=====================
= End-of-Day report =
=====================
Timeframe: Freitag 23-12-2022 18:00 − Dienstag 27-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ EarSpy attack eavesdrops on Android phones via motion sensors ∗∗∗
---------------------------------------------
A team of researchers has developed an eavesdropping attack for Android devices that can, to various degrees, recognize the callers gender and identity, and even discern private speech.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/earspy-attack-eavesdrops-on-…
∗∗∗ Container Verification Bug Allows Malicious Images to Cloud Up Kubernetes ∗∗∗
---------------------------------------------
A complete bypass of the Kyverno security mechanism for container image imports allows cyberattackers to completely take over a Kubernetes pod to steal data and inject malware.
---------------------------------------------
https://www.darkreading.com/cloud/container-verification-bug-malicious-imag…
∗∗∗ BlueNoroff introduces new methods bypassing MoTW ∗∗∗
---------------------------------------------
We continue to track the BlueNoroff group’s activities and this October we observed the adoption of new malware strains in its arsenal.
---------------------------------------------
https://securelist.com/bluenoroff-methods-bypass-motw/108383/
∗∗∗ DShield Sensor Setup in Azure, (Wed, Dec 21st) ∗∗∗
---------------------------------------------
In November I setup the DShield sensor in my Azure tenant using Ubuntu version 20.04. Here are the steps I followed.
---------------------------------------------
https://isc.sans.edu/diary/rss/29370
∗∗∗ GuLoader Malware Utilizing New Techniques to Evade Security Software ∗∗∗
---------------------------------------------
Cybersecurity researchers have exposed a wide variety of techniques adopted by an advanced malware downloader called GuLoader to evade security software.
---------------------------------------------
https://thehackernews.com/2022/12/guloader-malware-utilizing-new.html
∗∗∗ Navigating the Vast Ocean of Sandbox Evasions ∗∗∗
---------------------------------------------
After creating a bespoke sandbox environment, we discuss techniques used to target malware evasions with memory detection and more.
---------------------------------------------
https://unit42.paloaltonetworks.com/sandbox-evasion-memory-detection/
∗∗∗ Erinnerung: Basic Authentication in Exchange Online wird 2023 abgeschaltet ∗∗∗
---------------------------------------------
Microsoft hat die Tage daran erinnert, dass die sogenannte Basic Authentication in Exchange Online ausläuft und im kommenden Jahr abgeschaltet wird.
---------------------------------------------
https://www.borncity.com/blog/2022/12/27/erinnerung-basic-authentication-in…
∗∗∗ Caution! Malware Signed With Microsoft Certificate ∗∗∗
---------------------------------------------
Microsoft announced details on the distribution of malware signed with a Microsoft certificate. According to the announcement, a driver authenticated with the Windows Hardware Developer Program had been abused due to the leakage of multiple Windows developer accounts. To prevent damage, Microsoft blocked the related accounts and applied a security update (Microsoft Defender 1.377.987.0 or later).
---------------------------------------------
https://asec.ahnlab.com/en/44726/
∗∗∗ Distribution of Magniber Ransomware Stops (Since November 29th) ∗∗∗
---------------------------------------------
Through a continuous monitoring process, the AhnLab ASEC analysis team is swiftly responding to Magniber, the main malware that is actively being distributed using the typosquatting method which exploits typos in domain address input. Through such continuous responses, we have detected that as of November 29th, the distribution of the Magniber ransomware has halted.
---------------------------------------------
https://asec.ahnlab.com/en/43858/
∗∗∗ Inside the IcedID BackConnect Protocol ∗∗∗
---------------------------------------------
As part of our ongoing tracking of IcedID / BokBot, we wanted to share some insights derived from infrastructure associated with IcedID’s BackConnect (BC) protocol.
---------------------------------------------
https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol
=====================
= Vulnerabilities =
=====================
∗∗∗ Ksmbd: Kritische Lücke im SMB-Dienst des Linux-Kernels ∗∗∗
---------------------------------------------
Der Linux-Kernel verfügt seit vergangenem Jahr über eine eigene SMB-Implementierung. Diese enthält eine sehr gefährliche Lücke - Updates stehen bereit.
---------------------------------------------
https://www.golem.de/news/ksmbd-kritische-luecke-im-smb-dienst-des-linux-ke…
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (kernel, libksba, and mbedtls), Fedora (containerd, curl, firefox, kernel, mod_auth_openidc, and xorg-x11-server), and Mageia (chromium-browser-stable).
---------------------------------------------
https://lwn.net/Articles/918607/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gerbv), Fedora (webkitgtk), and SUSE (ca-certificates-mozilla, freeradius-server, multimon-ng, vim, and vlc).
---------------------------------------------
https://lwn.net/Articles/918631/
∗∗∗ Critical Vulnerability in Premium Gift Cards WordPress Plugin Exploited in Attacks ∗∗∗
---------------------------------------------
Defiant’s Wordfence team warns of a critical-severity vulnerability in the YITH WooCommerce Gift Cards premium WordPress plugin being exploited in attacks.
---------------------------------------------
https://www.securityweek.com/critical-vulnerability-premium-gift-cards-word…
∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0011 ∗∗∗
---------------------------------------------
Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
---------------------------------------------
https://webkitgtk.org/security/WSA-2022-0011.html
∗∗∗ Cross-Site Scripting im Admin-Panel von Lucee Server (SYSS-2022-051) ∗∗∗
---------------------------------------------
Im Admin-Panel von Lucee Server besteht eine Cross-Site Scripting (XSS)-Schwachstelle. Angreifende können somit JavaScript-Code im Browser ausführen.
---------------------------------------------
https://www.syss.de/pentest-blog/cross-site-scripting-im-admin-panel-von-lu…
∗∗∗ MISP 2.4.167 released with many improvements, bugs fixed and security fixes. ∗∗∗
---------------------------------------------
https://github.com/MISP/MISP/releases/tag/v2.4.167
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 22-12-2022 18:00 − Freitag 23-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Vice Society ransomware gang switches to new custom encryptor ∗∗∗
---------------------------------------------
The Vice Society ransomware operation has switched to using a custom ransomware encrypt that implements a strong, hybrid encryption scheme based on NTRUEncrypt and ChaCha20-Poly1305.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/vice-society-ransomware-gang…
∗∗∗ Google ad traffic leads to stealer packages based on free software, (Thu, Dec 22nd) ∗∗∗
---------------------------------------------
Earlier this month, I wrote a diary about Google ad traffic leading to a fake AnyDesk page pushing IcedID malware. This week, the same type of ad traffic led to a fake TeamViewer page, and that page led to a different type of malware.
---------------------------------------------
https://isc.sans.edu/diary/rss/29376
∗∗∗ Passwortmanager: LastPass-Hacker haben Zugriff auf Kennworttresore von Kunden ∗∗∗
---------------------------------------------
Bei einem IT-Sicherheitsvorfall beim Anbieter des Passwortmanagers LastPass konnten Angreifer doch auf Kundendaten inklusive gespeicherter Passwörter zugreifen.
---------------------------------------------
https://heise.de/-7441929
∗∗∗ Sourcecode vom Zugriffsmanagementdienst Okta geleakt ∗∗∗
---------------------------------------------
Unbekannte Angreifer konnten auf das Github-Repository von Okta zugreifen und Code kopieren. Die Sicherheit des Dienstes soll dadurch nicht gefährdet sein.
---------------------------------------------
https://heise.de/-7442131
∗∗∗ IcedID Botnet Distributors Abuse Google PPC to Distribute Malware ∗∗∗
---------------------------------------------
We analyze the latest changes in IcedID botnet from a campaign that abuses Google pay per click (PPC) ads to distribute IcedID via malvertising attacks.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/icedid-botnet-distributors-a…
=====================
= Vulnerabilities =
=====================
∗∗∗ Is this CVSS 10 Linux Kernel vuln going to ruin your Christmas? ∗∗∗
---------------------------------------------
Before Linux users worldwide get panties in a panicked bunch, there appears to be more positive news however: At first glance the vulnerability only appears to affect ksmbd, an in-kernel SMB file server that was merged to mainline in the Linux 5.15 release in August 2021; i.e. users running SMB servers via the much more widely deployed Samba, rather than ksmbd can more likely than not get back their mince pies unpurturbed.
---------------------------------------------
https://thestack.technology/is-this-cvss-10-linux-kernel-vulnerability-ksmb…
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (node-hawk and node-trim-newlines), Fedora (insight, ntfs-3g, and suricata), and SUSE (conmon, helm, kernel, and mbedtls).
---------------------------------------------
https://lwn.net/Articles/918486/
∗∗∗ Threat Brief: OWASSRF Vulnerability Exploitation ∗∗∗
---------------------------------------------
We analyze the new exploit method for Microsoft Exchange Server, OWASSRF, noting that all exploit attempts weve observed use the same PowerShell backdoor, which we track as SilverArrow.
---------------------------------------------
https://unit42.paloaltonetworks.com/threat-brief-owassrf/
∗∗∗ CVE-2022-42889 Text4shell Apache Commons Text RCE Vulnerability ∗∗∗
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0022
∗∗∗ PSA: YITH WooCommerce Gift Cards Premium Plugin Exploited in the Wild ∗∗∗
---------------------------------------------
https://www.wordfence.com/blog/2022/12/psa-yith-woocommerce-gift-cards-prem…
∗∗∗ Multiple vulnerabilities in IBM Java SDK affect AIX ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851437
∗∗∗ AIX is vulnerable to denial of service due to ISC BIND (CVE-2022-38178, CVE-2022-3080, CVE-2022-38177, CVE-2022-2795) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851445
∗∗∗ AIX is affected by a denial of service (CVE-2022-43680) due to Python ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851439
∗∗∗ Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for November 2022 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848295
∗∗∗ IBM Integration Designer is vulnerable to denial of service ( CVE-2022-21626) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851449
∗∗∗ Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server April and July 2022 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851613
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 21-12-2022 18:00 − Donnerstag 22-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ FIN7 hackers create auto-attack platform to breach Exchange servers ∗∗∗
---------------------------------------------
The notorious FIN7 hacking group uses an auto-attack system that exploits Microsoft Exchange and SQL injection vulnerabilities to breach corporate networks, steal data, and select targets for ransomware attacks based on financial size.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fin7-hackers-create-auto-att…
∗∗∗ Ransomware and wiper signed with stolen certificates ∗∗∗
---------------------------------------------
In this report, we compare the ROADSWEEP ransomware and ZEROCLEARE wiper versions used in two waves of attacks against Albanian government organizations.
---------------------------------------------
https://securelist.com/ransomware-and-wiper-signed-with-stolen-certificates…
∗∗∗ Microsoft research uncovers new Zerobot capabilities ∗∗∗
---------------------------------------------
The Microsoft Defender for IoT research team details information on the recent distribution of a Go-based botnet, known as Zerobot, that spreads primarily through IoT and web-application vulnerabilities.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research…
∗∗∗ “Suspicious login” scammers up their game – take care at Christmas ∗∗∗
---------------------------------------------
A picture is worth 1024 words - we clicked through so you dont have to.
---------------------------------------------
https://nakedsecurity.sophos.com/2022/12/21/suspicious-login-scammers-up-th…
∗∗∗ Neuer Android-Trojaner zielt auf Banking-Apps und Krypto-Plattformen ab ∗∗∗
---------------------------------------------
Eine neue Banking-Malware namens Godfather hat 16 Länder im Visier. Deutschland fällt darunter. Sie zeichnet Eingaben in über 415 Banking- und Krypto-Apps auf.
---------------------------------------------
https://heise.de/-7441440
∗∗∗ Exploiting WordPress Plugin Vulnerabilities to Steal AWS Metadata ∗∗∗
---------------------------------------------
If the site is hosted on an Amazon Web Services (AWS) server, then collecting the AWS metadata is relatively simple. This exploit only requires calling the appropriate REST API endpoint with the right payload in the ‘url’ parameter to achieve a successful exploit.
---------------------------------------------
https://www.wordfence.com/blog/2022/12/exploiting-wordpress-plugin-vulnerab…
∗∗∗ Qakbot Being Distributed via Virtual Disk Files (*.vhd) ∗∗∗
---------------------------------------------
There’s been a recent increase in the distribution of malware using disk image files.
---------------------------------------------
https://asec.ahnlab.com/en/44662/
∗∗∗ Vidar Stealer Exploiting Various Platforms ∗∗∗
---------------------------------------------
Vidar Malware is one of the active Infostealers, and its distribution has been significantly increasing. Its characteristics include the use of famous platforms such as Telegram and Mastodon as an intermediary C2.
---------------------------------------------
https://asec.ahnlab.com/en/44554/
=====================
= Vulnerabilities =
=====================
∗∗∗ Critical Windows code-execution vulnerability went undetected until now ∗∗∗
---------------------------------------------
Like EternalBlue, CVE-2022-37958, as the latest vulnerability is tracked, allows attackers to execute malicious code with no authentication required. Also, like EternalBlue, it’s wormable, meaning that a single exploit can trigger a chain reaction of self-replicating follow-on exploits on other vulnerable systems.
---------------------------------------------
https://arstechnica.com/information-technology/2022/12/critical-windows-cod…
∗∗∗ Sicherheitsupdates: Angreifer könnten Synology-Router kompromittieren ∗∗∗
---------------------------------------------
Aktuelle Versionen von Synology Router Manager schließen mehrere Sicherheitslücken. Der Hersteller stuft den Schweregrad als kritisch ein.
---------------------------------------------
https://heise.de/-7440888
∗∗∗ Wichtige Sicherheitsupdates für Avira Security, AVG Antivirus & Co. ∗∗∗
---------------------------------------------
Norton hat in seinem Portfolio von Anti-Viren-Software mehrere Sicherheitslücken geschlossen. Angreifer könnten sich höhere Nutzerrechte verschaffen.
---------------------------------------------
https://heise.de/-7441040
∗∗∗ Puckungfu: A NETGEAR WAN Command Injection ∗∗∗
---------------------------------------------
This blog post describes a command injection vulnerability found and exploited in November 2022 by NCC Group in the Netgear RAX30 router’s WAN interface.
---------------------------------------------
https://research.nccgroup.com/2022/12/22/puckungfu-a-netgear-wan-command-in…
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libksba and linux-5.10), Slackware (mozilla), and SUSE (curl, java-1_8_0-ibm, and sqlite3).
---------------------------------------------
https://lwn.net/Articles/918379/
∗∗∗ Vulnerability Spotlight: OpenImageIO file processing issues could lead to arbitrary code execution, sensitive information leak and denial of service ∗∗∗
---------------------------------------------
Cisco Talos recently discovered nineteen vulnerabilities in OpenImageIO, an image processing library, which could lead to sensitive information disclosure, denial of service and heap buffer overflows which could further lead to code execution.
---------------------------------------------
https://blog.talosintelligence.com/vulnerability-spotlight-openimageio-file…
∗∗∗ Two New Security Flaws Reported in Ghost CMS Blogging Software ∗∗∗
---------------------------------------------
https://thehackernews.com/2022/12/two-new-security-flaws-reported-in.html
∗∗∗ Security Vulnerabilities fixed in Thunderbird 102.6.1 ∗∗∗
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-54/
∗∗∗ Priva TopControl Suite ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-356-01
∗∗∗ Rockwell Automation Studio 5000 Logix Emulate ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-356-02
∗∗∗ Mitsubishi Electric MELSEC iQ-R, iQ-L Series and MELIPC Series ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-356-03
∗∗∗ Omron CX-Programmer ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-356-04
∗∗∗ IBM Content Navigator is vulnerable to missing authorization. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6844453
∗∗∗ Vulnerability (CVE-2022-3676) in Eclipse Openj9 affects CICS Transaction Gateway Desktop Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851347
∗∗∗ Vulnerabilities (CVE-2022-21541 and CVE-2022-21540 ) in IBM Java Runtime affects CICS Transaction Gateway ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851337
∗∗∗ Vulnerabilities (CVE-2022-21541 and CVE-2022-21540) in IBM Java Runtime affects CICS Transaction Gateway Desktop Editon ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851351
∗∗∗ Vulnerability (CVE-2021-41041) in Eclipse Openj9 affects CICS Transaction Gateway ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851339
∗∗∗ Vulnerability (CVE-2021-41041) in Eclipse Openj9 affects CICS Transaction Gateway Desktop Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851345
∗∗∗ Vulnerability (CVE-2021-2163) in IBM Java Runtime affects CICS Transaction Gateway ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851343
∗∗∗ Vulnerability (CVE-2021-2163) in IBM Java Runtime affects CICS Transaction Gateway Desktop Editon ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851349
∗∗∗ Vulnerability (CVE-2021-28167) in Eclipse Openj9 affects CICS Transaction Gateway Desktop Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6851341
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 20-12-2022 18:00 − Mittwoch 21-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Hackers bombard PyPi platform with information-stealing malware ∗∗∗
---------------------------------------------
The PyPi python package repository is being bombarded by a wave of information-stealing malware hiding inside malicious packages uploaded to the platform to steal software developers data.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-bombard-pypi-platfor…
∗∗∗ VirusTotal cheat sheet makes it easy to search for specific results ∗∗∗
---------------------------------------------
VirusTotal has published a cheat sheet to help researchers create queries leading to more specific results from the malware intelligence platform.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/virustotal-cheat-sheet-makes…
∗∗∗ FBI warns of search engine ads pushing malware, phishing ∗∗∗
---------------------------------------------
The FBI warns that threat actors are using search engine advertisements to promote websites distributing ransomware or stealing login credentials for financial institutions and crypto exchanges.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fbi-warns-of-search-engine-a…
∗∗∗ Malicious Macros Adapt to Use Microsoft Publisher to Push Ekipa RAT ∗∗∗
---------------------------------------------
After Microsoft announced this year that macros from the Internet will be blocked by default in Office , many threat actors have switched to different file types such as Windows Shortcut (LNK), ISO or ZIP files, to distribute their malware.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/malicious-m…
∗∗∗ Fake jQuery Domain Redirects Site Visitors to Scam Pages ∗∗∗
---------------------------------------------
A recent infection has been making its rounds across vulnerable WordPress sites, detected on over 160 websites so far at the time of writing.
---------------------------------------------
https://blog.sucuri.net/2022/12/fake-jquery-domain-redirects-site-visitors-…
∗∗∗ Kindersicherungs-Apps: Smarte Kids könnten Eltern attackieren ∗∗∗
---------------------------------------------
Sicherheitsforscher haben Android-Apps untersucht, über die Eltern Internetzugriffe von Kindern einschränken können. Doch Schwachstellen weichen den Schutz auf.
---------------------------------------------
https://heise.de/-7435146
∗∗∗ Adult popunder campaign used in mainstream ad fraud scheme ∗∗∗
---------------------------------------------
Taking advantage of cost effective and high traffic adult portals, a threat actor is secretly defrauding advertisers by displaying Google ads under the disguise of an XXX page.
---------------------------------------------
https://www.malwarebytes.com/blog/threat-intelligence/2022/12/adult-popunde…
∗∗∗ Meddler-in-the-Middle Phishing Attacks Explained ∗∗∗
---------------------------------------------
Meddler-in-the-Middle (MitM) phishing attacks show how threat actors find ways to get around traditional defenses and advice.
---------------------------------------------
https://unit42.paloaltonetworks.com/meddler-phishing-attacks/
∗∗∗ Godfather: A banking Trojan that is impossible to refuse ∗∗∗
---------------------------------------------
Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries.
---------------------------------------------
https://blog.group-ib.com/godfather-trojan
∗∗∗ Didn’t Notice Your Rate Limiting: GraphQL Batching Attack ∗∗∗
---------------------------------------------
In this article, we will discuss how allowing multiple queries or requesting multiple object instances in a single network call can be abused leading to massive data leaks or Denial of Service (DoS).
---------------------------------------------
https://checkmarx.com/blog/didnt-notice-your-rate-limiting-graphql-batching…
∗∗∗ A Technical Analysis of CVE-2022-22583 and CVE-2022-32800 ∗∗∗
---------------------------------------------
This blog entry discusses the technical details of how we exploited CVE-2022-22583 using a different method. We also tackle the technical details of CVE-2022-32800, another SIP-bypass that we discovered more recently, in this report.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/a-technical-analysis-of-cve-…
∗∗∗ Conti Team One Splinter Group Resurfaces as Royal Ransomware with Callback Phishing Attacks ∗∗∗
---------------------------------------------
In this blog entry, we discuss findings from our investigation of this ransomware and the tools that Royal ransomware actors used to carry out their attacks.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/conti-team-one-splinter-grou…
=====================
= Vulnerabilities =
=====================
∗∗∗ Jetzt patchen! Attacken auf Exchange Server im ProxyNotShell-Kontext gesichtet ∗∗∗
---------------------------------------------
Sicherheitsforscher warnen vor einem neuen Exploit, der ProxyNotShell-Schutzkonzepte umgeht. Es gibt aber Sicherheitsupdates.
---------------------------------------------
https://heise.de/-7434860
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (xorg-server), Fedora (samba, snakeyaml, thunderbird, xorg-x11-server, and xrdp), Slackware (libksba and sdl), and SUSE (cni, cni-plugins, java-1_7_1-ibm, kernel, openssl-3, and supportutils).
---------------------------------------------
https://lwn.net/Articles/918313/
∗∗∗ Passwordless Persistence and Privilege Escalation in Azure ∗∗∗
---------------------------------------------
Adversaries are always looking for stealthy means of maintaining long-term and stealthy persistence and privilege in a target environment. Certificate-Based Authentication (CBA) is an extremely attractive persistence option in Azure for three big reasons.
---------------------------------------------
https://posts.specterops.io/passwordless-persistence-and-privilege-escalati…
∗∗∗ Installers generated by Squirrel.Windows may insecurely load Dynamic Link Libraries ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN29902403/
∗∗∗ Critical Vulnerability in Hikvision Wireless Bridges Allows CCTV Hacking ∗∗∗
---------------------------------------------
https://www.securityweek.com/critical-vulnerability-hikvision-wireless-brid…
∗∗∗ Mattermost security updates 7.5.2, 7.4.1, 7.1.5 (ESR) released ∗∗∗
---------------------------------------------
https://mattermost.com/blog/mattermost-security-updates-7-5-2-7-4-1-7-1-5-e…
∗∗∗ Rechteausweitung in Razer Synapse (SYSS-2022-047) ∗∗∗
---------------------------------------------
https://www.syss.de/pentest-blog/rechteausweitung-in-razer-synapse-syss-202…
∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to denial of service due to the package org.yaml:snakeyaml and jackson-databind ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849213
∗∗∗ GraphQL Denial of Service security vulnerability CVE-2022-37734 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6828663
∗∗∗ IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote attacker due to Node.js (CVE-2022-43548 & CVE-2022-35256) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849223
∗∗∗ Security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849249
∗∗∗ OpenSSH as used by IBM Cloud Pak for Security is vulnerable to privilege escalation (CVE-2021-41617) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6850775
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 19-12-2022 18:00 − Dienstag 20-12-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Linux File System Monitoring & Actions, (Tue, Dec 20th) ∗∗∗
---------------------------------------------
There can be multiple reasons to keep an eye on a critical/suspicious file or directory. For example, you could track an attacker and wait for some access to the captured credentials in a phishing kit installed on a compromised server. You could deploy an EDR solution or an OSSEC agent that implements an FIM (File Integrity Monitoring). Upon a file change, an action can be triggered. Nice, but what if you would like a quick solution but agentless?
---------------------------------------------
https://isc.sans.edu/diary/rss/29362
∗∗∗ ChatGPT: Emerging AI Threat Landscape ∗∗∗
---------------------------------------------
ChatGPT is a prototype chatbot released by OpenAI. The chatbot is powered by AI and is gaining more traction than previous chatbots because it not only interacts in a conversational manner but has the capability to create code and many other complex questions and requests.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chatgpt-eme…
∗∗∗ Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems ∗∗∗
---------------------------------------------
Microsoft has disclosed details of a now-patched security flaw in Apple macOS that could be exploited by an attacker to get around security protections imposed to prevent the execution of malicious applications.
---------------------------------------------
https://thehackernews.com/2022/12/microsoft-details-gatekeeper-bypass.html
∗∗∗ Linux Kernel: Exploiting a Netfilter Use-after-Free in kmalloc-cg ∗∗∗
---------------------------------------------
We describe a method to exploit a use-after-free in the Linux kernel when objects are allocated in a specific slab cache, namely the kmalloc-cg series of SLUB caches used for cgroups. This vulnerability is assigned CVE-2022-32250 and exists in Linux kernel versions 5.18.1 and prior.
---------------------------------------------
https://blog.exodusintel.com/2022/12/19/linux-kernel-exploiting-a-netfilter…
∗∗∗ clif - simple command-line application fuzzer ∗∗∗
---------------------------------------------
clif is a command-line application fuzzer, pretty much what a wfuzz or ffuf are for web. It was inspired by sudo vulnerability CVE-2021-3156 and the fact that, for some reasons, Googles alf-fuzz doesnt allow for unlimited argument or option specification.
---------------------------------------------
https://andy.codes/content/blog/2022-12-20-clif.html
∗∗∗ Better Make Sure Your Password Manager Is Secure ∗∗∗
---------------------------------------------
As part of a security analysis, our colleagues kuekerino, ubahnverleih and parzel examined the password management solution Passwordstate of Click Studios and identified multiple high severity vulnerabilities (CVE-2022-3875, CVE-2022-3876, CVE-2022-3877). Successful exploitation allows an unauthenticated attacker to exfiltrate passwords from an instance, overwrite all stored passwords within the database, or elevate their privileges within the application.
---------------------------------------------
https://www.modzero.com/modlog/archives/2022/12/19/better_make_sure_your_pa…
∗∗∗ New RisePro Infostealer Increasingly Popular Among Cybercriminals ∗∗∗
---------------------------------------------
A recently identified information stealer named ‘RisePro’ is being distributed by pay-per-install malware downloader service ‘PrivateLoader’, cyberthreat firm Flashpoint reports. Written in C++, RisePro harvests potentially sensitive information from the compromised machines and then attempts to exfiltrate it as logs.
---------------------------------------------
https://www.securityweek.com/new-risepro-infostealer-increasingly-popular-a…
∗∗∗ Threat Spotlight: XLLing in Excel - threat actors using malicious add-ins ∗∗∗
---------------------------------------------
As more and more users adopt new versions of Microsoft Office, it is likely that threat actors will turn away from VBA-based malicious documents to other formats such as XLLs or rely on exploiting newly discovered vulnerabilities to launch malicious code.
---------------------------------------------
https://blog.talosintelligence.com/xlling-in-excel-malicious-add-ins/
∗∗∗ Diving into an Old Exploit Chain and Discovering 3 new SIP-Bypass Vulnerabilities ∗∗∗
---------------------------------------------
More than two years ago, a researcher, A2nkF demonstrated the exploit chain from root privilege escalation to SIP-Bypass up to arbitrary kernel extension loading. In this blog entry, we will discuss how we discovered 3 more vulnerabilities from the old exploit chain.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/diving-into-an-old-exploit-c…
∗∗∗ Raspberry Robin Malware Targets Telecom, Governments ∗∗∗
---------------------------------------------
We found samples of the Raspberry Robin malware spreading in telecommunications and government office systems beginning September. The main payload itself is packed with more than 10 layers for obfuscation and is capable of delivering a fake payload once it detects sandboxing and security analytics tools.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targ…
∗∗∗ Web3 IPFS Only Used for Phishing - So Far ∗∗∗
---------------------------------------------
We discuss the use of the InterPlanetary File System (IPFS) in phishing attacks.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/web3-ipfs-only-used-for-phis…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (mujs) and SUSE (kernel and thunderbird).
---------------------------------------------
https://lwn.net/Articles/918268/
∗∗∗ FoxIt Patches Code Execution Flaws in PDF Tools ∗∗∗
---------------------------------------------
Foxit Software has rolled out a critical-severity patch to cover a dangerous remote code execution flaw in its flagship PDF Reader and PDF Editor products.
---------------------------------------------
https://www.securityweek.com/foxit-patches-code-execution-flaws-pdf-tools
∗∗∗ [R1] Nessus Network Monitor Version 6.2.0 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-28
∗∗∗ Fuji Electric Tellus Lite V-Simulator ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-354-01
∗∗∗ Rockwell Automation GuardLogix and ControlLogix controllers ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-354-02
∗∗∗ ARC Informatique PcVue ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-354-03
∗∗∗ Rockwell Automation MicroLogix 1100 and 1400 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-354-04
∗∗∗ Delta 4G Router DX-3021 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-354-05
∗∗∗ Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.5ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849101
∗∗∗ IBM UrbanCode Build is affected by CVE-2022-42252 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849111
∗∗∗ IBM UrbanCode Build is affected by CVE-2021-43980 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849109
∗∗∗ IBM UrbanCode Build is affected by CVE-2022-34305 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6849107
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 16-12-2022 18:00 − Montag 19-12-2022 18:00
Handler: Robert Waldner
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Infostealer Malware with Double Extension, (Sun, Dec 18th) ∗∗∗
---------------------------------------------
Got this file attachment this week pretending to be from HSBC Global Payments and Cash Management. The attachment payment_copy.pdf.z is a rar archive, kind of unusual with this type of file archive but when extracted, it comes out as a double extension with pdf.exe. The file is a trojan infostealer and detected by multiple scanning engines.
---------------------------------------------
https://isc.sans.edu/diary/rss/29354
∗∗∗ Day 3 — Next Level Font Obfuscation ∗∗∗
---------------------------------------------
Today I learned how to obfuscate text using custom fonts. I made a program to automatically create deceptive fonts to demonstrate their danger. Using a custom font, I was able to make a letter look like a different letter to trick a plagiarism checker while still being human-readable.
---------------------------------------------
https://medium.com/@doctoreww/day-3-next-level-font-obfuscation-7a6cd978c7a5
∗∗∗ Venom ∗∗∗
---------------------------------------------
Venom is a C++ library that is meant to give an alternative way to communicate, instead of creating a socket that could be traced back to the process, it creates a new "hidden" (there is no window shown) detached edge process (edge was chosen because it is a browser that is installed on every Windows 10+ and wont raise suspicious) and stealing one of its sockets to perform the network operations.
---------------------------------------------
https://github.com/Idov31/Venom
∗∗∗ Exploiting API Framework Flexibility ∗∗∗
---------------------------------------------
The modern frameworks are often very flexible with what they accept, and will happily treat a POST with a JSON body as interchangeable with a URL encoded body, or even with query parameters. Due to this, an unexploitable JSON XSS vector can sometimes be made exploitable by flipping it to one of these alternative approaches.
---------------------------------------------
https://attackshipsonfi.re/p/exploiting-api-framework-flexibility
∗∗∗ Fake Shops und Phishing-SMS: Die Betrugsmaschen im Online-Weihnachtsgeschäft ∗∗∗
---------------------------------------------
Weihnachten bedeutet auch wieder Hochsaison für Betrüger, die mit gefälschten Shops und irreführenden SMS auf das Geld ihrer Opfer aus sind.
---------------------------------------------
https://www.derstandard.at/story/2000141845543/fake-shops-und-phishing-sms-…
∗∗∗ BSI legt 19 IT-Grundschutz-Bausteine als Final Draft vor ∗∗∗
---------------------------------------------
Kurzer Hinweis für Administratoren und IT-Dienstleister, die im Unternehmensumfeld aktiv sind. Das Bundesamt für Sicherheit in der Informationstechnik (BSI) hat diese Woche 19 sogenannte IT-Grundschutz-Bausteine als sogenannte Final Drafts vorgelegt. Das reicht von .NET über Active Directory Domain Services bis hin zu Windows Server.
---------------------------------------------
https://www.borncity.com/blog/2022/12/18/bsi-legt-19-it-grundschutz-baustei…
=====================
= Vulnerabilities =
=====================
∗∗∗ Cisco Security Advisories 2022-12-16 - 2022-12-18 ∗∗∗
---------------------------------------------
Cisco has updated 9 security advisories: (1x Critical, 5x High, 3x Medium)
---------------------------------------------
https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs…
∗∗∗ HP kümmert sich mit BIOS-Updates um Schadcode-Lücken ∗∗∗
---------------------------------------------
Sicherheitsupdates schließen mehrere Schwachstellen in HP-Computern. Einige Lücken betreffen ausschließlich AMD-Systeme.
---------------------------------------------
https://heise.de/-7398783
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium and thunderbird), Fedora (keylime, libarchive, libtasn1, pgadmin4, rubygem-nokogiri, samba, thunderbird, wireshark, and xorg-x11-server-Xwayland), Gentoo (curl, libreoffice, nss, unbound, and virtualbox), Mageia (advancecomp, couchdb, firefox, freerdp, golang, heimdal, kernel, kernel linus, krb5, leptonica, libetpan, python-slixmpp, thunderbird, and xfce4-settings), Oracle (firefox, nodejs:16, and thunderbird), Scientific Linux (firefox and thunderbird), Slackware (samba), SUSE (chromium and kernel), and Ubuntu (linux-oem-5.17).
---------------------------------------------
https://lwn.net/Articles/918203/
∗∗∗ Synology-SA-22:24 Samba AD DC ∗∗∗
---------------------------------------------
Multiple vulnerabilities allow remote attackers or remote authenticated users to bypass security constraint via a susceptible version of Synology Directory Server.
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_24
∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2022-3643, CVE-2022-42328 & CVE-2022-42329 ∗∗∗
---------------------------------------------
Several security issues have been identified in Citrix Hypervisor 8.2 LTSR CU1, each of which may allow a privileged user in a guest VM to cause the host to become unresponsive or crash.
---------------------------------------------
https://support.citrix.com/article/CTX473048/citrix-hypervisor-security-bul…
∗∗∗ Zenphoto vulnerable to cross-site scripting ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN06093462/
∗∗∗ Corel Roxio Creator LJB starts a program with an unquoted file path ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN13075438/
∗∗∗ ZDI-22-1681: Autodesk 3DS Max SKP File Parsing Use-After-Free Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1681/
∗∗∗ DLL Search Order Hijacking Vulnerability in the DWG TrueView™ Desktop Software ∗∗∗
---------------------------------------------
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0024
∗∗∗ Vulnerabilities in PHP may affect IBM Spectrum Sentinel Anomaly Scan Engine (CVE-2021-21703, CVE-2021-21708, CVE-2021-21707, CVE-2022-31629, CVE-2022-31628) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6845928
∗∗∗ IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2021-29469, CVE-2022-39160, CVE-2022-38708, CVE-2022-42003, CVE-2022-42004, CVE-2022-43883, CVE-2022-43887, CVE-2022-25647, CVE-2022-36364) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6841801
∗∗∗ IBM DataPower Gateway vulnerable to HTTP request smuggling (CVE-2022-35256) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848587
∗∗∗ IBM DataPower Gateway potentially affected by CPU side-channel (CVE-2022-21166) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848585
∗∗∗ IBM DataPower Gateway subject to a memory leak in TCP source port generation (CVE-2022-1012) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848583
∗∗∗ IBM DataPower Gateway vulnerable to network state information leakage (CVE-2021-20322, CVE-2021-45485, CVE-2021-45486) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848577
∗∗∗ UDP source port randomization flaw in IBM DataPower Gateway (CVE-2020-25705) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848581
∗∗∗ Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) & Rational Directory Administrator ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848847
∗∗∗ IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848879
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 15-12-2022 18:00 − Freitag 16-12-2022 18:00
Handler: Robert Waldner
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Phishing attack uses Facebook posts to evade email security ∗∗∗
---------------------------------------------
A new phishing campaign uses Facebook posts as part of its attack chain to trick users into giving away their account credentials and personally identifiable information (PII).
---------------------------------------------
https://www.bleepingcomputer.com/news/security/phishing-attack-uses-faceboo…
∗∗∗ Backdoor Targets FreePBX Asterisk Management Portal ∗∗∗
---------------------------------------------
Written in PHP and JavaScript, FreePBX is a web-based open-source GUI that manages Asterisk, a voice over IP and telephony server. This open-source software allows users to build customer phone systems. During a recent investigation, I came across a simple piece of malware targeting FreePBX’s Asterisk Management portal which allowed attackers to arbitrarily add and delete users, as well as modify the website’s .htaccess file. Let’s take a closer look at this backdoor.
---------------------------------------------
https://blog.sucuri.net/2022/12/backdoor-targets-freepbx-asterisk-managemen…
∗∗∗ Decentralized Identity Attack Surface – Part 2 ∗∗∗
---------------------------------------------
This is the second part of our Decentralized Identity (DID) blog series. In case you’re not familiar with DID concepts, we highly encourage you to start with the first part. This time we will cover a different DID implementation — Sovrin. We will also see what a critical (CVSS 10) DID vulnerability looks like by reviewing the one we found in this popular implementation.
---------------------------------------------
https://www.cyberark.com/resources/threat-research-blog/decentralized-ident…
∗∗∗ Das Ende vom unsicheren Hash-Algorithmus SHA-1 zieht sich wie Kaugummi ∗∗∗
---------------------------------------------
Das National Institute of Standards and Technology schickt das längst geknackte SHA-1-Verfahren in Rente – endgültig aber erst in acht Jahren.
---------------------------------------------
https://heise.de/-7396973
∗∗∗ Codeschmuggel möglich: Microsoft stuft Sicherheitslücke auf "kritisch" herauf ∗∗∗
---------------------------------------------
Eine Sicherheitslücke, für die Microsoft ein Update bereitgestellt hat, ermöglicht unerwartet Angreifern ohne Anmeldung, Schadcode einzuschleusen.
---------------------------------------------
https://heise.de/-7396879
∗∗∗ The Data Protection Officer, an ubiquitous role nobody really knows. (arXiv:2212.07712v1 [cs.CR]) ∗∗∗
---------------------------------------------
Among all cybersecurity and privacy workers, the Data Protection Officer (DPO) stands between those auditing a company's compliance and those acting as management advisors. A person that must be somehow versed in legal, management, and cybersecurity technical skills. We describe how this role tackles socio-technical risks in everyday scenarios.
---------------------------------------------
http://arxiv.org/abs/2212.07712
∗∗∗ FBI, FDA OCI, and USDA Release Joint Cybersecurity Advisory Regarding Business Email Compromise Schemes Used to Steal Food ∗∗∗
---------------------------------------------
The joint CSA analyzes the common tactics, techniques, and procedures (TTPs) utilized by criminal actors to spoof emails and domains to impersonate legitimate employees and order goods that went unpaid and were possibly resold at devalued prices with labeling that lacked industry standard “need-to-knows” (i.e., necessary information about ingredients, allergens, or expiration dates).
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/12/16/fbi-fda-oci-and-u…
∗∗∗ Agenda Ransomware Uses Rust to Target More Vital Industries ∗∗∗
---------------------------------------------
This year, various ransomware-as-a-service groups have developed versions of their ransomware in Rust, including Agenda. Agendas Rust variant has targeted vital industries like its Go counterpart. In this blog, we will discuss how the Rust variant works.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/agenda-ransomware-uses-rust-…
=====================
= Vulnerabilities =
=====================
∗∗∗ VMSA-2022-0034 ∗∗∗
---------------------------------------------
vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0034.html
*** Cisco Security Advisories 2022-12-16 ***
---------------------------------------------
Cisco has updated 18 security advisories: (4x Critical, 11x High, 3x Medium)
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&lastP…
*** Vulnerabilities in Autodesk Image Processing component used by Autodesk products II ***
---------------------------------------------
Applications and services that utilize Image Processing component used by Autodesk products may be impacted by Out-of-bound Read, Heap-based Overflow, Out-of-bound Write, Memory corruption, and Use-after-free vulnerabilities.
---------------------------------------------
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0025
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (firefox-esr, libde265, php7.3, and thunderbird), Fedora (firefox, freeradius, freerdp, and xorg-x11-server), Oracle (firefox, prometheus-jmx-exporter, and thunderbird), Red Hat (firefox, nodejs:16, prometheus-jmx-exporter, and thunderbird), and SUSE (ceph and chromium).
---------------------------------------------
https://lwn.net/Articles/918047/
∗∗∗ Samba Releases Security Updates ∗∗∗
---------------------------------------------
The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit some of these vulnerabilities to take control of an affected system.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/12/16/samba-releases-se…
∗∗∗ Remote code execution bypass in Eclipse Business Intelligence Reporting Tool (BiRT) ∗∗∗
---------------------------------------------
https://sec-consult.com/vulnerability-lab/advisory/remote-code-execution-by…
∗∗∗ IBM Security Guardium is affected by the following vulnerabilities [CVE-2022-39166, CVE-2022-34917, CVE-2022-42889] ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848317
∗∗∗ Multiple Vulnerabilities in base image packages affect IBM Voice Gateway ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848319
∗∗∗ Multiple vulnerabilities affect IBM Tivoli Monitoring included WebSphere Application Server and IBM HTTP Server used by WebSphere Application Server ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848279
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 14-12-2022 18:00 − Donnerstag 15-12-2022 18:00
Handler: Robert Waldner
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ LEGO BrickLink bugs let hackers hijack accounts, breach servers ∗∗∗
---------------------------------------------
Security analysts have discovered two API security vulnerabilities in BrickLink.com, LEGO Groups official second-hand and vintage marketplace for LEGO bricks.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/lego-bricklink-bugs-let-hack…
∗∗∗ Hacking Using SVG Files to Smuggle QBot Malware onto Windows Systems ∗∗∗
---------------------------------------------
Phishing campaigns involving the Qakbot malware are using Scalable Vector Graphics (SVG) images embedded in HTML email attachments.
---------------------------------------------
https://thehackernews.com/2022/12/hacking-using-svg-files-to-smuggle-qbot.h…
∗∗∗ Technical Review: A Deep Analysis of the Dirty Pipe Vulnerability ∗∗∗
---------------------------------------------
Dirty Pipe (CVE-2022-0847) proved that there is a new way to exploit Linux syscalls to write to files with a read-only privileges.
---------------------------------------------
https://blog.aquasec.com/deep-analysis-of-the-dirty-pipe-vulnerability
∗∗∗ Digging Inside Azure Functions: HyperV Is the Last Line of Defense ∗∗∗
---------------------------------------------
We investigated Azures serverless architecture and found that a HyperV VM was the remaining defense after a container breakout.
---------------------------------------------
https://unit42.paloaltonetworks.com/azure-serverless-functions-security/
∗∗∗ Patch Tuesday: (zur Abwechslung) Augen auf! ∗∗∗
---------------------------------------------
Manchmal gelangen wir die verzwickte Lage, dass sich in den Patchnotes Updates für Schwachstellen verbergen, aufgrund derer wir zwar keine Warnung veröffentlichen, aber auf die wir dennoch explizit hinweisen wollen. Diesen Monat ist es wieder einmal soweit.
---------------------------------------------
https://cert.at/de/blog/2022/12/patch-tuesday-zur-abwechslung-augen-auf
∗∗∗ Windows Server 2019/2022: Dezember 2022-Sicherheitsupdates verursachen Hyper-V-Probleme ∗∗∗
---------------------------------------------
Die zum Dezember 2022 Patchday von Microsoft ausgerollten Sicherheitsupdates führen in bestimmten Konstellationen zum Problemen mit Hyper-V.
---------------------------------------------
https://www.borncity.com/blog/2022/12/15/windows-server-2019-2022-dezember-…
∗∗∗ Microsoft-Zertifikate zur Signatur von Malware missbraucht (Dez. 2022) ∗∗∗
---------------------------------------------
Sicherheitsforscher sind auf Fälle gestoßen, wo es Cyberkriminellen gelungen ist, Malware durch gültige digitale Zertifikate von Microsoft zu signieren.
---------------------------------------------
https://www.borncity.com/blog/2022/12/15/microsoft-zertifikate-zur-signatur…
=====================
= Vulnerabilities =
=====================
∗∗∗ Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as Critical ∗∗∗
---------------------------------------------
Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution.
---------------------------------------------
https://thehackernews.com/2022/12/microsoft-reclassifies-spnego-extended.ht…
∗∗∗ Typo3: Neue Fassungen schließen hochriskante Sicherheitslücke ∗∗∗
---------------------------------------------
Angreifer könnten in Typo3 etwa eigenen PHP-Code einschleusen. Mit neuen Versionen schließen die Entwickler diese und weitere Sicherheitslücken.
---------------------------------------------
https://heise.de/-7395790
∗∗∗ Microsoft Patch Tuesday, December 2022 Edition ∗∗∗
---------------------------------------------
Microsoft has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various Windows operating systems and related software.
---------------------------------------------
https://krebsonsecurity.com/2022/12/microsoft-patch-tuesday-december-2022-e…
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (firefox-esr and git), Slackware (mozilla and xorg), SUSE (apache2-mod_wsgi, capnproto, xorg-x11-server, xwayland, and zabbix), and Ubuntu (emacs24, firefox, linux-azure, linux-azure-5.15, linux-azure-fde, linux-oem-6.0, and xorg-server, xorg-server-hwe-18.04, xwayland).
---------------------------------------------
https://lwn.net/Articles/917947/
∗∗∗ Der unsichtbare Feind: Buffer Overflow Schwachstellen in Zyxel Routern nach wie vor problematisch ∗∗∗
---------------------------------------------
https://sec-consult.com/de/blog/detail/enemy-within-unauthenticated-buffer-…
∗∗∗ Drupal Releases Security Updates to Address Vulnerabilities in H5P and File (Field) Paths ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/12/15/drupal-releases-s…
∗∗∗ [R1] Tenable.ad Versions 3.29.4, 3.19.12 and 3.11.9 Fix One Vulnerability ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-27
∗∗∗ Multiple Vulnerabilities in CloudPak for Watson AIOPs ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848189
∗∗∗ Multiple Vulnerabilities in CloudPak for Watson AIOPs ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848195
∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848221
∗∗∗ Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848225
∗∗∗ A vulnerability in Python affects IBM Elastic Storage System (CVE-2022-0391) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848229
∗∗∗ IBM Spectrum Control is vulnerable to multiple weaknesses related to Node [CVE-2022-39353] ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848213
∗∗∗ Vulnerabilities in IBM Java SDK affect IBM Spectrum Control ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847605
∗∗∗ IBM Spectrum Control is vulnerable to multiple weaknesses related IBM WebSphere Application Server Liberty and FasterXML jackson-databind ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847541
∗∗∗ Security vulnerability is addressed with IBM Cloud Pak for Business Automation iFixes for November 2022 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6848295
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 13-12-2022 18:00 − Mittwoch 14-12-2022 18:00
Handler: Robert Waldner
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Microsoft-signed malicious Windows drivers used in ransomware attacks ∗∗∗
---------------------------------------------
Microsoft has revoked several Microsoft hardware developer accounts after drivers signed through their profiles were used in cyberattacks, including ransomware incidents.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-signed-malicious-…
∗∗∗ Open-source repositories flooded by 144,000 phishing packages ∗∗∗
---------------------------------------------
Unknown threat actors have uploaded a total of 144,294 phishing-related packages on the open-source package repositories NuGet, PyPI, and NPM.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/open-source-repositories-flo…
∗∗∗ Input Validation for Website Security ∗∗∗
---------------------------------------------
Web forms are incredibly useful tools. They allow you to gather important information about potential clients and site visitors, collect comments and feedback, upload files, subscribe new users to your blog, or even collect payment details. But if your forms aren’t properly validating user inputs, you might be in for a nasty surprise: a variety of issues can occur if data is uploaded to your site’s environment without specific controls.
---------------------------------------------
https://blog.sucuri.net/2022/12/input-validation-for-website-security.html
∗∗∗ Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities ∗∗∗
---------------------------------------------
Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects.The Go-based tool, powered by the Open Source Vulnerabilities (OSV) database, is designed to connect "a projects list of dependencies with the vulnerabilities that affect them," [..]
---------------------------------------------
https://thehackernews.com/2022/12/google-launches-largest-distributed.html
∗∗∗ New GoTrim Botnet Attempting to Break into WordPress Sites Admin Accounts ∗∗∗
---------------------------------------------
A new Go-based botnet has been spotted scanning and brute-forcing self-hosted websites using the WordPress content management system (CMS) to seize control of the targeted systems."This new brute forcer is part of a new campaign we have named GoTrim because it was written in Go and uses :::trim::: to split data communicated to and from the C2 server,"
---------------------------------------------
https://thehackernews.com/2022/12/new-gotrim-botnet-attempting-to-break.html
∗∗∗ Ade iOS 15: Apple stellt Support auf neueren iPhones offenbar ein ∗∗∗
---------------------------------------------
iPhones ab Baujahr 2017 erhalten Sicherheits-Updates nur noch nach Upgrade auf iOS 16. Lücken in iOS 15 werden laut Apple aktiv ausgenutzt.
---------------------------------------------
https://heise.de/-7394913
∗∗∗ BSI-Magazin mit Schwerpunkt "Ransomware" veröffentlicht ∗∗∗
---------------------------------------------
Die zweite Ausgabe des BSI-Magazins "Mit Sicherheit" in diesem Jahr ist erschienen. Das BSI stellt in diesem BSI-Magazin eine der aktuell größten Bedrohungen für die IT-Sicherheit in einem Sonderteil in den Mittelpunkt: Ransomware. [..] Weitere Themen sind Automotive Security, der Digitale Verbraucherschutz sowie die Zusammenarbeit von BSI und NATO zur Gestaltung der Cloud-Sicherheit im Bündnis. Außerdem gibt es im neuen BSI-Magazin eine neue Checkliste mit Tipps für ein sicheres Heimnetzwerk.
---------------------------------------------
https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldunge…
∗∗∗ NSA, CISA, and ODNI Release Guidance on Potential Threats to 5G Network Slicing ∗∗∗
---------------------------------------------
Original release date: December 13, 2022Today, the National Security Agency (NSA), CISA, and the Office of the Director of National Intelligence (ODNI), published Potential Threats to 5G Network Slicing. This guidance—created by the Enduring Security Framework (ESF), a public-private cross-sector working group led by the NSA and CISA—presents both the benefits and risks associated with 5G network slicing. It also provides mitigation strategies that address potential threats to 5G network slicing.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/12/13/nsa-cisa-and-odni…
=====================
= Vulnerabilities =
=====================
∗∗∗ Vulnerabilities found on Arcadyan Routers ∗∗∗
---------------------------------------------
The two vulnerabilities were found by Asher Davila L. in Arcadyan wireless modems with model number VRV9506JAC23. It is probable that they are also present in other Arcadyan models as well because their web interfaces are similar and they have common features. The following are the two found vulnerabilities:
* CVE-2020-9420: Cleartext transmission of sensitive information
* CVE-2020-9419: Stored cross-site scripting
---------------------------------------------
https://gist.github.com/AsherDLL/03d0762b5a535e300f1121caebe333ce
∗∗∗ Webbrowser: Chrome-Update dichtet acht Sicherheitslecks ab ∗∗∗
---------------------------------------------
Google hat eine aktualisierte Version des Webbrowsers Chrome bereitgestellt. Sie schließt mindestens vier hochriskante Sicherheitslücken.
---------------------------------------------
https://heise.de/-7394554
∗∗∗ VMSA-2022-0032: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware Cloud Foundation (Cloud Foundation) ∗∗∗
---------------------------------------------
Synopsis: VMware Workspace ONE Access and Identity Manager updates address multiple vulnerabilities (CVE-2022-31700, CVE-2022-31701).
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0032.html
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (pngcheck), Fedora (qemu), Mageia (admesh, busybox, emacs, libarchive, netkit-telnet, ruby, rxvt-unicode, and shadowutils), Oracle (bcel and kernel), Red Hat (389-ds-base, bcel, dbus, firefox, grub2, kernel, kernel-rt, kpatch-patch, thunderbird, and usbguard), Scientific Linux (bcel), SUSE (containerd, firefox, grafana, java-1_8_0-openjdk, libtpms, net-snmp, and wireshark), and Ubuntu (pillow).
---------------------------------------------
https://lwn.net/Articles/917839/
∗∗∗ Adobe Patches 38 Flaws in Enterprise Software Products ∗∗∗
---------------------------------------------
After skipping last month, Adobe returned to its scheduled Patch Tuesday cadence with the release of fixes for at least 38 vulnerabilities in multiple enterprise-facing products.The San Jose, California software maker said the flaws could expose users to code execution and privilege escalation attacks across all computer platforms.
