer/ *** Cisco Unified Communications Manager glibc Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the GNU C library of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, local attacker to input crafted data to cause a heap-based buffer overflow. The vulnerability is due to incorrect sanitization of data. An attacker could exploit this vulnerability by setting an environment variable to a malicious value. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Schneider Electric VAMPSET Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Schneider Electric's VAMPSET software product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-254-01 *** Ecava Integraxor SCADA Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Ecava Integraxor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-224-01 *** Linux Kernel logi_dj_recv_destroy_djhid_device buffer overflow *** --------------------------------------------- Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the logi_dj_recv_destroy_djhid_device function. By sending an overly long string, a local attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95928 *** DNS cache poisoning used to steal emails *** --------------------------------------------- Does this happen in practice? CERT/CC researchers Jonathan Spring and Leigh Metcalf have evidence to suggest that it does. Using passive DNS data, they found a number of incorrect responses for A records belonging to mail servers of the big three webmail providers (Gmail, Yahoo! and Hotmail). Even though an increasing number of emails are sent over encrypted connections (using STARTTLS), there isnt really a way for the receiving mail server to enforce this, as HSTS does for secure HTTP --------------------------------------------- https://www.virusbtn.com/blog/2014/09_12.xml?rss *** Multiple security bulletins for IBM products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Donnerstag 11-09-2014
by Daily end-of-shift report 11 Sep '14

11 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-09-2014 18:00 − Donnerstag 11-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** iOS 8 stopft Hintertüren weitestgehend *** --------------------------------------------- Apple hat die für Diagnosezwecke gedachten Systemdienste in iOS 8 grösstenteils abgeschottet, berichtet ein Sicherheitsforscher. Bislang lassen sich darüber zahlreiche Nutzerdaten auslesen. --------------------------------------------- http://www.heise.de/security/meldung/iOS-8-stopft-Hintertueren-weitestgehen… *** Multiple vulnerabilities in Juniper products *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10646 http://kb.juniper.net/index?page=content&id=JSA10645 http://kb.juniper.net/index?page=content&id=JSA10647 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-4762; CVE-2014-4792) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Apache Warns of Tomcat Remote Code Execution Vulnerability *** --------------------------------------------- Some older versions of Apache Tomcat, the company's open source web server and servlet container, are vulnerable to remote code execution. --------------------------------------------- http://threatpost.com/apache-warns-of-tomcat-remote-code-execution-vulnerab… *** IBM Security Bulletin: Administrator password can be reset without authentication on SAN Volume Controller and Storwize Family (CVE-2014-4811) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** AIX OpenSSL Denial of Service due to double free *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_openssl_denial_of… *** Cisco Unified Communications Manager GLIBC Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco TelePresence System MXP Series Software Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure *** --------------------------------------------- Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerce_order module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered .. --------------------------------------------- https://www.drupal.org/node/2336357 *** Oracle MySQL Server MyISAM code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95881 *** Swiss economy makes online security its priority *** --------------------------------------------- Switzerland is one of the safest countries in the world. To make also the Internet a secure place in Switzerland, the Swiss online economy has started the Swiss Internet .. --------------------------------------------- http://securityblog.switch.ch/2014/09/11/swiss-economy-makes-online-securit… *** SHA1 deprecation: what you need to know *** --------------------------------------------- The news is that SHA1, a very popular hashing function, is on the way out. Strictly speaking, this development is not new. The first signs of weaknesses in SHA1 appeared (almost) ten years ago. In 2012, some calculations showed how breaking SHA1 is becoming feasible for those who can afford it. In November 2013, Microsoft announced that they wouldnt be accepting SHA1 certificates after 2016. --------------------------------------------- http://blog.ivanristic.com/2014/09/sha1-deprecation-what-you-need-to-know.h… *** Tabnabbing: A New Type of Phishing Attack *** --------------------------------------------- Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site. What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise. --------------------------------------------- http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/ *** Sicherheitslücke in vielen WordPress-Themes *** --------------------------------------------- Ein Fehler im beliebten Plug-in Slider Revolution erlaubt es, beliebige Dateien vom Webserver herunterzuladen. Damit kann ein Angreifer im schlimmsten Fall den ganzen Server kompromittieren. Das Plug-in ist in einer grossen Zahl von Themes fest verbaut. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-vielen-WordPress-… *** A system that facilitates malware identification in smartphones *** --------------------------------------------- The tool, developed by these UC3M researchers, baptized DENDROID and detailed in a study published in the review Expert Systems with Applications, allows security analysts to scrutinize a large quantity of apps to determine the origins of a malware sample and the family to which it belongs. --------------------------------------------- http://www.alphagalileo.org/ViewItem.aspx?ItemId=145206 *** Home Articles PCI Updates Skimming Prevention Guide - Best Practices for Protecting Merchants from POS Attacks *** --------------------------------------------- At a time when retailers are seeing a surge in point-of-sale breaches, The PCI Security Standards Council has released an update to its guidance for merchants on protecting against card skimming attacks in POS environments. --------------------------------------------- http://www.bankinfosecurity.co.uk/pci-updates-skimming-prevention-guide-a-7… *** Key Flaw Enables Recovery of Files Encrypted by TorrentLocker *** --------------------------------------------- Crypto ransomware, a relatively unknown phenomenon a couple of years ago, has exploded into one of the nastier malware problems for Internet users. Variants such as CryptoLocker and CryptoWall have been siphoning money from victims for some time, and now researchers have dissected a newer .. --------------------------------------------- http://threatpost.com/key-flaw-enables-recovery-of-files-encrypted-by-torre…

1 0

Tageszusammenfassung - Mittwoch 10-09-2014
by Daily end-of-shift report 10 Sep '14

10 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-09-2014 18:00 − Mittwoch 10-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB14-21) *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions ... CVE-2014-0547, CVE-2014-0548, CVE-2014-0549, CVE-2014-0550, CVE-2014-0551, CVE-2014-0552, CVE-2014-0553, CVE-2014-0554, CVE-2014-0555, CVE-2014-0556, CVE-2014-0557, CVE-2014-0559 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb14-21.html *** Assessing risk for the September 2014 security updates *** --------------------------------------------- Today we released four security bulletins addressing 42 unique CVE's. One bulletin has a maximum severity rating of Critical and the other three have maximum severity Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-se… *** MSRT September 2014 - Zemot *** --------------------------------------------- This month we added the Win32/Zemot family to the Malicious Software Removal Tool. The Zemot family of trojan downloaders are frequently used by malware with a number of different payloads. We started seeing activity from TrojanDownloader:Win32/Upatre.B in late 2013 and identified this threat as the main distributor of the click fraud malware PWS:Win32/Zbot.gen!AP and PWS:Win32/Zbot.CF. We renamed the downloader to Zemot in May 2014. Recently, other malware such as Win32/Rovnix, --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/09/msrt-september-2014-zemo… *** Microsoft IIS Web Server - CMD Process Contributing to Website Reinfections *** --------------------------------------------- We often spend a lot of time talking about application level malware, but from time to time we do like to dabble in the ever so interesting web server infections as well. It is one of those things that comes with the job. Today, we're going to chat about an interesting reinfection case in which the client was running their website on a Microsoft's Internet Information Services (IIS) web server. Yes, contrary to popular belief many organizations, especially large enterprise --------------------------------------------- http://blog.sucuri.net/2014/09/microsof-iis-web-server-cmd-process-contribu… *** VMware vSphere product updates to third party libraries *** --------------------------------------------- The Apache Struts library is updated to address a security issue. This issue may lead to remote code execution after authentication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2014-0114 to this issue. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0008.html *** The September 2014 issue of our SWITCH Security Report is available! *** --------------------------------------------- A new issue of our monthly SWITCH Security Report has just been released. Topics: - Inside information on government Trojans used internationally published on Twitter - Page not found: Network blocking in in Switzerland and neighbouring countries - Breaking bad - malvertising ransomware: ZeroLocker / CryptoLocker / CryptoWall / SynoLocker - Canvas or cookies - choosing between Scylla and Charybdis - The Clipboard: Interesting presentations, articles and videos --------------------------------------------- http://securityblog.switch.ch/2014/09/10/the-september-2014-issue-of-our-sw…

1 0

Tageszusammenfassung - Dienstag 9-09-2014
by Daily end-of-shift report 09 Sep '14

09 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-09-2014 18:00 − Dienstag 09-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Cisco Unified Computing System E-Series Blade Servers Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. The vulnerability is due to a failure to properly handle a crafted SSH packet. An attacker could exploit this vulnerability by sending a crafted packet to the SSH server running on the Cisco IMC of an affected device, which could result in the Cisco IMC becoming unresponsive. The operating system running on the blade will be unaffected. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software DHCPv6 Denial Of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the DHCPv6 server process on an affected device to crash. The vulnerability is due to incorrect handling of malformed DHCPv6 packets. An attacker could exploit this vulnerability by sending a malformed DHCPv6 packet to an affected device configured with DHCPv6 server functionality. An exploit could allow the attacker to cause the DHCPv6 process on the device to crash. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netgear ProSafe Plus Configuration Utility information disclosure *** --------------------------------------------- Netgear ProSafe Plus Configuration Utility could allow a remote attacker to obtain sensitive information, caused by the storing of passwords in plaintext within the backup file. An attacker could exploit this vulnerability using the configuration backup file to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95780 *** Researchers reveal security issues in Android apps *** --------------------------------------------- On Monday, the University of New Haven revealed its first video in a series of security findings. --------------------------------------------- http://www.scmagazine.com/researchers-reveal-security-issues-in-android-app… *** Why Google Is Pushing For a Web Free of SHA-1 *** --------------------------------------------- An anonymous reader writes: Google recently announced Chrome will be gradually phasing out support for certificates using SHA-1 encryption. They said, "We need to ensure that by the time an attack against SHA-1 is demonstrated publicly, the web has already moved away from it." Developer Eric Mill has written up a post explaining why SHA-1 is dangerously weak, and why moving browsers away from acceptance of SHA-1 is a lengthy, but important process. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ME5Z29v_gGw/story01.htm *** Salesforce: Oh no! Dyre RATs are thirsty for our customers logins *** --------------------------------------------- But attacks werent the cause of server outage, were told Salesforce has warned that miscreants are trying to infect its customers with a remote access trojan (RAT) dubbed Dyre that siphons off Salesforce.com login data. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/08/salesforcec… *** H1 2014 Threat Report *** --------------------------------------------- Our latest Threat Report is now available. The report includes our statistics, incidents calendar and threatscape summaries for H1(Q1+Q2) 2014. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002741.html *** QEMU VGA Emulator Bug Lets Local Guest Users Obtain Potentially Sensitive Information from the Host System *** --------------------------------------------- Description: A vulnerability was reported in QEMU. A local user on a guest system can obtain potentially sensitive information from the host system. A guest system Graphics Output Protocol driver can set a high resolution to trigger a flaw in the VGA emulator and obtain host memory contents. Impact: A local user on a guest system can obtain potentially sensitive information from the host system memory. --------------------------------------------- http://www.securitytracker.com/id/1030817 *** Enigmail PGP plugin forgets to encrypt mail sent as blind copies *** --------------------------------------------- User now waiting for the bad guys come and get me with their water-boards Enigmail has patched a hole in the worlds most popular PGP email platform that caused mail to be sent unencrypted when all security check boxes were ticked. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/09/09/enigmail_en… *** Kaspersky Internet Security Android App Certificate Validation Flaw Lets Remote Users Spoof Servers *** --------------------------------------------- A vulnerability was reported in Kaspersky Internet Security app for Android. A remote user can spoof servers. The application (com.kms.free) does not verify X.509 certificates from SSL servers. A remote user with the ability conduct a man-in-the-middle attack can supply a specially crafted certificate to spoof an SSL server obtain or modify sensitive information --------------------------------------------- http://www.securitytracker.com/id/1030815 *** OpenSSL Security Policy *** --------------------------------------------- Recent flaws have captured the attention of the media and highlighted how much of the internet infrastructure is based on OpenSSL. Weve never published our policy on how we internally handle security issues; that process being based on experience and has evolved over the years. --------------------------------------------- https://www.openssl.org/about/secpolicy.html *** 'Google Dorking' - Waking Up Web Admins Everywhere *** --------------------------------------------- Last July, the US Department of Homeland Security warned of a new kind of criminal attack: 'Google dorking'. This refers to asking Google for things they have found via special search operators. Let's look closely and see what this is. Google finds things online using a program that accesses web sites: the Google web crawler, called ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/DdLfN3jTMhw/ *** How a DNS Sinkhole Can Protect Against Malware *** --------------------------------------------- The Domain Name Service (DNS) is an integral part of Internet access. It translates human-recognized domain names into computer-readable IP addresses in order to facilitate online communication and connection between devices. ... And one of the best ways to gain control is via DNS itself, in order to disrupt malware transmission at the very point of connection. A DNS sinkhole, or sinkhole server, gives organizations this control in order to prevent internal access to malicious websites. --------------------------------------------- http://resources.infosecinstitute.com/dns-sinkhole-can-protect-malware/ *** Threat Spotlight: 'Kyle and Stan' Malvertising Network Threatens Windows and Mac Users With Mutating Malware *** --------------------------------------------- Once the victim gets redirected to the final URL, the website automatically starts the download of a unique piece of malware for every user. The file is a bundle of legitimate software, like a media-player, and compiles malware and a unique-to-every-user configuration into the downloaded file. The attackers are purely relying on social engineering techniques, in order to get the user to install the software package. No drive-by exploits are being used thus far. --------------------------------------------- https://blogs.cisco.com/security/kyle-and-stan/ *** Modern anti-spam and E2E crypto *** --------------------------------------------- ... asked me to write up some thoughts on how spam filtering and fully end to end crypto would interact, so its all available in one message instead of scattered over other threads. Specifically he asked for brain dumps on: - how does antispam currently work at large email providers - how would widespread E2E crypto affect this - what are the options for moving things to the client (and pros, cons) - is this feasible for email? --------------------------------------------- https://moderncrypto.org/mail-archive/messaging/2014/000780.html *** Research Finds No Large Scale Heartbleed Exploit Attempts Before Vulnerability Disclosure *** --------------------------------------------- In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations - perhaps the NSA - that had known about the bug for some time and had been using it for targeted attacks. A definitive answer to that question may never come, but ... --------------------------------------------- http://threatpost.com/research-finds-no-large-scale-heartbleed-exploit-atte… *** UPDATE: Upcoming Security Updates for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- UPDATE: The security update for Adobe Reader and Acrobat has been re-scheduled from September 9, 2014 to the week of September 15, 2014. This delay was necessary to address issues identified during routine regression testing. --------------------------------------------- http://blogs.adobe.com/psirt/?p=1121

1 0

Tageszusammenfassung - Montag 8-09-2014
by Daily end-of-shift report 08 Sep '14

08 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-09-2014 18:00 − Montag 08-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Apple IDs targeted by Kelihos botnet phishing campaign *** --------------------------------------------- Botnet targets Apple customers, launching phishing email campaign to lure victims into disclosing their Apple IDs and passwords. Days after numerous celebrities were found to have their iCloud accounts compromised, a major botnet has turned its attention to Apple customers, launching a phishing email campaign .. --------------------------------------------- http://www.symantec.com/connect/blogs/apple-ids-targeted-kelihos-botnet-phi… *** USB firmware: An upcoming threat for home and enterprise users *** --------------------------------------------- Every year, thousands of hackers and security researchers from around the world descend on Las Vegas to attend the annual Black Hat security conference. The conference boasts top notch security presentations from industry leaders - often centered on breaking computer security. Although many of the presentations are on breaking things, most of the .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/09/02/usb-firmware-an-upcoming… *** Stupid Spammer Tricks - Reversing Characters *** --------------------------------------------- Spammers engaged in phishing attacks constantly try to get their emails past spam filters. They try many different tactics, and these can include taking advantage of HTML coding characteristics. These HTML tricks can make the email look normal when rendered in a mail client, but the actual .. --------------------------------------------- http://blog.spiderlabs.com/2014/09/stupid-spammer-tricks-reversing-characte… *** Mozilla 1024-Bit Cert Deprecation Leaves 107,000 Sites Untrusted *** --------------------------------------------- Mozilla has deprecated 1024-bit RSA certificate authority certificates in Firefox 32 and Thunderbird. While there are pluses to the move such as a requirement for longer, stronger keys, at least 107,000 websites will no longer be trusted by Mozilla. Data from HD Moores Project Sonar, which .. --------------------------------------------- http://it.slashdot.org/story/14/09/05/2120246/mozilla-1024-bit-cert-depreca… *** Cisco Integrated Management Controller SSH Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Integrated Management Controller (Cisco IMC) SSH module of the Cisco Unified Computing System E-Series Blade servers could allow an unauthenticated, remote attacker to cause a denial of service condition. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Nuclear Exploit Kit and Flash CVE-2014-0515 *** --------------------------------------------- For this blog, wed like to walk you through a recent attack involving Nuclear Exploit Kit (EK) that we analyzed. It was found leveraging CVE-2014-0515, a buffer overflow in Adobe Flash Player discovered in April 2014. Nuclear Exploit kit .. --------------------------------------------- http://research.zscaler.com/2014/09/nuclear-exploit-kit-and-flash-cve-2014.… *** WPS-Sicherheitslücke: Wahrscheinlich wenige Router betroffen *** --------------------------------------------- Auf Anfrage von heise Netze haben sich einige Hersteller von in Deutschland verbreiteten Routern zur Sicherheitslücke in WPS-PIN geäussert, bei der sich die Zugangsnummer offline errechnen lässt. --------------------------------------------- http://www.heise.de/security/meldung/WPS-Sicherheitsluecke-Wahrscheinlich-w… *** Popular Photo Sharing Website Likes.com Vulnerable To Multiple Critical Flaws *** --------------------------------------------- Likes.com, one of the emerging social networking site and popular image browsing platform, is found vulnerable to several critical vulnerabilities that could allow an attacker to completely delete users' account in just one click. Likes.com is a social networking website that helps you to connect .. --------------------------------------------- http://thehackernews.com/2014/09/popular-photo-sharing-website.html *** Demasking Google Users With a Timing Attack *** --------------------------------------------- A 3rd party site can determine if a website viewer has access to a particular Google Drive document. ... How it works: The attack is straightforward. A malicious page repeatedly instantiates an image whose source points at the URL of a Google Drive document. If that document is viewable by the .. --------------------------------------------- http://blog.andrewcantino.com/blog/2014/09/04/demasking-google-users-with-a… *** Bugtraq: [security bulletin] HPSBUX03102 SSRT101681 rev.1 - HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Execution of Arbitrary Code and Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533370 *** iCloud: Apple verschickt neue Warnhinweise *** --------------------------------------------- Nach den aus iCloud-Accounts entwendeten Promi-Nacktfotos hat Apple damit begonnen, neue Benachrichtigungen zu versenden, wenn auf den Cloud-Dienst zugegriffen wird. Weitere Schutzfunktionen sind angekündigt. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Apple-verschickt-neue-Warnhinwe…

1 0

Tageszusammenfassung - Freitag 5-09-2014
by Daily end-of-shift report 05 Sep '14

05 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-09-2014 18:00 − Freitag 05-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 5 things you should know about email unsubscribe links before you click *** --------------------------------------------- We all get emails we don't want and cleaning them up can be as easy as clicking unsubscribe at the bottom of the email. However, some of those handy little links can cause more trouble than they solve. --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/04/5-things-you-should-know-about-e… *** Google acceleration of SHA-1 deprecation draws resistance *** --------------------------------------------- Google said Chrome 39, to be released within 12 weeks, will treat some sites as untrusted, accelerating the transition and user woes. --------------------------------------------- http://www.scmagazine.com/google-acceleration-of-sha-1-deprecation-draws-re… *** Fresh phish served with a helping of AES *** --------------------------------------------- Attempts to use encryption to make analysis of phishing websites more difficult may be a sign of things to come. Obfuscated phishing sites are nothing new. Various techniques such as JavaScript encryption tools (which offer very primitive obfuscation), data URIs (where the page content is mostly Base64-encoded), and .. --------------------------------------------- http://www.symantec.com/connect/blogs/fresh-phish-served-helping-aes *** Researchers discover two SQL injection flaws in WordPress security plugin *** --------------------------------------------- High-Tech Bridge discovered two SQL injection vulnerabilities in All In One WordPress Security and Firewall plugin and notified the vendor. --------------------------------------------- http://www.scmagazine.com/researchers-discover-two-sql-injection-flaws-in-w… *** Malware Bypasses Chrome Extension Security Feature *** --------------------------------------------- Originally created to extend a browser's functionality, browser extensions have become yet another tool for cybercriminals' schemes. Earlier this year, Google has addressed the issue of malicious browser extensions by .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malware-bypasses… *** Red Hat Enterprise Virtualization Manager 3.4.2 update *** --------------------------------------------- It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the .. --------------------------------------------- https://rhn.redhat.com/errata/RHSA-2014-1161.html *** Microsoft Security Bulletin Advance Notification for September 2014 *** --------------------------------------------- This is an advance notification of security bulletins that Microsoft is intending to release on September 9, 2014. ... The following table summarizes the security bulletins for this month in order of severity. Bulletin 1.. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-SEP *** renotification Security Advisory for Adobe Reader and Acrobat (APSB14-20) *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, September 9, 2014 for Adobe Reader and Acrobat for Windows and Macintosh .. --------------------------------------------- http://helpx.adobe.com/security/products/reader/apsb14-20.html *** Apple verspricht mehr Sicherheit nach Hacker-Angriff *** --------------------------------------------- Apple-Nutzer sollen künftig über Versuche zur Passwortänderung informiert werden, um Datendiebstahl zu verhindern. --------------------------------------------- http://futurezone.at/digital-life/apple-verspricht-mehr-sicherheit-nach-hac… *** Apache POI 3.10.1-20140818 security issues with OOXML *** --------------------------------------------- The Apache POI project is pleased to announce the release of POI 3.10.1-20140818. This release is a bugfix release to fix two... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090022 *** Security of Password Managers *** --------------------------------------------- At USENIX Security this year there were two papers studying the security of password managers: David Silver, Suman Jana, and Dan Boneh, "Password Managers: Attacks and Defenses." Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song, "The Emperors New Password Manager: Security Analysis of Web-based Password Managers." Its interesting work, especially because it looks at security problems in something that .. --------------------------------------------- https://www.schneier.com/blog/archives/2014/09/security_of_pas.html *** BankAPI - What is it? *** --------------------------------------------- BankAPI is a secure decentralized messaging system to send files/messages between banks and other types of financial institutions. There is a reference implementation of the protocol which can be used off-the-shelf, which is production grade quality and is not only for testing and demonstration, although it .. --------------------------------------------- https://github.com/trustly/bankapi/ *** Remote-Code-Execution-Lücke in F5 BigIP *** --------------------------------------------- Im Hochverfügbarkeits-Modus wiesen die Load-Balancer der Firma F5 ein Sicherheitsproblem auf, das Angreifern die volle Kontrolle über das System ermöglicht. Der Hersteller bessert nach. --------------------------------------------- http://www.heise.de/security/meldung/Remote-Code-Execution-Luecke-in-F5-Big…

1 0

Tageszusammenfassung - Donnerstag 4-09-2014
by Daily end-of-shift report 04 Sep '14

04 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-09-2014 18:00 − Donnerstag 04-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Paper: Prosecting the Citadel botnet - revealing the dominance of the Zeus descendent: part one *** --------------------------------------------- Aditya K. Sood and Rohit Bansal dissect botnet primarily used for financial fraud.It is unlikely that anyone still thinks that cybercrime is performed by 16-year-old kids who write short pieces of code that wreak havoc all over the world, but if you do still hold that belief, it wont hurt to take a look behind the scenes of a modern botnet operation. Todays botnets show how cybercrime has become a professional industry in which many tactics seen in the legitimate e-commerce and IT service --------------------------------------------- http://www.virusbtn.com/blog/2014/09_03.xml *** [webapps] - vBulletin 4.0.x - 4.1.2 (search.php, cat param) - SQL Injection Exploit *** --------------------------------------------- http://www.exploit-db.com/exploits/34526 *** WordPress Plugins Bogged Down with CSRF, XSS Vulnerabilities *** --------------------------------------------- A handful of bugs, mostly XSS and CSRF vulnerabilities, have been plaguing at least eight different Wordpress plugins as of late. --------------------------------------------- http://threatpost.com/wordpress-plugins-bogged-down-with-csrf-xss-vulnerabi… *** CERT/CC Enumerates Android App SSL Validation Failures *** --------------------------------------------- The CERT Coordination Center at Carnegie Mellon today released a list of Android applications hosted on Google Play and Amazon that it says fail to validate SSL certificates over HTTPS. --------------------------------------------- http://threatpost.com/certcc-enumerates-android-app-ssl-validation-failures… *** Splunk Enterprise 6.0.6 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.0.6 addresses the following vulnerabilities: OpenSSL TLS protocol downgrade attack (SPL-88587, CVE-2014-3511) Reflective cross-site scripting (XSS) referer header vulnerability (SPL-85360) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk .. --------------------------------------------- http://www.splunk.com/view/SP-CAAANE2 *** Identifying Firewalls from the Outside-In. Or, "Theres Gold in them thar UDP ports!", (Thu, Sep 4th) *** --------------------------------------------- In a penetration test, often the key to bypassing a security control is as simple as knowing identifying the platform its implemented on. In other words, its a lot easier to get past something if you know what it is. For instance, quite often youll be probing a set of perimeter addresses, and if there are no vulnerable hosts NAT-ed out for you, you might start .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18617 *** Mozilla Firefox <v32 Secret Leak PoC *** --------------------------------------------- Depending on a variety of factors, problems like that may leak secrets across web origins, or more prosaically, may help attackers bypass security measures such as ASLR. This code is a proof of concept for versions prior to 32. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090017 *** heap overflow in procmails formail utility *** --------------------------------------------- prcomails formail utility is vulnerable to a heap-based buffer overflow, caused by improper bounds checking when parsing addresses with unbalanced quotes. By sending an overly long argument, a remote attacker could overflow a buffer .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95688 *** Kostenloses G-Data-Tool schützt vor BadUSB-Angriffen *** --------------------------------------------- Der G Data USB Keyboard Guard kontrolliert neu an den PC angeschlossene Tastaturen. Der Anwender kann damit entscheiden, ob er diese tatsächlich benutzen will oder ob er einen Angriff befürchtet und das Gerät lieber aussperrt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Kostenloses-G-Data-Tool-schuetzt-vor… *** Akamai warnt vor Linux-Server-Botnet *** --------------------------------------------- Mit einer Sicherheitswarnung mit "Risikofaktor: Hoch" warnt Netzwerk-Spezialist Akamai vor einem Botnetz aus Linux-Servern, das verteilte DoS-Attacken durchführt, um andere Server in die Knie zu zwingen. --------------------------------------------- http://www.heise.de/security/meldung/Akamai-warnt-vor-Linux-Server-Botnet-2… *** zAnti - Android Penetration Testing Toolkit (Free!) *** --------------------------------------------- zANTI is a comprehensive network diagnostics toolkit that enables complex audits and penetration tests at the push of a button. It provides cloud-based reporting that walks you through simple guidelines to ensure network safety. zANTI offers a comprehensive range of fully customizable scans to reveal everything from authentication, backdoor and brute-force attempts to database, DNS and protocol-specific attacks - including rogue access points. --------------------------------------------- http://hack-tools.blackploit.com/2014/09/zanti-android-penetration-testing.… *** New file-encrypting ransomware called CryptoGraphic Locker *** --------------------------------------------- A new file-encrypting ransomware was discovered today by BartBlaze called CryptoGraphic Locker. Just like other encrypting ransomware, this infection will scan your your data files and encrypt them so that they are unusable. The infection will then display a ransom note that requires you to purchase .. --------------------------------------------- http://www.bleepingcomputer.com/forums/t/546749/new-file-encrypting-ransomw… *** Apple OS X: Security Through Obscurity is becoming an Absurdity *** --------------------------------------------- Today's blog on a new Mac malware is a reminder that attackers go where the money is. Apple usage within the enterprise is growing rapidly, with 52 percent of newly issued computers being Macs according to Forrester. Forrester also .. --------------------------------------------- http://www.fireeye.com/blog/corporate/2014/09/apple-os-x-security-through-o… *** Forced to Adapt: XSLCmd Backdoor Now on OS X *** --------------------------------------------- Introduction FireEye Labs recently discovered a previously unknown variant of the APT backdoor XSLCmd - OSX.XSLCmd - which is designed to compromise Apple OS X systems. This .. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2014/09/forced-to-ad… *** VU#855836: Arris Touchstone cable modem information leakage vulnerabiliity *** --------------------------------------------- Arris Touchstone DG950A cable modem enables SNMP public access by default. Description CWE-200 - Information ExposureThe Arris Touchstone DG950A cable modem running software version 7.10.131 was found to expose sensitive .. --------------------------------------------- http://www.kb.cert.org/vuls/id/855836 *** Semalt botnet hijacked nearly 300k computers *** --------------------------------------------- The "Semalt" botnet is quickly spreading across the Internet, Incapsula researchers warn. The botnet is named after a Ukrainian startup that poses as a legitimate online SEO service, and it currently numbers around 290,000 malware infected machines that continually spam millions of websites in a large-scale, referrer spam campaign. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2857

1 0

Tageszusammenfassung - Mittwoch 3-09-2014
by Daily end-of-shift report 03 Sep '14

03 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-09-2014 18:00 − Mittwoch 03-09-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Bugtraq: Defense in depth -- the Microsoft way (part 18): Microsoft Office 2010 registers command lines with unquoted pathnames *** --------------------------------------------- Microsoft Office 2010 registers the following command lines with unquoted pathnames containing spaces for various supported file types: --------------------------------------------- http://www.securityfocus.com/archive/1/533317 *** Quick Analysis of a DDoS Attack Using SSDP *** --------------------------------------------- Last week, one of our many clients came under an interesting attack. Enough that it was flagged for human intervention. The interesting aspect of the case was that it was a multi-faceted DDoS attack. The first issue we noticed was a Layer 7, HTTP Flood Attack, Distributed Denial of Service (DDoS) attack ... --------------------------------------------- http://blog.sucuri.net/2014/09/quick-analysis-of-a-ddos-attack-using-ssdp.h… *** New international cybercrime unit, J-CAT, launches pilot program *** --------------------------------------------- A new European cybercrime organization, the Joint Cybercrime Action Taskforce (J-CAT), announced the launch of its six-month pilot program yesterday. The group will investigate global cybercrime threats and targets, according to a release. The Federal Bureau of Investigation (FBI) and the U.K.'s National Crime Agency (NCA) have partnered up to create the unit. Other countries, including Canada and Australia, have signed on to the initiative. --------------------------------------------- http://www.scmagazine.com/new-international-cybercrime-unit-j-cat-launches-… *** ShadowServer Scans Confirm Scale of Netis Threat *** --------------------------------------------- Our friends at the ShadowServer Foundation are now scanning for the Netcore/Netis router backdoor which we found in August. Their findings are in line with what we published then: that the vast majority of those affected in China, with more than a million scanned IP addresses currently affected by this threat. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CSrl4YNzdgE/ *** Firefox 32 released, time to update *** --------------------------------------------- Firefox 32 released, time to update - now with support for Public Certificate Pinning. Release notes here: https://www.mozilla.org/en-US/firefox/32.0/releasenotes/ --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18609&rss *** IBM Security Bulletin: Missing access restriction on service types in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (CVE-2014-4758) *** --------------------------------------------- When invoking a service using the callService URL, there is no access restriction based on the service type and services that were meant for internal use only are available for authenticated users. CVE(s): CVE-2014-4758 Affected product(s) and affected version(s): IBM Business Process Manager Standard V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Express V7.5.x, 8.0.x 8.5.x IBM Business Process Manager Advanced V7.5.x, 8.0.x 8.5.x IBM WebSphere Lombardi Edition V7.2.x --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Mozilla Firefox for Android file: Protocol Lets Remote Users Obtain Potentially Sensitive Information in Certain Cases *** --------------------------------------------- A vulnerability was reported in Mozilla Firefox for Android. A remote user can obtain potentially sensitive information from the target user's system in certain cases. A remote user can create a specially crafted 'file:' URL that, when loaded by the target user, will access a local file in the Firefox profile directory and copy the data to the SD card without user intervention. A local application can then access the data. --------------------------------------------- http://www.securitytracker.com/id/1030792 *** LogAnalyzer 3.6.5 Cross Site Scripting *** --------------------------------------------- It was found that an XSS injection is possible on a syslog server running LogAnalyzer version 3.6.5. by changing the hostname of any entity logging to syslog server with LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary syslog message, a client-side script injection execution is possible. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014090008 *** Exploit PHP's mail() to get remote code execution *** --------------------------------------------- While searching around the web for new nifty tricks I stumbled across this post about how to get remote code exeution exploiting PHP's mail() function. First, I must say that this is only going to happen under some really rare circustances. Never the less, it's really something to think about and keep an eye out for. I will explain an example scenario which I think could be a real life scenario later in this article. --------------------------------------------- http://securitysucks.info/exploit-phps-mail-to-get-remote-code-execution/ *** Tests compare Mac OS X anti-malware products *** --------------------------------------------- Every day, independent test lab AV-TEST.org captures more than 400,000 new malware samples for Windows and 5,000 new samples for Android. For the Mac they identify less than 100 per month. But there is malware out there for the Mac and it does hit users in the real world, if less often and less intensely than on the PC. ... Thats why AV-TEST just completed a test of 18 products in this space --------------------------------------------- http://www.zdnet.com/tests-compare-mac-os-x-anti-malware-products-700003317… *** Xen Project Maintenance Releases Available (Versions 4.4.1, 4.3.3, 4.2.5) *** --------------------------------------------- Vulnerabilities fixed: Xen 4.4.1 CVE-2014-2599 CVE-2014-3125 CVE-2014-3124 CVE-2014-2915 CVE-2014-2986 CVE-2014-3714 CVE-2014-3715 CVE-2014-3716 CVE-2014-3717 CVE-2014-3967 CVE-2014-3968 CVE-2014-3969 CVE-2014-4021 CVE-2014-4022 CVE-2014-5147 CVE-2014-5148 Xen 4.2.5 + 4.3.3 CVE-2014-2599 CVE-2014-3124 CVE-2014-3967 CVE-2014-3968 CVE-2014-4021 Apart from those there are many further bug fixes and improvements. --------------------------------------------- http://lists.xen.org/archives/html/xen-announce/2014-09/msg00000.html *** ZDI-14-301: SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-301/

1 0

Tageszusammenfassung - Dienstag 2-09-2014
by Daily end-of-shift report 02 Sep '14

02 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-09-2014 18:00 − Dienstag 02-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Bugtraq: Avira License Application - Cross Site Request Forgery Vulnerability *** --------------------------------------------- An independent Vulnerability Laboratory Researcher discovered a cross site request forgery vulnerability in the official Avira license account system web-application. --------------------------------------------- http://www.securityfocus.com/archive/1/533288 *** Dodging Browser Zero Days - Changing your Orgs Default Browser Centrally *** --------------------------------------------- In a recent story about "whats a sysadmin to do?", we suggested that since our browsers seem to take turns with zero days lately, that system administrator should have processes in place to prepare for when their corporate standard browser has a major vulnerability that doesnt yet have .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18601 *** [webapps] - WordPress Slideshow Gallery Plugin 1.4.6 - Shell Upload Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/34514 *** [webapps] - Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download *** --------------------------------------------- http://www.exploit-db.com/exploits/34511 *** Net-snmp SNMP Trap Processing Flaw Lets Remote Users Crash snmptrapd *** --------------------------------------------- http://www.securitytracker.com/id/1030789 *** Industrial software website used in watering hole attack *** --------------------------------------------- AlienVault Labs has discovered a watering hole attack thats using a framework developed for reconnaissance as the primary infection vector.The criminals responsible for the incident compromised an unnamed industrial software firms website, suggesting the potential for future attacks against .. --------------------------------------------- http://www.csoonline.com/article/2600772/data-protection/industrial-softwar… *** The Secret Life of SIM Cards *** --------------------------------------------- SIM cards can do more than just authenticate your phone with your carrier. Small apps can be installed and run directly on the SIM separate from and without knowledge of the phone OS. ... This talk, based on our experience building SIM apps for the Toorcamp GSM network, explains what (U)SIM Toolkit Applications are, how they work, and how to develop them. --------------------------------------------- http://www.ehacking.net/2014/08/the-secret-life-of-sim-cards.html *** IPv6 insecurities on 'IPv4-only' networks *** --------------------------------------------- When people hear about IPv6-specific security issues, they frequently tend to rate this as an argument in favour of delaying or avoiding IPv6 deployment on their enterprise or campus network. Even without IPv6 being consciously deployed, however, some of the IPv6-related security issues were already introduced to most networks many years ago. --------------------------------------------- http://securityblog.switch.ch/2014/08/26/ipv6-insecurities-on-ipv4-only-net… *** Using WPS on your Wi-Fi router may be even more dangerous than you think *** --------------------------------------------- In 2011, a researcher found that WPS was 10,000 times easier to crack than it was supposed to be. Now, another researcher has found that cracking it may be 10,000 times easier again... --------------------------------------------- http://nakedsecurity.sophos.com/2014/09/02/using-wps-may-be-even-more-dange… *** TYPO3-EXT-SA-2014-010: Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: cwt_feedit, eu_ldap, flatmgr, jh_opengraphprotocol, ke_dompdf, lumophpinclude, news_pack, sb_akronymmanager, st_address_ma, weeaar_googlesitemap,. wt_directory --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** A Google Site Meant to Protect You Is Helping Hackers Attack You *** --------------------------------------------- It's long been suspected that hackers and nation-state spies are using Google's antivirus site to test their tools before unleashing them on victims. Now Brandon Dixon, an independent security researcher, has caught them in the act, tracking several high-profile hacking groups - including, surprisingly, two well-known nation-state teams - as they used VirusTotal to hone their code and develop their tradecraft. --------------------------------------------- http://www.wired.com/2014/09/how-hackers-use-virustotal

1 0

Tageszusammenfassung - Montag 1-09-2014
by Daily end-of-shift report 01 Sep '14

01 Sep '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-08-2014 18:00 − Montag 01-09-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CryptoWall's Haul: $1M in Six Months *** --------------------------------------------- The CryptoWall ransomware has proven to be a profitable criminal enterprise, netting more than $1.1 million in six months. More than 1,600 victims have surfaced and more than 5 billion files have been encrypted. --------------------------------------------- http://threatpost.com/cryptowalls-haul-1m-in-six-months/107978 *** Kindle App for Android SSL certificate spoofing *** --------------------------------------------- Kindle App for Android could allow a remote attacker to conduct spoofing attacks, caused by the improper verification of SSL certificates. By persuading a victim to visit a Web site containing a specially-crafted certificate, a remote attacker could exploit this vulnerability using man-in-the-middle techniques to cause the victim to accept spoofed certificates. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95617 *** Glibc Heap Overflow in __gconv_translit_find() Lets Local Users Gain Elevated Privileges *** --------------------------------------------- A local user can set a specially crafted CHARSET environment variable value to trigger an off-by-one memory error and resulting heap overflow in __gconv_translit_find() and execute arbitrary code on the target system. The local user may be able to cause a set user id (setuid) root application that uses this environment variable to execute code with root privileges. --------------------------------------------- http://www.securitytracker.com/id/1030786 *** F5 Unauthenticated rsync access to Remote Root Code Execution *** --------------------------------------------- When configured in a high availability mode, the F5 solution suffers from an unauthenticated rsync access vulnerability that can be leveraged to upload a malicious SSH key and gain remote root access to the appliance. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080148 *** 1900/UDP (SSDP) Scanning and DDOS, (Sun, Aug 31st) *** --------------------------------------------- Over the last few weeks we have detected a significant increase in both scanning for 1900/UDP and a huge increase of 1900/UDP being used for amplified reflective DDOS attacks. 1900/UDP is the Simple Service Discovery Protocol (SSDP) which is a part of Universal Plug and Play (UPnP). The limited information available to me indicates that the majority of the devices that are .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18599 *** Rubbish WPS config sees WiFi router keys popped in seconds *** --------------------------------------------- Another day, another way in to your home router Passwords within routers sold by chipset manufacturer Broadcom and an unnamed vendor can be accessed within seconds thanks to weak or absent key randomisation, security bod Dominique Bongard has claimed. --------------------------------------------- http://www.theregister.co.uk/2014/09/01/wps_flaw_leaves_home_routers_vulner… *** Lynis 1.6.0 - Security auditing tool for Unix/Linux systems *** --------------------------------------------- Lynis is an open source security auditing tool. Primary goal is to help users with auditing and hardening of Unix and Linux based systems. The software is .. --------------------------------------------- http://hack-tools.blackploit.com/2014/08/lynis-160-security-auditing-tool-f… *** Mozilla: An die 100.000 Nutzerdaten unabsichtlich offengelegt *** --------------------------------------------- Zweite grosse Datenpanne innerhalb eines Monats beim Firefox-Hersteller --------------------------------------------- http://derstandard.at/2000005015299 *** Dircrypt: Ransomware liefert Schlüssel mit *** --------------------------------------------- Eine Analyse der Ransomware Dircrypt hat ergeben, dass die verschlüsselten Dateien des Erpressungstrojaners offenbar den Schlüssel mitliefern. Allerdings nur für einen Teil der Daten. --------------------------------------------- http://www.golem.de/news/dircrypt-ransomware-liefert-schluessel-mit-1409-10… *** APWG Q2 2014 report, phishing is even more dangerous *** --------------------------------------------- The APWG has published its new report related to phishing activities in the period April - June 2014, the document titled 'Phishing Activity Trends Report, 2nd Quarter 2014' states that online payment services and crypto-currency sites are .. --------------------------------------------- http://securityaffairs.co/wordpress/27935/cyber-crime/apwg-q2-2014-report.h…

1 0

Tageszusammenfassung - Freitag 29-08-2014
by Daily end-of-shift report 29 Aug '14

29 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-08-2014 18:00 − Freitag 29-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Heartbleed is the gift that keeps on giving as servers remain unpatched *** --------------------------------------------- An average of 7,000 attacks continue to seek out servers vulnerable to the bug. --------------------------------------------- http://arstechnica.com/security/2014/08/heartbleed-is-the-gift-that-keeps-o… *** PCI Council urges retailers to defend against Backoff POS attacks *** --------------------------------------------- The warning comes soon after the Secret Service and DHS issues a warning on the threat. --------------------------------------------- http://www.scmagazine.com/pci-council-urges-retailers-to-defend-against-bac… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Django REMOTE_USER header security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95569 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js is affected by CVE-2014-5256 *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks *** --------------------------------------------- A few days ago we detected a watering hole campaign in a website owned by one big industrial company.The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing.The attackers were able to compromise the website and include code that loaded a malicious Javascript .. --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissanc… *** Squid Range Header Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030779 *** F5 BIG-IP ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030778 *** F5 Enterprise Manager ConfigSync Access Control Flaw Lets Remote Users Read and Write Arbitrary Files *** --------------------------------------------- http://www.securitytracker.com/id/1030777 *** Sinkholing the Backoff POS Trojan *** --------------------------------------------- There is currently a lot of buzz about the Backoff point-of-sale Trojan that is designed to steal credit card information from computers that have POS terminals attached. --------------------------------------------- https://securelist.com/blog/research/66305/sinkholing-the-backoff-pos-troja… *** Nearly 100k Bugzilla Users Affected by Data Disclosure *** --------------------------------------------- The email addresses and encrypted passwords of nearly 100,000 users of Mozilla's Bugzilla system were left on a publicly accessible server for several months earlier this year, the company said. The disclosure comes just a few weeks after Mozilla advised members of its Mozilla Developer .. --------------------------------------------- http://threatpost.com/nearly-100k-bugzilla-users-affected-by-data-disclosur…

1 0

Tageszusammenfassung - Donnerstag 28-08-2014
by Daily end-of-shift report 28 Aug '14