---------------------------------------------
https://www.securityweek.com/adobe-patches-38-flaws-enterprise-software-pro…
∗∗∗ ICS Patch Tuesday: Siemens Fixes 80 OpenSSL, OpenSSH Flaws in Switches ∗∗∗
---------------------------------------------
Industrial giants Siemens and Schneider Electric have addressed over 140 vulnerabilities with their December 2022 Patch Tuesday updates.Siemensread more
---------------------------------------------
https://www.securityweek.com/ics-patch-tuesday-siemens-fixes-80-openssl-ope…
∗∗∗ Apple Releases Security Updates for Multiple Products ∗∗∗
---------------------------------------------
Original release date: December 13, 2022Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device.CISA encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:
iCloud for Windows 14.1
Safari 16.2
macOS Monterey 12.6.2
macOS Big Sur 11.7.2
tvOS 16.2
watchOS 9.2
iOS 15.7.2 and iPadOS 15.7.2
iOS 16.2 and iPadOS 16.2
macOS Ventura 13.1
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/12/13/apple-releases-se…
∗∗∗ Sonicwall Capture Client Local Privilege Escalation via SentinelOne Agent (Aikido) ∗∗∗
---------------------------------------------
An arbitrary file deletion vulnerability (Aikido) in Sonicwall Capture Client via SentinelOne Agent could allow a local attacker to escalate privileges and delete files. The exploit was confirmed to work with 6 vulnerable EDR products, including the SentinelOne Agent for Windows.Please note: an attacker must first obtain low-privileged access on the target system in order to exploit this vulnerability.
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0025
∗∗∗ Cisco Identity Services Engine Unauthorized File Access Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-056/
∗∗∗ NVIDIA GPU Display Driver Advisory - November 2022 ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500536-NVIDIA-GPU-DISPLAY-DRIV…
∗∗∗ Vulnerabilities in Linux Kernel, Golang Go, and cURL libcurl may affect IBM Spectrum Protect Plus ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847643
∗∗∗ Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2022-34165) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847655
∗∗∗ Vulnerabilities in zlib and Golang Go may affect the IBM Spectrum Protect Server (CVE-2018-25032, CVE-2022-27664) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847653
∗∗∗ IBM Copy Services Manager is vulnerable to a remote attack vulnerabilities due to IBM WebSphere Application Server Liberty vulnerabilities (CVE-2022-22476) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847789
∗∗∗ IBM Tivoli Netcool\/OMNIbus Transport Module Common Integration Library is affected by vulnerability in Apache Kafka (CVE-2022-34917) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847829
∗∗∗ IBM Tivoli Netcool\/OMNIbus Probe and Integrations Library are affected by vulnerabilities in FasterXML jackson-databind (CVE-2022-42004, CVE-2022-42003) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6846525
∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847939
∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847945
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 12-12-2022 18:00 − Dienstag 13-12-2022 18:00
Handler: Stephan Richter
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Amazon ECR Public Gallery flaw could have wiped or poisoned any image ∗∗∗
---------------------------------------------
The researcher reported the vulnerability to AWS Security on November 15, 2022, and Amazon rolled out a fix in under 24 hours.
While there are no signs of this flaw being abused in the wild, threat actors could have used it in massive-scale supply chain attacks against many users.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/amazon-ecr-public-gallery-fl…
∗∗∗ IIS modules: The evolution of web shells and how to detect them ∗∗∗
---------------------------------------------
This blog aims to provide further guidance on detecting malicious IIS modules and other capabilities that you can use during your own incident response investigations.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-ev…
∗∗∗ A Deep Dive into BianLian Ransomware ∗∗∗
---------------------------------------------
BianLian ransomware is a Golang malware that performed targeted attacks across multiple industries in 2022. The ransomware employed anti-analysis techniques consisting of API calls that would likely crash some sandboxes/automated analysis systems. The malware targets all drives identified on the machine and deletes itself after the encryption is complete.
---------------------------------------------
https://resources.securityscorecard.com/research/bian-lian-deep-dive
∗∗∗ New Python-Based Backdoor Targeting VMware ESXi Servers ∗∗∗
---------------------------------------------
Security researchers with Juniper Networks’ Threat Labs warn of a new Python-based backdoor targeting VMware ESXi virtualization servers. The targeted servers were impacted by known security defects (such as CVE-2019-5544 and CVE-2020-3992) that were likely used for initial compromise, but what caught the researchers’ attention was the simplicity, persistence, and capabilities of the deployed backdoor.
---------------------------------------------
https://www.securityweek.com/new-python-based-backdoor-targeting-vmware-esx…
∗∗∗ What’s My Name Again? Reolink camera command injection ∗∗∗
---------------------------------------------
TL;DR Research on Reolink’s RLC-520A smart motion detection camera has turned up an authenticated command injection vulnerability. Exploiting this vulnerability with an injected system command can render the device useless.
---------------------------------------------
https://www.pentestpartners.com/security-blog/whats-my-name-again-reolink-c…
∗∗∗ Aktuelle Welle an DDoS Angriffen auf staatsnahe und kritische Infrastruktur in Österreich ∗∗∗
---------------------------------------------
Seit ca. zwei Wochen sehen sich vermehrt österreichische staatliche/staatsnahe Organisationen sowie Unternehmen der kritischen Infrastruktur mit DDoS Angriffen konfrontiert. Die genauen Hintergründe und Motive der Attacken sind uns zurzeit nicht bekannt. Die Täter:innen greifen hierbei zu verschiedenen Methoden und versuchen auch, sich an getroffene Gegenmaßnahmen anzupassen.
---------------------------------------------
https://cert.at/de/aktuelles/2022/12/aktuelle-welle-an-ddos-angriffen-auf-s…
∗∗∗ REPORT: A new trick from Facebook scammers and Sharkbot Android malware returns ∗∗∗
---------------------------------------------
A new wave of scams utilizes Facebook’s tagging feature to trick Page owners into believing they’ve violated Facebook’s terms and conditions. Several variations of the attack exist, but all lead to phishing sites designed to steal Page owner’s credentials.
---------------------------------------------
https://blog.f-secure.com/f-alert-report-a-new-trick-from-facebook-scammers…
=====================
= Vulnerabilities =
=====================
∗∗∗ Redmine vulnerable to cross-site scripting ∗∗∗
---------------------------------------------
Redmine contains a cross-site scripting vulnerability.
---------------------------------------------
https://jvn.jp/en/jp/JVN60211811/
∗∗∗ Announcing TYPO3 12.1.1 [12.1.2], 11.5.20 and 10.4.33 security releases ∗∗∗
---------------------------------------------
today weve released TYPO3 12.1.1, 11.5.20 LTS and 10.4.33 LTS, which are ready for you to download. All versions are security releases and contain important security fixes [unfortunately TYPO3 v12.1.1 contained a regression, which has been fixed in TYPO3 v12.1.2.]
---------------------------------------------
https://lists.typo3.org/pipermail/typo3-announce/2022/000523.html
∗∗∗ Vulnerabilities in multiple third party TYPO3 CMS extensions ∗∗∗
---------------------------------------------
several vulnerabilities have been found in the following third party TYPO3 extensions:
* "Change password for frontend users" (fe_change_pwd)
* "Newsletter subscriber management" (fp_newsletter)
* "Master-Quiz" (fp_masterquiz)
For further information on the issues, please read the related advisories TYPO3-EXT-SA-2022-016, TYPO3-EXT-SA-2022-017 and TYPO3-EXT-SA-2022-018 which were published today
---------------------------------------------
https://lists.typo3.org/pipermail/typo3-announce/2022/000524.html
∗∗∗ OpenSSL: X.509 Policy Constraints Double Locking (CVE-2022-3996) ∗∗∗
---------------------------------------------
Severity: Low
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup.
---------------------------------------------
https://www.openssl.org/news/secadv/20221213.txt
∗∗∗ Patchday SAP: 14 neue Sicherheitsmeldungen im Dezember ∗∗∗
---------------------------------------------
Zum Jahresende behandelt SAP in 14 Sicherheitsnotizen Schwachstellen in der Software des Unternehmens. IT-Verantwortliche sollten die Updates rasch anwenden.
---------------------------------------------
https://heise.de/-7392718
∗∗∗ Jetzt patchen! Kritische Zero-Day-Lücke in FortiOS wird angegriffen ∗∗∗
---------------------------------------------
Fortinet meldet eine kritische Sicherheitslücke in FortiOS. Cyberkriminelle missbrauchen diese bereits für Angriffe. Updates stehen bereit.
---------------------------------------------
https://heise.de/-7392455
∗∗∗ VMSA-2022-0031 ∗∗∗
---------------------------------------------
Synopsis: VMware vRealize Network Insight (vRNI) updates address command injection and directory traversal security vulnerabilities (CVE-2022-31702, CVE-2022-31703)
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0031.html
∗∗∗ VMSA-2022-0033 ∗∗∗
---------------------------------------------
Synopsis: VMware ESXi, Workstation, and Fusion updates address a heap out-of-bounds write vulnerability (CVE-2022-31705)
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0033.html
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (node-tar and pngcheck), SUSE (colord, containerd, and tiff), and Ubuntu (containerd, linux-azure, linux-azure, linux-azure-5.4, linux-oem-5.17, and vim).
---------------------------------------------
https://lwn.net/Articles/917749/
∗∗∗ Security Vulnerabilities fixed in Thunderbird 102.6 ∗∗∗
---------------------------------------------
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-53/
∗∗∗ Security Vulnerabilities fixed in Firefox ESR 102.6 ∗∗∗
---------------------------------------------
CVE-2022-46880: Use-after-free in WebGL
CVE-2022-46872: Arbitrary file read from a compromised content process
CVE-2022-46881: Memory corruption in WebGL
CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
CVE-2022-46882: Use-after-free in WebGL
CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/
∗∗∗ Security Vulnerabilities fixed in Firefox 108 ∗∗∗
---------------------------------------------
CVE-2022-46871: libusrsctp library out of date
CVE-2022-46872: Arbitrary file read from a compromised content process
CVE-2022-46873: Firefox did not implement the CSP directive unsafe-hashes
CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
CVE-2022-46877: Fullscreen notification bypass
CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6
CVE-2022-46879: Memory safety bugs fixed in Firefox 108
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-51/
∗∗∗ Citrix ADC and Citrix Gateway Security Bulletin for CVE-2022-27518 ∗∗∗
---------------------------------------------
A vulnerability has been discovered in Citrix Gateway and Citrix ADC, listed below, that, if exploited, could allow an unauthenticated remote attacker to perform arbitrary code execution on the appliance.
CVE-ID: CVE-2022-27518
---------------------------------------------
https://support.citrix.com/article/CTX474995/citrix-adc-and-citrix-gateway-…
∗∗∗ Privilege Escalation Schwachstellen (UNIX Insecure File Handling) in SAP® Host Agent (saposcol) ∗∗∗
---------------------------------------------
Due to insecure file handling issues of the SAP® Host Agent, a local attacker can exploit the helper binary saposcol to escalate privileges on UNIX systems. Successful exploitation leads to full system compromise with root access.
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/privilege-escalation-…
∗∗∗ ICS Advisory (ICSA-22-347-03): Contec CONPROSSYS HMI System (CHS) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-03
∗∗∗ ICS Advisory (ICSA-22-347-02): Schneider Electric APC Easy UPS Online ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-02
∗∗∗ ICS Advisory (ICSA-22-347-01): ICONICS and Mitsubishi Electric Products ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-347-01
∗∗∗ Wiesemann & Theis multiple products prone to web interface vulnerability ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-057/
∗∗∗ Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in multiple products ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-038/
∗∗∗ A vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Scale packaged in IBM Elastic Storage Server ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847315
∗∗∗ AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6619729
∗∗∗ IBM QRadar Network Packet Capture has released 7.3.1 Patch 1, and 7.2.8 Patch 1 in response to the vulnerabilities known as Spectre and Meltdown. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/571419
∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact (CVE-2021-41041, CVE-2022-3676) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847341
∗∗∗ Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847351
∗∗∗ Multiple vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM Tivoli Netcool Impact (CVE-2022-24839, CVE-2022-37734, CVE-2022-34165) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847349
∗∗∗ Multiple vulnerabilities have been identified in Smack API shipped with IBM Tivoli Netcool Impact (CVE-2014-0363, CVE-2014-0364) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847337
∗∗∗ Multiple Linux Kernel vulnerabilities may affect IBM Elastic Storage System ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847563
∗∗∗ WebSphere Application Server is vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests which affects Content Collector for Email ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847593
∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847591
∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847587
∗∗∗ Content Collector for Email is affected by a vulnerability found in embedded WebSphere Application Server ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6847595
∗∗∗ Vulnerability in OAuthlib affects IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-36087) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6842215
∗∗∗ Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/6842235
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 09-12-2022 18:00 − Montag 12-12-2022 18:00
Handler: Robert Waldner
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Clop ransomware partners with TrueBot malware for access to networks ∗∗∗
---------------------------------------------
Security researchers have noticed a spike in devices infected with the TrueBot malware downloader created by a Russian-speaking hacking group known as Silence.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/clop-ransomware-partners-wit…
∗∗∗ Popular WAFs Subverted by JSON Bypass ∗∗∗
---------------------------------------------
Web application firewalls from AWS, Cloudflare, F5, Imperva, and Palo Alto Networks are vulnerable to a database attack using the popular JavaScript Object Notation (JSON) format.
---------------------------------------------
https://www.darkreading.com/application-security/popular-wafs-json-bypass
∗∗∗ On-device WebAuthn and what makes it hard to do well ∗∗∗
---------------------------------------------
WebAuthn improves login security a lot by making it significantly harder for a users credentials to be misused - a WebAuthn token will only respond to a challenge if its issued by the site a secret was issued to, and in general will only do so if the user provides proof of physical presence[1]. But giving people tokens is tedious and also I have a new laptop which only has USB-C but does have a working fingerprint reader and I [...]
---------------------------------------------
https://mjg59.dreamwidth.org/62746.html
∗∗∗ Hack-for-Hire Group Targets Travel and Financial Entities with New Janicab Malware Variant ∗∗∗
---------------------------------------------
Travel agencies have emerged as the target of a hack-for-hire group dubbed Evilnum as part of a broader campaign aimed at legal and financial investment institutions in the Middle East and Europe. The attacks, which took place during 2020 and 2021 and likely went as far back as 2015, involved a revamped variant of a malware called Janicab that leverages a number of public services like WordPress [...]
---------------------------------------------
https://thehackernews.com/2022/12/hack-for-hire-group-targets-travel-and.ht…
∗∗∗ Log4j’s Log4Shell Vulnerability: One Year Later, It’s Still Lurking ∗∗∗
---------------------------------------------
Despite mitigation, one of the worst bugs in internet history is still prevalent—and being exploited.
---------------------------------------------
https://www.wired.com/story/log4j-log4shell-one-year-later/
∗∗∗ Practically-exploitable Cryptographic Vulnerabilities in Matrix ∗∗∗
---------------------------------------------
We report several practically-exploitable cryptographic vulnerabilities in the end-to-end encryption in Matrix and describe proof-of-concept attacks exploiting these vulnerabilities. [...] Whilst the language of the paper and this website is in present tense, many of the vulnerabilities disclosed have been fixed. See our paper (or Matrix’ website) for more details.
---------------------------------------------
https://nebuchadnezzar-megolm.github.io/
∗∗∗ Cisco Working on Patch for Publicly Disclosed IP Phone Vulnerability ∗∗∗
---------------------------------------------
Cisco informed customers on Thursday that it’s working on patches for a high-severity vulnerability affecting some of its IP phones.
---------------------------------------------
https://www.securityweek.com/cisco-working-patch-publicly-disclosed-ip-phon…
∗∗∗ So schützen Sie sich vor problematischen Online-Shops ∗∗∗
---------------------------------------------
Immer wieder werden uns Online-Shops gemeldet, die zwar keine Fake-Shops, aber trotzdem problematisch sind. Lieferzeiten werden nicht eingehalten, die Qualität der Produkte lässt zu wünschen übrig, oder es kommt zu hohen Zoll- oder Retourenkosten. Wir zeigen Ihnen, worauf Sie achten müssen, um keine bösen Überraschungen beim Online-Shopping zu erleben!
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-problemati…
∗∗∗ So schützen Sie sich vor Abo-Fallen im Internet ∗∗∗
---------------------------------------------
Auch im Internet hat niemand etwas zu verschenken! Lassen Sie Vorsicht walten bei Angeboten, die zu gut sind, um wahr zu sein. Diese „Angebote“ nutzen Kriminelle, um Sie in die Falle zu locken. Wenn Sie bemerken, dass Geldbeträge ohne Ihre Zustimmung von Ihrem Konto abgebucht werden, handelt es sich möglicherweise um eine Abo-Falle!
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-abo-fallen…
∗∗∗ Was tun, wenn Sie in eine Abo-Falle getappt sind? ∗∗∗
---------------------------------------------
Auf der Suche nach kostenlosen Angeboten und gratis Testversionen werden Sie im Internet schnell fündig. Doch Vorsicht: Hier ist nicht alles Gold, was glänzt! Oft handelt es sich nämlich um Abo-Fallen, bei denen Ihnen unbegründet Rechnungen zugeschickt oder Geldbeträge vom Konto abgebucht werden und man Ihnen mit Inkassobüros oder Rechtsanwaltsschreiben droht. Die Lösung? Auf keinen Fall bezahlen!
---------------------------------------------
https://www.watchlist-internet.at/news/was-tun-wenn-sie-in-eine-abo-falle-g…
∗∗∗ Precious Gemstones: The New Generation of Kerberos Attacks ∗∗∗
---------------------------------------------
Unit 42 researchers show new methods to improve detection of a next-gen line of Kerberos attacks, which allow attackers to modify Kerberos tickets to maintain privileged access.
---------------------------------------------
https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/
=====================
= Vulnerabilities =
=====================
∗∗∗ FortiOS - heap-based buffer overflow in sslvpnd ∗∗∗
---------------------------------------------
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Fortinet is aware of an instance where this vulnerability was exploited in the wild, and recommends immediately validating your systems against the following indicators of compromise: [...]
---------------------------------------------
https://www.fortiguard.com/psirt/FG-IR-22-398
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (cacti, grub2, hsqldb, node-eventsource, and openexr), Fedora (bcel, keylime, rust-capnp, rust-sequoia-octopus-librnp, xfce4-screenshooter, and xfce4-settings), Oracle (nodejs:18), Scientific Linux (grub2), Slackware (libarchive), SUSE (go1.18, go1.19, nautilus, opera, python-slixmpp, and samba), and Ubuntu (python2.7, python3.5, qemu, and squid3).
---------------------------------------------
https://lwn.net/Articles/917690/
∗∗∗ IFM: weak password recovery vulnerability in moneo appliance ∗∗∗
---------------------------------------------
Summary: An unauthenticated remote attacker could reset the administrators password with information from the default, self-signed certificate.
Impact: An unathenticated attacker can remotely reset the administrator password.
Solution:
Mitigation: The certificate is renewed by adjusting the hostname to an own customer-specific, so it does not contain the serial number.
Remediation: The password-reset mechanism will be updated in a future version.
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-050/
∗∗∗ IBM Security Bulletins 2022-12-09 - 2022-12-12 ∗∗∗
---------------------------------------------
Apache Commons HttpClient 3.x (and few others), Apache POI, IBM App Connect Enterprise, IBM® Db2® Net Search Extender, IBM Elastic Storage System, IBM Engineering Workflow Management (EWM), IBM InfoSphere Information Server, IBM Spectrum Copy Data Management, IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Virtual Environments, IBM Spectrum Scale packaged in IBM Elastic Storage Server, IBM Spectrum Scale packaged in IBM Elastic Storage System, IBM Tivoli Application Dependency Discovery Manager (TADDM), Rational Team Concert (RTC), z/Transaction Processing Facility
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ Intel Data Center Manager 5.1 Local Privilege Escalation ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022120027
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 07-12-2022 18:00 − Freitag 09-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Unsichtbare npm-Malware umgeht Sicherheitsprüfungen mit manipulierten Versionen ∗∗∗
---------------------------------------------
JFrog hat ein unerwartetes Verhalten der npm-Werkzeuge entdeckt: Für Pakete bestimmter Versionsformate zeigen sie wohl keine sicherheitsrelevanten Hinweise an.
---------------------------------------------
https://heise.de/-7372357
∗∗∗ So schützen Sie sich vor Fake-Shops ∗∗∗
---------------------------------------------
Fake-Shops locken mit gutem Design und unschlagbaren Preisen in die Falle. Doch wie erkennen Sie Fake-Shops und andere betrügerische Online-Shops, bevor es zu spät ist? Hier beschreiben wir hier die gängigsten Formen von Fake-Shops und ihre Erkennungsmerkmale. Ein Einkauf in einem Fake-Shop kann Sie nämlich wahrlich teuer zu stehen kommen.
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-fake-shops/
∗∗∗ Ransomware: Löschen statt entschlüsseln ∗∗∗
---------------------------------------------
Die defekte Ransomware Cryptonite kann Ihre Dateien nicht entschlüsseln, selbst wenn Sie das Lösegeld bezahlen. Stattdessen werden alle Daten einfach gelöscht.
---------------------------------------------
https://www.zdnet.de/88405737/ransomware-loeschen-statt-entschluesseln/
∗∗∗ New Zombinder platform binds Android malware with legitimate apps ∗∗∗
---------------------------------------------
A darknet platform dubbed Zombinder allows threat actors to bind malware to legitimate Android apps, causing victims to infect themselves while still having the full functionality of the original app to evade suspicion.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-zombinder-platform-binds…
∗∗∗ Hacked corporate email accounts used to send MSP remote access tool ∗∗∗
---------------------------------------------
MuddyWater hackers, a group associated with Irans Ministry of Intelligence and Security (MOIS), used compromised corporate email accounts to deliver phishing messages to their targets.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hacked-corporate-email-accou…
∗∗∗ DeathStalker targets legal entities with new Janicab variant ∗∗∗
---------------------------------------------
While hunting for less common Deathstalker intrusions, we identified a new Janicab variant used in targeting legal entities in the Middle East throughout 2020.
---------------------------------------------
https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab…
∗∗∗ How to train your Ghidra ∗∗∗
---------------------------------------------
Brief introduction to setting up Ghidra, and then configuring it with a familiar UI and shortcuts, so that you would not need to re-learn all the key sequences you have got used to over the years.
---------------------------------------------
https://securelist.com/how-to-train-your-ghidra/108272/
∗∗∗ Finding Gaps in Syslog - How to find when nothing happened, (Wed, Dec 7th) ∗∗∗
---------------------------------------------
I recently got a call from a client, they had an outage that required a firewall reboot, but couldn't give me an exact clock time. They were looking for anything in the logs just prior to that reboot that might indicate a carrier issue, as they had experienced a few outages like this recently.
---------------------------------------------
https://isc.sans.edu/diary/rss/29314
∗∗∗ Port Scanning in Powershell Redux: Speeding Up the Results (challenge accepted!), (Fri, Dec 9th) ∗∗∗
---------------------------------------------
In the story I wrote in October about using PowerShell for Port Scanning (https://isc.sans.edu/diary/29202), I noted that the basic "test-connect" operation made for a pretty slow port scanner, which seems to be the message that everyone latched onto. Of course, my immediate response was "challenge accepted!", so let's go - let's make that operation faster!
---------------------------------------------
https://isc.sans.edu/diary/rss/29324
∗∗∗ Trojanized OneNote Document Leads to Formbook Malware ∗∗∗
---------------------------------------------
Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and through this ongoing research, we uncovered threat actors using a OneNote document to move Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-…
∗∗∗ Compromised Cloud Compute Credentials: Case Studies From the Wild ∗∗∗
---------------------------------------------
A walk-through of attacks in the wild that abuse stolen cloud compute credentials in the cloud environment. Unit 42 researchers highlight two case studies.
---------------------------------------------
https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
∗∗∗ Fantasy - a new Agrius wiper deployed through a supply‑chain attack ∗∗∗
---------------------------------------------
ESET researchers analyzed a supply-chain attack abusing an Israeli software developer to deploy Fantasy, Agrius’s new wiper, with victims including the diamond industry
---------------------------------------------
https://www.welivesecurity.com/2022/12/07/fantasy-new-agrius-wiper-supply-c…
∗∗∗ On hacking forums, even the scammers aren’t safe ∗∗∗
---------------------------------------------
Cybercriminals use a range of techniques to steal victims’ money — from developing malicious software to siphon financial data to old-fashioned “rip-and-runs” — but that doesn’t mean they’re immune to falling for these scams themselves. Scammers scamming scammers, including sometimes the scammers who have scammed them, is “an entire sub-economy” on darknet marketplaces, according to [...]
---------------------------------------------
https://therecord.media/on-hacking-forums-even-the-scammers-arent-safe/
∗∗∗ OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning ∗∗∗
---------------------------------------------
After a CVE on open source software has been discovered and a fix has been released, a fruitful practice for security researchers is to go deep into the nature of the CVE and the fix.
---------------------------------------------
https://checkmarx.com/blog/openssl-cve-2022-3786-food-for-thought-on-the-im…
=====================
= Vulnerabilities =
=====================
∗∗∗ Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol Stack Overflow Vulnerability ∗∗∗
---------------------------------------------
A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device. This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol traffic to an affected device.
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ IBM Security Bulletins 2022-12-05 ∗∗∗
---------------------------------------------
IBM App Connect Enterprise, IBM Cloud Transformation Advisor, IBM Event Streams, IBM InfoSphere Information Server, IBM Power System, IBM QRadar SIEM, IBM Rational Functional Tester, IBM Rational Test Automation Server, IBM Spectrum Scale, IBM Sterling Secure Proxy, IBM Watson Developer Cloud
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ IBM Security Bulletins 2022-12-06 ∗∗∗
---------------------------------------------
IBM Business Automation Workflow, IBM Content Navigator, IBM Operations Analytics, IBM Rational Business Developer, IBM SPSS Collaboration and Deployment Services, IBM Security SiteProtector System, IBM Sterling External Authentication Server, IBM Tivoli Application Dependency Discovery Manager, IBM Tivoli Business Service Manager, IBM Tivoli Composite Application Manager for Transactions, IBM WebSphere Application Server
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ IBM Security Bulletins 2022-12-07 ∗∗∗
---------------------------------------------
AIX, HMC, IBM Business Automation Workflow Event Emitters, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Data Risk Manager, IBM Enterprise Content Management System Monitor, IBM Match 360, IBM PowerVM Novalink, IBM Virtualization Engine TS7700, IBM Watson Assistant for IBM Cloud Pak for Data
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ IBM Security Bulletins 2022-12-08 ∗∗∗
---------------------------------------------
AIX, IBM API Connect, IBM CICS Transaction Gateway, IBM Cloud Transformation Advisor, IBM InfoSphere Information Server, IBM MQ, IBM PowerVM Novalink, IBM Security Verify
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ IBM Security Bulletins 2022-12-09 ∗∗∗
---------------------------------------------
IBM App Connect Enterprise Certified Container, IBM Security Verify Governance, IBM Spectrum Copy Data Management, IBM Spectrum Protect for Space Management Client, IBM Tivoli Application Dependency Discovery Manager, z/Transaction Processing Facility
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
∗∗∗ VMSA-2022-0030 ∗∗∗
---------------------------------------------
VMware ESXi and vCenter Server updates address multiple security vulnerabilities (CVE-2022-31696, CVE-2022-31697, CVE-2022-31698, CVE-2022-31699)
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0030.html
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (dlt-daemon, jqueryui, and virglrenderer), Fedora (firefox, vim, and woff), Oracle (kernel and nodejs:18), Red Hat (java-1.8.0-ibm and redhat-ds:11), Slackware (python3), SUSE (buildah, matio, and osc), and Ubuntu (heimdal and postgresql-9.5).
---------------------------------------------
https://lwn.net/Articles/917398/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (leptonlib), Fedora (woff), Red Hat (grub2), Slackware (emacs), SUSE (busybox, chromium, java-1_8_0-openjdk, netatalk, and rabbitmq-server), and Ubuntu (gcc-5, gccgo-6, glibc, protobuf, and python2.7, python3.10, python3.6, python3.8).
---------------------------------------------
https://lwn.net/Articles/917530/
∗∗∗ Synology-SA-22:23 PWN2OWN TORONTO 2022 ∗∗∗
---------------------------------------------
Multiple vulnerabilities reported by PWN2OWN TORONTO 2022 have been addressed.
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_23
∗∗∗ AMI MegaRAC SP-X BMC Vulnerabilities ∗∗∗
---------------------------------------------
https://support.lenovo.com/product_security/PS500535-AMI-MEGARAC-SP-X-BMC-V…
∗∗∗ Security Advisory - Denial of Service Vulnerability in Huawei Smart WiFi Router ∗∗∗
---------------------------------------------
https://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-dosvihsw…
∗∗∗ K87046687: VMware Tools vulnerability CVE-2022-31676 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K87046687
∗∗∗ Advantech iView ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-342-01
∗∗∗ AVEVA InTouch Access Anywhere ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-342-02
∗∗∗ Rockwell Automation Logix controllers ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-342-03
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 06-12-2022 18:00 − Mittwoch 07-12-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ For Cyberattackers, Popular EDR Tools Can Turn into Destructive Data Wipers ∗∗∗
---------------------------------------------
Microsoft, three others release patches to fix a vulnerability in their respective products that enables such manipulation. Other EDR products potentially are affected as well.
---------------------------------------------
https://www.darkreading.com/vulnerabilities-threats/cyberattackers-popular-…
∗∗∗ DEV-0139 launches targeted attacks against the cryptocurrency industry ∗∗∗
---------------------------------------------
Microsoft security researchers investigate an attack where the threat actor, tracked DEV-0139, used chat groups to target specific cryptocurrency investment companies and run a backdoor within their network.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-…
∗∗∗ New Go-based Botnet Exploiting Exploiting Dozens of IoT Vulnerabilities to Expand its Network ∗∗∗
---------------------------------------------
A novel Go-based botnet called Zerobot has been observed in the wild proliferating by taking advantage of nearly two dozen security vulnerabilities in the internet of things (IoT) devices and other software.
---------------------------------------------
https://thehackernews.com/2022/12/new-go-based-zerobot-botnet-exploiting.ht…
∗∗∗ ChatGPT shows promise of using AI to write malware ∗∗∗
---------------------------------------------
For even the most skilled hackers, it can take at least an hour to write a script to exploit a software vulnerability and infiltrate their target. Soon, a machine may be able to do it in mere seconds.
---------------------------------------------
https://www.cyberscoop.com/chatgpt-ai-malware/
∗∗∗ So schützen Sie sich vor Scams ∗∗∗
---------------------------------------------
Beim Scamming - auch Vorschussbetrug genannt - versuchen Kriminelle, Sie zu einer Vorauszahlung zu drängen. Sie werden beispielsweise mit einem Millionengewinn, einer Erbschaft oder einem günstigen Kreditangebot geködert.
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-scams/
∗∗∗ OpenSSL punycode – with hindsight ∗∗∗
---------------------------------------------
The next Heartbleeds were about to be announced, two critical vulnerabilities that affect everyone and everything, everywhere. And then they were released. And everyone was let down.
---------------------------------------------
https://blog.checkpoint.com/2022/12/07/openssl-punycode-with-hindsight/
∗∗∗ Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE) ∗∗∗
---------------------------------------------
In August, the ASEC analysis team made a post on the malware being distributed with filenames that utilize RTLO (Right-To-Left Override).
---------------------------------------------
https://asec.ahnlab.com/en/43518/
∗∗∗ Industry 4.0: CNC Machine Security Risks Part 3 ∗∗∗
---------------------------------------------
This three-part blog series explores the risks associated with CNC machines
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/cnc-machine-security-risks-p…
=====================
= Vulnerabilities =
=====================
∗∗∗ Fortinet schließt Sicherheitslücken in mehreren Produkten ∗∗∗
---------------------------------------------
Für zahlreiche Produkte aus dem Portfolio hat Fortinet Sicherheitsupdates herausgegeben. Sie schließen teils hochriskante Schwachstellen.
---------------------------------------------
https://heise.de/-7368520
∗∗∗ Dienste-Monitoring: Angreifer können Cacti beliebigen Code unterschieben ∗∗∗
---------------------------------------------
In der Webanwendung Cacti, die etwa zur Diensteüberwachung dient, könnten Angreifer beliebigen Code einschleusen und ausführen. Ein Patch ist verfügbar.
---------------------------------------------
https://heise.de/-7369455
∗∗∗ Jetzt patchen: Fehlkonfiguration in Netgear-Router lässt Angreifer auf das Gerät ∗∗∗
---------------------------------------------
Forscher warnen vor Fremdzugriffen auf den Nighthawk WiFi 6 Router von Netgear. Ein Update ist verfügbar, soll sich aber nicht automatisch installieren.
---------------------------------------------
https://heise.de/-7369071
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (cgal, ruby-rails-html-sanitizer, and xfce4-settings), Red Hat (dbus, grub2, kernel, pki-core, and usbguard), Scientific Linux (pki-core), SUSE (bcel, LibVNCServer, and xen), and Ubuntu (ca-certificates and u-boot).
---------------------------------------------
https://lwn.net/Articles/917208/
∗∗∗ Cross-Site Scripting in Handy Macros for Confluence (SYSS-2022-049) ∗∗∗
---------------------------------------------
Durch eine Cross-Site Scripting-Schwachstelle im "Handy Tip"-Makro in Handy Macros for Confluence kann ausführbarer Schadcode in Seiten eingebaut werden.
---------------------------------------------
https://www.syss.de/pentest-blog/cross-site-scripting-in-handy-macros-for-c…
∗∗∗ K35253541: Java vulnerabilities CVE-2020-14779, CVE-2020-14781, CVE-2020-14782, CVE-2020-14797 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K35253541
∗∗∗ K71522481: Java vulnerability CVE-2021-2163 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K71522481
∗∗∗ Sprecher SPRECON-E-C/-E-P/-E-T3: Schwachstelle in der Firmwareverifikation ∗∗∗
---------------------------------------------
https://www.sprecher-automation.com/it-sicherheit/security-alerts
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 05-12-2022 18:00 − Dienstag 06-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Hackers hijack Linux devices using PRoot isolated filesystems ∗∗∗
---------------------------------------------
Hackers are abusing the open-source Linux PRoot utility in BYOF (Bring Your Own Filesystem) attacks to provide a consistent repository of malicious tools that work on many Linux distributions.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-hijack-linux-devices…
∗∗∗ Sneaky hackers reverse defense mitigations when detected ∗∗∗
---------------------------------------------
A financially motivated threat actor is hacking telecommunication service providers and business process outsourcing firms, actively reversing defensive mitigations applied when the breach is detected.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/sneaky-hackers-reverse-defen…
∗∗∗ Mirai Botnet and Gafgyt DDoS Team Up Against SOHO Routers., (Tue, Dec 6th) ∗∗∗
---------------------------------------------
Since 2014, self-replicating variants of DDoS attacks against routers and Linux-based IoT devices have been rampant. Gafgyt botnets target vulnerable IoT devices and use them to launch large-scale distributed denial-of-service attacks. SOHO and IoT devices are ubiquitous, less likely to have secure configurations or routine patches, and more likely to be at the internet edge.
---------------------------------------------
https://isc.sans.edu/diary/rss/29304
∗∗∗ Building A Virtual Machine inside ChatGPT ∗∗∗
---------------------------------------------
Did you know, that you can run a whole virtual machine inside of ChatGPT?
---------------------------------------------
https://www.engraved.blog/building-a-virtual-machine-inside/
∗∗∗ Exploring Prompt Injection Attacks ∗∗∗
---------------------------------------------
Prompt Injection is a new vulnerability that is affecting some AI/ML models and, in particular, certain types of language models using prompt-based learning.
---------------------------------------------
https://research.nccgroup.com/2022/12/05/exploring-prompt-injection-attacks/
∗∗∗ Phishing-Mail „Erneut identifizieren“ im Namen der WKO ignorieren! ∗∗∗
---------------------------------------------
Unternehmerinnen und Unternehmer aufgepasst: Aktuell versenden Kriminelle Phishing-Mails im Namen der Wirtschaftskammer Österreich. Man spielt Ihnen vor, dass eine neuerliche Identifikation notwendig wäre. Ignorieren Sie die Nachricht, denn auf der verlinkten Website eingegebene Daten landen in den Händen Krimineller.
---------------------------------------------
https://www.watchlist-internet.at/news/phishing-mail-erneut-identifizieren-…
∗∗∗ Vice Society: Profiling a Persistent Threat to the Education Sector ∗∗∗
---------------------------------------------
Vice Society, a ransomware gang, has been involved in high-profile activity against schools this year.
---------------------------------------------
https://unit42.paloaltonetworks.com/vice-society-targets-education-sector/
∗∗∗ Tractors vs. threat actors: How to hack a farm ∗∗∗
---------------------------------------------
Forget pests for a minute. Modern farms also face another – and more insidious – breed of threat.
---------------------------------------------
https://www.welivesecurity.com/2022/12/05/tractors-threat-actors-how-hack-f…
=====================
= Vulnerabilities =
=====================
∗∗∗ NETGEAR Nighthawk WiFi6 Router Network Misconfiguration ∗∗∗
---------------------------------------------
A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers.
---------------------------------------------
https://www.tenable.com/security/research/tra-2022-36
∗∗∗ Patchday: Schadcode über Bluetooth auf Android-Geräte schieben ∗∗∗
---------------------------------------------
Es gibt wichtige Sicherheitsupdates für Android 10, 11, 12, 12L und 13. Google hat unter anderem vier kritische Lücken geschlossen.
---------------------------------------------
https://heise.de/-7367211
∗∗∗ Virenschutz: Rechteausweitung durch Schwachstelle in AVG und Avast ∗∗∗
---------------------------------------------
Die Virenscanner von AVG und Avast hätten Angreifern ermöglichen können, ihre Rechte im System auszuweiten. Updates zum Beheben des Fehlers sind verfügbar.
---------------------------------------------
https://heise.de/-7367529
∗∗∗ Schwachstelle in Trend Micros Apex One ermöglicht Rechteausweitung ∗∗∗
---------------------------------------------
Der Virenschutz Apex One von Trend Micro enthält Sicherheitslücken, durch die Angreifer ihre Rechte ausweiten oder Dateien auf dem System löschen lassen können.
---------------------------------------------
https://heise.de/-7367824
∗∗∗ Server-Wartung: Gefährliche BMC-Lücken könnte Supply-Chain-Attacken auslösen ∗∗∗
---------------------------------------------
Sicherheitsforscher sind unter anderem auf eine kritische Sicherheitslücke in Baseboard Management Controllern von American Megatrend gestoßen.
---------------------------------------------
https://heise.de/-7367963
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Ubuntu (binutils and ca-certificates).
---------------------------------------------
https://lwn.net/Articles/917080/
∗∗∗ Schwachstelle in Citrix Workspace App for Windows ermöglicht Passwort-Klau ∗∗∗
---------------------------------------------
Der Hersteller Citrix warnt seit September 2022 vor einiger Schwachstelle in seiner Citrix Workspace App.
---------------------------------------------
https://www.borncity.com/blog/2022/12/06/schwachstelle-in-citrix-workspace-…
∗∗∗ Vulnerability Spotlight: NVIDIA driver memory corruption vulnerabilities discovered ∗∗∗
---------------------------------------------
Cisco Talos recently discovered two memory corruption vulnerabilities in shader functionality of an NVIDIA driver.
---------------------------------------------
https://blog.talosintelligence.com/vulnerability-spotlight-nvidia-driver-me…
∗∗∗ Multiple critical vulnerabilities in ILIAS eLearning platform ∗∗∗
---------------------------------------------
https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulner…
∗∗∗ XSA-424 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-424.html
∗∗∗ XSA-423 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-423.html
∗∗∗ Edge 108.0.1462.42 als Sicherheitsupdate ∗∗∗
---------------------------------------------
https://www.borncity.com/blog/2022/12/06/edge-108-0-1462-41-42-als-sicherhe…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 02-12-2022 18:00 − Montag 05-12-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ BlackProxies proxy service increasingly popular among hackers ∗∗∗
---------------------------------------------
A new residential proxy market is becoming popular among hackers, cybercriminals, phishers, scalpers, and scammers, selling access to a million claimed proxy IP addresses worldwide.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/blackproxies-proxy-service-i…
∗∗∗ Hackers use new, fake crypto app to breach networks, steal cryptocurrency ∗∗∗
---------------------------------------------
The North Korean Lazarus hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-use-new-fake-crypto-…
∗∗∗ If one sheep leaps over the ditch… ∗∗∗
---------------------------------------------
In this report, Kaspersky researchers discuss propagation methods of several ransomware families, and a vulnerable driver abuse case that may become a trend.
---------------------------------------------
https://securelist.com/crimeware-report-ransomware-tactics-vulnerable-drive…
∗∗∗ OWASP Top 10 CI/CD Security Risks ∗∗∗
---------------------------------------------
This document helps defenders identify focus areas for securing their CI/CD ecosystem. It is the result of extensive research into attack vectors associated with CI/CD, and the analysis of high profile breaches and security flaws.
---------------------------------------------
https://owasp.org/www-project-top-10-ci-cd-security-risks/
∗∗∗ #StopRansomware: Cuba Ransomware Alert (AA22-335A) ∗∗∗
---------------------------------------------
This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.
---------------------------------------------
https://www.cisa.gov/uscert/ncas/alerts/aa22-335a
∗∗∗ CryWiper: Fake-Ransomware zerstört Daten insbesondere in Russland ∗∗∗
---------------------------------------------
Die Virenanalysten von Kaspersky haben den Schädling CryWiper entdeckt, der sich als Ransomware ausgibt, Daten aber unwiderbringlich zerstört.
---------------------------------------------
https://heise.de/-7366160
=====================
= Vulnerabilities =
=====================
∗∗∗ Severe AMI MegaRAC flaws impact servers from AMD, ARM, HPE, Dell, others ∗∗∗
---------------------------------------------
Three vulnerabilities in the American Megatrends MegaRAC Baseboard Management Controller (BMC) software impact server equipment used in many cloud service and data center providers.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/severe-ami-megarac-flaws-imp…
∗∗∗ Sicherheitsupdate: Schadcode könnte durch Sophos-Firewalls schlüpfen ∗∗∗
---------------------------------------------
Die Entwickler des Sicherheitssoftware-Anbieters Sophos haben in hauseigenen Firewalls sieben Sicherheitslücken geschlossen. Eine gilt als kritisch.
---------------------------------------------
https://heise.de/-7366076
∗∗∗ Sicherheitslücke: Codeschmuggel mit Ping in FreeBSD ∗∗∗
---------------------------------------------
Angreifer könnten FreeBSD mit manipulierten Ping-Anfragen zum Ausführen untergejubelten Schadcodes bringen. Aktualisierungen stehen bereit.
---------------------------------------------
https://heise.de/-7366590
∗∗∗ Notfall-Update: Zero-Day-Sicherheitslücke in Google Chrome unter Beschuss ∗∗∗
---------------------------------------------
Google hat ein ungeplantes Update für Chrome herausgegeben. Damit schließt der Hersteller eine Sicherheitslücke im Webbrowser, die derzeit angegriffen wird.
---------------------------------------------
https://heise.de/-7365415
∗∗∗ Veritas NetBackup: Update schließt teils kritische Scherheitslücken ∗∗∗
---------------------------------------------
In Veritas NetBackup Flex Scale und Access Appliance könnten Angreifer aus dem Netz ohne Anmeldung Befehle einschleusen. Hotfixes beheben die Fehler.
---------------------------------------------
https://heise.de/-7365984
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (awstats, chromium, clamav, g810-led, giflib, http-parser, jhead, libpgjava, node-cached-path-relative, node-fetch, and vlc), Fedora (fastnetmon, kernel, librime, qpress, rr, thunderbird, and wireshark), Red Hat (kernel, kernel-rt, and kpatch-patch), Slackware (mozilla), SUSE (cherrytree and chromium), and Ubuntu (libbpf, libxml2, linux-gcp-5.15, linux-gke, linux-gke-5.15, and linux-gke).
---------------------------------------------
https://lwn.net/Articles/916979/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 01-12-2022 18:00 − Freitag 02-12-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Unpatched Redis servers targeted in new Redigo malware attacks ∗∗∗
---------------------------------------------
A new Go-based malware threat that researchers call Redigo has been targeting Redis servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow command execution.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/unpatched-redis-servers-targ…
∗∗∗ Samsung, Mediatek, LG: Android-Malware mit OEM-Zertifikaten signiert ∗∗∗
---------------------------------------------
Google hat Malware gefunden, die mit den Zertifikaten von Android-Herstellern signiert sind. Das kann für Systemberechtigungen genutzt werden.
---------------------------------------------
https://www.golem.de/news/samsung-mediatek-lg-android-malware-mit-oem-zerti…
∗∗∗ obama224 distribution Qakbot tries .vhd (virtual hard disk) images, (Fri, Dec 2nd) ∗∗∗
---------------------------------------------
Qakbot (also called Qbot) is a long-running malware family that has seen wide-spread distribution through malicious spam (malspam) in recent years. During an infection, Qakbot performs different functions as an information stealer, backdoor, and malware downloader.
---------------------------------------------
https://isc.sans.edu/diary/rss/29294
∗∗∗ Researchers Find a Way Malicious NPM Libraries Can Evade Vulnerability Detection ∗∗∗
---------------------------------------------
New findings from cybersecurity firm JFrog show that malware targeting the npm ecosystem can evade security checks by taking advantage of an "unexpected behavior" in the npm command line interface (CLI) tool.
---------------------------------------------
https://thehackernews.com/2022/11/researchers-find-way-malicious-npm.html
∗∗∗ Flaws in GX Works3 Threaten Mitsubishi Electric Safety PLC Security ∗∗∗
---------------------------------------------
In this blog, we uncover three additional vulnerabilities that affect Mitsubishi Electric GX Works3, tracked under CVE-2022-29831, CVE-2022-29832, and CVE-2022-29833 (Mitsubishi Electric advisory 2022-015, CISA advisory ICSA-22-333-05), and that, in the worst-case scenario, may lead to the compromise of safety PLCs with the only requirement being the possession of associated GX Works3 project files.
---------------------------------------------
https://www.nozominetworks.com/blog/flaws-in-gx-works3-threaten-mitsubishi-…
∗∗∗ Jetzt patchen! Angreifer attackieren Firewalls und Proxies von Fortinet ∗∗∗
---------------------------------------------
Sicherheitsforscher warnen vor Attacken auf Firmen. Der Grund ist eine kritische Lücke in Fortinet-Produkten.
---------------------------------------------
https://heise.de/-7364286
∗∗∗ Wordpress: Attackiert schon während der Installation ∗∗∗
---------------------------------------------
Noch bevor das System live geht, haben Angreifer es oft unbemerkt mit Hintertüren versehen. Die stehen nämlich schon nach wenigen Minuten auf der Matte.
---------------------------------------------
https://heise.de/-7364588
∗∗∗ IBM Cloud Vulnerability Exposed Users to Supply Chain Attacks ∗∗∗
---------------------------------------------
IBM recently patched a vulnerability in IBM Cloud Databases for PostgreSQL that could have exposed users to supply chain attacks. The vulnerability has been named Hell’s Keychain by cloud security firm Wiz, whose researchers discovered the issue. It has been described by the company as a “first-of-its-kind supply-chain attack vector impacting a cloud provider’s infrastructure”.
---------------------------------------------
https://www.securityweek.com/ibm-cloud-vulnerability-exposed-users-supply-c…
∗∗∗ Three Innocuous Linux Vulnerabilities Chained to Obtain Full Root Privileges ∗∗∗
---------------------------------------------
Qualys’ Threat Research Unit has shown how a new Linux vulnerability could be chained with two other apparently harmless flaws to gain full root privileges on an affected system.
---------------------------------------------
https://www.securityweek.com/three-innocuous-linux-vulnerabilities-chained-…
∗∗∗ Blowing Cobalt Strike Out of the Water With Memory Analysis ∗∗∗
---------------------------------------------
Unit 42 researchers examine several malware samples that incorporate Cobalt Strike components, and discuss some of the ways that we catch these samples by analyzing artifacts from the deltas in process memory at key points of execution. We will also discuss the evasion tactics used by these threats, and other issues that make their analysis problematic.
---------------------------------------------
https://unit42.paloaltonetworks.com/cobalt-strike-memory-analysis/
∗∗∗ Protecting major events: an incident response blueprint ∗∗∗
---------------------------------------------
Cisco Talos Incident Response (Talos IR) is sharing a white paper on the steps organizations should follow to secure any major event. These ten focus areas should help guide any organizing committee or participating businesses in preparation for securing such events.
---------------------------------------------
https://blog.talosintelligence.com/protecting-major-events-an-incident-resp…
∗∗∗ Industry 4.0: CNC Machine Security Risks Part 2 ∗∗∗
---------------------------------------------
This three-part blog series explores the risks associated with CNC machines
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/l/cnc-machine-security-risks-p…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-12-01 ∗∗∗
---------------------------------------------
IBM Watson, IBM App Connect, Rational Functional Tester, IBM Security Guardium, IBM Cloud Object Storage Systems, IBM API Connect.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (snapd), Fedora (firefox, libetpan, ntfs-3g, samba, thunderbird, and xen), SUSE (busybox, emacs, and virt-v2v), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-gcp, linux-ibm, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws-hwe, linux-gcp, linux-hwe, linux-oracle, and tiff).
---------------------------------------------
https://lwn.net/Articles/916658/
∗∗∗ BD BodyGuard Pumps ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsma-22-335-01
∗∗∗ Mitsubishi Electric MELSEC iQ-R Series ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-335-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 30-11-2022 18:00 − Donnerstag 01-12-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ New Windows malware scans victims’ mobile phones for data to steal ∗∗∗
---------------------------------------------
Security researchers found a previously unknown backdoor they call Dophin thats been used by North Korean hackers in highly targeted operations for more than a year to steal files and send them to Google Drive storage.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-windows-malware-scans-vi…
∗∗∗ New DuckLogs malware service claims having thousands of ‘customers’ ∗∗∗
---------------------------------------------
A new malware-as-a-service (MaaS) operation named DuckLogs has emerged, giving low-skilled attackers easy access to multiple modules to steal information, log key strokes, access clipboard data, and remote access to the compromised host.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-ducklogs-malware-service…
∗∗∗ Making unphishable 2FA phishable ∗∗∗
---------------------------------------------
One of the huge benefits of WebAuthn is that it makes traditional phishing attacks impossible. But what if there was a mechanism for an attacker to direct a user to a legitimate login page, resulting in a happy WebAuthn flow, and obtain valid credentials for that user anyway?
---------------------------------------------
https://mjg59.dreamwidth.org/62175.html
∗∗∗ Whats the deal with these router vulnerabilities?, (Thu, Dec 1st) ∗∗∗
---------------------------------------------
Earlier today, I was browser recently made public vulnerabilities for tomorrow's version of our @Risk newsletter. What stuck out was a set of about twenty vulnerabilities in Netgear and DLink routers.
---------------------------------------------
https://isc.sans.edu/diary/rss/29288
∗∗∗ Sirius XM flaw unlocks so-called smart cars thanks to code flaw ∗∗∗
---------------------------------------------
Telematics program doesn't just give you music, but a big security flaw Sirius XMs Connected Vehicle Services has fixed an authorization flaw that would have allowed an attacker to remotely unlock doors and start engines on connected cars knowing only the vehicle identification number (VIN).
---------------------------------------------
https://www.theregister.com/2022/11/30/siriusxm_connected_cars_hacking/
∗∗∗ l+f: Sicherheitsforscher legen aus Versehen gesamtes Botnet KmsdBot lahm ∗∗∗
---------------------------------------------
Wie ein Typo kriminellen Machenschaften das Handwerk legt.
---------------------------------------------
https://heise.de/-7363007
∗∗∗ Vorsicht, wenn Sie ein SMS von Amazon erhalten ∗∗∗
---------------------------------------------
Kriminelle geben sich als Amazon aus und versenden gefälschte Benachrichtigungen. Im SMS steht, dass Ihr Amazon-Konto vorübergehend gesperrt wurde und Sie Informationen aktualisieren müssen. Dafür sollten Sie auf einen Link klicken. Achtung: Der Link führt zu einer gefälschten Login-Seite. Kriminelle stehlen damit Ihre Benutzer- und Kreditkartendaten!
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-wenn-sie-ein-sms-von-amazon…
∗∗∗ LastPass-Kundendaten nach Hack eines Cloud-Speicherdiensts abgezogen (Nov. 2022) ∗∗∗
---------------------------------------------
Der Dienst LastPass informierte vor einigen Stunden seine Kunden, dass kürzlich "ungewöhnliche Aktivitäten" bei einem Cloud-Speicherdienst eines Drittanbieters entdeckt wurden.
---------------------------------------------
https://www.borncity.com/blog/2022/12/01/lastpass-kundendaten-nach-hack-ein…
∗∗∗ Vulnerability Spotlight: Lansweeper directory traversal and cross-site scripting vulnerabilities ∗∗∗
---------------------------------------------
Cisco Talos recently discovered several directory traversal and cross-site scripting vulnerabilities in Lansweeper.
---------------------------------------------
https://blog.talosintelligence.com/vulnerability-spotlight-lansweeper-direc…
=====================
= Vulnerabilities =
=====================
∗∗∗ Critical RCE bugs in Android remote keyboard apps with 2M installs ∗∗∗
---------------------------------------------
Three Android applications that allow users to use devices as remote keyboards for their computers have critical vulnerabilities that could expose key presses and enable remote code execution.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/critical-rce-bugs-in-android…
∗∗∗ IBM Security Bulletins 2022-11-30 ∗∗∗
---------------------------------------------
IBM API Connect, IBM MQ Operator and Queue manager container images, IBM Security Guardium, IBM Sterling Control Center, IBM Watson Discovery for IBM Cloud Pak for Data, IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps, IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (device-mapper-multipath, firefox, hsqldb, krb5, thunderbird, and xorg-x11-server), Debian (libraw), Fedora (freerdp and grub2), SUSE (bcel, emacs, glib2, glibc, grub2, nodejs10, and tomcat), and Ubuntu (linux-azure-fde and snapd).
---------------------------------------------
https://lwn.net/Articles/916443/
∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-062 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-062
∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-061
∗∗∗ Social Base - Moderately critical - Access bypass - SA-CONTRIB-2022-060 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-060
∗∗∗ Horner Automation Remote Compact Controller ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-335-02
∗∗∗ Replay Angriffe & Darstellung beliebiger Inhalte in Zhuhai Suny Technology ESL Tag / ETAG-TECH protocol (electronic shelf labels) ∗∗∗
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/replay-attacks-displa…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 29-11-2022 18:00 − Mittwoch 30-11-2022 18:00
Handler: Robert Waldner
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ How Stuff Gets eXposed ∗∗∗
---------------------------------------------
Intel's Software Guard Extension (SGX) promises an isolated execution environment, protected from all software running on the machine. In the past few years, however, SGX has come under heavy fire, threatened by numerous side channel attacks.
---------------------------------------------
https://sgx.fail/
∗∗∗ Looting Microsoft Configuration Manager ∗∗∗
---------------------------------------------
Microsoft Endpoint Configuration Manager (CM), also known as System Center Configuration Manager (SCCM), is widely deployed by companies to manage their Windows environments. It enables simple enrollment of servers and workstations, distributing software and generic management of the Windows systems in the environment.
---------------------------------------------
https://labs.withsecure.com/publications/looting-microsoft-configuration-ma…
∗∗∗ Was tun, wenn Sie in einem Fake-Shop bestellt haben? ∗∗∗
---------------------------------------------
Sie haben im Internet eingekauft. Das bestellte Produkt kommt aber nicht an, E-Mails an den vermeintlichen Shop bleiben unbeantwortet. Kommt Ihnen das bekannt vor, haben Sie wahrscheinlich in einem Fake-Shop eingekauft. Wir zeigen Ihnen, was Sie tun können, wenn Sie in die Shopping-Falle getappt sind.
---------------------------------------------
https://www.watchlist-internet.at/news/was-tun-wenn-sie-in-einem-fake-shop-…
∗∗∗ Industry 4.0: CNC Machine Security Risks Part 1 ∗∗∗
---------------------------------------------
This three-part blog series explores the risks associated with CNC machines.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/k/cnc-machine-security-risks-p…
=====================
= Vulnerabilities =
=====================
∗∗∗ NVIDIA releases GPU driver update to fix 29 security flaws ∗∗∗
---------------------------------------------
NVIDIA has released a security update for its GPU display driver for Windows, containing a fix for a high-severity flaw that threat actors can exploit to perform, among other things, code execution and privilege escalation.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/nvidia-releases-gpu-driver-u…
∗∗∗ CISA Releases Seven Industrial Control Systems Advisories ∗∗∗
---------------------------------------------
* ICSA-22-333-01 Mitsubishi Electric GOT2000
* ICSA-22-333-02 Hitachi Energys IED Connectivity Packages and PCM600 Products
* ICSA-22-333-03 Hitachi Energys MicroSCADA ProX SYS600 Products
* ICSA-22-333-04 Moxa UC Series
* ICSA-22-333-05 Mitsubishi Electric FA Engineering Software
* ICSA-21-334-02 Mitsubishi MELSEC and MELIPC Series (Update E)
* ICSA-19-346-02 Omron PLC CJ
---------------------------------------------
https://www.cisa.gov/uscert/ncas/current-activity/2022/11/29/cisa-releases-…
∗∗∗ Kritische Sicherheitslücke in VLC Media Player ∗∗∗
---------------------------------------------
Ein Update steht für den VLC Media Player bereit, mit dem die Entwickler unter anderem eine kritische Sicherheitslücke schließen.
---------------------------------------------
https://heise.de/-7362049
∗∗∗ Webbrowser Chrome 108 dichtet 28 Sicherheitslücken ab ∗∗∗
---------------------------------------------
Das Update auf den Webbrowser Chrome 108 liefert im Wesentlichen Fehlerkorrekturen, die 28 Schwachstellen schließen.
---------------------------------------------
https://heise.de/-7361154
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (krb5), Fedora (galera, mariadb, and mingw-python3), Red Hat (389-ds:1.4, kernel, kernel-rt, kpatch-patch, krb5, and usbguard), Scientific Linux (krb5), Slackware (kernel), SUSE (binutils, dbus-1, exiv2, freerdp, git, java-1_8_0-ibm, kernel, libarchive, libdb-4_8, libmspack, nginx, opencc, python, python3, rxvt-unicode, sudo, supportutils, systemd, vim, and webkit2gtk3), and Ubuntu (bind9, gnutls28, libsamplerate, linux-gcp-5.4, perl, pixman, shadow, [...]
---------------------------------------------
https://lwn.net/Articles/916346/
∗∗∗ Delta Electronics Patches Serious Flaws in Industrial Networking Devices ∗∗∗
---------------------------------------------
Taiwan-based Delta Electronics has patched potentially serious vulnerabilities in two of its industrial networking products. The flaws were identified by researchers at CyberDanube, a new industrial cybersecurity company based in Austria, in Delta’s DX-2100-L1-CN 3G cloud router and the DVW-W02W2-E2 industrial wireless access point.
---------------------------------------------
https://www.securityweek.com/delta-electronics-patches-serious-flaws-indust…
∗∗∗ Developers Warned of Critical Remote Code Execution Flaw in Quarkus Java Framework ∗∗∗
---------------------------------------------
Developers have been warned that the popular Quarkus framework is affected by a critical vulnerability that could lead to remote code execution.
---------------------------------------------
https://www.securityweek.com/developers-warned-critical-remote-code-executi…
∗∗∗ Anker Eufy Door Bell Sicherheitskameras mit Schwachstellen, Daten werden in die Cloud übertragen, Homebase 2 hat auch Schwachstellen ∗∗∗
---------------------------------------------
Anker Eufy Door Bell-Sicherheitskameras werden auch in Deutschland verkauft. Ein Sicherheitsforscher hat nun verschiedene Sicherheitslücken in der Firmware der Eufy-Kameras gefunden.
---------------------------------------------
https://www.borncity.com/blog/2022/11/30/anker-eufy-door-bell-sicherheitska…
∗∗∗ Drop What Youre Doing and Update iOS, Android, and Windows ∗∗∗
---------------------------------------------
https://www.wired.com/story/ios-android-windows-vulnerability-patches-novem…
∗∗∗ Security Advisory - Improper Authorization Vulnerability in a Huawei Childrens Watch ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iaviahcw-…
∗∗∗ Security Bulletin: A Kafka vulnerability affects IBM Operations Analytics Predictive Insights (CVE-2022-34917 ) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-kafka-vulnerability-aff…
∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.4ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 – 2022.4.0 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty profile affects IBM Operations Analytics Predictive Insights(CVE-2022-22393 CVE-2022-22476 CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-we…
∗∗∗ Security Bulletin: Multiple vulnerabilities in Netty libraries affect IBM Operations Analytics Predictive Insights (CVE-2021-43797 CVE-2022-24823) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affect IBM Operations Analytics Predictive Insights ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to remote authenticated attacker to execute arbitrary code on the system due to PostgreSQL (CVE-2022-2625) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Zahlreiche kritische Schwachstellen in Planet Enterprises Ltd - Planet eStream ∗∗∗
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/multiple-critical-vul…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 28-11-2022 18:00 − Dienstag 29-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Malicious Android app found powering account creation service ∗∗∗
---------------------------------------------
A fake Android SMS application, with 100,000 downloads on the Google Play store, has been discovered to secretly act as an SMS relay for an account creation service for sites like Microsoft, Google, Instagram, Telegram, and Facebook [...]
---------------------------------------------
https://www.bleepingcomputer.com/news/security/malicious-android-app-found-…
∗∗∗ Cyber-Threat Group Targets Critical RCE Vulnerability in Bleed You Campaign ∗∗∗
---------------------------------------------
More than 1,000 systems are exposed to a campaign hunting weak Windows servers and more.
---------------------------------------------
https://www.darkreading.com/threat-intelligence/cyber-threat-weak-windows-s…
∗∗∗ Subdomain Enumeration with DNSSEC ∗∗∗
---------------------------------------------
In my previous blog post I described how subdomain enumeration and subdomain bruteforce in particular could be enhanced by taking DNS status code into account, rather than relying on the existence of A or AAAA records only. This follow-up post describes what techniques exist to enumerate subdomains in a DNSSEC-enabled zone and what countermeasures exist to prevent it.
---------------------------------------------
https://www.securesystems.de/blog/subdomain-enumeration-with-DNSSEC/
∗∗∗ Angreifer könnten Secure Boot auf bestimmten Acer-Notebooks deaktivieren ∗∗∗
---------------------------------------------
Acers Entwickler haben eine Sicherheitslücke geschlossen. Unter bestimmten Umständen könnten Angreifer UEFI-Einstellungen manipulieren. Updates sind in Sicht.
---------------------------------------------
https://heise.de/-7359874
∗∗∗ #InvisibleChallenge: Malware sucht Opfer mit TikTok-Challenge ∗∗∗
---------------------------------------------
Cyberkriminelle missbrauchen eine Nackt-Tanz-Challenge auf TikTok, um Opfer zum Installieren ihrer Malware zu bewegen. Diese solle einen Filter entfernen.
---------------------------------------------
https://heise.de/-7360626
∗∗∗ Pre-auth RCE in Oracle Fusion Middleware exploited in the wild (CVE-2021-35587) ∗∗∗
---------------------------------------------
A pre-authentication RCE flaw (CVE-2021-35587) in Oracle Access Manager (OAM) that has been fixed in January 2022 is being exploited by attackers in the wild, the Cybersecurity and Infrastructure Security Agency has confirmed by adding the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
---------------------------------------------
https://www.helpnetsecurity.com/2022/11/29/cve-2021-35587-exploited/
∗∗∗ Project Zero Flags Patch Gap Problems on Android ∗∗∗
---------------------------------------------
Vulnerability researchers at Google Project Zero are calling attention to the ongoing “patch-gap” problem in the Android ecosystem, warning that downstream vendors continue to be tardy at delivering security fixes to Android-powered devices.
---------------------------------------------
https://www.securityweek.com/project-zero-flags-patch-gap-problems-android
∗∗∗ Booking.com: Vorsicht vor gefälschten Angeboten ∗∗∗
---------------------------------------------
Sie haben auf Booking.com eine verlockende Unterkunft gefunden? Der Buchungsprozess verläuft aber nicht wie gewohnt? Vorsicht! Möglicherweise sind Sie auf ein betrügerisches Angebot gestoßen. Wenn Unterkunftgeber:innen Sie von Booking.com auf eine andere Website verweisen, handelt es sich um eine Betrugsmasche. Wir erklären Ihnen, worauf Sie achten sollten!
---------------------------------------------
https://www.watchlist-internet.at/news/bookingcom-vorsicht-vor-gefaelschten…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-11-28 ∗∗∗
---------------------------------------------
Digital Certificate Manager for IBM i, IBM App Connect Enterprise Certified Container IntegrationServer operands, IBM Operations Analytics Predictive Insights, IBM Planning Analytics Workspace, IBM Sterling Connect:Direct for UNIX, IBM UrbanCode Deploy (UCD), IBM UrbanCode Deploy (UCD) Agents on zOS, IBM WebSphere Application Server Liberty, ISC BIND on IBM i
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ VMSA-2022-0029 ∗∗∗
---------------------------------------------
CVSSv3 Range: 3.3
CVE(s): CVE-2022-31693
Synopsis: VMware Tools for Windows update addresses a denial-of-service vulnerability
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0029.html
∗∗∗ K11742512: BIND vulnerability CVE-2022-2795 ∗∗∗
---------------------------------------------
By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the resolver's performance, effectively denying legitimate clients access to the DNS resolution service.
---------------------------------------------
https://support.f5.com/csp/article/K11742512
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (frr, gerbv, mujs, and twisted), Fedora (nodejs and python-virtualbmc), Oracle (dotnet7.0, kernel, kernel-container, krb5, varnish, and varnish:6), SUSE (busybox, python3, tiff, and tomcat), and Ubuntu (harfbuzz).
---------------------------------------------
https://lwn.net/Articles/916189/
∗∗∗ Edge 107.0.1418.62 ∗∗∗
---------------------------------------------
Kurzer Nachtrag: Microsoft hat zum 28. November 2022 den Edge-Browser im Stable Stable Channel auf die Version 107.0.1418.52 aktualisiert. Ist ein Sicherheits-Update, welches gemäß den Release Notes die vom Chromium-Team berichtete Schwachstelle CVE-2022-4135 schließt.
---------------------------------------------
https://www.borncity.com/blog/2022/11/29/edge-107-0-1418-62/
∗∗∗ Festo: Incomplete documentation of remote accessible functions and protocols in Festo products ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-041/
∗∗∗ Festo: Multiple Festo products contain an unsafe default Codesys configuration ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-037/
∗∗∗ Mitsubishi Electric GOT2000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-333-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 25-11-2022 18:00 − Montag 28-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Win32.Ransom.Conti / Crypto Logic Flaw ∗∗∗
---------------------------------------------
Conti ransomware FAILS to encrypt non PE files that have a ".exe" in the filename.
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022110044
∗∗∗ Bring Your Own Key — A Placebo? ∗∗∗
---------------------------------------------
BYOK was envisioned to reduce the risk of using a cloud service provider processing sensitive data, yet there are several deficiencies.
---------------------------------------------
https://www.darkreading.com/cloud/bring-your-own-key-a-placebo-
∗∗∗ All You Need to Know About Emotet in 2022 ∗∗∗
---------------------------------------------
For 6 months, the infamous Emotet botnet has shown almost no activity, and now its distributing malicious spam. Lets dive into details and discuss all you need to know about the notorious malware to combat it.
---------------------------------------------
https://thehackernews.com/2022/11/all-you-need-to-know-about-emotet-in.html
∗∗∗ Hacking Smartwatches for Spear Phishing ∗∗∗
---------------------------------------------
In this article we explain how to hack into a SmartWatch and show a custom text message.
---------------------------------------------
https://cybervelia.com/?p=1380
∗∗∗ Exploiting an N-day vBulletin PHP Object Injection Vulnerability ∗∗∗
---------------------------------------------
vBulletin is one of the most popular proprietary forum solutions over the Internet. It is used by some major websites, and according to the BuildWith website, vBulletin currently ranks at the second place on the Forum Software Usage Distribution in the Top 1 Million Sites, with over 2.000 websites using it among the “top 1 million”.
---------------------------------------------
https://karmainsecurity.com/exploiting-an-nday-vbulletin-php-object-injecti…
∗∗∗ Poking a mobile hotspot ∗∗∗
---------------------------------------------
Ive been playing with an Orbic Speed, a relatively outdated device that only speaks LTE Cat 4, but the towers I can see from here are, uh, not well provisioned so throughput really isnt a concern (and refurbs are $18, so). As usual Im pretty terrible at just buying devices and using them for their intended purpose, and in this case it has the irritating behaviour that if theres a power cut and the battery runs out it doesnt boot again when power returns, so heres what Ive learned so far.
---------------------------------------------
https://mjg59.dreamwidth.org/61725.html
∗∗∗ Vorsicht vor gefälschtem FinanzOnline-E-Mail ∗∗∗
---------------------------------------------
„Sie erhalten einen Betrag“ lautet der Betreff eines betrügerischen E-Mail, das angeblich von FinanzOnline kommt. Sie werden informiert, dass Sie eine Rückerstattung von 578,99 Euro erhalten. Um das Geld zu bekommen, müssen Sie auf den Link im E-Mail klicken. Vorsicht: Dieser führt auf eine gefälschte FinanzOnline-Seite. Kriminelle stehlen Ihre Daten.
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschtem-finanzonli…
∗∗∗ Emotet Strikes Again – LNK File Leads to Domain Wide Ransomware ∗∗∗
---------------------------------------------
The intrusion began when a user double clicked a LNK file, which then executed encoded Powershell commands to download an Emotet DLL onto the computer. Once executed, Emotet setup a Registry Run Key to maintain persistence on the beachhead host.
---------------------------------------------
https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to…
∗∗∗ LockBit Ransomware Being Mass-distributed With Similar Filenames ∗∗∗
---------------------------------------------
The ASEC analysis team had written about LockBit ransomware being distributed through emails over three blog posts. Through consistent monitoring, we hereby let you know that LockBit 2.0 and LockBit 3.0 are being distributed again with only a change to their filenames.
---------------------------------------------
https://asec.ahnlab.com/en/42890/
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, commons-configuration2, graphicsmagick, heimdal, inetutils, ini4j, jackson-databind, and varnish), Fedora (drupal7-i18n, grub2, kubernetes, and python-slixmpp), Mageia (botan, golang, kernel, kernel-linus, radare2/rizin, and xterm), Red Hat (krb5, varnish, and varnish:6), SUSE (busybox, chromium, erlang, exiv2, firefox, freerdp, ganglia-web, java-1_8_0-openj9, nodejs12, nodejs14, opera, pixman, python3, sudo, tiff, and xen), [...]
---------------------------------------------
https://lwn.net/Articles/916135/
∗∗∗ Cisco ISE Vulnerabilities Can Be Chained in One-Click Exploit ∗∗∗
---------------------------------------------
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow remote attackers to inject arbitrary commands, bypass existing security protections, or perform cross-site scripting (XSS) attacks.
---------------------------------------------
https://www.securityweek.com/cisco-ise-vulnerabilities-can-be-chained-one-c…
∗∗∗ Google Projekt Zero legt Schwachstelle in Mali GPU offen, Millionen Android-Geräte betroffen ∗∗∗
---------------------------------------------
Google Sicherheitsforscher haben im Project Zero eine Schwachstelle (CVE-2022-33917) im Kerneltreiber der in vielen Android-Geräten mit ARM CPU verwendeten Mali GPU offen gelegt.
---------------------------------------------
https://www.borncity.com/blog/2022/11/27/google-projekt-zero-legt-schwachst…
∗∗∗ Security Bulletin: IBM Maximo Mobile is vulnerable to Information Disclosure (CVE-2022-41732) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-mobile-is-vuln…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect App Connect Professional. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to X-Force 237819 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris…
∗∗∗ MISP v2.4.166 ∗∗∗
---------------------------------------------
https://github.com/MISP/MISP/releases/tag/v2.4.166
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 24-11-2022 18:00 − Freitag 25-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Docker Hub repositories hide over 1,650 malicious containers ∗∗∗
---------------------------------------------
Over 1,600 publicly available Docker Hub images hide malicious behavior, including cryptocurrency miners, embedded secrets that can be used as backdoors, DNS hijackers, and website redirectors.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/docker-hub-repositories-hide…
∗∗∗ Redacted Documents Are Not as Secure as You Think ∗∗∗
---------------------------------------------
Popular redaction tools don’t always work as promised, and new attacks can reveal hidden information, researchers say.
---------------------------------------------
https://www.wired.com/story/redact-pdf-online-privacy/
∗∗∗ Alte Social-Media-Konten löschen: Sicherheit durch weniger eigener Daten im Netz ∗∗∗
---------------------------------------------
Ungenutzte Social-Media-Accounts beinhalten persönliche Daten und bergen Sicherheitsrisiken. Unser Ratgeber zeigt, wie Sie veraltete Konten finden und löschen.
---------------------------------------------
https://heise.de/-7321954
∗∗∗ UEFI-BIOS mit bekannt unsicherem Code gespickt ∗∗∗
---------------------------------------------
In einem BIOS-Update fanden Experten mehrere OpenSSL-Versionen, teils mit uralten Sicherheitslücken. Das wirft ein Schlaglicht auf Risiken von PC-Firmware.
---------------------------------------------
https://heise.de/-7351884
∗∗∗ Word Documents Disguised as Normal MS Office URLs Being Distributed ∗∗∗
---------------------------------------------
Recently, there has been a case of malware disguised as a Word document being distributed through certain paths (e.g. KakaoTalk group chats). The ASEC analysis team has discovered during our additional monitoring process that the URL used in the fake Word document is becoming very cleverly disguised to closely resemble the normal URL, and we wish to advise caution on the part of users.
---------------------------------------------
https://asec.ahnlab.com/en/42554/
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (firefox), Mageia (dropbear, freerdp, java, libx11, and tumbler), Slackware (ruby), SUSE (erlang, grub2, libdb-4_8, and tomcat), and Ubuntu (exim4, jbigkit, and tiff).
---------------------------------------------
https://lwn.net/Articles/915984/
∗∗∗ Chrome 107.0.5304.121/122 Sicherheitsupdates ∗∗∗
---------------------------------------------
Google hat zum 24. November 2022 einen Schwung an Sicherheitsupdates des Google Chrome im 107er Zweig im Stable Channel für Mac, Linux und Windows sowie für Android freigegeben. Es werden dabei bereits ausgenutzte Schwachstellen geschlossen.
---------------------------------------------
https://www.borncity.com/blog/2022/11/25/chrome-107-0-5304-121-122-sicherhe…
∗∗∗ Canon: Regarding vulnerability measure against buffer overflow for Laser Printers and Small Office Multifunction Printers (CVE-2022-43608) – 25 November 2022 ∗∗∗
---------------------------------------------
Multiple cases of buffer overflow vulnerabilities have been identified with Canon Laser Printers and Small Office Multifunctional Printers. A list of affected models is given below.
---------------------------------------------
https://www.canon-europe.com/support/product-security-latest-news/
∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2022-3676) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. (CVE-2022-35637) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2021-28167) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM ILOG CPLEX Optimization Studio (CVE-2021-41041) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 23-11-2022 18:00 − Donnerstag 24-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Investigating a backdoored PyPi package targeting FastAPI applications ∗∗∗
---------------------------------------------
On November 23rd, 2022, the Datadog Security Labs team identified a utility Python package on PyPI related to FastAPI, fastapi-toolkit, that has likely been compromised by a malicious actor.
---------------------------------------------
https://securitylabs.datadoghq.com/articles/malicious-pypi-package-fastapi-…
∗∗∗ THREAT ALERT: Aggressive Qakbot Campaign and the Black Basta Ransomware Group Targeting U.S. Companies ∗∗∗
---------------------------------------------
In this threat alert, the Cybereason team describes one attack scenario that started from a QBot infection, resulting in multiple key machines loading Cobalt Strike, which finally led to the global deployment of Black Basta ransomware.
---------------------------------------------
https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and…
∗∗∗ MSI Afterburner: Vorsicht vor Fake-Software mit Trojaner im Gepäck ∗∗∗
---------------------------------------------
Immer wieder versuchen Kriminelle Opfern Schadcode unter dem Deckmantel von legitimen Tools, wie aktuell dem GPU-Tool MSI Afterburner, unterzuschieben.
---------------------------------------------
https://heise.de/-7351380
∗∗∗ In eine Phishing-Falle getappt? Das können Sie tun: ∗∗∗
---------------------------------------------
Wurden Sie über ein betrügerisches E-Mail oder SMS auf eine gefälschte Login-Seiten gelockt? Haben Sie dort Ihre Daten eingetippt? Dann haben Kriminelle Zugriff auf Ihr Konto. Wir zeigen Ihnen, was Sie tun können, wenn Sie Ihre Benutzerdaten preisgegeben haben.
---------------------------------------------
https://www.watchlist-internet.at/news/in-eine-phishing-falle-getappt-das-k…
∗∗∗ Neue Betrugsmasche: Kriminelle stehlen Kreditkartendaten und hinterlegen sie für Apple Pay ∗∗∗
---------------------------------------------
Kriminelle erschleichen sich mit Phishing-Nachrichten per SMS oder E-Mail Kreditkartendaten und hinterlegen diese für Apple Pay. Betroffene werden dann unter falschen Vorwänden verleitet, den Aktivierungscode für Apple Pay an die Kriminellen weiterzugeben.
---------------------------------------------
https://www.watchlist-internet.at/news/neue-betrugsmasche-kriminelle-stehle…
∗∗∗ Bahamut cybermercenary group targets Android users with fake VPN apps ∗∗∗
---------------------------------------------
Malicious apps used in this active campaign exfiltrate contacts, SMS messages, recorded phone calls, and even chat messages from apps such as Signal, Viber, and Telegram.
---------------------------------------------
https://www.welivesecurity.com/2022/11/23/bahamut-cybermercenary-group-targ…
∗∗∗ IBM: RansomExx becomes latest ransomware group to create Rust variant ∗∗∗
---------------------------------------------
The RansomExx ransomware group has become the latest gang to create a variant in the Rust programming language, according to IBM Security X-Force Threat researchers.
---------------------------------------------
https://therecord.media/ibm-ransomexx-becomes-latest-ransomware-group-to-cr…
=====================
= Vulnerabilities =
=====================
∗∗∗ TP-Link RE300 V1 tdpServer vulnerable to improper processing of its input ∗∗∗
---------------------------------------------
tdpServer of TP-Link RE300 V1 improperly processes its input, possibly resulting to crash.
---------------------------------------------
https://jvn.jp/en/jp/JVN29657972/
∗∗∗ Security update available in Foxit PDF Editor for Mac 11.1.4 ∗∗∗
---------------------------------------------
Foxit has released Foxit PDF Editor for Mac 11.1.4, which addresses potential security and stability issues.
---------------------------------------------
https://www.foxit.com/support/security-bulletins.html
∗∗∗ SolarWinds Security Advisories 2022-11-22 ∗∗∗
---------------------------------------------
SolarWinds published 7 Security Advisories (3 High, 1 Medium, 3 Low Severity).
---------------------------------------------
https://www.solarwinds.com/trust-center/security-advisories
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (vim), Fedora (drupal7-context, drupal7-link, firefox, xen, xorg-x11-server, and xorg-x11-server-Xwayland), Oracle (container-tools:ol8, device-mapper-multipath, dotnet7.0, firefox, hsqldb, keylime, podman, python3.9, python39:3.9, thunderbird, and xorg-x11-server), SUSE (exiv2-0_26, keylime, libarchive, net-snmp, nginx, opensc, pixman, python-joblib, strongswan, and webkit2gtk3), and Ubuntu (expat, imagemagick, mariadb-10.3, mariadb-10.6, [...]
---------------------------------------------
https://lwn.net/Articles/915929/
∗∗∗ Security Bulletin: IBM Sterling Control Center vulnerable to multiple issues to due IBM Cognos Analystics (CVE-2022-4160, CVE-2021-3733) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent…
∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service due to Websphere Liberty (CVE-2022-24839) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent…
∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to HTTP header injection due to Websphere Liberty (CVE-2022-34165) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent…
∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK affects Cloud Pak System [CVE-2021-28167] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java…
∗∗∗ Security Bulletin: IBM Sterling Control Center is vulnerable to unauthenticated data manipulation due to Java SE (CVE-2021-2163) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-control-cent…
∗∗∗ Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-for-ibm-cloudpak-for-wats…
∗∗∗ Security Bulletin: Vulnerabilities with MariaDB affect IBM Cloud Object Storage Systems (Nov 2022v1) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-mari…
∗∗∗ Pilz: PAS 4000 prone to ZipSlip ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-045/
∗∗∗ Pilz: Multiple products affected by ZipSlip ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-044/
∗∗∗ Pilz: PASvisu and PMI affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-033/
∗∗∗ 2022-18Multiple vulnerabilities in BAT-C2 ∗∗∗
---------------------------------------------
https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15087-sour…
∗∗∗ 2022-21Authenticated Command Injection in Hirschmann BAT-C2 ∗∗∗
---------------------------------------------
https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15088-sour…
∗∗∗ 2022-20TinyXML vulnerability in Hirschmann HiLCOS products ∗∗∗
---------------------------------------------
https://www.belden.com/dfsmedia/f1e38517e0cd4caa8b1acb6619890f5e/15089-sour…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 22-11-2022 18:00 − Mittwoch 23-11-2022 18:00
Handler: Robert Waldner
Co-Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Backdoored Chrome extension installed by 200,000 Roblox players ∗∗∗
---------------------------------------------
Chrome browser extension SearchBlox installed by more than 200,000 users has been discovered to contain a backdoor that can steal your Roblox credentials as well as your assets on Rolimons, a Roblox trading platform.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/backdoored-chrome-extension-…
∗∗∗ Ducktail Malware Operation Evolves with New Malicious Capabilities ∗∗∗
---------------------------------------------
The operators of the Ducktail information stealer have demonstrated a "relentless willingness to persist" and continued to update their malware as part of an ongoing financially driven campaign."The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victims Facebook account," ...
---------------------------------------------
https://thehackernews.com/2022/11/ducktail-malware-operation-evolves-with.h…
∗∗∗ Mind the Gap ∗∗∗
---------------------------------------------
Note: The vulnerabilities discussed in this blog post (CVE-2022-33917) are fixed by the upstream vendor, but at the time of publication, these fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung, Xiaomi, Oppo and others). Devices with a Mali GPU are currently vulnerable.
---------------------------------------------
https://googleprojectzero.blogspot.com/2022/11/mind-the-gap.html
∗∗∗ Nighthawk: An Up-and-Coming Pentest Tool Likely to Gain Threat Actor Notice ∗∗∗
---------------------------------------------
In September 2022, Proofpoint researchers identified initial delivery of a penetration testing framework called Nighthawk. Launched in late 2021 by MDSec, Nighthawk is similar to other frameworks such as Brute Ratel and Cobalt Strike and, like those, could see rapid adoption by threat actors wanting to diversify their methods and add a relatively unknown framework to their arsenal.
---------------------------------------------
https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pent…
∗∗∗ Kritische Infrastruktur: EU-Richtlinie nimmt Betreiber in die Pflicht ∗∗∗
---------------------------------------------
Das EU-Parlament hat eine Richtlinie zur Resilienz kritischer Einrichtungen beschlossen. Sie gilt für elf Branchen. Manche Betreiber sind besonders wichtig.
---------------------------------------------
https://heise.de/-7349574
∗∗∗ Google will Missbrauch des Pentesting-Tools Cobalt Strike eindämmen ∗∗∗
---------------------------------------------
Damit Admins Netzwerk-Attacken durch Cobalt-Strike-Missbrauch besser erkennen können, hat Google unter anderem Erkennungsregeln auf Yara-Basis veröffentlicht.
---------------------------------------------
https://heise.de/-7349813
∗∗∗ Standard für maschinenlesbare Sicherheitshinweise verabschiedet ∗∗∗
---------------------------------------------
Das Common Security Advisory Framework soll Administratoren die Arbeit erleichtern und aktuelle Sicherheitsinformationen leichter auffindbar machen.
---------------------------------------------
https://heise.de/-7350491
∗∗∗ Angriffe auf Boa Web Server gefährden IoT ∗∗∗
---------------------------------------------
Anfällige SDK-Komponenten führen zu Lieferkettenrisiken in IoT- und OT-Umgebungen, insbesondere durch den veralteten Boa Web Server, warnt Microsoft Security Threat Intelligence (MSTI).
---------------------------------------------
https://www.zdnet.de/88405186/angriffe-auf-boa-web-server-gefaehrden-iot/
∗∗∗ Web Application Firewalls umgehen ∗∗∗
---------------------------------------------
Web Application Firewalls (WAFs) sind beliebte Infrastrukturkomponenten, die verwendet werden, um Angriffe auf Webanwendungen zu erschweren. Was bieten WAFs wirklich? Können sie auch nur theoretisch perfekt sein, um jede Art von Webangriff zu verhindern? Lassen Sie uns WAFs entmystifizieren!
---------------------------------------------
https://certitude.consulting/blog/de/web-application-firewalls-umgehen/
∗∗∗ CVE-2022-23088: Exploiting a Heap Overflow in the FreeBSD Wi-Fi Stack ∗∗∗
---------------------------------------------
In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. [..] The researcher has graciously provided this detailed write-up of the vulnerability and a proof-of-concept exploit demonstrating the bug.
---------------------------------------------
https://www.thezdi.com/blog/2022/6/15/cve-2022-23088-exploiting-a-heap-over…
∗∗∗ CVE-2022-40300: SQL Injection in ManageEngine Privileged Access Management ∗∗∗
---------------------------------------------
In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Justin Hung and Dusan Stevanovic of the Trend Micro Research Team detail a recently patched SQL injection vulnerability in Zoho ManageEngine products.
---------------------------------------------
https://www.thezdi.com/blog/2022/11/22/cve-2022-40300-sql-injection-in-mana…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-11-22 ∗∗∗
---------------------------------------------
IBM Operations Analytics, IBM QRadar, IBM SDK, IBM Sterling Connect, Rational Service Tester, Rational Performance Tester, IBM HTTP Server, IBM Security Verify Governance, IBM InfoSphere DataStage, IBM Cloud Pak for Security
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Sicherheitslücke in HPE-Switches OfficeConnect gefährdet Netzwerke ∗∗∗
---------------------------------------------
Angreifer könnten Switches von Hewlett Packard Enterprise attackieren. Sicherheitsupdates stehen zum Download bereit.
---------------------------------------------
https://heise.de/-7350116
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (heimdal, libarchive, and nginx), Fedora (varnish-modules and xterm), Red Hat (firefox), Scientific Linux (firefox, hsqldb, and thunderbird), SUSE (Botan, colord, containerized-data-importer, ffmpeg-4, java-1_8_0-ibm, krb5, nginx, redis, strongswan, tomcat, and xtrabackup), and Ubuntu (apr-util, freerdp2, and sysstat).
---------------------------------------------
https://lwn.net/Articles/915802/
∗∗∗ CISA Releases Eight Industrial Control Systems Advisories ∗∗∗
---------------------------------------------
Original release date: November 22, 2022CISA has released eight (8) Industrial Control Systems (ICS) advisories on 22 November 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
- ICSA-22-326-01 AVEVA Edge
- ICSA-22-326-02 Digital Alert Systems DASDEC
- ICSA-22-326-03 Phoenix Contact Automation Worx
- ICSA-22-326-04 GE Cimplicity
- ICSA-22-326-05 Moxa Multiple ARM-Based Computers
- ICSMA-21-152-01 Hillrom Medical Device Management (Update C)
- ICSA-20-212-04 Mitsubishi Electric Factory Automation Engineering Products (Update I)
- ICSA-21-049-02 Mitsubishi Electric FA Engineering Software Products (Update G)
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/11/22/cisa-releases-eig…
∗∗∗ WordPress BeTheme 26.5.1.4 PHP Object Injection ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022110040
∗∗∗ Security Advisory - Improper Input Validation Vulnerability in a Huawei Childrens Watch ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-iivviahcw…
∗∗∗ Security Advisory - Insufficient Authentication Vulnerability in some Huawei Band Products ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20221130-…
∗∗∗ Multiple Vulnerabilities PRA-ES8P2S Ethernet-Switch ∗∗∗
---------------------------------------------
https://psirt.bosch.com/security-advisories/bosch-sa-247053-bt.html
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 21-11-2022 18:00 − Dienstag 22-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Google Chrome extension used to steal cryptocurrency, passwords ∗∗∗
---------------------------------------------
An information-stealing Google Chrome browser extension named VenomSoftX is being deployed by Windows malware to steal cryptocurrency and clipboard contents as users browse the web.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/google-chrome-extension-used…
∗∗∗ Android file manager apps infect thousands with Sharkbot malware ∗∗∗
---------------------------------------------
A new collection of malicious Android apps posing as harmless file managers had infiltrated the official Google Play app store, infecting users with the Sharkbot banking trojan.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/android-file-manager-apps-in…
∗∗∗ ICS cyberthreats in 2023 – what to expect ∗∗∗
---------------------------------------------
The coming year looks to be much more complicated. In the post we share some of our thoughts on potential developments of 2023, though we cannot claim to be providing either a complete picture or a high degree of precision.
---------------------------------------------
https://securelist.com/ics-cyberthreats-in-2023/108011/
∗∗∗ Crimeware and financial cyberthreats in 2023 ∗∗∗
---------------------------------------------
This report assesses how accurately we predicted the developments in the financial threats landscape in 2022 and ponder at what to expect in 2023.
---------------------------------------------
https://securelist.com/crimeware-financial-cyberthreats-2023/108005/
∗∗∗ Log4Shell campaigns are using Nashorn to get reverse shell on victims machines, (Mon, Nov 21st) ∗∗∗
---------------------------------------------
Almost one year later, Log4Shell attacks are still alive and making victims.
---------------------------------------------
https://isc.sans.edu/diary/rss/29266
∗∗∗ Researchers Warn of Cyber Criminals Using Go-based Aurora Stealer Malware ∗∗∗
---------------------------------------------
A nascent Go-based malware known as Aurora Stealer is being increasingly deployed as part of campaigns designed to steal sensitive information from compromised hosts.
---------------------------------------------
https://thehackernews.com/2022/11/researchers-warn-of-cyber-criminals.html
∗∗∗ Werbung für beheizbare Jacken auf TikTok ∗∗∗
---------------------------------------------
Haben Sie beim Durchscrollen von TikTok Werbung für eine beheizbare Jacke gesehen? Dann sind Sie wohl über die Marke „Mont Gerrard“ gestolpert. Die Jacken dürften bei TikTok-Nutzer:innen sehr beliebt sein, denn es gibt bereits Fake-Shops, die die Jacken zu einem günstigeren Preis anbieten und auf TikTok und Instagram bewerben.
---------------------------------------------
https://www.watchlist-internet.at/news/werbung-fuer-beheizbare-jacken-auf-t…
∗∗∗ Vulnerability Spotlight: Callback Technologies CBFS Filter denial-of-service vulnerabilities ∗∗∗
---------------------------------------------
Cisco Talos recently discovered three denial-of-service vulnerabilities in Callback Technologies CBFS Filter.
---------------------------------------------
https://blog.talosintelligence.com/vulnerability-spotlight-callback-technol…
∗∗∗ What is EPSS? A new rating system for vulnerabilities to replace CVSS. ∗∗∗
---------------------------------------------
LunaSec Security Researchers give a quick look at the EPSS scoring system, a new rating system for vulnerabilities that aims to replace CVSS.
---------------------------------------------
https://www.lunasec.io/docs/blog/what-is-epss
=====================
= Vulnerabilities =
=====================
∗∗∗ Attacken auf Backuplösung IBM Spectrum Protect Plus Container Backup möglich ∗∗∗
---------------------------------------------
Sicherheitslücken in der Programmiersprache Golang Go bedrohen IBM-Software. Sicherheitsupdates sind verfügbar.
---------------------------------------------
https://heise.de/-7348556
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (ntfs-3g), Fedora (krb5 and samba), Gentoo (firefox-bin, ghostscript-gpl, pillow, sudo, sysstat, thunderbird-bin, and xterm), Red Hat (firefox, hsqldb, and thunderbird), SUSE (cni, cni-plugins, and krb5), and Ubuntu (isc-dhcp and sqlite3).
---------------------------------------------
https://lwn.net/Articles/915708/
∗∗∗ BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks ∗∗∗
---------------------------------------------
Researchers at industrial cybersecurity firm Nozomi Networks have discovered more than a dozen vulnerabilities in baseboard management controller (BMC) firmware.
---------------------------------------------
https://www.securityweek.com/bmc-firmware-vulnerabilities-expose-ot-iot-dev…
∗∗∗ ZDI-22-1615: TP-Link TL-WR940N httpd Incorrect Implementation of Authentication Algorithm Information Disclosure Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1615/
∗∗∗ ZDI-22-1614: TP-Link TL-WR940N httpd Use of Insufficiently Random Values Authentication Bypass Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1614/
∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of dom4j (CVE-2018-1000632) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover…
∗∗∗ Security Bulletin: Potential Vulnerability in Apache HttpClient used by Logstash shipped with IBM Operations Analytics – Log Analysis (CVE-2020-13956) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-i…
∗∗∗ Security Bulletin: Vulnerability from Apache Kafka affect IBM Operations Analytics – Log Analysis (CVE-2018-17196) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-from-apache…
∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis susceptible to vulnerability in Apache Tika (CVE-2022-25169) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
∗∗∗ Security Bulletin: Vulnerabilities in SnakeYAML used by Logstash affects IBM Operations Analytics – Log Analysis (CVE-2022-25857, CVE-2017-18640) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-snakey…
∗∗∗ Security Bulletin: IBM DataPower Gateway does not invalidate active sessions on a password change (CVE-2022-40228) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-doe…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. (CVE-2022-22483) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: IBM DataPower Gateway potentially vulnerable to HTTP request smuggling ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-pot…
∗∗∗ Security Bulletin: Vulnerability in Bouncy Castle used by Logstash shipped with IBM Operations Analytics – Log Analysis (CVE-2017-13098) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-bouncy-c…
∗∗∗ Vulnerability Summary for the Week of November 14, 2022 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/bulletins/sb22-325
∗∗∗ Advisory: Impact of Vulnerability in WIBU CodeMeter Runtime to B&R Products ∗∗∗
---------------------------------------------
https://www.br-automation.com/downloads_br_productcatalogue/assets/16677451…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 18-11-2022 18:00 − Montag 21-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ New AxLocker ransomware encrypts files, then steals your Discord account ∗∗∗
---------------------------------------------
The new AXLocker ransomware family is not only encrypting victims files and demanding a ransom payment but also stealing the Discord accounts of infected users.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-axlocker-ransomware-encr…
∗∗∗ Apps with over 3 million installs leak Admin search API keys ∗∗∗
---------------------------------------------
Researchers discovered 1,550 mobile apps leaking Algolia API keys, risking the exposure of sensitive internal services and stored user information.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/apps-with-over-3-million-ins…
∗∗∗ Google releases 165 YARA rules to detect Cobalt Strike attacks ∗∗∗
---------------------------------------------
The Google Cloud Threat Intelligence team has open-sourced YARA Rules and a VirusTotal Collection of indicators of compromise (IOCs) to help defenders detect Cobalt Strike components in their networks.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/google-releases-165-yara-rul…
∗∗∗ McAfee Fake Antivirus Phishing Campaign is Back!, (Sat, Nov 19th) ∗∗∗
---------------------------------------------
Yesterday I received this email that my McAfee antivirus subscription is expired and that my computer is already infected with 5 viruses (how do they know?).
---------------------------------------------
https://isc.sans.edu/diary/rss/29264
∗∗∗ Vulnerable Code Snippets ∗∗∗
---------------------------------------------
YesWeHack present code snippets containing several different vulnerabilities to practice your code analysis. The code snippets are beginner friendly but suitable for all levels!
---------------------------------------------
https://github.com/yeswehack/vulnerable-code-snippets
∗∗∗ A Confused Deputy Vulnerability in AWS AppSync ∗∗∗
---------------------------------------------
We have identified a cross-tenant vulnerability in Amazon Web Services (AWS) that exploits AWS AppSync. This attack abuses the AppSync service to assume IAM roles in other AWS accounts, which allows an attacker to pivot into a victim organization and access resources in those accounts.
---------------------------------------------
https://securitylabs.datadoghq.com/articles/appsync-vulnerability-disclosur…
∗∗∗ 5 free resources from the Cybersecurity and Infrastructure Security Agency (CISA) ∗∗∗
---------------------------------------------
To assist businesses in enhancing their security capabilities, CISA offers free cybersecurity products and services.
---------------------------------------------
https://www.helpnetsecurity.com/2022/11/21/5-free-resources-cybersecurity-a…
∗∗∗ Gefälschtes SMS von Netflix droht mit Kontosperrung ∗∗∗
---------------------------------------------
Aktuell macht ein Netflix-SMS die Runde. Darin steht, dass Sie eine Rechnung nicht bezahlt haben. Daher droht man Ihnen mit einer Kontosperrung. Im SMS befindet sich auch ein Link. Klicken Sie nicht auf den Link, Kriminelle stehlen Ihre Netflix-Zugangsdaten.
---------------------------------------------
https://www.watchlist-internet.at/news/gefaelschtes-sms-von-netflix-droht-m…
∗∗∗ An AI Based Solution to Detecting the DoubleZero .NET Wiper ∗∗∗
---------------------------------------------
Unit 42 presents a machine learning model to predict maliciousness of .NET samples based on file structures, by analyzing the DoubleZero .NET wiper.
---------------------------------------------
https://unit42.paloaltonetworks.com/doublezero-net-wiper/
∗∗∗ Reputationsverlust durch Cyberangriffe ∗∗∗
---------------------------------------------
Die am meisten befürchteten Schäden durch Cyberangriffe sind finanzielle Schäden sowie Verlust von Reputation und Kundenvertrauen. Bei der Umsetzung von Cybersicherheitsmaßnahmen stehen jedoch Schutz von Geschäftskontinuität, Daten und Kunden im Vordergrund.
---------------------------------------------
https://www.zdnet.de/88405082/reputationsverlust-durch-cyberangriffe/
∗∗∗ Luna Moth: Erfolg mit Callback-Phishing ∗∗∗
---------------------------------------------
Die Luna Moth/Silent Ransom Kriminellen erbeuteten durch Callback-Phishing Hunderttausende von Euro, wie eine Analyse von Palo Alto Networks aufdeckt.
---------------------------------------------
https://www.zdnet.de/88405109/luna-moth-erfolg-mit-callback-phishing/
=====================
= Vulnerabilities =
=====================
∗∗∗ Exploit released for actively abused ProxyNotShell Exchange bug ∗∗∗
---------------------------------------------
Proof-of-concept exploit code has been released online for two actively exploited and high-severity vulnerabilities in Microsoft Exchange, collectively known as ProxyNotShell.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/exploit-released-for-activel…
∗∗∗ New attacks use Windows security bypass zero-day to drop malware ∗∗∗
---------------------------------------------
New phishing attacks use a Windows zero-day vulnerability to drop the Qbot malware without displaying Mark of the Web security warnings.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-attacks-use-windows-secu…
∗∗∗ IBM Security Bulletins 2022-11-18 ∗∗∗
---------------------------------------------
Power HMC, InfoSphere Information Server, IBM Operations Analytics, IBM i Access Client Solutions, IBM DataPower Gateway, IBM Tivoli, IBM Spectrum Protect Plus
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (graphicsmagick and krb5), Fedora (dotnet6.0, js-jquery-ui, kubernetes, and xterm), Gentoo (php and postgresql), Mageia (php-pear-CAS, sysstat, varnish, vim, and x11-server), Red Hat (thunderbird), SUSE (389-ds, binutils, dpkg, firefox, frr, grub2, java-11-openjdk, java-17-openjdk, kernel, kubevirt stack, libpano, nodejs16, openjpeg, php7, php74, pixman, python-Twisted, python39, rubygem-loofah, sccache, sudo, thunderbird, tor, and tumbler), [...]
---------------------------------------------
https://lwn.net/Articles/915623/
∗∗∗ PoC Code Published for High-Severity macOS Sandbox Escape Vulnerability ∗∗∗
---------------------------------------------
A security researcher has published details and proof-of-concept (PoC) code for a macOS vulnerability that could be exploited to escape a sandbox and execute code within Terminal.
---------------------------------------------
https://www.securityweek.com/poc-code-published-high-severity-macos-sandbox…
∗∗∗ Typora fails to properly neutralize JavaScript code ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN26044739/
∗∗∗ MISP 2.4.165 released with many improvements, bugs fixed and security fixes. ∗∗∗
---------------------------------------------
https://www.misp-project.org/2022/11/21/MISP.2.4.165.released.html/
∗∗∗ Miele: Vulnerability in ease2pay cloud service used by appWash ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-052/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 17-11-2022 18:00 − Freitag 18-11-2022 18:00
Handler: Robert Waldner
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Zeppelin: Heimlich die Schlüssel einer Ransomware geknackt ∗∗∗
---------------------------------------------
Eine Sicherheitsfirma ist es gelungen die Ransomware Zeppelin zu knacken. Sie half heimlich mehreren Organisationen, wieder an ihre Daten zu gelangen.
---------------------------------------------
https://www.golem.de/news/zeppelin-heimlich-die-schluessel-einer-ransomware…
∗∗∗ Security baseline for Microsoft Edge v107 ∗∗∗
---------------------------------------------
We have reviewed the settings in Microsoft Edge version 107 and updated our guidance with the addition of one new setting. We’re also highlighting three settings we would like you to consider based on your organizational needs.
---------------------------------------------
https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit…
∗∗∗ Successful Hack of Time-Triggered Ethernet ∗∗∗
---------------------------------------------
Time-triggered Ethernet (TTE) is used in spacecraft, basically to use the same hardware to process traffic with different timing and criticality. Researchers have defeated it.
---------------------------------------------
https://www.schneier.com/blog/archives/2022/11/successful-hack-of-time-trig…
∗∗∗ Microsoft Warns of Cybercrime Group Delivering Royal Ransomware, Other Malware ∗∗∗
---------------------------------------------
A threat actor tracked as DEV-0569 and known for the distribution of various malicious payloads was recently observed updating its delivery methods, Microsoft warns.
---------------------------------------------
https://www.securityweek.com/microsoft-warns-cybercrime-group-delivering-ro…
∗∗∗ CISA, NSA, and ODNI Release Guidance for Customers on Securing the Software Supply Chain ∗∗∗
---------------------------------------------
Today, CISA, the National Security Agency (NSA), and the Office of the Director of National Intelligence (ODNI), published the third of a three-part series on securing the software supply chain: Securing Software Supply Chain Series - Recommended Practices Guide for Customers.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/11/17/cisa-nsa-and-odni…
*** #StopRansomware: Hive Ransomware ***
---------------------------------------------
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Health and Human Services (HHS) are releasing this joint CSA to disseminate known Hive IOCs and TTPs identified through FBI investigations as recently as November 2022.
---------------------------------------------
https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (asterisk, firefox-esr, php-phpseclib, phpseclib, python-django, and thunderbird), Fedora (grub2, samba, and thunderbird), Mageia (firefox, sudo, systemd, and thunderbird), Slackware (freerdp), SUSE (firefox, go1.18, go1.19, kernel, openvswitch, python-Twisted, systemd, and xen), and Ubuntu (expat, git, multipath-tools, unbound, and webkit2gtk).