28 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-08-2014 18:00 − Donnerstag 28-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** CG Automation Improper Input Validation *** --------------------------------------------- This advisory provides mitigation details for an improper input validation vulnerability in the CG Automation ePAQ-9410 Substation Gateway DNP3 protocol components. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-01 *** Schneider Electric Wonderware Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric Wonderware Information Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-238-02 *** Mobile Security Roundup 1H 2014 *** --------------------------------------------- The first half of this year has been quite eventful for the mobile threat landscape. Sure, we had an idea the state of affairs from 2013 would continue on to this year, but we didn't know just to what extent. From ballooning mobile malware/high risk app numbers to vulnerabilities upon vulnerabilities, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-security-… *** MS14-045 - Important: Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege (2984615) - Version: 3.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-045 *** Cisco 1800 Series ISDN Basic Rate Interface Denial of Service *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cybercriminals Leverage Rumored Windows 9 Developer Preview Release With Social Engineering *** --------------------------------------------- We're seeing schemes that are taking advantage of the buzz around the upcoming developer preview release of Windows 9 this September. One of the threats we saw was found using some combinations of keywords like Windows 9, free, leak and download in popular search engines. It involves a potentially malicious .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-l… *** My WordPress Website Was Hacked *** --------------------------------------------- Before you freak out, allow me to clarify. It was one of several honeypots we have running. The honeypots are spread across the most commonly employed hosting companies. From Virtual Private Servers (VPS) to shared environments, to managed environments. In most instances we pay and .. --------------------------------------------- http://blog.sucuri.net/2014/08/my-wordpress-website-was-hacked.html *** One More Day of Trolling in POS Memory, (Wed, Aug 27th) *** --------------------------------------------- Further to the recent story on Memory Trolling for PCI data, I was able to spend one more day fishing in memory, I dug a bit deeper and come up with more fun Credit Card / Memory goodness with our friend the Point of Sale application. First of all, just searching for credit card numbers returns a lot of duplicates, as indicated in yesterdays .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18589 *** Smarthome: Die Ifa wird zur Messe der Sicherheitslücken *** --------------------------------------------- Auf der Internationalen Funkausstellung in Berlin (Ifa) wird das Smarthome zu einem grossen Thema. Kaspersky Lab warnt jetzt erneut vor potenziellen Sicherheitslücken im Heimnetz, und ein Blick in vergangene Meldungen zeigt, dass die .. --------------------------------------------- http://www.golem.de/news/smarthome-die-ifa-wird-zur-messe-der-sicherheitslu… *** [2014-08-28] Cross-Site Scripting vulnerabilities in F5 BIG-IP *** --------------------------------------------- Attacker can steal other users sessions, impersonate other users and to gain unauthorized access to the admin interface. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** LibreOffice 4.3.1/ .2.6-secfix *** --------------------------------------------- The Document Foundation announces LibreOffice 4.3.1, the first minor release of LibreOffice 4.3 "fresh" family, with over 100 fixes (including patches for two CVEs, backported to LibreOffice 4.2.6-secfix, which is also available for download now). --------------------------------------------- http://listarchives.documentfoundation.org/www/announce/msg00199.html *** Microsoft gibt Problem-Patch eine zweite Chance *** --------------------------------------------- Zumindest eine der vier zurückgezogenen Patches steht mit neuer KB-Nummer wieder zur Installation bereit. Er schliesst Lücken in Windows, durch die sich ein Angreifer höhere Rechte verschaffen kann. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-gibt-Problem-Patch-eine-zwei… *** Srizbi kernel-mode spambot reappears as Pitou *** --------------------------------------------- Malware possibly still in the brewing stage.In November 2007, we published an article by Kimmo Kasslin (F-Secure) and Elia Florio (Symantec), in which they analysed the Srizbi trojan, notable for being the first malware found in the wild that operated fully in kernel mode. It appears .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_28.xml?rss *** eCrime Research Symposium 2014 *** --------------------------------------------- The APWG is pleased to present eCrime 2014, a combined event that includes the 2014 Fall General Meeting, and eCrime Researchers Symposium. ... This eCrime Congress will include a one-day, members-only meeting on September 23rd and two full days of open sessions thereafter of programming that will be open to both members and non-members. --------------------------------------------- http://ecrimeresearch.org/events/ecrime2014/ *** Firefox soll falsche SSL-Zertifikate enttarnen *** --------------------------------------------- Auch Mozillas Browser wird künftig etwa beim Besuch von Google.com überprüfen, ob das ausgelieferte SSL-Zertifikat von einem Herausgeber stammt, den der Dienst üblicherweise benutzt. --------------------------------------------- http://www.heise.de/security/meldung/Firefox-soll-falsche-SSL-Zertifikate-e…

1 0

Tageszusammenfassung - Mittwoch 27-08-2014
by Daily end-of-shift report 27 Aug '14

27 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-08-2014 18:00 − Mittwoch 27-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Not all Java from java.com is legitimate *** --------------------------------------------- Isn't it ironic getting a Java exploit via java.com, the primary source for one of the most common used browser plugins? Current malvertising campaigns are able to do this. This blog post details a relatively new trend: real-time advertisement bidding platforms being infiltrated by cyber criminals spreading malware. --------------------------------------------- http://blog.fox-it.com/2014/08/27/malvertising-not-all-java-from-java-com-i… *** Multiple Cross-Site Scripting Vulnerabilities in Transport Gateway for Smart Call Home *** --------------------------------------------- A vulnerability in the web framework of Cisco Transport Gateway for Smart Call Home (TG-SCH) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Netflix Open Source Security Tools Solve Range of Challenges *** --------------------------------------------- Netflix engineers released two new application security tools to open source this week, a continuing effort from the streaming services company. --------------------------------------------- http://threatpost.com/netflix-open-source-security-tools-solve-range-of-cha… *** ZDI-14-296: Novell Groupwise Administration Server FileUploadServlet poLibMaintenanceFileSave Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to obtain sensitive information on vulnerable installations of Novell Groupwise. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-296/ *** VMware Support Tool temporary files denial of service *** --------------------------------------------- VMware Support Tool is vulnerable to a denial of service, caused by a symlink attack. Temporary files are created insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the system, which could allow the attacker to overwrite arbitrary files on the system and cause a denial of service. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95493 *** VMware Support Tool /tmp directory information disclosure *** --------------------------------------------- VMware Support Tool could allow a local attacker to obtain sensitive information, caused by insecure permissions being set for the /tmp directory. An attacker could exploit this vulnerability to obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95494 *** Vulnerability in Citrix CloudPlatform Virtual Router could result in unauthorised access to network resources *** --------------------------------------------- A vulnerability has been identified in the virtual router component of Citrix CloudPlatform, formerly known as Citrix CloudStack, that could allow .. --------------------------------------------- http://support.citrix.com/article/CTX140989 *** Citrix CloudPlatform Virtual Router Firewall Bug Lets Remote Users Access Network Resources *** --------------------------------------------- A vulnerability was reported in Citrix CloudPlatform Virtual Router. A remote user can bypass access controls to access network resources. --------------------------------------------- http://www.securitytracker.com/id/1030762 *** Google says - patch your Chrome *** --------------------------------------------- 64-bit browser loads cat vids FIFTEEN PERCENT faster! Google has dropped 50 patches for its flagship Chrome browser plugging holes and handed $30,000 to a lone bug hunter who reported a dangerous sandbox-busting attack. --------------------------------------------- www.theregister.co.uk/2014/08/27/goog_says_patch_your_chrome/ *** PCI Council wants YOU to give it things to DO *** --------------------------------------------- How about enforcing PCI DSS? Crusaders at the Payment Card Industry Security Standards Council have called for submissions into projects for 2015. --------------------------------------------- www.theregister.co.uk/2014/08/27/pci_council_wants_you_to_give_it_things_to… *** RSA Identity Management and Governance Authentication Flaw Lets Remote Users Bypass Authentication to Gain Access to the Target System *** --------------------------------------------- A vulnerability was reported in RSA Identity Management and Governance. A remote user can bypass authentication to gain access to the target system. --------------------------------------------- http://www.securitytracker.com/id/1030759 *** Sicherheitsupdate für Synology-Netzwerkspeicher *** --------------------------------------------- Auch ein NAS ist meist ein Linux-Server, der gehegt und gepflegt werden muss - insbesondere dann, wenn es über das Internet erreichbar ist. Synology hat deshalb unter anderem OpenSSL auf den aktuellen Stand gebracht und damit diverse Lücken geschlossen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsupdate-fuer-Synology-Netzwe… *** VB2014 preview: Methods of malware persistence on Mac OS X *** --------------------------------------------- Patrick Wardle shows that OS X users really have something to worry about.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. Today, .. --------------------------------------------- http://www.virusbtn.com/blog/2014/08_27.xml *** IBM: Heartbleed Attacks Thousands of Servers Daily *** --------------------------------------------- The 2014 IBM X-Force Threat Intelligence Quarterly takes a look back at Heartbleed and how organizations were affected by it. --------------------------------------------- http://threatpost.com/ibm-heartbleed-attacks-thousands-of-servers-daily/107… *** ZDI-14-297: Juniper Network and Security Manager XDB Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Juniper Network and Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-297/

1 0

Tageszusammenfassung - Dienstag 26-08-2014
by Daily end-of-shift report 26 Aug '14

26 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-08-2014 18:00 − Dienstag 26-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Barracuda Networks Web Security Flex multiple modules cross-site scripting *** --------------------------------------------- Barracuda Networks Web Security Flex is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by multiple modules. A remote attacker could exploit this vulnerability using the Domain Alias, LDAP Host or Bind DN/Username field to inject malicious script into a Web page which would be .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95445 *** Trolling Memory for Credit Cards in POS / PCI Environments, (Tue, Aug 26th) *** --------------------------------------------- In a recent penetration test, I was able to parlay a network oversight into access to a point of sale terminal. Given the discussions these days, the next step for me was an obvious one - memory analysis. My first step was to drive to the store I had compromised and purchase an .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18579 *** Point of Sale Terminal Protection - "Fortress PCI at the Mall", (Tue, Aug 26th) *** --------------------------------------------- This is a very broad topic, but over the last few months Ive seen some really nicly protected PCI termainls. Especially since many POS environments are still running Windows XP, this is an important topic to discuss. Things that Ive seen done very well: First of all, only allow access to the POS app - retail staff generally dont require access to email or the internet, at .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18581 *** Netis Routers Leave Wide Open Backdoor *** --------------------------------------------- Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cybercriminals to easily run arbitrary .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-le… *** Attack flogged through shiny-clicky social media buttons *** --------------------------------------------- 66,000 users popped by malicious Flash fudging add-on Web admins beware: social media buttons that load scripts from unknown external sites could see your sites foisting the FlashPack exploit .. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/26/ek_flogged_… *** Glibc: Fehlerhaftes Null-Byte führt zu Root-Zugriff *** --------------------------------------------- Mitgliedern von Googles Project Zero ist es gelungen, einen kleinen Fehler in der Glibc auszunutzen, um unter einem Linux-System Root-Zugriff zu erhalten. Dafür mussten zahlreiche Hürden überwunden werden. --------------------------------------------- http://www.golem.de/news/glibc-fehlerhaftes-null-byte-fuehrt-zu-root-zugrif…

1 0

Tageszusammenfassung - Montag 25-08-2014
by Daily end-of-shift report 25 Aug '14

25 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-08-2014 18:00 − Montag 25-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Stiffed by Synolocker ransomware crims? Try F-Secures python tool *** --------------------------------------------- Unlock key doesnt always fit, says security biz Security firm F-Secure has released a tool to decrypt data scrambled by the Synolocker malware - assuming youve obtained the decryption key from the crooks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/23/f_secure_sy… *** QEMU ACPI PCI code execution *** --------------------------------------------- QEMU could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds access error in ACPI PCI hotplug interface. An attacker could exploit this vulnerability to corrupt QEMU process memory and obtain sensitive information. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95419 *** HP Service Manager Bugs Let Remote Users Gain Elevated Privileges, Modify Data, and Deny Service and Conduct Cross-Site Scripting and Cross-Site Requset Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030756 *** OpenOffice Targeted Data Exposure Using Crafted OLE Objects *** --------------------------------------------- The exposure exploits the way OLE previews are generated to embed arbitrary file data into a specially crafted document when it is opened. Data exposure is possible if the updated document is distributed to other parties. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080102 *** OpenOffice 4.1.0 Calc Command Injection *** --------------------------------------------- The vulnerability allows command injection when loading Calc spreadsheets. Specially crafted documents can be used for command-injection attacks. Further exploits are possible but have not been verified. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080101 *** Fortinet FortiGate Flaw in FortiManager Protocol Service Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030753 *** NIST to sysadmins: clean up your SSH mess *** --------------------------------------------- Too many keys, too badly managed - NIST has taken a look at how companies use Secure Shell (SSH), and doesnt much like what it sees. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/25/nist_to_sys… *** Ransomware mit leistungsfähigen Password Stealer *** --------------------------------------------- Ransomware auch als 'WinLocker' bekannt, sind nach wie vor in unserem digitalen Alltag gegenwärtig und wird zudem von Cyberkriminellen mit weiteren und komplexeren Funktionen ausgestattet. Um an Informationen zu Funktionen und evtl. Hintermänner dieser Ransomware zu gelangen, haben Experten von Avast bei der neusten Generation dieser Malware, Indizien zu leistungsfähigen Modulen u.a. zum Diebstahl von Passwort und Zugangsdaten gefunden. --------------------------------------------- http://blog.botfrei.de/2014/08/ransomware-mit-leistungsfaehigen-password-st…

1 0

Tageszusammenfassung - Freitag 22-08-2014
by Daily end-of-shift report 22 Aug '14

22 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-08-2014 18:00 − Freitag 22-08-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Lua vararg functions buffer overflow *** --------------------------------------------- Lua is vulnerable to a buffer overflow, caused by improper bounds checking by vararg functions. By sending an overly long string argument, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95390 *** Researchers create privacy wrapper for Android Web apps *** --------------------------------------------- Users can wrap Facebook and other apps to better control their privacy and security, according to researchers from North Carolina State University. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/mQ5PZ77i084/ *** Malicious app can get past Android WITHOUT PERMISSIONS *** --------------------------------------------- Be careful what you install, say boffins. Again. Researchers presenting at Usenix have lifted the lid on yet another Android vulnerability: the way apps use memory can be exploited to leak private information with a success rate between 82 and 92 per cent of the time. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/22/malicious_a… *** Security Advisory - Remote Security Bypass Vulnerability on Huawei Android Devices *** --------------------------------------------- SA No: Huawei-SA-20140821-Android Android version 4.1.1 - 4.4.2 is prone to a remote security bypass vulnerability (CVE-2013-6272): A vulnerability in the Android system allows an attacker to initiate or terminate arbitrary calls without the call_phone permission. After investigation we confirm that some Huawei smartphone and tablet products are affected. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** RTFM 0day in iOS apps: G+, Gmail, FB Messenger, etc. *** --------------------------------------------- Normal people spend their nights watching movies, reading articles, socializing or (yes, I know its odd) sleeping. I spend my nights reading RFCs and pentesting various applications/services. --------------------------------------------- http://algorithm.dk/posts/rtfm-0day-in-ios-apps-g-gmail-fb-messenger-etc *** PHP 5.5.16 is released *** --------------------------------------------- The PHP Development Team announces the immediate availability of PHP 5.5.16. This release fixes several bugs against PHP 5.5.15 and resolves CVE-2014-3538, CVE-2014-3587, CVE-2014-2497, CVE-2014-5120 and CVE-2014-3597. All PHP users are encouraged to upgrade to this new version. --------------------------------------------- http://php.net/archive/2014.php

1 0

Tageszusammenfassung - Donnerstag 21-08-2014
by Daily end-of-shift report 21 Aug '14

21 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-08-2014 18:00 − Donnerstag 21-08-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco WebEx MeetMeNow Server Directory Traversal Vulnerability *** --------------------------------------------- A vulnerability in a PHP file in the Cisco WebEx MeetMeNow Server could allow an authenticated, remote attacker to obtain the contents of arbitrary files on an affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** The fall of rogue antivirus software brings new methods to light *** --------------------------------------------- Rogue antivirus software has been a part of the malware ecosystem for many years now - Win32/SpySheriff and Win32/FakeRean date all the way back to 2007. These rogues, and the many that have followed them throughout the years, generally mislead and scare users into paying a fee for "cleaning" false detections that the software claims to have found on the machine. They often use dozens .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/08/19/the-fall-of-rogue-antivi… *** Researchers build security framework for Android *** --------------------------------------------- University researchers have modified the Android operating system to let developers plug in enterprise-class security enhancements that would normally require overhauling a mobile devices firmware.The code added to the OS is called the Android Security Modules (ASM) framework, which is described .. --------------------------------------------- http://www.csoonline.com/article/2474691/mobile-security/researchers-build-… *** Britischer Geheimdienst GCHQ entwickelt Hackerspiel mit *** --------------------------------------------- Im Browserspiel soll getestet werden, wie gut sich die Briten mit Online-Sicherheit auskennen. Dabei soll es Wettbewerbe geben, bei denen Nachwuchs rekrutiert wird. --------------------------------------------- http://futurezone.at/digital-life/britischer-geheimdienst-gchq-entwickelt-h… *** 5 excuses for doing nothing about computer security *** --------------------------------------------- Sadly, as were sure you have found, once a friend or family member has latched onto a security avoidance excuse, it can be hard to talk them round. So, here are five excuses that we hear a lot, both from individuals and from small businesses, together with some points you can use to argue back that security really does matter. --------------------------------------------- http://nakedsecurity.sophos.com/2014/08/20/5-excuses-for-doing-nothing-abou… *** Need a green traffic light all the way home? Easy with insecure street signals, say researchers *** --------------------------------------------- "While other deployments may use different wireless radios or even wired connections between intersections we have no reason to believe there are any fundamental differences between the network we studied and other traffic signal systems," the researchers concluded. "We believe that many traffic infrastructure .. --------------------------------------------- http://www.theregister.co.uk/2014/08/20/sick_of_slow_commuting_americas_tra… *** IoT: How I hacked my home *** --------------------------------------------- A typical modern home can have around five devices connected to the local network which aren't computers, tablets or cellphones. As users in a connected digital environment we need to ask ourselves: Are the devices connected to my network vulnerable? What could an attacker actually do if these devices were compromised? Is my home 'hackable?' --------------------------------------------- https://securelist.com/analysis/publications/66207/iot-how-i-hacked-my-home/

1 0

Tageszusammenfassung - Mittwoch 20-08-2014
by Daily end-of-shift report 20 Aug '14

20 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-08-2014 18:00 − Mittwoch 20-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Apache OFBiz cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95356 *** The Administrator of Things (AoT) - A Side Effect of Smartification *** --------------------------------------------- In an earlier article, we talked about the ongoing smartification of the home - the natural tendency of households to accumulate more intelligent devices over time. While this has its benefits, the residents of smart homes also need to invest their time and energy to maintain these devices. These requirements will only grow as more... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5chS0C_DSr4/ *** RSA Archer GRC Platform 5.5 SP1 Privilege Escalation / CSRF / Access Bypass *** --------------------------------------------- Topic: RSA Archer GRC Platform 5.5 SP1 Privilege Escalation / CSRF / Access Bypass Risk: Medium Text:ESA-2014-071: RSA Archer GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2014-071 CVE Identifier: CVE-20... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080085 *** "El Machete" *** --------------------------------------------- "Machete" is a targeted attack campaign with Spanish speaking roots. Most of the victims are located in Venezuela, Ecuador, , Colombia, Peru, Russia, Cuba, and Spain. Targets include high-level profiles, including intelligence services, military, embassies and government institutions. --------------------------------------------- https://securelist.com/blog/research/66108/el-machete/ *** Microsoft zieht weitere Windows-Updates zurück *** --------------------------------------------- Nutzer klagen über Bluescreens und weitere Probleme --------------------------------------------- http://derstandard.at/2000004536290 *** Vernetzte Geräte: Tausende Sicherheitslücken entdeckt *** --------------------------------------------- In mehr als 140.000 Geräten haben Forscher teils schwerwiegende Sicherheitslücken entdeckt, darunter Zero-Day-Exploits, hartcodierte Passwörter und private Schlüssel. --------------------------------------------- http://www.golem.de/news/vernetzte-geraete-tausende-sicherheitsluecken-entd… *** Bugtraq: [security bulletin] HPSBUX03091 SSRT101667 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533176 *** Bugtraq: Deutsche Telekom CERT Advisory [DTC-A-20140820-001] check_mk vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/533180 *** Bugtraq: CVE-2014-5307 - Privilege Escalation in Panda Security Products *** --------------------------------------------- http://www.securityfocus.com/archive/1/533182 *** Bugtraq: CVE-2014-4973 - Privilege Escalation in ESET Windows Products *** --------------------------------------------- Versions 5.0 - 7.0 of ESET Smart Security and ESET Endpoint Security products for Windows XP OS allow a low privileged user to execute code as SYSTEM by exploiting a vulnerability in the ESET Personal Firewall NDIS filter (EpFwNdis.sys) kernel mode driver also mentioned as Personal Firewall module Build 1183 (20140214) and prior. --------------------------------------------- http://www.securityfocus.com/archive/1/533184 *** Aktuelle Masche: Krimineller "Blog-Klau" verärgert viele Betreiber *** --------------------------------------------- Unbekannte spiegeln derzeit dutzende deutsche Blogs und versuchen, mit den gekaperten Inhalten illegal Kasse zu machen. --------------------------------------------- http://www.heise.de/security/meldung/Aktuelle-Masche-Krimineller-Blog-Klau-… *** Zertifikate: Google will vor SHA-1 warnen *** --------------------------------------------- Google will Zertifikate, die mit SHA-1 signiert sind, bis spätestens 2017 loswerden. Der Chrome-Browser wird bald entsprechende Warnungen anzeigen. SHA-1 gilt schon seit einigen Jahren als potentiell unsicher. --------------------------------------------- http://www.golem.de/news/zertifikate-google-will-vor-sha-1-warnen-1408-1087… *** Multiple Vulnerabilities in various IBM Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/aix_libxml2_vulnerabi… https://www-304.ibm.com/connections/blogs/PSIRT/entry/vulnerability_in_aix_… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/multiple_vulnerabilit… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 19-08-2014
by Daily end-of-shift report 19 Aug '14

19 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-08-2014 18:00 − Dienstag 19-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** New Attack Binds Malware in Parallel to Software Downloads *** --------------------------------------------- Open source software distribution systems that lack security processes and integrity checks are prone to a new attack that binds malware to a download without modifying the original application. --------------------------------------------- http://threatpost.com/new-attack-binds-malware-in-parallel-to-software-down… *** Microsofts Windows 8 App Store Is Full of Scamware *** --------------------------------------------- Deathspawner writes Windows 8 brought a lot to the table, with one of its most major features being its app store. However, its not a feature that Microsoft seems too intent on keeping clean. As it is today, the store is completely littered with misleading apps and outright scamware. The unfortunate thing is that .. --------------------------------------------- http://beta.slashdot.org/story/206067 *** Virenscanner: Testlabor analysiert das fehlende Prozent *** --------------------------------------------- In Labortests erkennen fast alle Virenscanner stets über 99 Prozent der Schädlinge. Doch genau das fehlende Prozent kann den Unterschied machen, wie die Verbreitung der durchgeschlüpften Dateien zeigt. --------------------------------------------- http://www.heise.de/security/meldung/Virenscanner-Testlabor-analysiert-das-… *** Part 2: Is your home network unwittingly contributing to NTP DDOS attacks?, (Sun, Aug 17th) *** --------------------------------------------- This diary follows from Part 1, published on Sunday August 17, 2014. How is it possible that with no port forwarding enabled through the firewall that Internet originated NTP requests were getting past the firewall to the misconfigured NTP server? The reason why these packets are passing .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18549&rss *** Stuxnet: Geschlossene Sicherheitslücke gefährdet noch immer Millionen *** --------------------------------------------- Experten führen die hohen Zahlen auf eine mangelnde Wartung von Servern zurück --------------------------------------------- http://derstandard.at/2000004498863 *** APT Gang Branches Out to Medical Espionage in Community Health Breach *** --------------------------------------------- The Community Health Systems data breach has been tied to a Chinese APT gang that has branched out to medical espionage, stealing patient data in an effort to target intelligence on medical device development. --------------------------------------------- http://threatpost.com/apt-gang-branches-out-to-medical-espionage-in-communi… *** Multipe vulnerabilities in EMC Documentum products *** --------------------------------------------- http://www.securityfocus.com/archive/1/533161 http://www.securityfocus.com/archive/1/533160 http://www.securityfocus.com/archive/1/533159 http://www.securityfocus.com/archive/1/533162 *** DSA-3006 xen *** --------------------------------------------- http://www.debian.org/security/2014/dsa-3006 *** FreeNAS password security bypass *** --------------------------------------------- FreeNAS could allow a remote attacker to bypass security restrictions, caused by the use of a blank password by the Web admin. An attacker could exploit this vulnerability to reset the admin password and gain full administrative access to the device. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95326 *** Apache HttpComponents certificate spoofing *** --------------------------------------------- Apache HttpComponents could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the Subject's Common Name (CN) or SubjectAltName field of certificates. By persuading a victim to visit a Web site containing a .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/95327 *** Cisco NX-OS Software SNMP Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the Simple Network Management Protocol (SNMP) module of Cisco NX-OS Software could allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to a failure to respond to invalid requests in the same manner when specifying a VLAN ID. An attacker could exploit this vulnerability by making a large number of requests to .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Montag 18-08-2014
by Daily end-of-shift report 18 Aug '14

18 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-08-2014 18:00 − Montag 18-08-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Microsoft zieht Updates zurück *** --------------------------------------------- Mit insgesamt vier der am letzten Patchday veröffentlichten Updates für Windows gibt es offenbar Probleme. Microsoft hat jetzt reagiert und warnt davor, sie einzuspielen. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-zieht-Updates-zurueck-229417… *** Suspicious Login Message Faked, Distributes Backdoor *** --------------------------------------------- Legitimate services are often used by cybercriminals to try and make their attacks more convincing. Recently, I spotted attacks that used services and platforms like Google Drive and Dropbox in order to look less suspicious to unwary users. I received a spammed message like the one shown right below that supposedly came from Gmail itself. It warned me that someone logged... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/hhVGnlO7Tzs/ *** ZDI-14-295: AlienVault OSSIM av-centerd Util.pm remote_task Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-295/ *** ZDI-14-294: AlienVault OSSIM av-centerd Util.pm get_license Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-294/ *** Siemens OpenSSL Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-14-198-03A Siemens OpenSSL Vulnerabilities that was published July 23, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens OpenSSL cryptographic software library affecting several Siemens industrial products. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-198-03B *** Siemens SIMATIC S7-1500 CPU Denial of Service *** --------------------------------------------- Siemens produced a new firmware version that mitigates a denial of service vulnerability in SIMATIC S7-1500 CPU. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-14-226-01 *** 7 Places to Check for Signs of a Targeted Attack in Your Network *** --------------------------------------------- Targeted attacks are designed to circumvent existing policies and solutions within the target network, thus making their detection a big challenge. As we've stressed in our previous entry about common misconceptions about targeted attacks, there is no one-size-fits-all solution against it; enterprises need to arm themselves with protection that can provide sensors where needed, as well as IT... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/NhRVtViIRDU/ *** Security: Lücken in Update-Servern gefährden Millionen Router *** --------------------------------------------- Über mehrere Schwachstellen in den Auto Configuration Servern von Providern könnten Angreifer manipulierte Firmware an Millionen Router verteilen. Außerdem gibt es Fehler im dazugehörigen Kommunikationsprotokoll. --------------------------------------------- http://www.golem.de/news/security-luecken-in-update-servern-gefaehrden-mill… *** Internet Explorer: Veraltete ActiveX-Steuerelemente werden später blockiert *** --------------------------------------------- Microsoft verschiebt das Blockieren veralteter Versionen von Java und Co. auf September. Der Grund sind Beschwerden einiger Admins. --------------------------------------------- http://www.heise.de/security/meldung/Internet-Explorer-Veraltete-ActiveX-St… *** Kein Mailversand: Spamhaus listet Web.de, GMX und 1&1 *** --------------------------------------------- Spamhaus hat heute versehentlich die Mailserver von United Internet gelistet. Der Mailversand ist für einige Stunden nicht möglich gewesen. (Spam, E-Mail) --------------------------------------------- http://www.golem.de/news/mailserver-spamhaus-listet-web-de-gmx-und-1-1-1408… *** VB2014 preview: Optimized mal-ops. Hack the ad network like a boss *** --------------------------------------------- Researchers Vadim Kotov and Rahul Kashyap to discuss how advertisements are the new exploit kits.In the weeks running up to VB2014 (the 24th Virus Bulletin International Conference), we will look at some of the research that will be presented at the event. In the second of this series, we look at the paper Optimized mal-ops. Hack the ad network like a boss, from Vadim Kotov and Rahul Kashyap, two researchers from Bromium."We conclude that ad networks could be leveraged to aid, or even be --------------------------------------------- http://www.virusbtn.com/blog/2014/08_15.xml?rss *** Ebola fear used as bait, leads to malware infection *** --------------------------------------------- Summary: Ebola news is bait for attackers to steal login credentials and install Trojan.Zbot, W32.Spyrat, and Backdoor.Breut malware. --------------------------------------------- http://www.symantec.com/connect/blogs/ebola-fear-used-bait-leads-malware-in… *** FinFisher & Co. machen harmlose Katzenvideos zur Waffe für Cyber-Attacken *** --------------------------------------------- Ein Forscher hat im Detail beschrieben, wie Angreifer mit Zugriff auf die Netzwerkinfrastruktur eines Internet-Providers Trojaner in den Traffic der Nutzer einschleusen können, ohne dass die Opfer etwas bemerken. --------------------------------------------- http://www.heise.de/security/meldung/FinFisher-Co-machen-harmlose-Katzenvid… *** Part 1: Is your home network unwittingly contributing to NTP DDOS attacks?, (Sun, Aug 17th) *** --------------------------------------------- For the last year or so, I have been investigating UDP DDOS attacks. In this diary I would like to spotlight a somewhat surprising scenario where a manufacturer's misconfiguration on a popular consumer device combined with a design decision in a home gateway router may make you an unwitting accomplice in amplified NTP reflection DDOS attacks. This is part 1 of the story. I will publish the conclusion Tuesday August 19th. Background Today almost every house has consumer broadband services. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18547&rss *** Web Server Attack Investigation - Installing a Bot and Reverse Shell via a PHP Vulnerability, (Sat, Aug 16th) *** --------------------------------------------- With Windows malware getting so much attention nowadays, its easy to forget that attackers also target other OS platforms. Lets take a look at a recent attempt to install an IRC bot written in Perl by exploiting a vulnerability in PHP. The Initial Probe The web server received the initial probe from 46.41.128.231, an IP address that at the time was not flagged as malicious on various blacklists: HEAD / HTTP/1.0 The connection lacked the headers typically present in an HTTP request, which is why... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18543&rss *** ZeroLocker wont come to your rescue *** --------------------------------------------- In recent times weve been seeing a lot of file-encrypting ransomware activity. One of the new ones weve seen pop up in the last couple weeks is called ZeroLocker. Theres indication the C&C configuration contains some errors which would prevent... --------------------------------------------- https://securelist.com/blog/incidents/66135/zerolocker-wont-come-to-your-re…

1 0

Tageszusammenfassung - Donnerstag 14-08-2014
by Daily end-of-shift report 14 Aug '14

14 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-08-2014 18:00 − Donnerstag 14-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Safari: Apple behebt diverse Sicherheitslücken *** --------------------------------------------- Der Hersteller hat in der Nacht zum Donnerstag seinen hauseigenen Browser für verschiedene Betriebssysteme aktualisiert. Für Entwickler stellte Apple außerdem eine weitere Vorschauversion von OS X 10.9.5 bereit. --------------------------------------------- http://www.heise.de/security/meldung/Safari-Apple-behebt-diverse-Sicherheit… *** Vulnerability in Spotify Android App May Lead to Phishing *** --------------------------------------------- We have discovered a vulnerability that affects versions of the Spotify app for Android older than 1.1.1. If exploited, the vulnerability can allow bad guys to control what is being displayed on the app interface. This vulnerability can be potentially abused by cybercriminals to launch phishing attacks that may result to information loss or theft. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/ZJMVGX3NMwk/ *** Portal: Tor für mobile Router *** --------------------------------------------- Anonymes Surfen mit Tor ist noch sicherer, wenn die Software nicht auf dem eigenen Rechner läuft. Die Software Portal integriert Tor in der Firmware Openwrt und lässt sich so auf ausgewählten mobilen Routern nutzen. --------------------------------------------- http://www.golem.de/news/portal-tor-fuer-mobile-router-1408-108575-rss.html *** Tiny Malware PoC: Malware Without IAT, DATA OR Resource Section *** --------------------------------------------- Have you ever wondered about having an EXE without any entry in IAT (Import Address Table) at all? Well, I knew that its possible, but never saw an actual exe file without IAT entry. So I developed an application which is 1,536 bytes and still does basic annoying malware things. --------------------------------------------- http://www.codeandsec.com/PoC-Tiny-Malware-Without-IAT-DATA-Or-Resource-Sec… *** SAMHAIN v3.1.2 Released *** --------------------------------------------- The Samhain host-based intrusion detection system (HIDS) provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. Samhain been designed to monitor multiple hosts with potentially different operating systems, providingcentralized logging and maintenance, although it can also be used as standalone application on a single host. --------------------------------------------- http://www.toolswatch.org/2014/08/samhain-v3-1-2-released/ *** ZeroLocker *** --------------------------------------------- Recently in the news we saw FireEye and Fox-IT provide the ability to decrypt files encrypted by older crpytolocker variants. They used the command and control servers seized by the FBI during operation Tovar. Since they have access to those RSA keys they essentially have the password required for every single file encrypted by a Cryptolocker variant that used Evgeniy Bogachev's botnet. --------------------------------------------- http://www.webroot.com/blog/2014/08/14/zero-locker/ *** JSA10643 - 2014-08 Security Bulletin: Juniper Secure Analytics (JSA)/Security Threat Response Manager (STRM): Multiple vulnerabilities resolved by third party software upgrades. *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10643&actp=RSS *** JSA10642 - 2014-08 Security Bulletin: Network and Security Manager NSM: Multiple vulnerabilities *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10642&actp=RSS *** Disqus 2.7.5 Cross Site Request Forgery / Cross Site Scripting *** --------------------------------------------- Topic: Disqus 2.7.5 Cross Site Request Forgery / Cross Site Scripting Risk: Medium Text:<!-- Exploit for Disqus for Wordpress admin stored CSRF+XSS up to v2.7.5 Blog post explainer: https://www.nikcub.com/posts/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080064 *** Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Information *** --------------------------------------------- http://www.securitytracker.com/id/1030732 *** SSA-310688 (Last Update 2014-08-14): Denial-of-Service Vulnerability in SIMATIC S7-1500 CPU *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-234763 (Last Update 2014-08-14): OpenSSL Vulnerabilities in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… Next End-of-Shift report on 2014-08-18

1 0

Tageszusammenfassung - Mittwoch 13-08-2014
by Daily end-of-shift report 13 Aug '14

13 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-08-2014 18:00 − Mittwoch 13-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** (Updated 2014/8/13) Syria offline - initial analysis of BGP (and explanation) *** --------------------------------------------- This blog post evolved over time - initially it was a mere scratchpad for notes during our initial research between 2012/11/29 and 11/30. Later, after Syria was back online again, I added a summary and some potential explanations of what might have happened at the end of this blog post. UPDATE 2014/8/13: It seems it was the NSA that hacked a router, according to Snowden. Scroll to the end for links. --------------------------------------------- http://www.cert.at/services/blog/20121129184048-616.html *** MS14-AUG - Microsoft Security Bulletin Summary for August 2014 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for August 2014. With the release of the security bulletins for August 2014, this bulletin summary replaces the bulletin advance notification originally issued August 7, 2014. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-AUG *** Assessing risk for the August 2014 security updates *** --------------------------------------------- Today we released nine security bulletins addressing 40 unique CVEs. Two bulletins have a maximum severity rating of Critical while the other seven have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max exploit-ability Likely first 30 days impact Platform mitigations and key notes MS14-051 (Internet Explorer) Victim browses --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/08/12/assessing-risk-for-the-au… *** Microsoft-Patchday: 26 Lücken im Internet Explorer gestopft *** --------------------------------------------- Wie am zweiten Dienstag im Monat üblich, hat Microsoft eine Reihe von Sicherheitslücken im Internet Explorer, in Windows und in anderen Produkten geschlossen. Für den IE gibt es 26 einzelne Patches, eine Lücke wird bereits von Angreifern aktiv genutzt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Microsoft-Patchday-26-Luecken-im-Int… *** Cisco Unified Communications Manager and Cisco Unified Presence Server SQL Injection Vulnerability *** --------------------------------------------- CVE-2014-3339 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Study: Firmware Plagued By Poor Encryption and Backdoors *** --------------------------------------------- itwbennett writes: The first large-scale analysis of firmware has revealed poor security practices that could present opportunities for hackers probing the Internet of Things. Researchers with Eurecom, a technology-focused graduate school in France, developed a web crawler that plucked more than 30,000 firmware images from the websites of manufacturers including Siemens, Xerox, Bosch, Philips, D-Link, Samsung, LG and Belkin. In one instance, the researchers found a Linux kernel that was 10... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-X--LranmlI/story01.htm *** Fifteen zero days found in hacker router comp romp *** --------------------------------------------- Four routers rooted in SOHOpelessly Broken challenge DEF CON Researchers have unveiled 15 zero day vulnerabilities in four home and small business routers as part of the SOHOpelessly Broken hacker competition in DEF CON this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/13/fifteen_zer… *** Black Hat USA 2014 talk about hypervisor security *** --------------------------------------------- This week I presented at Black Hat USA. The talk is titled "Poacher turned gatekeeper: lessons learned from eight years of breaking hypervisors". The main points were: Describe the attack surface of Type 1 and Type 2 hypervisors Show that despite not being 100% bulletproof, hypervisors are still the best usable way to isolate potentially... --------------------------------------------- http://labs.bromium.com/2014/08/11/black-hat-usa-2014-talk-about-hypervisor… *** Wireless Auditing, Intrusion Detection & Prevention System *** --------------------------------------------- WAIDPS is an open source wireless swissknife written in Python and work on Linux environment. This is a multipurpose tools designed for audit (penetration testing) networks, detect wireless intrusion (WEP/WPA/WPS attacks) and also intrusion prevention (stopping station from associating to access point). --------------------------------------------- http://www.ehacking.net/2014/08/wireless-auditing-intrusion-detection.html *** SSA-635659 (Last Update 2014-08-14): Heartbleed Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Gefälschtes Tor-Browser-Bundle mit Trojaner *** --------------------------------------------- Eine täuschend echte Kopie der Seite torproject.org verteilt einen Trojaner. Der Student Julien Voisin hat ihn zerlegt - und konnte Kontakt zu den Verantwortlichen herstellen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Gefaelschtes-Tor-Browser-Bundle-mit-… *** Ältere Versionen von Disqus für WordPress angreifbar *** --------------------------------------------- Ein Sicherheitsforscher hat Sicherheitslücken im beliebten Disqus-Plug-in für WordPress entdeckt. Administratoren sollten sicherstellen, dass die entsprechenden Updates installiert sind. --------------------------------------------- http://www.heise.de/security/meldung/Aeltere-Versionen-von-Disqus-fuer-Word… *** New Metasploit 4.10: Credentials Are the New Exploits *** --------------------------------------------- We’ve given credentials a new boost with Metasploit 4.10. It’s now easier to manage, reuse and report on credentials as part of a penetration test. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/08/13/credentia…

1 0

Tageszusammenfassung - Dienstag 12-08-2014
by Daily end-of-shift report 12 Aug '14

12 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-08-2014 18:00 − Dienstag 12-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB14-18: Security updates available for Adobe Flash Player http://helpx.adobe.com/security/products/flash-player/apsb14-18.html APSB14-19: Security updates available for Adobe Reader and Acrobat http://helpx.adobe.com/security/products/reader/apsb14-19.html Customers of the affected products should consult the relevant Security Bulletin(s) for details. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1118 *** Cisco Unified Communications Manager SIP Subsystem Vulnerability *** --------------------------------------------- CVE-2014-3337 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Manager CTIManager Vulnerability *** --------------------------------------------- CVE-2014-3338 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Two new Gameover Zeus variants in the wild *** --------------------------------------------- About two months after botnet takedown efforts, new versions of the malware have surfaced in the U.S. and abroad. --------------------------------------------- http://www.scmagazine.com/two-new-gameover-zeus-variants-in-the-wild/articl… *** Millions of PCs Affected by Mysterious Computrace Backdoor *** --------------------------------------------- Absolute Softwares anti-theft Computrace software is mysteriously installed on brand new machines, nearly impossible to remove, and exploitable. --------------------------------------------- http://threatpost.com/millions-of-pcs-affected-by-mysterious-computrace-bac… *** NIST wants better SCADA security *** --------------------------------------------- Preparing the way for a test lab Americas National Institute of Standards and Technology (NIST) wants to take a hand in addressing the SCADA industry's chronic insecurity, by building a test bed for industrial control systems. --------------------------------------------- http://www.theregister.co.uk/2014/08/12/nist_wants_better_scada_security/ *** Command Injection allows Unauthenticated Command Bypass on multiple D-Link products *** --------------------------------------------- The DNS-315L DNS-320L, DNS-327L, DNS-340L, and DNS-345 have been identifed as having a vulnerability in their Web-GUI application that allows malicious users to gain access to the device configuraiton, device operating system, and stored file without requiring log-in credentials. --------------------------------------------- http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10042 *** 2Q 2014 Security Roundup: Turning the Tables on Cyber Attacks *** --------------------------------------------- The incidents that cropped up in the months of April to June 2014 - from the data breaches, DDoS attacks, to malware improvements and threats to privacy - highlighted the need for enterprises to craft a more strategic response against and in anticipation of security threats. There were plenty of threats to be found in the quarter. There was... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Cf4i9ouVNiM/ *** How to hack a Macbook using just USB *** --------------------------------------------- Yesterday, at the 2014 DEF CON hackers conference in Las Vegas, security researchers Joe Fitzpatrick and Miles Crabil demonstrated how they could directly access the memory of Apple Macbook devices using a piece of hardware they built to plug into the computer's own USB slot. --------------------------------------------- http://www.techly.com.au/2014/08/12/hack-macbook-using-just-usb/ *** BlackBerry Z10 erlaubte freien Zugriff über das WLAN *** --------------------------------------------- Sicherheitsforscher haben eine Lücke öffentlich gemacht, die es einem Angreifer erlaubte, auf Daten auf dem BlackBerry Z10 zuzugreifen. Der eingebaute File-Server erlaubte Zugriff auf den Telefonspeicher, ohne nach einem Passwort zu fragen. --------------------------------------------- http://www.heise.de/security/meldung/BlackBerry-Z10-erlaubte-freien-Zugriff…

1 0

Tageszusammenfassung - Montag 11-08-2014
by Daily end-of-shift report 11 Aug '14

11 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-08-2014 18:00 − Montag 11-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco Unity Connection SQL Injection Vulnerability *** --------------------------------------------- CVE-2014-3336 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Splunk Bugs Permit Remote Cross-Site Scripting and Remote Authenticated Directory Traversal Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030690 *** Incident Response with Triage-ir, (Sun, Aug 10th) *** --------------------------------------------- In many cases having a full disk image is not an option during an incident. Imagine that you are suspecting that you have dozen of infected or compromised system. Can you spend 2-3 hours to make a forensic copy of hard disks hundred computers? In such situation fast forensics is the solution for such situation. Instead of copying everything collecting some files that may contain an evidence can solve this issue. In this diary I am going to talk about an application that will collect most of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18509&rss *** Verifying preferred SSL/TLS ciphers with Nmap, (Mon, Aug 11th) *** --------------------------------------------- In last year or two, there has been a lot of talk regarding correct usage of SSL/TLS ciphers on web servers. Due to various incidents more or less known incidents, web sites today should use PFS (Perfect Forward Secrecy), a mechanism that is used when an SSL/TLS connection is established and symmetric keys exchanged. PFS ensures that, in case an attacker obtains the server's private key, he cannot decrypt previous SSL/TLS connections to that server. If PFS is not used (if RSA is used to --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18513&rss *** WordHound erzeugt maßgeschneiderte Wörterbücher für Passwort-Knacker *** --------------------------------------------- Wörterbuch-Attacken auf Passwort-Hashes dauern lange und sind nicht immer erfolgreich. Schneidet man die durchzuprobierenden Passwörter aber auf das Ziel zurecht, sind selbst vergleichbar komplizierte Kennwörter unter Umständen nicht mehr sicher. --------------------------------------------- http://www.heise.de/newsticker/meldung/WordHound-erzeugt-massgeschneiderte-… *** You cannot cyberhijack an airplane, but you can create mischief *** --------------------------------------------- Hacking a plane and taking control of the aircraft is a considerably scary prospect, but two speakers at DefCon 22 in Las Vegas quashed the notion and put worries to rest. --------------------------------------------- http://www.scmagazine.com/defcon-you-cannot-cyberhijack-an-airplane-but-you… *** Cybercrime Report: Soziale Netzwerke zunehmend betroffen *** --------------------------------------------- 2013 wurden in Österreich 11.199 Fälle von Cybercrime angezeigt. Als Motive sieht das Bundeskriminalamt finanzielle Interessen, Langeweile und Hacktivism. [...] Neue Technologien werden in Zukunft weiterhin neue Erscheinungsformen von Cyberkriminalität begünstigen, heißt es im Report. Genannt wurde der Einsatz von "NFC" (Near Field Communication) zur Durchführung kontaktloser Zahlungsvorgänge, aber auch Verkehrsmittel, die mit der Möglichkeit zur Netzwerk-Kommunikation ausgestattet werden, wie zum Beispiel Smart-Vehicles und Drohnen, warnt der Bericht abschließend. --------------------------------------------- http://futurezone.at/netzpolitik/cybercrime-report-soziale-netzwerke-zunehm…