---------------------------------------------
https://lwn.net/Articles/915378/
∗∗∗ WordPress Plugin "WordPress Popular Posts" accepts untrusted external inputs to update certain internal variables ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN13927745/
∗∗∗ Security Bulletin: IBM Operations Analytics – Log Analysis vulnerable to multiple vulnerabilities in Apache Tika (CVE-2022-30126, CVE-2022-33879, CVE-2022-30973) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
∗∗∗ Security Bulletin: Vulnerabilities with Kernel affect IBM Cloud Object Storage Systems (August 2022v2) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-kern…
∗∗∗ Security Bulletin: Rational Asset Analyzer is vulnerable to HTTP header injection (CVE-2022-34165) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-rational-asset-analyzer-i…
∗∗∗ Security Bulletin: Vulnerabilities from log4j affect IBM Operations Analytics – Log Analysis (CVE-2019-17571, CVE-2020-9488) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-from-log4…
∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2022-22488 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-…
∗∗∗ Security Bulletin: Vulnerabilities from log4j-core-2.16.0.jar affect IBM Operations Analytics – Log Analysis (CVE-2021-44832, CVE-2021-45105) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-from-log4…
∗∗∗ Security Bulletin: Rational Asset Analyzer is vulnerable to denial of service due to GraphQL Java (CVE-2022-37734) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-rational-asset-analyzer-i…
∗∗∗ Security Bulletin: Potential vulnerability in Eclipse Jetty affects IBM Operations Analytics – Log Analysis (CVE-2022-2047) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-potential-vulnerability-i…
∗∗∗ Security Bulletin: The Community Edition of IBM ILOG CPLEX Optimization Studio is affected by multiple vulnerabilities in libcurl (CVE-2022-42915, CVE-2022-42916, CVE-2022-32221) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-the-community-edition-of-…
∗∗∗ Security Bulletin: IBM Transform Services for IBM i is vulnerable to denial of service, buffer overflow, and allowing attacker to obtain sensitive information due to multiple vulnerabilities. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-transform-services-fo…
∗∗∗ Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2022-23305) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 16-11-2022 18:00 − Donnerstag 17-11-2022 18:00
Handler: Robert Waldner
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Evil Maid Attacks - Remediation for the Cheap, (Wed, Nov 16th) ∗∗∗
---------------------------------------------
The so-called evil maid attack is an attack against hardware devices utilizing hard- and/or software. It is carried out when the hardware is left unattended, e.g., in a hotel room when you're out for breakfast. The attacker manipulates the device in a malicious way.
---------------------------------------------
https://isc.sans.edu/diary/rss/29256
∗∗∗ WASP malware stings Python developers ∗∗∗
---------------------------------------------
Researchers from Phylum and Check Point earlier this month reported seeing new malicious packages on PyPI, a package index for Python developers. Analysts at Checkmarx this week connected the same attacker to both reports and said the operator is still releasing malicious packages.
---------------------------------------------
https://www.theregister.com/2022/11/16/wasp_python_malware_checkmarx/
∗∗∗ Disneyland Malware Team: It’s a Puny World After All ∗∗∗
---------------------------------------------
A financial cybercrime group calling itself the Disneyland Team has been making liberal use of visually confusing phishing domains that spoof popular bank brands using Punycode, an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic and Ukrainian.
---------------------------------------------
https://krebsonsecurity.com/2022/11/disneyland-malware-team-its-a-puny-worl…
∗∗∗ Onlinebetrug-Simulator: Testen Sie Ihr Wissen zu Betrugsmaschen im Internet ∗∗∗
---------------------------------------------
Um Sie für die Gefahren von Fake-Shops und Phishing-Emails zu sensibilisieren und Sie im Bereich der Cyber-Sicherheit zu schulen, hat die AK Niederösterreich in Kooperation mit der Universität Wien den Onlinebetrug-Simulator ins Leben gerufen.
---------------------------------------------
https://www.watchlist-internet.at/news/onlinebetrug-simulator-testen-sie-ih…
∗∗∗ Domain Controller gegen Angriffe absichern ∗∗∗
---------------------------------------------
Active Directory ist eine kritische Infrastruktur und sollte als solche behandelt werden. Aber wie sichert man als Administrator seine Domain Controller gegen Angriffe?
---------------------------------------------
https://www.borncity.com/blog/2022/11/17/domain-controller-gegen-angriffe-a…
∗∗∗ Get a Loda This: LodaRAT meets new friends ∗∗∗
---------------------------------------------
LodaRAT samples were deployed alongside other malware families, including RedLine and Neshta. Cisco Talos identified several variants and altered versions of LodaRAT with updated functionality have been seen in the wild.
---------------------------------------------
https://blog.talosintelligence.com/get-a-loda-this/
=====================
= Vulnerabilities =
=====================
∗∗∗ Schadcode-Attacken auf Bitbucket Server und Data Center möglich ∗∗∗
---------------------------------------------
Eine Sicherheitslücke bedroht mehrere Versionen von Atlassians Versionsverwaltungssoftware.
---------------------------------------------
https://heise.de/-7343226
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (firefox-esr and thunderbird), Fedora (expat, xen, and xorg-x11-server), Oracle (kernel, kernel-container, qemu, xorg-x11-server, and zlib), Scientific Linux (xorg-x11-server), Slackware (firefox, krb5, samba, and thunderbird), SUSE (ant, apache2-mod_wsgi, jsoup, rubygem-nokogiri, samba, and tomcat), and Ubuntu (firefox and linux, linux-aws, linux-aws-hwe, linux-dell300x, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon).
---------------------------------------------
https://lwn.net/Articles/915245/
∗∗∗ Samba Releases Security Updates ∗∗∗
---------------------------------------------
The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit some of these vulnerabilities to take control of an affected system.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/11/16/samba-releases-se…
∗∗∗ Security Bulletin: IBM Partner Engagement Manager is vulnerable to sensitive data exposure (CVE-2022-34354) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-partner-engagement-ma…
∗∗∗ Security Bulletin: IBM Planning Analytics Workspace is affected by a vulnerability [CVE-2022-31129] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-wo…
∗∗∗ Security Bulletin: CVE-2022-3676 may affect IBM® SDK, Java™ Technology Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-cve-2022-3676-may-affect-…
∗∗∗ Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow – CVE-2022-38390 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln…
∗∗∗ Security Bulletin: IBM InfoSphere DataStage is vulnerable to a command injection vulnerability [CVE-2022-40752] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-datastage-…
∗∗∗ Security Bulletin: Tivoli Business Service Manager is vulnerable to cross-site scripting due to improper validation in Angular (CVE-2022-25869) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-tivoli-business-service-m…
∗∗∗ Security Bulletin: IBM Jazz for Service Management is vulnerable to stored cross-site scripting (CVE-2022-35721) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-mana…
∗∗∗ Security Bulletin: IBM Jazz for Service Management is vulnerable to stored cross-site scripting (CVE-2022-35722) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-mana…
∗∗∗ Security Bulletin: IBM Urbancode Deploy (UCD) is vulnerable to Insufficiently Protected LDAP Search Credentials ( CVE-2022-40751 ) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-urbancode-deploy-ucd-…
∗∗∗ Security Bulletin: Apache Tomcat could allow a remote attacker to obtain sensitive information (CVE-2021-43980) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-apache-tomcat-could-allow…
∗∗∗ Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163) ∗∗∗
---------------------------------------------
https://research.nccgroup.com/2022/11/17/cve-2022-45163/
∗∗∗ Red Lion Crimson ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-321-01
∗∗∗ Cradlepoint IBR600 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-321-02
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 15-11-2022 18:00 − Mittwoch 16-11-2022 18:00
Handler: Robert Waldner
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Forscher erraten Passwörter via Wärmebild mit Machine Learning und KI ∗∗∗
---------------------------------------------
In einem Versuchsaufbau haben Sicherheitsforscher auf einer Tastatur eingetippte zwölfstellige Passwörter mit einer Erfolgsquote von 83 Prozent rekonstruiert.
---------------------------------------------
https://heise.de/-7341957
∗∗∗ ESET APT Activity Report T2 2022 ∗∗∗
---------------------------------------------
Ein Überblick über die Aktivitäten ausgewählter APT-Gruppen, die von ESET Research in T2 2022 untersucht und analysiert wurden.
---------------------------------------------
https://www.welivesecurity.com/deutsch/2022/11/16/apt-activity-report-t2-20…
∗∗∗ Fake Black Friday Gewinnspiele auf WhatsApp und Instagram im Umlauf ∗∗∗
---------------------------------------------
Vorsicht vor betrügerischen Gewinnspielen rund um den Black Friday. Zahlreiche WhatsApp- und Instagram-Nutzer:innen erhalten aktuell betrügerische Nachrichten von Unbekannten, aber auch eigenen Kontakten, die beispielsweise Gewinnspiele im Namen Amazons bewerben. Achtung: Es handelt sich um einen Versuch, Sie in eine Abo-Falle zu locken. Folgen Sie keinen Links in solchen Nachrichten und geben Sie keine Kreditkartendaten bekannt!
---------------------------------------------
https://www.watchlist-internet.at/news/fake-black-friday-gewinnspiele-auf-w…
∗∗∗ Control Your Types or Get Pwned: Remote Code Execution in Exchange PowerShell Backend ∗∗∗
---------------------------------------------
By now you have likely already heard about the in-the-wild exploitation of Exchange Server, chaining CVE-2022-41040 and CVE-2022-41082. It was originally submitted to the ZDI program by the researcher known as “DA-0x43-Dx4-DA-Hx2-Tx2-TP-S-Q from GTSC”. After successful validation, it was immediately submitted to Microsoft. They patched both bugs along with several other Exchange vulnerabilities in the November Patch Tuesday release. It is a beautiful chain, with an ingenious vector [...]
---------------------------------------------
https://www.thezdi.com/blog/2022/11/14/control-your-types-or-get-pwned-remo…
∗∗∗ CVE-2022-41622 and CVE-2022-41800 (FIXED): F5 BIG-IP and iControl REST Vulnerabilities and Exposures ∗∗∗
---------------------------------------------
Rapid7 discovered several vulnerabilities and exposures in specific F5 BIG-IP and BIG-IQ devices in August 2022. Since then, members of our research team have worked with the vendor to discuss impact, resolution, and a coordinated response.
---------------------------------------------
https://www.rapid7.com/blog/post/2022/11/16/cve-2022-41622-and-cve-2022-418…
∗∗∗ Magento stores targeted in massive surge of TrojanOrders attacks ∗∗∗
---------------------------------------------
At least seven hacking groups are behind a massive surge in TrojanOrders attacks targeting Magento 2 websites, exploiting a vulnerability that allows the threat actors to compromise vulnerable servers.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/magento-stores-targeted-in-m…
∗∗∗ Token tactics: How to prevent, detect, and respond to cloud token theft ∗∗∗
---------------------------------------------
As organizations increase their coverage of multifactor authentication (MFA), threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA. Recently, the Microsoft Detection and Response Team (DART) has seen an increase in attackers utilizing token theft for this purpose.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-…
∗∗∗ Packet Tuesday: Network Traffic Analysis for the Whole Family, (Tue, Nov 15th) ∗∗∗
---------------------------------------------
A short while ago, I floated the idea of a weekly video series with short lessons about packets, protocols, and networks. Today, we are kicking of "Packet Tuesday". Packet Tuesday, as the name implies, will release a new video each Tuesday. We will discuss packets in detail. See the first two videos below.
---------------------------------------------
https://isc.sans.edu/diary/rss/29252
∗∗∗ New SocGholish Malware Variant Uses Zip Compression & Evasive Techniques ∗∗∗
---------------------------------------------
Readers of this blog should already be familiar with SocGholish: a widespread, years-long malware campaign aimed at pushing fake browser updates to unsuspecting web users. Once installed, fake browser updates infect the victim’s computer with various types of malware including remote access trojans (RATs). SocGholish malware is often the first step in severe targeted ransomware attacks against corporations and other organizations.
---------------------------------------------
https://blog.sucuri.net/2022/11/new-socgholish-malware-variant-uses-zip-com…
∗∗∗ Researchers Discover Hundreds of Amazon RDS Instances Leaking Users Personal Data ∗∗∗
---------------------------------------------
"Make sure when sharing a snapshot as public that none of your private information is included in the public snapshot," Amazon cautions in its documentation. "When a snapshot is shared publicly, it gives all AWS accounts permission both to copy the snapshot and to create DB instances from it."
---------------------------------------------
https://thehackernews.com/2022/11/researchers-discover-hundreds-of-amazon.h…
=====================
= Vulnerabilities =
=====================
∗∗∗ Cisco Secure Email Gateway Malware Detection Evasion ∗∗∗
---------------------------------------------
This report is being published within a coordinated disclosure procedure. The researcher has been in contact with the vendor but not received a satisfactory response within a given time
frame. As the attack complexity is low and exploits have already been published by a third party there must be no further delay in making the threads publicly known.
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022110021
∗∗∗ Cisco Identity Services Engine Vulnerabilities ∗∗∗
---------------------------------------------
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to inject arbitrary operating system commands, bypass security protections, and conduct cross-site scripting attacks. For more information about these vulnerabilities, see the Details section of this advisory. Cisco plans to release software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (grub2, nginx, and wordpress), Red Hat (389-ds-base, bind, buildah, curl, device-mapper-multipath, dnsmasq, dotnet7.0, dpdk, e2fsprogs, grafana-pcp, harfbuzz, ignition, Image Builder, kernel, keylime, libguestfs, libldb, libtiff, libvirt, logrotate, mingw-zlib, mutt, openjpeg2, podman, poppler, python-lxml, qt5, rsync, runc, samba, skopeo, toolbox, unbound, virt-v2v, wavpack, webkit2gtk3, xorg-x11-server, xorg-x11-server-Xwayland, and yajl), SUSE (389-ds, bluez, dhcp, freerdp, jackson-databind, kernel, LibVNCServer, libX11, nodejs12, nodejs16, php7, php8, python-Mako, python-Twisted, python310, sudo, systemd, and xen), and Ubuntu (mako).
---------------------------------------------
https://lwn.net/Articles/915097/
∗∗∗ RICOH Aficio SP 4210N vulnerable to cross-site scripting ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN24659622/
∗∗∗ Multiple vulnerabilities in Movable Type ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN37014768/
∗∗∗ Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to the October 2022 CPU ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition, Security Update July 2022 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e…
∗∗∗ Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.2ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16 – 2022.4.0 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 14-11-2022 18:00 − Dienstag 15-11-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ DTrack activity targeting Europe and Latin America ∗∗∗
---------------------------------------------
DTrack is a backdoor used by the Lazarus group. Initially discovered in 2019, the backdoor remains in use three years later. It is used by the Lazarus group against a wide variety of targets. [..] So, what’s new? DTrack itself hasn’t changed much over the course of time. Nevertheless, there are some interesting modifications that we want to highlight in this blogpost. Dtrack hides itself inside an executable that looks like a legitimate program, and there are several stages of decryption before the malware payload starts.
---------------------------------------------
https://securelist.com/dtrack-targeting-europe-latin-america/107798/
∗∗∗ ABI compatibility in Python: How hard could it be? ∗∗∗
---------------------------------------------
This post will cover just one tiny piece of Python packaging’s complexity: the CPython stable ABI. We’ll see what the stable ABI is, why it exists, how it’s integrated into Python packaging, and how each piece goes terribly wrong to make accidental ABI violations easy.
---------------------------------------------
https://blog.trailofbits.com/2022/11/15/python-wheels-abi-abi3audit/
∗∗∗ Checkmk: Remote Code Execution by Chaining Multiple Bugs ∗∗∗
---------------------------------------------
Within the series of articles, we take a detailed look at multiple vulnerabilities we identified in Checkmk and its NagVis integration, which can be chained together by an unauthenticated, remote attacker to fully take over the server running a vulnerable version of Checkmk.
---------------------------------------------
https://blog.sonarsource.com/checkmk-rce-chain-3/
∗∗∗ Organizations Warned of Critical Vulnerability in Backstage Developer Portal Platform ∗∗∗
---------------------------------------------
Backstage is affected by a critical vulnerability related to a security hole found earlier this year by Oxeye in the popular sandbox library VM2. The VM2 flaw, dubbed SandBreak and tracked as CVE-2022-36067, can allow a remote attacker to escape the sandbox and execute arbitrary code on the host.
Backstage has been using VM2 and Oxeye researchers discovered that CVE-2022-36067 can be exploited for unauthenticated remote code execution in Backstage by abusing its software templates.
---------------------------------------------
https://www.securityweek.com/organizations-warned-critical-vulnerability-ba…
∗∗∗ Kreditbetrug: Vorsicht vor darlehenexpert.com ∗∗∗
---------------------------------------------
darlehenexpert.com gibt sich als Kreditgeber aus und ermöglicht angeblich Privat- und Autokredite, Hypotheken sowie Darlehen. Interessierte füllen online ein Kreditantragsformular aus und erhalten nach kurzer Zeit eine Zusage. Doch Vorsicht: darlehenexpert.com ist betrügerisch. Sie werden aufgefordert, vorab unterschiedliche Gebühren zu überweisen. Wenn Sie überweisen, verlieren Sie Ihr Geld und erhalten keinen Kredit!
---------------------------------------------
https://www.watchlist-internet.at/news/kreditbetrug-vorsicht-vor-darlehenex…
∗∗∗ Android malware: A million people downloaded these malicious apps before they were finally removed from Google Play ∗∗∗
---------------------------------------------
Cybersecurity researchers identify an aggressive adware campaign. The developer is now banned from Google Play - but if youve not uninstalled the apps, youre still infected. [..] The four apps that have been identified as malicious were from a developer called Mobile apps Group and were called 'Bluetooth Auto Connect', 'Bluetooth App Sender', 'Mobile transfer: smart switch', and 'Driver: Bluetooth, Wi-Fi, USB'.
---------------------------------------------
https://www.zdnet.com/article/android-warning-these-malicious-apps-had-over…
∗∗∗ Windows Server 2012 R2: Sophos User-Authentifizierung mittels Heartbeat auf RDS-Servern abgeschaltet ∗∗∗
---------------------------------------------
Kurzer Hinweis für Administratoren, die Windows Server 2012 R2 einsetzen und sich auf die Sophos User-Authentifizierung per Sophos Security Heartbeats verlassen. Sophos hat ein Update verteilt, welches die Funktion auf Windows Server 2012 R2 stillschweigend außer Kraft setzt.
---------------------------------------------
https://www.borncity.com/blog/2022/11/15/windows-server-2012-r2-sophos-user…
∗∗∗ LKA warnt vor Betrugsmasche mit digitalen Kreditkarten (Nov. 2022) ∗∗∗
---------------------------------------------
Das LKA Niedersachsen warnt vor einer neue Betrugsmasche, die Cyber-Kriminelle erdacht haben. Mittels Phishing-E-Mails, gefälschten Webseiten und digitalen Kreditkarten versuchen sie an Zahlungsdaten der Opfer heranzukommen. Die Daten der digitalen Kreditkarte werden dann für eigene Einkäufe auf Kosten des Opfers missbraucht.
---------------------------------------------
https://www.borncity.com/blog/2022/11/15/lka-warnt-vor-betrugsmasche-mit-di…
∗∗∗ Firmware- und BIOS-Updates: AMD, Intel, Lenovo, HP (Nov. 2022) ∗∗∗
---------------------------------------------
Die Hersteller Lenovo und HP stopfen mit Firmware-Updates entdeckte Schwachstellen im BIOS (und in der Software) ihrer Systeme. Und die Prozessorhersteller AMD sowie Intel haben ebenfalls Sicherheitslücken in ihrer Firmware per Update im November 2022 geschlossen. Hier ein kompakter Überblick über diese Updates.
---------------------------------------------
https://www.borncity.com/blog/2022/11/15/firmware-und-bios-updates-amd-inte…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (kernel and webkit2gtk3), Red Hat (dhcp, dovecot, flac, freetype, fribidi, frr, gimp, grafana, guestfs-tools, httpd, kernel-rt, libtirpc, mingw-gcc, mingw-glib2, pcs, php, protobuf, python3.9, qemu-kvm, redis, speex, and swtpm), SUSE (chromium, containerized-data-importer, jhead, kubevirt stack, nodejs14, nodejs16, python-Werkzeug, and xen), and Ubuntu (golang-1.13, nginx, and vim).
---------------------------------------------
https://lwn.net/Articles/914952/
∗∗∗ Security Vulnerabilities fixed in Thunderbird 102.5 ∗∗∗
---------------------------------------------
In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/
∗∗∗ Security Vulnerabilities fixed in Firefox ESR 102.5 ∗∗∗
---------------------------------------------
CVE-2022-45403: Service Workers might have learned size of cross-origin media files
CVE-2022-45404: Fullscreen notification bypass
CVE-2022-45405: Use-after-free in InputStream implementation
CVE-2022-45406: Use-after-free of a JavaScript Realm
CVE-2022-45408: Fullscreen notification bypass via windowName
CVE-2022-45409: Use-after-free in Garbage Collection
CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/
∗∗∗ Security Vulnerabilities fixed in Firefox 107 ∗∗∗
---------------------------------------------
CVE-2022-45407: Loading fonts on workers was not thread-safe
CVE-2022-45403: Service Workers might have learned size of cross-origin media files
CVE-2022-45404: Fullscreen notification bypass
CVE-2022-45405: Use-after-free in InputStream implementation
CVE-2022-45406: Use-after-free of a JavaScript Realm
CVE-2022-45408: Fullscreen notification bypass via windowName
CVE-2022-45409: Use-after-free in Garbage Collection
CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-47/
∗∗∗ TERASOLUNA Global Framework and TERASOLUNA Server Framework for Java (Rich) vulnerable to ClassLoader manipulation ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN54728399/
∗∗∗ ZDI-22-1592: Parse Server _expandResultOnKeyPath Prototype Pollution Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1592/
∗∗∗ ZDI-22-1591: Parse Server buildUpdatedObject Prototype Pollution Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1591/
∗∗∗ ZDI-22-1590: Parse Server transformUpdate Prototype Pollution Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1590/
∗∗∗ ABB PCM600 Cleartext Credentials Vulnerability ∗∗∗
---------------------------------------------
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001518
∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM HTTP Server is vulnerable to denial of service due to libexpat (CVE-2022-43680, CVE-2013-0340, CVE-2017-9233) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-http-server-is-vulner…
∗∗∗ Security Bulletin: Vulnerability from Apache Kafka affect IBM Operations Analytics – Log Analysis (CVE-2021-38153) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-from-apache…
∗∗∗ PHOENIX CONTACT: Denial-of-Service vulnerability in mGuard product family ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-051/
∗∗∗ Mitsubishi Electric GT SoftGOT2000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-319-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 11-11-2022 18:00 − Montag 14-11-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Jetzt deinstallieren! Sicherheitslücken, aber keine Patches für VMware Hyperic ∗∗∗
---------------------------------------------
Der Support für die IT-Managementsoftware VMware Hyperic ist ausgelaufen. Admins sollten umsteigen.
---------------------------------------------
https://heise.de/-7339160
∗∗∗ Neue Betrugsmasche auf Amazon: Betrügerische Marketplace-Händler stornieren Bestellungen und empfehlen Kauf bei „Amazon-Partnershops“ ∗∗∗
---------------------------------------------
Sabine sucht auf Amazon nach einer Kaffeemaschine. Bei einem Marketplace-Händler findet sie ein günstiges Angebot. Sie bestellt und wartet nun auf die Lieferung. Kurz nach der Bestellung wird der Kauf aber vom Händler storniert. Sie bekommt ein Mail, indem sich der Händler entschuldigt und ihr einen Shop nennt, bei dem sie die Kaffeemaschine zum gleichen Preis bestellen kann. Vorsicht: Dabei handelt es sich um Betrug!
---------------------------------------------
https://www.watchlist-internet.at/news/neue-betrugsmasche-auf-amazon-betrue…
∗∗∗ Extracting HTTP CONNECT Requests with Python, (Mon, Nov 14th) ∗∗∗
---------------------------------------------
Seeing abnormal Suricata alerts isnt too unusual in my home environment. In many cases it may be a TLD being resolved that at one point in time was very suspicious. With the increased legitimate adoption of some of these domains, these alerts have been less useful, although still interesting to investigate. I ran into a few of these alerts one night and when diving deeper there was an unusual amount, frequency, and source of the alerts.
---------------------------------------------
https://isc.sans.edu/diary/rss/29246
∗∗∗ Extracting Information From "logfmt" Files With CyberChef, (Sat, Nov 12th) ∗∗∗
---------------------------------------------
https://isc.sans.edu/diary/rss/29244
∗∗∗ KmsdBot: The Attack and Mine Malware ∗∗∗
---------------------------------------------
Akamai Security Research has observed a new malware that infected our honeypot, which we have dubbed KmsdBot. The botnet infects systems via an SSH connection that uses weak login credentials.
---------------------------------------------
https://www.akamai.com/blog/security-research/kmdsbot-the-attack-and-mine-m…
∗∗∗ Discover 2022’s Nastiest Malware ∗∗∗
---------------------------------------------
For the past year, hackers have been following close behind businesses and families just waiting for the right time to strike. In other words, 2022 has been an eventful year in the threat landscape, with malware continuing to take center stage. The 6 Nastiest Malware of 2022 Since the mainstreaming of ransomware payloads and the [...]
---------------------------------------------
https://www.webroot.com/blog/2022/10/14/discover-2022s-nastiest-malware/
∗∗∗ Typhon Reborn With New Capabilities ∗∗∗
---------------------------------------------
Typhon Stealer, a crypto miner/stealer for hire that was discovered in August 2022, now has an updated version called Typhon Reborn.
---------------------------------------------
https://unit42.paloaltonetworks.com/typhon-reborn-stealer/
∗∗∗ BumbleBee Zeros in on Meterpreter ∗∗∗
---------------------------------------------
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector from a Contact Forms campaign.
---------------------------------------------
https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
∗∗∗ Stories from the SOC: Fortinet authentication bypass observed in the wild ∗∗∗
---------------------------------------------
Fortinet’s newest vulnerability, CVE-2022-40684, allowing for authentication bypass to manipulate admin SSH keys, unauthorized downloading of configuration files, and creating of super admin accounts, is put a big target on the back’s of unpatched and exposed Fortinet devices.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-so…
=====================
= Vulnerabilities =
=====================
∗∗∗ HP-BIOS: Pufferüberlauf ermöglicht Rechteausweitung, Update ist verfügbar ∗∗∗
---------------------------------------------
HP warnt vor einer Sicherheitslücke im BIOS zahlreicher Notebooks und PC. Angreifer könnten dadurch ihre Rechte ausweiten oder beliebigen Code ausführen.
---------------------------------------------
https://heise.de/-7339122
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (dropbear, php7.4, pixman, sysstat, and xorg-server), Fedora (mingw-expat, mingw-libtasn1, and mingw-pixman), Mageia (binutils/gdb, chromium-browser-stable, exiv2, libtiff, nodejs, pcre, pixman, wayland, and webkit2), Red Hat (device-mapper-multipath and libksba), SUSE (autotrace, busybox, libmodbus, php72, python-numpy, rustup, samba, varnish, xen, and xterm), and Ubuntu (thunderbird).
---------------------------------------------
https://lwn.net/Articles/914811/
∗∗∗ Path Traversal Schwachstelle in Payara Platform ∗∗∗
---------------------------------------------
Aufgrund einer fehlerhaften Pfadüberprüfung in der Payara Software ist es möglich, die Konfigurations- oder Sourcecode-Dateien von Webanwendungen in den Verzeichnissen WEB-INF und META-INF über eine Path Traversal Schwachstelle zu lesen.
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/path-traversal-vulner…
∗∗∗ Vielfältige Schwachstellen in BACKCLICK Professional (SYSS-2022-026 bis -037) ∗∗∗
---------------------------------------------
https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-p…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42003) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: A vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44832) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. (CVE-2022-35637) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: Vulnerability in Apache Log4j affects some features of IBM® Db2® (CVE-2021-44228) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-l…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. (CVE-2022-22483) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: Multiple vulnerabilities in Apache Log4j affects some features of IBM® Db2® (CVE-2021-45046, CVE-2021-45105) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure caused by improper privilege management when table function is used. (CVE-2022-22390) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: IBM MQ Internet Pass-Thru traces sensitive data (CVE-2022-35719) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-internet-pass-thru…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 10-11-2022 18:00 − Freitag 11-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ US Health Dept warns of Venus ransomware targeting healthcare orgs ∗∗∗
---------------------------------------------
The U.S. Department of Health and Human Services (HHS) warned today that Venus ransomware attacks are also targeting the countrys healthcare organizations.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/us-health-dept-warns-of-venu…
∗∗∗ Microsoft fixes Windows zero-day bug exploited to push malware ∗∗∗
---------------------------------------------
Windows has fixed a bug that prevented Mark of the Web flags from propagating to files within downloaded ISO files, dealing a massive blow to malware distributors and developers.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-zer…
∗∗∗ NIS2-Richtlinie: Domaininhaber müssen künftig Adressdaten hinterlegen ∗∗∗
---------------------------------------------
Die neue EU-Richtlinie zur IT-Sicherheit (NIS2) untersagt die anonyme Registrierung von Domains.
---------------------------------------------
https://www.golem.de/news/nis2-richtlinie-domaininhaber-muessen-kuenftig-ad…
∗∗∗ Sicherheitslücke: Sperrbildschirm von Pixel-Smartphones ließ sich umgehen ∗∗∗
---------------------------------------------
Einem Forscher ist es gelungen, ein Pixel-Smartphone von Google ohne PIN zu entsperren. Doch Fix und Bug Bounty ließen lange auf sich warten.
---------------------------------------------
https://www.golem.de/news/sicherheitsluecke-sperrbildschirm-von-pixel-smart…
∗∗∗ Cisco dichtet Sicherheitslecks in ASA und Firepower ab ∗∗∗
---------------------------------------------
Cisco dichtet teils hochriskante Sicherheitslücken in der Software der Adaptive Security Appliance und Firepower Threat Defense. Admins sollten aktiv werden.
---------------------------------------------
https://heise.de/-7336757
∗∗∗ Digitalbarometer 2022: Weiter leichtes Spiel für Cyber-Kriminelle ∗∗∗
---------------------------------------------
BSI und Polizeiliche Kriminalprävention der Länder und des Bundes (ProPK) veröffentlichen die vierte gemeinsame Bürgerbefragung: Viele Bürgerinnen und Bürger vernachlässigen grundlegende Maßnahmen, um sich vor Angriffen im Netz zu schützen.
---------------------------------------------
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse202…
∗∗∗ CISA Releases Decision Tree Model to Help Companies Prioritize Vulnerability Patching ∗∗∗
---------------------------------------------
The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday announced the release of a Stakeholder-Specific Vulnerability Categorization (SSVC) guide that can help organizations prioritize vulnerability patching using a decision tree model.
---------------------------------------------
https://www.securityweek.com/cisa-releases-decision-tree-model-help-compani…
∗∗∗ Phishing-resistente Multifaktor Authentifizierung ∗∗∗
---------------------------------------------
Multifaktor Authentifizierung (MFA) kann durch Phishing ausgehebelt werden. Es kommt darauf an, MFA widerstandsfähiger zu machen, betont Lance Spitzner, SANS Security Awareness Director, in einem Gastbeitrag.
---------------------------------------------
https://www.zdnet.de/88404820/phishing-resistente-multifaktor-authentifizie…
∗∗∗ HackHound IRC Bot Being Distributed via Webhards ∗∗∗
---------------------------------------------
Webhards are the main platforms that the attackers targeting Korean users exploit to distribute malware. The ASEC analysis team has been monitoring malware types distributed through webhards and uploaded multiple blog posts about them in the past.
---------------------------------------------
https://asec.ahnlab.com/en/41806/
∗∗∗ CVE-2019-8561: A Hard-to-Banish PackageKit Framework Vulnerability in macOS ∗∗∗
---------------------------------------------
This blog entry details our investigation of CVE-2019-8561, a vulnerability that exists in the macOS PackageKit framework, a component used to install software installer packages (PKG files).
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/k/cve-2019-8561-a-hard-to-bani…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium and exiv2), Fedora (curl, device-mapper-multipath, dotnet6.0, mediawiki, mingw-gcc, and php-pear-CAS), Gentoo (lesspipe), Slackware (php), SUSE (git, glibc, kernel, libarchive, python, python-rsa, python3-lxml, rpm, sudo, xen, and xwayland), and Ubuntu (wavpack).
---------------------------------------------
https://lwn.net/Articles/914571/
∗∗∗ Preisgabe von sensiblen Informationen in Zoom (SYSS-2022-048) ∗∗∗
---------------------------------------------
Bei einer Videokonferenz über Zoom werden Chatnachrichten im Installationsverzeichnis gespeichert. Ein Angreifer kann diese Nachrichten entschlüsseln.
---------------------------------------------
https://www.syss.de/pentest-blog/preisgabe-von-sensiblen-informationen-in-z…
∗∗∗ Rapid7’s Impact from OpenSSL Buffer Overflow Vulnerabilities (CVE-2022-3786 & CVE-2022-3602) ∗∗∗
---------------------------------------------
CVE-2022-3786 & CVE-2022-3602 vulnerabilities affecting OpenSSL’s 3.0.x versions both rely on a maliciously crafted email address in a certificate.
---------------------------------------------
https://www.rapid7.com/blog/post/2022/11/11/rapid7s-impact-from-openssl-buf…
∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® Semeru Runtime ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM InfoSphere DataStage is vulnerable to a command injection vulnerability [CVE-2022-40752] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-datastage-…
∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime used by the IBM Installation Manager and IBM Packaging Utility – CVE-2021-2163 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
∗∗∗ Omron NJ/NX-series Machine Automation Controllers ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-07
∗∗∗ Omron NJNX-series ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-314-08
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 09-11-2022 18:00 − Donnerstag 10-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ New StrelaStealer malware steals your Outlook, Thunderbird accounts ∗∗∗
---------------------------------------------
A new information-stealing malware named StrelaStealer is actively stealing email account credentials from Outlook and Thunderbird, two widely used email clients.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-strelastealer-malware-st…
∗∗∗ VU#434994: Multiple race conditions due to TOCTOU flaws in various UEFI Implementations ∗∗∗
---------------------------------------------
Multiple Unified Extensible Firmware Interface (UEFI) implementations are vulnerable to code execution in System Management Mode (SMM) by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access (DMA) timing attacks that can lead to code execution. These threats are collectively referred to as RingHopper attacks.
---------------------------------------------
https://kb.cert.org/vuls/id/434994
∗∗∗ Windows breaks under upgraded IceXLoader malware ∗∗∗
---------------------------------------------
Were the malware of Nim! A malware loader deemed in June to be a "work in progress" is now fully functional and infecting thousands of Windows corporate and home PCs.…
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/11/10/icexloader_m…
∗∗∗ [SANS ISC] Do you collect “Observables” or “IOCs”? ∗∗∗
---------------------------------------------
Indicators of Compromise, or IOCs, are key elements in blue team activities. IOCs are mainly small pieces of technical information that have been collected during investigations, threat hunting activities or malware analysis.
---------------------------------------------
https://blog.rootshell.be/2022/11/10/sans-isc-do-you-collect-observables-or…
∗∗∗ Phishing-Resistant MFA Does Not Mean Un-Phishable ∗∗∗
---------------------------------------------
Human societies have a bad habit of taking a specific, limited-in-scope fact and turning it into an overly broad generalization that gets incorrectly believed and perpetuated as if it were as comprehensively accurate as the original, more-limited fact it was based on. Anything can be hacked. Do not confuse “phishing-resistant” with being impossible to phish or socially engineer.
---------------------------------------------
https://www.linkedin.com/pulse/phishing-resistant-mfa-does-mean-un-phishabl…
∗∗∗ The Case of Cloud9 Chrome Botnet ∗∗∗
---------------------------------------------
The Zimperium zLabs team recently discovered a malicious browser extension, which not only steals the information available during the browser session but can also install malware on a user’s device and subsequently assume control of the entire device. In this blog, we will take a deeper look into the architecture and modus operandi of this malicious browser extension, originally called Cloud9, by the malware author.
---------------------------------------------
https://www.zimperium.com/blog/the-case-of-cloud9-chrome-botnet/
∗∗∗ Certificates and Pwnage and Patches, Oh My! ∗∗∗
---------------------------------------------
A lot has happened since we released the “Certified Pre-Owned” blog post and whitepaper in June of last year. [...] A lot of organizations (and a lot of pentesters ;) definitely realized how pervasive misconfigurations in Active Directory Certificate Service are and how easy it is now to enumerate and abuse these issues. [...] With all of these changes, we wanted to revisit some of the offensive AD CS attacks, detail how the patch has affected some of the existing escalations, and
---------------------------------------------
https://posts.specterops.io/certificates-and-pwnage-and-patches-oh-my-8ae0f…
∗∗∗ The November 2022 Security Update Review ∗∗∗
---------------------------------------------
Welcome to the penultimate Patch Tuesday of 2021. As expected, Adobe and Microsoft have released their latest security updates and fixes to the world. Take a break from your regularly scheduled activities and join us as we review the details of their latest security offerings.
---------------------------------------------
https://www.thezdi.com/blog/2022/11/8/the-november-2022-security-update-rev…
∗∗∗ How LNK Files Are Abused by Threat Actors ∗∗∗
---------------------------------------------
LNK files are based on the Shell Link Binary file format, also known as Windows shortcuts. But what seems a relatively simple ability to execute other binaries on the system can inflict great harm when abused by threat actors.
---------------------------------------------
https://www.intezer.com/blog/malware-analysis/how-threat-actors-abuse-lnk-f…
∗∗∗ Penetration and Distribution Method of Gwisin Attacker ∗∗∗
---------------------------------------------
The attacker of Gwisin ransomware targets and penetrates the publicly available servers of companies. They then use the server as their foothold for distributing the ransomware into the internal infrastructure. It is known that the attacker uses various means such as SFTP, WMI, integrated management solution, and IIS web service to distribute the ransomware into the internal infrastructure. In this confirmed case, they used the IIS web service to distribute Gwisin ransomware.
---------------------------------------------
https://asec.ahnlab.com/en/41565/
=====================
= Vulnerabilities =
=====================
∗∗∗ Bios: Sicherheitslücken im UEFI etlicher Lenovo-Laptops ∗∗∗
---------------------------------------------
Lenovo hat Treiber verwendet, die nur für die Produktion vorgesehen waren. Dadurch lässt sich Secure Boot aus dem Betriebssystem heraus deaktivieren.
---------------------------------------------
https://www.golem.de/news/bios-sicherheitsluecken-im-uefi-etlicher-lenovo-l…
∗∗∗ Aiphone Video Multi-Tenant System Entrance Stations vulnerable to information disclosure ∗∗∗
---------------------------------------------
Video Multi-Tenant System Entrance Stations provided by AIPHONE CO., LTD. contain an information disclosure vulnerability.
---------------------------------------------
https://jvn.jp/en/jp/JVN75437943/
∗∗∗ Cisco Security Advisories 2022-11-09 ∗∗∗
---------------------------------------------
Cisco Adaptive Security Appliance Software, Cisco FXOS Software, Cisco FirePOWER Software for ASA FirePOWER Module, Cisco Firepower Management Center Software, Cisco Firepower Threat Defense Software, Cisco NGIPS Software, Cisco Secure Firewall 3100 Series, Multiple Cisco Products Snort SMB2 Detection Engine
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first…
∗∗∗ IBM Security Bulletins 2022-11-09 ∗∗∗
---------------------------------------------
IBM Cloud Pak for Security, IBM Master Data Management, IBM Planning Analytics, IBM Planning Analytics Workspace, IBM QRadar, IBM Tivoli Business Service Manager
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ HTML Injection in BMC Remedy ITSM-Suite ∗∗∗
---------------------------------------------
Die Anwendung BMC Remedy erlaubt es Benutzern Incidents über Email weiterzuleiten. Im Email Editor ist es möglich HTML-Code in das "To" Feld einzufügen. Danach zeigt die Anwendung an, dass der Incident an Empfänger weitergeleitet wurde. Durch Klicken auf die Anzahl der Empfänger wird der eingefügte HTML-Code geladen und ausgeführt.
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/html-injection-in-bmc…
∗∗∗ CVE-2022-0031 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine ∗∗∗
---------------------------------------------
A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attacker with shell access to the engine to execute programs with elevated privileges.
---------------------------------------------
https://security.paloaltonetworks.com/CVE-2022-0031
∗∗∗ Bugfix-Updates: Apple stellt macOS 13.0.1, iPadOS 16.1.1 und iOS 16.1.1 bereit ∗∗∗
---------------------------------------------
Fehlerbehebungen und gestopfte Sicherheitslücken außer der Reihe: Apple legt macOS 13.0.1, iPadOS 16.1.1 und iOS 16.1.1 für Mac, iPad und iPhone vor.
---------------------------------------------
https://heise.de/-7335516
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libjettison-java and xorg-server), Slackware (sysstat and xfce4), SUSE (python3 and xen), and Ubuntu (firefox).
---------------------------------------------
https://lwn.net/Articles/914347/
∗∗∗ Unit 42 Finds Three Vulnerabilities in OpenLiteSpeed Web Server ∗∗∗
---------------------------------------------
Unit 42 discovered three vulnerabilities in OpenLiteSpeed Web Server and LiteSpeed Web Server that could be used together for remote code execution.
---------------------------------------------
https://unit42.paloaltonetworks.com/openlitespeed-vulnerabilities/
∗∗∗ [R1] Nessus Version 8.15.7 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Nessus leverages third-party software to help provide underlying functionality. Several of the third-party components (expat, libxml2, zlib) were found to contain vulnerabilities, and updated versions have been made available by the providers.Out of caution and in line with good practice, Tenable has opted to upgrade these components to address the potential impact of the issues.
---------------------------------------------
https://www.tenable.com/security/tns-2022-26
∗∗∗ 2022-12 Multiple Java SE vulnerabilities in Belden/Hirschmann software products ∗∗∗
---------------------------------------------
https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=14996&mediaformat…" target="_blank
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 08-11-2022 18:00 − Mittwoch 09-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Intel, AMD Address Many Vulnerabilities With Patch Tuesday Advisories ∗∗∗
---------------------------------------------
Intel and AMD have announced fixes for many vulnerabilities on this Patch Tuesday, including for flaws that have been assigned a ‘high severity’ rating.
---------------------------------------------
https://www.securityweek.com/intel-amd-address-many-vulnerabilities-patch-t…
∗∗∗ Microsoft: Windows 10 21H1 reaches end of service next month ∗∗∗
---------------------------------------------
Microsoft has reminded customers today that all editions of Windows 10 21H1 (also known as the May 2021 Update) are reaching the end of service (EOS) next month.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-10-21h1-r…
∗∗∗ Lenovo fixes flaws that can be used to disable UEFI Secure Boot ∗∗∗
---------------------------------------------
Lenovo has fixed two high-severity vulnerabilities impacting various ThinkBook, IdeaPad, and Yoga laptop models that could allow an attacker to deactivate UEFI Secure Boot.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/lenovo-fixes-flaws-that-can-…
∗∗∗ Phishing-Resistant MFA Does Not Mean Un-Phishable ∗∗∗
---------------------------------------------
Human societies have a bad habit of taking a specific, limited-in-scope fact and turning it into an overly broad generalization that gets incorrectly believed and perpetuated as if it were as comprehensively accurate as the original, more-limited fact it was based on. Anything can be hacked. Do not confuse “phishing-resistant” with being impossible to phish or socially engineer.
---------------------------------------------
https://www.linkedin.com/pulse/phishing-resistant-mfa-does-mean-un-phishabl…
∗∗∗ SMS „Hallo Mama, mein Handy ist kaputt“ ist betrügerisch! ∗∗∗
---------------------------------------------
Eine großangelegte SMS-Betrugsmasche sorgt aktuell für Verunsicherung bei Empfänger:innen. Der Inhalt der „Hallo Mama“ oder „Hallo Papa“ SMS soll vermitteln, dass das eigene Kind eine neue Nummer hätte. Das Kind bittet deshalb um Kontaktaufnahme über WhatsApp. Wer hier antwortet, wird schon bald vom vermeintlichen Kind zu Zahlungen aufgefordert. Ignorieren Sie die Nachrichten und führen Sie auf keinen Fall Überweisungen durch.
---------------------------------------------
https://www.watchlist-internet.at/news/sms-hallo-mama-mein-handy-ist-kaputt…
∗∗∗ Massive ois[.]is Black Hat Redirect Malware Campaign ∗∗∗
---------------------------------------------
Since September 2022, our research team has tracked a surge in WordPress malware redirecting website visitors to fake Q&A sites via ois[.]is. These malicious redirects appear to be designed to increase the authority of the attacker’s sites for search engines. PublicWWW results show nearly 15,000 websites have been affected by this malware so far.
---------------------------------------------
https://blog.sucuri.net/2022/11/massive-ois-is-black-hat-redirect-malware-c…
∗∗∗ Threat Spotlight: Cyber Criminal Adoption of IPFS for Phishing, Malware Campaigns ∗∗∗
---------------------------------------------
The InterPlanetary File System (IPFS) is an emerging Web3 technology that is currently seeing widespread abuse by threat actors. Cisco Talos has observed multiple ongoing campaigns that leverage the IPFS network to host their malware payloads and phishing kit infrastructure while facilitating other attacks.
---------------------------------------------
https://blog.talosintelligence.com/ipfs-abuse/
∗∗∗ Check Point CloudGuard Spectral exposes new obfuscation techniques for malicious packages on PyPI ∗∗∗
---------------------------------------------
Check Point Research (CPR) detects a new and unique malicious package on PyPI, the leading package index used by developers for the Python programming language The new malicious package was designed to hide code in images and infect through open-source projects on Github CPR responsibly disclosed this information to PyPI, who removed the packages.
---------------------------------------------
https://research.checkpoint.com/2022/check-point-cloudguard-spectral-expose…
=====================
= Vulnerabilities =
=====================
∗∗∗ Microsoft fixes ProxyNotShell Exchange zero-days exploited in attacks ∗∗∗
---------------------------------------------
Microsoft has released security updates to address two high-severity Microsoft Exchange zero-day vulnerabilities collectively known as ProxyNotShell and exploited in the wild.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-proxynotshe…
∗∗∗ Kritische Sicherheitslücken in VMware Workspace ONE - Updates verfügbar ∗∗∗
---------------------------------------------
VMware hat Updates für drei kritische Authentication Bypass Sicherheitslücken im Remote-Access-Tool VMware Workspace ONE veröffentlicht. Entfernte, anonyme Angreifer:innen können die Authentifizierung in erreichbaren VMware Workspace ONE Instanzen umgehen und Administratorrechte auf den betroffenen Systemen erlangen.
---------------------------------------------
https://cert.at/de/warnungen/2022/11/kritische-sicherheitslucken-in-vmware-…
∗∗∗ Citrix Gateway und ADC: Kritische Lücke ermöglicht unbefugten Zugriff ∗∗∗
---------------------------------------------
Citrix schließt Sicherheitslücken, durch die Angreifer etwa unberechtigt auf die Gerätefunktionen zugreifen können. Administratoren sollten zügig aktualisieren.
---------------------------------------------
https://heise.de/-7334851
∗∗∗ Multiple vulnerabilities in WordPress ∗∗∗
---------------------------------------------
WordPress contains multiple vulnerabilities listed below which are to the WordPress Post by Email Feature.
---------------------------------------------
https://jvn.jp/en/jp/JVN09409909/
∗∗∗ IBM Security Bulletins 2022-11-08 ∗∗∗
---------------------------------------------
IBM App Connect Enterprise, IBM Cloud Application Business Insights, IBM Security Guardium, IBM Security Verify Access
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Lenovo Product Security Advisories 2022-11-08 ∗∗∗
---------------------------------------------
AMD Graphics Driver, AMD IBPB Return Branch Predictions, Brocade EZSwitch, Elan UltraNav and MiniPort Driver, Intel AMT SDK, Intel EMA, Intel MC, Intel Chipset Firmware, Intel PROSet Wireless WiFi, Intel vPro CSME WiFi, Killer WiFi, Intel SGX SDK, Lenovo Diagnostics, Lenovo Notebook BIOS, Lenovo Vantage Component, Multi-Vendor BIOS
---------------------------------------------
https://support.lenovo.com/at/en/product_security/home
∗∗∗ Cisco Security Advisories 2022-11-09 ∗∗∗
---------------------------------------------
Cisco Adaptive Security Appliance Software, Cisco FXOS Software, Cisco FirePOWER Software for ASA FirePOWER Module, Cisco Firepower Management Center Software, Cisco Firepower Threat Defense Software, Cisco NGIPS Software, Cisco Secure Firewall 3100 Series, Multiple Cisco Products Snort SMB2 Detection Engine
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first…
∗∗∗ Webbrowser: Zehn Sicherheitslücken weniger in Google Chrome ∗∗∗
---------------------------------------------
In dem jetzt verfügbaren Update für den Webbrowser Chrome schließt Google 10 Sicherheitslücken. Mit manipulierten Webseiten könnten Angreifer Code ausführen.
---------------------------------------------
https://heise.de/-7334255
∗∗∗ Foxit PDF Reader: Schadcode-Attacken über präparierte PDFs möglich ∗∗∗
---------------------------------------------
Die Foxit-Entwickler haben in ihren PDF-Anwendungen unter macOS und Windows Sicherheitslücken geschlossen.
---------------------------------------------
https://heise.de/-7334993
∗∗∗ Patchday: SAP stopft neun zum Teil kritische Schwachstellen ∗∗∗
---------------------------------------------
Am November-Patchday dichtet SAP teils kritische Sicherheitslücken in mehreren Produkten ab. Administratoren sollten sie zügig auf den aktuellen Stand bringen.
---------------------------------------------
https://heise.de/-7334573
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (vim, webkit2gtk, and wpewebkit), Fedora (mingw-python3, vim, webkit2gtk3, webkitgtk, and xen), Mageia (389-ds-base, bluez, ffmpeg, libtasn1, libtiff, libxml2, and mbedtls), Red Hat (kpatch-patch and linux-firmware), SUSE (conmon, containerized data importer, exim, expat, ganglia-web, gstreamer-0_10-plugins-base, gstreamer-0_10-plugins-good, gstreamer-plugins-base, gstreamer-plugins-good, kernel, kubevirt, protobuf, sendmail, and vsftpd), and Ubuntu (libzstd, openjdk-8, openjdk-lts, openjdk-17, openjdk-19, php7.2, php7.4, php8.1, and pixman).
---------------------------------------------
https://lwn.net/Articles/914221/
∗∗∗ Zahlreiche kritische Schwachstellen in Simmeth System GmbH Lieferantenmanager ∗∗∗
---------------------------------------------
Die Software Lieferantenmanager der Simmeth System GmbH ist von mehreren kritischen Schwachstellen betroffen. Durch diese lassen sich beliebige Befehle ohne Authentifizierung auf dem SQL Server ausführen. Des Weiteren können beliebige Dateien auf dem Webserver gelesen und Nutzersessions gestohlen werden. Außerdem wurde das E-Mail Passwort der Firma Simmeth mithilfe eines unauthentifizierten Requests ausgelesen.
---------------------------------------------
https://sec-consult.com/de/vulnerability-lab/advisory/multiple-critical-vul…
∗∗∗ [R1] Nessus Network Monitor Version 6.1.1 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Nessus Network Monitor leverages third-party software to help provide underlying functionality. One of the third-party components (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers.
---------------------------------------------
https://www.tenable.com/security/tns-2022-25
∗∗∗ Xen Security Advisory CVE-2022-23824 / XSA-422 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-422.html
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 07-11-2022 18:00 − Dienstag 08-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ How to mimic Kerberos protocol transition using reflective RBCD ∗∗∗
---------------------------------------------
We know that a delegation is dangerous if an account allows delegating third-party user authentication to a privileged resource. In the case of constrained delegation, all it takes is to find a privileged account in one of the SPN (Service Principal Name) set in the msDS-AllowedToDelegateTo attribute of a compromised service account.
---------------------------------------------
https://medium.com/tenable-techblog/how-to-mimic-kerberos-protocol-transiti…
∗∗∗ Azov-Malware zerstört Dateien in 666-Byte-Schritten ∗∗∗
---------------------------------------------
Der Windows-Schädling Azov ist ein Wiper und vernichtet Dateien unwiderruflich. Sicherheitsforscher beobachten ein erhöhtes Aufkommen.
---------------------------------------------
https://heise.de/-7333231
∗∗∗ Open Bug Bounty: Eine Million Sicherheitslücken im Web behoben ∗∗∗
---------------------------------------------
Eine offene Plattform für das Offenlegen von Sicherheitslücken im Web hat einen Meilenstein erreicht. Open Bug Bounty verzeichnet über 1,3 Mio. Entdeckungen.
---------------------------------------------
https://heise.de/-7333872
∗∗∗ Achtung Fake-Shop: marktstores.com gibt sich als Media Markt aus ∗∗∗
---------------------------------------------
Die Playstation 5 ist momentan überall ausverkauft. Vorsicht, wenn Sie im Internet dennoch einen Anbieter finden, der sie angeblich liefern kann. Dieser könnte sich als Fake-Shop herausstellen.
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-fake-shop-marktstorescom-gib…
∗∗∗ LockBit 3.0 Being Distributed via Amadey Bot ∗∗∗
---------------------------------------------
The ASEC analysis team has confirmed that attackers are using Amadey Bot to install LockBit. Amadey Bot, a malware that was first discovered in 2018, is capable of stealing information and installing additional malware by receiving commands from the attacker.
---------------------------------------------
https://asec.ahnlab.com/en/41450/
∗∗∗ Prepare, respond & recover: Battling complex Cybersecurity threats with fundamentals ∗∗∗
---------------------------------------------
The cybersecurity industry has seen a lot of recent trends. For example, the proliferation of multifactor authentication (MFA) to fight against credential harvesting is a common thread.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/prepare-respond-rec…
∗∗∗ Cracking 2.3M Attackers-Supplied Credentials: What Can We Learn from RDP Attacks ∗∗∗
---------------------------------------------
To study credentials attacks on RDP, we operate high-interaction honeypots on the Internet. We analyzed over 2.3 million connections that supplied hashed credentials and attempted to crack them.
---------------------------------------------
https://www.gosecure.net/blog/2022/11/08/cracking-2-3m-attackers-supplied-c…
∗∗∗ DeimosC2: What SOC Analysts and Incident Responders Need to Know About This C&C Framework ∗∗∗
---------------------------------------------
This report provides defenders and security operations center teams with the technical details they need to know should they encounter the DeimosC2 C&C framework.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/k/deimosc2-what-soc-analysts-a…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-11-07 ∗∗∗
---------------------------------------------
IBM Tivoli Monitoring, IBM App Connect Enterprise Certified Container, IBM Operations Analytics - Log Analysis
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Siemens Security Advisories 2022-11-08 ∗∗∗
---------------------------------------------
Siemens released 9 new and 8 updated Advisories. (CVSS Scores 5.3-9.9)
---------------------------------------------
https://new.siemens.com/global/en/products/services/cert.html?d=2022-11#Sec…
∗∗∗ Patchday: Angreifer könnten Android-Geräte über Attacken lahmlegen ∗∗∗
---------------------------------------------
Google hat wichtige Sicherheitsupdates für Android 10 bis 13 veröffentlicht. Einige andere Hersteller bieten ebenfalls Patches an.
---------------------------------------------
https://heise.de/-7333334
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (pixman and sudo), Fedora (mingw-binutils and mingw-gdb), Red Hat (bind, bind9.16, container-tools:3.0, container-tools:4.0, container-tools:rhel8, dnsmasq, dotnet7.0, dovecot, e2fsprogs, flatpak-builder, freetype, fribidi, gdisk, grafana, grafana-pcp, gstreamer1-plugins-good, httpd:2.4, kernel, kernel-rt, libldb, libreoffice, libtiff, libxml2, mingw-expat, mingw-zlib, mutt, nodejs:14, nodejs:18, openblas, openjpeg2, osbuild, pcs, php:7.4, php:8.0, [...]
---------------------------------------------
https://lwn.net/Articles/914119/
∗∗∗ ICS Patch Tuesday: Siemens Addresses Critical Vulnerabilities ∗∗∗
---------------------------------------------
Siemens and Schneider Electric have released their Patch Tuesday advisories for November 2022. Siemens has released nine new security advisories covering a total of 30 vulnerabilities, but Schneider has only published one new advisory.
---------------------------------------------
https://www.securityweek.com/ics-patch-tuesday-siemens-addresses-critical-v…
∗∗∗ Varnish HTTP/2 Request Forgery ∗∗∗
---------------------------------------------
https://docs.varnish-software.com/security/VSV00011/
∗∗∗ Open Source Varnish Request Smuggling ∗∗∗
---------------------------------------------
https://docs.varnish-software.com/security/VSV00010/
∗∗∗ PHOENIX CONTACT: Automationworx BCP File Parsing Vulnerabilities ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-048/
∗∗∗ Citrix Gateway and Citrix ADC Security Bulletin for CVE-2022-27510 CVE-2022-27513 and CVE-2022-27516 ∗∗∗
---------------------------------------------
https://support.citrix.com/article/CTX463706/citrix-gateway-and-citrix-adc-…
∗∗∗ McAfee Total Protection: Update fixt Schwachstelle CVE-2022-43751 ∗∗∗
---------------------------------------------
https://www.borncity.com/blog/2022/11/08/mcafee-total-protection-update-fix…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 04-11-2022 18:00 − Montag 07-11-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Windows Malware with VHD Extension, (Sat, Nov 5th) ∗∗∗
---------------------------------------------
Windows 10 supports various virtual drives natively and can recognize and use ISO, VHD and VHDX files. The file included as an attachment with this email, when extracted appears in the email as a PDF but is is in fact a VHD file.
---------------------------------------------
https://isc.sans.edu/diary/rss/29222
∗∗∗ IPv4 Address Representations, (Sun, Nov 6th) ∗∗∗
---------------------------------------------
A reader asked for help with this maldoc. Not with the analysis itself, but how to understand where the URL is pointing to.
---------------------------------------------
https://isc.sans.edu/diary/rss/29224
∗∗∗ Experts Find URLScan Security Scanner Inadvertently Leaks Sensitive URLs and Data ∗∗∗
---------------------------------------------
Security researchers are warning of "a trove of sensitive information" leaking through urlscan.io, a website scanner for suspicious and malicious URLs. "Sensitive URLs to shared documents, password reset pages, team invites, payment invoices and more are publicly listed and searchable," Positive Security co-founder, Fabian Bräunlein, said in a report published on November 2, 2022.
---------------------------------------------
https://thehackernews.com/2022/11/experts-find-urlscan-security-scanner.html
∗∗∗ AWS Organizations Defaults ∗∗∗
---------------------------------------------
[...] These things combined mean that, should an attacker compromise the management account, the default behavior of AWS Organizations provides a path to compromise every account in the organization as an administrator. For offensive security professionals, identifying paths into the management account can be an incredibly fruitful exercise, and may result in an entire organization compromise.
---------------------------------------------
https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/
∗∗∗ Kommentar: Angriffe lassen sich nicht vermeiden – übernehmt die Verantwortung! ∗∗∗
---------------------------------------------
Shit happens, ebenso wie Sicherheitsvorfälle. Die Frage kann also nur sein, wie damit umzugehen ist - vorher wie nachher.
---------------------------------------------
https://heise.de/-7328918
∗∗∗ Versteckte Kosten für Kündigungen auf stornierenbei.de ∗∗∗
---------------------------------------------
Wenn Sie einen Vertrag kündigen wollen und dazu über Ihre Suchmaschine recherchieren, stoßen Sie womöglich auf stornierenbei.de. Dort wird eine einfache Kündigung von Verträgen unterschiedlichster Anbieter als Dienstleistung angeboten. Achtung: Statt der Kündigung des angegebenen Vertrages, kommen versteckte Kosten auf Sie zu, die auch eingemahnt werden! Bezahlen Sie nichts. Es besteht kein gültiger Vertrag mit stornierenbei.de.
---------------------------------------------
https://www.watchlist-internet.at/news/versteckte-kosten-fuer-kuendigungen-…
∗∗∗ BYODC - Bring Your Own Domain Controller ∗∗∗
---------------------------------------------
BYODC or bring your own domain controller is a post-exploitation technique and another option for performing a DCSync in a more opsec safe manner.
---------------------------------------------
https://blog.zsec.uk/byodc-attack/
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-11-04 ∗∗∗
---------------------------------------------
AIX LPARs in IBM PureData System for Operational Analytics, IBM App Connect Enterprise, IBM MQ, IBM WebSphere Application Server Liberty / CICS Transaction Gateway
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (ffmpeg, libxml2, python-django, python-scciclient, and xen), Fedora (ghc-cmark-gfm, java-latest-openjdk, and vim), Mageia (expat, ntfs-3g, and wkhtmltopdf), Oracle (kernel), Slackware (sudo), and SUSE (expat, libxml2, rubygem-loofah, and xmlbeans).
---------------------------------------------
https://lwn.net/Articles/914012/
∗∗∗ Shodan Verified Vulns 2022-11-01 ∗∗∗
---------------------------------------------
Mit Stand 2022-11-01 sieht Shodan in Österreich die folgenden Schwachstellen: [...]
---------------------------------------------
https://cert.at/de/aktuelles/2022/11/shodan-verified-vulns-2022-11-01
∗∗∗ Nov 3 2022 Security Releases ∗∗∗
---------------------------------------------
(Update 04-November-2022) Security releases available
Updates are now available for v14,x, v16.x, v18.x and v19.x Node.jsrelease lines for the following issues. [...]
---------------------------------------------
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases
∗∗∗ WebKit HTMLSelectElement Use-After-Free ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022110007
∗∗∗ TRUMPF: Multiple products prone to X.Org server vulnerabilities ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-049/
∗∗∗ Wiesemann &Theis: Multiple Vulnerabilities in the Com-Server Family ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-043/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 03-11-2022 18:00 − Freitag 04-11-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ WLAN-Sicherheitslücke: Für Spezialdrohnen sind Wände wie Glas ∗∗∗
---------------------------------------------
Kanadische Forscher haben eine Funktion entdeckt, die es Angreifern ermöglicht, durch Wände zu sehen - trotz Passwortschutz.
---------------------------------------------
https://www.golem.de/news/wlan-sicherheitsluecke-fuer-eine-spezialdrohne-si…
∗∗∗ A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain ∗∗∗
---------------------------------------------
Note: The three vulnerabilities discussed in this blog were all fixed in Samsung’s March 2021 release. They were fixed as CVE-2021-25337, CVE-2021-25369, CVE-2021-25370. To ensure your Samsung device is up-to-date under settings you can check that your device is running SMR Mar-2021 or later. As defenders, in-the-wild exploit samples give us important insight into what attackers are really doing. We get the “ground truth” data about the vulnerabilities and exploit techniques they’re using, which then informs our further research and guidance to security teams on what could have the biggest impact or return on investment. To do this, we need to know that the vulnerabilities and exploit samples were found in-the-wild.
---------------------------------------------
https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-sa…
∗∗∗ What Is Cross-Origin Resource Sharing (CORS)? ∗∗∗
---------------------------------------------
Thanks to the rapid growth of JavaScript frameworks like Angular, React, and Vue, Cross-Origin Resource Sharing (CORS) has become a popular word in the developer’s vocabulary — and for good reason. It’s common practice for modern web applications to load resources from multiple domains. But accessing these website resources from different origins requires a thorough understanding of CORS. In this post, we’ll take a look at what CORS is and why proper implementation is an important component of building secure websites and applications. We’ll also examine some common examples of how to use CORS, dive into preflight requests, and discuss how to protect your website against attacks.
---------------------------------------------
https://blog.sucuri.net/2022/11/what-is-cross-origin-resource-sharing-cors.…
∗∗∗ Multi-factor auth fatigue is real – and its why you may be in the headlines next ∗∗∗
---------------------------------------------
Overwhelmed by waves of push notifications, worn-down users inadvertently let the bad guys in
Analysis
The September cyberattack on ride-hailing service Uber began when a criminal bought the stolen credentials of a company contractor on the dark web.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/11/03/mfa_fatigue_…
∗∗∗ Inside the V1 Raccoon Stealer’s Den ∗∗∗
---------------------------------------------
Team Cymru’s S2 Research Team has blogged previously on the initial Raccoon stealer command and control methodology (Raccoon Stealer - An Insight into Victim “Gates”), which utilized “gate” IP addresses to proxy victim traffic / data to static threat actor-controlled infrastructure. Since the publication of our previous blog, the following timeline of events has occurred: [...]
---------------------------------------------
https://www.team-cymru.com/post/inside-the-v1-raccoon-stealer-s-den
∗∗∗ Cisco-Sicherheitsupdates: Angreifer könnten durch Lücken in Netzwerke eindringen ∗∗∗
---------------------------------------------
Die Softwareentwickler von Cisco haben unter anderem in Identity Services Engine und Email Security Appliance Schwachstellen geschlossen.
---------------------------------------------
https://heise.de/-7329978
∗∗∗ UK-Cybersicherheitsbehörde startet landesweites Schwachstellen-Scanning ∗∗∗
---------------------------------------------
Die IT-Sicherheitsbehörde des Vereinigten Königreichs startet einen Schwachstellen-Scanner-Dienst. Der untersucht alle Systeme des Landes auf Sicherheitslücken.
---------------------------------------------
https://heise.de/-7330532
∗∗∗ Apple Rolls Out Xcode Update Patching Git Vulnerabilities ∗∗∗
---------------------------------------------
Apple this week announced a security update for the Xcode macOS development environment, to resolve three Git vulnerabilities, including one leading to arbitrary code execution.
---------------------------------------------
https://www.securityweek.com/apple-rolls-out-xcode-update-patching-git-vuln…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-11-03 ∗∗∗
---------------------------------------------
IBM App Connect Enterprise Certified Container, IBM InfoSphere Information server, IBM Operations Analytics - Log Analysis, IBM Security Verify Governance, IBM WebSphere Application Server Liberty
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Patchday: Big-Data-Spezialist Splunk dichtet zwölf Schwachstellen ab ∗∗∗
---------------------------------------------
Der Big-Data-Experte Splunk aktualisiert die gleichnamige Software Splunk Enterprise und Cloud. Nach den Updates klaffen darin zwölf Schwachstellen weniger.
---------------------------------------------
https://heise.de/-7329933
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (pypy3), Fedora (drupal7, git, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and php), Oracle (kernel, lua, openssl, pcs, php-pear, pki-core, python3.9, and zlib), Red Hat (kernel, kernel-rt, kpatch-patch, lua, openssl-container, pcs, php-pear, pki-core, python3.9, and zlib), Scientific Linux (kernel, pcs, and php-pear), SUSE (EternalTerminal, hsqldb, ntfs-3g_ntfsprogs, privoxy, rubygem-actionview-4_2, sqlite3, and xorg-x11-server), and Ubuntu [...]
---------------------------------------------
https://lwn.net/Articles/913771/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (clickhouse, distro-info-data, and ntfs-3g), Fedora (firefox), Oracle (kernel), Slackware (mozilla), and SUSE (python-Flask-Security-Too).
---------------------------------------------
https://lwn.net/Articles/913849/
∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0010 ∗∗∗
---------------------------------------------
Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32888 Versions affected: WebKitGTK and WPE WebKit before 2.38.0. Credit to P1umer (@p1umer). Impact: Processing maliciously crafted web content may lead toarbitrary code execution.
---------------------------------------------
https://webkitgtk.org/security/WSA-2022-0010.html
∗∗∗ CVE Report Published for Spring Tools ∗∗∗
---------------------------------------------
We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode
Please review the information in the CVE report and upgrade immediately.
---------------------------------------------
https://spring.io/blog/2022/11/03/cve-report-published-for-spring-tools
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 02-11-2022 18:00 − Donnerstag 03-11-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Emotet botnet starts blasting malware again after 5 month break ∗∗∗
---------------------------------------------
The Emotet malware operation is again spamming malicious emails after almost a five-month "vacation" that saw little activity from the notorious cybercrime operation.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blastin…
∗∗∗ Hundreds of U.S. news sites push malware in supply-chain attack ∗∗∗
---------------------------------------------
The compromised infrastructure of an undisclosed media company is being used by threat actors to deploy the SocGholish JavaScript malware framework (also known as FakeUpdates) on the websites of hundreds of newspapers across the U.S.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hundreds-of-us-news-sites-pu…
∗∗∗ Was tun, wenn ich Opfer von Cybercrime geworden bin? ∗∗∗
---------------------------------------------
Die Online-Identität kann schnell gestohlen werden, wenn jemand seine Daten auf unseriösen Websites eingibt. Dann kann es zu weiteren Konsequenzen kommen.
---------------------------------------------
https://futurezone.at/digital-life/cybercrime-identitaetsdiebstahl-phishing…
∗∗∗ The OpenSSL security update story – how can you tell what needs fixing? ∗∗∗
---------------------------------------------
How to Hack! Finding OpenSSL library files and accurately identifying their version numbers...
---------------------------------------------
https://nakedsecurity.sophos.com/2022/11/03/the-openssl-security-update-sto…
∗∗∗ P2P Botnets: Review - Status - Continuous Monitoring ∗∗∗
---------------------------------------------
P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets.
---------------------------------------------
https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/
∗∗∗ Breakpoints in Burp, (Wed, Nov 2nd) ∗∗∗
---------------------------------------------
No, this is not a story about the Canadian Thanksgiving long weekend, it's about web application testing. I recently had a web application to assess, and I used Burp Suite Pro as part of that project.
---------------------------------------------
https://isc.sans.edu/diary/rss/29214
∗∗∗ Hackers Using Rogue Versions of KeePass and SolarWinds Software to Distribute RomCom RAT ∗∗∗
---------------------------------------------
The operators of RomCom RAT are continuing to evolve their campaigns with rogue versions of software such as SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro.
---------------------------------------------
https://thehackernews.com/2022/11/hackers-using-rogue-versions-of-keepass.h…
∗∗∗ Researchers discover security loophole allowing attackers to use Wi-Fi to see through walls ∗∗∗
---------------------------------------------
The Wi-Peep exploits a loophole the researchers call polite Wi-Fi. Even if a network is password protected, smart devices will automatically respond to contact attempts from any device within range. The Wi-Peep sends several messages to a device as it flies and then measures the response time on each, enabling it to identify the devices location to within a meter.
---------------------------------------------
https://techxplore.com/news/2022-11-loophole-wi-fi-walls.html
∗∗∗ Passwörter: 64 Prozent der User verwenden Kennwörter mehrmals ∗∗∗
---------------------------------------------
Eine Umfrage unter 3750 Angestellten auch aus deutschen Organisationen fördert bedenkliche Passwortnutzung zutage. Und das trotz besseren Wissens.
---------------------------------------------
https://heise.de/-7328871
∗∗∗ BSI-Lagebericht 2022: Gefährdungslage im Cyber-Raum hoch wie nie ∗∗∗
---------------------------------------------
Im Berichtszeitraum hat sich die bereits zuvor angespannte Lage weiter zugespitzt. Grund dafür sind anhaltende Aktivitäten im Bereich der Cyber-Kriminalität, Cyber-Angriffe im Kontext des russischen Angriffs auf die Ukraine und eine unzureichende Produktqualität von IT- und Software-Produkten.
---------------------------------------------
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse202…
∗∗∗ A new crop of malicious modules found on PyPI ∗∗∗
---------------------------------------------
Phylum has posted anarticle with a detailed look at a set of malicious packages discoveredby an automated system they have developed. Similar to this attacker’s previous attempts, this particular attack starts by copying existing popular libraries and simply injecting a malicious __import__ statement into an otherwise healthy codebase.
---------------------------------------------
https://lwn.net/Articles/913555/
∗∗∗ Vorsicht vor Scam-Versuchen auf Telegram ∗∗∗
---------------------------------------------
Eine Nachricht auf Telegram erreicht Sie aus heiterem Himmel: Jemand, den Sie nicht kennen bietet Ihnen eine lukrative Investment-Möglichkeit an, oder sogar eine große Summe Geld. Vorsicht, bei diesen Nachrichten handelt es sich um Betrugsversuche!
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-scam-versuchen-auf-tele…
∗∗∗ Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild ∗∗∗
---------------------------------------------
We present new techniques that leverage active probing and network fingerprint technology to help you detect Cobalt Strike’s Team Servers.
---------------------------------------------
https://unit42.paloaltonetworks.com/cobalt-strike-team-server/
∗∗∗ ASEC Weekly Malware Statistics (October 24th, 2022 – October 30th, 2022) ∗∗∗
---------------------------------------------
This post will list weekly statistics collected from October 24th, 2022 (Monday) to October 30th (Sunday).
---------------------------------------------
https://asec.ahnlab.com/en/41139/
=====================
= Vulnerabilities =
=====================
∗∗∗ Awareness and guidance related to OpenSSL 3.0 – 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602) ∗∗∗
---------------------------------------------
Microsoft is aware and actively addressing the impact associated with the recent OpenSSL vulnerabilities announced on October 25th 2022, fixed in version 3.0.7. As part of our standard processes, we are rolling out fixes for impacted services.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/11/02/microsoft-guidance-related-to-op…
∗∗∗ IBM Security Bulletins 2022-11-02 ∗∗∗
---------------------------------------------
Content Collector for Email in Content Search Services container, IBM Business Automation Workflow, IBM Business Process Manager (BPM), IBM InfoSphere DataStage, IBM MQ, IBM Operations Analytics - Log Analysis, IBM SPSS Modeler, IBM Security SOAR, Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Schwachstellenscanner Nessus: Updates schließen mehrere Sicherheitslücken ∗∗∗
---------------------------------------------
Der Netzwerk-Schwachstellenscanner Nessus behebt mit neuen Versionen mehrere Schwachstellen in Drittherstellerkomponenten. Admins sollten sie installieren.
---------------------------------------------
https://heise.de/-7328440
∗∗∗ Patchday Fortinet: FortiSIEM speichert Log-in-Daten unverschlüsselt ∗∗∗
---------------------------------------------
Es gibt wichtige Updates für Sicherheitsprodukte von Fortinet. Darunter etwa FortiADC und FortiOS. Keine Lücke gilt als kritisch.
---------------------------------------------
https://heise.de/-7328476
∗∗∗ (Non-US) DIR-1935 : Rev. Ax : F/W v1.03b02 :: Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://supportannouncement.us.dlink.com/announcement/publication.aspx?name…
∗∗∗ Splunk Patches 9 High-Severity Vulnerabilities in Enterprise Product ∗∗∗
---------------------------------------------
https://www.securityweek.com/splunk-patches-9-high-severity-vulnerabilities…
∗∗∗ ETIC Telecom Remote Access Server (RAS) ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-307-01
∗∗∗ Nokia ASIK AirScale System Module ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-307-02
∗∗∗ Delta Industrial Automation DIALink ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-307-03
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 31-10-2022 18:00 − Mittwoch 02-11-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Sicherheitslücken: OpenSSL korrigiert Fehler im Zertifikatsparser ∗∗∗
---------------------------------------------
Zwei Buffer Overflows bei der Verarbeitung von Punycode können OpenSSL zum Absturz bringen - und möglicherweise Codeausführung ermöglichen.
---------------------------------------------
https://www.golem.de/news/sicherheitsluecken-openssl-korrigiert-fehler-im-z…
∗∗∗ Lenovo kündigt gegen Schadcode-Attacken abgesicherte BIOS-Versionen an ∗∗∗
---------------------------------------------
Der Computer-Hersteller Lenovo will mehrere BIOS-Lücken in verschiedenen Laptop-Modellen schließen. Einige Updates sind aber erst für Anfang 2023 angekündigt.
---------------------------------------------
https://heise.de/-7327115
∗∗∗ Eine Million Downloads: Bösartige Android-Apps leiten auf Phishing-Seiten ∗∗∗
---------------------------------------------
Ein App-Entwickler fällt wiederholt auf, verseuchte Apps in Google Play anzubieten. Die derzeitig problematischen Apps kommen auf über eine Million Downloads.
---------------------------------------------
https://heise.de/-7327239
∗∗∗ Ausweiskopien mit Wasserzeichen versehen ∗∗∗
---------------------------------------------
Zahlreiche Betrugsmaschen zielen auf eine Kopie Ihres Ausweises ab. Damit können Kriminelle sich bei anderen Betrugsmaschen als Sie ausgeben, in Ihrem Namen Verträge abschließen oder andere Straftaten begehen. Versenden Sie Ausweiskopien daher nur, wenn es unbedingt notwendig ist. Gibt es keine andere Möglichkeit, sollten Sie die Ausweiskopie mit einem Wasserzeichen versehen. Wir zeigen Ihnen, wie Sie unkompliziert ein Wasserzeichen erstellen.
---------------------------------------------
https://www.watchlist-internet.at/news/ausweiskopien-mit-wasserzeichen-vers…
∗∗∗ Raspberry Robin Wurm transportiert Malware ∗∗∗
---------------------------------------------
Laut den Sicherheitsforschern von Microsoft verbreitet die bisher vor allem auf USB-Laufwerken bekannte Malware Raspberry Robin jetzt auch die Ransomware Clop.
---------------------------------------------
https://www.zdnet.de/88404569/raspberry-robin-wurm-transportiert-malware/
∗∗∗ Windows PowerShell-Backdoor entdeckt; gibt sich als Teil des Windows Update-Prozesses aus ∗∗∗
---------------------------------------------
Sicherheitsforscher von SafeBreach sind kürzlich auf eine bisher unbekannte PowerShell-Backdoor in Windows gestoßen. Diese verwendet ein bösasartiges Word-Dokument, um die PowerShell-Scripte einzuschleusen. Die Backdoor kann Active Directory-Benutzer und Remote-Desktops auflisten und soll vermutlich zu einem späteren Zeitpunkt zur Ausbreitung in [...]
---------------------------------------------
https://www.borncity.com/blog/2022/11/01/windows-powershell-backdoor-als-te…
∗∗∗ Gregor Samsa: Exploiting Javas XML Signature Verification ∗∗∗
---------------------------------------------
Earlier this year, I discovered a surprising attack surface hidden deep inside Java’s standard library: A custom JIT compiler processing untrusted XSLT programs, exposed to remote attackers during XML signature verification. This post discusses CVE-2022-34169, an integer truncation bug in this JIT compiler resulting in arbitrary code execution in many Java-based web applications and identity providers that support the SAML single-sign-on standard.
---------------------------------------------
https://googleprojectzero.blogspot.com/2022/11/gregor-samsa-exploiting-java…
∗∗∗ Server-side attacks, C&C in public clouds and other MDR cases we observed ∗∗∗
---------------------------------------------
This report describes several interesting incidents observed by the Kaspersky Managed Detection and Response (MDR) team. We hope that it helps you to stay up to date on the modern threat landscape and to be better prepared for attacks.
---------------------------------------------
https://securelist.com/server-side-attacks-cc-in-public-clouds-mdr-cases/10…
∗∗∗ SHA-3 code execution bug patched in PHP – check your version! ∗∗∗
---------------------------------------------
As everyone waits for news of a bug in OpenSSL, heres a reminder that other cryptographic code in your life may also need patching!
---------------------------------------------
https://nakedsecurity.sophos.com/2022/11/01/sha-3-code-execution-bug-patche…
∗∗∗ Ransomware: Not enough victims are reporting attacks, and thats a problem for everyone ∗∗∗
---------------------------------------------
The true impact of ransomware is unclear because some victims arent disclosing that theyve been attacked.
---------------------------------------------
https://www.zdnet.com/article/ransomware-not-enough-victims-are-reporting-a…
∗∗∗ A technical analysis of Pegasus for Android – Part 3 ∗∗∗
---------------------------------------------
Pegasus is a spyware developed by the NSO group that was repeatedly analyzed by Amnesty International and CitizenLab. In this article, we dissect the Android version that was initially analyzed by Lookout in this paper, and we recommend reading it along with this post. During our research about Pegasus for Android, we’ve found out that vendors wrongly attributed [...]
---------------------------------------------
https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-3/
=====================
= Vulnerabilities =
=====================
∗∗∗ Microsoft Mitigates Vulnerability in Jupyter Notebooks for Azure Cosmos DB ∗∗∗
---------------------------------------------
Microsoft recently fixed an authentication bypass vulnerability in Jupyter Notebooks for Azure Cosmos DB (currently in preview) reported by Orca Security. Customers not using Jupyter Notebooks (99.8% of Azure Cosmos DB customers do NOT use Jupyter notebooks) were not susceptible to this vulnerability. The bug was introduced on August 12th and fully patched worldwide [...]
---------------------------------------------
https://msrc-blog.microsoft.com/2022/11/01/microsoft-mitigates-vulnerabilit…
∗∗∗ Multiple Vulnerabilities Reported in Checkmk IT Infrastructure Monitoring Software ∗∗∗
---------------------------------------------
Multiple vulnerabilities have been disclosed in Checkmk IT Infrastructure monitoring software that could be chained together by an unauthenticated, remote attacker to fully take over affected servers.
---------------------------------------------
https://thehackernews.com/2022/11/multiple-vulnerabilities-reported-in.html
∗∗∗ Xcode 14.1 ∗∗∗
---------------------------------------------
This document describes the security content of Xcode 14.1.
---------------------------------------------
https://support.apple.com/kb/HT213496
∗∗∗ Cisco Security Advisories 2022-11-02 ∗∗∗
---------------------------------------------
Security Impact Rating: 4x High, 7x Medium
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first…
∗∗∗ Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022 ∗∗∗
---------------------------------------------
On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022]. This advisory will be updated as additional information becomes available.
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
AIX, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Cloud Object Storage Systems, IBM Cloud Pak for Integration, IBM Cloud Pak for Security, IBM DataPower Gateway, IBM Elastic Storage System, IBM Event Streams, IBM FlashSystem, IBM FlashSystem models FS900 and V9000, IBM InfoSphere Information Server, IBM MQ, IBM QRadar SIEM, IBM SAN Volume Controller, IBM Security Guardium, IBM Security Verify Access, IBM Spectrum Virtualize, IBM Storwize, IBM Voice Gateway, IBM WebSphere Application Server, IBM WebSphere Application Server used by IBM Master Data Management, Platform Navigator and Automation Assets in IBM Cloud Pak for Integration, Power System, Zlib for IBM i
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ An Update on the OpenSSL vulnerability CVE-2022-3602 ∗∗∗
---------------------------------------------
November 1, 2022: IBM is responding to the reported buffer overflow vulnerability that the OpenSSL open-source community disclosed for OpenSSL versions 3.0.0 – 3.0.6. We are taking action as an enterprise, and for IBM products and services that may potentially be impacted, as we do for all vulnerabilities rated High.
---------------------------------------------
https://www.ibm.com/blogs/psirt/ibm-preparing-to-respond-to-the-upcoming-op…
∗∗∗ FortiGuard PSIRT Advisories 2022-11-01 ∗∗∗
---------------------------------------------
AV Engine, FortiADC, FortiClient (MAC), FortiDeceptor, FortiEDR CollectorWindows, FortiMail, FortiManager/FortiAnalyzer, FortiOS, FortiSIEM, FortiSOAR, FortiTester
---------------------------------------------
https://fortiguard.fortinet.com/psirt
∗∗∗ Xen Security Advisories 2022-11-01 ∗∗∗
---------------------------------------------
Xen released 10 Security Advisories.
---------------------------------------------
https://xenbits.xen.org/xsa/
∗∗∗ Bitdefender: Löschen von Registry-Keys durch Sicherheitslücke möglich ∗∗∗
---------------------------------------------
Eine Sicherheitslücke in den Virenscannern von Bitdefender ermöglicht Angreifern, Registry-Schlüssel zu löschen. Bitdefender verteilt Aktualisierungen dagegen.
---------------------------------------------
https://heise.de/-7327061
∗∗∗ Kritische Sicherheitslücke in IT-Managementsoftware von Hitachi geschlossen ∗∗∗
---------------------------------------------
Admins sollten die aktuellen Versionen von Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer und Hitachi Ops Center Viewpoint installieren.
---------------------------------------------
https://heise.de/-7327825
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (batik, chromium, expat, libxml2, ncurses, openvswitch, pysha3, python-django, thunderbird, and tomcat9), Fedora (cacti, cacti-spine, curl, mbedtls, mingw-expat, and xen), Gentoo (apptainer, bind, chromium, exif, freerdp, gdal, gitea, hiredis, jackson-databind, jhead, libgcrypt, libksba, libtirpc, lighttpd, net-snmp, nicotine+, open-vm-tools, openexr, rpm, schroot, shadow, sofia-sip, tiff, and xorg-server), Mageia (libreoffice), Oracle (expat), Red [...]
---------------------------------------------
https://lwn.net/Articles/913261/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (python3.7), Gentoo (android-tools, expat, firefox, libjxl, libxml2, pjproject, sqlite, thunderbird, and zlib), Oracle (compat-expat1), Slackware (php8 and vim), SUSE (kernel, libtasn1, podman, and pyenv), and Ubuntu (libtasn1-6).
---------------------------------------------
https://lwn.net/Articles/913352/
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (ffmpeg and linux-5.10), Fedora (libksba, openssl, and php), Gentoo (openssl), Mageia (curl, gdk-pixbuf2.0, libksba, nbd, php, and virglrenderer), Red Hat (kernel, kernel-rt, libksba, and openssl), SUSE (gnome-desktop, hdf5, hsqldb, kernel, nodejs10, openssl-3, php7, podofo, python-Flask-Security, python-lxml, and xorg-x11-server), and Ubuntu (backport-iwlwifi-dkms, firefox, ntfs-3g, and openssl).
---------------------------------------------
https://lwn.net/Articles/913504/
∗∗∗ Nov 3 2022 Security Releases ∗∗∗
---------------------------------------------
The Node.js project will release new versions of the 14.x, 16.x, 18.x, 19.xreleases lines on or shortly after Thursday, November 3, 2022 in order to address: One medium severity issues. Two high severity issues that affect OpenSSL as per secadv/20221101.txt These security releases are driven by the OpenSSL security release as announced in OpenSSL November Security Release as well as an additional vulnerability that affects all supported release lines.
---------------------------------------------
https://nodejs.org/en/blog/vulnerability/november-2022-security-releases
∗∗∗ Chromium: CVE-2022-3723 Type Confusion in V8 ∗∗∗
---------------------------------------------
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware of reports that an exploit for CVE-2022-3723 exists in the wild.
---------------------------------------------
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3723
∗∗∗ Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN46345126/
∗∗∗ Security Advisory - Path Traversal Vulnerability in a Huawei Childrens Watch ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20221102-…
∗∗∗ K44454157: Expat vulnerability CVE-2022-40674 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K44454157
∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2022-42316, CVE-2022-42317 & CVE-2022-42318 ∗∗∗
---------------------------------------------
https://support.citrix.com/article/CTX472851/citrix-hypervisor-security-bul…
∗∗∗ [R1] Nessus Agent Version 10.2.1 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-22
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 28-10-2022 18:00 − Montag 31-10-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Jetzt patchen! Es könnten Attacken auf VMware Cloud Foundation bevorstehen ∗∗∗
---------------------------------------------
Für eine kritische Sicherheitslücke in Cloud Foundation von VMware ist Exploit-Code in Umlauf.
---------------------------------------------
https://heise.de/-7324777
∗∗∗ Apple räumt ein: Nur aktuelles macOS stopft alle bekannten Sicherheitslücken ∗∗∗
---------------------------------------------
Apple hat zum ersten Mal bestätigt, dass der Hersteller in früheren macOS-Versionen nicht alle Schwachstellen beseitigt. Dasselbe gilt offensichtlich für iOS.
---------------------------------------------
https://heise.de/-7324991
∗∗∗ Backup-Software von ConnectWise für Ransomware-Attacken anfällig ∗∗∗
---------------------------------------------
Angreifer könnten Systeme mit Recover oder R1Soft Server Backup Manager von ConnectWise attackieren. Sicherheitsupdates sind verfügbar.
---------------------------------------------
https://heise.de/-7324856
∗∗∗ Gefälschtes A1-Mail im Umlauf ∗∗∗
---------------------------------------------
In einem gefälschten E-Mail von A1 behaupten Kriminelle, dass Sie bereits 80% Ihres Postfach-Speicherplatzes aufgebraucht haben. Sie werden aufgefordert, auf einen Link zu klicken, um zusätzlichen Speicherplatz freizuschalten. Klicken Sie nicht auf den Link, Sie landen auf einer manipulierten Login-Seite.
---------------------------------------------
https://www.watchlist-internet.at/news/gefaelschtes-a1-mail-im-umlauf/
∗∗∗ 2022 OpenSSL vulnerability ∗∗∗
---------------------------------------------
This repo contains operational information regarding the recently announced vulnerability in OpenSSL 3. [...] Currently no complete overview of vulnerable products is available. Please see https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md for a list of products that are known to be vulnerable. The list is a work in progress.
---------------------------------------------
https://github.com/NCSC-NL/OpenSSL-2022
∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗
---------------------------------------------
Some here may still remember Heartbleed. Heartbleed was a critical OpenSSL vulnerability that surprised many organizations, and patching the issue was a major undertaking. Heartbleed caused OpenSSL and other open-source projects to rethink how they address security issues and communicate with their users. OpenSSL started to pre-announce any security updates about a week ahead of time. This week, OpenSSL announced they would release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability [1].
---------------------------------------------
https://isc.sans.edu/diary/rss/29192
∗∗∗ APT10: Tracking down LODEINFO 2022, part I ∗∗∗
---------------------------------------------
The first part of this report will provide technical analysis of the new infection methods such as SFX files and DOWNIISSA, a new downloader shellcode used to deploy the LODEINFO backdoor.
---------------------------------------------
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/
∗∗∗ APT10: Tracking down LODEINFO 2022, part II ∗∗∗
---------------------------------------------
In the second part of this report, we discuss improvements made to the LODEINFO backdoor shellcode in 2022.
---------------------------------------------
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/
∗∗∗ NMAP without NMAP - Port Testing and Scanning with PowerShell, (Mon, Oct 31st) ∗∗∗
---------------------------------------------
Ever needed to do a portscan and didn't have nmap installed? I've had this more than once on an internal pentest or more often just on run-rate "is that port open? / is there a host firewall in the way?" testing.
---------------------------------------------
https://isc.sans.edu/diary/rss/29202
∗∗∗ WordPress Vulnerability & Patch Roundup October 2022 ∗∗∗
---------------------------------------------
[...] To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.
---------------------------------------------
https://blog.sucuri.net/2022/10/wordpress-vulnerability-patch-roundup-octob…
∗∗∗ Hardware Trojans Under a Microscope ∗∗∗
---------------------------------------------
While the security industry generally focuses on software cyber attacks, we can’t forget the security impact of lower level hardware flaws, such as those that affect semiconductors.
---------------------------------------------
https://ryancor.medium.com/hardware-trojans-under-a-microscope-bf542acbcc29
∗∗∗ What I learnt from reading 217* Subdomain Takeover bug reports. ∗∗∗
---------------------------------------------
My two prior blogs, What I Learnt From Reading 220 IDOR bug reports, and What I Learnt From Reading 126 Information Disclosure Writeups*, were well received, so I’m continuing the series. I once more scraped ALL 143 SDTO bug reports from hackerone, and 74 detailed write-ups, then went into hiding as I read and took notes on them. I’m here to show you my actionable findings, and show you how to properly hunt for SDTOs.
---------------------------------------------
https://medium.com/@nynan/what-i-learnt-from-reading-217-subdomain-takeover…
∗∗∗ Free Micropatches For Bypassing MotW Security Warning with Invalid Signature (0day) ∗∗∗
---------------------------------------------
Nine days ago we issued micropatches for a vulnerability that allows attackers to bypass the warning Windows normally present to users when they try to open a document or executable obtained from an untrusted source (Internet, email, USB key, network drive). That vulnerability, affecting all supported and many legacy Windows versions, still has no official patch from Microsoft so our (free!) patches are the only actual patches in existence as of this writing. On the very same day we issued these micropatches, Will Dormann - who researched said vulnerability - replied to a tweet by another security researcher, Patrick Schläpfer. Patrick works at HP Wolf Security where they analyzed the Magniber Ransomware and wrote a detailed analysis of its working. Will asked Patrick about the ZIP files used in the malware campaign to see if they were exploiting the same vulnerability or employing some other trick to bypass the "Mark of the Web". [...] And so a new 0day - already exploited in the wild - was revealed.
---------------------------------------------
https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html
∗∗∗ The Defender’s Guide to the Windows Registry ∗∗∗
---------------------------------------------
Welcome to the Defender’s Guide. This is a series of blog posts designed to give you a ground-up start to defending a specific technology from potential attackers. While a lot of this information may be redundant to a more seasoned information security personnel, even the best of us rely on Google and blog posts to get information. These posts are designed to be a one-stop shop, bringing a lot of that information together.
---------------------------------------------
https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-feb…
∗∗∗ Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure ∗∗∗
---------------------------------------------
Learning about the variety of techniques used by banking Trojans can help us detect other activities of financially motivated threat groups.
---------------------------------------------
https://unit42.paloaltonetworks.com/banking-trojan-techniques/
∗∗∗ Follina Exploit Leads to Domain Compromise ∗∗∗
---------------------------------------------
In early June 2022, we observed an intrusion where a threat actor gained initial access by exploiting the CVE-2022-30190 (Follina) vulnerability which triggered a Qbot infection chain.
---------------------------------------------
https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compro…
∗∗∗ Vulnerabilities in Apache Batik Default Security Controls – SSRF and RCE Through Remote Class Loading ∗∗∗
---------------------------------------------
I stumbled upon the Apache Batik library while researching other Java-based products. It immediately caught my attention, as this library parses Scalable Vector Graphics (SVG) files and transforms them into different raster graphics formats (i.e., PNG, PDF, or JPEG). I was even more encouraged when I looked at the Batik documentation. It was obvious that such a library could be prone to Server-Side Request Forgery (SSRF) issues (e.g., loading of images from remote resources).
---------------------------------------------
https://www.thezdi.com/blog/2022/10/28/vulnerabilities-in-apache-batik-defa…
∗∗∗ AgentTesla Being Distributed via VBS ∗∗∗
---------------------------------------------
The ASEC analysis team has recently identified that AgentTesla is being distributed through malicious VBS. The script file has multiple codes that have been obfuscated multiple times. AgentTesla has been found to be distributed last May through a Windows Help file (*.chm), and it seems that its distribution method is continuously changing.
---------------------------------------------
https://asec.ahnlab.com/en/40890/
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
App Connect Professional, IBM Business Automation Manager Open Editions 8.0.1, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Cloud Pak for Business Automation, IBM Cloud Pak for Security, IBM Event Streams, IBM Host Access Transformation Services, IBM MQ Appliance
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client ∗∗∗
---------------------------------------------
Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible.
---------------------------------------------
https://spring.io/blog/2022/10/31/cve-2022-31690-privilege-escalation-in-sp…
∗∗∗ CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security ∗∗∗
---------------------------------------------
Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for [CVE-2022-31692](https://tanzu.vmware.com/security/cve-2022-31692) affecting the AuthorizationFilter. Users are encouraged to update as soon as possible.
---------------------------------------------
https://spring.io/blog/2022/10/31/cve-2022-31692-authorization-rules-can-be…
∗∗∗ CISA Has Added One Known Exploited Vulnerability to Catalog ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/10/28/cisa-has-added-on…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 27-10-2022 18:00 − Freitag 28-10-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Windows: Gefährliche, IE-basierende Schwachstellen ∗∗∗
---------------------------------------------
Sicherheitsforscher der Varonis Threat Labs haben zwei Windows-Sicherheitslücken aufgedeckt, die große blinde Flecken für Sicherheits-Software erzeugen und Rechner mittels DoS-Angriffe außer Betrieb setzen können. LogCrusher und OverLog nutzen dabei das Internet Explorer-spezifische Ereignisprotokoll MS-EVEN, das auf allen aktuellen Windows-Betriebssystemen vorhanden ist, unabhängig davon, ob der Browser genutzt wurde oder wird. Während OverLog mittlerweile gefixt ist, hat Microsoft für LogCrusher kürzlich nur einen partiellen Patch herausgegeben: Cyberkriminelle können deshalb immer noch Angriffe durchführen, wenn sie sich einen Administrator-Zugang zum Netzwerk des Opfers verschaffen.
---------------------------------------------
https://www.borncity.com/blog/2022/10/28/windows-gefhrliche-ie-basierende-s…
∗∗∗ Neue Website: Apple erleichtert Sicherheitsforschung ∗∗∗
---------------------------------------------
Ein zentrales neues Portal erklärt das Bug–Bounty-Programm und ermöglicht es, schneller und direkter mit dem Security-Team des Konzerns in Kontakt zu kommen.
---------------------------------------------
https://heise.de/-7323634
∗∗∗ macOS 13: Anti-Malware-Tools nach Upgrade zahnlos ∗∗∗
---------------------------------------------
Antivirus-Software und andere Sicherheits-Tools funktionieren durch einen Apple-Bug in macOS Ventura nicht mehr richtig. Das Problem kann behoben werden.
---------------------------------------------
https://heise.de/-7322669
∗∗∗ Vorsicht vor dieser Fake-Raiffeisen Investmentfalle ∗∗∗
---------------------------------------------
Geld verdienen mit Raiffeisen, angeboten werden angeblich Aktien einer der größten Banken Österreichs. Das Versprechen klingt gut, doch es handelt sich um eine gut getarnte Phishing-Seite. Investieren Sie nicht auf lps.snowgross.com, Sie tappen in eine Anlagebetrugsfalle!
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-dieser-fake-raiffeisen-…
∗∗∗ One-Time Programs ∗∗∗
---------------------------------------------
One of the things I like to do on this blog is write about new research that has a practical angle. Most of the time (I swear) this involves writing about other folks’ research: it’s not that often that I write about work that comes out of my own lab. Today I’m going make an [...]
---------------------------------------------
https://blog.cryptographyengineering.com/2022/10/27/one-time-programs/
∗∗∗ Apple clarifies security update policy: Only the latest OSes are fully patched ∗∗∗
---------------------------------------------
New document confirms what security researchers have observed for a few years.
---------------------------------------------
https://arstechnica.com/?p=1893235
∗∗∗ Android malware droppers with 130K installs found on Google Play ∗∗∗
---------------------------------------------
A set of Android malware droppers were found infiltrating the Google Play store to install malicious programs by pretending to be app updates.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/android-malware-droppers-wit…
∗∗∗ Exploit released for critical VMware RCE vulnerability, patch now ∗∗∗
---------------------------------------------
Proof-of-concept exploit code is now available for a pre-authentication remote code execution (RCE) vulnerability allowing attackers to execute arbitrary code remotely with root privileges on unpatched Cloud Foundation and NSX Manager appliances.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/exploit-released-for-critica…
∗∗∗ Researchers Expose Over 80 ShadowPad Malware C2 Servers ∗∗∗
---------------------------------------------
As many as 85 command-and-control (C2) servers have been discovered supported by the ShadowPad malware since September 2021, with infrastructure detected as recently as October 16, 2022. Thats according to VMwares Threat Analysis Unit (TAU), which studied three ShadowPad variants using TCP, UDP, and HTTP(S) protocols for C2 communications.
---------------------------------------------
https://thehackernews.com/2022/10/researchers-expose-over-80-shadowpad.html
∗∗∗ Raspberry Robin Operators Selling Cybercriminals Access to Thousands of Endpoints ∗∗∗
---------------------------------------------
The Raspberry Robin worm is becoming an access-as-a-service malware for deploying other payloads, including IcedID, Bumblebee, TrueBot (aka Silence), and Clop ransomware. It is "part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread," the Microsoft Security Threat Intelligence Center (MSTIC) said in a detailed write-up.
---------------------------------------------
https://thehackernews.com/2022/10/raspberry-robin-operators-selling.html
∗∗∗ TCP/IP Vulnerability CVE-2022–34718 PoC Restoration and Analysis ∗∗∗
---------------------------------------------
The patch released by Microsoft last month contained a vulnerability in the TCP/IP protocol that allowed for code execution. To ascertain the impact of the vulnerability, Numen’s security research team conducted an in-depth analysis of the vulnerability and restored the PoC through patch comparison.
---------------------------------------------
https://medium.com/numen-cyber-labs/analysis-and-summary-of-tcp-ip-protocol…
∗∗∗ Defeating Guloader Anti-Analysis Technique ∗∗∗
---------------------------------------------
Unit 42 is providing a script to deobfuscate a recently discovered Guloader variant that uses anti-analysis techniques, and other samples like it.
---------------------------------------------
https://unit42.paloaltonetworks.com/guloader-variant-anti-analysis/
∗∗∗ Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign ∗∗∗
---------------------------------------------
Group uses novel method of reading commands from legitimate IIS logs.
---------------------------------------------
https://symantec-enterprise-blogs.security.com/threat-intelligence/cranefly…
=====================
= Vulnerabilities =
=====================
∗∗∗ Sicherheitsupdates für älteres iOS und iPadOS ∗∗∗
---------------------------------------------
iPadOS 15.7.1 und iOS 15.7.1 stopfen problematische Sicherheitslücken für alle, die nicht auf iPadOS 16 und iOS 16 aktualisieren wollen - oder können.
---------------------------------------------
https://heise.de/-7323199
∗∗∗ Webbrowser: Entwickler schließen hochriskante Sicherheitslücke in Chrome ∗∗∗
---------------------------------------------
Google hat ein Update für den Webbrowser Chrome veröffentlicht. Darin dichten die Programmierer eine Schwachstelle mit hohem Risiko ab.
---------------------------------------------
https://heise.de/-7322963
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
CP4D Match 360, IBM Answer Retrieval for Watson Discovery versions 2.8 and earlier, IBM Cloud Pak System, IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data, Db2 Warehouse® on Cloud Pak for Data, IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite, IBM QRadar SIEM, IBM TXSeries for Multiplatforms, IBM Voice Gateway, IBM Watson Assistant for IBM Cloud Pak for Data, IBM® SDK, Java™ Technology Edition, Liberty for Java for IBM Cloud, node.js
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (expat, ruby-sinatra, and thunderbird), Fedora (glances), Mageia (cups, firefox, git, heimdal, http-parser, krb5-appl, minidlna, nginx, and thunderbird), Oracle (389-ds:1.4, device-mapper-multipath, firefox, mysql:8.0, postgresql:12, and thunderbird), SUSE (dbus-1, libconfuse0, libtasn1, openjpeg2, qemu, and thunderbird), and Ubuntu (dbus, linux-azure-fde, and tiff).
---------------------------------------------
https://lwn.net/Articles/912873/
∗∗∗ Corel Coreldraw graphics suite vulnerabilities ∗∗∗
---------------------------------------------
https://secalerts.co/vulnerabilities/corel/coreldraw_graphics_suite
∗∗∗ Case update: DIVD-2022-00020 - Multiple injection vulnerabilities identified within Feathers.js ∗∗∗
---------------------------------------------
https://csirt.divd.nl/cases/DIVD-2022-00020/
∗∗∗ Case update: DIVD-2022-00045 - Injection vulnerability found within Socket.io ∗∗∗
---------------------------------------------
https://csirt.divd.nl/cases/DIVD-2022-00045/
∗∗∗ [R1] Nessus Version 10.4.0 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-21
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 25-10-2022 18:00 − Donnerstag 27-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Microsoft fixes Windows vulnerable driver blocklist sync issue ∗∗∗
---------------------------------------------
Microsoft says it addressed an issue preventing the Windows kernel vulnerable driver blocklist from being synced to systems running older Windows versions.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vul…
∗∗∗ Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets ∗∗∗
---------------------------------------------
A new version of the Fodcha DDoS botnet has emerged, featuring ransom demands embedded in packets and new features to evade detection of its infrastructure.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1…
∗∗∗ How to prevent lateral movement attacks using Microsoft 365 Defender ∗∗∗
---------------------------------------------
Learn how Microsoft 365 Defender can enhance mitigations against lateral movement paths in your environment, stopping attackers from gaining access to privileged and sensitive accounts.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/10/26/how-to-prevent-lat…
∗∗∗ Malware vs Virus: What’s the Difference? ∗∗∗
---------------------------------------------
In today’s article, we’ll be clarifying the difference between viruses and malware while helping to identify the most common types of malware.
---------------------------------------------
https://blog.sucuri.net/2022/10/whats-the-difference-malware-virus.html
∗∗∗ New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances ∗∗∗
---------------------------------------------
A new cryptojacking campaign has been uncovered targeting vulnerable Docker and Kubernetes infrastructures as part of opportunistic attacks designed to illicitly mine cryptocurrency.
---------------------------------------------
https://thehackernews.com/2022/10/new-cryptojacking-campaign-targeting.html
∗∗∗ Hijacking AUR Packages by Searching for Expired Domains ∗∗∗
---------------------------------------------
The Arch User Repository (AUR) is a software repository for Arch Linux. It differs from the official Arch Linux repositories in that its packages are provided by its users and not officially supported by Arch Linux.
---------------------------------------------
https://blog.nietaanraken.nl/posts/aur-packages-expired-domains/
∗∗∗ Industrial Ransomware Attacks: New Groups Emerge, Manufacturing Pays Highest Ransom ∗∗∗
---------------------------------------------
Industrial organizations continue to be a top target for ransomware attacks, and reports published by cybersecurity companies this week reveal some recent trends.