1 0

Tageszusammenfassung - Freitag 8-08-2014
by Daily end-of-shift report 08 Aug '14

08 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-08-2014 18:00 − Freitag 08-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Massives Datenleck *** --------------------------------------------- Massives Datenleck | 6. August 2014Diverse Medien berichten, dass eine kriminelle Gruppe aus Russland eine gigantische Zahl an Zugangsdaten erbeutet hat. Siehe u.a.: New York Times, Slate, WSJ, DerStandard, Futurezone, Heise, ... | Woher die Credentials wirklich stammen (die Geschichte mit dem Botnet und SQL-Injection klingt ein bisschen nach einem Bericht aus 2013), ist auch nicht restlos geklärt: In anderen Fällen war das eine Mischung aus diversen Kampagnen, sowohl Einbrüchen in... --------------------------------------------- http://www.cert.at/services/blog/20140806143111-1213.html *** Black Hat USA Talks: Investigating PowerShell Attacks *** --------------------------------------------- Threat actors are always eager to adopt new tools, tactics, and procedures that can help them evade detection and conduct their mission. Incident responders from Mandiant have observed increasing use of PowerShell by targeted attackers to conduct command-and-control in compromised... --------------------------------------------- http://www.fireeye.com/blog/technical/2014/08/black-hat-usa-talks-investiga… *** IETF will selbst elliptische Kurven standardisieren *** --------------------------------------------- Künftig will die IETF nicht mehr nur einfach die von der NIST empfohlenen Krypto-Standards übernehmen, sondern eigene schaffen. Die NIST hingegen versucht weiterhin, ihr ramponiertes Image als unabhängige Instanz zu retten. --------------------------------------------- http://www.heise.de/security/meldung/IETF-will-selbst-elliptische-Kurven-st… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect WebSphere Application Server July 2014 CPU *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition that is shipped with IBM WebSphere Application Server. These issues were disclosed as part of the IBM Java SDK updates in July 2014. CVE(s): CVE-2014-4263 and CVE-2014-4244, Affected product(s) and affected version(s): IBM Java SDK shipped with IBM WebSphere Application Server Version 8.5.0.0 through 8.5.5.2, Version 8.0.0.0 through 8.0.0.9, Version 7.0.0.0 through 7.0.0.33, Version 6.1.0.0 through 6.1.0.47 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Checking for vulnerabilities in the Smart Grid System, (Thu, Aug 7th) *** --------------------------------------------- SCADA systems are not composed the same way as regular IT systems. Therefore, the risk and vulnerability assessment cannot be performed as it is done for any other IT system. The most important differences are: SCADA Pentesting should not be done in production environment: SCADA devices are very fragile and some activities that could pose harmless to regular IT environments could be catastrophic to the process availability. Think of massive blackouts or no water supply for a city. SCADA --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18499&rss *** Wordpress: Defektes Plugin erlaubt Admin-Zugriff *** --------------------------------------------- Das Wordpress-Plugin Custom Contacts Form hat einen Fehler, der es Angreifern erlaubt, administrative Rechte über eine Webseite zu erhalten. Es gibt bereits einen Patch. --------------------------------------------- http://www.golem.de/news/wordpress-defektes-plugin-erlaubt-admin-zugriff-14… *** Analyzing the Fake ID Android vulnerability *** --------------------------------------------- In this video shot at Black Hat 2014 in Las Vegas, Jeff Forristal of Bluebox Security sits with Danielle Walker, reporter at SC Magazine, to discuss the Fake ID Android vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Tp9gYIOHaFg/ *** Black Hat 2014: 75 Prozent aller mobilen Kassensysteme verwundbar *** --------------------------------------------- Knapp drei viertel aller gängigen mobilen Terminals zum Auslesen von Kreditkarten basieren auf der selben Hard- und Software. Forscher haben demonstriert, wie sie die Geräte unter Kontrolle bringen und so dem Kartenmissbrauch Tür und Tor öffnen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Black-Hat-2014-75-Prozent-aller-mobi… *** Patchday: Microsoft behebt kritische Lücken in Windows und IE *** --------------------------------------------- Am kommenden Patchday veröffentlicht Microsoft insgesammt neun Sicherheitsupdates, davon sind zwei als "kritisch" und sieben weitere als "wichtig" markiert. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-behebt-kritische-… *** Microsoft: Keine Updates mehr für ältere Internet Explorer *** --------------------------------------------- Ab Anfang 2016 will Microsoft ältere Internet-Explorer-Versionen nicht mehr unterstützen. Bis dahin sollten Windows-Nutzer den Webbrowser aktualisieren, um weiterhin Updates zu erhalten. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-Keine-Updates-mehr-fuer-aelt… *** How to Use Your Cat to Hack Your Neighbor's Wi-Fi *** --------------------------------------------- Late last month, a Siamese cat named Coco went wandering in his suburban Washington, DC neighborhood. He spent three hours exploring nearby backyards. He killed a mouse, whose carcass he thoughtfully brought home to his octogenarian owner, Nancy. And while he was out, Coco mapped dozens of his neighbors' Wi-Fi networks, identifying four routers that used... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/3d4f7cee/sc/10/l/0L0Swired0N0C20A… *** HPSBHF03084 rev.1 HP PCs with UEFI Firmware, Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilies have been identified with certain HP PCs with UEFI Firmware. The vulnerabilities could be exploited to allow execution of arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03087 SSRT101413 rev.1 - HP-UX CIFS Server (Samba), Remote Denial of Service (DoS), Execution of Arbitrary Code, Unauthorized Access *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX CIFS-Server (Samba). The vulnerabilities could be exploited remotely to cause a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Neues Sysinternals-Tool hilft bei der Malware-Suche *** --------------------------------------------- Mit dem Programm Sysmon ist die beliebte Werkzeugsammlung von Microsoft Sysinternals um ein neues Tool zum Aufspüren verdächtiger Aktivitäten auf Windows-Rechnern gewachsen. --------------------------------------------- http://www.heise.de/security/meldung/Neues-Sysinternals-Tool-hilft-bei-der-…

1 0

Tageszusammenfassung - Donnerstag 7-08-2014
by Daily end-of-shift report 07 Aug '14

07 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-08-2014 18:00 − Donnerstag 07-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco IOS Software and Cisco IOS XE Software EnergyWise Crafted Packet Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20140806-energywise --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Security expert calls home routers a clear and present danger *** --------------------------------------------- In Black Hat Q&A, In-Q-Tel CISO says home routers are "critical infrastructure." --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/iXnyWy8k6JU/ *** Black Hat 2014: Netzbetreiber-Software zum Fernsteuern von Mobilgeräten erlaubt Missbrauch *** --------------------------------------------- Auf zwei Milliarden Mobilfunkgeräten läuft eine verwundbare Software, die Netzbetreibern zum Kontrollieren der Geräte dient. Mit geringem Aufwand können Angreifer die Geräte unbemerkt aus der Ferne manipulieren und so beispielsweise Datenverkehr mitschneiden. --------------------------------------------- http://www.heise.de/security/meldung/Black-Hat-2014-Netzbetreiber-Software-… *** Internet Explorer begins blocking out-of-date ActiveX controls *** --------------------------------------------- As part of our ongoing commitment to delivering a more secure browser, starting August 12th Internet Explorer will block out-of-date ActiveX controls. ActiveX controls are small apps that let Web sites provide content, like videos and games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-bloc… *** Cisco 2014 Midyear Security Report: Exposing Weak Links to Strengthen the Security Chain *** --------------------------------------------- You may be thinking, "What could have possibly changed since January?" True to form, the attacker community continues to evolve, innovate, and think up new ways to discover and exploit weak links in the security chain. Also true to form, they sometimes simply use tried and true methods to exploit some of the same old vulnerabilities that continue to present themselves. --------------------------------------------- https://blogs.cisco.com/security/cisco-2014-midyear-security-report-exposin… *** Securing VoIP systems *** --------------------------------------------- Countermeasures for these security issues are given below in greater detail: - Encryption - Firewalls - Traffic Analysis - Improved network Security - Authentication mechanisms - Apply appropriate patches - Turn off unnecessary protocols... --------------------------------------------- http://resources.infosecinstitute.com/securing-voip-systems/ *** Jetzt updaten: Ältere Synology NAS-Geräte anfällig für Ransomware *** --------------------------------------------- Der NAS-Hersteller Synology hat Details zu der Lücke bekannt gegeben, die der Erpressungs-Trojaner SynoLocker ausnutzt, um die Daten seiner Opfer zu verschlüsseln. Nach Informationen des Herstellers betrifft das Sicherheitsproblem nur ältere Firmware-Versionen und wurde im Dezember 2013 behoben. Die DiskStation-Manager-Software (DSM) Version 4.3-3810 oder älter soll betroffen sein, ein Update auf DSM 5.0 soll Abhilfe schaffen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Jetzt-updaten-Aeltere-Synology-NAS-G… *** OpenSSL-Updates - diesmal nicht ganz so schlimm *** --------------------------------------------- Die OpenSSL-Entwickler beseitigen neun Sicherheitslücken, die meisten von Google-Forschern entdeckt. Allerdings ist diesmal nichts wirklich dramatisches dabei. --------------------------------------------- http://www.heise.de/newsticker/meldung/OpenSSL-Updates-diesmal-nicht-ganz-s… *** Hintergrund: Politische Lösungen für eine sichere Zukunft der Kommunikation *** --------------------------------------------- Nach den Snowden-Enthüllungen steht eine Diskussion an, was wir zukünftig besser machen können, um Spionage und großflächige Massenüberwachung zu verhindern. Neben der besserer Technik braucht es da auch neue politische Ansätze, meint Linus Neumann. --------------------------------------------- http://www.heise.de/security/artikel/Politische-Loesungen-fuer-eine-sichere… *** Security Notice-Statement on 9 OpenSSL Vulnerabilities *** --------------------------------------------- Aug 07, 2014 20:29 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 6-08-2014
by Daily end-of-shift report 06 Aug '14

06 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-08-2014 18:00 − Mittwoch 06-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Another Bypass Identified in PayPal 2FA *** --------------------------------------------- A security researcher has uncovered a simple method for bypassing the two-factor authentication mechanism that PayPal uses to protect accounts that are tied to eBay accounts. The vulnerability is related to the way that the login flow works when a user is prompted to connect her eBay account to her PayPal account. The eBay and... --------------------------------------------- http://threatpost.com/another-bypass-identified-in-paypal-2fa/107605 *** Mozilla zukünftig mit zentralen Sperrlisten *** --------------------------------------------- Sichere Internet-Verbindungen erfordern Mechanismen, kompromittierte Zertifikate als ungültig zu erklären. Die aktuellen Verfahren dazu funktionieren jedoch nicht. Zukünftig soll das bei Firefox und Co die OneCRL richten. --------------------------------------------- http://www.heise.de/security/meldung/Mozilla-zukuenftig-mit-zentralen-Sperr… *** Researchers release CryptoLocker decryption tool *** --------------------------------------------- Tool uses private keys found in database of victims.The CryptoLocker ransomware is one of the nastiest pieces of malware to have targeted Internet users in recent years. The malware uses strong file encryption (more particularly, AES encryption with a key that has been encrypted using an RSA-2048 private key) to deny the user access to their files unless they pay a ransom of around US$300. At a time when we often seem to be learning about accidental or intentional vulnerabilities in encryption,... --------------------------------------------- http://www.virusbtn.com/blog/2014/08_06.xml?rss *** CipherShed *** --------------------------------------------- CipherShed is free (as in free-of-charge and free-speech) encryption software for keeping your data secure and private. It started as a fork of the now-discontinued TrueCrypt Project. --------------------------------------------- http://n0where.net/ciphershed/ *** Web-Fu - Chrome extension for pentesting web applications *** --------------------------------------------- Chrome extension for pentesting web applications. Web-fu Is a web hacking tool focused on discovering and exploiting web vulnerabilitites. --------------------------------------------- http://hack-tools.blackploit.com/2014/08/web-fu-chrome-extension-for-pentes…

1 0

Tageszusammenfassung - Dienstag 5-08-2014
by Daily end-of-shift report 05 Aug '14

05 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-08-2014 18:00 − Dienstag 05-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Synology - erste Informationen bezüglich "Synolocker" *** --------------------------------------------- Special Notes SynoLocker Message Issue - If NAS is not infected: First, close all open ports for external access for now. Backup the data on the DiskStation and update DSM to the latest version. Synology will provide further information as soon as possible if you are vulnerable. If NAS is infected, first do not trust (and ignore) any unauthorized, non-Synology messages or emails. Hard shut down the DiskStation to prevent any further issues. --------------------------------------------- https://myds.synology.com/support/support_form.php?lang=us *** Synolocker: Why OFFLINE Backups are important, (Tue, Aug 5th) *** --------------------------------------------- One current threat causing a lot of sleepless nights to victims is "Cryptolocker" like malware. Various variations of this type of malware are still haunting small businesses and home users by encrypting files and asking for ransom to obtain the decryption key. Your best defense against this type of malware is a good backup. Shadow volume copies may help, but arent always available and complete. In particular for small businesses, various simple NAS systems have become popular over --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18481&rss *** Ubuntu-Sperrbildschirm verliert Tastatureingaben *** --------------------------------------------- Eine jetzt geschlossene Sicherheitslücke im Sperrbildschirm der Linux-Distribution Ubuntu könnte zur Folge haben, dass Nutzer ihr Passwort aus Versehen öffentlich im Internet bekanntgeben. --------------------------------------------- http://www.heise.de/newsticker/meldung/Ubuntu-Sperrbildschirm-verliert-Tast… *** Barracuda Web Application Firewall Reusable URL-Based Authentication Tokens Let Remote Users Bypass Authentication *** --------------------------------------------- http://www.securitytracker.com/id/1030665 *** Evernote Patches Vulnerability in Android App *** --------------------------------------------- We have previously discussed an Android vulnerability that may lead to user data being captured or used to launch attacks. We discovered that the popular Android app for Evernote contained the said vulnerability. We disclosed the details to Evernote, and they took action by issuing an update to the Android version of their app. Evernote has added additional... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/BBLQmuk3RrQ/ *** Symantec Endpoint Protection Local Client Application Device Control Buffer Overflow *** --------------------------------------------- Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSEP Local Client ADC Buffer Overflow- Medium6.... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Bugtraq: SEC Consult SA-20140805-0 :: Multiple vulnerabilities in Readsoft Invoice Processing and Process Director *** --------------------------------------------- http://www.securityfocus.com/archive/1/533024 *** A Peek Into the Lions Den - The Magnitude [aka PopAds] Exploit Kit *** --------------------------------------------- Recently we managed to have an unusual peek into the content that is used on the servers of the prevalent exploit kit, Magnitude. In this blog post we'll review its most up-to-date administration panel and capabilities, as well as review some infection statistics provided by Magnitude over the course of several weeks. These days, after the arrest of Paunch, Blackhole exploit kit creator, exploit kit developers and sellers have learned their lesson regarding doing business in the --------------------------------------------- http://blog.spiderlabs.com/2014/08/a-peek-into-the-lions-den-the-magnitude-… *** Vulnerability in Spotify Android App May Lead to Phishing *** --------------------------------------------- We have discovered a vulnerability that affects versions of the Spotify app for Android older than 1.1.1. If exploited, the vulnerability can allow bad guys to control what is being displayed on the app interface. This vulnerability can be potentially abused by cybercriminals to launch phishing attacks that may result to information loss or theft. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/GZKakDZwRhw/

1 0

Tageszusammenfassung - Montag 4-08-2014
by Daily end-of-shift report 04 Aug '14

04 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 01-08-2014 18:00 − Montag 04-08-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** ZDI-14-273: AlienVault OSSIM av-centerd Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault OSSIM. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-273/ *** Remote code execution on Android devices *** --------------------------------------------- You walk into a coffee shop and take a seat. While waiting for your coffee, you take out your smartphone and start playing a game you downloaded the other day. Later, you go to work and check your email in the elevator. Without you knowing, an attacker has just gained a foothold in your corporate... --------------------------------------------- http://labs.bromium.com/2014/07/31/remote-code-execution-on-android-devices/ *** POWELIKS: Malware Hides In Windows Registry *** --------------------------------------------- We spotted a malware that hides all its malicious codes in the Windows Registry. The said tactic provides evasion and stealth mechanisms to the malware, which Trend Micro detects as TROJ_POWELIKS.A. When executed, TROJ_POWELIKS.A downloads files, which can cause further system infection. Systems affected by this malware risk being infected by other malware, thus causing further... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OEAKGdXwSnc/ *** All Samba 4.x.x are vulnerable to a remote code execution vulnerability in the nmbd NetBIOS name services daemon, (Sat, Aug 2nd) *** --------------------------------------------- A remote code execution in nmbd (the NetBIOS name services daemon) has been found in Samba versions 4.0.0 to 4.1.10. ( assgined CVE-2014-3560) and a patch has been release by the team at samba.org. Heres the details from http://www.samba.org/samba/security/CVE-2014-3560 =========== Description =========== All current versions of Samba 4.x.x are vulnerable to a remote code execution vulnerability in the nmbd NetBIOS name services daemon. A malicious browser can send packets that may overwrite --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18471&rss *** TP-Link TL-WR740N v4 arbitrary shell command execution *** --------------------------------------------- Topic: TP-Link TL-WR740N v4 arbitrary shell command execution Risk: High Text:# Exploit Title: TP-Link TL-WR740N v4 router (FW-Ver. 3.16.6 Build 130529 Rel.47286n) arbitrary shell command execution # Dat... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014080013 *** Verschlüsselungstrojaner attackiert Synology-Speichersysteme *** --------------------------------------------- Cyber-Erpresser haben einen neuen, direkten Weg gefunden, um das digitale Hab und Gut ihrer Opfer als Geisel zu nehmen: Sie nutzen eine Sicherheitslücke in der NAS-Firmware, um den gesamten Netzwerkspeicher zu verschlüsseln. --------------------------------------------- http://www.heise.de/newsticker/meldung/Verschluesselungstrojaner-attackiert… *** China boots Kaspersky and Symantec off security contractor list *** --------------------------------------------- Foreign firms dropped from roll of approved infosec vendors Kaspersky Labs and Symantec have both been booted off China's list of approved security vendors for government agencies, as the country continues to tighten up against foreign tech firms in the wake of the NSA indiscriminate surveillance revelations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/08/04/kaspersky_s… *** Bugtraq: ownCloud Unencrypted Private Key Exposure *** --------------------------------------------- http://www.securityfocus.com/archive/1/533010 *** Backdoor Techniques in Targeted Attacks *** --------------------------------------------- Backdoors are an essential part of targeted attacks, as they allow an external threat actor to exercise control over any compromised machines. These allow the threat actor to collect information and move laterally within the targeted organization. Our investigations into various targeted attacks have showed that a wide variety of tactics are used by backdoors to carry out... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fHW4IPov8YE/ *** IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM WebSphere Real Time *** --------------------------------------------- Java SE issues disclosed in the Oracle July 2014 Critical Patch Update, plus 1 additional vulnerability CVE(s): CVE-2014-3086, CVE-2014-4227, CVE-2014-4262, CVE-2014-4219, CVE-2014-4209, CVE-2014-4220, CVE-2014-4268, CVE-2014-4218, CVE-2014-4252, CVE-2014-4266, CVE-2014-4265, CVE-2014-4221, CVE-2014-4263, CVE-2014-4244 and CVE-2014-4208 Affected product(s) and affected version(s): IBM WebSphere Real Time Version 3 Service Refresh 7 and earlier Refer to the following reference URLs for --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Security vulnerabilities in Apache Tomcat in Rational DOORS Web Access *** --------------------------------------------- The Apache Tomcat application server in installations of IBM Rational DOORS Web Access version contains security vulnerabilities. CVE(s): CVE-2013-4322, CVE-2013-4590, CVE-2014-0096, CVE-2014-0099 and CVE-2014-0119 Affected product(s) and affected version(s): Rational DOORS Web Access version 9.6.0.x, 9.5.2.x, 9.5.1.x, 9.5.0.x, 1.5.0.x, 1.4.0.4 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Freitag 1-08-2014
by Daily end-of-shift report 01 Aug '14

01 Aug '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 31-07-2014 18:00 − Freitag 01-08-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Russian ransomware author takes the easy route *** --------------------------------------------- Symantec Security Response has observed a new variant of ransomcrypt malware which is easy to update and uses open source components to encrypt files. The variant, detected as Trojan.Ransomcrypt.L, uses a legitimate open source implementation of the OpenPGP standard to encrypt files on the victim’s computer. The threat then displays a ransom notice in Russian, asking the user to pay in order to unlock the files. --------------------------------------------- http://www.symantec.com/connect/blogs/russian-ransomware-author-takes-easy-… *** Announcing EMET 5.0 *** --------------------------------------------- Today, we are excited to announce the general availability of the Enhanced Mitigation Experience Toolkit (EMET) 5.0. As many of you already know, EMET is a free tool, designed to help customers with their defense in depth strategies against cyberattacks, by helping detect and block exploitation techniques .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/07/31/announcing-emet-v5.aspx *** Backoff - Technical Analysis *** --------------------------------------------- As discussed in the an advisory published by US-CERT, Trustwave SpiderLabs has discovered a previously unidentified family of Point of Sale (PoS) malware. This blog post serves as a technical analysis of the Backoff malware family. While a number .. --------------------------------------------- http://blog.spiderlabs.com/2014/07/backoff-technical-analysis.html *** BadUSB: Wenn USB-Geräte böse werden *** --------------------------------------------- Wer die Firmware eines USB-Sticks kontrolliert, kann den zu einem perfekten Trojaner umfunktionieren. Deutsche Forscher zeigen, dass das komplett via Software möglich ist und sich damit ganz neue Infektions-Szenarien eröffnen. --------------------------------------------- http://www.heise.de/security/meldung/BadUSB-Wenn-USB-Geraete-boese-werden-2… *** Backups - The Forgotten Website Security Pillar *** --------------------------------------------- I travel a lot (a lot might actually be an understatement these days), but the travel always revolves around a couple common threads - namely website security education and awareness. In these travels, regardless of the community I am engaging with, there are always common questions .. --------------------------------------------- http://blog.sucuri.net/2014/07/backups-the-forgotten-website-security-pilla… *** The Severe Flaw Found in Certain File Locker Apps *** --------------------------------------------- Protecting data has always been one of the most important aspects of our digital life. Given the amount of activity done on smartphones, this is especially rings true for smartphones. While users may use the built-in privacy and security settings of their devices, others take it a step further and employ security .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-severe-flaw-… *** MediaWiki Input Validation Flaws Permit Cross-Site Scripting and Clickjacking Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030660 *** Offensive Security reports of Symantec Endpoint Protection zero-day vulnerability (July 2014) *** --------------------------------------------- This Knowledge Base article will be updated as further information becomes available. Please subscribe to this document to receive update notifications automatically. To mitigate this issue while research is underway and solutions are being identified, uninstall or disable the sysplant driver. --------------------------------------------- http://www.symantec.com/business/support/index?page=content&id=TECH223338 *** Backdoor.Gates: Also Works for Windows *** --------------------------------------------- We have received reports about a Linux malware known as Backdoor.Gates. Analysis showed that this malware has the following features .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002728.html *** SubSTATION Server Telegyr 8979 Master Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for a Buffer Overflow Vulnerability in the SUBNET Solutions Inc (SUBNET), SubSTATION Server 2, Telegyr 8979 Master .. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-196-01 *** Yes, Hackers Could Build an iPhone Botnet - Thanks to Windows *** --------------------------------------------- A reminder to Apple and smug iPhone owners: Just because iOS has never been the victim of a widespread malware outbreak doesn't mean mass iPhone hacking isn't still possible. Now one group of security researchers plans .. --------------------------------------------- http://www.wired.com/2014/08/yes-hackers-could-build-an-iphone-botnetthanks… *** Citadel Malware Variant Allows Attackers Remote Access, Even After Removal *** --------------------------------------------- A new variant of the Citadel banking Trojan has been discovered where the attackers are using Windows remote shell commands to be enable Remote Desktop Protocol access, even if the malware is discovered and removed. --------------------------------------------- http://threatpost.com/citadel-malware-variant-allows-attackers-remote-acces…

1 0

Tageszusammenfassung - Donnerstag 31-07-2014
by Daily end-of-shift report 31 Jul '14

31 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 30-07-2014 18:00 − Donnerstag 31-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Innominate mGuard Unauthorized Leakage of System Data *** --------------------------------------------- Exploitation of this vulnerability could allow a remote unauthenticated user access to release configuration information. While this is a minor vulnerability, it represents a method for further network reconnaissance. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-189-02 *** How safe is your quantified self? Tracking, monitoring, and wearable tech *** --------------------------------------------- Self-tracking enthusiasts are generating a torrent of personal information through apps and devices. Is this data safe from prying eyes? --------------------------------------------- http://www.symantec.com/connect/blogs/how-safe-your-quantified-self-trackin… *** Why the Security of USB Is Fundamentally Broken *** --------------------------------------------- Computer users pass around USB sticks like silicon business cards. Although we know they often carry malware infections, we depend on antivirus scans and the occasional reformatting to keep our thumbdrives from becoming the carrier for the .. --------------------------------------------- http://www.wired.com/2014/07/usb-security/ *** TA14-212A: Backoff Point-of-Sale Malware *** --------------------------------------------- “Backoff” is a family of PoS malware and has been discovered recently. The malware family has been witnessed on at least three separate forensic investigations. Researchers have identified three primary variants to the “Backoff” malware including .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA14-212A *** Takedowns: Touchdown or Turnover? *** --------------------------------------------- Over the last several months malware takedowns have made headlines. But what is really involved in such an operation? The recent takedowns have been a collaborative effort mostly between the private sector and government entities, with academic researchers also playing a role. While some operations included arrests, and others included a civil lawsuit, .. --------------------------------------------- http://www.seculert.com/blog/2014/07/takedowns-touchdown-or-turnover.html *** 3 security mistakes small companies make and how to avoid them *** --------------------------------------------- Dedicated IT staff are a luxury most very small businesses do without but those organisations still need to find a way to secure their computers against cyber ciminals who arent looking to cut them a break just because they're small. --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/31/3-security-mistakes-small-compan… *** How to Hunt Down Phishing Kits *** --------------------------------------------- Sites like phishtank and clean-mx act as crowdsourced phishing detection and validation. By knowing how to look, you can consistently find interesting information about how attackers work, and the tools they use to conduct phishing campaigns. This post will give an example of how phishing kits are used, how to find them, as well as show a case study into other .. --------------------------------------------- https://jordan-wright.github.io/blog/2014/07/30/how-to-hunt-down-phishing-k… *** Spy of the Tiger *** --------------------------------------------- A recent report documents a group of attackers known as 'PittyTiger' that appears to have been active since at least 2011; however, they may have been operating as far back as 2008. We have been monitoring the activities of this .. --------------------------------------------- http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-th… *** Angriff auf Videospiele-Hersteller: Hacker haben es auf Quellcode abgesehen *** --------------------------------------------- Die Hacker der "Threat Group 3279" sind seit Jahren aktiv und versuchen, Quellcode von Spielen zu stehlen und die Sicherheitsvorkehrungen der dazugehörigen DRM-Systeme zu knacken. Die Gruppe soll aus China stammen. --------------------------------------------- http://www.heise.de/security/meldung/Angriff-auf-Videospiele-Hersteller-Hac…

1 0

Tageszusammenfassung - Mittwoch 30-07-2014
by Daily end-of-shift report 30 Jul '14

30 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 29-07-2014 18:00 − Mittwoch 30-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** 22 Jump Street, Transformers Are Top Movie Lures for Summer *** --------------------------------------------- Summertime has become synonymous with blockbuster movies. Unfortunately, these movies have become a go-to social engineering lure used by cybercriminals. Just like in previous years, Trend Micro engineers searched for possible threats related to movies released during the summer. This year, 22 Jump Street was the top movie used for social .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/22-jump-street-t… *** Google Android Certificate Chain Validation Flaw Lets Applications Gain Elevated Privileges *** --------------------------------------------- The software does not properly validate an application's certificate chain. An application can supply a specially crafted application identity certificate to impersonate a privileged application and gain access to vendor-specific device administration extensions. --------------------------------------------- http://www.securitytracker.com/id/1030654 *** Erpressungs-Trojaner CTB-Locker verschlüsselt sicher und verwischt Spuren *** --------------------------------------------- Wenn man diesem Schädling zum Opfer fällt, gibt es wenig Hoffnung für die eigenen Daten. Diese sind mit State-of-the-Art-Verschlüsselung gesichert und der Trojaner kommuniziert nur verschlüsselt über das Tor-Netz mit seinen Kontrollservern. --------------------------------------------- http://www.heise.de/security/meldung/Erpressungs-Trojaner-CTB-Locker-versch… *** Symantec Endpoint Protection 0day *** --------------------------------------------- In a recent engagement, we had the opportunity to audit the Symantec Antivirus Endpoint Protection solution, where we found a multitude of vulnerabilities. Some of these made it to CERT, while others have been scheduled for review during our upcoming AWE course at Black Hat 2014, Las Vegas. Ironically, the same software that was meant to protect the organization under review was the reason for its compromise. --------------------------------------------- http://www.offensive-security.com/vulndev/symantec-endpoint-protection-0day/ *** Scan Shows Possible Heartbleed Fix Failures *** --------------------------------------------- Of more than 1,600 Global 2000 firms, only 3% of their public-facing servers have been fully and properly locked down from the Heartbleed vulnerability that was first revealed .. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/vulnerability-manageme… *** Tor security advisory: "relay early" traffic confirmation attack *** --------------------------------------------- On July 4 2014 we found a group of relays that we assume were trying to deanonymize users. They appear to have been targeting people who operate or access Tor hidden services. The attack involved modifying Tor protocol headers to do traffic confirmation attacks. --------------------------------------------- https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-… *** Internet of Things: Kreditkartennummern und das Passwort 1234 *** --------------------------------------------- Hersteller von vernetzten Geräten gehen sorglos mit deren Sicherheit um. Kaputte Webinterfaces, überflüssige Kreditkarteninformationen und zu einfache Passwörter wie 1234 machen viele Geräte angreifbar. --------------------------------------------- http://www.golem.de/news/internet-of-things-kreditkartennummern-und-das-pas… *** Multiple vulnerabilities in Kunena Forum Extension for Joomla *** --------------------------------------------- http://www.securityfocus.com/archive/1/532933 http://www.securityfocus.com/archive/1/532932 *** Multiple vulnerabilities in SAP products *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94932 http://xforce.iss.net/xforce/xfdb/94931 http://xforce.iss.net/xforce/xfdb/94930 http://xforce.iss.net/xforce/xfdb/94922 http://xforce.iss.net/xforce/xfdb/94923 http://xforce.iss.net/xforce/xfdb/94921

1 0

Tageszusammenfassung - Dienstag 29-07-2014
by Daily end-of-shift report 29 Jul '14

29 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 28-07-2014 18:00 − Dienstag 29-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Critroni/Onion - Newest Addition to Encrypting Ransomware *** --------------------------------------------- In my last blog post about a week ago, I talked about how Cryptolocker and the like are not dead and we will continue to see more of them in action. It's a successful 'business model' and I don't see it going away anytime soon. Not even a few days after my post a new encrypting ransomware emerged. This .. --------------------------------------------- http://www.webroot.com/blog/2014/07/25/critroni-new-encrypting-ransomware/ *** Interesting HTTP User Agent "chroot-apach0day", (Mon, Jul 28th) *** --------------------------------------------- Our reader Robin submitted the following detect: Ive got a site that was scanned this morning by a tool that left these entries in the logs: [HTTP_USER_AGENT] => chroot-apach0day .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18453 *** Cisco Prime Data Center Network Manager Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030652 *** Hacker klauten Pläne für Israels Raketenschild "Iron Dome" *** --------------------------------------------- Bei einem Hackerangriff auf drei israelische Waffenschmieden sollen Hacker der chinesischen Regierung in den Jahren 2011 und 2012 haufenweise wichtige Daten zu dem Raketenabwehrsystem erbeutet haben. Die Angreifer sollen der Spezialeinheit 61398 angehören. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-klauten-Plaene-fuer-Israels-Rak… *** Android crypto blunder exposes users to highly privileged malware *** --------------------------------------------- The majority of devices running Google's Android operating system are susceptible to hacks that allow malicious apps to bypass a key security sandbox so they can steal user credentials, read e-mail, and access payment histories and other sensitive data, researchers have warned. --------------------------------------------- http://arstechnica.com/security/2014/07/android-crypto-blunder-exposes-user… *** Changes in the Asprox Botnet *** --------------------------------------------- In this blog post, we took a quick overview of Asprox's functions and saw the updates that it has made to its C&C code. With added RSA encryption, another C&C command, and updated messaging format, it does not look like Asprox will stop evolving. We will continue to monitor Asprox for any changes and will keep you updated. --------------------------------------------- https://blog.fortinet.com/Changes-in-the-Asprox-Botnet/ *** How Cybercrime Exploits Digital Certificates *** --------------------------------------------- Security experts recognize 2011 as the worst year for certification authorities. The number of successful attacks against major companies reported during the year has no precedent, many of them had serious consequences. --------------------------------------------- http://resources.infosecinstitute.com/cybercrime-exploits-digital-certifica… *** Security: Antivirenscanner machen Rechner unsicher *** --------------------------------------------- Ein Datenexperte hat sich aktuelle Virenscanner angesehen. Viele seien durch einfache Fehler angreifbar, meint er. Da sie tief ins System eingreifen, stellen sie eine besondere Gefahr dar - obwohl sie eigentlich schützen sollen. --------------------------------------------- http://www.golem.de/news/security-antivirenscanner-machen-rechner-unsicher-… *** Elasticsearch-Lücke verwandelt Amazon-Cloud-Server in DDoS-Zombies *** --------------------------------------------- Durch eine Sicherheitslücke in einer älteren Elasticsearch-Version können Angreifer beliebigen Schadcode ausführen. Das wird momentan dazu genutzt, Server in Amazons EC2-Cloud zu kapern und für DDoS-Angriffe zu missbrauchen. --------------------------------------------- http://www.heise.de/security/meldung/Elasticsearch-Luecke-verwandelt-Amazon… *** Multiple vulnerabilities in Oxwall 1.7.0 *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070156 http://cxsecurity.com/issue/WLB-2014070155

1 0

Tageszusammenfassung - Montag 28-07-2014
by Daily end-of-shift report 28 Jul '14

28 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 25-07-2014 18:00 − Montag 28-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco WebEx Meetings Server Authenticated Encryption Vulnerability *** --------------------------------------------- A vulnerability in the user.php script of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cacti cross-site scripting *** --------------------------------------------- Cacti is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the Full Name field to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting .. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94862 *** Cisco WebEx Meetings Server OutlookAction Class Vulnerability *** --------------------------------------------- A vulnerability in the OutlookAction Class of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to enumerate valid user accounts. The vulnerability is due to .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Web Framework Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view sensitive information. The vulnerability occurs because sensitive information is passed in a query string. An attacker could .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Service Drains Competitors' Online Ad Budget *** --------------------------------------------- The longer one lurks in the Internet underground, the more difficult it becomes to ignore the harsh reality that for nearly every legitimate online business there is a cybercrime-oriented anti-business. Case in point: Todays post looks at a popular service that helps crooked online marketers exhaust the Google AdWords budgets of their competitors. --------------------------------------------- http://krebsonsecurity.com/2014/07/service-drains-competitors-online-ad-bud… *** Daimler: Mit eigener Hacker-Gruppe gegen Sicherheitslücken *** --------------------------------------------- Der Automobilhersteller Daimler beschäftigt eine fest angestellte Gruppe von Datenspezialisten, deren Aufgabe es ist, das eigene Firmennetzwerk zu attackieren. So sollen Sicherheitslücken schneller aufgespürt werden. --------------------------------------------- http://www.golem.de/news/daimler-mit-eigener-hacker-gruppe-gegen-sicherheit… *** Ubiquiti UbiFi Controller 2.4.5 Password Hash Disclosure *** --------------------------------------------- If remote logging is enabled on the UniFi controller, syslog messages are sent to a syslog server. Contained within the syslog messages is the admin password that is used by both the UniFi controller, and all managed Access Points. This CVE was .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070146 *** Tails: Zero-Day im Invisible Internet Project *** --------------------------------------------- In der Linux-Distribution Tails befindet sich eine Sicherheitslücke, über die Nutzeridentitäten aufgedeckt werden können. Die Schwachstelle ist nicht in Tor, sondern im Invisible-Internet-Project-Netzwerk zu finden. --------------------------------------------- http://www.golem.de/news/tails-zero-day-im-invisible-internet-project-1407-… *** DANE disruptiv: Authentifizierte OpenPGP-Schlüssel im DNS *** --------------------------------------------- Pretty Good Privacy soll das DNS zur Schlüsselpropagierung nutzen. Auf der Liste der Entwickler der Internet Engineering Task Force (IETF) steht als nächstes die Zulassung eigenen Schlüsselmaterials. --------------------------------------------- http://www.heise.de/security/meldung/DANE-disruptiv-Authentifizierte-OpenPG… *** Behind the Android.OS.Koler distribution network *** --------------------------------------------- Android.OS.Koler.a a ransomware program that blocks the screen of an infected device and requests a ransom in order to unlock the device. An entire network of malicious porn sites linked to a traffic direction system that redirects the victim to different payloads targeting not only mobile devices but any other visitor. --------------------------------------------- https://securelist.com/blog/research/65189/behind-the-android-os-koler-dist… *** Dissecting the CVE-2013-2460 Java Exploit *** --------------------------------------------- In this vulnerability, code is able to get the references of some restricted classes which are cleverly used for privilege escalation and bypassing the JVM sandbox. The vulnerable 'invoke' method of the 'sun.tracing.ProviderSkeleton' class is used to .. --------------------------------------------- http://research.zscaler.com/2014/07/dissecting-cve-2013-2460-java-exploit.h… *** Anatomy of an iTunes phish - tips to avoid getting caught out *** --------------------------------------------- Even if youd back yourself to spot a phish every time, heres a step-by-step account that might help to save your friends and family in the future... --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/28/anatomy-of-an-itunes-phish-tips-… *** ICS 3C - ICS Cybersecurity Council Conference *** --------------------------------------------- ICS 3C gathers experts and decision makers placing Cybersecurity at the heart of a Pan-European Dialogue on solutions for securing critical processes. --------------------------------------------- http://www.anapur.de/u_e_ICS_Cybersecurity_Conference_2014_HD.htm *** Trojaner: Warnungen vor gefälschten Ikea-Mails *** --------------------------------------------- Schon mehrere tausend Funde, E-Mails sind "täuschend echt" .. --------------------------------------------- http://derstandard.at/2000003626539 *** Malware, Would You Install it for One Cent? *** --------------------------------------------- A research study report entitled It's All About The Benjamins: An empirical study on incentivizing users to ignore security .. --------------------------------------------- http://www.seculert.com/blog/2014/07/would-you-install-potential-malware-fo…

1 0

Tageszusammenfassung - Freitag 25-07-2014
by Daily end-of-shift report 25 Jul '14

25 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-07-2014 18:00 − Freitag 25-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** More Details of Onion/Critroni Crypto Ransomware Emerge *** --------------------------------------------- New ransomware has been dubbed Onion by researchers at Kaspersky Lab as its creators use command and control servers hidden in the Tor Network (a/k/a The Onion Router) to obscure their malicious activity. --------------------------------------------- http://threatpost.com/onion-ransomware-demands-bitcoins-uses-tor-advanced-e… *** Kali 1.0.8 released with UEFI boot support, more info at http://www.kali.org/news/kali-1-0-8-released-uefi-boot-support/, (Fri, Jul 25th) *** --------------------------------------------- -- Bojan INFIGO IS (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18443&rss *** Gefährlicher als die NSA: Firmen unterschätzen kriminelle Hacker *** --------------------------------------------- Allianz für Cyber-Sicherheit beim deutschen Bundesamt für Sicherheit in der Informationstechnik sieht größten Nachholbedarf in produzierenden Unternehmen --------------------------------------------- http://derstandard.at/2000003528513 *** TAILS Team Recommends Workarounds for Flaw in I2P *** --------------------------------------------- The developers of the TAILS operating system say that users can mitigate the severity of the critical vulnerability researchers discovered in the I2P software that's bundled with TAILS with a couple of workarounds, but there is no patch for the bug yet. The vulnerability that affects TAILS is in the I2P anonymity network software that comes... --------------------------------------------- http://threatpost.com/tails-team-recommends-workarounds-for-flaw-in-i2p/107… *** Fake GoogleBots are third most common DDoS attacker *** --------------------------------------------- An analysis of 400 million search engine visits to 10,000 sites done by Incapsula researchers has revealed details that might be interesting to web operators and SEO professionals. --------------------------------------------- http://www.net-security.org/secworld.php?id=17169 *** New SSL server rules go into effect Nov. 1 *** --------------------------------------------- Public certificate authorities (CAs) are warning that as of Nov. 1 they will reject requests for internal SSL server certificates that don't conform to new internal domain naming and IP address conventions designed to safeguard networks. --------------------------------------------- http://www.networkworld.com/article/2457649/security0/new-ssl-server-rules-… *** The App I Used to Break Into My Neighbor's Home *** --------------------------------------------- Leave your ring of cut-brass secrets unattended on your desk at work, at a bar table while you buy another round, or in a hotel room, and any stranger---or friend---can upload your keys to their online collection. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/3cdb9908/sc/36/l/0L0Swired0N0C20A… *** Attackers abusing Internet Explorer to enumerate software and detect security products *** --------------------------------------------- During the last few years we have seen an increase on the number of malicious actors using tricks and browser vulnerabilities to enumerate the software that is running on the victim's system using Internet Explorer.In this blog post we will describe some of the techniques that attackers are using to perform reconnaisance that gives them information for future attacks. We have also seen these techniques being used to decide whether or not they exploit the victim based on detected... --------------------------------------------- http://www.alienvault.com/open-threat-exchange/blog/attackers-abusing-inter… *** Building a Legal Botnet in the Cloud *** --------------------------------------------- Two researchers have built a botnet using free anonymous accounts. They only collected 1,000 accounts, but theres no reason this cant scale to much larger numbers.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/07/building_a_lega.html *** Bugtraq: Security advisory for Bugzilla 4.5.5, 4.4.5, 4.2.10, and 4.0.14 *** --------------------------------------------- http://www.securityfocus.com/archive/1/532895 *** Morpho Itemiser 3 Hard-Coded Credential *** --------------------------------------------- This advisory provides vulnerability information for hard-coded credentials in the Morpho Itemiser 3. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-205-01 *** VU#394540: Sabre AirCentre Crew contains a SQL injection vulnerability *** --------------------------------------------- Vulnerability Note VU#394540 Sabre AirCentre Crew contains a SQL injection vulnerability Original Release date: 25 Jul 2014 | Last revised: 25 Jul 2014 Overview Sabre AirCentre Crew 2010.2.12.20008 and earlier contains a SQL injection vulnerability. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Sabre AirCentre Crew 2010.2.12.20008 and earlier is vulnerable to a SQL Injection attack in the username and password fields in CWPLogin.aspx. --------------------------------------------- http://www.kb.cert.org/vuls/id/394540 *** Cisco Unified Presence Server Sync Agent Vulnerability *** --------------------------------------------- CVE-2014-3328 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2014-3305 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Stack Trace Vulnerability *** --------------------------------------------- CVE-2014-3301 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014…

1 0

Tageszusammenfassung - Donnerstag 24-07-2014
by Daily end-of-shift report 24 Jul '14

24 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-07-2014 18:00 − Donnerstag 24-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** ZDI-14-264: (0Day) Apple QuickTime mvhd Atom Heap Memory Corruption Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-264/ *** ZDI-14-263: (0Day) Hewlett-Packard Data Protector Cell Request Service Opcode 1091 Directory Traversal Arbitrary File Write Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Data Protector. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-263/ *** ZDI-14-262: (0Day) Hewlett-Packard Data Protector Cell Request Service Opcode 305 Directory Traversal Arbitrary File Creation Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Data Protector. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-262/ *** [Honeypot Alert] Wordpress XML-RPC Brute Force Scanning *** --------------------------------------------- There are news reports of new Wordpress XML-PRC brute force attacks being seen in the wild. The SANS Internet Storm Center also has a Diary entry showing similar data. We have captured similar attacks in our web honeypots so we wanted to share more data with the community. Please reference earlier blog posts we have done related to Wordpress: Wordpress XML-RPC Pingback Vulnerability Analysis Defending Wordpress Logins from Brute Force Attacks Thanks goes to my SpiderLabs Research colleague --------------------------------------------- http://blog.spiderlabs.com/2014/07/honeypot-alert-wordpress-xml-rpc-brute-f… *** Smart Grid Attack Scenarios *** --------------------------------------------- This is the third (and last) in a series of posts looking at the threats surrounding smart grids and smart meters. In the first post, we introduced smart meters, smart grids, and showed why these can pose risks. In the second post, we looked at the risks of attacks on smart meters. In this post,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/6sRN65gV904/ *** Windows Previous Versions against ransomware, (Thu, Jul 24th) *** --------------------------------------------- One of the cool features that Microsoft actually added in Windows Vista is the ability to recover previous versions of files and folders. This is part of the VSS (Volume Shadow Copy Service) which allows automatic creation of backup copies on the system. Most users "virtually meet" this service when they are installing new software, when a restore point is created that allows a user to easily revert the operating system back to the original state, if something goes wrong. However, --------------------------------------------- https://isc.sans.edu/diary/Windows+Previous+Versions+against+ransomware/184… *** BMWs ConnectedDrive falls over, bosses blame upgrade snafu *** --------------------------------------------- Traffic flows up 20% as motorway middle lanes miraculously unclog BMWs ConnectedDrive car-to-mobe interface has suffered a UK-wide outage that may also affect customers in mainland Europe. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/24/bmw_connect… *** Dirty Dozen Spampionship - which country is spewing the most spam? *** --------------------------------------------- The World Cup may be done and dusted, but the Spampionship continues! Where did you come in our spam-sending league tables? --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/22/dirty-dozen-spampionship-which-c… *** A new generation of ransomware *** --------------------------------------------- Trojan-Ransom.Win32.Onion a highly dangerous threat and one of the most technologically advanced encryptors out there. Its developers used both proven techniques 'tested' on its predecessors and solutions that are completely new for this class of malware. The use of an unorthodox cryptographic scheme makes file decryption impossible, even if traffic is intercepted between the Trojan and the server. --------------------------------------------- https://securelist.com/analysis/publications/64608/a-new-generation-of-rans… *** Bugcrowd Releases Open Source Vulnerability Disclosure Framework *** --------------------------------------------- The problems that come from doing security research on modern Web applications and other software aren't just challenging for researchers, but also for the companies on the receiving end of their advisories. Companies unaccustomed to dealing with researchers can find themselves in a difficult position, trying to figure out the clearest path forward. To help... --------------------------------------------- http://threatpost.com/bugcrowd-releases-open-source-vulnerability-disclosur… *** SA-CONTRIB-2014-072 - Freelinking, Freelinking Case Tracker - Access bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-072Project: freelinking (third-party module)Project: freelinking case tracker (third-party module)Version: 6.x, 7.xDate: 2014-July-23Security risk: CriticalExploitable from: RemoteVulnerability: Access bypassDescriptionThe freelinking and freelinking case tracker modules implement a filter for the easier creation of HTML links to other pages in the site or external sites with a wiki style format such as [[pluginname:identifier]].The module doesnt sufficiently... --------------------------------------------- https://www.drupal.org/node/2308503 *** Siemens OpenSSL Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-198-03 Siemens OpenSSL Vulnerabilities that was published July 17, 2014, on the NCCIC/ICS-CERT web site. This updated advisory provides mitigation details for vulnerabilities in the Siemens OpenSSL cryptographic software library affecting several Siemens industrial products. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-198-03A *** Sierra Wireless AirLink Raven X EV-DO Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the advisory titled ICSA-14-007-01A Sierra Wireless AirLink Raven X EV-DO Multiple Vulnerabilities that was published January 16, 2014, on the NCCIC/ICS CERT web site. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-007-01B *** HPSBMU03076 rev.1 - HP Systems Insight Manager (SIM) on Linux and Windows running OpenSSL, Multiple Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Systems Insight Manager running on Linux and Windows which could be exploited remotely resulting in multiple vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU03074 rev.1 - HP Insight Control server migration on Linux and Windows running OpenSSL, Remote Denial of Service (DoS), Code Execution, Unauthorized Access, Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Insight Control server migration running on Linux and Windows which could be exploited remotely resulting in denial of service (DoS), code execution, unauthorized access, or disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Cisco TelePresence Management Interface Vulnerability *** --------------------------------------------- CVE-2014-3324 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Bugtraq: Beginners error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of other account *** --------------------------------------------- Beginners error: import function of Windows Mail executes rogue program C:\Program.exe with credentials of other account --------------------------------------------- http://www.securityfocus.com/archive/1/532875