---------------------------------------------
https://www.securityweek.com/industrial-ransomware-attacks-new-groups-emerg…
∗∗∗ Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving ∗∗∗
---------------------------------------------
We examine trends in web threats for the second calendar year quarter of 2022, including how a malicious JavaScript downloader is evolving to evade detection.
---------------------------------------------
https://unit42.paloaltonetworks.com/web-threats-malicious-javascript-downlo…
∗∗∗ FormBook Malware Being Distributed as .NET ∗∗∗
---------------------------------------------
FormBook is an info-stealer that aims to steal the user’s web browser login information, keyboard input, clipboard, and screenshots. It targets random individuals, and is usually distributed through spam mails or uploaded to infiltrated websites.
---------------------------------------------
https://asec.ahnlab.com/en/40663/
=====================
= Vulnerabilities =
=====================
∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗
---------------------------------------------
This week, OpenSSL announced that they will release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability. The update will only affect OpenSSL 3.0.x, not 1.1.1. Now is the time to figure out where and how you are using OpenSSL 3.0.x.
---------------------------------------------
https://isc.sans.edu/diary/rss/29192
∗∗∗ IBM Security Bulletins 2022-10-26 and 2022-10-25 ∗∗∗
---------------------------------------------
IBM SDK, IBM WebSphere Application Server Liberty, IBM QRadar SIEM, IBM i, IBM Robotic Process Automation, IBM Cloud Transformation Advisor, CloudPak for Watson, Netcool Operations Insight.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Cisco AnyConnect: Alte Sicherheitslücken im Visier von Angreifern ∗∗∗
---------------------------------------------
Allerhöchste Zeit, um alte Lücken in Cisco AnyConnect abzudichten: Cisco warnt vor derzeitigen Cyber-Angriffen auf Schwachstellen aus dem Jahr 2020.
---------------------------------------------
https://heise.de/-7320917
∗∗∗ Sicherheitsupdate ArubaOS: Schadcode-Attacken durch präparierte Anfragen möglich ∗∗∗
---------------------------------------------
Die Entwickler des Netzwerkbetriebssystems ArubaOS haben unter anderem eine kritische Lücke geschlossen.
---------------------------------------------
https://heise.de/-7321787
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (tomcat9), Oracle (389-ds-base, device-mapper-multipath, firefox, git-lfs, gnutls, kernel, kernel-container, libksba, pki-core, samba, sqlite, and zlib), Red Hat (device-mapper-multipath, kernel, kpatch-patch, libksba, and thunderbird), Slackware (expat and samba), SUSE (bind, buildah, curl, firefox, golang-github-prometheus-node_exporter, grafana, icinga2, python-paramiko, python-waitress, SUSE Manager Client Tools, telnet, and xen), [...]
---------------------------------------------
https://lwn.net/Articles/912495/
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (389-ds-base, bind, expat, java-1.8.0-openjdk, java-11-openjdk, libksba, and squid), Debian (chromium, libdatetime-timezone-perl, tzdata, and wordpress), Fedora (dbus, dhcp, dotnet3.1, jhead, samba, and strongswan), Mageia (virtualbox), Oracle (device-mapper-multipath), Scientific Linux (device-mapper-multipath and thunderbird), Slackware (curl), SUSE (container-suseconnect, curl, kernel, libmad, libtasn1, libtirpc, qemu, rubygem-puppet, [...]
---------------------------------------------
https://lwn.net/Articles/912688/
∗∗∗ Windows (Mark of the Web) 0-day per JavaScript für Ransomware-Angriffe genutzt ∗∗∗
---------------------------------------------
Die Tage hatte ich über eine ungefixte 0-day-Schwachstelle, Mark of the Web (MOTOW), in Windows berichtet, für die es einen inoffiziellen Fix gibt. Nun ist mir ein Bericht unter die Augen gekommen, dass eine 0-day-Schwachstelle in diesem Bereich von Cyberkriminellen per JavaScript ausgenutzt werden kann, um Web-Sicherheitswarnungen zu umgehen und Ransomware-Angriffe zu verschleiern.
---------------------------------------------
https://www.borncity.com/blog/2022/10/27/exploited-windows-0-day-mark-of-th…
∗∗∗ ZDI-22-1467: (0Day) IronCAD STP File Parsing Uninitialized Pointer Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1467/
∗∗∗ VMSA-2022-0027 ∗∗∗
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0027.html
∗∗∗ K11601010: Intel Processor vulnerability CVE-2021-33149 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K11601010
∗∗∗ Synology-SA-22:20 Samba ∗∗∗
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_20
∗∗∗ Hitachi Energy MicroSCADA X DMS600 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-04
∗∗∗ Johnson Controls CKS CEVAS ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-05
∗∗∗ Delta Electronics DIAEnergie ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-06
∗∗∗ AliveCor KardiaMobile ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsma-22-298-01
∗∗∗ Haas Controller ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-01
∗∗∗ HEIDENHAIN Controller TNC on HARTFORD Machine ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-02
∗∗∗ Rockwell Automation FactoryTalk Alarm and Events Server ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-01
∗∗∗ SAUTER Controls moduWeb ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-02
∗∗∗ Rockwell Automation Stratix Devices Containing Cisco IOS ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-03
∗∗∗ Trihedral VTScada ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-300-04
∗∗∗ Samba Releases Security Updates ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/10/26/samba-releases-se…
∗∗∗ [R1] Nessus Version 10.3.1 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-20
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 24-10-2022 18:00 − Dienstag 25-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Zero-Day-Fehler im Kernel von iOS und iPadOS wird ausgenutzt ∗∗∗
---------------------------------------------
iOS und iPadOS 16.1 beheben einen schwerwiegenden Kernel-Bug in den Betriebssystemen für iPhone und iPad. Apple hat Berichte über laufende Angriffe.
---------------------------------------------
https://heise.de/-7319500
∗∗∗ Chrome extensions with 1 million installs hijack targets’ browsers ∗∗∗
---------------------------------------------
Researchers at Guardio Labs have discovered a new malvertizing campaign pushing Google Chrome and Microsoft Edge extensions that hijack searches and insert affiliate links into webpages.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/chrome-extensions-with-1-mil…
∗∗∗ How the Software Supply Chain Security is Threatened by Hackers ∗∗∗
---------------------------------------------
In many ways, the software supply chain is similar to that of manufactured goods, which we all know has been largely impacted by a global pandemic and shortages of raw materials. However, in the IT world, it is not shortages or pandemics that have been the main obstacles to overcome in recent years, but rather attacks aimed at using them to harm hundreds or even thousands of victims simultaneously.
---------------------------------------------
https://thehackernews.com/2022/10/how-software-supply-chain-security-is.html
∗∗∗ Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog ∗∗∗
---------------------------------------------
Cybersecurity researchers have disclosed details about a pair of vulnerabilities in Microsoft Windows, one of which could be exploited to result in a denial-of-service (DoS).
---------------------------------------------
https://thehackernews.com/2022/10/researchers-detail-windows-event-log.html
∗∗∗ Chapter 1 - From Gozi to ISFB: The history of a mythical malware family. ∗∗∗
---------------------------------------------
Disclaimer: This article does not contain any IOCs or infrastructure details. Instead, the aim is to explain the whole business dynamic of a long-lasting malware family. This work is based on almost 10 years of research and intel gatherings and tries its best to stick to the truth and the facts observed around ISFB. Hopefully, it will give some insight on how the top cyber crime groups have been working over the years.
---------------------------------------------
https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of…
∗∗∗ Stranger Strings: An exploitable flaw in SQLite ∗∗∗
---------------------------------------------
Trail of Bits is publicly disclosing CVE-2022-35737, which affects applications that use the SQLite library API. CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and fixed in release 3.39.2 (released on July 21, 2022). CVE-2022-35737 is exploitable on 64-bit systems, and exploitability depends on how the program is compiled [...]
---------------------------------------------
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-libr…
∗∗∗ E-Mail von WhatsApp: Gewinn über 900.600,00 USD ist Fake ∗∗∗
---------------------------------------------
Aktuell kursiert ein E-Mail von WhatsApp, in dem Sie über den Gewinn von 900.600,00 USD informiert werden. Um den Gewinn zu erhalten, müssen Sie Ihre Kontaktdaten an account.whatsapp(a)mail.com senden.
---------------------------------------------
https://www.watchlist-internet.at/news/e-mail-von-whatsapp-gewinn-ueber-900…
∗∗∗ Windows 10 22H2, Windows 11 22H2: Administrative Vorlagen (.admx); Windows 10 22H2 Security Baseline ∗∗∗
---------------------------------------------
Kleiner Hinweis für Administratoren von Windows-Systemen in Unternehmensumgebungen. Microsoft hat die Security Baseline für das Windows 10 October 2022 Update (Version 22H2) freigegeben.
---------------------------------------------
https://www.borncity.com/blog/2022/10/25/windows-10-22h2-windows-11-22h2-ad…
∗∗∗ Rapidly Evolving Magniber Ransomware ∗∗∗
---------------------------------------------
The Magniber ransomware has recently been evolving rapidly. From changing its file extension, injection and to UAC bypassing techniques, the Magniber ransomware has been rapidly changing to bypass the detection of anti-malware software. This article summarizes the evolution of the Magniber ransomware in the last few months based on the analysis that had been previously performed.
---------------------------------------------
https://asec.ahnlab.com/en/40422/
∗∗∗ Analysis on Attack Techniques and Cases Using RDP ∗∗∗
---------------------------------------------
Overview One of the previous ASEC blog posts discussed cases where attackers abused various remote control tools that are originally used for system management purposes to gain control over infected systems. This post will cover cases where RDP (Remote Desktop Protocol), a default service provided by baseline Windows OS, was used.
---------------------------------------------
https://asec.ahnlab.com/en/40394/
=====================
= Vulnerabilities =
=====================
∗∗∗ Webkonferenzen: Sicherheitslücke in Zoom ermöglicht Sitzungsübernahme ∗∗∗
---------------------------------------------
Zoom warnt vor einer Sicherheitslücke, durch die Angreifer Opfer etwa auf falsche Server locken und so Sitzungen übernehmen könnten. Updates stehen bereit.
---------------------------------------------
https://heise.de/-7319974
∗∗∗ VMSA-2022-00031 ∗∗∗
---------------------------------------------
VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-00031.html
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libbluray and wkhtmltopdf), Fedora (firefox, libksba, libmodsecurity, libxml2, qemu, and xmlsec1), Red Hat (389-ds-base, 389-ds:1.4, git-lfs, gnutls, java-1.8.0-ibm, kernel, kernel-rt, kpatch-patch, libksba, mysql:8.0, pki-core, postgresql:12, samba, sqlite, and zlib), Scientific Linux (389-ds-base, libksba, and pki-core), SUSE (bluez, firefox, jdom, kernel, libosip2, libxml2, multipath-tools, and python-Mako), and Ubuntu (barbican, mysql-5.7, mysql-8.0, openvswitch, and pillow).
---------------------------------------------
https://lwn.net/Articles/912324/
∗∗∗ Synology-SA-22:19 Presto File Server ∗∗∗
---------------------------------------------
Multiple vulnerabilities allow remote attackers to write arbitrary files or remote authenticated users to bypass security constraint via a susceptible version of Presto File Server.
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_19
∗∗∗ Synology-SA-22:18 DSM ∗∗∗
---------------------------------------------
Multiple vulnerabilities allow remote attackers to read or write arbitrary files or remote authenticated users to access intranet resources via a susceptible version of Synology DiskStation Manager (DSM).
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_18
∗∗∗ Node.js: OpenSSL and zlib update assessment, and Node.js Assessment workflow ∗∗∗
---------------------------------------------
https://nodejs.org/en/blog/vulnerability/openssl-and-zlib-vulnerability-ass…
∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosure of information that could aid in further system attacks. (CVD-2022-38710) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom…
∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: IBM InfoSphere Information Server is potentially vulnerable to CSV Injection (CVE-2022-22425) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio…
∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to incorrect permission assignment ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom…
∗∗∗ Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthorized attacker causing integrity impact (CVE-2021-2163) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Delta Electronics InfraSuite Device Master ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-298-07
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 21-10-2022 18:00 − Montag 24-10-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Thousands of GitHub repositories deliver fake PoC exploits with malware ∗∗∗
---------------------------------------------
Researchers at the Leiden Institute of Advanced Computer Science found thousands of repositories on GitHub that offer fake proof-of-concept (PoC) exploits for various vulnerabilities, some of them including malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/thousands-of-github-reposito…
∗∗∗ Typosquat campaign mimics 27 brands to push Windows, Android malware ∗∗∗
---------------------------------------------
A massive, malicious campaign is underway using over 200 typosquatting domains that impersonate twenty-seven brands to trick visitors into downloading various Windows and Android malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/typosquat-campaign-mimics-27…
∗∗∗ Kriminalität: Eltern durch Whatsapp-Betrug um Tausende Euro gebracht ∗∗∗
---------------------------------------------
Die Polizei warnt vor Trickbetrügern, die mit einer angeblichen Notlage des Kindes Eltern um ihr Geld bringen.
---------------------------------------------
https://www.golem.de/news/kriminalitaet-eltern-durch-whatsapp-betrug-um-tau…
∗∗∗ Securing IoT devices against attacks that target critical infrastructure ∗∗∗
---------------------------------------------
South Staffordshire PLC, a company that supplies water to over one million customers in the United Kingdom, notified its customers in August of being a target of a criminal cyberattack. This incident highlights the sophisticated threats that critical industries face today.
---------------------------------------------
https://www.microsoft.com/en-us/security/blog/2022/10/21/securing-iot-devic…
∗∗∗ rtfdumps Find Option, (Sat, Oct 22nd) ∗∗∗
---------------------------------------------
Due to the nature of the RTF language, malicious RTF files can be very obfuscated. To the point that my tool rtfdump.py and Philippe's tool rtfobj don't find embedded objects.
---------------------------------------------
https://isc.sans.edu/diary/rss/29174
∗∗∗ C2 Communications Through outlook.com, (Mon, Oct 24th) ∗∗∗
---------------------------------------------
Most malware implements communication with their C2 server over HTTP(S). Why? Just because it works! But they are multiple ways to implement C2 communications: DNS, P2P, Layer 7 (Twitter), ... Another one that has become less popular with time is SMTP (email communications). I spotted a malicious Python script that exchanges information with its C2 server through emails.
---------------------------------------------
https://isc.sans.edu/diary/rss/29180
∗∗∗ SCuBA M365 Security Baseline Assessment Tool ∗∗∗
---------------------------------------------
Developed by CISA, this assessment tool verifies that an M365 tenant’s configuration conforms to the policies described in the SCuBA Minimum Viable Secure Configuration Baseline documents.
---------------------------------------------
https://github.com/cisagov/ScubaGear
∗∗∗ Cisco ISE: Angreifer könnten Kontrolle übernehmen ∗∗∗
---------------------------------------------
Cisco warnt, dass Angreifer Dateien in der Identity Services Engine lesen und löschen könnten. Die Übernahme der Kontrolle über die Geräte könnte möglich sein.
---------------------------------------------
https://heise.de/-7317442
∗∗∗ Gebrauchtwagen-Kauf: Abwicklung über Treuhandunternehmen ist Betrug ∗∗∗
---------------------------------------------
Sie sind gerade auf der Suche nach einem Gebrauchtwagen? Bedenken Sie: Nicht jedes Inserat ist seriös. Auch Kriminelle nutzen gängige Verkaufsplattformen, um betrügerische Lockangebote zu platzieren. Ein betrügerisches Angebot erkennen Sie an der Kommunikation und der Forderung, Geld an ein Treuhandkonto zu überweisen.
---------------------------------------------
https://www.watchlist-internet.at/news/gebrauchtwagen-kauf-abwicklung-ueber…
∗∗∗ So funktioniert Domain Shadowing ∗∗∗
---------------------------------------------
Cyberkriminelle nutzen schwer auffindbare Shadow Domains für verschiedene illegale Aktivitäten, einschließlich Phishing und Botnet-Operationen.
---------------------------------------------
https://www.zdnet.de/88404347/so-funktioniert-domain-shadowing/
∗∗∗ AA22-294A: #StopRansomware: Daixin Team ∗∗∗
---------------------------------------------
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) are releasing this joint CSA to provide information on the “Daixin Team,” a cybercrime group that is actively targeting U.S. businesses, predominantly in the Healthcare and Public Health (HPH) Sector, with ransomware and data extortion operations.
---------------------------------------------
https://us-cert.cisa.gov/ncas/alerts/aa22-294a
∗∗∗ Treasure trove. Alive and well point-of-sale malware ∗∗∗
---------------------------------------------
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals.
---------------------------------------------
https://blog.group-ib.com/majikpos_treasurehunter_malware
∗∗∗ Attacking Very Weak RC4-Like Ciphers the Hard Way ∗∗∗
---------------------------------------------
RC4 is a popular encryption algorithm. The way it works is that a “Key Scheduling Algorithm” (KSA) takes your key and generates a 256-byte array, and then a “Pseudo-Random Generation Algorithm” (PRGA) uses that byte array to output an endless stream of bytes (the “key stream”), which look like random noise unless you know what the original byte array was.
---------------------------------------------
https://research.checkpoint.com/2022/attacking-very-weak-rc4-like-ciphers-t…
∗∗∗ Uncovering Security Blind Spots in CNC Machines ∗∗∗
---------------------------------------------
Industry 4.0 has given rise to smart factories that have markedly improved machining processes, but it has also opened the doors for cybercriminals looking to abuse networked industrial equipment such as CNC machines. Our research investigates potential cyberthreats to CNC machines and how manufacturers can mitigate the associated risks.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/j/uncovering-security-blind-sp…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-10-21 and 2022-10-22 ∗∗∗
---------------------------------------------
IBM Cloud Pak for Watson, API Connect, IBM Cloud Pak for Multicloud Management, IBM MQ Appliance, IBM Voice Gateway, Infrastructure Automation, IBM Security Identity Manager.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (bluez, kernel, and lava), Fedora (ckeditor, drupal7, moby-engine, php-Smarty, and wavpack), Mageia (bind, e2fsprogs, epiphany, freerdp, kernel, kernel-linus, libconfuse, libosip2, ntfs-3g, perl-Image-ExifTool, and poppler), Oracle (firefox, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, kernel, kernel-container, and thunderbird), Scientific Linux (firefox, java-1.8.0-openjdk, and java-11-openjdk), SUSE (bluez, firefox, kernel, libxml2, and Ubuntu (linux-gcp).
---------------------------------------------
https://lwn.net/Articles/912178/
∗∗∗ Missing Authentication in ZKTeco ZEM/ZMM Web Interface ∗∗∗
---------------------------------------------
The ZKTeco time attendance device does not require authentication to use theweb interface, exposing the database of employees and their credentials.
---------------------------------------------
https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-003/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 20-10-2022 18:00 − Freitag 21-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Synology: Kritische Lücken in NAS erlauben Angreifern Ausführen von Schadcode ∗∗∗
---------------------------------------------
Synology warnt vor kritischen Sicherheitslücken in der DSM-Software einiger NAS. Angreifer könnten Schadode ausführen und unbefugt an Informationen gelangen.
---------------------------------------------
https://heise.de/-7316623
∗∗∗ F5 BIG-IP und Nginx: Hersteller stopft teils kritische Sicherheitslücken ∗∗∗
---------------------------------------------
Mehrere Sicherheitslücken in den BIG-IP- und Nginx-Systemen von F5 könnten Angreifern etwa das Ausführen von Schadcode ermöglichen. Updates stehen bereit.
---------------------------------------------
https://heise.de/-7316039
∗∗∗ Gefahren für kritische Infrastrukturen: "Uns fehlt eine Schwachstellenanalyse" ∗∗∗
---------------------------------------------
Prof. Norbert Gebbeken, Gründer und Sprecher des Forschungszentrums RISK, über die Gefahren, die unserer kritischen Infrastruktur drohen – und was man tun kann.
---------------------------------------------
https://heise.de/-7315119
∗∗∗ Your Microsoft Exchange Server Is a Security Liability ∗∗∗
---------------------------------------------
Endless vulnerabilities. Massive hacking campaigns. Slow and technically tough patching. Its time to say goodbye to on-premise Exchange.
---------------------------------------------
https://www.wired.com/story/microsoft-exchange-server-vulnerabilities/
∗∗∗ sczriptzzbn inject pushes malware for NetSupport RAT, (Fri, Oct 21st) ∗∗∗
---------------------------------------------
A campaign nicknamed "sczriptzzbn inject" can be identified by script using a variable named sczriptzzbn injected into files returned from a compromised website. This injected script causes a fake browser update page to appear in the victim's browser. The fake browser update page presents the malware payload for download. More information on the campaign can be found here. In previous weeks, this campaign pushed SolarMarker malware. I ran across one such example on 2022-09-27. This month, we've started seeing a payload for NetSupport RAT from the sczriptzzbn inject.
---------------------------------------------
https://isc.sans.edu/diary/rss/29170
∗∗∗ Archive Sidestepping: Emotet Botnet Pushing Self-Unlocking Password-Protected RAR ∗∗∗
---------------------------------------------
Trustwave SpiderLabs’ spam traps have identified an increase in threats packaged in password-protected archives with about 96% of these being spammed by the Emotet Botnet. In the first half of 2022, we identified password-protected ZIP files as the third most popular archive format used by cybercriminals to conceal malware.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sid…
∗∗∗ Wordfence Evasion Malware Conceals Backdoors ∗∗∗
---------------------------------------------
Malware authors, with some notable exceptions, tend to design their malicious code to hide from sight. The techniques they use help their malware stay on the victim’s website for as long as possible and ensure execution. For example — obfuscation techniques, fake code comments, naming conventions for injections that deploy SEO spam, redirect visitors to malicious third party websites, or steal credit card information from eCommerce stores.
---------------------------------------------
https://blog.sucuri.net/2022/10/wordfence-evasion-malware-conceals-backdoor…
∗∗∗ Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware ∗∗∗
---------------------------------------------
A now-patched vulnerability in VMware Workspace ONE Access has been observed being exploited to deliver both cryptocurrency miners and ransomware on affected machines. "The attacker intends to utilize a victims resources as much as possible, not only to install RAR1Ransom for extortion, but also to spread GuardMiner to collect cryptocurrency," Fortinet FortiGuard Labs researcher Cara Lin said in a Thursday report.
---------------------------------------------
https://thehackernews.com/2022/10/multiple-campaigns-exploit-vmware.html
∗∗∗ Threat Advisory: Monitoring CVE-2022-42889 “Text4Shell” Exploit Attempts ∗∗∗
---------------------------------------------
On October 17, 2022, the Wordfence Threat Intelligence team began monitoring for activity targeting CVE-2022-42889, or “Text4Shell” on our network of 4 million websites. We started seeing activity targeting this vulnerability on October 18, 2022. Text4Shell is a vulnerability in the Apache Commons Text library versions 1.5 through 1.9 that can be used to achieve [...]
---------------------------------------------
https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-…
∗∗∗ CISA Tells Organizations to Patch Linux Kernel Vulnerability Exploited by Malware ∗∗∗
---------------------------------------------
The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a Linux kernel flaw to its Known Exploited Vulnerabilities Catalog and instructed federal agencies to address it within three weeks.
---------------------------------------------
https://www.securityweek.com/cisa-tells-organizations-patch-linux-kernel-vu…
∗∗∗ Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool ∗∗∗
---------------------------------------------
Exbyte is the latest tool developed by ransomware attackers to expedite data theft from victims.
---------------------------------------------
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bl…
∗∗∗ Attackers Abusing Various Remote Control Tools ∗∗∗
---------------------------------------------
Ordinarily, attackers install malware through various methods such as spear phishing emails with a malicious attachment, malvertising, vulnerabilities, and disguising the malware as normal software and uploading them to websites. The malware that is installed include infostealers which steal information from the infected system, ransomware which encrypts files to demand ransom, and DDoS Bots which are used in DDoS attacks. In addition to these, backdoor and RAT are also major programs used by attackers.
---------------------------------------------
https://asec.ahnlab.com/en/40263/
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-10-20 ∗∗∗
---------------------------------------------
IBM Security Verify Gateway/Bridge, IBM Enterprise Records, IBM Sterling Order Management Netty, IBM WebSphere Application Server, IBM MQ Operator, IBM Sterling Order Management, IBM Enterprise Records, IBM Netezza Host Management.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ SolarWinds Security Advisories 2022-10-19 ∗∗∗
---------------------------------------------
SolarWinds released 4 new Security Advisories (3 high, 1 medium) for SolarWinds Platform 2022.4 RC1.
---------------------------------------------
https://www.solarwinds.com/trust-center/security-advisories
∗∗∗ SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server ∗∗∗
---------------------------------------------
The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account.Siemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the mobile server.
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-640732.txt
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (poppler), Oracle (firefox and thunderbird), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk, and java-17-openjdk), SUSE (bind, clone-master-clean-up, grafana, libksba, python3, tiff, and v4l2loopback), and Ubuntu (libreoffice).
---------------------------------------------
https://lwn.net/Articles/911989/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 19-10-2022 18:00 − Donnerstag 20-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Forensic Value of Prefetch, (Thu, Oct 20th) ∗∗∗
---------------------------------------------
When a program executes on a Windows system there are many artifacts that are generated which can assist digital forensic investigations. One of particular note is the Windows Prefetch file. Found in C:\Windows\Prefetch by default, prefetch files (.pf) contain a wealth of information that can prove vital to any investigation.
---------------------------------------------
https://isc.sans.edu/diary/rss/29168
∗∗∗ Fantastic Rootkits: And Where to Find Them (Part 1) ∗∗∗
---------------------------------------------
In this blog series, we will cover the topic of rootkits — how they are built and the basics of kernel driver analysis — specifically on the Windows platform. In this first part, we will focus on some implementation examples of basic rootkit functionality and the basics of kernel driver development, as well as Windows Internals background needed to understand the inner workings of rootkits.
---------------------------------------------
https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-…
∗∗∗ Microsoft liefert Updates gegen SSL-/TLS-Probleme durch Windows-Updates ∗∗∗
---------------------------------------------
Die aktuellen Windows-Updates für Windows 10, 11 und Server könnten Probleme bei SSL- und TLS-Verschlüsselung verursachen. Teils helfen weitere Patches dagegen.
---------------------------------------------
https://heise.de/-7314906
∗∗∗ New Malicious Clicker found in apps installed by 20M+ users ∗∗∗
---------------------------------------------
Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares masquerading as a useful tool or utility, and automatically crawling ads in the background. Recently the McAfee Mobile Research Team has identified new Clicker malware that sneaked into Google Play.
---------------------------------------------
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-…
∗∗∗ Social Engineering dos and don’ts ∗∗∗
---------------------------------------------
It got me thinking, again, about what makes for good social engineering (SE), and what advice would I give my younger self. These are my thoughts.
---------------------------------------------
https://www.pentestpartners.com/security-blog/social-engineering-dos-and-do…
∗∗∗ E-Mail-Konto wird migriert: Kriminelle senden betrügerische Mail an Mitarbeiter:innen ∗∗∗
---------------------------------------------
Kriminelle versenden betrügerische E-Mails und geben sich dabei als „Outlook-E-Mail-Administrator“ Ihres Unternehmens aus. Angeblich sollen die E-Mail-Konten aller Mitarbeiter:innen migriert werden. Klicken Sie nicht auf den Link.
---------------------------------------------
https://www.watchlist-internet.at/news/e-mail-konto-wird-migriert-kriminell…
∗∗∗ Datenleck bei Microsoft, Kundendaten betroffen (Okt. 2022) ∗∗∗
---------------------------------------------
Bei Microsoft hat es ein größeres Datenleck gegeben, bei dem Kundendaten wohl öffentlich zugreifbar waren. Eine Sicherheitsfirma hat einen fehlkonfigurierten Server mit den Daten im Internet gefunden und Microsoft im September informiert.
---------------------------------------------
https://www.borncity.com/blog/2022/10/20/datenleck-bei-microsoft-kundendate…
∗∗∗ Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them ∗∗∗
---------------------------------------------
Cisco Talos recently discovered several vulnerabilities in the Abode Systems iota All-In-One Security Kit. This kit includes a main security camera and hub that can alert users of unwanted movement in their homes. It also includes several motion sensors that can be attached to windows and doors.
---------------------------------------------
http://blog.talosintelligence.com/2022/10/vuln-spotlight-abode-.html
∗∗∗ LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for Over a Year ∗∗∗
---------------------------------------------
Checkmarx discovered ~200 malicious NPM packages with thousands of installations linked to an attack group called “LofyGang”.
---------------------------------------------
https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organiz…
∗∗∗ New Research: We’re Still Terrible at Passwords; Making it Easy for Attackers ∗∗∗
---------------------------------------------
We look at two of the most popular protocols used for remote administration, SSH and RDP, to get a sense of how attackers are taking advantage of weaker password management to gain access to systems.
---------------------------------------------
https://www.rapid7.com/blog/post/2022/10/20/new-research-were-still-terribl…
∗∗∗ Black Basta and the Unnoticed Delivery ∗∗∗
---------------------------------------------
As reported by Check Point at the end of H1 2022, 1 out of 40 organizations worldwide were impacted by ransomware attacks, which constitutes a worrying 59% increase over the past year. The ransomware business continues to grow in gargantuan proportions due to the lucrative payments demanded – and often received – by cybercrime gangs.
---------------------------------------------
https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/
=====================
= Vulnerabilities =
=====================
∗∗∗ Patchday: Oracle liefert 370 Sicherheitsupdates im Oktober ∗∗∗
---------------------------------------------
Zum Patchday, Critical Patch Update genannt, liefert Oracle eine lange Liste an Produkten mit Sicherheitslücken. 370 Updates schließen die Schwachstellen.
---------------------------------------------
https://heise.de/-7314209
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (firefox-esr), Red Hat (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, OpenShift Container Platform 4.9.50 bug fix and, and rh-nodejs14-nodejs), SUSE (buildah, clone-master-clean-up, go1.18, go1.19, helm, jasper, libostree, nodejs16, php8, qemu, and xen), and Ubuntu (libxdmcp, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oem-5.14, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-oem-5.17, and perl).
---------------------------------------------
https://lwn.net/Articles/911879/
∗∗∗ Drupal: Search API - Moderately critical - Information Disclosure - SA-CONTRIB-2022-059 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-059
∗∗∗ Security Bulletin: IBM MQ is affected by an identity spoofing issue in IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-affected-by-an-…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator B2B API vulnerable to multiple issues due to Apache Zookeeper (CVE-2019-0201, CVE-2021-21409) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server April 2022 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: Apache log4j security vulnerability as it relates to IBM Maximo Scheduler Optimization – Apache Log4j – [CVE-2021-45105] (affecting v2.16) and [CVE-2021-45046] (affecting v2.15) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-security-vul…
∗∗∗ F5: K24823443: Apache Commons Text vulnerability CVE-2022-42889 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K24823443
∗∗∗ F5: K27155546: BIND vulnerability CVE-2022-38177 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K27155546
∗∗∗ F5: K04712583: Linux kernel vulnerability CVE-2021-40490 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K04712583
∗∗∗ F5: K32615023: Linux kernel vulnerability CVE-2022-2588 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K32615023
∗∗∗ Bentley Systems MicroStation Connect ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-293-01
∗∗∗ Spring: CVE-2022-31684: Reactor Netty HTTP Server may log request headers ∗∗∗
---------------------------------------------
https://spring.io/blog/2022/10/20/cve-2022-31684-reactor-netty-http-server-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 18-10-2022 18:00 − Mittwoch 19-10-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Adobe patcht Illustrator außer der Reihe ∗∗∗
---------------------------------------------
Nach dem großen Patchday letzte Woche legt Adobe nun zwei Updates gegen kritische Lücken im Illustrator nach.
---------------------------------------------
https://heise.de/-7314003
∗∗∗ AMD, Google, Microsoft, Nvidia: Offengelegter Sicherheitsprozessor Caliptra ∗∗∗
---------------------------------------------
Branchenschwergewichte setzen auf RISC-V-Technik für offengelegte Hardware-Security. Sie könnte Black-Box-Umsetzungen wie Microsofts Pluton ersetzen.
---------------------------------------------
https://heise.de/-7313272
∗∗∗ Achtung Betrug: Bewerben Sie sich nicht als „Process Tester“ bei page-rangers.de ∗∗∗
---------------------------------------------
page-rangers.de bietet einen gut bezahlten Minijob als „App-Tester“. Die Arbeit wird von zu Hause aus erledigt und benötigt keine speziellen Anforderungen. Sie erhalten täglich kleine Aufträge, z. B. die Benutzerfreundlichkeit bei der Eröffnung eines Bankkontos zu testen. Doch Vorsicht: Mit diesem Job stehlen Kriminelle Ihre Identität. Mit dem erstellten Bankkonto wird in Ihrem Namen Geld gewaschen!
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-betrug-bewerben-sie-sich-nic…
∗∗∗ Defenders beware: A case for post-ransomware investigations ∗∗∗
---------------------------------------------
The Microsoft Detection and Response Team (DART) details a recent ransomware incident in which the attacker used a collection of commodity tools and techniques, such as using living-off-the-land binaries, to launch their malicious code.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/10/18/defenders-beware-a-case-…
∗∗∗ Awareness and guidance related to potential Service Fabric Explorer (SFX) v1 web client risk ∗∗∗
---------------------------------------------
Microsoft was recently made aware of a Cross-Site Scripting (XSS) vulnerability (CVE-2022-35829), that under limited circumstances, affects older versions of Service Fabric Explorer (SFX). The current default SFX web client (SFXv2) is not vulnerable to this attack. However, customers can manually switch from the default web client (SFXv2) to an older vulnerable SFX web [...]
---------------------------------------------
https://msrc-blog.microsoft.com/2022/10/19/awareness-and-guidance-related-t…
∗∗∗ Are Internet Scanning Services Good or Bad for You?, (Wed, Oct 19th) ∗∗∗
---------------------------------------------
I'm in Luxembourg to attend the first edition of the CTI Summit[1]. There was an interesting keynote performed by Patrice Auffret[2], the founder of Onyphe, about "Ethical Internet Scanning in 2022". They are plenty of online scanners that work 24x7 to build a map of the Internet. They scan the entire IP addresses space and look for interesting devices, vulnerabilities, etc. Big players are Shodan, Onyphe, Censys, ZoomEye, etc.
---------------------------------------------
https://isc.sans.edu/diary/rss/29164
∗∗∗ Fully undetectable Windows backdoor gets detected ∗∗∗
---------------------------------------------
SafeBreach Labs says it has detected a novel fully undetectable (FUD) PowerShell backdoor, which calls into question the accuracy of threat naming.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/10/18/fully_undete…
∗∗∗ A New Attack Surface on MS Exchange Part 4 - ProxyRelay! ∗∗∗
---------------------------------------------
Hi, this is a long-time-pending article. We could have published this article earlier (the original bug was reported to MSRC in June 2021 with a 90-days Public Disclosure Policy). However, during communications with MSRC, they explained that since this is an architectural design issue, lots of code changes and testings are expected and required, so they hope to resolve this problem with a one-time CU (Cumulative Update) instead of the regular Patch Tuesday.
---------------------------------------------
https://devco.re/blog/2022/10/19/a-new-attack-surface-on-MS-exchange-part-4…
∗∗∗ Warning: "FaceStealer" iOS and Android apps steal your Facebook login ∗∗∗
---------------------------------------------
FaceStealer is back. As a seasoned threat to legitimate app stores, expect it to be gone and then back again.
---------------------------------------------
https://www.malwarebytes.com/blog/news/2022/10/warning-facestealer-ios-and-…
∗∗∗ TeamTNT Returns – or Does It? ∗∗∗
---------------------------------------------
Our honeypots caught malicious cryptocurrency miner samples targeting the cloud and containers, and its routines are reminiscent of the routines employed by cybercriminal group TeamTNT, which was said to have quit in November 2021. Our investigation shows that another threat actor group, WatchDog, might be mimicking TeamTNT’s arsenal.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/j/teamtnt-returns-or-does-it.h…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (bcel, kernel, node-xmldom, and squid), Mageia (chromium-browser-stable, dhcp, dokuwiki, firefox, golang, python-joblib, sos, and unzip), Oracle (nodejs and nodejs:16), Red Hat (firefox, kernel, kernel-rt, nodejs, nodejs:14, and thunderbird), Scientific Linux (firefox and thunderbird), Slackware (git and mozilla), SUSE (amazon-ssm-agent, caasp-release, cri-o, patchinfo, release-notes-caasp, skuba, enlightenment, libreoffice, netty, nodejs12, nodejs14, [...]
---------------------------------------------
https://lwn.net/Articles/911723/
∗∗∗ Oracle Releases 370 New Security Patches With October 2022 CPU ∗∗∗
---------------------------------------------
Oracle on Tuesday announced the release of 370 patches as part of its quarterly set of security updates. The October 2022 Critical Patch Update (CPU) resolves over 50 critical-severity vulnerabilities. More than 200 of the newly released security patches deal with vulnerabilities that are remotely exploitable without authentication.
---------------------------------------------
https://www.securityweek.com/oracle-releases-370-new-security-patches-octob…
∗∗∗ Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function UPDATE A ∗∗∗
---------------------------------------------
UPDATE A (19.10.2022): Added Control block-Set CPX-CEC-C1 and Control block-SETCPX-CMXX to affected products.
Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-036/
∗∗∗ K30425568: Overview of F5 vulnerabilities (October 2022) ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K30425568
∗∗∗ CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series ∗∗∗
---------------------------------------------
https://psirt.bosch.com/security-advisories/bosch-sa-609377-bt.html
∗∗∗ Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000 ∗∗∗
---------------------------------------------
https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html
∗∗∗ Cisco Identity Services Engine Unauthorized File Access Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Security Bulletin: Operations Dashboard is vulnerable to Golang Go vulnerabilities (CVE-2022-27664 and CVE-2022-32190) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-operations-dashboard-is-v…
∗∗∗ Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-qradar-pulse-application-…
∗∗∗ Security Bulletin: Multiple vulnerabilities in Spark affecting IBM QRadar User Behavior Analytics ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by vulnerability in Dojo [CVE-2021-23450] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-manage…
∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2022-34339, CVE-2021-3712, CVE-2021-3711, CVE-2021-4160, CVE-2021-29425, CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-43138, CVE-2022-24758) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-…
∗∗∗ Security Bulletin: CMIS is affected since it uses Spring Framework, but not vulnerable to [CVE-2022-22965] and [CVE-2022-22963] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-cmis-is-affected-since-it…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator is vulnerable to information disclosure due to JUnit4 (CVE-2020-15250) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2022-23302) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 17-10-2022 18:00 − Dienstag 18-10-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ CVE-2022-42889: Keep Calm and Stop Saying "4Shell" ∗∗∗
---------------------------------------------
[...] The vulnerability has been compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object. However, initial analysis indicates that this is a bad comparison. The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input.
In summary, much like with Spring4Shell, there are significant caveats to practical exploitability for CVE-2022-42889. With that said, we still recommend patching any relevant impacted software according to your normal, hair-not-on-fire patch cycle.
---------------------------------------------
https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-st…
∗∗∗ Europol: Festgenommene Autodiebe stahlen Fahrzeuge mittels Software ∗∗∗
---------------------------------------------
In Frankreich wurden 31 Mitglieder einer Diebesbande festgenommen, die Autos mit schlüssellosen Zugangssystemen per Software gestohlen haben sollen.
---------------------------------------------
https://www.golem.de/news/europol-festgenommene-autodiebe-stahlen-fahrzeuge…
∗∗∗ Sicherheit: Antivirensoftware blockiert Thunderbird-Updates ∗∗∗
---------------------------------------------
Statt für Sicherheit zu sorgen, blockieren Avast und AVG Thunderbird-Updates. Das soll bereits seit dreieinhalb Monaten der Fall sein.
---------------------------------------------
https://www.golem.de/news/sicherheit-antivirensoftware-blockiert-thunderbir…
∗∗∗ Fake-Shop Alarm: Vorsicht vor betrügerischen Solar- und Photovoltaik-Shops ∗∗∗
---------------------------------------------
Shops wie elektrox-solar.at und horizon-shot.com täuschen mit professionellem Design und gestohlenen Impressumsdaten. Lassen Sie sich von diesen Fake-Shops nicht in die Falle locken! So erkennen Sie Fake-Solar-Shops online.
---------------------------------------------
https://www.watchlist-internet.at/news/fake-shop-alarm-vorsicht-vor-betrueg…
∗∗∗ Das Salz in der Suppe: Salts als unverzichtbare Zutat bei der Passwortspeicherung für Applikationen ∗∗∗
---------------------------------------------
Die Verwendung eines Salt bei der Passwortspeicherung verhindert die Vorberechnung des Hash. Als zusätzliches Geheimnis kann ein Pepper verwendet werden.
---------------------------------------------
https://www.syss.de/pentest-blog/das-salz-in-der-suppe-salts-als-unverzicht…
∗∗∗ WordPress 6.0.3 erschienen ∗∗∗
---------------------------------------------
Gerade habe ich die Meldung erhalten, dass ein Wartungsupdate auf WordPress 6.0.3 erschienen ist. Dieses Update schließt einige Sicherheitslücken, die hier beschrieben sind.
---------------------------------------------
https://www.borncity.com/blog/2022/10/18/wordpress-6-0-3-erschienen/
∗∗∗ FLEXlm and Citrix ADM Denial of Service Vulnerability ∗∗∗
---------------------------------------------
On June 27, 2022, Citrix released an advisory for CVE-2022-27511 and CVE-2022-27512, which affect Citrix ADM (Application Delivery Management).
Rapid7 investigated these issues to better understand their impact, and found that the patch is not sufficient to prevent exploitation. We also determined that the worst outcome of this vulnerability is a denial of service - the licensing server can be told to shut down (even with the patch).
---------------------------------------------
https://www.rapid7.com/blog/post/2022/10/18/flexlm-and-citrix-adm-denial-of…
∗∗∗ Python Obfuscation for Dummies, (Tue, Oct 18th) ∗∗∗
---------------------------------------------
Recently, I found several malicious Python scripts that looked the same. They all contained the same strings at the end: [...]
---------------------------------------------
https://isc.sans.edu/diary/rss/29160
∗∗∗ I’m in your hypervisor, collecting your evidence ∗∗∗
---------------------------------------------
Data acquisition during incident response engagements is always a big exercise, both for us and our clients. It’s rarely smooth sailing, and we usually encounter a hiccup or two. Fox-IT’s approach to enterprise scale incident response for the past few years has been to collect small forensic artefact packages using our internal data collection utility, “acquire”, usually deployed using the clients’ preferred method of software deployment. While this method works fine in most cases, we often encounter scenarios where deploying our software is tricky or downright impossible.
---------------------------------------------
https://blog.fox-it.com/2022/10/18/im-in-your-hypervisor-collecting-your-ev…
∗∗∗ Zoom for macOS Contains High-Risk Security Flaw ∗∗∗
---------------------------------------------
Video messaging technology powerhouse Zoom has rolled out a high-priority patch for macOS users alongside a warning that hackers could abuse the software flaw to connect to and control Zoom Apps.
---------------------------------------------
https://www.securityweek.com/zoom-macos-contains-high-risk-security-flaw
∗∗∗ Dutch Police obtain 155 decryption keys for Deadbolt ransomware victims ∗∗∗
---------------------------------------------
Police in the Netherlands said they were able to trick the group behind the Deadbolt ransomware to hand over the decryption keys for 155 victims during a police operation announced last week. In a statement, the Dutch National Police said on Friday that they conducted a targeted operation where they effectively paid a ransom in [...]
---------------------------------------------
https://therecord.media/dutch-police-obtain-155-decryption-keys-for-deadbol…
∗∗∗ Alchimist: A new attack framework in Chinese for Mac, Linux and Windows ∗∗∗
---------------------------------------------
Cisco Talos discovered a new attack framework including a command and control (C2) tool called "Alchimist" and a new malware "Insekt" with remote administration capabilities. The Alchimist has a web interface in Simplified Chinese with remote administration features. The attack framework is designed to target Windows, Linux and Mac machines.
---------------------------------------------
http://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html
∗∗∗ Software Patch Management Policy Best Practices ∗∗∗
---------------------------------------------
Explore the top risk-based patch management policy best practices to mitigate the growing threat of vulnerability exploits in your organization.
---------------------------------------------
https://www.trendmicro.com/en_us/ciso/22/j/software-patch-management-policy…
=====================
= Vulnerabilities =
=====================
∗∗∗ Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software ∗∗∗
---------------------------------------------
HelpSystems, the company behind the Cobalt Strike software platform, has released an out-of-band security update to address a remote code execution vulnerability that could allow an attacker to take control of targeted systems.
---------------------------------------------
https://thehackernews.com/2022/10/critical-rce-vulnerability-discovered.html
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (glibc and libksba), Fedora (dhcp and kernel), Red Hat (.NET 6.0, .NET Core 3.1, compat-expat1, kpatch-patch, and nodejs:16), Slackware (xorg), SUSE (exiv2, expat, kernel, libreoffice, python, python-numpy, squid, and virtualbox), and Ubuntu (linux-azure and zlib).
---------------------------------------------
https://lwn.net/Articles/911562/
∗∗∗ Advantech R-SeeNet ∗∗∗
---------------------------------------------
Successful exploitation of these vulnerabilities could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution.
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-291-01
∗∗∗ Security Bulletin: IBM WebSphere Application Server is vulnerable to SOAPAction spoofing (CVE-2022-38712) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to denial of service due to XStream (CVE-2021-43859) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Spring Framework (CVE-2021-22060) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to remove traversal due to Apache Commons IO (CVE-2021-29425) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-qradar-pulse-application-…
∗∗∗ Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-qradar-analy…
∗∗∗ Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow – CVE-2022-35279 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable due to Eclipse Jetty ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 14-10-2022 18:00 − Montag 17-10-2022 18:00
Handler: Stephan Richter
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Prestige: Microsoft findet neue Ransomware in Polen und Ukraine ∗∗∗
---------------------------------------------
Das Sicherheitsteam von Microsoft hat eine komplett neue Ransomware-Kampagne gegen den Logistik- und Transportsektor in der Ukraine und Polen entdeckt.
---------------------------------------------
https://www.golem.de/news/prestige-microsoft-findet-neue-ransomware-in-pole…
∗∗∗ Office 365: Microsofts E-Mail-Verschlüsselung ist unsicher ∗∗∗
---------------------------------------------
Die E-Mail-Verschlüsselung von Microsoft 365 setzt auf AES in einem unsicheren Modus. Dadurch können Rückschlüsse auf die Inhalte gezogen werden.
---------------------------------------------
https://www.golem.de/news/office-365-microsofts-e-mail-verschluesselung-ist…
∗∗∗ Schwachstelle im Linux-Kernel ermöglicht Codeschmuggel via WLAN ∗∗∗
---------------------------------------------
Ein IT-Sicherheitsforscher hat Schwachstellen im Linux-Kernel gefunden. Angreifer könnten durch manipulierte WLAN-Pakete beliebigen Code einschleusen.
---------------------------------------------
https://heise.de/-7309762
∗∗∗ Support-Ende für VMware ESXi 6.5 und 6.7 - noch viele Alt-Systeme aktiv ∗∗∗
---------------------------------------------
Am 15. Oktober hat VMware den Support für VMware ESXi 6.5 und 6.7 eingestellt. Aktuellen Zahlen zufolge sind noch viele veraltete Systeme im Einsatz.
---------------------------------------------
https://heise.de/-7310412
∗∗∗ Neue Ransomware-Gang „Ransom Cartel“ ∗∗∗
---------------------------------------------
Der IT-Sicherheitsanbieter Palo Alto Networks und dessen Malware-Analyseteam Unit42 haben Erkenntnisse zu „Ransom Cartel“ gewonnen. Es handelt sich um eine Ransomware as a Service (RaaS)-Anbieter, der Mitte Dezember 2021 erstmals aufgetaucht ist.
---------------------------------------------
https://www.zdnet.de/88404159/neue-ransomware-gang-ransom-cartel/
∗∗∗ Microsoft bestätigt: Windows patzt bei der Erkennung gefährlicher Treiber – Blocklisten nicht verteilt ∗∗∗
---------------------------------------------
Eigentlich sollte Windows bekannte, bösartige Treiber beim Laden blockieren, so dass diese keinen Schaden anrichten können. Zumindest hat Microsoft dies seit Jahren behauptet. Nun hat Microsoft unter der Hand zugegeben, dass man dort gepatzt hat.
---------------------------------------------
https://www.borncity.com/blog/2022/10/17/microsoft-besttigt-windows-patzt-b…
∗∗∗ Unseriöse Werbung auf Pinterest ∗∗∗
---------------------------------------------
Wie in jedem Sozialen Netzwerk gibt es auch auf Pinterest Werbung. In letzter Zeit vermehrt von unseriösen Online-Shops für Haar-Styling-Geräte und Shaping-Hosen. Die Produkte von zevoon.de, valurabeauty.de oder lusto.de wirken zwar vielversprechend, erfahrungsgemäß werden Sie aber enttäuscht und erhalten minderwertigen Schrott aus China. Wir zeigen Ihnen, bei welchen Shops Sie lieber nicht bestellen sollten.
---------------------------------------------
https://www.watchlist-internet.at/news/unserioese-werbung-auf-pinterest/
∗∗∗ New PHP information-stealing malware targets Facebook accounts ∗∗∗
---------------------------------------------
Threat analysts have spotted a new Ducktail campaign using a new infostealer variant and novel TTPs (tactics, techniques, and procedures), while the Facebook users it targets are no longer limited to holders of business accounts.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-php-information-stealing…
∗∗∗ Black Basta Ransomware Hackers Infiltrates Networks via Qakbot to Deploy Brute Ratel C4 ∗∗∗
---------------------------------------------
The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. The development marks the first time the nascent adversary simulation software is being delivered via a Qakbot infection, cybersecurity firm Trend Micro said in a technical analysis released last week.
---------------------------------------------
https://thehackernews.com/2022/10/black-basta-ransomware-hackers.html
∗∗∗ Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis ∗∗∗
---------------------------------------------
On September 2, 2022, Zscaler Threatlabz captured an in-the-wild 0-day exploit in the Windows Common Log File System Driver (CLFS.sys) and reported this discovery to Microsoft. In the September Tuesday patch, Microsoft fixed this vulnerability that was identified as CVE-2022-37969, which is a Windows Common Log File System Driver elevation of privilege vulnerability. An attacker who successfully exploits this vulnerability may gain SYSTEM privileges.
---------------------------------------------
https://www.zscaler.com/blogs/security-research/technical-analysis-windows-…
∗∗∗ Free Micropatches For Bypassing "Mark of the Web" on Unzipped Files (0day) ∗∗∗
---------------------------------------------
In May, security researcher Will Dormann found a vulnerability in Windows that allows an attacker to prevent Windows from setting the "Mark of the Web" flag on files extracted from a ZIP archive, even if the ZIP archive came from an untrusted source such as Internet, email, or a USB key. Mark of the Web (MOTW) is an important security mechanism in Windows: Windows will show a security warning before launching an executable file with MOTW;
---------------------------------------------
https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-mark-of.html
∗∗∗ New Black Lotus UEFI Rootkit Provides APT-Level Capabilities to Cybercriminals ∗∗∗
---------------------------------------------
A threat actor is promoting on underground criminal forums a vendor-independent UEFI rootkit that can disable security software and controls, cybersecurity veteran Scott Scheferman warns.
---------------------------------------------
https://www.securityweek.com/new-black-lotus-uefi-rootkit-provides-apt-leve…
∗∗∗ Detecting Emerging Network Threats From Newly Observed Domains ∗∗∗
---------------------------------------------
We discuss how to discover potential threats among newly observed domains at the time they begin to carry attack traffic.