1 0

Tageszusammenfassung - Mittwoch 23-07-2014
by Daily end-of-shift report 23 Jul '14

23 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-07-2014 18:00 − Mittwoch 23-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** DDoS attacks remain up, stronger in Q2, report says *** --------------------------------------------- Prolexics second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth. --------------------------------------------- http://www.scmagazine.com/ddos-attacks-remain-up-stronger-in-q2-report-says… *** De-obfuscating the DOM based JavaScript obfuscation found in EK's such as Fiesta and Rig *** --------------------------------------------- There is little doubt that exploit kit (EK) developers are continuing to improve their techniques and are making exploit kits harder to detect. They have heavily leveraged obfuscation techniques for JavaScript and are utilizing browser functionality to their advantage. Recent exploit kits such as "Fiesta" and "Rig" for example, have been found to be using DOM based JavaScript obfuscation. In... --------------------------------------------- http://research.zscaler.com/2014/07/de-obfuscating-dom-based-javascript.html *** Securing the Nest Thermostat *** --------------------------------------------- A group of hackers are using a vulnerability in the Nest thermostat to secure it against Nests remote data collection.... --------------------------------------------- https://www.schneier.com/blog/archives/2014/07/securing_the_ne.html *** WordPress brute force attack via wp.getUsersBlogs, (Tue, Jul 22nd) *** --------------------------------------------- Now that the XMLRPC "pingback" DDoS problem in WordPress is increasingly under control, the crooks now seem to try brute force password guessing attacks via the "wp.getUsersBlogs" method of xmlrpc.php. ISC reader Robert sent in some logs that show a massive distributed (> 3000 source IPs) attempt at guessing passwords on his Wordpress installation. The requests look like the one shown below and are posted into xmlrpc.php. Unfortunately, the web server responds with a --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18427&rss *** New Feature: "Live" SSH Brute Force Logs and New Kippo Client, (Wed, Jul 23rd) *** --------------------------------------------- We are announcing a new feature we have been working on for a while, that will display live statistics on passwords used by SSH brute forcing bots. In addition, we also updated our script that will allow you to contribute data to this effort. Right now, we are supporting the kippo honeypot to collect data. This script will submit usernames, passwords and the IP address of the attacker to our system. To download the script see https://isc.sans.edu/clients/kippo/kippodshield.pl . The script uses --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18433&rss *** Arbeit für Admins: Apache 2.4.10 stopft Sicherheitslücken *** --------------------------------------------- Für Administratoren von Webservern, die auf Apache 2.4.x laufen, heißt es updaten. Die Apache-Entwickler haben mit der neuesten Version der Software fünf Lücken geschlossen, eine davon erlaubt das Ausführen von Schadcode aus dem Netz. --------------------------------------------- http://www.heise.de/security/meldung/Arbeit-fuer-Admins-Apache-2-4-10-stopf… *** How Thieves Can Hack and Disable Your Home Alarm System *** --------------------------------------------- When it comes to the security of the Internet of Things, a lot of the attention has focused on the dangers of the connected toaster, fridge and thermostat. But a more insidious security threat lies with devices that aren't even on the internet: wireless home alarms. Two researchers say that top-selling home alarm setups can... --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/3cc7d302/sc/15/l/0L0Swired0N0C20A… *** EU to Roll Out Cybercrime Taskforce *** --------------------------------------------- International Team Will Target Cross-Border Crime Campaigns The European Union is set to launch a trial run of an international cybercrime task force that will coordinate investigations across Europe, as well as with a handful of other countries, including Australia, Canada and the United States. --------------------------------------------- http://www.bankinfosecurity.com/eu-to-roll-out-cybercrime-taskforce-a-7093 *** The psychology of phishing *** --------------------------------------------- Phishing emails are without a doubt one of the biggest security issues consumers and businesses face today. Cybercriminals no longer send out thousands of emails at random hoping to get a handful of hits, today they create highly targeted phishing emails which are tailored to suit their recipients. --------------------------------------------- http://www.net-security.org/article.php?id=2078 *** Just Released - The Phishing Planning Kit *** --------------------------------------------- One of the biggest challenges with an effective phishing program is not the technology you use, but how you communicate and implement your phishing program. To assist you in getting the most out of your phishing program we have put together the Phishing Planning Kit. Based on the feedback and input of numerous security awareness officers, this kit... --------------------------------------------- http://www.securingthehuman.org/blog/2014/07/22/phishing-planning-kit *** Facebook Scam Leads to Nuclear Exploit Kit *** --------------------------------------------- Attackers have become more aggressive and are now using Facebook scams to lead to exploit kits so they can control a user's system. --------------------------------------------- http://www.symantec.com/connect/blogs/facebook-scam-leads-nuclear-exploit-k… *** Cisco IOS XR Software NetFlow Processing Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-3322 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SonicWALL GMS 7.2 Build 7221.1701 Cross Site Scripting *** --------------------------------------------- Topic: SonicWALL GMS 7.2 Build 7221.1701 Cross Site Scripting Risk: Low Text:I. VULNERABILITY - Reflected XSS vulnerabilities in DELL SonicWALL GMS 7.2 Build: 7221.1701 II. BACKGROUND ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070121 *** Barracuda Networks Spam And Virus Firewall 6.0.2 XSS *** --------------------------------------------- Topic: Barracuda Networks Spam And Virus Firewall 6.0.2 XSS Risk: Low Text:Document Title: Barracuda Networks Spam&Virus Firewall v6.0.2 (600 & Vx) - Client Side Cross Site Vulnerability Re... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070118 *** Security Notice-Statement on the XSS Security Vulnerability in Huawei E355 *** --------------------------------------------- Jul 23, 2014 17:37 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** SSA-214365 (Last Update 2014-07-23): Vulnerabilities in SIMATIC WinCC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Omron NS Series HMI Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in Omron Corporation's NS series human-machine interface (HMI) terminals. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-203-01 *** Honeywell FALCON XLWeb Controllers Vulnerabilities *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on June 24, 2014, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in Honeywell FALCON XLWeb controllers. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-175-01 *** HPSBMU03073 rev.1 - HP Network Virtualization, Remote Execution of Code, Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Network Vitalization. The vulnerability could be exploited remotely to allow execution of code and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Dienstag 22-07-2014
by Daily end-of-shift report 22 Jul '14

22 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 21-07-2014 18:00 − Dienstag 22-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Retefe Bankentrojaner *** --------------------------------------------- Die meisten [...] Bankentrojaner basieren auf technisch betrachtet ziemlich komplexen Softwarekomponenten: Verschlüsselte Konfigurationen, Man-in-the-Browser-Funktionalität, Persistenz- und Updatemechanismen, um einige zu nennen. Im letzten halben Jahr hat sich eine gänzlich neue Variante behauptet, welche erst im Februar 2014 einen Namen erhielt: Retefe. --------------------------------------------- http://securityblog.switch.ch/2014/07/22/retefe-bankentrojaner/ *** IBM Fixes Code Execution, Cookie-Stealing Vulnerabilities in Switches *** --------------------------------------------- IBM recently patched a handful of vulnerabilities in some of its KVM switches that if exploited, could have given an attacker free reign over any system attached to it. --------------------------------------------- http://threatpost.com/ibm-fixes-code-execution-cookie-stealing-vulnerabilit… *** Mobile App Wall of Shame: CNN App for iPhone *** --------------------------------------------- The CNN App for iPhone is one of the most popular news applications available for the iPhone. At present, it is sitting at #2 in the iTunes free News app category and #165 among all free apps. Along with providing news stories, alerts and live video, it also includes iReport functionality, allowing... --------------------------------------------- http://research.zscaler.com/2014/07/cnn-app-for-iphone.html *** OWASP Zed Attack Proxy, (Mon, Jul 21st) *** --------------------------------------------- Affectionately know as ZAP the OWASP Zed Attack Proxy in an excellent web application testing tool. It finds its way into the hands of experienced penetration testers, newer security administrators, vulnerability assessors, as well as auditors and the curious. One of the reasons for its popularity is the ease of use and the extensive granular capability to examine transactions. While some may know ZAP as a fork or successor to the old Paros proxy,it is so much more. Roughly 20% of the code base... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18421&rss *** Old and Persistent Malware *** --------------------------------------------- User error is the best reason to explain why Excel spreadsheets infected with the Laroux macro virus have been published on the China Securities Regulatory Commission website (csrc.gov.cn). The commission regulates China's financial markets and provides an online law library on their website where visitors can download various files and texts. Two of the files available in the library contain the MSEXcel.Laroux virus. --------------------------------------------- https://blogs.cisco.com/security/old-and-persistent-malware/ *** FakeNet Malware Analysis *** --------------------------------------------- FakeNet is a tool that aids in the dynamic analysis of malicious software. The tool simulates a network so that malware interacting with a remote host continues to run allowing the analyst to observe the malware's network activity from within a safe environment. --------------------------------------------- http://www.ehacking.net/2014/07/fakenet-malware-analysis.html *** Cisco-Routerlücke: Der mysteriöse Vorab-Patch *** --------------------------------------------- Die kritische Sicherheitslücke, die neun Router und Kabelmodems von Cisco verwundbar für Angriffe aus dem Netz macht, ist bei deutschen Providern vor Jahren mit einem Update geschlossen worden. Allerdings bleibt unklar, warum Cisco den Fix erst jetzt öffentlich machte. --------------------------------------------- http://www.heise.de/security/meldung/Cisco-Routerluecke-Der-mysterioese-Vor… *** App "telemetry", (Tue, Jul 22nd) *** --------------------------------------------- ISC reader James had just installed "Foxit Reader" on his iPhone, and had answered "NO" to the "In order to help us improve Foxit Mobile PDF, we would like to collect anonymous usage data..." question, when he noticed his phone talking to China anyway. The connected-to site was alog.umeng.com, 211.151.151.7. Umeng is an "application telemetry" and online advertising company. Below is what was sent (some of the ids are masked or have been obfuscated) I --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18425&rss *** Massive Malware Infection Breaking WordPress Sites *** --------------------------------------------- The last few days has brought about a massive influx of broken WordPress websites. What makes it so unique is that the malicious payload is being blindly injected which is causing websites to break. While we're still researching, we do want to share share some observations: This infection is aimed at websites built on the... --------------------------------------------- http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.h… *** Privacy Badger Extension Blocks Tracking Through Social Icons *** --------------------------------------------- Online tracking has been a thorny problem for years, and as Web security companies, browser vendors and users have become more aware of the problem and smarter about how to defend themselves, ad companies and trackers have responded in kind. The advent of social networks has made it far easier for tracking companies to monitor user behavior across... --------------------------------------------- http://threatpost.com/privacy-badger-extension-blocks-tracking-through-soci… *** [webapps] - MTS MBlaze Ultra Wi-Fi / ZTE AC3633 - Multiple Vulnerabilities *** --------------------------------------------- http://www.exploit-db.com/exploits/34128 *** Apache Multiple Flaws Let Remote Users Deny Service or Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030615 *** Tenable Nessus Access Control Flaw in Web UI Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1030614 *** Apache Scoreboard / Status Race Condition *** --------------------------------------------- Topic: Apache Scoreboard / Status Race Condition Risk: Medium Text:Hi there, --[ 0. Sparse summary Race condition between updating ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070114 *** HPSBMU03071 rev.1 - HP Autonomy IDOL, Running OpenSSL, Remote Unauthorized Access, Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Autonomy IDOL. The vulnerability could be exploited to allow remote unauthorized access and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Moodle rubric/advanced grading cross-site scripting *** --------------------------------------------- Moodle rubric/advanced grading cross-site scripting --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94724 *** OleumTech WIO Family Vulnerabilities *** --------------------------------------------- Security researchers Lucas Apa and Carlos Mario Penagos Hollman of IOActive have identified multiple vulnerabilities in OleumTech's WIO family including the sensors and the DH2 data collector. The researchers have coordinated the vulnerability details with NCCIC/ICS-CERT and OleumTech in hopes the vendor would develop security patches to resolve these vulnerabilities. While ICS-CERT has had many discussions with both OleumTech and IOActive this past year, there has not been consensus... --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-202-01 *** Bugtraq: Web Login Bruteforce in Symantec Endpoint Protection Manager 12.1.4023.4080 *** --------------------------------------------- http://www.securityfocus.com/archive/1/532857

1 0

Tageszusammenfassung - Montag 21-07-2014
by Daily end-of-shift report 21 Jul '14

21 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 18-07-2014 18:00 − Montag 21-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** The Little Signature That Could: The Curious Case of CZ Solution *** --------------------------------------------- Malware authors are always looking for new ways to masquerade their actions. Attackers are looking for their malware to be not only fully undetectable, but also appear valid on a system, so as not to draw attention. Digital signatures are... --------------------------------------------- http://www.fireeye.com/blog/technical/2014/07/the-little-signature-that-cou… *** Keeping the RATs out: the trap is sprung - Part 3, (Sat, Jul 19th) *** --------------------------------------------- As we bring out three part series on RAT tools suffered upon our friends at Hazrat Supply we must visit the centerpiece of it all. The big dog in this fight is indeed the bybtt.cc3 file (Jake suspected this), Backdoor:Win32/Zegost.B. The file is unquestionably a PEDLL but renamed a .cc3 to hide on system like a CueCards Professional database file. Based on the TrendMicro writeup on this family, the backdoor drops four files, including %Program Files%\%SESSIONNAME%\{random characters}.cc3 This... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18415&rss *** Top 10 Common Database Security Issues *** --------------------------------------------- Introduction The database typically contains the crown jewels of any environment; it usually holds the most business sensitive information which is why it is a high priority target for any attacker. The purpose of this post is to create awareness among database administrators and security managers about some of the areas on which it is important to focus on when implementing a new database or hardening the security of an existing one. --------------------------------------------- https://www.nccgroup.com/en/blog/2014/07/top-10-common-database-security-is… *** Smart Meter Attack Scenarios *** --------------------------------------------- In our previous post, we looked at how smart meters were being introduced across multiple countries and regions, and why these devices pose security risks to their users. At their heart, a smart meter is simply... a computer. Let's look at our existing computers - whether they are PCs, smartphones, tablets, or embedded devices. Similarly, these... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/smart-meter-atta… *** Angriffe auf Web-Server via Wordpress-Plugin MailPoet *** --------------------------------------------- Über eine kürzlich entdeckte Sicherheitslücke werden derzeit systematisch Server gekapert. Wer das Anfang Juli veröffentlichte Update noch nicht installiert hat, sollte das dringend nachholen. --------------------------------------------- http://www.heise.de/security/meldung/Angriffe-auf-Web-Server-via-Wordpress-… *** Home router security to be tested in upcoming hacking contest *** --------------------------------------------- Researchers are gearing up to hack an array of different home routers during a contest next month at the Defcon 22 security conference. The contest is called SOHOpelessly Broken - a nod to the small office/home office space targeted by the products - and follows a growing number of large scale attacks this year against routers and other home embedded systems. --------------------------------------------- http://www.cio.com/article/2455981/home-router-security-to-be-tested-in-upc… *** Sicherheitsforscher weist auf "Hintertüren" in iOS hin *** --------------------------------------------- Undokumentierte Systemdienste in iOS machen Angreifern das Auslesen von Nutzerdaten leicht, wenn das iPhone oder iPad mit einem Desktop-Computer lokal gepairt wurde, erklärt Jonathan Zdziarski - und hofft auf Antwort von Apple. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsforscher-weist-auf-Hintertu… *** Call for last-minute papers for VB2014 announced *** --------------------------------------------- Seven speaking slots waiting to be filled with presentations on hot security topics. --------------------------------------------- http://www.virusbtn.com/news/2014/07_21.xml?rss *** Heartbleed bedroht kritische Industrie-Kontrollsysteme *** --------------------------------------------- Über drei Monate nach Bekanntwerden der massiven Sicherheitslücke sind immer noch zahlreiche Systeme von Siemens ungeschützt. --------------------------------------------- http://futurezone.at/digital-life/heartbleed-bedroht-kritische-industrie-ko… *** VMSA-2014-0006.8 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** EMC RecoverPoint Internal Firewall Ruleset Error Lets Remote Users Bypass the Firewall *** --------------------------------------------- http://www.securitytracker.com/id/1030608 *** DSA-2981 polarssl *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2981 *** DSA-2982 ruby-activerecord-3.2 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2982 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** VU#688812: Huawei E355 contains a stored cross-site scripting vulnerability *** --------------------------------------------- Vulnerability Note VU#688812 Huawei E355 contains a stored cross-site scripting vulnerability Original Release date: 21 Jul 2014 | Last revised: 21 Jul 2014 Overview The Huawei E355 built-in web interface contains a stored cross-site scripting vulnerability. Description Huawei E355 wireless broadband modems include a web interface for administration and additional services. The web interface allows users to receive SMS messages using the connected cellular network.CWE-79: Improper... --------------------------------------------- http://www.kb.cert.org/vuls/id/688812 *** Bugtraq: CVE-2014-4326 Remote command execution in Logstash zabbix and nagios_nsca outputs. *** --------------------------------------------- Vendor: Elasticsearch Product: Logstash CVE: CVE-2014-4326 Affected versions: Logstash 1.0.14 through 1.4.1 --------------------------------------------- http://www.securityfocus.com/archive/1/532841

1 0

Tageszusammenfassung - Freitag 18-07-2014
by Daily end-of-shift report 18 Jul '14

18 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-07-2014 18:00 − Freitag 18-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** SQL Injection Vulnerability - vBulletin 5.x *** --------------------------------------------- The vBulletin team just released a security patch for vBulletin 5.0.4, 5.0.5, 5.1.0, 5.1.1, and 5.1.2 to address a SQL injection vulnerability on the member list page. Every vBulletin user needs to upgrade to the latest version asap. vBulletin is a very popular forum sofware used on more than .. --------------------------------------------- http://blog.sucuri.net/2014/07/sql-injection-on-vbulletin-5-x.html *** Siemens OpenSSL Vulnerabilities *** --------------------------------------------- Siemens has identified four vulnerabilities in its OpenSSL cryptographic software library affecting several Siemens industrial products. Updates are available for APE 2.0.2 and WinCC OA (PVSS). The ROX 1, ROX 2, S7-1500, and CP1543-1 products do not have a patch at this time; however, Siemens has made mitigation recommendations. Siemens is continuing to work on patching these vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-198-03 *** Cogent DataHub Code Injection Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT has become aware of a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. (hereafter referred to as Cogent). Security researcher John Leitch reported this vulnerability to the Zero Day Initiative (ZDI), who then reported it directly to Cogent. Successful exploitation of this vulnerability could allow remote execution of arbitrary code. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-198-01 *** Advantech WebAccess Vulnerabilities *** --------------------------------------------- NCCIC/ICS-CERT received a report from the Zero Day Initiative (ZDI) concerning vulnerabilities affecting the Advantech WebAccess application. These vulnerabilities were reported to ZDI by security researchers Dave Weinstein, Tom Gallagher, John Leitch, and others. Advantech has produced an updated software version that mitigates these vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-198-02 *** Mitigating UAF Exploits with Delay Free for Internet Explorer *** --------------------------------------------- After introducing the 'isolated heap' in June security patch for Internet Explorer, Microsoft has once again introduced several improvements in the July patch for Internet Explorer. The most interesting and smart improvement is one which we will call 'delay free.' This improvement is designed to mitigate Use After Free (UAF) vulnerability exploits .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mitigating-uaf-e… *** DSA-2979 fail2ban *** --------------------------------------------- Two vulnerabilities were discovered in Fail2ban, a solution to ban hosts that cause multiple authentication errors. When using Fail2ban to monitor Postfix or Cyrus IMAP logs, improper input validation in log parsing could enable a remote attacker to trigger an IP ban on arbitrary addresses, resulting in denial of service. --------------------------------------------- http://www.debian.org/security/2014/dsa-2979 *** Bugtraq: Microsoft MSN HBE - Blind SQL Injection Vulnerability *** --------------------------------------------- A boolean-based blind SQL Injection web vulnerability has been detected in the official MSN (habitos.be.msn.com) web application Service. The vulnerability allows remote attackers to inject own sql commands to compromise the affected .. --------------------------------------------- http://www.securityfocus.com/archive/1/532830 *** Critroni Crypto Ransomware Seen Using Tor for Command and Control *** --------------------------------------------- There's a new kid on the crypto ransomware block, known as Critroni, that's been sold in underground forums for the last month or so and is now being dropped by the Angler exploit kit. The ransomware includes a number of unusual features and researchers say .. --------------------------------------------- http://threatpost.com/critroni-crypto-ransomware-seen-using-tor-for-command… *** LibreSSL: Linuxer und OpenBSDler raufen sich zusammen *** --------------------------------------------- Anhand der Probleme bei der Portierung von LibreSSL auf andere Plattformen wie Linux kann man erkennen, wie aus OpenSSL so ein Security-Alptraum werden konnte. Und der ist noch längst nicht vorbei. --------------------------------------------- http://www.heise.de/security/meldung/LibreSSL-Linuxer-und-OpenBSDler-raufen…

1 0

Tageszusammenfassung - Donnerstag 17-07-2014
by Daily end-of-shift report 17 Jul '14

17 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-07-2014 18:00 − Donnerstag 17-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Kritische Sicherheitslücke gefährdet Router und Modems von Cisco *** --------------------------------------------- Neun Consumer-Router und Kabelmodems von Cisco sind anfällig für eine kritische Lücke, die es Angreifern aus dem Netz ermöglicht, das Gerät zu kapern. Auch deutsche Provider setzten die betroffenen Modelle ein. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Sicherheitsluecke-gefaehrdet… *** Cisco Wireless Residential Gateway Remote Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the web server used in multiple Cisco Wireless Residential Gateway products could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/ciscos… *** Cisco Cable Modem Buffer Overflow Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- A remote user can send a specially crafted HTTP request to the target device to trigger a buffer overflow and execute arbitrary code on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030598 *** Apache httpd mod_status Heap Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- The specific flaw exists within the updating of mod_status. A race condition in mod_status allows an attacker to disclose information or corrupt memory with several requests to endpoints with handler server-status and other endpoints. By abusing this flaw, an attacker can possibly disclose credentials or leverage this situation to achieve remote code execution. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-236/ *** Zusatzinformationen zum Interview im Standard *** --------------------------------------------- Zusatzinformationen zum Interview im Standard16. Juli 2014Wir freuen uns (fast) immer, wenn wir in Medien zitiert werden, und wir damit eine deutlich breitere Masse erreichen, als nur über unsere direkten Kanäle (Webseite, RSS, Mail, Twitter).Nur: Interviews müssen meist recht schnell gehen, Journalisten arbeiten täglich mit harten Deadlines und auf Papier gibt es beschränkten Platz und keine Hyperlinks.Daher will ich hier ein bisschen Kontext zum Interview geben, das .. --------------------------------------------- http://www.cert.at/services/blog/20140716101643-1199.html *** SA-CORE-2014-003 - Drupal core - Multiple vulnerabilities *** --------------------------------------------- Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. (Denial of Service, Cross Site Scripting, Access Bypass) --------------------------------------------- https://www.drupal.org/SA-CORE-2014-003 *** SA-CONTRIB-2014-071 - FileField - Access bypass *** --------------------------------------------- A vulnerability was discovered in the FileField third-party module that could allow attackers to gain access to private files. --------------------------------------------- https://www.drupal.org/node/2304561 *** Kaum eingeführt, schon umgestellt: Apple verbessert iCloud-Mail-Verschlüsselung *** --------------------------------------------- Nur wenige Tage nach der Einführung einer Transportverschlüsselung für Apples iCloud-Mail-Dienste bessert der Konzern nach. Zumindest einige Server genügen jetzt aktuellen Anforderungen an gute Verschlüsselung. --------------------------------------------- http://www.heise.de/security/meldung/Kaum-eingefuehrt-schon-umgestellt-Appl… *** Pushdo Trojan outbreak: 11 THOUSAND systems infected in just 24 hours *** --------------------------------------------- A wave of attacks by cybercrooks pushing a new variant of the resilient Pushdo Trojan has compromised more than 11,000 systems in just 24 hours. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/17/pushdo_troj… *** Paper: Mayhem - a hidden threat for *nix web servers *** --------------------------------------------- New kind of malware has the functions of a traditional Windows bot, but can act under restricted privileges in the system. --------------------------------------------- http://www.virusbtn.com/news/2014/07_17.xml *** Havex, It's Down With OPC *** --------------------------------------------- FireEye recently analyzed the capabilities of a variant of Havex (referred to by FireEye as 'Fertger' or 'PEACEPIPE'), the first publicized malware reported to actively scan OPC servers used for controlling SCADA (Supervisory Control and Data Acquisition) devices in .. --------------------------------------------- http://www.fireeye.com/blog/technical/targeted-attack/2014/07/havex-its-dow…

1 0

Tageszusammenfassung - Mittwoch 16-07-2014
by Daily end-of-shift report 16 Jul '14

16 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-07-2014 18:00 − Mittwoch 16-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** SSL Black List Aims to Publicize Certificates Associated With Malware *** --------------------------------------------- Malware and botnet operators are always adapting their tactics, trying to stay a step or two ahead of defensive technologies and techniques. One of the methods many attackers have adopted is using SSL to communicate with the infected machines they control, and a researcher has started a new .. --------------------------------------------- http://threatpost.com/ssl-black-list-aims-to-publicize-certificates-associa… *** Early Review of LibreSSL Finds Problematic PRNG *** --------------------------------------------- A critical vulnerability was reported in the random number generator in LibreSSL, a fork of OpenSSL. LibreSSL preview versions were released this weekend. --------------------------------------------- http://threatpost.com/early-review-of-libressl-finds-problematic-prng/107239 *** Critical Patch Update - July 2014 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html *** About Two Recently Patched IBM DB2 LUW Vulnerabilities *** --------------------------------------------- IBM recently released patches for three security vulnerabilities affecting various versions of DB2 for Linux, Unix and Windows. This post will explore some more technical details of two of these vulnerabilities (CVE-2014-0907 and CVE-2013-6744) to help database administrators assess the risk of .. --------------------------------------------- http://blog.spiderlabs.com/2014/07/about-two-ibm-db2-luw-vulnerabilities-pa… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. These vulnerabilities affect all currently supported versions of Citrix .. --------------------------------------------- http://support.citrix.com/article/CTX140984 *** Elipse E3 Scada PLC Denial Of Service *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070083 *** [2014-07-16] Multiple SSRF vulnerabilities in Alfresco Community Edition *** --------------------------------------------- The Alfresco Community Edition Server is prone to multiple Server Side Request Forgery vulnerabilities allowing access to internal resources for an unauthenticated attacker. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** HP Data Protector, Remote Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has been identified with HP Data Protector. This vulnerability could be remotely exploited to execute arbitrary code. --------------------------------------------- http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** [2014-07-16] Remote Code Execution via CSRF in OpenVPN Access Server "Desktop Client" *** --------------------------------------------- Remote attackers can execute arbitrary code and execute other attacks on computers with the OpenVPN Access Server "Desktop Client" installed. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-07-16] Multiple critical vulnerabilities in Bitdefender GravityZone *** --------------------------------------------- Attackers are able to completely compromise the Bitdefender GravityZone solution as they can gain system and database level access. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Schwachstelle in Symfony: W0rm hackt Cnet *** --------------------------------------------- Die russische Hackergruppe W0rm hat sich Zugang zu den Servern der Nachrichtenwebseite Cnet verschafft. Die Datenbank mit Benutzerdaten wollen die Hacker für einen symbolische Betrag von einem Bitcoin verkaufen. --------------------------------------------- http://www.golem.de/news/schwachstelle-in-symfony-w0rm-hackt-cnet-1407-1079… *** Common Misconceptions IT Admins Have on Targeted Attacks *** --------------------------------------------- In our efforts around addressing targeted attacks, we often work with IT administrators from different companies in dealing with threats against their network. During these collaborations, we've recognized certain misconceptions that IT administrators - or perhaps enterprises in general - have in terms of targeted attacks. I will cover some of them in this .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/common-misconcep…

1 0

Tageszusammenfassung - Dienstag 15-07-2014
by Daily end-of-shift report 15 Jul '14

15 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-07-2014 18:00 − Dienstag 15-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Introduction to Smart Meters *** --------------------------------------------- While wearable personal technology may be the most 'public' face of the Internet of Everything, the most widespread use of it may be in smart meters. What is a smart meter, exactly? It's a meter for utilities (electricity, gas, or water) that records the consumption of the utility in question, and transmits it .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/introduction-to-… *** Disclosure: Insecure Nonce Generation in WPtouch *** --------------------------------------------- If you use the popular WPtouch plugin (5m+ downloads) on your WordPress website, you should update it immediately. During a routine audit for our WAF, we discovered a very dangerous vulnerability that could potentially allow a user with no administrative privileges, who was logged in .. --------------------------------------------- http://blog.sucuri.net/2014/07/disclosure-insecure-nonce-generation-in-wpto… *** Five Year Old Phishing Campaign Unveiled *** --------------------------------------------- Details have been disclosed on a five-year-old phishing campaign where in attackers have pilfered victims's login credentials from Google, Yahoo, Facebook, Dropbox and Skype. --------------------------------------------- http://threatpost.com/five-year-old-phishing-campaign-unveiled/107197 *** OpenVPN PrivateTunnel ptservice privilege escalation *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94482 *** HP StoreVirtual Bugs Let Remote Users Obtain Information and Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1030567 *** Citrix NetScaler Application Delivery Controller and NetScaler Gateway Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in the Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway, formerly known .. --------------------------------------------- http://support.citrix.com/article/CTX140863 *** iCloud-Mail-Versand jetzt auch verschlüsselt *** --------------------------------------------- Als einer der letzten grossen Mail-Provider hat Apple nun die Sicherung des Transports gegen einfaches Mitlesen eingeschaltet. Die eingesetzten Verfahren lassen allerdings viel zu wünschen übrig. --------------------------------------------- http://www.heise.de/security/meldung/iCloud-Mail-Versand-jetzt-auch-verschl… *** OpenCart <= 1.5.6.4 (cart.php) PHP Object Injection Vulnerability *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070078 *** Oracle zur Zukunft von Java 7 unter Windows XP *** --------------------------------------------- Java 7 wird bis frühestens April 2015 mit Security-Updates versorgt. Alle weiteren Releases der vorletzten Java-Version bis dahin werden auch weiterhin mit dem nicht mehr von Microsoft offiziell unterstützten Windows XP funktionieren. --------------------------------------------- http://www.heise.de/security/meldung/Oracle-zur-Zukunft-von-Java-7-unter-Wi… *** The 'Forbidden' Apple: App Stores and the Illusion of Control Part I *** --------------------------------------------- There is no doubt we truly live in an 'App Economy.' From personal to professional, we direct and live our lives through our smart phones. But while we enjoy the latest games, stream the latest content or catch up on our friends activities, few think .. --------------------------------------------- http://research.zscaler.com/2014/07/the-forbidden-apple-app-stores-and.html *** And the mice will 'Play': App Stores and the Illusion of Control Part II *** --------------------------------------------- In the last blog, we began analyzing what we've termed the vApp Dichotomy' of the App Economy - The fact that we are at least as much the consumed, as we are the consumer. Our goal was to analyze popular apps from Apple's App Store and Google Play to .. --------------------------------------------- http://research.zscaler.com/2014/07/and-mice-will-play-app-stores-and.html *** Project Zero: Google baut Internet-Sicherheitsteam auf *** --------------------------------------------- Mit Vollzeit-Entwicklern im Project Zero will Google, das Sicherheitsforschung bisher nur nebenbei betrieben hat, das Internet sicherer machen und politisch Verfolgten helfen. --------------------------------------------- http://www.golem.de/news/project-zero-google-baut-internet-sicherheitsteam-… *** New Kronos Banking Malware Advertised On Russian Forums *** --------------------------------------------- Researchers have spotted a new banking Trojan advertised for sale on Russian forums. Kronos promises features that help it evade detection and analysis, such as a Ring3 rootkit. --------------------------------------------- http://threatpost.com/new-kronos-banking-malware-advertised-on-russian-foru…

1 0

Tageszusammenfassung - Montag 14-07-2014
by Daily end-of-shift report 14 Jul '14

14 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-07-2014 18:00 − Montag 14-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Oracle to release 115 security patches *** --------------------------------------------- Oracle is planning to release 115 security patches for vulnerabilities affecting a wide array of its products, including its flagship database, Java SE, Fusion Middleware and business applications. The update includes fixes for 20 weaknesses in Java SE, all of which can be exploited by an attacker remotely, without the need for login credentials, .. --------------------------------------------- http://www.cio.com/article/2453362/oracle-to-release-115-security-patches.h… *** VU#917348: Datum Systems satellite modem devices contain multiple vulnerabilities *** --------------------------------------------- The Datum Systems SnIP operating system on PSM-4500 and PSM-500 satellite modem devices has FTP enabled by default with no credentials required, which allows open access to sensitive areas of the file system. A remote unauthenticated attacker may be able to gain full control of the device. --------------------------------------------- http://www.kb.cert.org/vuls/id/917348 *** Cisco ASA CIFS Share Enumeration Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the WebVPN Common Internet File System (CIFS) access function of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, remote attacker to trigger a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Juniper Junos Unspecified Command Line Interface Flaw Lets Local Users Gain Root Privileges *** --------------------------------------------- A local user on the command line interface can invoke certain combinations of commands to gain root privileges on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030559 *** Dell Sonicwall Scrutinizer 11.01 Code Execution / SQL Injection *** --------------------------------------------- Dell Sonicwall Scrutinizer suffers from several SQL injections, many of which can end up with remote code execution. An attacker needs to be authenticated, but not as an administrator. However, that wouldn not stop anyone since there is also a privilege escalation vulnerability in that .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070065 *** Schrack MICROCONTROL XSS / Disclosure / Weak Default Password *** --------------------------------------------- The Microcontrol emergency light system, distributed by Schrack Technik GmbH, is an autarchic emergency light system, which is configurable over a web interface. Through the vulnerabilities described in this advisory an attacker can reconfigure the whole emergency light system without authentication. Furthermore he can perform attacks.. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070067 *** 'Gameover' malware returns from the dead *** --------------------------------------------- In early June 2014, a internationally co-ordinated law enforcement effort against the criminals behind the infamous Gameover malware pretty much wiped out their botnet altogether. Bad news - it looks as though Gameover is back... --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/13/gameover-malware-returns-from-th… *** Popular password protection programs p0wnable *** --------------------------------------------- LastPass, RoboForm, My1Login, PasswordBox and NeedMyPassword all flawed Researchers have detailed a series of quickly patched vulnerabilities in five popular password managers that could allow attackers to steal user credentials. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/14/popular_web… *** Beware Keyloggers at Hotel Business Centers *** --------------------------------------------- The U.S. Secret Service is advising the hospitality industry to inspect computers made available to guests in hotel business centers, warning that crooks have been compromising hotel business center PCs with keystroke-logging malware in a bid to steal personal and financial data from guests. --------------------------------------------- http://krebsonsecurity.com/2014/07/beware-keyloggers-at-hotel-business-cent… *** The Internet of Things: How do you "on-board" devices?, (Mon, Jul 14th) *** --------------------------------------------- Certified pre-pw0ned devices are nothing new. We talked years ago about USB picture frames that came with malware pre-installed. But for the most part, the malware was added to the device accidentally, or for example by customers who later returned the device just to have it resold without adequately resetting/wiping the device. But more recently, more evidence emerged that .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18387&rss *** Verschlüsselung: LibreSSL wird flügge *** --------------------------------------------- Die Entwickler des OpenSSL-Forks LibreSSL haben die erste Version ihrer Software veröffentlicht, die andere Plattformen als OpenBSD unterstützt. Damit schickt sich die SSL-Bibliothek an, eine echte Alternative zum Heartbleed-geplagten OpenSSL zu werden. --------------------------------------------- http://www.heise.de/security/meldung/Verschluesselung-LibreSSL-wird-fluegge… *** Understanding Ransomware *** --------------------------------------------- Our Cyber Defence Operations team, led by David Cannings, has published a new whitepaper on understanding ransomware. It looks at the impact, evolution and defensive strategies that can be employed by organisations. While the paper is primarily focused on Microsoft Windows due to the historic .. --------------------------------------------- https://www.nccgroup.com/en/blog/2014/07/understanding-ransomware/ *** VU#204988: Kaseyas agent driver contains NULL pointer dereference *** --------------------------------------------- Kaseyas agent driver, kapfa.sys, is vulnerable to a NULL pointer dereference. A local authenticated attacker may be able to crash the application, thereby causing a denial of service. Kaseya has .. --------------------------------------------- http://www.kb.cert.org/vuls/id/204988 *** WordPress Download Manager 2.6.8 Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070062 *** Shopizer 1.1.5 Code Execution / XSS / CSRF / Data Manipulation *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070066

1 0

Tageszusammenfassung - Freitag 11-07-2014
by Daily end-of-shift report 11 Jul '14

11 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-07-2014 18:00 − Freitag 11-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Finding the Clowns on the Syslog Carousel, (Thu, Jul 10th) *** --------------------------------------------- So often I see clients faithfully logging everything from the firewalls, routers and switches - taking terabytes of disk space to store it all. Sadly, the interaction after the logs are created is often simply to make sure that the partition doesnt fill up - either old logs are just deleted, or each month logs are burned to DVD and filed away. The comment I often get is that logs entries are complex, and that the sheer volume of information makes it impossible to make sense of it. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18373&rss *** Security Advisory 2982792 released, Certificate Trust List updated *** --------------------------------------------- Today, we are updating the Certificate Trust List (CTL) for all supported releases of Microsoft Windows to remove the trust of mis-issued third-party digital certificates. These certificates could be used to spoof content and perform phishing or man-in-the-middle attacks against web properties. With this update, most customers will be automatically protected against this issue and will not need to take any action. If you do not have automatic updates enabled, or if you are on Windows Server... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/07/10/security-advisory-298279… *** Weekly Metasploit Update: Another Meterpreter Evasion Option *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/07/10/weekly-me… *** Website Malware - Mobile Redirect to BaDoink Porn App *** --------------------------------------------- A few weeks ago we reported that we were seeing a huge increase in the number of web sites compromised with a hidden redirection to pornographic content. It was a very tricky injection, with the redirection happening only once per day per IP address and only if the visitor was using a mobile device... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/pAisQqonxQM/website-malware-m… *** VU#712660: Raritian PX power distribution software is vulnerable to the cipher zero attack. *** --------------------------------------------- Vulnerability Note VU#712660 Raritian PX power distribution software is vulnerable to the cipher zero attack. Original Release date: 10 Jul 2014 | Last revised: 10 Jul 2014 Overview Raritan PX power distribution software version 01.05.08 and previous running on a model DPXR20A-16 device allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. Description CWE-287: Improper Authentication - --------------------------------------------- http://www.kb.cert.org/vuls/id/712660 *** Oracle Critical Patch Update - July 2014 - Pre-Release Announcement *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html *** Cisco ASA Filter and Inspect Overlap Denial of Service Vulnerability *** --------------------------------------------- CVE-2013-5567 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Adobe Flash: The most INSECURE program on a UK users PC *** --------------------------------------------- XML a weak spot, but nothings as dire as Adobe player Adobe Flash Player was the most insecure program installed on UK computer users PCs throughout the second quarter of 2014, according to stats from vulnerability management firm Secunia. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/10/secunia_pc_… *** Crooks Seek Revival of "Gameover Zeus" Botnet *** --------------------------------------------- Cybercrooks today began taking steps to resurrect the Gameover ZeuS botnet, a complex crime machine that has been blamed for the theft more than $100 million from banks, businesses and consumers worldwide. The revival attempt comes roughly five weeks after the FBI joined several nations, researchers and security firms in a global and thus far successful effort to eradicate it. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/yLU9-y_8J-k/ *** VMSA-2014-0006.7 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** DSA-2976 eglibc *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2976 *** osCommerce 2.3.4 - Multiple vulnerabilities *** --------------------------------------------- Topic: osCommerce 2.3.4 - Multiple vulnerabilities Risk: Medium Text:#Title: osCommerce 2.3.4 - Multiple vulnerabilities #Date: 10.07.14 #Affected versions: => 2.3.4 (latest atm) #Vendor: oscom... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070059 *** C99 Shell Authentication Bypass via Backdoor *** --------------------------------------------- Topic: C99 Shell Authentication Bypass via Backdoor Risk: Medium Text:# Exploit Title: C99 Shell Authentication Bypass via Backdoor # Google Dork: inurl:c99.php # Date: June 23, 2014 # Exploit A... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070057 *** Exploit emerges for LZO algo hole *** --------------------------------------------- Take one Nyan Cat, add Firefox and hope your Linux distro has been patched Security Mouse security researcher Don A Bailey has showcased an exploit of the Lempel-Ziv-Oberhumer (LZ0) compression algorithm running in the Mplayer2 media player and says it could leave some Linuxes vulnerable to attack. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/11/firefox_lzo… *** Microsoft entzieht Indischer CA das Vertrauen *** --------------------------------------------- Als Konsequenz auf die missbräuchlich ausgestellten Google-Zertifikate hat Microsoft die betroffenen SubCAs auf die Sperrliste gesetzt. Darüber hinaus wurde das ganze Ausmaß des Zwischenfalls bekannt: Betroffen sind 45 Domains - auch von Yahoo. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-entzieht-Indischer-CA-das-Ve… *** Lack of Certificate Pinning Exposes Encrypted iOS Gmail App Communication *** --------------------------------------------- Google has failed to implement certificate pinning in its official iOS Gmail application, which could enable Man-in-the-Middle attacks exposing encrypted user communications. --------------------------------------------- http://threatpost.com/lack-of-certificate-pinning-exposes-encrypted-ios-gma…

1 0

Tageszusammenfassung - Donnerstag 10-07-2014
by Daily end-of-shift report 10 Jul '14

10 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-07-2014 18:00 − Donnerstag 10-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** MSRT July 2014 - Caphaw *** --------------------------------------------- This month we added Win32/Caphaw and Win32/Bepush to the Malicious Software Removal Tool (MSRT). Caphaw is a malware family that can be used by criminals to gain access to your PC - the ultimate goal is to steal your financial or banking-related information. The graph below shows the number of machine encounters we have seen since September 2013. Figure 1: Caphaw encounters Caphaw can be installed on a PC via malicious links posted on Facebook, YouTube, and Skype. It can also spread through --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/07/08/msrt-july-2014-caphaw.as… *** International Authorities Take Down Shylock Banking Malware *** --------------------------------------------- Europol announced today that it, along with international law enforcement and industry partners, conducted a successful takedown of the infrastructure supporting the Shylock banking malware. --------------------------------------------- http://threatpost.com/international-authorities-take-down-shylock-banking-m… *** Certificate Errors in Office 365 Today, (Thu, Jul 10th) *** --------------------------------------------- It looks like theres a mis-assignment of certificates today at Office 365. After login, the redirect to portal.office.com reports the following error: portal.office.com uses an invalid security certificate. The certificate is only valid for the following names: *.bing.com, *.platform.bing.com, bing.com, ieonline.microsoft.com, *.windowssearch.com, cn.ieonline.microsoft.com, *.origin.bing.com, *.mm.bing.net, *.api.bing.com, ecn.dev.virtualearth.net, *.cn.bing.net, *.cn.bing.com, *.ssl.bing.com, --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18371&rss *** ZDI-14-224: (0Day) Embarcadero ER/Studio Data Architect TSVisualization ActiveX loadExtensionFactory Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Embarcadero ER/Studio Data Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-224/ *** SA-CONTRIB-2014-069 - Logintoboggan - Access Bypass and Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-069Project: LoginToboggan (third-party module)Version: 7.xDate: 2014-July-09Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site Scripting, Access bypassDescriptionThis module enables you to customise the standard Drupal registration and login processes.Cross Site ScriptingThe module doesnt filter user-supplied information from the URL resulting in a reflected Cross Site Scripting (XSS) vulnerability.Access BypassThe module --------------------------------------------- https://www.drupal.org/node/2300369 *** Cisco WebEx Meetings Client Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Manager DNA Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Apache Struts 2 Command Execution Vulnerability in Multiple Cisco Products *** --------------------------------------------- cisco-sa-20140709-struts2 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Infoblox NetMRI Input Validation Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030541 *** [2014-07-10] Multiple critical vulnerabilities in Shopizer webshop *** --------------------------------------------- The webshop software Shopizer is affected by multiple critical vulnerabilities. Attackers are able to completely compromise the system through arbitrary code execution or manipulate product prices or customer data. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-07-10] Multiple high risk vulnerabilities in Shopizer webshop *** --------------------------------------------- The webshop software Shopizer is affected by multiple high risk vulnerabilities. Attackers are able to bypass authentication / authorization and access invoice data of other customers. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-07-10] Multiple critical vulnerabilites in Schrack MICROCONTROL emergency light system *** --------------------------------------------- Unauthenticated attackers are able to reconfigure the Schrack MICROCONTROL emergency light system by accessing the file system via telnet or FTP. Furthermore a weak default password can be exploited. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** [2014-07-10] Design Issue / Password Disclosure in WAGO-I/O-SYSTEM with CODESYS V2.3 WebVisu *** --------------------------------------------- The vulnerability in WAGO-I/O-SYSTEM with CODESYS V2.3 WebVisu enables an attacker to extract all the configured passwords without authentication. The attacker can use the extracted passwords to access the WebVisu and control the system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Vulnerability in Citrix XenDesktop could result in unauthorized access to another users desktop *** --------------------------------------------- Severity: High Description of Problem A vulnerability has been identified in Citrix XenDesktop that could result in a user gaining unauthorized interactive access to another user's desktop. --------------------------------------------- http://support.citrix.com/article/CTX139591 *** HPSBMU03070 rev.1 - HP Cloud Service Automation, OpenSSL Vulnerability, Unauthorized Access, Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Cloud Service Automation. The vulnerability could be exploited to allow unauthorized access and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBMU03069 rev.1 - HP Software Operation Orchestration, OpenSSL Vulnerability, SSL/TLS, Remote Code Execution, Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Software Operation Orchestration. The vulnerabilities could be exploited to allow remote code execution, denial of service (DoS) and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vuln: PHP unserialize() Function Type Confusion Security Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/68237

1 0

Tageszusammenfassung - Mittwoch 9-07-2014
by Daily end-of-shift report 09 Jul '14

09 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-07-2014 18:00 − Mittwoch 09-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** "Weaponized" exploit can steal sensitive user data on eBay, Tumblr, et al. *** --------------------------------------------- Google and Twitter already patched against potent "Rosetta Flash" attack. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/B_J-82SKyS4/ *** Who owns your typo?, (Wed, Jul 9th) *** --------------------------------------------- Heres one way how to get at sensitive data that seems to be making a comeback. Already in the olden days, it was popular with the crooks to register domain names that only differed by a typo from the name of a legitimate high traffic site. Googl.com, for example. The crooks would then run web pages with lots of advertisements on these domains, and live happily ever after from the ad revenue that the misdirected typo traffic alone brought their way. Google put a stop to this by registering, for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18363&rss *** Exploiting IoT technologies *** --------------------------------------------- How many Internet of Things (IoT) devices do you have? From smart TVs to coffee machines, these devices are becoming more and more popular in both homes and offices. A team of researchers at NCC Group, led by technical director, Paul Vlissidis, conducted research into a number of IoT devices and looked at some of the ways that an attacker could exploit them. The team, which also consisted of Pete Beck and Felix Ingram, principal consultants, conducted a live demonstration which explored the --------------------------------------------- https://www.nccgroup.com/en/blog/2014/07/exploiting-iot-technologies/ *** Who inherits your IP address?, (Wed, Jul 9th) *** --------------------------------------------- Somewhat similar to the typo squatting story earlier, the recent proliferation of cloud service usage by enterprises has led to a new problem. For a project at a community college, we needed a couple servers, and didnt want (or have the funds) to build them on-site. In view of the limited duration of the experiment, we decided to "rent" the boxes as IaaS (infrastructure as a service) devices from two "cloud" providers. So far, all went well. But when we brought the instances --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18365&rss *** Yahoo Patches Bugs in Mail, Messenger, Flickr *** --------------------------------------------- Yahoo recently fixed a trio of remotely exploitable vulnerabilities in its services that could have let attackers execute a handful of nefarious tricks. --------------------------------------------- http://threatpost.com/yahoo-fixes-trio-of-bugs-in-mail-messenger-flickr/107… *** Trojan:W32/Lecpetex: Bitcoin miner spreading via FB messages *** --------------------------------------------- In early March this year, while investigating various threats as part of our Facebook malware cleanup effort, we ran across an interesting one that was spreading in zipped files attached to messages.The messages themselves were classic social engineering bait that lead the users to install the executable file in the attachment, which turned out to be a Bitcoin miner, which we identify as Trojan:W32/Lecpetex. Some of the more interesting details of our analysis are presented in our Lecpetex --------------------------------------------- http://www.f-secure.com/weblog/archives/00002725.html *** Indien stellte falsche Google-Zertifikate aus *** --------------------------------------------- Erneut kam es zu einem schwerwiegenden Zwischenfall bei einem Herausgeber von SSL-Zertifikaten: Die staatlich betriebene CA von Indien hat unter anderem Zertifikate für Google-Dienste herausgegeben. Diese eignen sich zum Ausspähen von SSL-Traffic. --------------------------------------------- http://www.heise.de/security/meldung/Indien-stellte-falsche-Google-Zertifik… *** DPAPI vulnerability allows intruders to decrypt personal data *** --------------------------------------------- Passcape Software has discovered a DPAPI vulnerability that could potentially lead to unauthorized decryption of personal data and passwords of interactive domain users. The vulnerability is present in all Windows Server operating systems. --------------------------------------------- http://www.net-security.org/secworld.php?id=17094 *** ATTACK of the Windows ZOMBIES on point-of-sale terminals *** --------------------------------------------- Infosec bods infiltrate botnet, uncover crap password security Security watchers have spotted a fresh Windows-based botnet that attempts to hack into point-of-sale systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/09/botnet_brut… *** Security updates available for Adobe Flash Player (APSB14-17) *** --------------------------------------------- July 8, 2014 --------------------------------------------- http://blogs.adobe.com/psirt/?p=1108 *** MS14-JUL - Microsoft Security Bulletin Summary for July 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-JUL *** Assessing risk for the July 2014 security updates *** --------------------------------------------- Today we released six security bulletins addressing 29 unique CVE's. Two bulletins have a maximum severity rating of Critical, three have maximum severity Important, and one is Moderate. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/07/08/assessing-risk-for-the-ju… *** VMSA-2014-0006.6 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** Cisco Small Business SPA300 and SPA500 Series IP Phones Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-3313 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Yokogawa Centum Buffer Overflow Vulnerability *** --------------------------------------------- Advisory Document --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-189-01 *** DSA-2974 php5 *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2974 *** DSA-2973 vlc *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2973 *** HPSBMU03065 rev.1 - HP Operations Analytics, OpenSSL Vulnerability, SSL/TLS, Remote Code Execution, Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Operations Analytics. The vulnerability could be exploited to allow remote code execution, denial of service (DoS) and disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** ABB Relion 650 Series OpenSSL Vulnerability (Update A) *** --------------------------------------------- Advisory Document --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-126-01A *** Cisco IOS Software and Cisco IOS XE Software NTP Access Group Vulnerability *** --------------------------------------------- CVE-2014-3309 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-14:17.kmem *** --------------------------------------------- http://www.securityfocus.com/archive/1/532698 *** Juniper Security Bulletins *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10634&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10633&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10638&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10637&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10641&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10635&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10613&actp=RSS http://kb.juniper.net/index?page=content&id=JSA10640&actp=RSS *** IBM Security Bulletin: IBM InfoSphere Guardium System x/Flex Systems appliances are affected by vulnerabilities in OpenSSL *** --------------------------------------------- IBM InfoSphere Guardium System x/Flex Systems appliances are affected by vulnerabilities in OpenSSL (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470) Security vulnerabilities have been discovered in OpenSSL. CVE(s): CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470 and CVE-2014-5298 Affected product(s) and affected version(s): Hardware versions affected: InfoSphere Guardium Collector X1000 InfoSphere --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Rational Systems Tester is affected by Libxml2 vulnerability (CVE-2014-0191) *** --------------------------------------------- Denial-Of-service vulnerability has been discovered in Libxml2 that was reported on May 09, 2014 CVE(s): CVE-2014-0191 Affected product(s) and affected version(s): Rational Systems Tester 3.3, 3.3.0.1, 3.3.0.2, 3.3.0.3, 3.3.0.4, 3.3.0.5, 3.3.0.6, 3.3.0.7 Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21678183 X-Force Database: http://xforce.iss.net/xforce/xfdb/93092 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin…

1 0

Tageszusammenfassung - Dienstag 8-07-2014
by Daily end-of-shift report 08 Jul '14

08 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-07-2014 18:00 − Dienstag 08-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Multi Platform *Coin Miner Attacking Routers on Port 32764, (Mon, Jul 7th) *** --------------------------------------------- Thanks to reader Gary for sending us in a sample of a *Coin miner that he found attacking Port 32764. Port 32764 was recently found to offer yet another backdoor on Sercomm equipped devices. We covered this backdoor before [1] The bot itself appears to be a variant of the "zollard" worm sean before by Symantec [2]. Symantecs writeup describes the worm as attacking a php-cgi vulnerability, not the Sercomm backdoor. But this worm has been seen using various exploits. Here some quick,... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18353&rss *** When Adware Goes Bad: The Installbrain and Sefnit Connection *** --------------------------------------------- "Monetize On Non-buyers" is the bold motto of InstallBrain-adware that turns out to have been developed by an Israeli company called iBario Ltd. This motto clearly summarizes the potential risks adware companies can introduce to users, especially when they install stuff on... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/nRXcb4Udr5o/ *** IEEE expands malware initiatives *** --------------------------------------------- Clearing-house for software metadata Standards body the IEEE has launched two new anti-malware initiatives designed to help software and security vendors spot malware thats been inserted into other software, and improve the performance of malware detection by cutting down on false positives. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/08/ieee_expand… *** NTT Group 2014 Global Threat Intelligence Report *** --------------------------------------------- The NTT Group 2014 Global Threat Intelligence Report (GTIR) emphasizes that the security basics, when done right, can be enough to mitigate and even avoid high-profile, costly data breaches altogether. Using statistics and real-world case studies, the report shows that combining threat avoidance and threat response capabilities into a strategic approach provides the best chance to reduce the impact of threats. --------------------------------------------- http://www.solutionary.com/research/threat-reports/annual-threat-report/ntt… *** Paper: VBA is not dead! *** --------------------------------------------- Gabor Szappanos looks at the resurgence of malicious VBA macros that use social engineering to activate. --------------------------------------------- http://www.virusbtn.com/news/2014/07_07.xml?rss *** Android Vulnerability Allows Applications to Make Unauthorized Calls without Permissions *** --------------------------------------------- A major vulnerability believed to be present in most versions of Android can allow a malicious Android applications on the Android app store to make phone calls on a user's device, even when they lack the necessary permissions. The critical vulnerability was identified and reported to Google Inc. late last year by researchers from German security firm Curesec. The researchers believe the... --------------------------------------------- http://thehackernews.com/2014/07/android-vulnerability-allows.html *** Google Android / eduroam-Zugangsdaten *** --------------------------------------------- Bei mobilen Geräten mit Android-Betriebssystem ist die Default-Konfiguration für die Option CA-Zertifikat für WLAN-Verbindungen "keine Angabe". Konkret bedeutet dieses als normal dokumentierte Verhalten, dass die Prüfung der Zertifikatskette komplett deaktiviert ist, d.h. jedes beliebige Zertifikat wird ohne weitere Warnung akzeptiert. Erschwerend kommt hinzu,... --------------------------------------------- https://www.dfn-cert.de/aktuell/Google-Android-Eduroam-Zugangsdaten.html *** How not to tell your customers how much you care about their security *** --------------------------------------------- Weve written before about "what not to do" when sending emails to your customers. Heres another example, with an explanation of why doing the right thing will be better for everyone - including your marketing team! - in the long run. --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/08/how-not-to-tell-your-customers-h… *** Metadaten gegen Viren-Fehlerkennugen *** --------------------------------------------- Die IEEE hat eine Datenbank für Metadaten von Binaries gestartet. Sie liefert Informationen, über die ein Virenscanner eindeutig feststellen kann, ob eine Datei gutartig ist. --------------------------------------------- http://www.heise.de/security/meldung/Metadaten-gegen-Viren-Fehlerkennugen-2… *** GKsu and VirtualBox Root Command Execution by Filename (CVE-2014-2943) *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/07/07/virtualbo… *** Bugtraq: Backdoor access to Techboard/Syac devices *** --------------------------------------------- http://www.securityfocus.com/archive/1/532665 *** [remote] - Oracle Event Processing FileUploadServlet Arbitrary File Upload *** --------------------------------------------- http://www.exploit-db.com/exploits/33989 *** Vuln: GitList CVE-2014-4511 Unspecified Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/68253 *** Security Advisory-Apache Struts2 vulnerability on Huawei multiple products *** --------------------------------------------- Jul 07, 2014 21:09 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Apple iTunes 11.2.2 Insecure Libraries *** --------------------------------------------- Topic: Apple iTunes 11.2.2 Insecure Libraries Risk: High Text:Hi @ll, Apples current iTunes 11.2.2 for Windows comes with the following COMPLETELY outdated and vulnerable 3rd party libr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070042 *** Apache Syncope Insecure Password Generation *** --------------------------------------------- Topic: Apache Syncope Insecure Password Generation Risk: Medium Text:CVE-2014-3503: Insecure Random implementations used to generate passwords in Apache Syncope Severity: Major Vendor: The ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014070039 *** Vuln: WordPress Easy Banners Plugin easy-banners.php Cross Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/68281 *** Vuln: WordPress Custom Banners Plugin options.php Cross Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/68279 *** TYPO3 CMS 4.5.35, 6.1.10 and 6.2.4 released *** --------------------------------------------- The TYPO3 Community announces the versions 4.5.35, 6.1.10 and 6.2.4 of the TYPO3 Enterprise Content Management System. All versions are maintenance releases and contain bug fixes. --------------------------------------------- https://typo3.org/news/article/typo3-cms-4535-6110-and-624-released/ *** HPSBGN03050 rev.1 - HP IceWall SSO Dfw and HP IceWall MCRP running OpenSSL, Remote Denial of Service (DoS), Code Execution, Security Restriction Bypass, Disclosure of Information, or Unauthorized Access *** --------------------------------------------- Potential security vulnerabilities have been identified with HP IceWall SSO Dfw and HP IceWall MCRP running OpenSSL. The vulnerabilities could be exploited remotely to create a Denial of Service (DoS), execute code, allow unauthorized access, or disclose information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Montag 7-07-2014
by Daily end-of-shift report 07 Jul '14

07 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-07-2014 18:00 − Montag 07-07-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Self-signing custom Android ROMs *** --------------------------------------------- The security model on the Google Nexus devices is pretty straightforward. The OS is (nominally) secure and prevents anything from accessing the raw MTD devices. The bootloader will only allow the user to write to partitions if its unlocked. The recovery image will only permit you to install images that are signed with a trusted key. In combination, these facts mean that its impossible for an attacker to modify the OS image without unlocking the bootloader[1], and unlocking the bootloader wipes --------------------------------------------- http://mjg59.dreamwidth.org/31765.html *** Java Support ends for Windows XP, (Sat, Jul 5th) *** --------------------------------------------- Oracle is no longer supporting Java for Windows XP and will only support Windows Vista or later. Java 8 is not supported for Windows XP and users will be unable to install on their systems. Oracle warns "Users may still continue to use Java 7 updates on Windows XP at their own risk" [1] [1] https://www.java.com/en/download/faq/winxp.xml [2] http://www.oracle.com/us/support/library/057419.pdfhttps://www.java.com/en/… ----------- Guy Bruneau IPSS Inc. gbruneau at --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18345&rss *** Critical Vulnerability and Privacy LoopHole Found in RoboForm Password Manager *** --------------------------------------------- Unless you are a human supercomputer, remembering password is not so easy, and that too if you have a different password for each site. But luckily to make the whole process very easy, there is a growing market out there for password managers and lockers with extra layers of security. But, if you are using the mobile version of most popular password manager from Password management company --------------------------------------------- http://feedproxy.google.com/~r/TheHackersNews/~3/Ajpf8i6yTao/critical-vulne… *** Zwei Patches schließen SQL-Injection-Lücken in Ruby on Rails *** --------------------------------------------- Zwei recht ähnliche Lücken erlaubten SQL-Injections auf Websites, die auf Ruby on Rails 2.0.0 bis 3.1.18 sowie auf 4.x aufsetzen. In mehreren Anläufen haben die Rails-Entwickler die Lücken nun geschlossen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Zwei-Patches-schliessen-SQL-Injectio… *** Malware Analysis with pedump, (Sat, Jul 5th) *** --------------------------------------------- Are you looking for a tool to analyze Windows Portable Executable (PE) files? Consider using pedump a ruby win32 PE binary file analyzer. It currently support DOS MZ EXE, win16 NE and win32/64 PE. There are several ways to install the ruby package; however, the simplest way is to execute "gem install pedump" from a Linux workstation. You can also download the file here or use the pedump website to upload your file for analysis. This example shows the output from the pedump website. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18347&rss *** Industrial Control System Firms In Dragonfly Attack Identified *** --------------------------------------------- chicksdaddy (814965) writes Two of the three industrial control system (ICS) software companies that were victims of the so-called "Dragonfly" malware have been identified. ... Dale Peterson of the firm Digitalbond identified the vendors as MB Connect Line, a German maker of industrial routers and remote access appliances and eWon, a Belgian firm that makes virtual private network (VPN) software that is used to access industrial control devices like programmable logic controllers. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Jr0QiFtg7lc/story01.htm *** Coinbase wallet app in SSL/TLS SNAFU *** --------------------------------------------- The popular Bitcoin wallet Coinbase has a security flaw in its Android apps which could allow an attacker to steal authentication codes and access users accounts, according to a security researcher. Coinbase is far from alone in leaving its wallet app users vulnerable, so what should you do to stay safe when using mobile banking apps? --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/GsgGIYu7TA0/ *** The Rise of Thin, Mini and Insert Skimmers *** --------------------------------------------- Like most electronic gadgets these days, ATM skimmers are getting smaller and thinner, with extended battery life. Heres a look at several miniaturized fraud devices that were pulled from compromised cash machines at various ATMs in Europe so far this year. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/8s5hQ323oMY/ *** Fridge hacked. Car hacked. Next up, your LIGHT BULBS *** --------------------------------------------- So shall you languish in darkness - or under disco-style strobes - FOREVER Those convinced that the emerging Internet of Things (IoT) will become a hackers playground were given more grist for their mill with news on Friday that security researchers have discovered a weakness in Wi-Fi/mesh networked lightbulbs. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/07/wifi_enable… *** Anwälte: Falsche Filesharing-Abmahnung verbreitet massenhaft Malware *** --------------------------------------------- Zwei bekannte Anwälte warnen vor gefälschten Abmahnungen wegen illegalen Musikdownloads. An den massenhaft verschickten E-Mails hängt eine Zip-Datei mit Schadcode. --------------------------------------------- http://www.golem.de/news/anwaelte-falsche-filesharing-abmahnung-verbreitet-… *** IBM Security Bulletin: Multiple vulnerabilities exist in IMS Enterprise Suite SOAP Gateway (CVE-2014-0453, CVE-2013-4286, CVE-2013-4322) *** --------------------------------------------- The IMS Enterprise Suite SOAP Gateway is affected by multiple vulnerabilities in IBM SDK, Java Technology Edition (April Update) and Apache Tomcat. CVE(s): CVE-2014-0453, CVE-2013-4286 and CVE-2013-4322 Affected product(s) and affected version(s): CVE ID: CVE-2014-0453 The SOAP Gateway component of the IMS Enterprise Suite versions 2.1, 2.2, 3.1. CVE ID: CVE-2013-4286 CVE ID: CVE-2013-4322 The SOAP Gateway component of the IMS Enterprise Suite versions 2.2, 3.1. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** OpenSSL vulnerabilities in IBM Products *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** RealPlayer MP4 Memory Corruption Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030524 *** [webapps] - Netgear WNR1000v3 - Password Recovery Credential Disclosure Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/33984 *** VU#960193: AVG Secure Search ActiveX control provides insecure methods *** --------------------------------------------- Vulnerability Note VU#960193 AVG Secure Search ActiveX control provides insecure methods Original Release date: 07 Jul 2014 | Last revised: 07 Jul 2014 Overview The AVG Secure Search toolbar includes an ActiveX control that provides a number of unsafe methods, which may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user. Description AVG Secure Search is a toolbar add-on for web browsers that "... provides an additional security layer while --------------------------------------------- http://www.kb.cert.org/vuls/id/960193 *** Bugtraq: CVE-2014-3863 - Stored XSS in JChatSocial *** --------------------------------------------- http://www.securityfocus.com/archive/1/532662 *** WordPress Theme My Login for WordPress file include *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94160

1 0

Tageszusammenfassung - Freitag 4-07-2014
by Daily end-of-shift report 04 Jul '14

04 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-07-2014 18:00 − Freitag 04-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Intelligent Automation for Cloud Form Data Viewer information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94177 *** VU#143740: Netgear GS108PE Prosafe Plus Switch contains hard-coded login credentials *** --------------------------------------------- Netgear GS108PE Prosafe Plus Switch contains hard-coded login credentials that can be used for authenticating to the web server running on the device. The username is .. --------------------------------------------- http://www.kb.cert.org/vuls/id/143740 *** MS14-JUL - Microsoft Security Bulletin Advance Notification for July 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-JUL *** Phishing: iPhone 6 und iWatch als Lockmittel *** --------------------------------------------- Angreifer nutzen derzeit die Aufmerksamkeit rund um zukünftige Apple-Produkte, um Nutzer auf eine gefälschte Apple-Webseite zu locken. Die Aufmachung der Mail erinnert an offizielle Apple-Mitteilungen. --------------------------------------------- http://www.heise.de/security/meldung/Phishing-iPhone-6-und-iWatch-als-Lockm… *** Security Bulletin: IBM BladeCenter Advanced Management Module (AMM), Integrated Management Module (IMM), and Integrated Management Module 2 (IMM2) Potential IPMI credentials Exposure (CVE-2014-0860) *** --------------------------------------------- The administrative IPMI credentials for authenticating communications between the IBM BladeCenter Advanced Management Module (AMM), Integrated Management Module (IMM), and Integrated Management Module 2 (IMM2) are stored in plaintext within the AMM firmware binaries. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Dailymotion Compromised to Send Users to Exploit Kit *** --------------------------------------------- Attackers made the popular video site redirect users to the Sweet Orange Exploit Kit. On June 28, the popular video sharing website Dailymotion was compromised to redirect users to the Sweet Orange Exploit Kit. This exploit kit takes advantage of vulnerabilities in Java, Internet Explorer, and Flash Player. If the .. --------------------------------------------- http://www.symantec.com/connect/blogs/dailymotion-compromised-send-users-ex… *** HP Universal Configuration Management Database Flaws Let Remote Users Obtain Information and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030518 *** "Phishing wird vom seltenen Anlass zum Tagesgeschäft" *** --------------------------------------------- Während immer mehr Phishing-Webseiten auftauchen, werden die angewandten Taktiken immer raffinierter. Opfer werden vermehrt persönlich angesprochen. --------------------------------------------- http://futurezone.at/digital-life/phishing-wird-vom-seltenen-anlass-zum-tag… *** Miniduke is back: Nemesis Gemina and the Botgen Studio *** --------------------------------------------- In the wake of our publications from 2013, the Miniduke campaigns have stopped or at least decreased in intensity. However, in the beginning of 2014 they resumed attacks in full force, once again grabbing our attention. We believe its time to uncover more information on their operations. --------------------------------------------- https://www.securelist.com/en/blog/208214341/Miniduke_is_back_Nemesis_Gemin… *** phpinfo() Type Confusion Infoleak Vulnerability and SSL Private Keys *** --------------------------------------------- In this post we will detail the phpinfo() type confusion vulnerability that we disclosed to PHP.net and show how it allows a PHP script to steal the private SSL key. We demonstrate this on a Ubuntu 12.04 LTS 32 bit default installation of PHP and mod_ssl. Unfortunately this kind of problem is not considered a security problem by PHP.net and therefore this security vulnerability does not have a CVE name assignet to it, yet. --------------------------------------------- https://www.sektioneins.de/en/blog/14-07-04-phpinfo-infoleak.html

1 0

Tageszusammenfassung - Donnerstag 3-07-2014
by Daily end-of-shift report 03 Jul '14

03 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-07-2014 18:00 − Donnerstag 03-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Vulnerabilities in Cisco Unified Communications Domain Manager *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Analysis of a New Banking Trojan Spammed by Cutwail *** --------------------------------------------- The Cutwail spambot has a long history of sending spam with attached malicious files such as Zbot, Blackhole Exploit Kit and Cryptolocker. Another trick in Cutwail's portfolio is to use links pointing to popular file hosting services. Over the past weeks, we have observed spam that claims to be an unpaid invoice from .. --------------------------------------------- http://blog.spiderlabs.com/2014/07/analysis-of-a-banking-trojan-spammed-by-… *** Simple Javascript Extortion Scheme Advertised via Bing, (Wed, Jul 2nd) *** --------------------------------------------- Thanks to our reader Dan for spotting this one. As of today, a search for "Katie Matusik" on Bing will include the following result. The rank has been slowly rising during the day, and as of right now, it is the first link after the link to "Videos" Once a user clicks on the link, the user is redirected to .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=18337&rss *** Multiple vulnerabilities in third-party Drupal modules *** --------------------------------------------- https://www.drupal.org/node/2296783 https://www.drupal.org/node/2296511 https://www.drupal.org/node/2296495 *** New Android Malware HijackRAT Attacks Mobile Banking Users *** --------------------------------------------- Cybercriminals have rolled out a new malicious Android application that wraps different varieties of banking fraud trick into a single piece of advanced mobile malware. --------------------------------------------- http://thehackernews.com/2014/07/new-android-malware-hijackrat-attacks.html *** Exploring the Java vulnerability (CVE-2013-2465) used in the Fiesta EK *** --------------------------------------------- While going through our daily analysis this month, we came across several Fiesta Exploit Kit attacks. Although this EK first emerged in August 2013, the authors have constantly updated their .. --------------------------------------------- http://research.zscaler.com/2014/07/exploring-java-vulnerability-cve-2013.h… *** Avast hielt Krypto-Messenger für Trojaner *** --------------------------------------------- Wer angeblich mit dem Trojaner "Android:Banker-BW" infiziert ist, kann die Warnung unter Umständen getrost ignorieren. Der Avast-Virenscanner hat Moxie Marlinspikes Krypto-Messenger TextSecure fälschlicherweise als Malware eingestuft. --------------------------------------------- http://www.heise.de/security/meldung/Avast-hielt-Krypto-Messenger-fuer-Troj… *** Bugtraq: [security bulletin] HPSBMU03059 rev.1 - HP SiteScope, Remote Authentication Bypass *** --------------------------------------------- http://www.securityfocus.com/archive/1/532631 *** DynDNS-Dienst: Microsoft hat Domains an NoIP zurückgegeben *** --------------------------------------------- Seit Tagen funktioniert der DynDNS-Dienst NoIP für viele Kunden nicht, weil Microsoft die Domains übertragen wurden und viele Anfragen ins Leere liefen. Nun hat Microsoft die Domains zurückgegeben und die Lage sollte sich normalisieren. --------------------------------------------- http://www.heise.de/security/meldung/DynDNS-Dienst-Microsoft-hat-Domains-an… *** VU#402020: Autodesk VRED contains an unauthenticated remote code execution vulnerability *** --------------------------------------------- Improper Neutralization of Special Elements used in an OS Command (OS Command Injection): Autodesk VRED Professional 2014 contains an unauthenticated remote code execution vulnerability. Autodesk VRED Professional 2014. --------------------------------------------- http://www.kb.cert.org/vuls/id/402020 *** 8 Common Pitfalls of HeartBleed Identification and Remediation (CVE-2014-0160) *** --------------------------------------------- Unfortunately, one of the biggest vulnerabilities disclosed this year, HeartBleed, has been inefficiently addressed and for some, already forgotten about. Plenty of details about the vulnerability already exist including our FAQ and .. --------------------------------------------- http://blog.spiderlabs.com/2014/07/pitfalls-of-heartbleed-identification-an…

1 0

Tageszusammenfassung - Mittwoch 2-07-2014
by Daily end-of-shift report 02 Jul '14

02 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-07-2014 18:00 − Mittwoch 02-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Microsoft Expands TLS, Forward Secrecy Support *** --------------------------------------------- Microsoft announced TLS support on Outlook.com and that OneDrive cloud storage now supports Perfect Forward Secrecy. --------------------------------------------- http://threatpost.com/microsoft-expands-tls-forward-secrecy-support/106965 *** Cisco Small Cell Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DOWNAD Tops Malware Spam Source in Q2 2014 *** --------------------------------------------- DOWNAD , also known as Conficker remains to be one of the top 3 malware that affects enterprises and small and medium businesses. This is attributed to the fact that a number of companies are still using Windows XP, susceptible to this threat. It can infect .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/downad-tops-malw… *** VMSA-2014-0006.4 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** Microsoft Digital Crimes Unit disrupts Jenxcus and Bladabindi malware families *** --------------------------------------------- Today, following an investigation to which the Microsoft Malware Protection Center (MMPC) contributed, the Microsoft Digital Crimes Unit initiated a disruption of the Jenxcus and Bladabindi malware families. These families are believed to have been created by individuals Naser Al Mutairi, aka njQ8, and .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/06/30/microsoft-digital-crimes… *** MONSTER COOKIES can nom nom nom ALL THE BLOGS *** --------------------------------------------- Blog networks can be force-fed more than they can chew Giant cookies could be used to create a denial of service (DoS) on blog networks, says infosec researcher Bogdan Calin. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/07/02/monster_coo… *** Transparenzzentrum: Microsoft gewährt Behörden Quellcode-Einsicht *** --------------------------------------------- In einem Transparenzzentrum will Microsoft Behörden, die Code-Manipulationen durch fremde Geheimdienste befürchten, die Gelegenheit bieten, den Source-Code selbst zu untersuchen. --------------------------------------------- http://www.heise.de/security/meldung/Transparenzzentrum-Microsoft-gewaehrt-… *** Anatomy of a buffer overflow - Googles "KeyStore" security module for Android *** --------------------------------------------- Heres a cautionary tale about a bug, courtesy of IBM. Not that IBM had the bug, just to be clear: Google had the bug, and IBM researchers spotted it. --------------------------------------------- http://nakedsecurity.sophos.com/2014/07/02/anatomy-of-a-buffer-overflow-goo… *** OpenSSL legt Sanierungsplan vor *** --------------------------------------------- Nach der Heartbleed-Katastrophe hat das OpenSSL-Projekt nun eine Roadmap veröffentlicht, die helfen soll, organisatorische Mängel im Entwicklungsprozess auszubessern. --------------------------------------------- http://www.heise.de/security/meldung/OpenSSL-legt-Sanierungsplan-vor-224810… *** Rig Exploit Kit Used in Recent Website Compromise *** --------------------------------------------- Attackers planted code in a popular Web portal to redirect users to an exploit kit .. --------------------------------------------- http://www.symantec.com/connect/blogs/rig-exploit-kit-used-recent-website-c…

1 0

Tageszusammenfassung - Dienstag 1-07-2014
by Daily end-of-shift report 01 Jul '14

01 Jul '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 30-06-2014 18:00 − Dienstag 01-07-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Microsoft Darkens 4MM Sites in Malware Fight *** --------------------------------------------- Millions of Web sites were shuttered Monday morning after Microsoft executed a legal sneak attack against a malware network thought to be responsible for more than 7.4 million infections of Windows PCs worldwide. --------------------------------------------- http://krebsonsecurity.com/2014/07/microsoft-darkens-4mm-sites-in-malware-f… *** Apple Releases Security Updates for OS X, Safari, iOS devices, and Apple TV *** --------------------------------------------- Apple has released security updates for Mac OS X, Safari, iOS devices, and Apple TV to address multiple vulnerabilities, some of which could allow attackers to execute arbitrary code with system privileges or cause an unexpected application termination. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2014/07/01/Apple-Releases-Sec… *** [2014-06-30] Multiple vulnerabilities in IBM Algorithmics RICOS *** --------------------------------------------- Abusing multiple vulnerabilities within IBM Algorithmics RICOS, an attacker can take over foreign user accounts and bypass authorization mechanisms. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** JBoss Seam org.jboss.seam.web.AuthenticationFilter code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/94090 *** ICS Focused Malware *** --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-178-01 *** CERT-Bund: Trojaner-Opfer ändern Passwörter, PCs bleiben infiziert *** --------------------------------------------- Die Auswertung von zehntausenden kompromittierten Mail-Zugangsdaten zeigt, dass ein beträchtlicher Teil der Opfer zwar sein Passwort ändert, allerdings schnell erneut zum Opfer wird - möglicherweise, weil der Rechner nicht desinfiziert wurde. --------------------------------------------- http://www.heise.de/security/meldung/CERT-Bund-Trojaner-Opfer-aendern-Passw… *** [2014-07-01] Stored cross site scripting in EMC Documentum eRoom *** --------------------------------------------- Due to improper input validation, EMC Documentum eRoom suffers from multiple stored cross-site scripting vulnerabilities, which allow an attacker to steal other users sessions, to impersonate other users and to gain unauthorized access to documents hosted in eRooms. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Apple testet Zwei-Faktor-Authentifizierung auf iCloud.com *** --------------------------------------------- Künftig sollen auch auf Apples Cloud-Portal Zugangsdaten besser abgesichert werden. Gestern war die Funktion kurzzeitig freigegeben. --------------------------------------------- http://www.heise.de/security/meldung/Apple-testet-Zwei-Faktor-Authentifizie… *** Verwirrung um Microsofts Sicherheits-Newsletter *** --------------------------------------------- Wer Windows-Rechner administriert, weiss den Security-Notifications-Newsletter von Microsoft zu schätzen. Letzte Woche kündigte das Unternehmen an, diesen einzustellen - um die Entscheidung kurz darauf zu revidieren. --------------------------------------------- http://www.heise.de/security/meldung/Verwirrung-um-Microsofts-Sicherheits-N… *** Cyberspying Campaign Comes With Sabotage Option *** --------------------------------------------- New research from Symantec spots US and Western European energy interests in the bulls eye, but the campaign could encompass more than just utilities. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/advanced-threats/cyber… *** Geodo: New Cridex Version Combines Data Stealer and Email Worm *** --------------------------------------------- Recent efforts by our Research Lab has revealed new activity related to Cridex. As you may recall, Cridex is a data stealer also referred to as Feodo, and Bugat. The new Cridex version we are seeing now, aka Geodo, combines a self-spreading infection method - effectively turning each bot in the botnet .. --------------------------------------------- http://www.seculert.com/blog/2014/07/geodo-new-cridex-version-combines-data… *** Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters) *** --------------------------------------------- Marc-Alexandre Montpas, from our research team, found a serious security vulnerability in the MailPoet WordPress plugin. This bug allows an attacker to upload any file remotely to the vulnerable website (i.e., no authentication is required). This is a serious vulnerability, The MailPoet plugin (wysija-newsletters) .. --------------------------------------------- http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet… *** IBM BladeCenter Advanced Management Module (AMM), Integrated Management Module (IMM), and Integrated Management Module 2 (IMM2) Potential IPMI credentials Exposure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/90880

1 0

Tageszusammenfassung - Montag 30-06-2014
by Daily end-of-shift report 30 Jun '14

30 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-06-2014 18:00 − Montag 30-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Akamai State of the Internet Report *** --------------------------------------------- The globally distributed Akamai Intelligent Platform delivers over 2 trillion Internet interactions and defends against multiple DDoS attacks each day. This provides us with unique visibility into Internet connection speeds, broadband adoption, mobile usage, outages, and attacks. Drawing .. --------------------------------------------- http://www.akamai.com/stateoftheinternet/ *** OpenAFS Memory Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030459 *** 20 Jahre alte Kompressionsverfahren-Lücke sorgt für Verwirrung *** --------------------------------------------- Sicherheitsforscher deckte Schwachstelle auf, von der hauptsächlich Linux-User betroffen sein sollen - Entwarnung von Autoren --------------------------------------------- http://derstandard.at/2000002429137 *** Serious Android crypto key theft vulnerability affects 86% of devices *** --------------------------------------------- Bug in Android KeyStore that leaks credentials fixed only in KitKat. --------------------------------------------- http://arstechnica.com/security/2014/06/serious-android-crypto-key-theft-vu… *** Anatomy of an Android SMS virus - watch out for text messages, even from your friends! *** --------------------------------------------- Paul Ducklin looks into "Andr/SlfMite-A", an Android SMS virus. The malware sends itself to your top 20 contacts and foists an third party app for an alternative Android software market onto your device... --------------------------------------------- http://nakedsecurity.sophos.com/2014/06/29/anatomy-of-an-android-sms-virus-… *** DSA-2970 cacti *** --------------------------------------------- http://www.debian.org/security/2014/dsa-2970 *** Microsoft Kills Security Emails, Blames Canada *** --------------------------------------------- In a move that may wind up helping spammers, Microsoft is blaming a new Canadian anti-spam law for the companys recent decision to stop sending regular emails about security updates for its Windows operating system and other Microsoft software. --------------------------------------------- http://krebsonsecurity.com/2014/06/microsoft-kills-security-emails-blames-c… *** ICS Focused Malware (Update A) *** --------------------------------------------- This alert update is a follow-up to the original NCCIC/ICS-CERT Alert titled ICS-ALERT-14-176-02 ICS Focused Malware that was published June 25, 2014 on the ICS-CERT web site, and includes information previously published to the US-CERT secure portal. --------------------------------------------- http://ics-cert.us-cert.gov/alerts/ICS-ALERT-14-176-02A *** Disqus Wordpress Plugin Flaw Leaves Millions of Blogs Vulnerable to Hackers *** --------------------------------------------- A Remote code execution (RCE) vulnerability has been discovered in the comment and discussion service, Disqus plugin for the most popular Blogging Platform Wordpress. While there are more than 70 million websites on the Internet currently running WordPress, about 1.3 million of them use the 'Disqus Comment System' Plugin, making it one of the popular plugins of Wordpress for web comments --------------------------------------------- http://thehackernews.com/2014/06/disqus-wordpress-plugin-flaw-leaves.html *** Medienplayer VLC mit kritischer Krypto-Lücke *** --------------------------------------------- Eine Schwachstelle in GnuTLS kann offenbar auch VLC-Nutzern zum Verhängnis werden: Versucht der Mediaplayer einen Stream von einem präparierten Server zu öffnen, droht die Infektion mit Schadcode. --------------------------------------------- http://www.heise.de/security/meldung/Medienplayer-VLC-mit-kritischer-Krypto… *** Analysis: Spam in May 2014 *** --------------------------------------------- In the run-up to the summer, spammers offered their potential customers seedlings and seeds for gardening. In addition, English-language festive spam in May was dedicated to Mother's Day - the attackers sent out adverts offering flowers and candies. --------------------------------------------- http://www.securelist.com/en/analysis/204792339/Spam_in_May_2014 *** How to protect yourself against privileged user abuse *** --------------------------------------------- Network World - The typical organization loses 5% of its revenues to fraud by its own employees each year, with most thefts committed by trusted employees in executive management, operations, accounting, sales, customer service or purchasing, .. --------------------------------------------- http://www.computerworld.com/s/article/9249440/How_to_protect_yourself_agai… *** Auch Google schliesst Datenleck im Cloud-Speicher *** --------------------------------------------- Wer Links in bei Google Drive abgelegten Dokumenten anklickt, hinterlässt Datenspuren. Durch diese können Dritte auf die Dokumente zugreifen. --------------------------------------------- http://www.heise.de/security/meldung/Auch-Google-schliesst-Datenleck-im-Clo…

1 0

Tageszusammenfassung - Freitag 27-06-2014
by Daily end-of-shift report 27 Jun '14

27 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-06-2014 18:00 − Freitag 27-06-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Stuxnet-like Havex Malware Strikes European SCADA Systems *** --------------------------------------------- Security researchers have uncovered a new Stuxnet like malware, named as "Havex", which was used in a number of previous cyber attacks against organizations in the energy sector. Just like Famous Stuxnet Worm, which was specially designed to sabotage the Iranian nuclear project, the new trojan Havex is also programmed to infect industrial control system softwares of SCADA and ICS systems,... --------------------------------------------- http://thehackernews.com/2014/06/stuxnet-like-havex-malware-strikes.html *** Integer-Overflow: Sicherheitslücke in Kompressionsverfahren LZ4 und LZO *** --------------------------------------------- Im Code für die weit verbreiteten Kompressionsverfahren LZO und LZ4 wurde eine Sicherheitslücke entdeckt. Das betrifft zahlreiche Anwendungen, darunter den Linux-Kernel, die Multimediabibliotheken FFmpeg und Libav, sowie OpenVPN. --------------------------------------------- http://www.golem.de/news/integer-overflow-sicherheitsluecke-in-kompressions… *** Image Stock Spam Reemerges *** --------------------------------------------- Image stock spam, which can affect share prices and cause financial loss, has become more prominent in the last week. Image spam has been around for a longtime and peaked in January 2007 when Symantec estimated that image spam accounted for nearly 52 percent of all spam. Pump-and-dump image stock spam made up a significant portion of that 52 percent. --------------------------------------------- http://www.symantec.com/connect/blogs/image-stock-spam-reemerges *** 1st International Conference on Information Systems Security and Privacy - ICISSP 2015 *** --------------------------------------------- Venue: ESEO, Angers, Loire Valley, France Event date: 9 - 11 February, 2015 Scope: The International Conference on Information Systems Security and Privacy aims at creating a meeting point of researchers and practitioners that address security and privacy challenges that concern information systems, especially in organizations, including not only technological issues but also social issues. --------------------------------------------- http://www.securityfocus.com/archive/1/532572 *** Neue PHP-Versionen verarzten Sicherheitslücken *** --------------------------------------------- PHP 5.4.30 und 5.5.14 schließen jeweils eine größere Anzahl von Sicherheitslücken; die Entwickler empfehlen ein zügiges Upgrade. --------------------------------------------- http://www.heise.de/security/meldung/Neue-PHP-Versionen-verarzten-Sicherhei… *** Thomson TWG87OUIR Cross Site Request Forgery *** --------------------------------------------- Topic: Thomson TWG87OUIR Cross Site Request Forgery Risk: Medium Text:#Author: nopesled #Date: 24/06/14 #Vulnerability: POST Password Reset CSRF #Tested on: Thomson TWG87OUIR (Hardware Version) ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060148 *** Bugtraq: [RT-SA-2014-008] Python CGIHTTPServer File Disclosure and Potential Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/532571 *** Security Notice-Statement About the Impact of the Dual_EC_DRBG Vulnerability on Huawei Devices *** --------------------------------------------- Jun 27, 2014 17:39 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Vuln: LZ4 lz4.c Memory Corruption Vulnerability *** --------------------------------------------- LZ4 lz4.c Memory Corruption Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/68218

1 0

Tageszusammenfassung - Donnerstag 26-06-2014
by Daily end-of-shift report 26 Jun '14

26 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-06-2014 18:00 − Donnerstag 26-06-2014 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Symantec Data Insight Management Console HTML Injection and Cross-Site Scripting *** --------------------------------------------- The management console for Symantec Data Insight does not sufficiently validate/sanitize arbitrary input in two separate fields within the management GUI. This could potentially allow unauthorized command execution or potential malicious redirection. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** VMware Patches Apache Struts Flaws in vCOPS *** --------------------------------------------- VMware has patched several serious security vulnerabilities in its vCenter Operations Center Management suite, one of which could lead to remote code execution on vulnerable machines. --------------------------------------------- http://threatpost.com/vmware-patches-apache-struts-flaws-in-vcops/106858 *** phpMyAdmin 4.2.3 XSS *** --------------------------------------------- Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.1.x before 4.1.14.1 and 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted table name that is improperly handled after a hide or unhide action. --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060139 *** Sophos Anti-Virus Input Validation Flaw in Configuration Console Permits Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in the Sophos Anti-Virus Configuration Console. A remote user can conduct cross-site scripting attacks. Several scripts do not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Sophos Anti-Virus configuration console software and will run in the security context of that site. --------------------------------------------- http://www.securitytracker.com/id/1030467 *** IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 7.0.0.33 *** --------------------------------------------- Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 7.0.0.33 and IBM WebSphere Application Server Hypervisor Edition 7.0.0.33 CVE(s): CVE-2013-6323, CVE-2013-6329, CVE-2013-6349, CVE-2013-6738, CVE-2014-0859, CVE-2013-6438, CVE-2013-6747, CVE-2014-3022, CVE-2014-0891, CVE-2014-0965, CVE-2014-0050, CVE-2014-0098, CVE-2014-0963 and CVE-2014-0114 Affected product(s) and affected version(s): WebSphere Application Server and bundling --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.0.0.9 *** --------------------------------------------- Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.0.0.9 and IBM WebSphere Application Server Hypervisor 8.0.0.9 CVE(s): CVE-2013-6323, CVE-2013-6329, CVE-2013-6349, CVE-2014-0823, CVE-2013-6738, CVE-2014-0857, CVE-2014-0859, CVE-2013-6438, CVE-2013-6747, CVE-2014-3022, CVE-2014-0891, CVE-2014-0965, CVE-2014-0050, CVE-2014-0098, CVE-2014-0963 and CVE-2014-0076 Affected product(s) and affected version(s): WebSphere Application Server and bundling --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: Rational ClearQuest is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-3470 *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. The OpenSSL commponent is shipped as embedded in cqperl. Customers might be affected when there is perl hooks or scripts that are using SSL connections. ClearQuest itself does not provide any service using OpenSSL. CVE(s): CVE-2014-0224 and CVE-2014-3470 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** PayPal 2FA mobe flaw chills warm and fuzzy security feeling *** --------------------------------------------- PayPal's second factor authentication (2FA) protection can be mitigated through mobile device interfaces that allow fraudsters to steal funds with a victim's username and password, Duo Security researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/06/26/paypal_2fa_… *** Multiple Cross Site Scripting in Sophos Antivirus Configuration Console (Linux) *** --------------------------------------------- The Configuration Console of Sophos Antivirus 9.5.1 (Linux) does not sanitize several input parameters before sending them back to the browser, so an attacker could inject code inside these parameters, including JavaScript code. ... CVE: CVE-2014-2385 Affected version: 9.5.1 Fixed version: 9.6.1 --------------------------------------------- https://www.portcullis-security.com/security-research-and-downloads/securit… *** Weniger NTP-Server für dDoS ausnutzbar, aber... *** --------------------------------------------- Die noch verwundbaren Zeitserver sind aber zum Teil so schlecht konfiguriert, dass verheerende NTP-Verstärkungsangriffe nach wie vor möglich sind. --------------------------------------------- http://www.heise.de/newsticker/meldung/Weniger-NTP-Server-fuer-dDoS-ausnutz… *** Fighting cybercrime: Strategic cooperation agreement signed between ENISA and Europol *** --------------------------------------------- The heads of ENISA and Europol today signed a strategic cooperation agreement in Europol's headquarters in The Hague, to facilitate closer cooperation and exchange of expertise in the fight against cybercrime. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/fighting-cybercrime-strateg… *** 2014 Cyber Attacks Timeline Master Index (at least so far) *** --------------------------------------------- Finally I was able to organize the timelines collected in 2014. I have created a new page with the 2014 Cyber Attacks Timeline Master Index accessible either directly or from the link in the top menu bar. Hopefully it will be regularly updated. With this opportunity I also re-ordered the timelines and stats for 2013. Now everything should be more structured. --------------------------------------------- http://hackmageddon.com/2014/06/24/2014-cyber-attacks-timeline-master-index… *** Update to Microsoft Update client *** --------------------------------------------- This article describes the update that further improves the security of Windows Update (WU) / Microsoft Update (MU) client for Windows 8, Windows RT, Windows Server 2012, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1. Note: Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 with update 2919355 already include these improvements. --------------------------------------------- http://support.microsoft.com/kb/2887535 *** Hacking Blind (PDF) *** --------------------------------------------- Abstract We show that it is possible to write remote stack buffer overflow exploits without possessing a copy of the target binary or source code, against services that restart after a crash. This makes it possible to hack proprietary closed-binary services, or open-source servers manually compiled and installed from source where the binary remains unknown to the attacker. --------------------------------------------- http://www.exploit-db.com/download_pdf/33872