---------------------------------------------
https://unit42.paloaltonetworks.com/malicious-newly-observed-domains/
∗∗∗ CISA Releases RedEye: Red Team Campaign Visualization and Reporting Tool ∗∗∗
---------------------------------------------
CISA has released RedEye, an interactive open-source analytic tool to visualize and report Red Team command and control activities. RedEye allows an operator to quickly assess complex data, evaluate mitigation strategies, and enable effective decision making.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/10/14/cisa-releases-red…
∗∗∗ Stories from the SOC: Feeling so foolish – SocGholish drive by compromise ∗∗∗
---------------------------------------------
SocGholish, also known as FakeUpdate, is a JavaScript framework leveraged in social engineering drive by compromises that has been a thorn in cybersecurity professionals’ and organizations’ sides for at least 5 years now. Upon visiting a compromised website, users are redirected to a page for a browser update and a zip archive file containing a malicious JavaScript file is downloaded and unfortunately often opened and executed by the fooled end user.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-so…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-10-14 ∗∗∗
---------------------------------------------
IBM InfoSphere Information Server, IBM Sterling B2B Integrator, IBM Sterling Connect:Direct for HP NonStop, IBM Sterling File Gateway
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ MiniDVBLinux 5.4 Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Arbitrary File Read Vulnerability, Remote Root Command Execution Vulnerability, Remote Root Command Injection Vulnerability, Unauthenticated Stream Disclosure Vulnerability, Change Root Password PoC, Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit, Config Download Exploit
---------------------------------------------
https://www.zeroscience.mk/en/vulnerabilities/
∗∗∗ CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults ∗∗∗
---------------------------------------------
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with [...]
---------------------------------------------
https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Arch Linux (kernel, linux-hardened, linux-lts, and linux-zen), Debian (python-django), Fedora (apptainer, kernel, python3.6, and vim), Gentoo (assimp, deluge, libvirt, libxml2, openssl, rust, tcpreplay, virglrenderer, and wireshark), Slackware (zlib), SUSE (chromium, python3, qemu, roundcubemail, and seamonkey), and Ubuntu (linux-aws-5.4 and linux-ibm).
---------------------------------------------
https://lwn.net/Articles/911461/
∗∗∗ WAGO: Multiple products - Loss of MAC-Address-Filtering after reboot ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-042/
∗∗∗ WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-040/
∗∗∗ TRUMPF TruTops prone to improper access control ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-023/
∗∗∗ Gitea: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1742
∗∗∗ Linux Kernel: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1741
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 13-10-2022 18:00 − Freitag 14-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Infostealer: Was ist das, wie werden sie verbreitet und wie lassen sie sich aufhalten? ∗∗∗
---------------------------------------------
Infostealer sind eine schädliche Software, die darauf ausgelegt ist, Ihre vertraulichen Daten zu stehlen. Hier erfahren Sie, was genau sie sind, wie sie verbreitet werden und wie sie sich aufhalten lassen.
---------------------------------------------
https://blog.emsisoft.com/de/41944/infostealer-was-ist-das-wie-werden-sie-v…
∗∗∗ Magniber ransomware now infects Windows users via JavaScript files ∗∗∗
---------------------------------------------
A recent malicious campaign delivering Magniber ransomware has been targeting Windows home users with fake security updates.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/magniber-ransomware-now-infe…
∗∗∗ What the Uber Hack can teach us about navigating IT Security ∗∗∗
---------------------------------------------
The recent Uber cyberattack shows us the myriad tactics employed by threat actors to breach corporate networks. Learn more about these tactics used and how to navigate IT Security.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/what-the-uber-hack-can-teach…
∗∗∗ Microsoft 365 Message Encryption Can Leak Sensitive Info ∗∗∗
---------------------------------------------
The default email encryption used in Microsoft Offices cloud version is leaky, which the company acknowledged but said it wouldnt fix.
---------------------------------------------
https://www.darkreading.com/application-security/microsoft-365-message-encr…
∗∗∗ Hunting for Cobalt Strike: Mining and plotting for fun and profit ∗∗∗
---------------------------------------------
Cobalt Strike is a commercial Command and Control framework built by Helpsystems. You can find out more about Cobalt Strike on the MITRE ATT&CK page. But it can also be used by real adversaries. In this post we describe how to use RiskIQ and other Microsoft technologies to see if you have Cobalt Strike [...]
---------------------------------------------
https://msrc-blog.microsoft.com/2022/10/13/hunting-for-cobalt-strike-mining…
∗∗∗ Improvements in Security Update Notifications Delivery - And a New Delivery Method ∗∗∗
---------------------------------------------
At MSRC, we are passionate about ensuring our customers have a positive experience when they use the Microsoft Security Update Guide (SUG). A big part of improving that experience is ensuring that customers have timely and easily accessible notifications. As such we have two important announcements to share about changes to the way we provide notifications.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/10/12/14921/
∗∗∗ Analysis of a Malicious HTML File (QBot), (Thu, Oct 13th) ∗∗∗
---------------------------------------------
Reader Eric submitted a malicious HTML page that contains BASE64 images with malware.
---------------------------------------------
https://isc.sans.edu/diary/rss/29146
∗∗∗ Firefoxs New Service Gives You a Burner Phone Number To Cut Down on Spam ∗∗∗
---------------------------------------------
Firefox Relay, a Mozilla service designed to hide your "real" email address by giving you virtual ones to hand out, is expanding to offer virtual phone numbers. From a report: In a blog post Mozilla product manager Tony Amaral-Cinotto explains that the relay service generates a phone number for you to give out to companies if you suspect they might use it to send you spam messages in the future, or if you think they might share it with others who will.
---------------------------------------------
https://news.slashdot.org/story/22/10/13/1124240/firefoxs-new-service-gives…
∗∗∗ PiRogue Tool Suite Mobile forensic & network analysis on a Raspberry Pie ∗∗∗
---------------------------------------------
PiRogue tool suite (PTS) is an open-source tool suite that provides a comprehensive mobile forensic and network traffic analysis platform targeting mobile devices both Android and iOS, internet of things devices (devices that are connected to the user mobile apps), and in general any device using wi-fi to connect to the Internet.
---------------------------------------------
https://pts-project.org/
∗∗∗ PoC Published for Fortinet Vulnerability as Mass Exploitation Attempts Begin ∗∗∗
---------------------------------------------
Details and a proof-of-concept (PoC) exploit have been published for the recent Fortinet vulnerability tracked as CVE-2022-40684, just as cybersecurity firms are seeing what appears to be the start of mass exploitation attempts.
---------------------------------------------
https://www.securityweek.com/poc-published-fortinet-vulnerability-mass-expl…
∗∗∗ Ransom Cartel Ransomware: A Possible Connection With REvil ∗∗∗
---------------------------------------------
Ransom Cartel is ransomware as a service (RaaS) that exhibits several similarities to and technical overlaps with REvil ransomware. Read our overview.
---------------------------------------------
https://unit42.paloaltonetworks.com/ransom-cartel-ransomware/
∗∗∗ Seven tips to run effective security awareness campaigns ∗∗∗
---------------------------------------------
Planning large-scale security awareness campaigns throws up many questions to grapple with. How can you make sure your campaign reaches the right people? What’s the best way to inspire them to take action? And how do you run a security awareness campaign so realistic it gets banned by the national post office?
---------------------------------------------
https://connect.geant.org/2022/10/14/seven-tips-to-run-effective-security-a…
∗∗∗ Shodan Verified Vulns 2022-10-01 ∗∗∗
---------------------------------------------
Mit Stand 2022-10-01 sieht Shodan in Österreich die folgenden Schwachstellen: [...]
---------------------------------------------
https://cert.at/de/aktuelles/2022/10/shodan-verified-vulns-2022-10-01
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
IBM Performance Management, IBM Watson Discovery for IBM Cloud Pak for Data, IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data, IBM Cloud Pak System
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium), Fedora (dbus, dhcp, expat, kernel, thunderbird, vim, and weechat), Mageia (libofx, lighttpd, mediawiki, and python), Oracle (.NET 6.0 and .NET Core 3.1), Slackware (python3), SUSE (chromium, kernel, libosip2, python-Babel, and python-waitress), and Ubuntu (gThumb, heimdal, linux-aws, linux-gcp-4.15, linux-aws-hwe, linux-gcp, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, postgresql-9.5, and xmlsec1).
---------------------------------------------
https://lwn.net/Articles/911168/
∗∗∗ Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service ∗∗∗
---------------------------------------------
This advisory contains mitigations for Allocation of Resources Without Limits or Throttling and Code Injection vulnerabilities in versions of Hitachi Energy Lumada Asset Performance Manager (APM) software.
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-286-05
∗∗∗ OpenSSL Infinite loop when parsing certificates CVE-2022-0778 ∗∗∗
---------------------------------------------
Version: 1.7, Date: 14-Oct-2022, Description: Fixed product(s) lists are updated: GMS, Analytics, SonicWave, SonicSwitch, Connect Tunnel Client.
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002
∗∗∗ Joomla KSAdvertiser 2.5.37 Cross Site Scripting ∗∗∗
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022100035
∗∗∗ Android App "IIJ SmartKey" vulnerable to information disclosure ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN74534998/
∗∗∗ Pulse Secure Pulse Connect Secure: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1717
∗∗∗ Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1715
∗∗∗ Atlassian Jira Software: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1719
∗∗∗ Octopus Deploy: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1720
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 12-10-2022 18:00 − Donnerstag 13-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ New Alchimist attack framework targets Windows, macOS, Linux ∗∗∗
---------------------------------------------
Cybersecurity researchers have discovered a new attack and C2 framework called Alchimist, which appears to be actively used in attacks targeting Windows, Linux, and macOS systems.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-alchimist-attack-framewo…
∗∗∗ SiteCheck Malware Trends Report – Q3 2022 ∗∗∗
---------------------------------------------
Our free SiteCheck remote website scanner provides immediate insights about malware infections, blocklisting, website anomalies, and errors for millions of webmasters every month. Best of all, conducting a remote website scan is one of the easiest ways to identify security issues.
---------------------------------------------
https://blog.sucuri.net/2022/10/sitecheck-malware-trends-report-2022-q3.html
∗∗∗ Researchers Uncover Custom Backdoors and Spying Tools Used by Polonium Hackers ∗∗∗
---------------------------------------------
Core to the attacks has been the use of implants coined CreepyDrive and CreepyBox for their ability to exfiltrate sensitive data to actor-controlled OneDrive and Dropbox accounts. Also deployed is a PowerShell backdoor dubbed CreepySnail.
---------------------------------------------
https://thehackernews.com/2022/10/researchers-uncover-custom-backdoors.html
∗∗∗ VPN-Problem: Apple-Apps leaken Daten unter iOS ∗∗∗
---------------------------------------------
Der iPhone-VPN-Dienst scheint noch immer nicht sauber zu laufen. Ein Sicherheitsforscher warnt vor Leaks insbesondere aus Apple-eigenen Apps.
---------------------------------------------
https://heise.de/-7307198
∗∗∗ Top 5 ransomware detection techniques: Pros and cons of each ∗∗∗
---------------------------------------------
In the fight against ransomware, much of the discussion revolves around prevention and response. Actually detecting the ransomware, however, is just as important to securing your business. To understand why, just consider the following example.
---------------------------------------------
https://www.malwarebytes.com/blog/business/2022/10/top-5-ransomware-detecti…
∗∗∗ MS Enterprise app management service RCE. CVE-2022-35841 ∗∗∗
---------------------------------------------
TL;DR A remote command execution and local privilege escalation vulnerability has been fixed by Microsoft as part of September’s patch Tuesday. The vulnerability, filed under CVE-2022-35841, affects the Enterprise App Management Service which handles the installation of enterprise applications deployed via MDM.
---------------------------------------------
https://www.pentestpartners.com/security-blog/ms-enterprise-app-management-…
∗∗∗ Some Vulnerabilities Don’t Have a Name ∗∗∗
---------------------------------------------
There is a common assumption that all open source vulnerabilities hold a CVE. Still, others believe that the National Vulnerability Database (NVD) has the final word when deciding what is a vulnerability and what is not. However, can a vulnerability exist that isn’t tracked by a CVE, or is not in the NVD?
---------------------------------------------
https://checkmarx.com/blog/some-vulnerabilities-dont-have-a-name/
=====================
= Vulnerabilities =
=====================
∗∗∗ Sicherheitsupdates: Kritische Lücken in WAN-Managementsystem von Aruba ∗∗∗
---------------------------------------------
Zwei kritische Schwachstellen in Aruba EdgeConnect Orchestrator gefährden Netzwerke.
---------------------------------------------
https://heise.de/-7307059
∗∗∗ CVE-2022-0030 PAN-OS: Authentication Bypass in Web Interface ∗∗∗
---------------------------------------------
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.
---------------------------------------------
https://security.paloaltonetworks.com/CVE-2022-0030
∗∗∗ Juniper Security Bulletins 2022-10-12 ∗∗∗
---------------------------------------------
Juniper has released 37 security advisories.
---------------------------------------------
https://supportportal.juniper.net/s/global-search/%40uri?language=en_US#sor…
∗∗∗ Schwachstelle in JavaScript-Sandbox vm2 erlaubt Ausbruch aus der Isolation ∗∗∗
---------------------------------------------
Wer eine Version kleiner 3.9.11 von vm2 verwendet, sollte die Sandbox aktualisieren, da eine Schwachstelle das Ausführen von Remote-Code auf dem Host erlaubt.
---------------------------------------------
https://heise.de/-7306752
∗∗∗ Groupware Zimbra: Updates stopfen mehrere Sicherheitslecks ∗∗∗
---------------------------------------------
In der Groupware Zimbra beheben die Entwickler mehrere sicherheitsrelevante Fehler. Angreifer könnten die Instanz kompromittieren oder ihre Rechte ausweiten.
---------------------------------------------
https://heise.de/-7307521
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libreoffice, rexical, ruby-nokogiri, and squid), Fedora (wavpack), Red Hat (expat), SUSE (gdcm, orthanc, orthanc-gdcm, orthanc-webviewer and rubygem-puma), and Ubuntu (GMP and unzip).
---------------------------------------------
https://lwn.net/Articles/911042/
∗∗∗ Trellix ePolicy Orchestrator: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Trellix ePolicy Orchestrator ausnutzen, um Dateien zu manipulieren oder einen Cross-Site-Scripting-Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1700
∗∗∗ Vulnerability Spotlight: Multiple issues in Robustel R1510 cellular router could lead to code execution, denial of service ∗∗∗
---------------------------------------------
Cisco Talos recently discovered nine vulnerabilities in the Robustel R1510 industrial cellular router, several of which could allow an adversary to inject operating system code remotely.
---------------------------------------------
http://blog.talosintelligence.com/2022/10/vuln-spotlight-robustel-router.ht…
∗∗∗ Sonicwall: GMS File Path Manipulation ∗∗∗
---------------------------------------------
An unauthenticated attacker can gain access to web directory containing applications binaries and configuration files through file path manipulation vulnerability.
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0021
∗∗∗ Drupal: Twig Field Value - Moderately critical - Access bypass - SA-CONTRIB-2022-058 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-058
∗∗∗ Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
∗∗∗ Security Bulletin: Hortonworks DataFlow product has log messages vulnerable to arbitrary code execution, denial of service, and remote code execution due to Apache Log4j vulnerabilities [CVE-2021-44228], [CVE-2021-45105], and [CVE-2021-45046] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-hortonworks-dataflow-prod…
∗∗∗ Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2021-44832) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-…
∗∗∗ Security Bulletin: Vulnerabilities in Java affect IBM WIoTP MessageGateway (CVE-2021-213) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-java-a…
∗∗∗ Dell BIOS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1705
∗∗∗ Grafana: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1702
∗∗∗ Mitel MiVoice Connect: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1706
∗∗∗ Pulse Secure SA45520 - CVEs (CVE-2022-35254,CVE-2022-35258) may lead to DoS attack ∗∗∗
---------------------------------------------
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 11-10-2022 18:00 − Mittwoch 12-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Ein guter Tag für Freund:innen von Adobe Software und gepflegtem Patchen ∗∗∗
---------------------------------------------
Da kann man sich nicht beschweren: nicht nur eine kritische Lücke in Adobe Commerce und Magento Open Source (CVSS 10.0 - Highscore-verdächtig), sondern auch gleich deren mehrere in Adobe ColdFusion (unter Anderem 4x mit CVSS 9.8 und 1x mit 8.1). Nutzer:innen von Adobe Acrobat/Acrobat Reader kommen ebenfalls nicht zu kurz, auch wenn man dort dank Auto-Updates vielleicht nicht selbst so viel Spass mit dem Patchen hat. Und auch wenn ich nicht weiß, was (eine) Adobe Dimension ist: Admins haben dort 4x CVSS 7.8 - Freude.
---------------------------------------------
https://cert.at/de/blog/2022/10/ein-guter-tag-fur-freundinnen-von-adobe-sof…
∗∗∗ New npm timing attack could lead to supply chain attacks ∗∗∗
---------------------------------------------
Security researchers have discovered an npm timing attack that reveals the names of private packages so threat actors can release malicious clones publicly to trick developers into using them instead.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-npm-timing-attack-could-…
∗∗∗ Malicious WhatsApp mod distributed through legitimate apps ∗∗∗
---------------------------------------------
The malicious version of YoWhatsApp messenger, containing Triada trojan, was spreading through ads in the popular Snaptube app and the Vidmate apps internal store.
---------------------------------------------
https://securelist.com/malicious-whatsapp-mod-distributed-through-legitimat…
∗∗∗ Userland Execution of Binaries Directly from Python ∗∗∗
---------------------------------------------
TL;DR: If you are familiar with what a userland binary execution tool does and you just want to see the code and/or test it, skip the rest of this post and go to the project GitHubs page.
---------------------------------------------
https://www.anvilsecure.com/blog/userland-execution-of-binaries-directly-fr…
∗∗∗ A deep dive into CVE-2021–42847 - arbitrary file write and XXE in ManageEngine ADAudit Plus before 7006 ∗∗∗
---------------------------------------------
After coming across a vulnerable instance during a pentest, and discovering that no root cause analysis or PoC has ever been made available for this vulnerability, I decided to have a closer look myself.
---------------------------------------------
https://medium.com/@erik.wynter/pwning-manageengine-from-endpoint-to-exploi…
∗∗∗ Brute-Force-Angriffe: Microsoft rüstet Schutzmechanismus nach ∗∗∗
---------------------------------------------
Die Windows-Updates zum Oktober-Patchday haben auch eine neue Funktion mitgebracht. Sie sperrt lokale Administratorkonten bei fehlerhaften Log-in-Versuchen.
---------------------------------------------
https://heise.de/-7306276
∗∗∗ Abo-Falle bei der Wohnungssuche auf rentola.at ∗∗∗
---------------------------------------------
Sind Sie gerade auf Wohnungssuche? Dann nehmen Sie sich vor einem undurchsichtigen Abo-Vertrag auf rentola.at in Acht. Geworben wird mit unzähligen Wohnungen in ganz Österreich und auf der ganzen Welt. Für eine erste Nachricht an Vermieter:innen müssen Sie jedoch 1 Euro bezahlen. Ein versteckter Kostenhinweis verrät: Hier landen Sie in einem teuren Abonnement!
---------------------------------------------
https://www.watchlist-internet.at/news/abo-falle-bei-der-wohnungssuche-auf-…
∗∗∗ Qakbot Being Distributed as ISO Files Instead of Excel Macro ∗∗∗
---------------------------------------------
There is a recent increase in the distribution method of malware through ISO files. Among the malware, it has been identified that Qakbot, an online banking malware, has had its distribution method changed from Excel 4.0 Macro to ISO files.
---------------------------------------------
https://asec.ahnlab.com/en/39537/
∗∗∗ VMware vCenter Server bug disclosed last year still not patched ∗∗∗
---------------------------------------------
VMware informed customers today that vCenter Server 8.0 (the latest version) is still waiting for a patch to address a high-severity privilege escalation vulnerability disclosed in November 2021.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/vmware-vcenter-server-bug-di…
=====================
= Vulnerabilities =
=====================
∗∗∗ Kritische Sicherheitslücke in Magento Open Source und Adobe Commerce - Updates verfügbar ∗∗∗
---------------------------------------------
Adobe hat Updates für die E-Commerce Software Suites Magento Open Source und Adobe Commerce herausgegeben. CVE-Nummer(n): CVE-2022-35698 CVSS Base Score: 10.0. Angreifer:innen können beliebigen Code auf betroffenen Systemen ausführen (vermutlich mit den Rechten des Webservers), und haben Zugriff auf alle Daten die im E-Commerce System gespeichert sind.
---------------------------------------------
https://cert.at/de/warnungen/2022/10/kritische-sicherheitslucke-in-magento-…
∗∗∗ Microsoft Security Update Summary (11. Oktober 2022) ∗∗∗
---------------------------------------------
Am 11. Oktober 2022 hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office usw. – sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen 84 Schwachstellen …
---------------------------------------------
https://www.borncity.com/blog/2022/10/11/microsoft-security-update-summary-…
∗∗∗ Exchange Server Sicherheitsupdates (11. Oktober 2022) ∗∗∗
---------------------------------------------
Microsoft hat zum 11. Oktober 2022 Sicherheitsupdates für Exchange Server 2013, Exchange Server 2016 und Exchange Server 2019 veröffentlicht. Diese Updates sollen Schwachstellen, die von externen Sicherheitspartnern gemeldet oder durch Microsoft gefunden wurden, schließen. Die seit Ende September 2022 bekannten 0-day-Schwachstellen (ProxyNotShell) werden aber nicht beseitigt.
---------------------------------------------
https://www.borncity.com/blog/2022/10/12/exchange-server-sicherheitsupdates…
∗∗∗ IBM Security Bulletins 2022-10-11 ∗∗∗
---------------------------------------------
IBM Robotic Process Automation, IBM App Connect Enterprise, IBM Security Identity Management, IBM Security Guardium, IBM Cloud Pak, Rational Change, IBM Navigator Mobile Android, Rational Synergy.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Schneider Elecronic Security Advisories 2022-10-11 ∗∗∗
---------------------------------------------
4 new, 8 updated
---------------------------------------------
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.…
∗∗∗ Webbrowser: Google schließt sechs Sicherheitslücken in Chrome ∗∗∗
---------------------------------------------
Google hat ein Update für den Webbrowser Chrome veröffentlicht. Es schließt insgesamt sechs Sicherheitslücken, von denen ein hohes Risiko ausgeht.
---------------------------------------------
https://heise.de/-7305732
∗∗∗ Fortinet-Patchday: Mehrere kritische Lücken geschlossen ∗∗∗
---------------------------------------------
Nachdem am Wochenende eine kritische Sicherheitslücke in Fortinet-Produkten bekannt wurde, hat das Unternehmen nun weitere Updates bereitgestellt.
---------------------------------------------
https://heise.de/-7306400
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (mediawiki and twig), Oracle (expat, gnutls and nettle, and kernel), Red Hat (expat, kernel, and kpatch-patch), and Ubuntu (advancecomp and dotnet6).
---------------------------------------------
https://lwn.net/Articles/910953/
∗∗∗ Zoom Video Communications: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter oder lokalerAngreifer kann mehrere Schwachstellen in Zoom Video Communications Zoom Client und Zoom Video Communications On-Premise ausnutzen, um einen Denial of Service Angriff durchzuführen und Sicherheitsmaßnahmen zu umgehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1677
∗∗∗ LibreOffice: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in LibreOffice ausnutzen, um beliebigen Programmcode auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1679
∗∗∗ bingo!CMS vulnerable to authentication bypass ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN74592196/
∗∗∗ The installer of Sony Content Transfer may insecurely load Dynamic Link Libraries ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN40620121/
∗∗∗ VMSA-2022-0026 ∗∗∗
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0026.html
∗∗∗ WAGO: FTP-Server - Denial-of-Service ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-047/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 10-10-2022 18:00 − Dienstag 11-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Your Publicly Accessible Google API Key Could Be Giving Hackers Access to Your Files and Photos! ∗∗∗
---------------------------------------------
We’ve all seen them before, those long, seemingly random strings of characters starting with AIza. Yes, that’s right, the ubiquitous Google API key.
---------------------------------------------
https://spidersilk.com/news/your-publicly-accessible-google-api-key-could-b…
∗∗∗ Fortinet Confirms Zero-Day Vulnerability Exploited in One Attack ∗∗∗
---------------------------------------------
Fortinet has confirmed that the critical vulnerability whose existence came to light last week is a zero-day flaw that has been exploited in at least one attack.
---------------------------------------------
https://www.securityweek.com/fortinet-confirms-zero-day-vulnerability-explo…
∗∗∗ Siemens Not Ruling Out Future Attacks Exploiting Global Private Keys for PLC Hacking ∗∗∗
---------------------------------------------
Researchers have demonstrated that threat actors could obtain global private keys that protect some of Siemens’ industrial devices, and the vendor says it cannot rule out malicious exploitation in the future.
---------------------------------------------
https://www.securityweek.com/siemens-not-ruling-out-future-attacks-exploiti…
∗∗∗ Living off the Cloud. Cloudy with a Chance of Exfiltration ∗∗∗
---------------------------------------------
Unless default settings are changed, typical Office 365 (O365) licences come loaded with various services that are all usable by end users without special permissions. Power Automate can be used maliciously by compromised users or insider threats to systematically capture and exfiltrate data without having to contend with network safeguards.
---------------------------------------------
https://www.pentestpartners.com/security-blog/living-off-the-cloud-cloudy-w…
∗∗∗ Betrügerisches Jobangebot auf santo-vermoegen.com ∗∗∗
---------------------------------------------
Auf „santo-vermoegen.com/infofolder“ sind aktuell freie Stellen als „Back Office Mitarbeiter“ ausgeschrieben. Der Job ist auch auf diversen Jobportalen inseriert. Die Beschreibung der Tätigkeit ist vage. Es geht lediglich hervor, dass Sie auf Ihrem privaten Bankkonto Zahlungen empfangen, protokollieren und weiterleiten. Vorsicht: Dabei handelt es sich um Geldwäsche, Sie machen sich strafbar!
---------------------------------------------
https://www.watchlist-internet.at/news/betruegerisches-jobangebot-auf-santo…
∗∗∗ Exchange Server: Neue 0-day (nicht NotProxyShell, CVE-2022-41040, CVE-2022-41082) ∗∗∗
---------------------------------------------
AhnLabs schreibt, dass theoretisch die Möglichkeit besteht, dass die von dem vietnamesischen Sicherheitsunternehmen GTSC am 28. September offengelegten Schwachstellen von Microsoft Exchange Server(CVE-2022-41040, CVE-2022-41082) für die Infektion ausgenutzt wurden. Aber die Angriffsmethode, der generierte WebShell-Dateiname, und nachfolgende Angriffe nach der Installation der WebShell lassen vermuten, dass ein anderer Angreifer eine andere Zero-Day-Schwachstelle ausgenutzt hat.
---------------------------------------------
https://www.borncity.com/blog/2022/10/11/exchange-server-neue-0-day-nicht-n…
∗∗∗ Persistent PHP payloads in PNGs: How to inject PHP code in an image – and keep it there ! ∗∗∗
---------------------------------------------
During the assessment of a PHP application, we recently came across a file upload vulnerability allowing the interpretation of PHP code inserted into valid PNG files. However, the image processing performed by the application forced us to dig deeper into the different techniques available to inject PHP payloads into this particular file format - and to make it persist through image transformations.
---------------------------------------------
https://www.synacktiv.com/publications/persistent-php-payloads-in-pngs-how-…
=====================
= Vulnerabilities =
=====================
∗∗∗ Siemens Security Advisories ∗∗∗
---------------------------------------------
16 new, 11 updated
---------------------------------------------
https://new.siemens.com/global/en/products/services/cert.html?d=2022-10#Sec…
∗∗∗ IBM Security Bulletins 2022-10-10 ∗∗∗
---------------------------------------------
IBM Process Mining, z/Transaction Processing Facility, Content Manager OnDemand z/OS, IBM Sterling Connect.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Exchange Zero-Day-Lücke: Nochmals nachgebesserter Workaround ∗∗∗
---------------------------------------------
Microsoft bessert den Workaround für die Zero-Day-Lücke in Exchange noch mal nach. Admins bleibt nur zu hoffen, dass die jetzige Regel bis zum Update hält.
---------------------------------------------
https://heise.de/-7304522
∗∗∗ SAP-Patchday: 15 neue Sicherheitswarnungen im Oktober ∗∗∗
---------------------------------------------
Die von SAP zum Oktober-Patchday verfügbaren Updates schließen unter anderem zwei kritische Sicherheitslücken.
---------------------------------------------
https://heise.de/-7305149
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (connman, dbus, git, isc-dhcp, strongswan, and wordpress), Fedora (rubygem-pdfkit and seamonkey), Red Hat (gnutls, nettle, rh-ruby27-ruby, and rh-ruby30-ruby), SUSE (libgsasl, python, and snakeyaml), and Ubuntu (graphite2, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-raspi, linux, linux-aws, linux-bluefield, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux, linux-dell300x, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux-hwe, linux-oracle, openssh, and pcre3).
---------------------------------------------
https://lwn.net/Articles/910828/
∗∗∗ iOS 16.0.3 freigegeben ∗∗∗
---------------------------------------------
Apple hat zum 10. Oktober 2022 iOS 16.0.3 für neuere iPhone-Modelle freigegeben. Es handelt sich um ein Sicherheitsupdate, welches die Sicherheitslücke CVE-2022-22658 in Mail beseitigen soll.
---------------------------------------------
https://www.borncity.com/blog/2022/10/11/ios-16-0-3-freigegeben/
∗∗∗ OpenSSL Security Advisory [11 October 2022] ∗∗∗
---------------------------------------------
https://www.openssl.org/news/secadv/20221011.txt
∗∗∗ Xen Security Advisory CVE-2022-33749 / XSA-413 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-413.html
∗∗∗ Xen Security Advisory CVE-2022-33748 / XSA-411 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-411.html
∗∗∗ Xen Security Advisory CVE-2022-33746 / XSA-410 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-410.html
∗∗∗ Xen Security Advisory CVE-2022-33747 / XSA-409 ∗∗∗
---------------------------------------------
https://xenbits.xen.org/xsa/advisory-409.html
∗∗∗ PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-046/
∗∗∗ Hashicorp Vagrant: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1669
∗∗∗ Octopus Deploy: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1663
∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2022-33748 & CVE-2022-33749 ∗∗∗
---------------------------------------------
https://support.citrix.com/article/CTX465146/citrix-hypervisor-security-bul…
∗∗∗ Altair HyperView Player ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-284-01
∗∗∗ Daikin Holdings Singapore Pte Ltd. SVMPC1 and SVMPC2 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-284-02
∗∗∗ Sensormatic Electronics C-CURE 9000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-284-03
∗∗∗ Lenovo: IPV6 VLAN Stacking Vulnerability ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500520-IPV6-VLAN-STACKING-VULN…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 07-10-2022 18:00 − Montag 10-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Fake adult sites push data wipers disguised as ransomware ∗∗∗
---------------------------------------------
Malicious adult websites push fake ransomware which, in reality, acts as a wiper that quietly tries to delete almost all of the data on your device.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fake-adult-sites-push-data-w…
∗∗∗ Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server ∗∗∗
---------------------------------------------
A correction was made to the string in step 6 and step 9 in the URL Rewrite rule mitigation Option 3. Steps 8, 9, and 10 have updated images.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-z…
∗∗∗ That thing to help protect internet traffic from hijacking? Its broken ∗∗∗
---------------------------------------------
RPKI is supposed to verify network routes. Instead, heres how it could be subverted. An internet security mechanism called Resource Public Key Infrastructure (RPKI), intended to safeguard the routing of data traffic, is broken, according to security experts from Germanys ATHENE, the National Research Center for Applied Cybersecurity.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/10/09/internet_tra…
∗∗∗ Groupware: Kritische Codeschmuggel-Lücke in Zimbra wird angegriffen ∗∗∗
---------------------------------------------
Eine Sicherheitslücke in der Groupware Zimbra erlaubt Angreifern, Schadcode einzuschleusen. Die Schwachstelle wird inzwischen angegriffen. Ein Workaround hilft.
---------------------------------------------
https://heise.de/-7289104
∗∗∗ Intel-CPU "Alder Lake": BIOS-Quellcode-Leak öffnet potenzielle Einfallstore ∗∗∗
---------------------------------------------
Rund 6 GByte BIOS-Daten für die CPU-Generation Core i-12000 sind Intel abhandengekommen. Darin enthalten ist Code für Sicherheitsmechanismen wie Boot Guard.
---------------------------------------------
https://heise.de/-7289262
∗∗∗ How to protect your Firefox saved passwords with a Primary Password ∗∗∗
---------------------------------------------
For better security, dont rely on browser syncing to manage your passwords. Heres a better way.
---------------------------------------------
https://www.zdnet.com/article/how-to-protect-your-firefox-saved-passwords-w…
=====================
= Vulnerabilities =
=====================
∗∗∗ Kritische Sicherheitslücke in Fortinet Produkten - Updates verfügbar ∗∗∗
---------------------------------------------
Kritische Schwachstellen in Fortinet Produkten erlauben es Angreifenden, die Authentisierung zu umgehen und Aktionen mit Admin-Rechten auszuführen. CVE-Nummer(n): CVE-2022-40684 CVSS Base Score: 9.6.
---------------------------------------------
https://cert.at/de/warnungen/2022/10/kritische-sicherheitslucken-in-fortine…
∗∗∗ IBM Security Bulletins 2022-10-07 and 2022-10-08 ∗∗∗
---------------------------------------------
IBM Partner Engagement Manager, IBM CICS TX Standard, IBM CICS TX Advanced, IBM Cloud, IBM Business Automation Workflow, IBM Security Verify Governance, IBM TXSeries, IBM Security Network Threat Analytics, IBM Security Verify Governance, IBM Jazz.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (knot-resolver and libpgjava), Fedora (booth, dotnet3.1, expat, nheko, php-twig, php-twig2, php-twig3, poppler, python-joblib, and seamonkey), Mageia (colord, dbus, enlightenment, kitty, libvncserver, php, python3, and unbound), Slackware (libksba), SUSE (cyrus-sasl, ImageMagick, and xmlgraphics-commons), and Ubuntu (nginx and thunderbird).
---------------------------------------------
https://lwn.net/Articles/910724/
∗∗∗ Critical Remote Code Execution Vulnerability Found in vm2 Sandbox Library ∗∗∗
---------------------------------------------
A critical vulnerability in vm2 may allow a remote attacker to escape the sandbox and execute arbitrary code on the host. A highly popular JavaScript sandbox library with more than 16 million monthly downloads, vm2 supports the execution of untrusted code synchronously in a single process.
---------------------------------------------
https://www.securityweek.com/critical-remote-code-execution-vulnerability-f…
∗∗∗ MISP 2.4.164 released with new tag relationship feature, improvements and a security fix ∗∗∗
---------------------------------------------
We are pleased to announce the immediate availability of MISP v2.4.164 with a new tag relationship features, many improvements and a security fix.
---------------------------------------------
https://www.misp-project.org/2022/10/10/MISP.2.4.164.released.html/
∗∗∗ Trend Micro Apex One: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein lokaler oder entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Trend Micro Apex One ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1649
∗∗∗ ZDI-22-1399: Centreon Poller Broker SQL Injection Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1399/
∗∗∗ ZDI-22-1398: Centreon Contact Group SQL Injection Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1398/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 06-10-2022 18:00 − Freitag 07-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Powershell Backdoor with DGA Capability, (Fri, Oct 7th) ∗∗∗
---------------------------------------------
DGA ("Domain Generation Algorithm") is a popular tactic used by malware to make connections with their C2 more stealthy and difficult to block. The idea is to generate domain names periodically and use them during the defined period. An alternative is to generate a lot of domains and loop across them to find an available C2 server. Attackers just register a few domain names and can change them very quickly.
---------------------------------------------
https://isc.sans.edu/diary/rss/29122
∗∗∗ What is a Malware Attack? ∗∗∗
---------------------------------------------
A malware attack is the act of injecting malicious software to infiltrate and execute unauthorized commands within a victim’s system without their knowledge or authorization. The objectives of such an attack can vary – from stealing client information to sell as lead sources, obtaining system information for personal gain, bringing a site down to stop business or even just placing the mark of a cyber-criminal on a public domain.
---------------------------------------------
https://blog.sucuri.net/2022/10/what-is-a-malware-attack.html
∗∗∗ Loads of PostgreSQL systems are sitting on the internet without SSL encryption ∗∗∗
---------------------------------------------
They probably shouldnt be connected in the first place, says database expert. Only a third of PostgreSQL databases connected to the internet use SSL for encrypted messaging, according to a cloud database provider.
---------------------------------------------
https://www.theregister.com/2022/10/07/postgresql_no_ssl/
∗∗∗ Top CVEs Actively Exploited By [..] State-Sponsored Cyber Actors ∗∗∗
---------------------------------------------
This joint Cybersecurity Advisory (CSA) provides the top Common Vulnerabilities and Exposures (CVEs) used since 2020 by [..] state-sponsored cyber actors as assessed by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI).
---------------------------------------------
https://www.cisa.gov/uscert/ncas/alerts/aa22-279a
∗∗∗ So schützen Sie sich vor Kleinanzeigen-Betrug ∗∗∗
---------------------------------------------
Egal ob Sie kaufen oder verkaufen: Schützen Sie sich auf Kleinanzeigen-Plattformen wie Willhaben, ebay, Vinted und Co. vor Kriminellen. Mit Fake-Profilen, gefälschten Zahlungsbestätigungen oder unechten Zahlungsplattformen zocken Kriminelle immer wieder Nutzer:innen ab. Wir geben Ihnen Tipps zum sicheren Kaufen und Verkaufen.
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-kleinanzei…
∗∗∗ Exchange Hacks: Achtung, gut gemachte, bösartige Mails im Umlauf (7. Oktober 2022) ∗∗∗
---------------------------------------------
Die Woche wurden Administratoren von Exchange-Servern ja durch die Ende September 2022 bekannt gewordene 0-day-Schwachstellen und die Workarounds von Microsoft ziemlich gefordert. Inzwischen versuchen Cyber-Kriminelle aus dieser Situation Kapital zu schlagen.
---------------------------------------------
https://www.borncity.com/blog/2022/10/07/exchange-hacks-achtung-gut-gemacht…
=====================
= Vulnerabilities =
=====================
∗∗∗ Remote Code Execution in Zimbra Collaboration Suite - Workaround verfügbar ∗∗∗
---------------------------------------------
Eine kritische Schwachstelle in Zimbra Collaboration Suite erlaubt potentiell entfernten, unauthorisierten Angreifer:innen das Ausführen von beliebigem Code. Laut diversen Berichten wird diese Schwachstelle bereits aktiv ausgenutzt. Das Ausnützen der Schwachstelle durch senden einer Email mit speziell präparierten Anhängen in den Formaten .cpio, .tar, .rpm kann zu einer vollständigen Kompromittierung des Systems führen.
---------------------------------------------
https://cert.at/de/warnungen/2022/10/remote-code-execution-in-zimbra-collab…
∗∗∗ Fortinet warns admins to patch critical auth bypass bug immediately ∗∗∗
---------------------------------------------
Fortinet has warned administrators to update FortiGate firewalls and FortiProxy web proxies to the latest versions, which address a critical severity vulnerability.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fortinet-warns-admins-to-pat…
∗∗∗ Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes ∗∗∗
---------------------------------------------
An attacker may trivially bypass the use of InetAddress::getAllByName to validate inputs. Note: As input validation is not an appropriate mechanism to protect against injection attacks — as opposed to output encoding and Harvard architecture-style APIs — this issue is itself considered to be of Low risk as code relying on the documented validation for such purposes should be considered insecure regardless of this issue.
---------------------------------------------
https://research.nccgroup.com/2022/10/06/technical-advisory-openjdk-weak-pa…
∗∗∗ Angreifer könnten Cisco-Admins manipulierte Updates unterschieben ∗∗∗
---------------------------------------------
Es sind wichtige Sicherheitsupdates für unter anderem Cisco Expressway Series und TelePresence Video Communication Server erschienen.
---------------------------------------------
https://heise.de/-7286880
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (dbus, isc-dhcp, and strongswan), Fedora (booth, php, php-twig, php-twig2, and php-twig3), Oracle (expat, prometheus-jmx-exporter, and squid), Red Hat (expat, openvswitch2.11, and squid), Scientific Linux (expat and squid), SUSE (exiv2, LibVNCServer, postgresql-jdbc, protobuf, python-PyJWT, python3, slurm, squid, and webkit2gtk3), and Ubuntu (libreoffice).
---------------------------------------------
https://lwn.net/Articles/910606/
∗∗∗ VMware Patches Code Execution Vulnerability in vCenter Server ∗∗∗
---------------------------------------------
Virtualization giant VMware on Thursday announced patches for a vCenter Server vulnerability that could lead to arbitrary code execution. A centralized management utility, the vCenter Server is used for controlling virtual machines and ESXi hosts, along with their dependent components. Tracked as CVE-2022-31680 (CVSS score of 7.2), the security bug is described as an unsafe deserialization vulnerability in the platform services controller (PSC).
---------------------------------------------
https://www.securityweek.com/vmware-patches-code-execution-vulnerability-vc…
∗∗∗ Growi vulnerable to improper access control ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN00845253/
∗∗∗ IPFire WebUI vulnerable to cross-site scripting ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN15411362/
∗∗∗ Security Bulletin: IBM InfoSphere Information Server Low Level Authenticated User Can View Higher Level User And Group Listing (CVE-2022-36772) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio…
∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2022-21824) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea…
∗∗∗ Security Bulletin: IBM InfoSphere Information Server is affected by a session management vulnerability (CVE-2022-41291) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio…
∗∗∗ Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-qradar-analy…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Browser User Interface vulnerable to multiple issues due to IBM Runtime Environment Java ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Nagios Enterprises Nagios XI: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1638
∗∗∗ Avaya Aura Application Enablement Services: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1645
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 05-10-2022 18:00 − Donnerstag 06-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Ikea Smart Light System Flaw Lets Attackers Turn Bulbs on Full Blast ∗∗∗
---------------------------------------------
With just one malformed Zigbee frame, attackers could take over certain Ikea smart lightbulbs, leaving users unable to turn the lights down.
---------------------------------------------
https://www.darkreading.com/application-security/ikea-smart-light-system-fl…
∗∗∗ Ransomware: Sicherheitssoftware mit legitimem Treiber deaktiviert ∗∗∗
---------------------------------------------
Die Ransomware Blackbyte nutzt die Angriffstechnik Bring your own vulnerable Driver, um Antivirensoftware zu deaktivieren.
---------------------------------------------
https://www.golem.de/news/ransomware-sicherheitssoftware-mit-legitimem-trei…
∗∗∗ A look at the 2020–2022 ATM/PoS malware landscape ∗∗∗
---------------------------------------------
We looked at the number of affected ATMs and PoS terminals, geography of attacks and threat families used by cybercriminals to target victims in 2020-2022.
---------------------------------------------
https://securelist.com/atm-pos-malware-landscape-2020-2022/107656/
∗∗∗ Detecting and preventing LSASS credential dumping attacks ∗∗∗
---------------------------------------------
In this blog, we share examples of various threat actors that we’ve recently observed using the LSASS credential dumping technique. [..] Finally, we offer additional recommendations to further harden systems and prevent attackers from taking advantage of possible misconfigurations should they fail to leverage credential dumping.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/10/05/detecting-and-preventing…
∗∗∗ MSSQL, meet Maggie ∗∗∗
---------------------------------------------
Continuing our monitoring of signed binaries, DCSO CyTec recently found a novel backdoor malware targeting Microsoft SQL servers. [Keine kompromittierten Systeme in AT angeführt, Anm. d. Red.]
---------------------------------------------
https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01
∗∗∗ CVE-2022–36635 — A SQL Injection in ZKSecurityBio to RCE ∗∗∗
---------------------------------------------
This is a write-up of CVE-2022–36635: SQLInjection found in a platform of physical security (access control, elevator control, guest management, patrol and parking management) called ZKSecurity Bio v4.1.3 and how it was used to obtain a RCE.
---------------------------------------------
https://medium.com/stolabs/cve-2022-36635-a-sql-injection-in-zksecuritybio-…
∗∗∗ Exchange Zero-Day: Microsoft bessert Workaround erneut nach ∗∗∗
---------------------------------------------
Nachdem der erste Workaround für eine Exchange Zero-Day-Lücke wirkungslos war und Microsoft nachbesserte, hat der Hersteller abermals eine Korrektur vorgelegt.
---------------------------------------------
https://heise.de/-7285558
∗∗∗ Gratis Entschlüsselungstool: Lücke in Ransomwares der Hades-Familie entdeckt ∗∗∗
---------------------------------------------
Opfer einiger Erpressungstrojan der der Hades-Familie wie MafiaWare666 können unter bestimmten Voraussetzungen wieder auf ihre Daten zugreifen.
---------------------------------------------
https://heise.de/-7285784
∗∗∗ Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style ∗∗∗
---------------------------------------------
Hidden DNS resolvers and how to compromise your infrastructure
---------------------------------------------
https://sec-consult.com/blog/detail/melting-the-dns-iceberg-taking-over-you…
∗∗∗ ESET Threat Report T2 2022 ∗∗∗
---------------------------------------------
Ein Blick auf die Bedrohungslandschaft im zweiten Drittel des Jahres 2022 aus Sicht der ESET-Telemetrie und aus der Perspektive der ESET-Experten.
---------------------------------------------
https://www.welivesecurity.com/deutsch/2022/10/05/eset-threat-report-t2-202…
=====================
= Vulnerabilities =
=====================
∗∗∗ CVE-2022-41343 - RCE via Phar Deserialisation (Dompdf) ∗∗∗
---------------------------------------------
Dompdf is a popular library in PHP used for rendering PDF files from HTML. Tanto Security disclosed a vulnerability in Dompdf affecting version 2.0.0 and below. The vulnerability was patched in Dompdf v2.0.1. We recommend all Dompdf users update to the latest version as soon as possible.
---------------------------------------------
https://tantosec.com/blog/cve-2022-41343/
∗∗∗ Cisco Security Advisories 2022-10-05 ∗∗∗
---------------------------------------------
Cisco published 9 Security Advisories (2 High, 7 Medium Severity)
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first…
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (bind9 and nodejs), Red Hat (prometheus-jmx-exporter and squid), Slackware (dhcp), SUSE (pngcheck and sendmail), and Ubuntu (isc-dhcp, kitty, and linux-gcp-5.4).
---------------------------------------------
https://lwn.net/Articles/910492/
∗∗∗ Internet Systems Consortium DHCP: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Internet Systems Consortium DHCP ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1634
∗∗∗ Security Bulletin: IBM Cloud Pak for Business Automation is affected but not classified as vulnerable by a remote code execution in Spring Framework [CVE-2022-22965] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-busines…
∗∗∗ Security Bulletin: IBM QRadar DNS Analyzer App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities (CVE-2022-31129, CVE-2022-24785, CVE-2017-18214) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-dns-analyzer-a…
∗∗∗ Security Bulletin: IBM Planning Analytics Workspace is affected by multiple vulnerabilities (CVE-2021-40690, CVE-2022-25647, XFID: 233967) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-planning-analytics-wo…
∗∗∗ Security Bulletin: IBM HTTP Server is vulnerable to arbitrary code execution due to Expat (CVE-2022-40674) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-http-server-is-vulner…
∗∗∗ K10812540: OpenJDK vulnerability CVE-2019-18197 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K10812540?utm_source=f5support&utm_mediu…
∗∗∗ Rockwell Automation FactoryTalk VantagePoint ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-279-01
∗∗∗ HIWIN Robot System Software (HRSS) ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-279-02
∗∗∗ Schwachstelle in SPRECON-V460 Visualisierungssoftware ∗∗∗
---------------------------------------------
https://www.sprecher-automation.com/it-sicherheit/security-alerts
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 04-10-2022 18:00 − Mittwoch 05-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Exchange Zero-Day: Microsoft korrigiert Workaround ∗∗∗
---------------------------------------------
Der zuerst vorgeschlagene Workaround für die Zero-Day-Lücke ProxyNotShell in Exchange ließ sich einfach umgehen. Microsoft liefert eine korrigierte Fassung.
---------------------------------------------
https://heise.de/-7284241
∗∗∗ Ende von Basic Auth: Brute-Force-Angriffe auf Microsoft Exchange nehmen zu ∗∗∗
---------------------------------------------
Microsoft berichtet von vielen Angriffen auf E-Mail-Konten, die noch die einfache Authentifizierung nutzen. Kunden sollen rasch handeln.
---------------------------------------------
https://www.golem.de/news/ende-von-basic-auth-brute-force-angriffe-auf-micr…
∗∗∗ Post-Exploitation Persistent Email Forwarder in Outlook Desktop ∗∗∗
---------------------------------------------
There is an exploitation method that can automatically forward emails CC’d to external addresses via an Outlook Desktop rule, even when this action is prevented on the corporate Exchange server.
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/post-exploi…
∗∗∗ GandCrab bedroht Deutschland ∗∗∗
---------------------------------------------
Die Ransomware GandCrab dominiert in Deutschland, Österreich und der Schweiz die ESET Erkennungsstatistiken. Nahezu jeder vierte Ransomware-Fund geht auf GandCrab zurück.
---------------------------------------------
https://www.zdnet.de/88403902/gandcrab-bedroht-deutschland/
∗∗∗ Vorsicht vor Blackout-Shops wie dyn-amo.de und dynamos.at! ∗∗∗
---------------------------------------------
Immer wieder wird aktuell von der Möglichkeit kurzzeitiger Blackouts, also großflächiger Strom-, Internet- oder Heizungsausfälle berichtet. Unseriöse Online-Shops wie jene von ECOM4YOU, HAPPY SHOPPING oder Shopfactory24 GmbH bauen auf die Ängste ihrer Kundinnen und Kunden und bieten Notfall-Sets für Blackouts an. Vorsicht, wir haben es getestet: Die Produkte sind überteuert, die Lieferzeiten lang, die Qualität teils minderwertig und [...]
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-blackout-shops-wie-dyn-…
∗∗∗ Shadowserver Alliance Launch ∗∗∗
---------------------------------------------
The Shadowserver Foundation today launched its new Alliance to Continue to Build a Safer, More Secure Internet. The new Shadowserver Alliance partner program will accelerate growth and scale up delivery of no cost cybersecurity and cyber threat intelligence services to internet defender organizations and law enforcement. The Alliance represents a significant expansion to Shadowservers freely provided internet security services and enables partners, [...]
---------------------------------------------
https://www.shadowserver.org/news/shadowserver-alliance-launch/
∗∗∗ Credential Harvesting with Telegram API, (Tue, Oct 4th) ∗∗∗
---------------------------------------------
Phishing emails are a daily occurrence and many times it ends with credential harvesting. An email initially lures a user to a website that promised an anticipated file. The landing page taunts a user to click on an additional link and enter their credentials. In this case, the credentials entered by the user are not sent back to the bad actor using a simple web form but using the Telegram API [1].
---------------------------------------------
https://isc.sans.edu/diary/rss/29112
∗∗∗ How to Secure & Harden Your Joomla! Website in 12 Steps ∗∗∗
---------------------------------------------
At Sucuri, we’re often asked how website owners and webmasters can secure their websites. However, advice can often be too broad; different content management systems (CMS) exist in this ecosystem and each require a unique security configuration.
---------------------------------------------
https://blog.sucuri.net/2022/10/how-to-secure-harden-your-joomla-website-in…
∗∗∗ Securing Developer Tools: A New Supply Chain Attack on PHP ∗∗∗
---------------------------------------------
Supply chain attacks are a hot topic for development organizations today. Last year, in the largest ever software supply chain attack, a backdoor infected 18,000 SolarWinds customers. Earlier this year, a security researcher was able to breach Apple, Microsoft, Paypal, and other tech giants using a new supply chain attack technique.
---------------------------------------------
https://blog.sonarsource.com/securing-developer-tools-a-new-supply-chain-at…
∗∗∗ Our Fox-IT Dissect framework for forensic data collection, now open source ∗∗∗
---------------------------------------------
Dissect is a framework for collecting and analysing large amounts of forensic data. A game changer in cyber incident response, it enables data acquisition on thousands of systems within hours, regardless of the nature and size of the IT environment to be investigated after an attack.
---------------------------------------------
https://www.mynewsdesk.com/nccgroup/pressreleases/our-fox-it-dissect-framew…
∗∗∗ Change in Magniber Ransomware (*.js → *.wsf) – September 28th ∗∗∗
---------------------------------------------
The ASEC analysis team has explained through the blog post on September 8th that the Magniber ransomware has changed from having a CPL extension to a JSE extension. The attacker made another change after September 8th, changing the file extension from JSE to JS on September 16th. And on September 28th, the attacker changed the distribution method once again, changing the file extension from JS to WSF. It seems the attacker is continuously distributing variations to bypass various detection [...]