1 0

Tageszusammenfassung - Mittwoch 25-06-2014
by Daily end-of-shift report 25 Jun '14

25 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-06-2014 18:00 − Mittwoch 25-06-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** TimThumb WebShot Code Execution Exploit (0-day) *** --------------------------------------------- If you are still using Timthumb after the serious vulnerability that was found on it last year, you have one more reason to be concerned. A new 0-day was just disclosed on TimThumb's "Webshot" feature that allows for certain commands to be executed on the vulnerable website remotely (no authentication required). With a simple command,... --------------------------------------------- http://blog.sucuri.net/2014/06/timthumb-webshot-code-execution-exploit-0-da… *** SPAM Hack Targets WordPress Core Install Directories *** --------------------------------------------- Do you run your website on WordPress? Have you checked the integrity of your core install lately for SPAM like "Google Pharmacy" stores or other fake stores? We have been tracking and analyzing a growing trend in SEO Spam (a.k.a., Search Engine Poisoning (SEP)) attacks in which thousands of compromised WordPress websites are being used... --------------------------------------------- http://blog.sucuri.net/2014/06/spam-hack-targets-wordpress-core-install-dir… *** Asprox botnet campaign shifts tactics, evades detection *** --------------------------------------------- FireEye researchers are tracking spikes in malicious emails attributed to an ongoing Asprox campaign. --------------------------------------------- http://www.scmagazine.com/asprox-botnet-campaign-shifts-tactics-evades-dete… *** R2DR2: ANALYSIS AND EXPLOITATION OF UDP AMPLIFICATION VULNERABILITIES *** --------------------------------------------- Since we began our studies in the Masters degree on ICT security at the European University, drew our attention the possibility of doing a project under the guidance of Alejandro Ramos (@aramosf), a professional of the scene that we admire. After several ideas and proposals by both parties, we decided to make a project about finding new attack vectors on distributed reflection denial of service attacks (DRDOS). Recently this blog talked about it in a article focused on SNMP vulnerability,... --------------------------------------------- http://www.securitybydefault.com/2014/06/r2dr2-analysis-and-exploitation-of… *** PlugX RAT With "Time Bomb" Abuses Dropbox for Command-and-Control Settings *** --------------------------------------------- Monitoring network traffic is one of the means for IT administrators to determine if there is an ongoing targeted attack in the network. Remote access tools or RATs, commonly seen in targeted attack campaigns, are employed to establish command-and-control (C&C) communications. Although the network traffic of these RATs, such as Gh0st, PoisonIvy, Hupigon, and PlugX, among... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/4SyyRxr49gU/ *** HackPorts - Mac OS X Penetration Testing Framework and Tools *** --------------------------------------------- HackPorts was developed as a penetration testing framework with accompanying tools and exploits that run natively on Mac platforms. HackPorts is a "super-project" that leverages existing code porting efforts, security professionals can now use hundreds of penetration tools on Mac systems without the need for Virtual Machines. --------------------------------------------- http://hack-tools.blackploit.com/2014/06/hackports-mac-os-x-penetration-tes… *** Flaw Lets Attackers Bypass PayPal Two-Factor Authentication *** --------------------------------------------- There's a vulnerability in the way that PayPal handles certain requests from mobile clients that can allow an attacker to bypass the two-factor authentication mechanism for the service and transfer money from a victim's account to any recipient he chooses. The flaw lies in the way that the PayPal authentication flow works with the service's... --------------------------------------------- http://threatpost.com/flaw-lets-attackers-bypass-paypal-two-factor-authenti… *** ZyXEL P660RT2 EE rpAuth_1 cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93924 *** [papers] - Searching SHODAN For Fun And Profit *** --------------------------------------------- http://www.exploit-db.com/download_pdf/33859 *** Cisco IOS Software IPsec Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-3299 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** GnuPG data packets denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93935 *** VMSA-2014-0006.3 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** VMSA-2014-0007 *** --------------------------------------------- VMware product updates address security vulnerabilities in Apache Struts library --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0007.html *** TimThumb 2.8.13 Remote Code Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060134 *** Bugtraq: [security bulletin] HPSBMU03053 rev.1 - HP Software Database and Middleware Automation, OpenSSL Vulnerability, Remote Unauthorized Access or Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/532541

1 0

Tageszusammenfassung - Dienstag 24-06-2014
by Daily end-of-shift report 24 Jun '14

24 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-06-2014 18:00 − Dienstag 24-06-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Stop running this script? notification redirects to Angler Exploit Kit *** --------------------------------------------- ESET researchers identified a website serving up a Stop running this script? notification that, when clicked, redirects Internet Explorer users to the Angler Exploit Kit. --------------------------------------------- http://www.scmagazine.com/stop-running-this-script-notification-redirects-t… *** Android KeyStore::getKeyForName buffer overflow *** --------------------------------------------- Google Android is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the KeyStore::getKeyForName method. By sending an overly long string, a remote attacker could overflow a buffer and execute arbitrary code on the system under the keystore process. ... Remedy: Upgrade to the latest version of Android (4.4 or later), available from the Google Web site. See References. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93916 *** Havex Hunts for ICS/SCADA Systems *** --------------------------------------------- During the past year, weve been keeping a close eye on the Havex malware family and the group behind it. Havex is known to be used in targeted attacks against different industry sectors, and it was earlier reported to have specific interest in the energy sector. The main components of Havex are a general purpose Remote Access Trojan (RAT) and a server written in PHP. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002718.html *** Beware of Skype Adware *** --------------------------------------------- During our daily log analysis, we recently encountered a sample purporting to power up Skype with different emoticons. The binary, when installed, integrated itself with Skype and sent the following message contacts without further intervention. --------------------------------------------- http://research.zscaler.com/2014/06/beware-of-skype-adware.html *** Dramatic Drop in Vulnerable NTP Servers Used in DDoS Attacks *** --------------------------------------------- 95 percent of vulnerable NTP servers leveraged in massive DDoS attacks earlier this year have been patched, but the remaining servers still have experts concerned. --------------------------------------------- http://threatpost.com/dramatic-drop-in-vulnerable-ntp-servers-used-in-ddos-…

1 0

Tageszusammenfassung - Montag 23-06-2014
by Daily end-of-shift report 23 Jun '14

23 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-06-2014 18:00 − Montag 23-06-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** IBM Security Bulletin: IBM Security Proventia Network Enterprise Scanner is affected by the following OpenSSL vulnerabilities *** --------------------------------------------- Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. CVE(s): CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298 and CVE-2014-3470 Affected product(s) and affected version(s): Products: IBM Security Enterprise Scanner Versions: 2.3 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Wordpress 3.9.1-CSRF vulnerability *** --------------------------------------------- This is the new version released by Wordpress. version is 3.9.1(Latest) Cross site request Forgery(CSRF) is present in this version at the url shown: http://localhost/wordpress/wp-comments-post.php --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060119 *** cups-filters 1.0.52 execute arbitrary commands *** --------------------------------------------- Topic: cups-filters 1.0.52 execute arbitrary commands Risk: High Text:The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP print... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060124 *** [SECURITY] [DSA 2966-1] samba security update *** --------------------------------------------- Multiple vulnerabilities were discovered and fixed in Samba, a SMB/CIFS file, print, and login server: CVE-2014-0178 Information leak vulnerability in the VFS code.. CVE-2014-0244 Denial of service (infinite CPU loop) in the nmbd.. CVE-2014-3493 Denial of service (daemon crash) in the smbd.. --------------------------------------------- https://lists.debian.org/debian-security-announce/2014/msg00147.html *** Security Bulletin: IBM Security Access Manager for Mobile and IBM Security Access Manager for Web appliances - LMI Authentication Bypass *** --------------------------------------------- IBM Security Access Manager for Mobile / IBM Security Access Manager for Web fails to properly handle certain input data such that it could be possible for an attacker to authenticate to the appliance Local Management Interface using invalid authentication data. CVE: CVE-2014-3053 CVSS Base Score: 8.0 --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21676700 *** A peek inside a commercially available Android-based botnet for hire *** --------------------------------------------- Relying on the systematic release of DIY (do-it-yourself) mobile malware generating tools, commercial availability of mobile malware releases intersecting with the efficient exploitation of legitimate Web sites through fraudulent underground traffic exchanges, as well as the utilization of cybercrime-friendly affiliate based revenue sharing schemes, cybercriminals continue capitalizing on the ever-growing Android mobile market segment for the purpose of achieving a positive ROI ... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/m9Fm5dNY9bg/

1 0

Tageszusammenfassung - Freitag 20-06-2014
by Daily end-of-shift report 20 Jun '14

20 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-06-2014 18:00 − Freitag 20-06-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** SA-CONTRIB-2014-062 -Passsword Policy - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-062 Project: Password policy (third-party module) Version: 6.x, 7.x Date: 2014-June-18 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Multiple vulnerabilities Description: The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords.Access bypass and information disclosure (7.x only) --------------------------------------------- https://drupal.org/node/2288341 *** KDE: Fehler in Kmail ermöglicht Man-in-the-Middle-Angriffe *** --------------------------------------------- Im Code des POP3-Kioslaves in KDEs E-Mail-Anwendung Kmail beziehungsweise in Kdelibs ist ein Fehler, durch den ungültige Zertifikate ohne Abfrage akzeptiert werden. Angreifer könnten sich so in den verschlüsselten E-Mail-Verkehr einklinken. --------------------------------------------- http://www.golem.de/news/kde-fehler-in-kmail-erlaubt-man-in-the-middle-angr… *** Cisco WebEx Meeting Server Sensitive Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the XML programmatic interface (XML PI) of Cisco WebEx Meeting Server could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to disclosure of the meeting information. An attacker could exploit this vulnerability by sending a crafted URL request to a vulnerable device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Tausende Android-Apps geben geheime Schlüssel preis *** --------------------------------------------- Viele Android-Programme betten geheime Zugangsschlüssel direkt in ihren Quellcode ein. Ein Angreifer kann diese nutzen, um private Daten der App-Nutzer zu erbeuten und im schlimmsten Fall die Server-Infrastruktur der Entwickler übernehmen. --------------------------------------------- http://www.heise.de/security/meldung/Tausende-Android-Apps-geben-geheime-Sc… *** Android 4.4.4 is rolling out to devices; contains OpenSSL fix *** --------------------------------------------- Official change log lists "security fixes;" Googler says it is OpenSSL related. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/rMSXTBPBcjU/ *** 'Your fault - core dumped' - Diving into the BSOD caused by Rovnix *** --------------------------------------------- Recently we have noticed some Win32/Rovnix samples (detected as TrojanDropper:Win32/Rovnix.K) causing the BSOD on Windows 7 machines. We spent some time investigating this situation and discovered an interesting story behind the BSOD. Analyzing the crash dump We first saw TrojanDropper:Win32/Rovnix.K in October 2013. During a normal Windows Boot the malware will cause the BSOD. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/06/18/your-fault-core-dumped-d… *** Linux Kernel PI Futex Requeuing Bug Lets Local Users Gain Elevated Privileges *** --------------------------------------------- A vulnerability was reported in the Linux Kernel. A local user can obtain elevated privileges on the target system. A local user can can exploit a flaw in the requeuing of Priority Inheritance (PI) to PI futexes to gain elevated privileges on the target system. --------------------------------------------- http://www.securitytracker.com/id/1030451 *** Yet Another BMC Vulnerability (And some added extras) *** --------------------------------------------- After considering the matter for the past 6 months while continuing to work with Supermicro on the issues, I have decided to release the following to everyone. On 11/7/2013, after reading a couple articles on the problems in IPMI by Rapid7's HD Moore (linked at the end), I discovered that Supermicro had created the password file PSBlock in plain text and left it open to the world on port 49152. --------------------------------------------- http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-… *** Simplocker ransomware: New variants spread by Android downloader apps *** --------------------------------------------- Since our initial discovery of Android/Simplocker we have observed several different variants. The differences between them are mostly in: Tor usage - some use a Tor .onion domain, whereas others use a more conventional C&C domain. Different ways of receiving the 'decrypt' command, indicating that the ransom has been paid. ... --------------------------------------------- http://www.welivesecurity.com/2014/06/19/simplocker-new-variants/ *** Pen Testing Payment Terminals - A Step by Step How-to Guide *** --------------------------------------------- There is plentitude of payment terminals out there and the design principles vary quite a bit. The ones I have run into in Finland appear to be tightly secured with no attack surface. At first glance, that is. These generally open only outbound connections and use SSL encryption to protect the traffic. Here, I explain why testing a simple, tightly secured payment terminal is not as simple as one might think. --------------------------------------------- http://pen-testing.sans.org/blog/pen-testing/2014/06/12/pen-testing-payment…

1 0

Tageszusammenfassung - Mittwoch 18-06-2014
by Daily end-of-shift report 18 Jun '14

18 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-06-2014 18:00 − Mittwoch 18-06-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** Evernote forum breached, profile information compromised *** --------------------------------------------- The official discussion forum of Evernote has been hacked, leaving users profile information accessible to attackers. --------------------------------------------- http://www.scmagazine.com/evernote-forum-breached-profile-information-compr… *** Xen Lets Local Guests Obtain Hypervisor Heap Memory Contents *** --------------------------------------------- A vulnerability was reported in Xen. A local user can obtain potentially sensitive information from other domains. The system does not properly control access to memory pages during memory cleanup for dying guest systems. A local user on a guest system can access information from guest or hypervisor memory, potentially including guest CPU register state and hypercall arguments. --------------------------------------------- http://www.securitytracker.com/id/1030442 *** HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal *** --------------------------------------------- VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Executive Scorecard. The vulnerability could be exploited remotely to allow remote code execution and directory traversal. References: CVE-2014-2609 (ZDI-CAN-2116, SSRT101436) CVE-2014-2610 (ZDI-CAN-2117, SSRT101435) CVE-2014-2611 (ZDI-CAN-2120, SSRT101431) --------------------------------------------- http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDispl… *** OpenStack Neutron L3-agent Remote Denial of Service Vulnerability *** --------------------------------------------- OpenStack Neutron is prone to a remote denial-of-service vulnerability. An attacker can leverage this issue to cause a denial-of-service condition; denying service to legitimate users. The following versions are vulnerable: Versions Neutron 2013.2.3 and prior. Versions Neutron 2014.1 and prior. --------------------------------------------- http://www.securityfocus.com/bid/68064/discuss *** Microsoft bessert absturzgefährdeten Virenschutz nach *** --------------------------------------------- Mit einem Update außer der Patchday-Reihe beseitigt Microsoft einen Fehler in der Malware Protection Engine durch den Schädlinge den Virenschutz lahmlegen konnten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Microsoft-bessert-absturzgefaehrdete… *** VU#774788: Belkin N150 path traversal vulnerability *** --------------------------------------------- Belkin N150 wireless router firmware versions 1.00.07 and earlier contain a path traversal vulnerability through the built-in web interface. The webproc cgi module accepts a getpage parameter which takes an unrestricted file path as input. The web server runs with root privileges by default, allowing a malicious attacker to read any file on the system. --------------------------------------------- http://www.kb.cert.org/vuls/id/774788 *** [remote] - Ubisoft Rayman Legends 1.2.103716 - Remote Stack Buffer Overflow Vulnerability *** --------------------------------------------- Summary: Rayman Legends is a 2013 platform game developed by Ubisoft Montpellier and published by Ubisoft. ... Desc: The vulnerability is caused due to a memset() boundary error in the processing of incoming data thru raw socket connections on TCP port 1001, which can be exploited to cause a stack based buffer overflow by sending a long string of bytes on the second connection. Successful exploitation could allow execution of arbitrary code on the affected node. --------------------------------------------- http://www.exploit-db.com/exploits/33804 *** Forensik-Tool soll iCloud-Backups ohne Passwort herunterladen können *** --------------------------------------------- Elcomsoft hat angekündigt, dass sein "Phone Password Breaker" Authentifizierungstokens von Rechnern auslesen kann, mit denen sich Ermittler dann Zugang zu iCloud-Daten eines Verdächtigen verschaffen können. Dessen Passwort sei nicht mehr nötig. --------------------------------------------- http://www.heise.de/security/meldung/Forensik-Tool-soll-iCloud-Backups-ohne… *** When Vulnerabilities are Exploited: the Timing of First Known Exploits for Remote Code Execution Vulnerabilities *** --------------------------------------------- One of the questions I get asked from time to time is about the days of risk between the time that a vulnerability is disclosed and when we first see active exploitation of it; i.e. how long do organizations have to deploy the update before active attacks are going to happen? Trustworthy Computing's Security Science team published new data that helps put the timing of exploitation into perspective, in the recently released Microsoft Security Intelligence Report volume 16. --------------------------------------------- http://blogs.technet.com/b/security/archive/2014/06/17/when-vulnerabilities…

1 0

Tageszusammenfassung - Dienstag 17-06-2014
by Daily end-of-shift report 17 Jun '14

17 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-06-2014 18:00 − Dienstag 17-06-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Malicious Web-based Java applet generating tool spotted in the wild *** --------------------------------------------- Despite the prevalence of Web based client-side exploitation tools as the cybercrime ecosystem's primary infection vector, in a series of blog posts, we've been emphasizing on the emergence of managed/hosted/DIY malicious Java applet generating tools/platforms, highlighting the existence of a growing market segment relying on 'visual social engineering' vectors for the purpose of tricking end users into executing malicious/rogue/fake Java applets, ultimately joining a --------------------------------------------- http://www.webroot.com/blog/2014/06/16/malicious-web-based-java-applet-gene… *** Cisco ASA WebVPN Information Disclosure Vulnerability *** --------------------------------------------- CVE ID: CVE-2014-2151 ... A vulnerability in the WebVPN portal of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, remote attacker to view sensitive information from the affected system. The vulnerability is due to improper input validation in the WebVPN portal. An attacker could exploit this vulnerability by providing a crafted JavaScript file to an authenticated WebVPN user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Security Advisory-Heap Overflow Vulnerability in Huawei eSap Platform *** --------------------------------------------- Huawei eSap software platform has four heap overflow vulnerabilities. Huawei products that have used this platform are affected. When receiving some special malformed packets, such devices access heap memory that is beyond the valid range and cause unexpected restart of the devices. If an attacker keeps sending such malformed packets, the devices will repeatedly restart, causing a denial of service (DoS) attack (Vulnerability ID: HWPSIRT-2014-0111). Huawei has provided fixed versions. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM AIX ntpd Query Function Lets Remote Users Conduct Amplified Denial of Service Attacks *** --------------------------------------------- A vulnerability was reported in IBM AIX. A remote user can conduct amplified denial of service attacks. A remote user can exploit an administrative query function in ntpd to amplify distributed denial of service (DDoS) attacks against other sites. --------------------------------------------- http://www.securitytracker.com/id/1030433 *** Hacking the Java Debug Wire Protocol - or - 'How I met your Java debugger' *** --------------------------------------------- In this post, I will explain the Java Debug Wire Protocol (JDWP) and why it is interesting from a pentester's point of view. I will cover some JDWP internals and how to use them to perform code execution, resulting in a reliable and universal exploitation script. ... As a matter of fact, JDWP is used quite a lot in the Java application world. Pentesters might, however, not see it that often when performing remote assessments as firewalls would (and should) mostly block the port it is --------------------------------------------- http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.ht… *** CVE-2014-4049 php: heap-based buffer overflow in DNS TXT record parsing *** --------------------------------------------- A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query. --------------------------------------------- https://bugzilla.redhat.com/show_bug.cgi?id=1108447 *** SLocker Android Ransomware Communicates Via Tor And SMS *** --------------------------------------------- A little over two weeks ago, we found a new family of Android ransomware: SLocker.We have no evidence that SLocker is related to Koler, the most recently discovered Android ransomware. It does however carry through on the threat Koler made. Unlike Koler - which pretended to, but didnt actually encrypt files - SLocker will actually scan the devices SD card for specific file types: When the SLocker app is launched, it encrypts these files and then displays a ransom message:The message --------------------------------------------- http://www.f-secure.com/weblog/archives/00002716.html *** Microsoft dichtet OneDrive-Links ab *** --------------------------------------------- In der Dokument-Freigabe von Microsofts Cloud-Speicher klaffte ein Loch, das es Angreifern erlaubt hätte, unbefugten Zugriff auf Dokumente zu erhalten. Microsoft hat die Lücke nun geschlossen, altere Freigabe-URLs könnten aber noch verwundbar sein. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-dichtet-OneDrive-Links-ab-22… *** Technology sites "riskier" than illegal sites in 2013, according to Symantec data *** --------------------------------------------- The 'riskiest' pages to visit in 2013 were technology websites, according to data from users of Norton Web Safe, which monitors billions of traffic requests and millions of software downloads per day. --------------------------------------------- http://www.scmagazine.com/technology-sites-riskier-than-illegal-sites-in-20… *** Popular HTTPS Sites Still Vulnerable to OpenSSL Connection Hijacking Attack *** --------------------------------------------- Some of the Internets most visited websites that encrypt data with the SSL protocol are still susceptible to a recently announced vulnerability that could allow attackers to intercept and decrypt connections. --------------------------------------------- http://www.cio.com/article/754250/Popular_HTTPS_Sites_Still_Vulnerable_to_O… *** Researchers Outline Spammers Business Ecosystem *** --------------------------------------------- An anonymous reader writes A team of researchers at the UC Santa Barbara and RWTH Aachen presented new findings on the relationship of spam actors [abstract; full paper here] at the ACM Symposium on Information, Computer and Communications Security. This presents the first end-to-end analysis of the spam delivery ecosystem including: harvesters crawl the web and compile email lists, botmasters infect and operate botnets, and spammers rent botnets and buy email lists to run spam campaigns. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-AKpHVGH5us/story01.htm

1 0

Tageszusammenfassung - Montag 16-06-2014
by Daily end-of-shift report 16 Jun '14

16 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-06-2014 18:00 − Montag 16-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** BlackEnergy Rootkit, Sort of *** --------------------------------------------- A sample of the BlackEnergy family was recently uploaded to VirusTotal from Ukraine. The family is allegedly the same malware used in the cyber attack against Georgia in 2008. The malware provides attackers full access to their infected hosts. Check out SecureWorks detailed analysis from 2010 for more information about the family.The new sample is not much of a rootkit anymore, in the sense that it no longer hides files, .. --------------------------------------------- http://www.f-secure.com/weblog/archives/00002715.html *** Vorinstallierter Trojaner auf chinesischem S4-Klon gefunden *** --------------------------------------------- Spionagesoftware liest sensible Daten aus und lässt Gerät zu Wanze umfunktionieren. --------------------------------------------- http://derstandard.at/2000002023277 *** Hinweis für Debian-Benutzer bei OpenSSL Upgrade *** --------------------------------------------- Hinweis für Debian-Benutzer bei OpenSSL Upgrade6. Juni 2014Again, Openssl was the centre of patching in the last two days. While Debian was quick to release a patched version, it seems like Debian forgot to restart some services which link against openssl (libssl) get restarted.Here is how you can check with services use .. --------------------------------------------- http://www.cert.at/services/blog/20140606123624-1163.html *** Ruling Raises Stakes for Cyberheist Victims *** --------------------------------------------- A Missouri firm that unsuccessfully sued its bank to recover $440,000 stolen in a 2010 cyberheist may now be on the hook to cover the financial institutions legal fees, an appeals court has ruled. Legal experts say the decision is likely to discourage future victims from pursuing such cases. --------------------------------------------- http://krebsonsecurity.com/2014/06/ruling-raises-stakes-for-cyberheist-vict… *** BruteForce-Angriffe auf wp-login.php abwehren *** --------------------------------------------- Gegenwärtig werden verstärkt "BruteForce"-Attacken auf WordPress-Blogs gefahren. Auch wir registrieren eine Zunahme solcher Angriffe. [...] Im nachfolgenden zeigen wir Ihnen wie Sie den Erfolg solcher Angriffe eindämmen können. --------------------------------------------- http://blog.initiative-s.de/2013/04/bruteforce-angriffe-auf-wp-login-php-ab… *** One-third of cyber attacks take hours to detect *** --------------------------------------------- More than one-third of cyber attacks take hours to detect. Even more alarming, resolving breaches takes days, weeks, and in some cases, even .. --------------------------------------------- http://www.net-security.org/secworld.php?id=17005 *** Ende-zu-Ende-Verschlüsselung für BlackBerry Messenger *** --------------------------------------------- Der BlackBerry Messenger erhält mit BBM Protected eine Ende-zu-Ende-Verschlüsselung, zunächst nur im verschärften Regulated-Modus ohne BlackBerry Balance oder Android- und iOS-Clients. --------------------------------------------- http://www.heise.de/security/meldung/Ende-zu-Ende-Verschluesselung-fuer-Bla… *** Deutscher Nachfolger für TrueCrypt angekündigt *** --------------------------------------------- Das aus nicht ganz geklärten Gründen eingestellte Open-Source-Verschlüsselungs-Projekt TrueCrypt hat einen neuen Anwärter auf seine Nachfolge. Die angekündigte Software hat ihren direkten Ursprung in TrueCrypt. --------------------------------------------- http://www.heise.de/ix/meldung/Deutscher-Nachfolger-fuer-TrueCrypt-angekuen… *** Towelroot knackt Android in Sekunden *** --------------------------------------------- Geohot hat überraschend ein Tool herausgebracht, das fast alle Android-Geräte rooten können soll. In einem ersten Test funktionierte das erstaunlich gut. Er demonstriert damit aber auch eine fatale Sicherheitslücke. --------------------------------------------- http://www.heise.de/security/meldung/Towelroot-knackt-Android-in-Sekunden-2… *** Multiple vulnerabilities in Openfiler *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93764 http://xforce.iss.net/xforce/xfdb/93763 http://xforce.iss.net/xforce/xfdb/93762 http://xforce.iss.net/xforce/xfdb/93761 *** Bugtraq: [SE-2014-01] Security vulnerabilities in Oracle Database Java VM *** --------------------------------------------- http://www.securityfocus.com/archive/1/532433 *** Asterisk MixMonitor Lets Remote Authenticated Users Execute Arbitrary Shell Commands *** --------------------------------------------- http://www.securitytracker.com/id/1030426 *** PostgreSQL 8.4.1 Denial Of Service Integer Overflow *** --------------------------------------------- PostgreSQL is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied data before... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060082 *** PowerDNS in default configuration is vulnerable to DoS attack *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060083

1 0

Tageszusammenfassung - Freitag 13-06-2014
by Daily end-of-shift report 13 Jun '14

13 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-06-2014 18:00 − Freitag 13-06-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Microsoft zieht die "Secure Boot"-Bremse *** --------------------------------------------- Mit einem Update für Windows 8, Server 2012, 8.1 und Server 2012 R2 installiert Microsoft neue Schlüssel-Datenbanken, die den Start einiger UEFI-Module blockieren. --------------------------------------------- http://www.heise.de/security/meldung/Microsoft-zieht-die-Secure-Boot-Bremse… *** Setting HoneyTraps with ModSecurity: Adding Fake Hidden Form Fields *** --------------------------------------------- This blog post continues with the topic of setting "HoneyTraps" within your web applications to catch attackers. Please review the previous posts for more examples: Project Honeypot Integration Unused Web Ports Adding Fake robots.txt Entries Adding Fake HTML Comments This blog post will discuss Recipe 3-4: Adding Fake Hidden Form Fields from my book "Web Application Defenders Cookbook: Battling Hackers and Protecting Users". Recipe 3-4: Adding Fake Hidden Form Fields --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/btSzvx21q3s/setting-ho… *** Hacker claims PayPal loophole generates FREE MONEY *** --------------------------------------------- Convicted hacker comes good with fraudster flowchart A PayPal loophole can be exploited to earn free cash according to a convicted former NASA hacker turned white hat. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/06/13/hacker_clai… *** You have no SQL inj--... sorry, NoSQL injections in your application *** --------------------------------------------- Everyone knows about SQL injections. They are classic, first widely publicized by Rain Forest Puppy, and still widely prevalent today (hint: don't interpolate query string params with SQL). But who cares? SQL injections are so ten years ago. I want to talk about a vulnerability I hadn't run into before that I recently had a lot of fun exploiting. It was a NoSQL injection. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/06/12/you-have-… *** Banking malware using Windows to block anti-malware apps *** --------------------------------------------- BKDR_VAWTRAK is using Software Restriction Policies to restrict security software. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/s0xxmloC9XA/ *** Mergers and Acquisitions: When Two Companies and APT Groups Come Together *** --------------------------------------------- With Apple's purchase of Beats, Pfizer's failed bids for AstraZeneca, and financial experts pointing to a rally in the M&A market, the last month was a busy one for mergers and acquisitions. Of course, when we first see headlines of... --------------------------------------------- http://www.fireeye.com/blog/technical/targeted-attack/2014/06/mergers-and-a… *** Microsofts Juni-Patches können Office-2013-Installation zerstören *** --------------------------------------------- Die Office-2013-Patches vom 11. Juni bereiten mitunter größere Probleme und können dazu führen, sich die Office-Programme nicht mehr starten lassen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Microsofts-Juni-Patches-koennen-Offi… *** How iOS 8 Will Affect the Security of iPhones and iPads *** --------------------------------------------- Apple's mobile OS has been enhanced, but is it more secure? --------------------------------------------- http://www.symantec.com/connect/blogs/how-ios-8-will-affect-security-iphone… *** Stratfor-Hack: Geheimer Bericht stellt gravierende Sicherheitslücken fest *** --------------------------------------------- Eine Untersuchung nach dem Einbruch auf die Stratfor-Server durch die Gruppe Antisec hat ergeben: Das Unternehmen hat wichtigste Sicherheitsmaßnahmen nicht beachtet. --------------------------------------------- http://www.golem.de/news/stratfor-hack-geheimer-bericht-stellt-gravierende-… *** CloudFlare offers free DDoS protection to public interest websites *** --------------------------------------------- A project launched by CloudFlare, a provider of website performance and security services, allows organizations engaged in news gathering, civil society and political or artistic speech to use the companys distributed denial-of-service (DDoS) protection technology for free.The goal of the project, dubbed Galileo, is to protect freedom of expression on the Web by helping sites with public interest information from being censored through online attacks, according to the San Francisco-based --------------------------------------------- http://www.csoonline.com/article/2363382/cloudflare-offers-free-ddos-protec… *** ISC Patches Critical DoS Vulnerability in BIND *** --------------------------------------------- A critical, remotely exploitable bug in some BIND domain name system (DNS) servers could cause a denial of service situation and trigger them to crash. --------------------------------------------- http://threatpost.com/isc-patches-critical-dos-vulnerability-in-bind/106653 *** CVE-2014-3859: BIND named can crash due to a defect in EDNS printing processing *** --------------------------------------------- A specially crafted query sent to a BIND nameserver can cause it to crash with a REQUIRE assertion error. --------------------------------------------- https://kb.isc.org/article/AA-01166/74/CVE-2014-3859:-BIND-named-can-crash-… *** IBM Security Bulletin: IBM Algo One - cryptographic key information discovery (CVE-2014-0076) *** --------------------------------------------- Under certain circumstances, a local attacker could discover cryptographic key information from IBM Algo One. CVE(s): CVE-2014-0076 Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21675765 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL *** --------------------------------------------- Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL CVE(s): CVE-2010-5298 Affected product(s) and affected version(s): AIX 5.3, 6.1 and 7.1 VIOS 2.X Refer to the following reference URLs for remediation and additional vulnerability details: Source Bulletin: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory8.asc X-Force Database: http://xforce.iss.net/xforce/xfdb/92632 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/race_condition_in_the… *** IBM Security Advisory for AIX *** --------------------------------------------- AIX OpenSSL SSL/TLS Man In The Middle (MITM) vulnerability AIX OpenSSL DTLS recursion flaw AIX OpenSSL DTLS invalid fragment vulnerability AIX OpenSSL SSL_MODE_RELEASE_BUFFERS NULL pointer dereference AIX OpenSSL Anonymous ECDH denial of service --------------------------------------------- http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc *** Cisco Autonomic Networking Infrastructure Overwrite Vulnerability *** --------------------------------------------- CVE-2014-3290 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-2958 apt *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2958 *** DSA-2957 mediawiki *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2957 *** VMSA-2014-0006.1 *** --------------------------------------------- VMware product updates address OpenSSL security vulnerabilities --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0006.html *** Yealink VoIP Phones XSS / CRLF Injection *** --------------------------------------------- Topic: Yealink VoIP Phones XSS / CRLF Injection Risk: Low Text:I. ADVISORY CVE-2014-3427 CRLF Injection in Yealink VoIP Phones CVE-2014-3428 XSS vulnerabilities in Yealink VoIP Phones ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060079 *** SSA-963338 (Last Update 2014-06-13): Multiple Buffer Overflows in UPnP Interface of OZW and OZS Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Bugtraq: AST-2014-005: Remote Crash in PJSIP Channel Drivers Publish/Subscribe Framework *** --------------------------------------------- http://www.securityfocus.com/archive/1/532414 *** Bugtraq: AST-2014-007: Exhaustion of Allowed Concurrent HTTP Connections *** --------------------------------------------- http://www.securityfocus.com/archive/1/532415 *** HPSBUX03046 SSRT101590 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS), Code Execution, Security Restriction Bypass, Disclosure of Information, or Unauthorized Access *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS), execute code, bypass security restrictions, disclose information, or allow unauthorized access. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Donnerstag 12-06-2014
by Daily end-of-shift report 12 Jun '14

12 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-06-2014 18:00 − Donnerstag 12-06-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Weekly Metasploit Update: Meterpreter Madness *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/06/11/weekly-me… *** MSRT June 2014 - Necurs *** --------------------------------------------- This month we added Win32/Necurs to the Microsoft Malicious Software Removal Tool (MSRT). In a previous blog about Necurs I outlined the familys prevalence and the techniques it uses to execute its payload. In this blog, I will discuss the Necurs rootkit components Trojan:WinNT/Necurs.A and Trojan:Win64/Necurs.A in greater depth. These Necurs rootkit components are sophisticated drivers that try to block security products during every stage of Windows startup. It's important to note that... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/06/10/msrt-june-2014-necurs.as… *** Gmail Bug Could Have Exposed Every User's Address *** --------------------------------------------- Security tester Oren Hafif says that he found and helped fix a bug in Googles Gmail service that could have been used to extract millions of Gmail addresses, if not all of them, in a matter of days or weeks. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/3b66e7a5/sc/4/l/0L0Swired0N0C20A1… *** Small businesses running cloud-based POS software hit with unique POSCLOUD malware *** --------------------------------------------- Researchers with IntelCrawler have identified a unique type of malware, known as POSCLOUD, which targets cloud-based point-of-sale software. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/PLQgnJ1-_Mc/ *** Yahoo Toolbar triggers XSS in Google, other popular services, researcher finds *** --------------------------------------------- A researcher discovered that Yahoo Toolbar triggers XSS in highly popular services, which could enable an attacker to hijack accounts. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/rM026xMWg8U/ *** Feedly and Evernote Hit by DDoS Attacks, Extortion Demands *** --------------------------------------------- Yesterday, the most popular RSS reader Feedly was down as a result of a large scale distributed-denial-of service (DDoS) attack carried by the cybercriminals to extort money. On Wednesday, the Feedly was temporarily unavailable for its users. Feedly posted details of the attack at 5:00 AM ET on its blog saying that they were under a Distributed Denial of Service (DDoS) attack and --------------------------------------------- http://feedproxy.google.com/~r/TheHackersNews/~3/9ZGb8CUzJwg/feedly-and-eve… *** RSS-Dienst: Feedly ist wieder erreichbar *** --------------------------------------------- Nach einem Ausfall von knapp 24 Stunden ist der RSS-Dienst Feedly wieder nutzbar. Kriminelle führten eine DDos-Attacke gegen die Feedly-Server durch und forderten eine Geldzahlung, um den Angriff zu beenden. --------------------------------------------- http://www.golem.de/news/rss-dienst-feedly-ist-wieder-erreichbar-1406-10713… *** Feedly wieder unter DDoS-Beschuss *** --------------------------------------------- Die Cyber-Erpresser, die den Newsreader-Dienst Feedly am MIttwoch lahm gelegt haben, geben offenbar nicht auf. Erneut ist der Dienst nicht erreichbar. --------------------------------------------- http://www.heise.de/security/meldung/Feedly-wieder-unter-DDoS-Beschuss-2220… *** TweetDeck mit Herzfehler *** --------------------------------------------- Durch einen Bug hat der Twitter-Client in Tweets eingebettete JavaScript-Code ausgeführt, wenn daran ein Unicode-Herz angehängt wurde. --------------------------------------------- http://www.heise.de/security/meldung/TweetDeck-mit-Herzfehler-2220478.html *** The Computer Security Threat From Ultrasonic Networks *** --------------------------------------------- KentuckyFC (1144503) writes Security researchers in Germany have demonstrated an entirely new way to attack computer networks and steal information without anybody knowing. The new medium of attack is ultrasonic sound. It relies on software that uses the built-in speakers on a laptop to broadcast at ultrasonic frequencies while nearby laptops listen out for the transmissions and pass them on, a set up known as a mesh network. The team has tested this kind of attack on a set of Lenovo T400... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/1R8EpiBl880/story01.htm *** VMware Patches ESXi Against OpenSSL Flaw, But Many Other Products Still Vulnerable *** --------------------------------------------- While the group of vulnerabilities that the OpenSSL Project patched last week hasn't grown into the kind of mess that the Heartbleed flaw did, the vulnerabilities still affect a huge range of products. Vendors are still making their way through the patching process, and VMware has released an advisory confirming that a long list of... --------------------------------------------- http://threatpost.com/vmware-patches-esxi-against-openssl-flaw-but-many-oth… *** Project Un1c0rn Wants to Be the Google for Lazy Security Flaws *** --------------------------------------------- Following broad security scares like that caused by the Heartbleed bug, it can be frustratingly difficult to find out if a site you use often still has gaping flaws. But a little known community of software developers is trying to change that, by creating a searchable, public index of websites with known security issues. --------------------------------------------- http://motherboard.vice.com/en_ca/read/is-this-website-vulnerable-to-hacker… *** Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20140611-ipv6 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** JSA10628 - 2014-06 Security Bulletin: Junos Pulse Secure Access Service (SSL VPN) and Junos Pulse Access Control Service (UAC): Weak SSL cipher allowed unexpectedly when higher level cipher group is configured (CVE-2014-3812) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10628&actp=RSS *** JSA10631 - 2014-06 Security Bulletin: NetScreen Firewall: DNS lookup issue may cause denial of service (CVE-2014-3813) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10631&actp=RSS *** JSA10632 - 2014-06 Security Bulletin: NetScreen Firewall: Malformed IPv6 packet DoS issue (CVE-2014-3814) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10632&actp=RSS *** JSA10630 - 2014-06 Security Bulletin: Junos WebApp Secure: Local user privilege escalation issue (CVE-2013-2094) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10630&actp=RSS *** SA-CONTRIB-2014-060- Petitions - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-060Project: - Petitions - (third-party distribution)Version: 7.xDate: 2014-June-11Security risk: Less criticalExploitable from: RemoteVulnerability: Cross Site Request ForgeryDescriptionThis distribution enables you to build an application that lets users create and sign petitions.The contained wh_petitions module doesnt sufficiently verify the intent of the user when signing a petition. A malicious user could trick another user into signing a petition they... --------------------------------------------- https://drupal.org/node/2284571 *** SA-CONTRIB-2014-059 - Touch Theme - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-059Project: Touch (third-party module)Version: 7.xDate: 2014-June-11Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross Site ScriptingDescriptionTouch Theme is a light weight theme with modern look and feel.The theme does not sufficiently sanitize theme settings input for Twitter and Facebook username. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer themes".CVE... --------------------------------------------- https://drupal.org/node/2284415 *** Cisco IOS XR ASR 9000 IPv6 Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030400 *** DSA-2956 icinga *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2956 *** DSA-2955 iceweasel *** --------------------------------------------- security update --------------------------------------------- http://www.debian.org/security/2014/dsa-2955 *** Netscape Portable Runtime API Buffer Overflow May Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030404

1 0

Tageszusammenfassung - Mittwoch 11-06-2014
by Daily end-of-shift report 11 Jun '14

11 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-06-2014 18:00 − Mittwoch 11-06-2014 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Microsoft Security Bulletin Summary for June 2014 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for June 2014. With the release of the security bulletins for June 2014, this bulletin summary replaces the bulletin advance notification originally issued June 5, 2014. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-JUN *** Assessing risk for the June 2014 security updates *** --------------------------------------------- Today we released seven security bulletins addressing 66 unique CVEs. Two bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. This table is designed to help you prioritize the deployment of updates appropriately for your environment. Bulletin Most likely attack vector Max Bulletin Severity Max XI Likely first 30 days impact Platform mitigations and key notes MS14-035(Internet Explorer) Victim browses to a malicious --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-ju… *** Android no longer reveals app permission changes in automatic updates *** --------------------------------------------- Change could heighten security risks for users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/KCMtV-_xnqA/ *** May 2014 Cyber Attack Statistics *** --------------------------------------------- As I noticed previously in these pages, looks like attackers are just waiting for the Summer, since the number of events in May has experienced a sensible decreease. The Daily Trend Of Attacks chart shows quite a linear trend with two small peaks around the 15 and 30 May. Overall the activity appears quite limited. --------------------------------------------- http://hackmageddon.com/2014/06/11/may-2014-cyber-attack-statistics/

1 0

Tageszusammenfassung - Dienstag 10-06-2014
by Daily end-of-shift report 10 Jun '14

10 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-06-2014 18:00 − Dienstag 10-06-2014 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Microsoft preps seven fixes, two critical, for Patch Tuesday release *** --------------------------------------------- The critical patches will remediate remote code execute (RCE) bugs in Windows, IE, Office and Microsoft Lync. --------------------------------------------- http://www.scmagazine.com/microsoft-preps-seven-fixes-two-critical-for-patc… *** Microsoft will Uralt-Lücke bei Internet Explorer ausmerzen *** --------------------------------------------- Sieben Update-Pakete für kommenden Patchday angekündigt - Support für XP fraglich --------------------------------------------- http://derstandard.at/2000001862657 *** Security updates available for Adobe Flash Player (APSB14-16) *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player 13.0.0.214 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.359 and earlier versions for Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe recommends users update their product installations to the latest versions:... --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb14-16.html *** Microsoft Fixing Windows 8 Flaws, But Leaving Them In Windows 7 *** --------------------------------------------- mask.of.sanity sends this news from El Reg: "Microsoft has left Windows 7 exposed by only applying security upgrades to its newest operating systems. Researchers found the gaps after they scanned 900 Windows libraries using a custom diffing tool and uncovered a variety of security functions that were updated in Windows 8 but not in 7. They said the shortcoming could lead to the discovery of zero day vulnerabilities. The missing safe functions were part of Microsofts dedicated libraries... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Rz2E0q7KOps/story01.htm *** Coordinated malware eradication nears launch *** --------------------------------------------- Good news: the coordinated malware eradication preparations are almost done. We have held several roundtable meetings at industry events around the world, and the last two are scheduled for June and July. We had insightful conversations with a diverse group of experts from across the antimalware industry. The ideas have converged into a shared vision of how we'll work together to put pressure on the malware ecosystem. I am excited for the first coordinated eradication campaigns to... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/06/04/coordinated-malware-erad… *** Routersicherheit: Fritzbox sucht automatisch nach Firmware-Updates *** --------------------------------------------- AVM hat eine Konsequenz aus der schweren Sicherheitslücke seiner Router gezogen. Eine Laborversion ermöglicht nun ein automatisches Update der Firmware. --------------------------------------------- http://www.golem.de/news/routersicherheit-fritzbox-sucht-automatisch-nach-f… *** Backstage with the Gameover Botnet Hijackers *** --------------------------------------------- When youre planning to rob the Russian cyber mob, youd better be sure that you have the element of surprise, that you can make a clean getaway, and that you understand how your target is going to respond. Todays column features an interview with two security experts who helped plan and execute this weeks global, collaborative effort to hijack the Gameover Zeus botnet, an extremely resilient and sophisticated crime machine that helped an elite group of thieves steal more than $100 million from --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/QUb7mFxjXlc/ *** Extracting the payload from a CVE-2014-1761 RTF document *** --------------------------------------------- Background In March Microsoft published security advisory 2953095, detailing a remote code execution vulnerability in multiple versions of Microsoft Office (CVE-2014-1761). A Technet blog was released at the same time which contained excellent information on how a typical malicious document would be constructed. NCC Group's Cyber Defence Operations team used the information in the Technet blog to identify a malicious document within our malware zoo that exploited this vulnerability which... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/06/extracting-the-payload-from-a-cve-… *** Weve Set Up a One-Click Test For GameOver ZeuS *** --------------------------------------------- Today weve published a new, quick way to check if your computer is infected by GameOver ZeuS (GOZ). Last week the GOZ botnet was disrupted by international law enforcement together with industry partners, including ourselves.It is of critical importance to realize GOZ was disrupted - not dismantled. Its not technically impossible for the botnet administrators to reclaim control in the near future. More than one million computers are infected by GOZ, time is of the essence.To assist with... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002712.html *** Cyber-Kriminalität kostet laut Studie weltweit über 400 Mrd. Dollar *** --------------------------------------------- In Österreich beträgt der Schaden 0,41 Prozent des Bruttoinlandsproduktes --------------------------------------------- http://derstandard.at/2000001878950 *** "Red Button" Attack Could Compromise Some Smart TVs *** --------------------------------------------- A vulnerability in an emerging interactive television standard could open up number of smart TVs to untraceable drive-by attacks. --------------------------------------------- http://threatpost.com/red-button-attack-could-compromise-some-smart-tvs/106… *** Chrome OS leaks data to Google before switching on a VPN, says GCHQ *** --------------------------------------------- UK spy-base wing in new advice for BlackBerry, and Google OSes The sexy-named Communications Electronics Security Group (CESG) - the bit of GCHQ that helps Brits protect secrets from foreign spies (never mind GCHQ) - has issued new advice for securing BlackBerry OS 10, Android and Chrome OS 32. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/06/10/security_gu… *** Zeus Alternative "Pandemiya" Emerges in Cybercrime Underground *** --------------------------------------------- Pandemiya has all the capabilities that are typical among banking Trojans, such as injecting fake elements into websites, capturing screenshots of the users computer screen, and encrypting its communications with the control panel. What sets Pandemiya apart from all other banking Trojans is the fact that it has been written from scratch without sharing any source code with Zeus, Fleyder said. --------------------------------------------- https://www.securityweek.com/zeus-alternative-pandemiya-emerges-cybercrime-… *** iOS Malware Does Exist *** --------------------------------------------- Before somebody asks me (again) whether there are any iOS malware or not, I decided to consolidate the information for you. --------------------------------------------- https://blog.fortinet.com/iOS-malware-do-exist/ *** Cisco Wireless LAN Controller Cisco Discovery Protocol Denial of Service Vulnerability *** --------------------------------------------- CVE-2014-3291 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Citrix Security Advisory for OpenSSL Vulnerabilities (June 2014) *** --------------------------------------------- Severity: High Overview The OpenSSL security advisory released on the 5 th of June 2014 disclosed six security vulnerabilities in this open source component; these are described below: --------------------------------------------- http://support.citrix.com/article/CTX140876 *** SAP Hard-Coded Credentials *** --------------------------------------------- Topic: SAP Hard-Coded Credentials Risk: Medium Text: Onapsis Security Advisories:Multiple Hard-coded Usernames (CWE-798) have been found and patched in a variety of SAP componen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060046 *** MediaWiki Input Validation Flaw in Special:PasswordReset Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030364 *** VU#758382: Unauthorized modification of UEFI variables in UEFI systems *** --------------------------------------------- Vulnerability Note VU#758382 Unauthorized modification of UEFI variables in UEFI systems Original Release date: 09 Jun 2014 | Last revised: 09 Jun 2014 Overview Certain firmware implementations may not correctly protect and validate information contained in certain UEFI variables. Exploitation of such vulnerabilities could potentially lead to bypass of security features and/or denial of service for the platform. Description According to Corey Kallenberg, Xeno Kovah, John Butterworth, and Sam... --------------------------------------------- http://www.kb.cert.org/vuls/id/758382 *** Cisco Unified Communications Manager Java Interface SQL Injection Vulnerability *** --------------------------------------------- CVE-2014-3287 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** WebEx Meeting Server Sensitive Information Disclosure Vulnerability *** --------------------------------------------- CVE-2014-3294 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Vuln: Cisco Wireless LAN Controller CVE-2014-3291 Denial of Service Vulnerability *** --------------------------------------------- Cisco Wireless LAN Controller CVE-2014-3291 Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/67926 *** IBM Security Bulletin: Denial of Service attack possible on Cúram instances using Apache Commons FileUpload (CVE-2014-0050) *** --------------------------------------------- A version of Apache Commons FileUpload shipped with Cúram is vulnerable to a denial of service attack. CVE(s): CVE-2014-0050 Affected product(s) and affected version(s): Cúram Social Program Management All products are affected when running code releases 4.5 SP10, 5.0, 5.2, 5.2 SP1, 5.2 SP4, 5.2 SP4 DE, 5.2 SP5, 5.2 SP6, 6.0 SP2, 6.0.3.0, 6.0.4.0, 6.0.4.3, 6.0.4.4, 6.0.4.5, 6.0.5.2, 6.0.5.3, 6.0.5.4. Refer to the following reference URLs for remediation and additional... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** WebTitan: Multiple critical vulnerabilities *** --------------------------------------------- product: WebTitan vulnerable version: 4.01 (Build 68) fixed version: 4.04 impact: critical ... 1) SQL Injection 2) Remote command execution 3) Path traversal 4) Unprotected Access --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014…

1 0

Tageszusammenfassung - Freitag 6-06-2014
by Daily end-of-shift report 06 Jun '14

06 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-06-2014 18:00 − Freitag 06-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Hunderttausende Server über Fernwartungsprotokolle angreifbar *** --------------------------------------------- Das Fernwartungsprotokoll IPMI, mit dem Server über die Firmware des Motherboards gewartet werden können, hat gravierende Sicherheitslücken. Forscher haben bei einem Scan des Internets haufenweise Server gefunden, die angreifbar sind. --------------------------------------------- http://www.heise.de/security/meldung/Hunderttausende-Server-ueber-Fernwartu… *** Microsoft Security Bulletin Advance Notification for June 2014 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-JUN *** Microsoft to Patch Critical Internet Explorer Zero-Day Vulnerability Next Tuesday *** --------------------------------------------- Today Microsoft has released its Advance Notification for the month of June 2014 Patch Tuesday releasing seven security Bulletins, which will address several vulnerabilities in its products, out of which two are marked critical and rest are important in severity. This Tuesday, Microsoft will issue Security Updates to .. --------------------------------------------- http://thehackernews.com/2014/06/microsoft-to-patch-critical-internet.html *** Linux Kernel futex privilege escalation *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93593 *** Linux: Kernel-Bug erlaubt Sandbox-Ausbrüche *** --------------------------------------------- Ein Fehler im Futex-Code von Linux erlaubt Nutzern vollen Zugriff auf den Kernel. Damit liesse sich etwa aus der Chrome-Sandbox ausbrechen. Patches sind bereits verfügbar. --------------------------------------------- http://www.golem.de/news/linux-kernel-bug-erlaubt-sandbox-ausbrueche-1406-1… *** Bugtraq: ESA-2014-046: EMC Documentum Content Server Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/532311 *** Hacking Apple ID? *** --------------------------------------------- The many announcements at Apple's 2014 Worldwide Developers Conference (WWDC) this week was welcome news to the throngs of Apple developers and enthusiasts. It was also welcome news for another group of people with less than clean motives: cybercriminals. Last week we got a concrete example of how some .. --------------------------------------------- blog.trendmicro.com/trendlabs-security-intelligence/hacking-apple-id/ *** Daktronics Vanguard Hardcoded Credentials (Update A) *** --------------------------------------------- http://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-155-01A *** Noch mehr Herzbluten bei OpenSSL *** --------------------------------------------- Der Verursacher der Heartbleed-Lücke hat weiteren Code zum Open-Source-Projekt beigetragen. Und auch der hat offensichtliche Sicherheitslücken. --------------------------------------------- http://www.heise.de/security/meldung/Noch-mehr-Herzbluten-bei-OpenSSL-22172… *** Phish or legit - Can you tell the difference? *** --------------------------------------------- I recently received two emails, sent to two different addresses and both from different senders. The first email was allegedly from Apple and was sent to my work account. The second email was allegedly from the Bank of Montreal (BMO) and was sent to my personal account. Both were unsolicited and were asking me to click on links contained in the body of the email. --------------------------------------------- http://nakedsecurity.sophos.com/2014/06/06/phish-or-legit-can-you-tell-the-… *** Web-Browser: Neues History-Leck schwer zu stopfen *** --------------------------------------------- Eine Javascript-Funktion erlaubt es indirekt, die Ladezeiten einer Webseite zu messen. Damit lässt sich herausfinden, ob ein Besucher bestimmte Links schon einmal aufgerufen hat. --------------------------------------------- http://www.heise.de/security/meldung/Web-Browser-Neues-History-Leck-schwer-… *** [2014-06-06] Multiple critical vulnerabilities in WebTitan *** --------------------------------------------- Multiple critical security vulnerabilities have been identified in the WebTitan web filtering solution. Exploiting these vulnerabilities potential attackers could take control over the entire appliance. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014…

1 0

Tageszusammenfassung - Donnerstag 5-06-2014
by Daily end-of-shift report 05 Jun '14

05 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-06-2014 18:00 − Donnerstag 05-06-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Peek Inside a Professional Carding Shop *** --------------------------------------------- Over the past year, Ive spent a great deal of time trolling a variety of underground stores that sell "dumps" -- street slang for stolen credit card data that buyers can use to counterfeit new cards and go shopping in big-box stores for high-dollar merchandise that can be resold quickly for cash. --------------------------------------------- http://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/ *** Daktronics Vanguard Hardcoded Credentials *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report of a hardcoded password vulnerability affecting Daktronics Vanguard highway notification sign configuration software. According to this report, the vulnerability is a hardcoded password that could allow unauthorized access to the highway sign. --------------------------------------------- http://ics-cert.us-cert.gov//alerts/ICS-ALERT-14-155-01 *** New Apple operating systems bring security mysteries *** --------------------------------------------- Apples march toward seamless integration between the Mac, iPhone and iPad worries some security experts who say companies may find it more difficult to prevent data leakage on the devices.On Monday, Apple introduced Handoff, a feature in upcoming iOS 8 and Mac OS X Yosemite that would let a person start a task on one device and complete it on another. For example, an email started on the Mac could be completed later on the iPad. --------------------------------------------- http://www.csoonline.com/article/2360161/data-protection/new-apple-operatin… *** Android-Trojaner verschlüsselt Speicherkarte *** --------------------------------------------- Ein weiter Malware-Trend erreicht Android: Nach den Erpressungstrojanern, die das Gerät sperren, gibt es nun auch einen Schädling, der das digitale Hab und Gut seines Opfers verschlüsselt. Für die Entschlüsselung der Daten verlangen die Ganoven Geld. --------------------------------------------- http://www.heise.de/security/meldung/Android-Trojaner-verschluesselt-Speich… *** Sicherheitsprobleme mit OpenSSL *** --------------------------------------------- Das OpenSSL-Projekt hat eine Warnung bezüglich mehrerer sicherheitsrelevanter Schwachstellen veröffentlicht. Es besteht die Möglichkeit von Remote Code Execution, Denial Of Service und Man-in-the-middle Attacken. Diese können sowohl OpenSSL Clients als auch Server betreffen. --------------------------------------------- http://cert.at/warnings/all/20140605.html *** IBM Security Bulletin: Vulnerability which could allow for unauthorized access to an IBM API Management topology *** --------------------------------------------- There is a vulnerability which could allow for unauthorized access to an IBM API Management topology, when a user secures APIs with basic authentication CVE(s): CVE-2014-3036 Affected product(s) and affected version(s): IBM API Management V3.0.0.0 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** They're ba-ack: Browser-sniffing ghosts return to haunt Chrome, IE, Firefox *** --------------------------------------------- Privacy threat that allows websites to know what sites youve viewed is revived. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/mZ97m15Wo_M/ *** Security-Experten isolierten über 2 Millionen Gameover-Bots *** --------------------------------------------- Im Rahmen der Aktionen gegen das Botnetz Gameover Zeus musste ein riesige Peer-to-Peer-Netz ausgeschaltet werden. Über zwei Millionen infizierte Rechner mussten dazu manipuliert werden. --------------------------------------------- http://www.heise.de/security/meldung/Security-Experten-isolierten-ueber-2-M… *** Security Notice-Statement About the CSRF Vulnerability on Multiple Huawei 3G Wi-Fi Devices *** --------------------------------------------- Huawei has noticed that several websites reported the CSRF vulnerability on Huawei E355, E5331, E303, B593 3G Mobile Wi-Fi Devices. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Webfwlog - Firewall Log Analyzer *** --------------------------------------------- Webfwlog is a flexible web-based firewall log analyzer and reporting tool. It supports standard system logs for linux, FreeBSD, OpenBSD, NetBSD, Solaris, Irix, OS X, etc. as well as Windows XP. Supported log file formats are netfilter, ipfilter, ipfw, ipchains and Windows XP. ... You can sort a report with a single click, 'drill-down' on the reports all the way to the packet level, and save your reports for later use. --------------------------------------------- http://hack-tools.blackploit.com/2014/06/webfwlog-firewall-log-analyzer.html

1 0

Tageszusammenfassung - Mittwoch 4-06-2014
by Daily end-of-shift report 04 Jun '14

04 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-06-2014 18:00 − Mittwoch 04-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** GameOver Zeus Takedown Shows Good Early Returns *** --------------------------------------------- The effect of the takedown of the GameOver Zeus botnet this week has been immediate and significant. Researchers who track the activity of the peer-to-peer botnet's activity say that the volume of packets being sent out by infected machines has dropped to almost zero. On Friday, the FBI and Europol, .. --------------------------------------------- http://threatpost.com/gameover-zeus-takedown-shows-good-early-returns/106429 *** Phishing Tale: An Analysis of an Email Phishing Scam *** --------------------------------------------- Phishing scams are always bad news, and in light of the Google Drive scam that made the rounds again last week, we thought we'd tell the story of some spam that was delivered into my own inbox because even security researchers, .. --------------------------------------------- http://blog.sucuri.net/2014/06/phishing-tale-an-analysis-of-an-email-phishi… *** Making end-to-end encryption easier to use *** --------------------------------------------- While end-to-end encryption tools like PGP and GnuPG have been around for a long time, they require a great deal of technical know-how and manual effort to use. To help make this kind of encryption a bit easier, we're releasing code for a new Chrome extension that uses OpenPGP, an open standard supported by many existing encryption tools. However, .. --------------------------------------------- http://googleonlinesecurity.blogspot.co.at/2014/06/making-end-to-end-encryp… *** The Best Of Both Worlds - Soraya *** --------------------------------------------- Arbor Networks' ASERT has recently discovered a new malware family that combines several techniques to steal payment card information. Dubbed Soraya, meaning 'rich', this malware uses memory scraping techniques similar to those found in Dexter to target point-of-sale terminals. Soraya also intercepts form data sent from web browsers, similar to the Zeus family of malware. Neither of these two techniques are new, but we have not seen them used together in the same piece of malware. --------------------------------------------- http://www.arbornetworks.com/asert/2014/06/the-best-of-both-worlds-soraya/ *** COPA-DATA Improper Input Validation *** --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-154-01 *** DSA-2945 chkrootkit *** --------------------------------------------- http://www.debian.org/security/2014/dsa-2945 *** Adobe Acrobat / Reader XI-X AcroBroker Sandbox Bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060030 *** FreeBSD PAM Policy Parser Remote Authentication Bypass *** --------------------------------------------- http://www.securitytracker.com/id/1030330

1 0

Tageszusammenfassung - Dienstag 3-06-2014
by Daily end-of-shift report 03 Jun '14

03 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-06-2014 18:00 − Dienstag 03-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Energy Bill Spam Campaign Serves Up New Crypto Malware *** --------------------------------------------- Everyone hates getting bills, and with each new one it seems like the amount due just keeps getting higher and higher. However, Symantec recently discovered an energy bill currently being .. --------------------------------------------- http://www.symantec.com/connect/blogs/energy-bill-spam-campaign-serves-new-… *** Writing robust Yara detection rules for Heartbleed *** --------------------------------------------- This blog walks through the methodology and process of writing robust Yara rules to detect either Heartbleed vulnerable OpenSSL statically linked or shared libraries which omit version information. Although Yara is designed for pattern matching and typically used by malware researchers we'll show how we can also use it to detect vulnerable binaries. --------------------------------------------- https://www.nccgroup.com/en/blog/2014/06/writing-robust-yara-detection-rule… *** Huawei-Router lassen sich aus dem Internet kapern *** --------------------------------------------- Eine Reihe von Schwachstellen in zwei Mobilnetz-Routern von Huawei ermglichen es, die Geräte aus dem Internet zu kapern. Eine der Schwachstellen hatte Huawei schon einmal geschlossen - offensichtlich nicht gründlich genug. --------------------------------------------- http://www.heise.de/security/meldung/Huawei-Router-lassen-sich-aus-dem-Inte… *** TYPO3-EXT-SA-2014-009: Cross-Site Scripting in news *** --------------------------------------------- It has been discovered that the extension "News system" (news) is susceptible to Cross-Site Scripting --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** Vulnerabilities in All in One SEO Pack Wordpress Plugin Put Millions of Sites At Risk *** --------------------------------------------- Multiple Serious vulnerabilities have been discovered in the most famous "All In One SEO Pack" plugin for WordPress, that put millions of Wordpress websites at risk. --------------------------------------------- https://thehackernews.com/2014/05/vulnerabilities-in-all-in-one-seo-pack.ht… *** (0Day) Rocket Servergraph Admin Center for TSM userRequest save_server_groups Command Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Rocket Servergraph Admin Center for Tivoli Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the userRequest servlet. It is possible to inject arbitrary operating system commands when the servlet .. --------------------------------------------- http://zerodayinitiative.com/advisories/ZDI-14-166/ *** Using nmap to scan for DDOS reflectors *** --------------------------------------------- As we have seen in past diaries about reflective DDOS attacks they are certainly the flavor of the day. US-CERT claims there are several UDP based protocols that are potential attack vectors. In my experience the most prevalent ones are DNS, NTP, SNMP, and CharGEN. Assuming you have permission; Is there an easy way to do good data gathering for these ports on your network? Yes, as a matter of a fact it can be done in one simple nmap command. --------------------------------------------- https://isc.sans.edu/diary/Using+nmap+to+scan+for+DDOS+reflectors/18193 *** dbus-glib pam_fprintd Local Root Exploit *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060009 *** DCMTK Privilege Escalation *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060011

1 0

Tageszusammenfassung - Montag 2-06-2014
by Daily end-of-shift report 02 Jun '14

02 Jun '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-05-2014 18:00 − Montag 02-06-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Play Store ermöglicht Apps mehr Rechte ohne Nachfragen *** --------------------------------------------- Der Play Store wird mal wieder renoviert, doch dabei sägt Google auch an tragenden Wänden. In der aktuellen Version werden App-Berechtigungen in Gruppen zusammengefasst, weshalb neue Rechte nicht immer genehmigt werden müssen. --------------------------------------------- http://www.heise.de/security/meldung/Play-Store-ermoeglicht-Apps-mehr-Recht… *** CVE-2014-2120 - A Tale of Cisco ASA 'Zero-Day' *** --------------------------------------------- A few months ago I was trying to PoC a known cross-site scripting vulnerability in the Cisco ASA WebVPN portal (CVE-2013-3414) for inclusion in the TrustKeeper Scan Engine. I tried a number of different techniques on multiple different ASA versions/branches and I simply could not tease out a viable PoC. At my wits end, I .. --------------------------------------------- http://blog.spiderlabs.com/2014/05/cve-2014-2120-a-tale-of-cisco-asa-0-day.… *** FTP Zugangsdaten kompromittiert *** --------------------------------------------- Wie Heise berichtet, hat das BSI/CERT-Bund viele Provider informiert, dass Zugangsdaten zu FTP-Accounts gefunden wurden.Das betraf nicht nur Deutschland; die gleiche Quelle hat auch andere CERTs und Sicherheitsteams informiert. Wir bekamen die gleichen Daten wie unsere deutschen Kollegen, .. --------------------------------------------- http://www.cert.at/services/blog/20140530100952-1151.html *** WordPress iMember360is 3.9.001 XSS Disclosure Code Execution *** --------------------------------------------- WordPress iMember360is 3.9.001 XSS Disclosure Code Execution --------------------------------------------- http://cxsecurity.com/issue/WLB-2014060001 *** Security: Heartbleed in WLAN-Routern gefunden *** --------------------------------------------- Der Heartbleed-Fehler ist offenbar noch in zahlreichen WLAN-Routern vorhanden, genauer im Authentifizierungsprotokoll EAP. Das berichtet der Sicherheitsexperte Luis Grangeia. --------------------------------------------- http://www.golem.de/news/security-heartbleed-in-wlan-routern-gefunden-1406-… *** CVE-2014-3466 gnutls: insufficient session id length check in _gnutls_read_server_hello (GNUTLS-SA-2014-3) *** --------------------------------------------- A flaw was found in the way GnuTLS parsed session ids from Server Hello packets of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code. --------------------------------------------- https://bugzilla.redhat.com/show_bug.cgi?id=1101932 *** DSA-2943-1 php5 -- security update *** --------------------------------------------- Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development .. --------------------------------------------- https://www.debian.org/security/2014/dsa-2943 *** Huawei: SMS verschicken auf fremde Kosten *** --------------------------------------------- Eine Sicherheitslücke in einem weit verbreiteten USB-UMTS-Stick ermöglicht es Angreifern, mit einer manipulierten Webseite SMS zu verschicken. Ein Update gibt es bisher nicht. (UMTS, Technologie) --------------------------------------------- http://www.golem.de/news/huawei-sms-verschicken-auf-fremde-kosten-1406-1068… *** 'Operation Tovar' Targets 'Gameover' ZeuS Botnet, CryptoLocker Scourge *** --------------------------------------------- The U.S. Justice Department is expected to announce today an international law enforcement operation to seize control over the Gameover ZeuS botnet, a sprawling network of hacked Microsoft Windows computers that currently infects an estimated 500,000 to 1 million compromised systems globally. Experts say PCs infected with Gameover are being harvested for sensitive financial and personal data, .. --------------------------------------------- http://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-bo…

1 0

Tageszusammenfassung - Freitag 30-05-2014
by Daily end-of-shift report 30 May '14

30 May '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-05-2014 18:00 − Freitag 30-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Third-Party Auth Token Theft: The Big Picture *** --------------------------------------------- Nothing sets the technical journalists abuzz like the prospect of a catastrophic, Internet-wide vulnerability. Fresh off the very legitimate excitement over Heartbleed, some media outlets were hoping for a new scoop with "Covert Redirections". Spoiler alert: there's no catastrophe. For those that haven't heard, this started with a paper and series of blog posts by Wang Jing. Wang describes an attack against websites that use third-party authentication services and are... --------------------------------------------- http://blog.spiderlabs.com/2014/05/third-party_auth_token_theft_the_big_pic… *** Ende von Truecrypt: Entwickler hat angeblich Interesse verloren *** --------------------------------------------- Einer der Entwickler von Truecrypt hat sich angeblich zu Wort gemeldet und die Beweggründe für das plötzliche Aus erklärt: Man habe das Interesse verloren. Einer Weiterentwicklung durch die Community steht er demnach kritisch gegenüber. --------------------------------------------- http://www.heise.de/security/meldung/Ende-von-Truecrypt-Entwickler-hat-ange… *** Hintergrund: Truecrypt ist unsicher - und jetzt? *** --------------------------------------------- Sollten wir jetzt wirklich alle auf Bitlocker umsteigen, wie es die Truecrypt-Entwickler vorschlagen? Einen echten Nachfolger wird es jedenfalls so bald nicht geben - und daran sind nicht zu letzt auch die Truecrypt-Entwickler schuld. --------------------------------------------- http://www.heise.de/security/artikel/Truecrypt-ist-unsicher-und-jetzt-22114… *** ThreadFix v2.1M1 Released *** --------------------------------------------- ThreadFix is a software vulnerability aggregation and management system that reduces the time it takes to fix software vulnerabilities. ThreadFix imports the results from dynamic, static and manual testing to provide a centralized view of software security defects across development teams and applications. ThreadFix is licensed under the Mozilla Public License (MPL) version 2.0. --------------------------------------------- http://www.toolswatch.org/2014/05/threadfix-v2-1m1-released/ *** New Attack Methods Can brick Systems, Defeat Secure Boot, Researchers Say *** --------------------------------------------- IDG News Service - The Secure Boot security mechanism of the Unified Extensible Firmware Interface (UEFI) can be bypassed on around half of computers that have the feature enabled in order to install bootkits, according to a security researcher. --------------------------------------------- http://www.cio.com/article/753439/New_Attack_Methods_Can_39_brick_39_System… *** Thieves Planted Malware to Hack ATMs *** --------------------------------------------- A recent ATM skimming attack in which thieves used a specialized device to physically insert malicious software into a cash machine may be a harbinger of more sophisticated scams to come. --------------------------------------------- http://krebsonsecurity.com/2014/05/thieves-planted-malware-to-hack-atms/ *** Heartbleed-Bug: OpenSSL bekommt Security-Audit und zwei Festangestellte *** --------------------------------------------- Die Linux-Foundation sammelt Geld für Kern-Infrastruktur wie OpenSSL und gibt nun erste Pläne bekannt. Beraten sollen das Projekt Linux-Kernel-Hacker und Bruce Schneier sowie Eben Moglen. --------------------------------------------- http://www.golem.de/news/heartbleed-bug-openssl-bekommt-security-audit-und-… *** When Networks Turn Hostile *** --------------------------------------------- We've previously discussed how difficult it is to safely connect to networks when on the go. This is particularly true on vacations and holidays, where the availability of Internet access is one of the most important factors when looking for a place to stay. In fact, many holiday lodges and hotels today have made Wi-Fi access an... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CL6K-SnbQJQ/ *** Triangle MicroWorks Uncontrolled Resource Consumption *** --------------------------------------------- Adam Crain of Automatak and Chris Sistrunk of Mandiant have identified an uncontrolled resource consumption vulnerability in Triangle MicroWorks products and third-party components. Triangle MicroWorks has produced an update that mitigates this vulnerability. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-149-01 *** Cogent Datahub Vulnerabilities *** --------------------------------------------- Independent researcher Alain Homewood has identified four vulnerabilities in the Cogent Real-Time Systems DataHub application. Cogent Real-Time Systems has produced a new version that mitigates three of the four identified vulnerabilities; they have recommended a mitigation for the unresolved vulnerability. The researcher has tested the new version to validate that it resolves three of the four vulnerabilities. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02 *** VMSA-2014-0005 *** --------------------------------------------- VMware Workstation, Player, Fusion, and ESXi patches address a guest privilege escalation --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0005.html *** VMSA-2014-0002.3 *** --------------------------------------------- VMware vSphere updates to third party libraries --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2014-0002.html *** ElasticSearch Dynamic Script Arbitrary Java Execution *** --------------------------------------------- Topic: ElasticSearch Dynamic Script Arbitrary Java Execution Risk: High Text:## # This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-fr... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050154 *** VU#325636: Huawei E303 contains a cross-site request forgery vulnerability *** --------------------------------------------- Vulnerability Note VU#325636 Huawei E303 contains a cross-site request forgery vulnerability Original Release date: 30 May 2014 | Last revised: 30 May 2014 Overview The built-in web interface of Huawei E303 devices contains a cross-site request forgery vulnerability. Description Huawei E303 wireless broadband modems include a web interface for administration and additional services. The web interface allows users to send and receive SMS messages using the connected cellular network. CWE-352: --------------------------------------------- http://www.kb.cert.org/vuls/id/325636 *** VU#124908: Dell ML6000 and Quantum Scalar i500 tape backup system command injection vulnerability *** --------------------------------------------- Vulnerability Note VU#124908 Dell ML6000 and Quantum Scalar i500 tape backup system command injection vulnerability Original Release date: 30 May 2014 | Last revised: 30 May 2014 Overview Dell ML6000 and Quantum Scalar i500 tape backup system contain a command injection vulnerability. Description CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)Dells and Quantums advisories state the following:The tape librarys remote user interface... --------------------------------------------- http://www.kb.cert.org/vuls/id/124908

1 0

Tageszusammenfassung - Mittwoch 28-05-2014
by Daily end-of-shift report 28 May '14

28 May '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-05-2014 18:00 − Mittwoch 28-05-2014 18:00 Handler: Christian Wojner Co-Handler: Stephan Richter *** Spam Campaign Spreading Malware Disguised as HeartBleed Bug Virus Removal Tool *** --------------------------------------------- At the beginning of April, a vulnerability in the OpenSSL cryptography library, also known as the Heartbleed bug, made headlines around the world.read more --------------------------------------------- http://www.symantec.com/connect/blogs/spam-campaign-spreading-malware-disgu… *** [2014-05-28] Root Backdoor & Unauthenticated access to voice recordings in NICE Recording eXpress *** --------------------------------------------- Attackers are able to completely compromise the voice recording / surveillance solution "NICE Recording eXpress" as they can gain access to the system and database level and listen to recorded calls without prior authentication or exploit a root backdoor account. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Apple Ransomware Targeting iCloud Users Hits Australia *** --------------------------------------------- A handful of iPhone, iPad and Mac users, largely confined to Australia, awoke Tuesday to discover their devices had been taken hostage by ransomware. --------------------------------------------- http://threatpost.com/apple-ransomware-targeting-icloud-users-hits-australi… *** iPhone-"Entführung" per Fernzugriff: Apple betont, dass iCloud sicher ist *** --------------------------------------------- In einem Statement heißt es, die derzeit in Australien die Runde machenden Erpressungsversuche, bei denen Angreifer Apple-Hardware aus der Ferne sperren, hätten nichts mit Sicherheitsproblemen in der iCloud zu tun. Schlechte Passwörter seien schuld. --------------------------------------------- http://www.heise.de/security/meldung/iPhone-Entfuehrung-per-Fernzugriff-App… *** Bugtraq: LSE Leading Security Experts GmbH - LSE-2014-05-21 - Check_MK - Arbitrary File Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/532224 *** Kali-Linux: Pentesting-Stick mit Verschlüsselung und Notfallknopf *** --------------------------------------------- Wer Kali Linux auf einen USB-Stick installiert, kann die Datenpartition mit Version 1.0.7 endlich verschlüsseln. Das schützt brisante Daten vor neugierigen Blicken. Darüber hinaus gibt es einen Selbstzerstörungs-Mechanismus. --------------------------------------------- http://www.heise.de/security/meldung/Kali-Linux-Pentesting-Stick-mit-Versch… Next End-of-Shift report on 2015-05-30

1 0

Tageszusammenfassung - Dienstag 27-05-2014
by Daily end-of-shift report 27 May '14

27 May '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-05-2014 18:00 − Dienstag 27-05-2014 18:00 Handler: Christian Wojner Co-Handler: Stephan Richter *** Mac OS X: VirusTotal veröffentlicht Uploader *** --------------------------------------------- Der von Google aufgekaufte Viren-Scan-Dienst hat ein Tool veröffentlicht, mit dem Mac-Nutzer suspekte Dateien und Programme zur Prüfung hochladen können. VirusTotal erhofft sich tieferen Einblick in OS-X-Schadsoftware. --------------------------------------------- http://www.heise.de/security/meldung/Mac-OS-X-VirusTotal-veroeffentlicht-Up… *** Malicious Redirections to Porn Websites *** --------------------------------------------- The past week has brought about a large number of cases where compromised websites had hidden redirections to porn injected into their code. All the infections had a similar pattern where they only targeted mobile devices. They are highly conditional as well making it challenging for webmasters to detect. Lets take a minute to explain... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/aMQhA3--dfg/website-infection… *** Unsafe cookies leave WordPress accounts open to hijacking, 2-factor bypass *** --------------------------------------------- Accounts accessed from Wi-Fi hotspots and other unsecured networks are wide open. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/yKbonlXYDrk/ *** Youve got Mail! But someone else is reading it in Outlook for Android *** --------------------------------------------- Researchers say Redmond forgot to encrypt messages stored on Android SD cards Researchers have plucked privacy holes in Microsofts Outlook Android app that expose user data when user security setting screws were not tightened. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/27/prying_priv… *** Mt. Gox: Bitcoin-Preise angeblich durch Bots manipuliert *** --------------------------------------------- Neue Spekulation um die insolvente Bitcoin-Börse Mt. Gox: Laut einer Analyse sollen Bots die Preise an der Börse getrieben und mindestens rund 570.000 Bitcoins aufgekauft haben. --------------------------------------------- http://www.heise.de/newsticker/meldung/Mt-Gox-Bitcoin-Preise-angeblich-durc… *** Fernwartungsfunktion: Onlineganoven entführen Macs und iPhones *** --------------------------------------------- Mit "Find My iPhone" und "Find My Mac" können Nutzer geklaute Hardware über ihre Apple ID sperren. Gerät diese in falsche Hände, können das aber auch Erpresser. In Australien sollen solche "Entführungen" gerade öfter vorkommen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Fernwartungsfunktion-Onlineganoven-e… *** cPanel cgiemail Character Injection Flaw Lets Remote Users Send SPAM via the System *** --------------------------------------------- A remote user can inject newline characters via certain parameters to modify email fields and send SPAM to arbitrary destination addresses via cgiemail. --------------------------------------------- http://www.securitytracker.com/id/1030287 *** Avast-Forum fällt Hackerangriff zum Opfer *** --------------------------------------------- Unbekannten gelang es, Nutzernamen, E-Mail-Adressen und verschlüsselte Passwörter von 350.000 Nutzern zu kopieren. Der Firmenchef des Antivirenherstellers hält es für möglich, dass die Hacker an Klartext-Passwörter kommen. --------------------------------------------- http://www.heise.de/security/meldung/Avast-Forum-faellt-Hackerangriff-zum-O… *** Multiple Vulnerabilities in TYPO3 CMS *** --------------------------------------------- It has been discovered that TYPO3 CMS is vulnerable to Cross-Site Scripting, Insecure Unserialize, Improper Session Invalidation, Authentication Bypass, Information Disclosure and Host Spoofing. --------------------------------------------- http://typo3.org/news/article/multiple-vulnerabilities-in-typo3-cms-1/ *** Amazons AWS bietet Verschlüsselung auf Blockebene *** --------------------------------------------- Nutzer von Amazons Cloud-Angeboten können ihre auf virtuellen Laufwerken gespeicherten Daten verschlüsseln. --------------------------------------------- http://www.heise.de/security/meldung/Amazons-AWS-bietet-Verschluesselung-au… *** Top 10 Windows Server Security Misconfigurations *** --------------------------------------------- Introduction According to Wikipedia, 32.6% of servers on the Internet are running Microsoft Windows. The purpose of this article is to create awareness among system administrators and managers about some of the areas on which it is important to focus when implementing a new Windows build or when hardening the security of an existing server. The Survey One of the activities of the @NCCGroupInfosec team is to perform build reviews on clients' systems, looking for any misconfigurations that... --------------------------------------------- https://www.nccgroup.com/en/blog/2014/05/top-10-windows-server-security-mis… *** Zeus-Carberp Hybrid Trojan Pops Up *** --------------------------------------------- Researchers have discovered a new hybrid Trojan that combines elements of two of the more notorious crimeware strains of the last few years: Zeus and Carberp. It's not uncommon for malware writers to steal bits and pieces of code from one another, but both Zeus and Carberp were once exclusively private tools, but the source... --------------------------------------------- http://threatpost.com/zeus-carberp-hybrid-trojan-pops-up/106283

1 0

Tageszusammenfassung - Montag 26-05-2014
by Daily end-of-shift report 26 May '14

26 May '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-05-2014 18:00 − Montag 26-05-2014 18:00 Handler: Christian Wojner Co-Handler: Stephan Richter *** Long run compromised accounting data based type of managed iframe-ing service spotted in the wild *** --------------------------------------------- In a cybercrime ecosystem dominated by DIY (do-it-yourself) malware/botnet generating releases, populating multiple market segments on a systematic basis, cybercriminals continue seeking new ways to acquire and efficiently monetize fraudulently obtained accounting data, for the purpose of achieving a positive ROI (Return on Investment) on their fraudulent operations. In a series of blog posts, we've been detailing the existence of commercially available server-based malicious... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/HvVQ_hnfyXQ/ *** RAT in a jar: A phishing campaign using Unrecom + IOC's *** --------------------------------------------- In the past two weeks, we have observed an increase in attack activity against the U.S. state and local government, technology, advisory services, health, and financial sectors through phishing emails with what appears to be a remote access trojan (RAT) known as Unrecom. The attack has also been observed against the financial sector in Saudi Arabia and Russia. --------------------------------------------- http://www.fidelissecurity.com/webfm_send/382 (PDF) http://www.fidelissecurity.com/files/files/FTA1013_RAT_in_a_jar_IOCs.xlsx *** Hackers claim MitM attack enables iCloud security feature bypass *** --------------------------------------------- Hackers claim that the iOS Activation Lock, a feature that makes it harder for crooks to use and sell lost or stolen Apple mobile devices, can be bypassed in a MitM attack. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/kJtdTS-KQeU/ *** US may block visas for Chinese hackers attending DefCon, Black Hat *** --------------------------------------------- Organizers of those conferences skeptical of the move to exclude Chinese nationals. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/Cny7FF2H8rU/ *** Warnung vor Update-Hack für Windows XP *** --------------------------------------------- Mit einem Trick kann man dem Update-Server von Microsoft vormachen, man betreibe eine Spezialversion von Windows XP, die noch bis April 2019 mit Updates versorgt wird. Das ist allerdings nicht ganz ungefährlich. --------------------------------------------- http://www.heise.de/newsticker/meldung/Warnung-vor-Update-Hack-fuer-Windows…

1 0

Tageszusammenfassung - Freitag 23-05-2014
by Daily end-of-shift report 23 May '14

23 May '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-05-2014 18:00 − Freitag 23-05-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** (0Day) SAP Sybase ESP Remote Code Execution Vulnerabilities *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-142/ http://www.zerodayinitiative.com/advisories/ZDI-14-143/ http://www.zerodayinitiative.com/advisories/ZDI-14-144/ http://www.zerodayinitiative.com/advisories/ZDI-14-145/ http://www.zerodayinitiative.com/advisories/ZDI-14-146/ http://www.zerodayinitiative.com/advisories/ZDI-14-147/ http://www.zerodayinitiative.com/advisories/ZDI-14-148/ ... http://www.zerodayinitiative.com/advisories/ZDI-14-158/ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-14-141/ *** SBA Research: Heartbleed-Betroffene in Österreich beheben Problem unzureichend *** --------------------------------------------- Das österreichische COMET-Kompetenzzentrum SBA Research hat aufgrund der aktuellen Bedrohungslage durch die Heartbleed-Schwachstelle eine Analyse über die Behebung der Schwachstelle durchgeführt. Dabei ist es für die Administratoren der betroffenen Server nicht nur wichtig, die OpenSSL-Bibliothek zu aktualisieren, sondern auch, Benutzer der Seite zur Passwort-Anderung aufzufordern und die SSL-Zertifikate inklusive kryptografischer Schlüssel zu erneuern. --------------------------------------------- http://www.sba-research.org/2014/05/23/heartbleedpresse/ *** Multiple D-Link Routers Cross Site Scripting / Information Disclosure *** --------------------------------------------- Topic: Multiple D-Link Routers Cross Site Scripting / Information Disclosure Risk: High Text:The following five D-Link model routers suffer from several vulnerabilities including Clear Text Storage of Passwords, Cross S... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050127 *** Redmond reversal pops IE8 patch in pipeline *** --------------------------------------------- Bug not so bad, Microsoft says, but if you wont upgrade well get around to it eventually Microsoft has announced it will now patch a zero day Internet Explorer 8 vulnerability seven months after it was reported. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/23/redmond_rev… *** Cookie-Klau durch zwei Monate alte eBay-Lücke *** --------------------------------------------- In Auktionen eingeschleuste Skripte können Sitzungs-Cookies angreifen oder auch Malware verbreiten. eBay ist offenbar seit zwei Monaten informiert, hat das Problem aber bislang nicht behoben. --------------------------------------------- http://www.heise.de/newsticker/meldung/Cookie-Klau-durch-zwei-Monate-alte-e…

1 0

Tageszusammenfassung - Donnerstag 22-05-2014
by Daily end-of-shift report 22 May '14

22 May '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-05-2014 18:00 − Donnerstag 22-05-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** 145 Millionen Kunden von eBay-Hack betroffen *** --------------------------------------------- Unbekannte haben einen grossen Teil der Kundendatenbank der Online-Handelsplattform kopiert. Während der Druck auf eBay steigt, gibt es erste Hinweise, dass die gestohlenen Daten schon missbraucht werden. --------------------------------------------- http://www.heise.de/security/meldung/145-Millionen-Kunden-von-eBay-Hack-bet… *** Multiple Vulnerabilities in Cisco NX-OS-Based Products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SA-CONTRIB-2014-057 - Password policy - General logic error *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-057, Project: Password policy (third-party module), Version: 7, Security risk: Moderately critical; This module enables you to define password policies with various constraints on allowable user passwords. The history constraint, when enabled, disallows a users password from being changed to match a specified number of their .. --------------------------------------------- https://drupal.org/node/2271839 *** SA-CONTRIB-2014-055 - Require Login - Access bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-055, Project: Require Login (third-party module), Version: 7, Security risk: Moderately critical; This module enables you to restrict access to a site for all non-authenticated users.The module does not protect the front page, thereby exposing any sensitive information on the front page to anonymous users.This vulnerability is mitigated by the fact that private/sensitive information .. --------------------------------------------- https://drupal.org/node/2271837 *** SA-CONTRIB-2014-056 - Commerce Moneris - Information Disclosure *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-056, Project: Commerce Moneris (third-party module), Version: 7, Security risk: Critical; Commerce Moneris is a payment module that integrates the Moneris payment system with Drupal Commerce.The module stores credit card data in a commerce order object unnecessarily for the purpose of passing the credit card information to the payment gateway. The credit card information is .. --------------------------------------------- https://drupal.org/node/2271823 *** SA-CONTRIB-2014-054 - Views - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-054, Project: Views (third-party module), Version: 7, Security risk: Moderately critical; The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented.The module doesnt sufficiently check handler access when returning the list of handlers .. --------------------------------------------- https://drupal.org/node/2271809 *** IBM Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM WebSphere Portal *** --------------------------------------------- IBM WebSphere Application Server is shipped as a component of IBM WebSphere Portal. Information about a security vulnerabilities affecting IBM WebSphere Application Server has been published in security bulletins. CVE(s): CVE-2014-0963 Affected product(s) .. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** A peek inside a newly launched all-in-one E-shop for cybercrime-friendly services *** --------------------------------------------- Cybercriminals continue diversifying their portfolios of standardized fraudulent services, in an attempt to efficiently monetize their malicious 'know-how', further contributing to the growth of the cybercrime ecosystem. In a series of blog posts highlighting the emergence of the boutique cybercrime-friendly E-shops, we've been emphasizing on the over-supply of compromised/stolen accounting data, efficiently aggregated .. --------------------------------------------- http://www.webroot.com/blog/2014/05/21/peek-inside-newly-launched-one-e-sho… *** Redmond wont fix IE 8 zero day, says harden up instead *** --------------------------------------------- Phishers get fresh code execution bait Microsoft has decided not to fix an IE 8 zero-day first identified seven months ago, instead telling users to harden up their browsers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/22/ie_8_zero_d… *** Hacker wollen Apples iOS-Aktivierungssperre geknackt haben *** --------------------------------------------- Eine Team aus den Niederlanden und Marokko behauptet, die in iCloud integrierte Funktion ausgehebelt zu haben, mit der Apple die Nutzung geklauter iPhones und iPads verhindern will - angeblich per Man-in-the-Middle-Angriff. Bislang fehlen viele Details. --------------------------------------------- http://www.heise.de/security/meldung/Hacker-wollen-Apples-iOS-Aktivierungss… *** Multiple Vulnerabilities in TYPO3 CMS *** --------------------------------------------- It has been discovered that TYPO3 CMS is vulnerable to Cross-Site Scripting, Insecure Unserialize, Improper Session Invalidation, Authentication Bypass, Information Disclosure and Host Spoofing. Vulnerability Types: Cross-Site Scripting, Insecure Unserialize, Improper Session Invalidation, Authentication Bypass, Information Disclosure and Host Spoofing. Overall Severity: Medium --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-s… *** XML Schema, DTD, and Entity Attacks - A Compendium of Known Techniques *** --------------------------------------------- The eXtensible Markup Language (XML) is an extremely pervasive technology used in countless software projects. ... When used incorrectly, certain aspects of these document definition and validation features can lead to security vulnerabilities in applications that use XML. This document attempts to provide an up to date reference on these attacks, enumerating all publicly known techniques applicable to the most popular XML parsers in use while exploring a few novel attacks as well. --------------------------------------------- http://packetstorm.interhost.co.il/papers/general/XMLDTDEntityAttacks.pdf

1 0

Tageszusammenfassung - Mittwoch 21-05-2014
by Daily end-of-shift report 21 May '14