---------------------------------------------
https://asec.ahnlab.com/en/39489/
∗∗∗ How Water Labbu Exploits Electron-Based Applications ∗∗∗
---------------------------------------------
In the second part of our Water Labbu blog series, we explore how the threat actor exploits Electron-based applications using Cobalt Strike to deploy backdoors.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/j/how-water-labbu-exploits-ele…
=====================
= Vulnerabilities =
=====================
∗∗∗ Patchday: Angreifer könnten ihre Rechte unter Android 10 bis 13 hochstufen ∗∗∗
---------------------------------------------
Wichtige Sicherheitsupdates schließen zum Teil kritische Lücken in verschiedenen Android-Versionen.
---------------------------------------------
https://heise.de/-7284409
∗∗∗ Aruba: Kritische Sicherheitslücke in Access Points ∗∗∗
---------------------------------------------
Aruba warnt vor kritischen Sicherheitslücken in den eigenen Access Points.
---------------------------------------------
https://heise.de/-7284335
∗∗∗ IBM Security Bulletins 2022-10-04 ∗∗∗
---------------------------------------------
IBM Tivoli Netcool Impact, IBM Tivoli Business Service Manage, IBM Tivoli Monitoring, IBM WebSphere Application Server Liberty, IBM QRadar SIEM, IBM Security Guardium, Rational Business Developer, IBM Cloud Pak for Watson, IBM i Modernization Engine, IBM CICS TX Advanced, IBM Planning Analytics Workspace, IBM Security Guardium.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (barbican, mediawiki, and php-twig), Fedora (bash, chromium, lighttpd, postgresql-jdbc, and scala), Mageia (bash, chromium-browser-stable, and golang), Oracle (bind, bind9.16, and squid:4), Red Hat (bind, bind9.16, RHSSO, and squid:4), Scientific Linux (bind), SUSE (cifs-utils, libjpeg-turbo, nodejs14, and nodejs16), and Ubuntu (jackd2, linux-gke, and linux-intel-iotg).
---------------------------------------------
https://lwn.net/Articles/910395/
∗∗∗ SA45476 - Client Side Desync Attack (Informational) ∗∗∗
---------------------------------------------
The deprecated Pulse Collaboration feature is vulnerable to Client-Side Desync attacks on versions of PCS 9.1R15 and below.
---------------------------------------------
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-D…
∗∗∗ OpenSSH: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1621
∗∗∗ Keycloak: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1624
∗∗∗ Octopus Deploy: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1625
∗∗∗ Matomo: Schwachstellen ermöglichen Cross-Site Scripting ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1626
∗∗∗ BD Totalys MultiProcessor ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsma-22-277-01
∗∗∗ Johnson Controls Metasys ADX Server ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-277-01
∗∗∗ Hitachi Energy Modular Switchgear Monitoring (MSM) ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-277-02
∗∗∗ Horner Automation Cscape ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-277-03
∗∗∗ OMRON CX-Programmer ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-277-04
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 03-10-2022 18:00 − Dienstag 04-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Live support service hacked to spread malware in supply chain attack ∗∗∗
---------------------------------------------
The official installer for the Comm100 Live Chat application, a widely deployed SaaS (software-as-a-service) that businesses use for customer communication and website visitors, was trojanized as part of a new supply-chain attack.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/live-support-service-hacked-…
∗∗∗ Fake Microsoft Exchange ProxyNotShell exploits for sale on GitHub ∗∗∗
---------------------------------------------
Scammers are impersonating security researchers to sell fake proof-of-concept ProxyNotShell exploits for newly discovered Microsoft Exchange zero-day vulnerabilities.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fake-microsoft-exchange-prox…
∗∗∗ OnionPoison: infected Tor Browser installer distributed through popular YouTube channel ∗∗∗
---------------------------------------------
Kaspersky researchers detected OnionPoison campaign: malicious Tor Browser installer spreading through a popular YouTube channel and targeting Chinese users.
---------------------------------------------
https://securelist.com/onionpoison-infected-tor-browser-installer-youtube/1…
∗∗∗ CISA verdonnert US-Behörden zu besserer Netzwerkkontrolle ∗∗∗
---------------------------------------------
Die US-Cybersicherheitsbehörde CISA hat eine verbindliche Direktive erlassen. Nach der müssen alle Bundesbehörden ihre Netzwerke regelmäßig untersuchen.
---------------------------------------------
https://heise.de/-7283699
∗∗∗ Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices ∗∗∗
---------------------------------------------
NXP’s HABv4 API documentation references a now-mitigated defect in ROM-resident High Assurance Boot (HAB) functionality present in devices with HAB version < 4.3.7. I could find no further public documentation on whether this constituted a vulnerability or an otherwise “uninteresting” errata item, so I analyzed it myself!
---------------------------------------------
https://research.nccgroup.com/2022/10/03/shining-new-light-on-an-old-rom-vu…
∗∗∗ Mit tragbaren Heizgeräten Strom sparen? Fallen Sie nicht auf dieses Fake-Produkt herein! ∗∗∗
---------------------------------------------
Online-Shops wie ultraheatpro.com und valty-heater.com bewerben aktuell einen Stecker, der Räume in weniger als 2 Minuten aufheizt. Die sehr kleinen und kabellosen Heizgeräte verbrauchen angeblich kaum Strom, reduzieren Heizkosten und verursachen keinen Lärm. Beim Kauf dieser „Wundergeräte“ verschwenden Sie aber Ihr Geld, denn Sie bekommen, wenn überhaupt, ein funktionsloses Gerät zugesendet.
---------------------------------------------
https://www.watchlist-internet.at/news/mit-tragbaren-heizgeraeten-strom-spa…
∗∗∗ Developer account body snatchers pose risks to the software supply chain ∗∗∗
---------------------------------------------
Over the past several years, high-profile software supply chain attacks have increased in frequency. These attacks can be difficult to detect and source code repositories became a key focus of this research. Developer account takeovers present a substantial risk to the software supply chain because attackers who successfully compromise a developer account could conceal malicious code in software packages used by others.
---------------------------------------------
http://blog.talosintelligence.com/2022/10/developer-account-body-snatchers-…
∗∗∗ Tracking Earth Aughisky’s Malware and Changes ∗∗∗
---------------------------------------------
For over 10 years, security researchers have been observing and keeping tabs of APT group Earth Aughisky’s malware families and the connections, including previously documented malware that have yet to be attributed.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/j/tracking-earth-aughiskys-mal…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-10-03 ∗∗∗
---------------------------------------------
IBM Robotic Process Automation, IBM WebSphere Application Server Liberty, IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize, IBM FlashSystem, Content Manager OnDemand z/OS, IBM Spectrum Copy Data Management, CloudPak for Watson AIOPs, IBM MaaS360, Tivoli Netcool/OMNIbus WebGUI, CP4D Match 360.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (barbican), Fedora (libdxfrw, librecad, and python-oauthlib), Oracle (bind), Red Hat (bind and rh-python38-python), SUSE (bind, chromium, colord, libcroco, libgit2, lighttpd, nodejs12, python, python3, slurm, slurm_20_02, and webkit2gtk3), and Ubuntu (linux-azure, python-django, strongswan, and wayland).
---------------------------------------------
https://lwn.net/Articles/910300/
∗∗∗ Aruba ArubaOS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in Aruba ArubaOS ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand herbeizuführen und einen Cross-Site-Scripting-Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1606
∗∗∗ MediaWiki: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1604
∗∗∗ Hitachi Storage: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hitachi Storage ausnutzen, um seine Privilegien zu erhöhen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1601
∗∗∗ FasterXML Jackson: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1608
∗∗∗ Netgate pfSense: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Netgate pfSense ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1609
∗∗∗ Android-Sicherheitsbulletin – Oktober 2022 ∗∗∗
---------------------------------------------
https://source.android.com/docs/security/bulletin/2022-10-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 30-09-2022 18:00 − Montag 03-10-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server ∗∗∗
---------------------------------------------
October 2, 2022 updates: Added to the Mitigations section: we strongly recommend Exchange Server customers to disable remote PowerShell access for non-admin users in your organization. Guidance on how to do this for single user or multiple users is here. Updated Detection section to refer to Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and [...]
---------------------------------------------
https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-z…
∗∗∗ Analyzing attacks using the Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082 ∗∗∗
---------------------------------------------
MSTIC observed activity related to a single activity group in August 2022 that achieved initial access and compromised Exchange servers by chaining CVE-2022-41040 and CVE-2022-41082 in a small number of targeted attacks.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-…
∗∗∗ Achtung, Phishing boomt! Security-Checkliste zu den 6 meist verbreiteten Methoden ∗∗∗
---------------------------------------------
Dass Phishing derzeit besonders häufig von Cyberkriminellen eingesetzt wird, um in IT-Systeme einzudringen, belegen viele aktuelle Statistiken.
---------------------------------------------
https://sec-consult.com/de/blog/detail/6-common-types-of-phishing-attacks/
∗∗∗ Sicherheitsupdate Drupal: Angreifer könnten auf Zugangsdaten zugreifen ∗∗∗
---------------------------------------------
Es gibt ein wichtiges Sicherheitsupdate für das Content Management System Drupal.
---------------------------------------------
https://heise.de/-7282401
∗∗∗ Jetzt patchen! Attacken auf Atlassian Bitbucket Server ∗∗∗
---------------------------------------------
Sicherheitsforscher und eine US-Sicherheitsbehörde warnen davor, dass Angreifer Bitbucket Server im Visier haben.
---------------------------------------------
https://heise.de/-7282369
∗∗∗ Backdoor in Windows-Logo versteckt ∗∗∗
---------------------------------------------
Eine Hackergruppe hat bei Angriffen auf Regierungen Steganografie verwendet, um Schadsoftware über harmlos aussehende Bitmaps nachzuladen.
---------------------------------------------
https://heise.de/-7282730
∗∗∗ Fake-Shops fälschen Klarna-Zahlungsprozess ∗∗∗
---------------------------------------------
Die Online-Shops schmitt-drogerie.com und ohnesorge-fachhandel.com sind betrügerisch. Produkte, die Sie hier bestellen, werden nicht geliefert. Die Bezahlung erfolgt angeblich per „Klarna Sofortüberweisung“. Doch Vorsicht: Der Zahlungsprozess wurde gefälscht. Sie sind nicht auf der echten Klarna-Zahlungsseite, sondern auf einer nachgebauten Website, mit der Ihre Bankdaten gestohlen werden.
---------------------------------------------
https://www.watchlist-internet.at/news/fake-shops-faelschen-klarna-zahlungs…
∗∗∗ 11 old software bugs that took way too long to squash ∗∗∗
---------------------------------------------
In 2021, a vulnerability was revealed in a system that lay at the foundation of modern computing. An attacker could force the system to execute arbitrary code. Shockingly, the vulnerable code was almost 54 years old—and there was no patch available, and no expectation that one would be forthcoming. Fortunately, thats because the system in question was Marvin Minskys 1967 implementation of a Universal Turing Machine, [...]
---------------------------------------------
https://www.csoonline.com/article/3620948/10-old-software-bugs-that-took-wa…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-09-30 ∗∗∗
---------------------------------------------
IBM MQ, IBM Tivoli Monitoring Basic Services, IBM Event Streams, The IBM® Engineering Requirements Management, Rational Change Fix Pack, BM Tivoli Monitoring Data Provider, IBM Virtualization Engine, IBM Content Manager OnDemand, IBM Security Identity Governance and Intelligence, IBM Robotic Process Automation, IBM Jazz Technology, IBM Tivoli Composite Application Manager, IBM Case Manager, IBM Cloud Pak for Business Automation, Rational Synergy.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ macOS: Apps können Festplattenvollzugriff des Terminals missbrauchen ∗∗∗
---------------------------------------------
Programme, die nicht in einer Sandbox laufen, können den Systemschutz TCC von macOS umgehen, sobald man dem Terminal Festplattenvollzugriff gestattet.
---------------------------------------------
https://heise.de/-7282104
∗∗∗ Thunderbird: Angreifer könnten Absender verschlüsselter Nachrichten fälschen ∗∗∗
---------------------------------------------
Sicherheitslücken im Matrix-Chat-SDK machen den Mail-Client Thunderbird verwundbar. Eine aktualisierte Version schafft Abhilfe.
---------------------------------------------
https://heise.de/-7282339
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, gdal, kernel, libdatetime-timezone-perl, libhttp-daemon-perl, lighttpd, mariadb-10.3, node-thenify, snakeyaml, tinyxml, and tzdata), Fedora (enlightenment, kitty, and thunderbird), Mageia (expat, firejail, libjpeg, nodejs, perl-HTTP-Daemon, python-mako, squid, and thunderbird), Scientific Linux (firefox and thunderbird), SUSE (buildah, connman, cosign, expat, ImageMagick, python36, python39, slurm, and webkit2gtk3), and Ubuntu (linux, [...]
---------------------------------------------
https://lwn.net/Articles/910161/
∗∗∗ K21600298: OpenSSL vulnerabilities CVE-2022-1292 and CVE-2022-2068 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K21600298?utm_source=f5support&utm_mediu…
∗∗∗ Update - 0-day Exploit Remote Code Execution in Microsoft Exchange On-Premise – Workaround verfügbar ∗∗∗
---------------------------------------------
https://cert.at/de/warnungen/2022/10/0-day-exploit-remote-code-execution-in…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 29-09-2022 18:00 − Freitag 30-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Zero-Day-Attacken auf Microsoft Exchange Server – Sicherheitspatches fehlen ∗∗∗
---------------------------------------------
Aufgrund von Angriffen und bislang fehlenden Patches sollten Admins Exchange Server über einen Workaround absichern.
---------------------------------------------
https://heise.de/-7280460
∗∗∗ Microsoft warnt: Angriffe mit Linkedin und präparierter Open-Source-Software ∗∗∗
---------------------------------------------
Laut Microsoft führen staatliche Hacker derzeit Angriffe auf Linkedin durch. Dabei arbeiten sie mit um Schadfunktionen erweiterter Open-Source-Software.
---------------------------------------------
https://www.golem.de/news/microsoft-warnt-angriffe-mit-linkedin-und-praepar…
∗∗∗ Hacking group hides backdoor malware inside Windows logo image ∗∗∗
---------------------------------------------
Security researchers have discovered a malicious campaign by the Witchetty hacking group, which uses steganography to hide a backdoor malware in a Windows logo.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hacking-group-hides-backdoor…
∗∗∗ Detecting Mimikatz with Busylight ∗∗∗
---------------------------------------------
In 2015 Raphael Mudge released an article [1] that detailed that versions of mimikatz released after 8th of October, 2015 had a new module that was utilising certain types of external USB devices to flash lights in different colours if mimikatz was executed. The technique presented in the article required certain kind of busylights that [...]
---------------------------------------------
https://research.nccgroup.com/2022/09/30/detecting-mimikatz-with-busylight/
∗∗∗ CISA Publishes User Guide to Prepare for Nov. 1 Move to TLP 2.0 ∗∗∗
---------------------------------------------
CISA has published its Traffic Light Protocol 2.0 User Guide and Traffic Light Protocol: Moving to Version 2.0 fact sheet in preparation for its November 1, 2022 move from Traffic Light Protocol (TLP) Version 1.0 to TLP 2.0. Managed by the Forum of Incident Response and Security Teams (FIRST), TLP is a system of markings that communicates information sharing permissions.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/09/29/cisa-publishes-us…
∗∗∗ Mandiant, VMware und US-CERT warnen vor Malware, die auf VMware ESXi Server zielt ∗∗∗
---------------------------------------------
Der von Google übernommene Sicherheitsanbieter Mandiant ist auf eine neue Malware-Familie (VirtualPITA, VirtualPIE und VirtualGATE) gestoßen, die es auf Virtualisierunglösungen wie VMware ESXi Server abgesehen hat und spezialisierte Techniken zum Eindringen verwendet. VMware hat einen entsprechenden Sicherheitshinweis veröffentlicht, [...]
---------------------------------------------
https://www.borncity.com/blog/2022/09/30/mandiant-vmware-und-us-cert-warnen…
=====================
= Vulnerabilities =
=====================
∗∗∗ ZDI-22-1325: SolarWinds Network Performance Monitor UpdateActionsDescriptions SQL Injection Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor. Authentication is required to exploit this vulnerability.
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1325/
∗∗∗ IBM Security Bulletins 2022-09-29 ∗∗∗
---------------------------------------------
IBM Robotic Process Automation, Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint, Content Collector for IBM Connections, IBM Spectrum Fusion HCI, IBM MQ, IBM MQ Blockchain bridge, IBM QRadar User Behavior Analytics.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libsndfile and libvncserver), Fedora (bash), Red Hat (httpd24-httpd, java-1.7.1-ibm, and java-1.8.0-ibm), and SUSE (krb5-appl, libjpeg-turbo, python310, and slurm_20_02).
---------------------------------------------
https://lwn.net/Articles/909947/
∗∗∗ GitLab: Mehrere Schwachstellen ermöglichen Cross-Site Scripting ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1582
∗∗∗ vim: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1584
∗∗∗ F-Secure und WithSecure Produkte: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter Angreifer kann eine Schwachstelle in F-Secure und WithSecure Produkten ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1591
∗∗∗ BookStack vulnerable to cross-site scripting ∗∗∗
---------------------------------------------
https://jvn.jp/en/jp/JVN78862034/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 28-09-2022 18:00 − Donnerstag 29-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ New Royal Ransomware emerges in multi-million dollar attacks ∗∗∗
---------------------------------------------
A new ransomware operation named Royal is quickly ramping up, targeting corporations with ransom demands ranging from $250,000 to over $2 million.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-royal-ransomware-emerges…
∗∗∗ The secrets of Schneider Electric’s UMAS protocol ∗∗∗
---------------------------------------------
Kaspersky ICS CERT report on vulnerabilities in Schneider Electrics engineering software that enables UMAS protocol abuse.
---------------------------------------------
https://securelist.com/the-secrets-of-schneider-electrics-umas-protocol/107…
∗∗∗ Report Shows How Long It Takes Ethical Hackers to Execute Attacks ∗∗∗
---------------------------------------------
A survey of more than 300 ethical hackers conducted by cybersecurity companies Bishop Fox and SANS Institute found that many could execute an end-to-end attack in less than a day.
---------------------------------------------
https://www.securityweek.com/report-shows-how-long-it-takes-ethical-hackers…
∗∗∗ Exchange Health Checker – Script-Erweiterungen von Frank Zöchling ∗∗∗
---------------------------------------------
Von Microsoft gibt es den Exchange Health Checker, ein PowerShell-Script zur Überprüfung von On-Premises Exchange-Installationen auf Probleme. Das Script wird durch Microsoft wohl kontinuierlich weiter entwickelt. Frank Zöchling hat sich das Thema jetzt mal vorgenommen und das Ganze um ein Script erweitert, um wichtige Einstellungen beim Prüfen einer Exchange-Installation automatisch vorzunehmen.
---------------------------------------------
https://www.borncity.com/blog/2022/09/29/exchange-health-checker-script-erw…
=====================
= Vulnerabilities =
=====================
∗∗∗ New malware backdoors VMware ESXi servers to hijack virtual machines ∗∗∗
---------------------------------------------
Hackers have found a new method to establish persistence on VMware ESXi hypervisors to control vCenter servers and virtual machines for Windows and Linux while avoiding detection.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-malware-backdoors-vmware…
∗∗∗ Root-Lücke: Selbstheilungsfunktion gefährdet Cisco-Netzwerkhardware ∗∗∗
---------------------------------------------
Wichtige Sicherheitsupdates schließen mehrere Lücken in Ciscos Netzwerkbetriebssystem IOS und weiterer Software.
---------------------------------------------
https://heise.de/-7279116
∗∗∗ Matrix chat encryption sunk by five now-patched holes ∗∗∗
---------------------------------------------
You take the green pill, youll spend six hours in a dont roll your own crypto debate. Four security researchers have identified five cryptographic vulnerabilities in code libraries that can be exploited to undermine Matrix encrypted chat clients.
---------------------------------------------
https://www.theregister.com/2022/09/28/matrix_encryption_flaws/
∗∗∗ IBM Security Bulletins 2022-09-28 ∗∗∗
---------------------------------------------
IBM Content Manager OnDemand, SPSS Collaboration and Deployment Services, IBM Decision Optimization Center, IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, IBM Spectrum Protect for Virtual Environments, IBM MQ Operator and Queue manager container images, TXSeries, Rational Service Tester, IBM ILOG CPLEX Optimization Studio, IBM CICS TX Standard and Advanced, IBM SDK, Enterprise Content Management System Monitor, AIX, IBM Robotic Process Automation, IBM WebSphere Application Server Liberty.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, lighttpd, and webkit2gtk), Fedora (firefox, gajim, libofx, and python-nbxmpp), Gentoo (bluez, chromium, expat, firefox, go, graphicsmagick, kitty, php, poppler, redis, thunderbird, and zutty), Oracle (firefox and thunderbird), Red Hat (kernel), Slackware (xorg), SUSE (expat, libostree, lighttpd, python3-lxml, rust1.62, slurm, slurm_18_08, and vsftpd), and Ubuntu (libxi, linux-gcp, postgresql-9.5, and sqlite3).
---------------------------------------------
https://lwn.net/Articles/909870/
∗∗∗ Drupal Updates Patch Vulnerability in Twig Template Engine ∗∗∗
---------------------------------------------
Updates announced for Drupal this week address a severe vulnerability in Twig that could lead to the leakage of sensitive information.
---------------------------------------------
https://www.securityweek.com/drupal-updates-patch-vulnerability-twig-templa…
∗∗∗ PHP: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein lokaler Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsmechanismen zu umgehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1567
∗∗∗ Notepad++: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
Ein lokaler Angreifer kann eine Schwachstelle in Notepad++ ausnutzen, um beliebigen Programmcode auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1559
∗∗∗ Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache Tomcat ausnutzen, um Informationen offenzulegen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1558
∗∗∗ xpdf: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in xpdf ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1570
∗∗∗ Thunderbird 102.3.1 freigegeben ∗∗∗
---------------------------------------------
Die Entwickler des Thunderbird haben zum 28. September 2022 ein weiteres Update des E-Mail Client auf die Version 102.3.1 freigegeben. Es ist ein Bug-Fix-Update, welches eine Reihe an Problemen und Schwachstellen beheben soll.
---------------------------------------------
https://www.borncity.com/blog/2022/09/29/thunderbird-102-3-1-freigegeben/
∗∗∗ CVE-2022-37461: Two Reflected XSS Vulnerabilities in Canon Medical’s Vitrea View ∗∗∗
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-37…
∗∗∗ Hitachi Energy MicroSCADA Pro X SYS600_8DBD000107 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-272-02
∗∗∗ Hitachi Energy MicroSCADA Pro X SYS600_8DBD000106 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-272-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 27-09-2022 18:00 − Mittwoch 28-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Microsoft to retire Exchange Online client access rules in a year ∗∗∗
---------------------------------------------
Microsoft announced today that it will retire Client Access Rules (CARs) in Exchange Online within a year, by September 2023.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-to-retire-exchang…
∗∗∗ Leaked LockBit 3.0 builder used by ‘Bl00dy’ ransomware gang in attacks ∗∗∗
---------------------------------------------
The relatively new Bl00Dy Ransomware Gang has started to use a recently leaked LockBit ransomware builder in attacks against companies.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/leaked-lockbit-30-builder-us…
∗∗∗ Prilex: the pricey prickle credit card complex ∗∗∗
---------------------------------------------
Prilex is a Brazilian threat actor focusing on ATM and PoS attacks. In this report, we provide an overview of its PoS malware.
---------------------------------------------
https://securelist.com/prilex-atm-pos-malware-evolution/107551/
∗∗∗ New Malware Variants Serve Bogus CloudFlare DDoS Captcha ∗∗∗
---------------------------------------------
When attackers shift up their campaigns, change their payload or exfiltration domains, and put some extra effort into hiding their malware it’s usually a telltale sign that they are making some money off of their exploits. One such campaign is the fake CloudFlare DDoS pages which we reported on last month.
---------------------------------------------
https://blog.sucuri.net/2022/09/new-malware-variants-serve-bogus-cloudflare…
∗∗∗ Researchers Warn of New Go-based Malware Targeting Windows and Linux Systems ∗∗∗
---------------------------------------------
A new, multi-functional Go-based malware dubbed Chaos has been rapidly growing in volume in recent months to ensnare a wide range of Windows, Linux, small office/home office (SOHO) routers, and enterprise servers into its botnet.
---------------------------------------------
https://thehackernews.com/2022/09/researchers-warn-of-new-go-based.html
∗∗∗ Zielscheibe Open-Source-Paket: Angriffe 700 Prozent häufiger als vor drei Jahren ∗∗∗
---------------------------------------------
Open-Source-Repositories werden immer häufiger zum Angriffsziel Krimineller. Allein im letzten Jahr hat Sonatype über 55.000 infizierte Pakete identifiziert.
---------------------------------------------
https://heise.de/-7278355
∗∗∗ Attacking Encrypted HTTP Communications ∗∗∗
---------------------------------------------
The Reolink RLC-520A PoE camera obfuscates its HTTP communication by encrypting the POST body data. This level of security does defend against opportunistic attackers but falls short when defending against persistent attackers.
---------------------------------------------
https://www.pentestpartners.com/security-blog/attacking-encrypted-http-comm…
∗∗∗ Decrypt “encrypted stub data” in Wireshark ∗∗∗
---------------------------------------------
I often use Wireshark to analyze Windows and Active Directory network protocols, especially those juicy RPC But I’m often interrupted in my enthusiasm by the payload dissected as “encrypted stub data”: Can we decrypt this “encrypted stub data?”
---------------------------------------------
https://medium.com/tenable-techblog/decrypt-encrypted-stub-data-in-wireshar…
∗∗∗ Stories from the SOC - C2 over port 22 ∗∗∗
---------------------------------------------
The Mirai botnet is infamous for the impact and the everlasting effect it has had on the world. Since the inception and discovery of this malware in 2016, to present day and all the permutations that have spawned as a result, cybersecurity professionals have been keeping a keen eye on this form of Command and Control (C2 or CnC) malware and associated addresses.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-so…
=====================
= Vulnerabilities =
=====================
∗∗∗ VU#855201: L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers ∗∗∗
---------------------------------------------
OverviewLayer-2 (L2) network security controls provided by various devices, such as switches, routers, and operating systems, can be bypassed by stacking Ethernet protocol headers. An attacker can send crafted packets through vulnerable devices to cause Denial-of-service (DoS) or to perform a man-in-the-middle (MitM) attack against a target network. This vulnerability exists within Ethernet encapsulation protocols that allow for stacking of Virtual Local Area Network (VLAN) headers.
---------------------------------------------
https://kb.cert.org/vuls/id/855201
∗∗∗ Cisco Security Advisories 2022-09-27 - 2022-09-28 ∗∗∗
---------------------------------------------
Cisco published 23 Security Advisories (13 High, 10 Medium Severity)
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first…
∗∗∗ Webbrowser Chrome 106: Neue Funktionen und 20 abgedichtete Sicherheitslecks ∗∗∗
---------------------------------------------
Google bessert 20 teils hochriskante Sicherheitslücken im Webbrowser Chrome aus. Zudem erhält der Browser neue Funktionen und Verbesserungen.
---------------------------------------------
https://heise.de/-7277825
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gdal, maven-shared-utils, thunderbird, webkit2gtk, and wpewebkit), Fedora (firefox and libofx), SUSE (dpdk, firefox, flatpak, grafana, kernel, libcaca, and opera), and Ubuntu (ghostscript and linux-gcp-5.15).
---------------------------------------------
https://lwn.net/Articles/909676/
∗∗∗ Octopus Deploy: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Octopus Deploy ausnutzen, um Informationen offenzulegen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1552
∗∗∗ Security Bulletin: A Security Vulnerability was fixed in IBM Application Gateway. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Bulletin: IBM WebSphere Application Server is vulnerable to Server-Side Request Forgery (CVE-2022-35282) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application…
∗∗∗ Security Bulletin: Information disclosure vulnerability in IBM QRadar User Behavior Analytics (CVE-2022-36771) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM App Connect Enterprise and IBM Integration Bus ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty vulnerable to identity spoofing by an authenticated user using a specially crafted request. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-powervm-novalink-is-v…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Functional Tester ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty vulnerable to HTTP header injection, caused by improper validation. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-powervm-novalink-is-v…
∗∗∗ Security Bulletin: IBM MQ Appliance is vulnerable to cross-site scripting (CVE-2022-32750) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-vulne…
∗∗∗ Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affect IBM Decision Optimization Center (CVE-2022-21299) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
∗∗∗ Security Bulletin: IBM Jazz for Service Management is vulnerable to stored cross-site scripting (CVE-2022-35721) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-mana…
∗∗∗ Security Bulletin: IBM Jazz for Service Management is vulnerable to stored cross-site scripting (CVE-2022-35722) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-jazz-for-service-mana…
∗∗∗ Security Bulletin: IBM MQ Appliance is vulnerable to an XML External Entity Injection attack (CVE-2022-31775) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-vulne…
∗∗∗ Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to zlib (CVE-2018-25032) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris…
∗∗∗ Security Bulletin:IBM TRIRIGA Application Platform discloses possible path command execution(CVE-2021-41878) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletinibm-tririga-application-pl…
∗∗∗ Security Bulletin: IBM PowerVM Novalink is vulnerable because IBM WebSphere Application Server Liberty vulnerable, Eclipse Paho Java client could allow a remote attacker to bypass security restrictions. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-powervm-novalink-is-v…
∗∗∗ Autodesk AutoCAD: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1549
∗∗∗ Moodle: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1546
∗∗∗ Check Point ZoneAlarm Extreme Security: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1544
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 26-09-2022 18:00 − Dienstag 27-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Hackers use PowerPoint files for mouseover malware delivery ∗∗∗
---------------------------------------------
The threat actor lures targets with a PowerPoint (.PPT) file allegedly linked to the Organization for Economic Co-operation and Development (OECD), an intergovernmental organization working towards stimulating economic progress and trade worldwide.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-use-powerpoint-files…
∗∗∗ New Erbium password-stealing malware spreads as game cracks, cheats ∗∗∗
---------------------------------------------
The new Erbium information-stealing malware is being distributed as fake cracks and cheats for popular video games to steal victims credentials and cryptocurrency wallets.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-erbium-password-stealing…
∗∗∗ Pass-the-Hash Attacks and How to Prevent them in Windows Domains ∗∗∗
---------------------------------------------
Hackers often start out with nothing more than a low-level user account and then work to gain additional privileges that will allow them to take over the network. One of the methods that is commonly used to acquire these privileges is a pass-the-hash attack.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/pass-the-hash-attacks-and-ho…
∗∗∗ Anlagebetrug: Vorsicht vor Diensten, die Ihnen helfen wollen, Ihr verlorenes Geld zurückzubekommen ∗∗∗
---------------------------------------------
Haben Sie bei einer betrügerischen Investmentplattform Geld verloren? Dann nehmen Sie sich vor Folgebetrug in Acht. Kriminelle bewerben Dienstleistung, die Ihnen angeblich dabei helfen, Ihr verlorenes Geld zurückzubekommen. Angebote von finanzaufsicht.com oder firstmoneyback.com sind aber Fake! Sie werden erneut betrogen!
---------------------------------------------
https://www.watchlist-internet.at/news/anlagebetrug-vorsicht-vor-diensten-d…
∗∗∗ More Than Meets the Eye: Exposing a Polyglot File That Delivers IcedID ∗∗∗
---------------------------------------------
Polyglot files, such as the malicious CHM file analyzed here, can be abused to hide from anti-malware systems that rely on file format identification.
---------------------------------------------
https://unit42.paloaltonetworks.com/polyglot-file-icedid-payload/
∗∗∗ What happens with a hacked Instagram account – and how to recover it ∗∗∗
---------------------------------------------
Had your Instagram account stolen? Don’t panic – here’s how to get your account back and how to avoid getting hacked (again).
---------------------------------------------
https://www.welivesecurity.com/2022/09/26/what-happens-hacked-instagram-acc…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (dovecot and firefox-esr), Fedora (firefox and grafana), Red Hat (firefox and thunderbird), Slackware (dnsmasq and vim), SUSE (dpdk, firefox, kernel, libarchive, libcaca, mariadb, openvswitch, opera, permissions, podofo, snakeyaml, sqlite3, unzip, and vsftpd), and Ubuntu (expat, libvpx, linux-azure-fde, linux-oracle, squid, squid3, and webkit2gtk).
---------------------------------------------
https://lwn.net/Articles/909576/
∗∗∗ SECURITY - ABB Central Licensing System Vulnerabilities, impact on ABB Ability SCADAvantage ∗∗∗
---------------------------------------------
https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A3198&Lan…
∗∗∗ Security Bulletin: A vulnerability in Apache Commons Fileupload affects IBM Tivoli Business Service Manager (CVE-2013-2186, CVE-2013-0248, CVE-2016-3092, CVE-2014-0050, 220723) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-apache…
∗∗∗ Security Bulletin: A vulnerability in FasterXML Woodstox affects IBM Tivoli Business Service Manager (220573) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-faster…
∗∗∗ Veritas NetBackup: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1541
∗∗∗ Publish SBA-ADV-20220328-01: Vtiger CRM Stored Cross-Site Scripting ∗∗∗
---------------------------------------------
https://github.com/sbaresearch/advisories/commit/28e164f1cb73e4885a58616d1b…
∗∗∗ Hitachi Energy APM Edge ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-270-02
∗∗∗ Rockwell Automation ThinManager ThinServer ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-270-03
∗∗∗ Hitachi Energy AFS660/AFS665 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-270-01
∗∗∗ September 23rd 2022 Security Releases ∗∗∗
---------------------------------------------
https://nodejs.org/en/blog/vulnerability/september-2022-security-releases
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 23-09-2022 18:00 − Montag 26-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ NullMixer: oodles of Trojans in a single dropper ∗∗∗
---------------------------------------------
NullMixer is a dropper delivering a number of Trojans, such as RedLine Stealer, SmokeLoader, Satacom, and others.
---------------------------------------------
https://securelist.com/nullmixer-oodles-of-trojans-in-a-single-dropper/1074…
∗∗∗ Maldoc Analysis Info On MalwareBazaar, (Sat, Sep 24th) ∗∗∗
---------------------------------------------
When you lookup a malicious document sample on MalwareBazaar, like this sample, you can see analysis data from olevba and oledump.
---------------------------------------------
https://isc.sans.edu/diary/rss/29084
∗∗∗ Downloading Samples From Takendown Domains, (Sun, Sep 25th) ∗∗∗
---------------------------------------------
Sometimes I want to download a sample from a malicious server, but the domain name no longer resolves (it has been taken down).
---------------------------------------------
https://isc.sans.edu/diary/rss/29086
∗∗∗ Easy Python Sandbox Detection , (Mon, Sep 26th) ∗∗∗
---------------------------------------------
Many malicious Python scripts implement a sandbox detection mechanism, I already wrote diaries about this, but it requires some extra code in the script. Because we are lazy (attackers too), why not try to automate this and easily detect the presence of such a security mechanism?
---------------------------------------------
https://isc.sans.edu/diary/rss/29090
∗∗∗ 13,8 Millionen Downloads: Malware-Apps unter Android und iOS ∗∗∗
---------------------------------------------
Ein IT-Sicherheitsunternehmen hat Werbebetrugs-Apps in Google Play und im Apple Store gefunden, die auf insgesamt 13,8 Millionen Downloads kommen.
---------------------------------------------
https://heise.de/-7275295
∗∗∗ Ransomware: Nach Verschlüsseln kommt jetzt Kopieren & Zerstören ∗∗∗
---------------------------------------------
Das mit dem Verschlüsseln ist aufwendig und fehleranfällig – das denken sich wohl auch Cybercrime-Banden, die zuvor kopierte Daten unbrauchbar machen.
---------------------------------------------
https://heise.de/-7275667
∗∗∗ Microsoft Edge mit SOCKS Proxy über PuTTY / SSH nutzen ∗∗∗
---------------------------------------------
Microsoft Edge (dzt. geprüfte Versionen bis v107) bietet in den Einstellungen leider keine Nutzung von SOCKS-Proxys an. Edge unterstützt dies aber (obwohl sich hierzu in der offiziellen Doku leider nichts findet) über das CmdLine-Argument “--proxy-server“.
---------------------------------------------
https://hitco.at/blog/microsoft-edge-socks-proxy-putty-ssh/
∗∗∗ Betrügerisches Post-Gewinnspiel auf WhatsApp ∗∗∗
---------------------------------------------
Vorsicht, wenn Sie auf WhatsApp ein Gewinnspiel mit dem Titel „Österreichische Post Staatliche Förderung“ erhalten. Dabei handelt es sich um Fake. Sie tappen entweder in eine Abo-Falle oder laden Schadsoftware herunter. Klicken Sie nicht auf den Link und löschen Sie die Nachricht.
---------------------------------------------
https://www.watchlist-internet.at/news/betruegerisches-post-gewinnspiel-auf…
∗∗∗ Hunting for Unsigned DLLs to Find APTs ∗∗∗
---------------------------------------------
Hunting for the loading of unsigned DLLs can help you identify attacks and threat actors in your environment. Our examples include well-known APTs.
---------------------------------------------
https://unit42.paloaltonetworks.com/unsigned-dlls/
∗∗∗ BumbleBee: Round Two ∗∗∗
---------------------------------------------
In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee has been identified as an initial access vector utilized by several ransomware affiliates.
---------------------------------------------
https://thedfirreport.com/2022/09/26/bumblebee-round-two/
∗∗∗ MISP 2.4.163 released with improved periodic notification system and many improvements ∗∗∗
---------------------------------------------
We are pleased to announce the immediate availability of MISP v2.4.163 with an updated periodic notification systemand many improvements.
---------------------------------------------
https://github.com/MISP/MISP/releases/tag/v2.4.163
∗∗∗ Tell Me Where You Live and I Will Tell You About Your P@ssw0rd: Understanding the Macrosocial Factors Influencing Password’s Strength ∗∗∗
---------------------------------------------
Free Person Holding World Globe Facing Mountain Stock PhotoTo explore how a user’s environment influences password creation strategies, we present a blogpost series in which we consider several different perspectives – the macrosocial influence of your country (where you live), the influence of your peers (who your friends are), and a technical understanding of how they are attacked – to improve password security and mitigate the risk of poorly secured passwords.
---------------------------------------------
https://www.gosecure.net/blog/2022/09/26/tell-me-where-you-live-and-i-will-…
=====================
= Vulnerabilities =
=====================
∗∗∗ Microsoft Windows Shift F10 Bypass and Autopilot privilge escalation ∗∗∗
---------------------------------------------
This post demonstrates full chained exploitation, and it contains two steps. The second step is a known vulnerability, but there are other ways.
---------------------------------------------
https://k4m1ll0.com/ShiftF10Bypass-and-privesc.html
∗∗∗ Sophos Firewalls: Kritische Sicherheitslücke wird angegriffen ∗∗∗
---------------------------------------------
Angreifer nutzen eine Schwachstelle in Sophos Firewalls aus, durch die sie eigenen Code auf verwundbare Maschinen schieben. Softwareflicken dichten das Leck ab.
---------------------------------------------
https://heise.de/-7275195
∗∗∗ Angreifer nisten sich in Exchange Online ein – mit bösartigen OAuth-Apps ∗∗∗
---------------------------------------------
Microsoft hat Angriffe auf Cloud-Exchange analysiert, bei denen Angreifer mit bösartigen OAuth-Apps nachhaltig Zugang erlangten und ihn für Spam missbrauchen.
---------------------------------------------
https://heise.de/-7275757
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (expat and poppler), Fedora (dokuwiki), Gentoo (fetchmail, grub, harfbuzz, libaacplus, logcheck, mrxvt, oracle jdk/jre, rizin, smarty, and smokeping), Mageia (tcpreplay, thunderbird, and webkit2), SUSE (dpdk, permissions, postgresql14, puppet, and webkit2gtk3), and Ubuntu (linux-gkeop and sosreport).
---------------------------------------------
https://lwn.net/Articles/909439/
∗∗∗ Trend Micro Deep Security Agent: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein lokaler Angreifer kann mehrere Schwachstellen in Trend Micro Deep Security Agent ausnutzen, um Informationen offenzulegen oder seine Rechte zu erweitern.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1534
∗∗∗ QEMU: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in QEMU ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1535
∗∗∗ WhatsApp: Zwei Schwachstellen ermöglichen Remote Code-Ausführung ∗∗∗
---------------------------------------------
Meta-Tochter WhatsApp warnt vor zwei Schwachstellen in seinen Apps für Android und iOS, die die Sicherheit der Benutzer gefährden. Beide Schwachstellen ermöglichen eine Remote Code-Ausführung – die Apps sollten also zeitnah aktualisiert werden.
---------------------------------------------
https://www.borncity.com/blog/2022/09/26/whatsapp-zwei-schwachstellen-ermgl…
∗∗∗ Security Bulletin: IBM Sterling Partner Engagement Manager vulnerable to denial of service due to Apache Shiro (CVE-2022-32532) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-partner-enga…
∗∗∗ Security Bulletin: IBM MQ Appliance is vulnerable to cross-site scripting (CVE-2022-31744) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-vulne…
∗∗∗ Security Bulletin: Due to RPM, AIX is vulnerable to arbitrary code execution (CVE-2021-20271), RPM database corruption (CVE-2021-3421), and denial of service (CVE-2021-20266) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-due-to-rpm-aix-is-vulnera…
∗∗∗ Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Vmware Tanzu Spring Framework (CVE-2022-22971) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-partner-enga…
∗∗∗ Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Carlo Gavazzi Controls: Multiple Vulnerabilities in Controller UWP 3.0 ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-029/
∗∗∗ CISA Has Added One Known Exploited Vulnerability to Catalog ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/09/23/cisa-has-added-on…
∗∗∗ Node.js: September 22nd 2022 Security Releases ∗∗∗
---------------------------------------------
https://nodejs.org/en/blog/vulnerability/september-2022-security-releases
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 22-09-2022 18:00 − Freitag 23-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Schadsoftware: Betrüger verteilen Malware mit gefälschten Zoom-Webseiten ∗∗∗
---------------------------------------------
Die Webseiten geben sich als Downloadseite für Zoom aus, doch verteilen sie eine Schadsoftware, die es auf Bankdaten abgesehen hat.
---------------------------------------------
https://www.golem.de/news/schadsoftware-betrueger-verteilen-malware-mit-gef…
∗∗∗ Google Play Store: Trojaner Harly kommt auf 4,8 Millionen Downloads ∗∗∗
---------------------------------------------
Im Google Play Store entdeckt Kaspersky zahlreiche trojanisierte Apps, die den Schädling Harly enthalten. Der schließt kostenpflichtige Dienste-Abos ab.
---------------------------------------------
https://heise.de/-7273522
∗∗∗ Fingerabdruck & Co. - Wie funktionieren biometrische Anmeldeverfahren? ∗∗∗
---------------------------------------------
Ihre Augen können das Fenster zu Ihrer Seele sein, aber sie können auch Ihre Bordkarte für das Flugzeug oder der Schlüssel zum Entsperren Ihres Telefons sein. Welche Vor- und Nachteile birgt die Verwendung biometrischer Merkmale für die Authentifizierung?
---------------------------------------------
https://www.welivesecurity.com/deutsch/2022/09/22/fingerabdruck-co-wie-funk…
∗∗∗ Microsoft: Windows KB5017383 preview update added to WSUS by mistake ∗∗∗
---------------------------------------------
Microsoft says that KB5017383, this months Windows preview update, has been accidentally listed in Windows Server Update Services (WSUS) and may lead to security update install problems in some managed environments.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-kb5017383…
∗∗∗ Malicious OAuth applications used to compromise email servers and spread spam ∗∗∗
---------------------------------------------
Microsoft discovered an attack where attackers installed a malicious OAuth application in compromised tenants and used their Exchange servers to launch spam runs.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/09/22/malicious-oauth-applicat…
∗∗∗ Kids Like Cookies, Malware Too!, (Fri, Sep 23rd) ∗∗∗
---------------------------------------------
Recently, a vulnerability has been disclosed by Vectra that affects Microsoft Teams[1], the very popular communication tool used daily by millions of people (me too). Security researchers found that Teams stores session tokens in clear text on the file system. I won't discuss the vulnerability here; read the blog post if you want to learn more. The critical element is that once the token has been stolen, an attacker can impersonate the user.
---------------------------------------------
https://isc.sans.edu/diary/rss/29082
∗∗∗ Hackers Using Fake CircleCI Notifications to Hack GitHub Accounts ∗∗∗
---------------------------------------------
GitHub has put out an advisory detailing what may be an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication (2FA) codes by impersonating the CircleCI DevOps platform. The Microsoft-owned code hosting service said it learned of the attack on September 16, 2022, adding the campaign impacted "many victim organizations.
---------------------------------------------
https://thehackernews.com/2022/09/hackers-using-fake-circleci.html
∗∗∗ WAF bypasses via 0days ∗∗∗
---------------------------------------------
In May, I participated in 1337up0522 from Intigriti which was about hacking OWASP ModSecurity Core Rule Set (CRS). I’ve got 13 findings accepted including 3 exceptional, 2 critical, and 8 high severity vulnerabilities. In this article, I will showcase a couple of interesting findings.
---------------------------------------------
https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec
∗∗∗ Surge in Magento 2 template attacks ∗∗∗
---------------------------------------------
The critical template vulnerability in Magento 2 (CVE-2022-24086) is gaining popularity among eCommerce cyber criminals. The majority of recent Sansec forensic cases concern this attack method. In this article we share our findings of 3 template hacks, and hope it will help you if you are confronted with a similar attack.
---------------------------------------------
https://sansec.io/research/magento-2-template-attacks
∗∗∗ Cross-Site Scripting: The Real WordPress Supervillain ∗∗∗
---------------------------------------------
Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a malicious actor to take full control of an affected [...]
---------------------------------------------
https://www.wordfence.com/blog/2022/09/cross-site-scripting-the-real-wordpr…
∗∗∗ CISA Warns of Zoho ManageEngine RCE Vulnerability Exploitation ∗∗∗
---------------------------------------------
The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday warned of cyberattacks targeting a recently addressed vulnerability in Zoho ManageEngine.
---------------------------------------------
https://www.securityweek.com/cisa-warns-zoho-manageengine-rce-vulnerability…
∗∗∗ NSA and CISA: Heres how hackers are going after critical systems, and what you need to do about it ∗∗∗
---------------------------------------------
NSA and CISA offer some advice for critical infrastructure operators to protect their industrial control systems.
---------------------------------------------
https://www.zdnet.com/article/nsa-and-cisa-heres-how-hackers-are-going-afte…
∗∗∗ Experts fear LockBit spread after ransomware builder leaked ∗∗∗
---------------------------------------------
A toolkit to create DIY versions of the LockBit ransomware has leaked, raising alarms among incident responders and cybersecurity experts warning of more widespread use in attacks. The leak, for the LockBit 3.0 ransomware encryptor, was announced on Wednesday by security researcher 3xp0rt. Several experts and researchers confirmed to The Record that the builder works [...]
---------------------------------------------
https://therecord.media/experts-fear-lockbit-spread-after-ransomware-builde…
∗∗∗ FARGO Ransomware (Mallox) Being Distributed to Vulnerable MS-SQL Servers ∗∗∗
---------------------------------------------
The ASEC analysis team is constantly monitoring malware distributed to vulnerable MS-SQL servers. The analysis team has recently discovered the distribution of FARGO ransomware that is targeting vulnerable MS-SQL servers. Along with GlobeImposter, FARGO is one of the prominent ransomware that targets vulnerable MS-SQL servers.
---------------------------------------------
https://asec.ahnlab.com/en/39152/
=====================
= Vulnerabilities =
=====================
∗∗∗ HP-Drucker: Kritische Lücke erlaubt Codeschmuggel in diversen Modellen ∗∗∗
---------------------------------------------
HP warnt vor Sicherheitslücken in zahlreichen Druckermodellen, die Angreifern das Einschleusen von Schadcode ermöglichen. Der Hersteller stellt Updates bereit.
---------------------------------------------
https://heise.de/-7250538
∗∗∗ IBM Security Bulletins 2022-09-22 ∗∗∗
---------------------------------------------
IBM CICS TX Advanced, IBM CICS TX Standard, IBM Common Cryptographic Architecture (CCA), IBM InfoSphere Information Server, IBM Jazz for Service Management, IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite, IBM Partner Engagement Manager, IBM Security Guardium, IBM Spectrum Control, Operations Dashboard, TXSeries for Multiplatforms, Watson Explorer and Watson Explorer Content Analytics Studio, z/Transaction Processing Facility
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (bind9, expat, firefox-esr, mediawiki, and unzip), Fedora (qemu and thunderbird), Oracle (webkit2gtk3), SUSE (ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma, ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma, dpdk, [...]
---------------------------------------------
https://lwn.net/Articles/909208/
∗∗∗ New Firmware Vulnerabilities Affecting Millions of Devices Allow Persistent Access ∗∗∗
---------------------------------------------
Firmware security company Binarly has discovered another round of potentially serious firmware vulnerabilities that could allow an attacker to gain persistent access to any of the millions of affected devices.
---------------------------------------------
https://www.securityweek.com/new-firmware-vulnerabilities-affecting-million…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 21-09-2022 18:00 − Donnerstag 22-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ BlackCat ransomware’s data exfiltration tool gets an upgrade ∗∗∗
---------------------------------------------
The BlackCat ransomware (aka ALPHV) isnt showing any signs of slowing down, and the latest example of its evolution is a new version of the gangs data exfiltration tool used for double-extortion attacks.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/blackcat-ransomware-s-data-e…
∗∗∗ Critical Magento vulnerability targeted in new surge of attacks ∗∗∗
---------------------------------------------
Researchers have observed a surge in hacking attempts targeting CVE-2022-24086, a critical Magento 2 vulnerability allowing unauthenticated attackers to execute code on unpatched sites.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/critical-magento-vulnerabili…
∗∗∗ RAT Delivered Through FODHelper , (Thu, Sep 22nd) ∗∗∗
---------------------------------------------
I found a simple batch file that drops a Remcos RAT through an old UAC Bypass technique. This technique is based on the "fodhelper" utility ("Features On Demand Helper").
---------------------------------------------
https://isc.sans.edu/diary/rss/29078
∗∗∗ Researchers Disclose Critical Vulnerability in Oracle Cloud Infrastructure ∗∗∗
---------------------------------------------
Researchers have disclosed a new severe Oracle Cloud Infrastructure (OCI) vulnerability that could be exploited by users to access the virtual disks of other Oracle customers.
---------------------------------------------
https://thehackernews.com/2022/09/researchers-disclose-critical.html
∗∗∗ Bypassing FileBlockExecutable in Sysmon 14.0: A Lesson In Analyzing Assumptions ∗∗∗
---------------------------------------------
Recently (in August of 2022), the Sysinternals team released Sysmon 14.0 – a notable update of a powerful and configurable tool for monitoring Windows machines. While Sysmon already included a few valuable detection capabilities, the update introduced the first preventive measure – the FileBlockExecutable event (ID 27).
---------------------------------------------
https://www.huntandhackett.com/blog/bypassing-sysmon
∗∗∗ A technical analysis of the leaked LockBit 3.0 builder ∗∗∗
---------------------------------------------
This is our analysis of the LockBit 3.0 builder that was leaked online on September 21, 2022.
---------------------------------------------
https://cybergeeks.tech/a-technical-analysis-of-the-leaked-lockbit-3-0-buil…
∗∗∗ You can’t stop me. MS Teams session hijacking and bypass ∗∗∗
---------------------------------------------
How cleartext session tokens are stored in an unsecured directory that can be stolen and used to impersonate a Teams user.
---------------------------------------------
https://www.pentestpartners.com/security-blog/you-cant-stop-me-ms-teams-ses…
∗∗∗ Webinar: Love Scams im Internet erkennen ∗∗∗
---------------------------------------------
Am Mittwoch, den 28.09.2022 von 18:30 – 20:00 Uhr findet das kostenlose Webinar zum Thema „Love Scams" statt.
---------------------------------------------
https://www.watchlist-internet.at/news/webinar-love-scams-im-internet-erken…
∗∗∗ Noberus Ransomware: Darkside and BlackMatter Successor Continues to Evolve its Tactics ∗∗∗
---------------------------------------------
New version of Exmatter, and Eamfo malware, used by attackers deploying the Rust-based ransomware.
---------------------------------------------
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/no…
∗