21 May '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-05-2014 18:00 − Mittwoch 21-05-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Ebay: Kundendaten bei Hackerangriff gestohlen *** --------------------------------------------- Hacker hatten im Februar und März Zugriff auf Kundendaten --------------------------------------------- http://derstandard.at/2000001422781 *** Enterprises Still Lax on Privileged User Access Controls *** --------------------------------------------- The results of a survey commissioned by Raytheon demonstrate that enterprises still dont have a firm grasp on privileged users and their activities on corporate networks. --------------------------------------------- http://threatpost.com/enterprises-still-lax-on-privileged-user-access-contr… *** iBanking: Exploiting the Full Potential of Android Malware *** --------------------------------------------- http://www.symantec.com/connect/blogs/ibanking-exploiting-full-potential-an… *** World's most pricey trojan is veritable Swiss Army knife targeting Android *** --------------------------------------------- Malicious Android app contains remote bugging, SMS interception, and much more. --------------------------------------------- http://arstechnica.com/security/2014/05/worlds-most-pricey-trojan-is-verita… *** Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B) *** --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-105-03B *** [2014-05-21] Multiple critical vulnerabilities in CoSoSys Endpoint Protector 4 *** --------------------------------------------- The software CoSoSys Endpoint Protector is affected by critical, unauthenticated SQL injection vulnerabilities and backdoor accounts. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Security App of the Week: WP Security Audit Log *** --------------------------------------------- WP Security Audit Log is a WordPress plugin that logs all the actions and events that take place under your website's hood. The plugin is useful not only in case of a data breach, but also for preventing one. The plugin is designed to generate a security alert when certain actions are detected. For instance, .. --------------------------------------------- http://news.softpedia.com/news/Security-App-of-the-Week-WP-Security-Audit-L… *** Hook Analyser 3.1 - Malware Analysis Tool *** --------------------------------------------- Hook Analyser is a freeware application which allows an investigator/analyst to perform 'static & run-time / dynamic' analysis of suspicious applications, also gather (analyse & co-related) threat intelligence related information (or data) from various open sources on the Internet. --------------------------------------------- http://www.darknet.org.uk/2014/05/hook-analyser-3-1-malware-analysis-tool/ *** Why You Should Ditch Adobe Shockwave *** --------------------------------------------- This author has long advised computer users who have Adobes Shockwave Player installed to junk the product, mainly on the basis that few sites actually require the browser plugin, and because its yet another plugin that requires constant updating. But I was positively shocked this week to learn that this software introduces a far more pernicious problem: Turns out, .. --------------------------------------------- http://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/ *** LSE stellt Authentifizierungs-Tool LinOTP unter Open-Source-Lizenz *** --------------------------------------------- Das Authentifizierungswerkzeug LinOTP steht ab sofort als Open-Source-Produkt zum kostenlosen Download bereit. --------------------------------------------- http://www.heise.de/newsticker/meldung/LSE-stellt-Authentifizierungs-Tool-L… *** Bugs in your TV *** --------------------------------------------- Introduction As part of our research into the Internet of Things (IoT), we were asked to look at the current generation of Smart TVs and see whether they posed any new issues when used in the home or office. In particular, the latest sets come with built-in cameras (for use with video chat applications, .. --------------------------------------------- https://www.nccgroup.com/en/blog/2014/05/bugs-in-your-tv/

1 0

Tageszusammenfassung - Dienstag 20-05-2014
by Daily end-of-shift report 20 May '14

20 May '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-05-2014 18:00 − Dienstag 20-05-2014 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Blackshades - Coordinated Takedown Leads to Multiple Arrests *** --------------------------------------------- The FBI, Europol and several other law enforcement agencies have arrested dozens of individuals suspected of cybercriminal activity centered around the malware known as Blackshades (a.k.a. W32.Shadesrat).read more --------------------------------------------- http://www.symantec.com/connect/blogs/blackshades-coordinated-takedown-lead… *** Moodle Bugs Permit Cross-Site Scripting, Cross-Site Request Forgery, and Information Disclosure Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1030256 *** Silverlight finally becomes popular ... with criminals *** --------------------------------------------- Angler exploit kit targets Redmonds unloved rich web application kit Silverlight has become a choice target for VXers who are foisting nasty exploit kits on users through hacked advertising networks. --------------------------------------------- http://www.theregister.co.uk/2014/05/20/silverlight_attacks_spike_as_ekers_… *** Cisco IOS XR DHCPv6 Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1030259 *** Bugtraq: t214: Call for Papers 2014 (Helsinki / Finland) *** --------------------------------------------- http://www.securityfocus.com/archive/1/532154 *** When Networks Turn Hostile *** --------------------------------------------- We've previously discussed how difficult it is to safely connect to networks when on the go. This is particularly true on vacations and holidays, where the availability of Internet access is one of the most important factors when looking for a place to stay. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/when-networks-tu… *** Cisco IOS Software IPv6 Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20110928-ipv6 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Sicherheitslücke in iTunes: BSI drängt zum Update *** --------------------------------------------- Eine durch Apples Medien-Software verursachte Schwachstelle erlaubt lokalen Nutzern einen umfassenden Zugriff auf andere Benutzerkonten - das Bundesamt für Sicherheit in der Informationstechnik rät zum Update auf Version 11.2.1. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-iTunes-BSI-draeng…

1 0

Tageszusammenfassung - Montag 19-05-2014
by Daily end-of-shift report 19 May '14

19 May '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-05-2014 18:00 − Montag 19-05-2014 18:00 Handler: Robert Waldner Co-Handler: n/a *** January-April 2014 *** --------------------------------------------- The 'NCCIC/ICS-CERT Monitor' newsletter offers a means of promoting preparedness, information sharing, and collaboration with the 16 critical infrastructure sectors. ICS-CERT accomplishes this on a day-to-day basis through sector briefings, meetings, conferences, and information product releases. This publication highlights recent activities and information products affecting industrial control systems (ICSs), and provides a look ahead at upcoming ICS-related events. --------------------------------------------- http://ics-cert.us-cert.gov//monitors/ICS-MM201404 *** IBM Security Bulletin: Fixes available for vulnerability in Apache Commons FileUpload contained in IBM WebSphere Portal (CVE-2014-0050) *** --------------------------------------------- Fixes available for a denial of service vulnerability in the open source library Apache Commons FileUpload which affects IBM WebSphere Portal. CVE(s): CVE-2014-0050 Affected product(s) and affected version(s): WebSphere Portal 8 WebSphere Portal 7 WebSphere Portal 6.1.x --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** IBM Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with Rational ClearCase *** --------------------------------------------- IBM WebSphere Application Server is shipped as a component of IBM Rational ClearCase. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. CVE(s): CVE-2014-0964 Affected product(s) and affected version(s): IBM Rational ClearCase, CM Server component, release 7.1.x (7.1.0.x, 7.1.1.x, and 7.1.2.x). --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Mozilla gründet "Winter of Security" *** --------------------------------------------- Studenten können bei Mozillas Programm für ihr Studium ein Projekt durchführen, das eine Bedeutung auch außerhalb der Universität hat. Begleitet wird die Arbeit von einem Entwickler. --------------------------------------------- http://www.heise.de/security/meldung/Mozilla-gruendet-Winter-of-Security-21… *** Malvertising Up By Over 200% *** --------------------------------------------- An anonymous reader writes "Online Trust Alliance (OTA) Executive Director and President Craig Spiezle testified before the U.S. Senates Homeland Security and Governmental Affairs Permanent Subcommittee on Investigations, outlining the risks of malicious advertising, and possible solutions to stem the rising tide. According to OTA research, malvertising increased by over 200% in 2013 to over 209,000 incidents, generating over 12.4 billion malicious ad impressions. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/ZUq6VAva50Y/story01.htm *** DDoS Trojans attack Linux *** --------------------------------------------- May 15, 2014 The fallacy that Linux is fully protected against malware thanks to the specific features of its architecture makes life much easier for intruders distributing such software. In May 2014, Doctor Webs security analysts identified and examined a record-high number of Trojans for Linux, a large portion of which is designed to (distributed denial of service) attacks. These programs share common features: first, they carry out DDoS attacks via various protocols, and second, they appear .. --------------------------------------------- http://news.drweb.com/show/?i=5760&lng=en&c=9 *** Security: Datenbank informiert über Identitätsklau *** --------------------------------------------- Eine Datenbank gibt Informationen darüber, ob Passwörter oder Kontodaten eines Nutzers auf einschlägigen Foren zu finden sind. Die vom Hasso-Plattner-Institut bereitgestellten Informationen unterscheiden sich von denen des BSI. --------------------------------------------- http://www.golem.de/news/security-datenbank-informiert-ueber-identitaetskla… *** Cisco ASA Crafter RADIUS Packets Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the implementation of the Remote Authentication Dial-in User Services (RADIUS) code of Cisco ASA Software could allow an authenticated, remote attacker to cause an affected system to reload. The vulnerability is due to insufficient validation of RADIUS packets including crafted attributes. An attacker could exploit this vulnerability by sending crafted RADIUS packets to the affected system. The attacker must know the RADIUS shared secret and inject the crafted packet while a RADIUS exchange is in progress. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Mid-2014 Tech Security Rundown: 5 Current Exploits Worth Knowing About *** --------------------------------------------- Here are just a few of the security threats that have risen to prominence in recent months. ... Rotbrow Mobile Side Channel Leakage IoT Hardware & Software Ad Network Intrusion Out of Harm's Way Besides these exploits, web users must contend with on-going threats like SQL injection and cross-site scripting. --------------------------------------------- http://hackersnewsbulletin.com/2014/05/mid-2014-tech-security-rundown-5-cur… *** Online-Banking: Verstärkte Angriffe auf das mTAN-Verfahren *** --------------------------------------------- Experten warnen vor verstärkten Infektionen mit dem Android-Trojaner FakeToken. Die Software kopiert empfangene SMS, die TANs enthalten. Ganoven können dann das Konto des Opfers leer räumen. --------------------------------------------- http://www.heise.de/security/meldung/Online-Banking-Verstaerkte-Angriffe-au… *** Kryptographie: Schnellerer Algorithmus für das diskrete Logarithmusproblem *** --------------------------------------------- Auf der Eurocrypt-Konferenz ist ein schnellerer Algorithmus für eine spezielle Variante des diskreten Logarithmusproblems vorgestellt worden. Dieses Problem ist die Grundlage zahlreicher kryptographischer Verfahren, doch eine direkte Bedrohung für real eingesetzte Algorithmen gibt es zur Zeit nicht. --------------------------------------------- http://www.golem.de/news/kryptographie-schnellerer-algorithmus-fuer-das-dis…

1 0

Tageszusammenfassung - Freitag 16-05-2014
by Daily end-of-shift report 16 May '14

16 May '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-05-2014 18:00 − Freitag 16-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** CSWorks Software SQL Injection Vulnerability *** --------------------------------------------- Researcher John Leitch, working with HP's Zero Day Initiative (ZDI), has identified an SQL injection vulnerability in CSWorks' CSWorks software framework. CSWorks has produced an updated version that mitigates this vulnerability. This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-135-01 *** Statistik: Verschlüsselter Datenverkehr nimmt zu *** --------------------------------------------- Laut einer Studie steigt seit Beginn der Enthüllungen des Whistleblowsers Edward Snowden der Anteil an SSL-verschlüsselten Verbindungen im Internet. Die Zunahmen in den USA und Europa unterscheiden sich aber. --------------------------------------------- http://www.heise.de/security/meldung/Statistik-Verschluesselter-Datenverkeh… *** Torque 2.5.13 Buffer Overflow *** --------------------------------------------- Topic: Torque 2.5.13 Buffer Overflow Risk: High Text:A buffer overflow exists in versions of TORQUE which can be exploited in order to remotely execute code from an unauthenticated... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050086 *** Apple Releases OS X 10.9.3, Fixes Serious Flaw in iTunes *** --------------------------------------------- Apple has released a new version of OS X Mavericks, which includes all of the security fixes it pushed out last month. OS X 10.9.3 includes the patches for the so-called triple handshake SSL vulnerability, as well as fixes for several remote code-execution vulnerabilities. --------------------------------------------- http://threatpost.com/apple-releases-os-x-10-9-3-fixes-serious-flaw-in-itun… *** Understanding how Fuzzing Relates to a Vulnerability like Heartbleed *** --------------------------------------------- Fuzzing is a security-focused testing technique in which a compiled program is executed so that the attack surface can be tested as it actually runs. The attack surfaces are the components of code that accept user input. Since this is the most vulnerable part of code, it should be rigorously tested with anomalous data. --------------------------------------------- http://labs.bromium.com/2014/05/14/understanding-how-fuzzing-relates-to-a-v… *** iTunes: Apple schließt problematische Lücke in PC-Version *** --------------------------------------------- Das Update 11.2 stopft ein Leck, über das es unter Windows XP SP3 bis 8 möglich war, iTunes-Zugangsdaten zu stehlen. --------------------------------------------- http://www.heise.de/security/meldung/iTunes-Apple-schliesst-problematische-… *** PayPal Fixes Serious Account Hijacking Bug in Manager *** --------------------------------------------- PayPal patched a hole in its Manager functionality this week that could have made it easy for an attacker to hijack an admin's account, change their password and steal their personal information -- not to mention their savings. --------------------------------------------- http://threatpost.com/paypal-fixes-serious-account-hijacking-bug-in-manager…

1 0

Tageszusammenfassung - Donnerstag 15-05-2014
by Daily end-of-shift report 15 May '14

15 May '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-05-2014 18:00 − Donnerstag 15-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** VOBFUS Evolves, Adds Multiple Languages *** --------------------------------------------- VOBFUS malware is known for its polymorphic abilities, which allow for easy generation of new variants. We recently came across one variant that replaces these abilities for one never seen in VOBFUS malware before - the ability to 'speak' .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/vobfus-evolves-a… *** Zeus - Reach Expands With New Webinjects *** --------------------------------------------- The peer-to-peer version of Zeus was especially busy in the first quarter with infections reported by banks in 10 countries that previously had .. --------------------------------------------- http://threatpost.com/zeus-reach-expands-with-new-webinjects/106092 *** Blog: Fake antivirus - attack of the clones *** --------------------------------------------- http://www.securelist.com/en/blog/8221/Fake_antivirus_attack_of_the_clones *** Placebo-Virenschutz jetzt auch für Windows Phone *** --------------------------------------------- Augen auf beim Virenscanner-Kauf: Auch im Windows-Phone-Store wimmelt es nur so von Apps, die rein gar nichts tun - ausser Geld zu kosten. --------------------------------------------- http://www.heise.de/security/meldung/Placebo-Virenschutz-jetzt-auch-fuer-Wi… *** Facebook-Virus schürft verdeckt Kryptomünzen *** --------------------------------------------- Der zuerst in Norwegen aufgetauchte Schadcode verbreitet sich über Facebook-Nachrichten und infiziert seine Opfer, wenn diese eine angehängte Datei öffnen. Ist der Schadcode auf dem System, wird dieses deutlich .. --------------------------------------------- http://www.heise.de/security/meldung/Facebook-Virus-schuerft-verdeckt-Krypt… *** Firms must protect against malicious ads *** --------------------------------------------- The Senate warned Google, Yahoo and other leading technology companies Thursday they need to better protect consumers from hackers exploiting their lucrative online advertising networks or risk new legislation that would force them to do so. --------------------------------------------- http://m.apnews.com/ap/db_15897/contentdetail.htm?contentguid=8dJLuw6G *** Bugtraq: CSRF and Remote Code Execution in EGroupware *** --------------------------------------------- http://www.securityfocus.com/archive/1/532103 *** SSA-839231: Incorrect Certificate Verification in Ruggedcom ROX-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… Multiple vulnerabilities in Juniper products --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10627 http://kb.juniper.net/index?page=content&id=JSA10626 http://kb.juniper.net/index?page=content&id=JSA10625 Multiple vulnerabilities in Drupal third-party-modules --------------------------------------------- https://drupal.org/node/2267539 https://drupal.org/node/2267485 https://drupal.org/node/2267381 https://drupal.org/node/2267481

1 0

Tageszusammenfassung - Mittwoch 14-05-2014
by Daily end-of-shift report 14 May '14

14 May '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-05-2014 18:00 − Mittwoch 14-05-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Microsoft Security Bulletin Summary for May 2014 - Version: 2.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS14-MAY *** Assessing risk for the May 2014 security updates *** --------------------------------------------- Today we released eight security bulletins addressing 13 unique CVEs. Two bulletins have a maximum severity rating of Critical while the other six have a maximum severity rating of Important. The table is designed to help you prioritize the deployment of updates appropriately for your .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2014/05/13/assessing-risk-for-the-ma… *** Operation Saffron Rose *** --------------------------------------------- There is evolution and development underway within Iranian-based hacker groups that coincides with Iran's efforts at controlling political dissent and expanding offensive cyber capabilities. The capabilities of .. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2014/05/operation-sa… *** Yokogawa Multiple Products Vulnerabilities *** --------------------------------------------- http://ics-cert.us-cert.gov//advisories/ICSA-14-133-01 *** DSA-2927 libxfont *** --------------------------------------------- http://www.debian.org/security/2014/dsa-2927 *** WordPress Formidable Forms Remote Code Execution *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050069 *** Patchday: Adobe flickt Flash und Illustrator *** --------------------------------------------- Adobe hat am Mai-Patchday Sicherheitsupdates für Lücken im Flash-Player und in Adobe Illustrator CS6 herausgegeben. Die Updates für beide Programme werden von der Firma als kritisch eingeschätzt. --------------------------------------------- http://www.heise.de/security/meldung/Patchday-Adobe-flickt-Flash-und-Illust… *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player 13.0.0.206 and earlier versions for Windows and Macintosh and Adobe Flash Player 11.2.202.356 and earlier versions for Linux. These updates address vulnerabilities that could .. --------------------------------------------- https://helpx.adobe.com/security/products/flash-player/apsb14-14.html *** Security hotfix available for Adobe Illustrator (CS6) *** --------------------------------------------- Adobe has released a security hotfix for Adobe Illustrator (CS6) for Windows and Macintosh. This hotfix addresses a vulnerability that could be exploited to gain remote code execution on the affected system. Adobe recommends users .. --------------------------------------------- https://helpx.adobe.com/security/products/illustrator/apsb14-11.html *** Heartbleed-Betroffene stecken Kopf in den Sand *** --------------------------------------------- Wer einen Server mit einer für Heartbleed anfälligen OpenSSL-Version betrieben hat, muss damit rechnen, dass seine Private Keys kompromittiert wurden. Trotzdem sind diese in den meisten Fällen immer noch im Einsatz. --------------------------------------------- http://www.heise.de/security/meldung/Heartbleed-Betroffene-stecken-Kopf-in-…

1 0

Tageszusammenfassung - Dienstag 13-05-2014
by Daily end-of-shift report 13 May '14

13 May '14

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-05-2014 18:00 − Dienstag 13-05-2014 18:00 Handler: Alexander Riepl Co-Handler: n/a *** NSA manipuliert per Post versandte US-Netzwerktechnik *** --------------------------------------------- Bereits Anfang des Jahres hatte Jacob Appelbaum behauptet, die NSA fange per Post versandte Geräte ab, um darauf Spyware zu installieren. Nun untermauert Glenn Greenwald diese Anschuldigung: Betroffen seien unter anderem Router und Server von Cisco. --------------------------------------------- http://www.heise.de/security/meldung/NSA-manipuliert-per-Post-versandte-US-… *** AV-Firma warnt wieder vor Adware-Trojaner für OS X *** --------------------------------------------- Nach Angabe von Doctor Web ist aktuell neue Adware im Umlauf, die auf Mac-Nutzer abzielt. Die unerwünschten Browser-Plugins werden bei der Installation von OS-X-Software mit eingespielt. --------------------------------------------- http://www.heise.de/security/meldung/AV-Firma-warnt-wieder-vor-Adware-Troja… *** Zertifikate: DANE und DNSSEC könnten mehr Sicherheit bringen *** --------------------------------------------- DANE könnte die Echtheitsprüfung von Zertifikaten bei TLS-Verbindungen verbessern. Allerdings benötigt das System DNSSEC - und das ist bislang kaum verbreitet. Der Mailanbieter Posteo prescht jetzt voran und will das System etablieren. --------------------------------------------- http://www.golem.de/news/zertifikate-dane-und-dnssec-koennten-mehr-sicherhe… *** Lücken in AVG Remote Administration bleiben offen *** --------------------------------------------- Auf Anfrage teilte die Firma mit, dass sie Angriffe aus dem LAN heraus nicht verhindern könne und deswegen drei Lücken in der Software nicht schliessen wolle. Durch die Lücken können Angreifer den Virenschutz einer Organisation von innen abschalten. --------------------------------------------- http://www.heise.de/security/meldung/Luecken-in-AVG-Remote-Administration-b… *** Proactively Hardening Systems Against Intrusion: Configuration Hardening *** --------------------------------------------- The concept of 'hardening' has nice imagery to it. When we use it to describe battle-hardened soldiers who have been tested in combat a grim, determined image invariably leaps to mind. The same thing happens when we speak of hardened steel that's been repeatedly quenched and tempered, or .. --------------------------------------------- http://www.tripwire.com/state-of-security/security-data-protection/automati… *** Adobe Security Bulletins Posted *** --------------------------------------------- http://blogs.adobe.com/psirt/?p=1100 *** Linux Kernel raw_cmd_copyin() privilege escalation *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93050 *** RSA Security Analytics Lets Remote Users Bypass Authentication *** --------------------------------------------- http://www.securitytracker.com/id/1030220 *** RSA NetWitness Lets Remote Users Bypass Authentication *** --------------------------------------------- http://www.securitytracker.com/id/1030219 *** Flag Module for importer code execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93086 *** grub-mkconfig local access to password *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050063

1 0

Tageszusammenfassung - Montag 12-05-2014
by Daily end-of-shift report 12 May '14

12 May '14

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-05-2014 18:00 − Montag 12-05-2014 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Collabtive folder SQL injection *** --------------------------------------------- Collabtive is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the managefile.php script using the folder parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93029 *** Cobbler kickstart value file include *** --------------------------------------------- Cobbler could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request using the Kickstart value when creating new profiles, to specify a malicious file from the local system, which could allow the attacker to obtain sensitive information or execute arbitrary code on the vulnerable Web server. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93033 *** Bitcoin Miner Utilizing IRC Worm *** --------------------------------------------- Bitcoin miners have given a new reason for attackers to communicate en mass with infected users. IRC worms are not exactly the most hip way to communicate, but they remain effective at sending and receiving commands. I recently came across several samples which bit coin mining examples leveraging IRC. The malicious binary, once installed, queries for the network shares connected to the --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/2xQ7VPxF-ms/bitcoin-mine… *** strongSwan Null Pointer Dereference in Processing ID_DER_ASN1_DN ID Payloads Lets Remote Users Deny Service *** --------------------------------------------- A vulnerability was reported in strongSwan. A remote user can cause denial of service conditions. A remote user can send a specially crafted ID_DER_ASN1_DN ID payload to trigger a null pointer dereference and cause the target IKE service to crash. --------------------------------------------- http://www.securitytracker.com/id/1030209 *** G Data: Symantecs "Ende der Antivirensoftware" verunsichert Nutzer *** --------------------------------------------- Nicht verunsichern lassen und weiter Antivirensoftware kaufen - so lautet ein Aufruf von G Data. Symantec hatte zuvor erklärt, dass nur noch durchschnittlich 45 Prozent aller Angriffe von Antivirensoftware erkannt werden. --------------------------------------------- http://www.golem.de/news/g-data-symantecs-ende-der-antivirensoftware-veruns… *** Drupal Flag 7.x-3.5 Command Execution *** --------------------------------------------- Topic: Drupal Flag 7.x-3.5 Command Execution Risk: High Text:Drupal Flag 7.x-3.5 Module Vulnerability Report Author: Ubani Anthony Balogun Reported: May 07, 2014 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2014050054 *** Nach Heartbleed: Neues Zertifikat, alter Key *** --------------------------------------------- Nach dem Heartbleed-Bug haben viele Administratoren Zertifikate für TLS-Verbindungen ausgetauscht. Viele haben dabei jedoch einen fatalen Fehler begangen: Sie erstellten zwar ein neues Zertifikat, aber keinen neuen Schlüssel. (Technologie, Applikationen) --------------------------------------------- http://www.golem.de/news/nach-heartbleed-neues-zertifikat-alter-key-1405-10… *** Backdoor Xtrat Continues to Evade Detection *** --------------------------------------------- While reviewing recent reports scanned by ZULU, we came across a malicious report that drew our attention. It was notable as the final redirection downloaded ZIP content by accessing a PHP file on the domain www.stisanic.com. URL: hxxp://www[.]stisanic[.]com/wp-content/coblackberrycomnotasdevozdate07052014[.]php ZULUs virustotal check scored the file as higher risk. At the time 10 --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/OqS4L1x6ebQ/backdoor-xtr… *** Link-shortening service Bit.ly suffers data breach *** --------------------------------------------- We have reason to believe that Bitly account credentials have been compromised; specifically, users' email addresses, encrypted passwords, API keys and OAuth tokens. We have no indication at this time that any accounts have been accessed without permission. We have taken steps to ensure the security of all accounts, including disconnecting all users' Facebook and Twitter accounts. All users can safely reconnect these accounts at their next login. --------------------------------------------- http://blog.bitly.com/post/85169217199/urgent-security-update-regarding-you… *** Falsche Zertifikate unterwandern HTTPS-Verbindungen *** --------------------------------------------- Forscher sprechen von signifikantem Teil der verschlüsselten Kommunikation - Vor allem Firewalls und Antivirensoftware verantwortlich --------------------------------------------- http://derstandard.at/1399507237936 *** Linux-Kernel: Root-Rechte für Nutzer *** --------------------------------------------- Durch einen Fehler im Linux-Kernel kann ein einfacher Nutzer Root-Rechte erlangen. Bekannt ist der Fehler schon seit gut einer Woche, aber jetzt gibt es einen öffentlichen Exploit. --------------------------------------------- http://www.golem.de/news/linux-kernel-root-rechte-fuer-nutzer-1405-106407-r… *** Race Condition in the Linux kernel *** --------------------------------------------- The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. --------------------------------------------- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0196 *** Unbekannte bieten 33 Millionen E-Mail-Adressen feil *** --------------------------------------------- Das könnte die nächste Spam-Welle auslösen: Unbekannte bieten per E-Mail mehrere Millionen Mailadressen von deutschen Providern zum Kauf an. Angeblich handelt es sich um 100 Prozent gültige Adressen. --------------------------------------------- http://www.heise.de/security/meldung/Unbekannte-bieten-33-Millionen-E-Mail-… *** HPSBST03038 rev.1 - HP H-series Fibre Channel Switches, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with certain HP H-series Fibre Channel Switches. This vulnerability could be exploited remotely to disclose information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Bugtraq: ESA-2014-027: RSA NetWitness and RSA Security Analytics Authentication Bypass Vulnerability *** --------------------------------------------- RSA NetWitness and RSA Security Analytics each contain a security fix for an authentication bypass vulnerability that could potentially be exploited to compromise the affected system. When PAM for Kerberos is enabled, an attacker can authenticate to the vulnerable system with a valid user name and without specifying a password. This issue does not affect other authentication methods. --------------------------------------------- http://www.securityfocus.com/archive/1/532077

1 0

Tageszusammenfassung - Freitag 9-05-2014
by Daily end-of-shift report 09 May '14

09 May '14

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-05-2014 18:00 − Freitag 09-05-2014 18:00 Handler: Stephan Richter Co-Handler: n/a *** Advance Notification Service for the May 2014 Security Bulletin Release *** --------------------------------------------- Today we provide Advance Notification Service (ANS) for the release of eight bulletins, two rated Critical and six rated Important in severity. These updates will address vulnerabilities for .NET Framework, Office, Internet Explorer, and Windows. As we do every month, we've scheduled the security bulletin release for the second Tuesday of the month, May 13, 2014, at approximately 10:00 a.m. PDT. Revisit this blog then for deployment guidance and further analysis together with a brief --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2014/05/08/advance-notification-ser… *** Prenotification Security Advisory for Adobe Reader and Acrobat *** --------------------------------------------- Adobe is planning to release security updates on Tuesday, May 13, 2014 for Adobe Reader and Acrobat XI (11.0.06) and earlier versions for Windows and Macintosh. --------------------------------------------- https://helpx.adobe.com/security/products/reader/apsb14-15.html *** SQL Injection In Insert, Update, And Delete *** --------------------------------------------- This is a brief whitepaper that goes over different payloads that can be leveraged in SQL injection attacks. --------------------------------------------- http://packetstormsecurity.com/files/126527/SQL-Injection-In-Insert-Update-… *** SNMP: The next big thing in DDoS Attacks? *** --------------------------------------------- It started with DNS: Simple short DNS queries are easily spoofed and the replies can be much larger then the request, leading to an amplification of the attack by orders of magnitude. Next came NTP. Same game, different actors: NTPs "monlist" feature allows for small requests (again: UDP, so trivially spoofed) and large responses. Today, we received a packet capture from a reader showing yet another reflective DDoS mode: SNMP. The "reflector" in this case... --------------------------------------------- https://isc.sans.edu/diary/SNMP%3A+The+next+big+thing+in+DDoS+Attacks%3F/18… *** Heartbleed, IE Zero Days, Firefox vulnerabilities - Whats a System Administrator to do? *** --------------------------------------------- With the recent headlines, weve seen heartbleed (which was not exclusive to Linux, but was predominately there), an IE zero day that had folks over-reacting with headlines of "stop using IE", but Firefox and Safari vulnerabilities where not that far back in the news either. So what is "safe"? And as an System Administrator or CSO what should you be doing to protect your organization? --------------------------------------------- https://isc.sans.edu/diary/Heartbleed%2C+IE+Zero+Days%2C+Firefox+vulnerabil… *** Exploit Kit Roundup: Best of Obfuscation Techniques *** --------------------------------------------- The world of exploit kits is an ever-changing one, if you happen to look away even just for one month, you'll come back to find that most everything has changed around you. Because of this, people like us, who work on a secure web gateway product, are continuously immersed in the world of exploit kits. Every once in a while it's a good idea to stop, take a look around us, and review what's changed. We would like to share some of the more interesting obfuscation techniques --------------------------------------------- http://feedproxy.google.com/~r/SpiderlabsAnterior/~3/R9KtNDgyouY/exploit-ki… *** Surge in Viknok infections bolsters click fraud campaign *** --------------------------------------------- Researchers detected over 16,500 Viknok infections in the first week of May alone. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/6mC7Lf47bgY/ *** Malicious DIY Java applet distribution platforms going mainstream - part two *** --------------------------------------------- In a cybercrime ecosystem, dominated by client-side exploits serving Web malware exploitation kits, cybercriminals continue relying on good old fashioned social engineering tricks in an attempt to trick gullible end users into knowingly/unknowingly installing malware. In a series of blog posts, we've been highlighting the existence of DIY (do-it-yourself), social engineering driven, Java drive-by type of Web based platforms, further enhancing the current efficient state of social... --------------------------------------------- http://feedproxy.google.com/~r/WebrootThreatBlog/~3/6wG1i4Gl5HQ/ *** Bitly shortens life of users passwords after credential compromise *** --------------------------------------------- OAuth tentacles mean its time to change ANOTHER password URL-shortening and online marketing outfit Bit.ly has warned its systems have been accessed by parties unknown and suggested users change their passwords. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2014/05/09/bitly_short… *** Weekly Metasploit Update: Disclosing Usernames, More Flash Bugs, and Wireshark Targets *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/05/08/weekly-me… *** Heartbleed: Noch immer 300.000 Server verwundbar *** --------------------------------------------- Vier Wochen nach Auftauchen der Lücke zeigt Untersuchung nur wenig Fortschritte --------------------------------------------- http://derstandard.at/1399507030882 *** Cyber Security Challenge sucht österreichische IT-Talente *** --------------------------------------------- Bereits zum dritten Mal wird im Rahmen der Cyber Security Challenge Austria nach jungen Hacker-Talenten gesucht. Dieses Jahr gibt es auch einen europaweiten Wettbewerb. --------------------------------------------- http://futurezone.at/netzpolitik/cyber-security-challenge-sucht-oesterreich… *** CVE-2014-3214: A Defect in Prefetch Can Cause Recursive Servers to Crash *** --------------------------------------------- A defect in the pre-fetch feature (which is enabled by default) can cause BIND 9.10.0 to terminate with a "REQUIRE" assertion failure if it processes queries whose answers have particular attributes. This can be triggered as the result of normal query processing. --------------------------------------------- https://kb.isc.org/article/AA-01161 *** QNAP-Photostation V.3.2 XSS *** --------------------------------------------- XSS-Lücke in QNAP-Photostation V.3.2 (auf QNAP NAS TS259+ Pro - Firmware 4.0.7 vom 12.04.2014) --------------------------------------------- http://sdcybercom.wordpress.com/2014/04/25/qnap-cross-site-scripting-nicht-… *** Digi International OpenSSL Vulnerability *** --------------------------------------------- Digi International has identified five products that are vulnerable to the OpenSSL Heartbleed bug. Digi International has produced downloadable firmware upgrade versions that mitigate this vulnerability. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-128-01 *** IBM Security Bulletins for TADDM *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… https://www-304.ibm.com/connections/blogs/PSIRT/entry/ibm_security_bulletin… *** Kaspersky Internet Security Null Pointer Dereference in prremote.dll Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1030203 *** Multiple BIG-IP products iControl command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/93015 *** Security Bulletin: IBM iNotes Cross-Site Scripting Vulnerability (CVE-2014-0913) *** --------------------------------------------- IBM iNotes versions 9.0.1 and 8.5.3 Fix Pack 6 contain a cross-site scripting vulnerability. The fixes for these issues were introduced in IBM Domino and IBM iNotes versions 9.0.1 Fix Pack 1 and 8.5.3 Fix Pack 6 Interim Fix 2. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21671981 *** HPSBMU03035 rev.1 - HP Network Node Manager I (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross-Site Scripting (XSS) *** --------------------------------------------- A potential security vulnerability has been identified with HP Network Node Manager I (NNMi) on HP-UX, Linux, Solaris, and Windows. This vulnerability could be exploited remotely to allow cross-site scripting (XSS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03008 rev.2 - HP Software Service Manager, "HeartBleed" OpenSSL Vulnerability, Remote Disclosure of Information *** --------------------------------------------- The Heartbleed vulnerability was detected in specific OpenSSL versions. OpenSSL is a 3rd party product that is embedded with some of HP Software products. This bulletin objective is to notify HP Software customers about products affected by the Heartbleed vulnerability. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** R7-2013-19.2 Disclosure: Yokogawa CENTUM CS 3000 BKESimmgr.exe Buffer Overflow (CVE-2014-0782) *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2014/05/09/r7-2013-1…

1 0

Tageszusammenfassung - Donnerstag 8-05-2014
by Daily end-of-shift report 08 May '14

08 May '14

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-05-2014 18:00 − Donnerstag 08-05-2014 18:00 Handler: L. Aaron Kaplan Co-Handler: Stephan Richter *** The State of Cryptography in 2014, Part 2: Hardware, Black Swans, and What To Do Now *** --------------------------------------------- We continue our look into the state of cryptography in 2014; Part 1 was posted earlier this week. Is Hardware Security Any Better? We closed the first post by asking: is hardware any more trustworthy? One would think that it is - but it's not. Recently, chip vendors have been incorporating cryptography into their CPUs or chipsets. Usually,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5erAjAwWMmU/ *** SIRv16: Cybercriminal tactics trend toward deceptive measures *** --------------------------------------------- Microsoft's Security Intelligence Report volume 16 (SIRv16) was released today, providing threat trends on malware encounter rates, infection rates, vulnerabilities, exploits, and more for 110 countries/regions worldwide. The report is designed to help IT and security professionals better protect themselves and their organizations from cyberattacks. Malware data is gathered from the Malicious Software Removal Tool (MSRT), which is used to calculate the infection rate... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2014/05/07/sirv16-cybercriminal-tac… *** Case Study: Analyzing the Origins of a DDoS Attack *** --------------------------------------------- Recently a client was experiencing a massive layer 7 DDOS attack, generating tens of thousands of random HTTP requests per second to the server. The architecture of the website included a cluster of three web servers responsible for handling all incoming traffic, which did little to alleviate the pressures brought about the attack. An interestingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/7nrfa2OwFuo/map-of-a-ddos-att… *** Systemkamera Samsung NX300 öffnet Hackern Tür und Tor *** --------------------------------------------- Die Kamera enthält eine ganze Reihe von Sicherheitslücken, inklusive einem weit offen stehenden X-Server und einem reprogrammierbaren NFC-Chip. Angreifer könnten diese nutzen, um Schadcode auf dem Gerät auszuführen. --------------------------------------------- http://www.heise.de/security/meldung/Systemkamera-Samsung-NX300-oeffnet-Hac… *** April 2014 virus activity review from Doctor Web *** --------------------------------------------- April 30, 2014 April 2014 proved to be quite fruitful in terms of the emergence of new threats. In particular, Doctor Webs security researchers discovered a new multi-purpose backdoor targeting Windows. Also registered were numerous incidents involving adware browser extensions for Mac OS X. In addition, a variety of signatures for Android malware were added to the virus databases. --------------------------------------------- http://news.drweb.com/show/?i=4376&lng=en&c=9 *** Volafox Mac OS X Memory Analysis Toolkit *** --------------------------------------------- Volafox is an open source toolkit that you can use for Mac OS X and BSD forensics. The tool is a python based and allows investigating security incidents and finding information for malwares and any malicious program on the system. Security analyst can have the following information using this tool:... --------------------------------------------- http://www.sectechno.com/2014/05/04/volafox-mac-os-x-memory-analysis-toolki… *** Security: Gravierende Lücke in AVG Remote Administration *** --------------------------------------------- Nutzer, die das Fernwartungspaket AVG Remote Administration nutzen, sollten dringend einen aktuellen Patch installieren. Bisher war es möglich, dass Angreifer über das Programm Code einschleusen konnten - aber das ist nicht die einzige Lücke, weitere stehen noch offen. --------------------------------------------- http://www.golem.de/news/security-gravierende-luecke-in-avg-remote-administ… *** [2014-05-08] Multiple critical vulnerabilities in AVG Remote Administration *** --------------------------------------------- Attackers are able to completely compromise the AVG Admin server (part of AVG Remote Administration) system as they can gain full access at the application and system level by exploiting remote code execution, authentication bypass, missing entity authentication and insecure encryption vulnerabilities. Attackers can also manage endpoints and possibly deploy attacker-controlled code on endpoints. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2014… *** Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players *** --------------------------------------------- Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Recording Format (WRF) and Advanced Recording Format (ARF) Players. Exploitation of these vulnerabilities could allow a remote attacker to cause an affected player to crash and, in some cases, could allow a remote attacker to execute arbitrary code on the system of a targeted user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** SA-CONTRIB-2014-049 - Organic Groups (OG) - Access Bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2014-049Project: Organic groups (third-party module)Version: 7.xDate: 2014-May-07Security risk: Moderately criticalExploitable from: RemoteVulnerability: Access bypassDescriptionOrganic groups (OG) enables users to create and manage their own groups. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves.OG doesnt sufficiently check the permissions when a group member is pending or blocked status within... --------------------------------------------- https://drupal.org/node/2261245 *** Ruby on Rails Implicit Render Bug Lets Remote Users Obtain Files From the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1030210 *** HP Security Bulletins *** --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vuln: vBulletin Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/66972 *** Vuln: SAP Solution Manager Background Processing Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/67107 *** Vuln: SAP NetWeaver Portal WD Information Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/67104 *** Security Advisory-Radius Vulnerability on Some Huawei Devices *** --------------------------------------------- On huawei Campus Switch, AR, SRG,WLAN devices, the RADIUS component cannot handle malformed RADIUS packets. This vulnerability allows attackers to repeatedly restart the device, causing a DoS attack (Vulnerability ID: HWPSIRT-2014-0307). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Mittwoch 7-05-2014
by Daily end-of-shift report 07 May '14

07 May '14

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 06-05-2014 18:00 − Mittwoch 07-05-2014 18:00 Handler: L. Aaron Kaplan Co-Handler: Stephan Richter *** TLS 1.3 Working Group Has Consensus to Deprectate RSA Key Transport *** --------------------------------------------- RSA key transport cipher suites could be deprecated in TLS 1.3 in favor of Diffie-Hellman Exchange or Elliptic curve Diffie-Hellman. --------------------------------------------- http://threatpost.com/tls-1-3-working-group-has-consensus-to-deprectate-rsa… *** Antivirus is Dead: Long Live Antivirus! *** --------------------------------------------- An article in The Wall Street Journal this week quoted executives from antivirus pioneer Symantec uttering words that would have been industry heresy a few years ago, declaring antivirus software "dead" and stating that the company is focusing on developing technologies that attack online threats from a different angle. This hardly comes as news for anyone in the security industry whos been paying attention over the past few years, but Im writing about it because this is a great --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/INOFThmd17Q/ *** Sicherheit im Fokus der Linuxwochen in Wien *** --------------------------------------------- Von 8. bis 10. Mai finden auf der FH Technikum Wien zahlreiche Vorträge und Workshops zu Linux, Open Data und Open Source statt. --------------------------------------------- http://futurezone.at/digital-life/sicherheit-im-fokus-der-linuxwochen-in-wi… *** Video: NEXT Berlin *** --------------------------------------------- Mikko spoke at NEXT Berlin yesterday:And the video is now online: Arms Race. [24m15s] On 06/05/14 At 12:31 PM --------------------------------------------- http://www.f-secure.com/weblog/archives/00002701.html *** Erpressungstrojaner drohen Android-Nutzern *** --------------------------------------------- Sicherheitsforscher haben den ersten Trojaner entdeckt, der Android-Geräte befällt und von seinen Opfern Lösegeld erpresst. Der Schadcode mit dem Namen Koler.A befällt bereits Smartphones weltweit. --------------------------------------------- http://www.heise.de/security/meldung/Erpressungstrojaner-drohen-Android-Nut… *** Security: Gegen die Angst vor Angriffen aufs Smartphone *** --------------------------------------------- Für das Re:publica-Publikum haben die Sicherheitsexperten Linus Neumann und Ben Schlabs ein paar Tipps parat, wie Smartphones gesichert werden können. Und sie zeigen, wie Siri als Einbruchhelfer missbraucht werden kann. --------------------------------------------- http://www.golem.de/news/security-gegen-die-angst-vor-angriffen-aufs-smartp… *** Hintergrund: SSL-Fuzzing mit "Frankencerts" *** --------------------------------------------- Durch das Zusammenstückeln von Tausenden von echten SSL-Zertifikaten zu über acht Millionen "Frankencerts" haben Forscher Lücken in gängigen SSL-Bibliotheken gefunden. --------------------------------------------- http://www.heise.de/security/artikel/SSL-Fuzzing-mit-Frankencerts-2166135.h… *** New DNS Spoofing Technique: Why we havent covered it., (Wed, May 7th) *** --------------------------------------------- The last couple of days, a lot of readers sent us links to articles proclaiming yet another new flaw in DNS. "Critical Vulnerability in BIND Software Puts DNS Protocol Security At Risk" [1] claimed one article, going forward to state: "The students have found a way to compel DNS servers to connect with a specific server controlled by the attacker that could respond with a false IP address. “ So how bad is this really? First of all, here is a the --------------------------------------------- http://isc.sans.edu/diary.html?storyid=18079&rss *** OpenBSD-Entwickler bezweifeln angebliche OpenSSH-Schwachstelle *** --------------------------------------------- Der Exploit soll so schlimm wie der SSL-GAU Heartbleed sein und die wichtige Unix-Bibliothek OpenSSH betreffen. Allerdings sagen viele Entwickler, dass die Lücke wahrscheinlich nicht existiert. --------------------------------------------- http://www.heise.de/security/meldung/OpenBSD-Entwickler-bezweifeln-angeblic… *** Advanced Evasion Techniques (AET) a Major Concern for CIOs *** --------------------------------------------- According to a new Vanson Bourne study sponsored by McAfee, CIOs are adding yet another threat to their ever-growing list of network security concerns: Advanced Evasion Techniques, or AETs. Unlike Advanced Persistent Threats (APTs) and other advanced malware, Advanced Evasion Techniques are not types of malicious software. Rather, they are a technique used by threat [...]The post Advanced Evasion Techniques (AET) a Major Concern for CIOs appeared first on Seculert Blog on Advanced Threats and --------------------------------------------- http://www.seculert.com/blog/2014/05/advanced-evasion-techniques-aet-a-majo… *** ABB Relion 650 Series OpenSSL Vulnerability *** --------------------------------------------- ABB has identified an OpenSSL vulnerability in its Relion 650 series application. ABB is in the process of creating a patch that mitigates this vulnerability. This vulnerability could be exploited remotely. Exploits that target this vulnerability are known to be publicly available. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-14-126-01 *** Security Advisory- BootRom Menu and Boot Menu Vulnerabilities on Huawei Campus Switches *** --------------------------------------------- Some versions of Huawei Campus S7700/S9300/S9700 switches are affected by the BootRom and Boot Menu vulnerability. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** VU#902790: Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability *** --------------------------------------------- Vulnerability Note VU#902790 Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability Original Release date: 07 May 2014 | Last revised: 07 May 2014 Overview Fortinet Fortiweb prior to version 5.2.0 do not sufficiently verify whether a valid request was intentionally provided by the user, which results in a cross-site request forgery (CSRF) vulnerability. (CWE-352) Description CWE-352: Cross-Site Request Forgery (CSRF)Fortinet Fortiweb prior to version 5.2.0 do not... --------------------------------------------- http://www.kb.cert.org/vuls/id/902790 *** HPSBMU02994 rev.4 - HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP BladeSystem c-Class Onboard Administrator (OA) running OpenSSL. This is the OpenSSL vulnerability known as "Heartbleed" which could be exploited remotely resulting in disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily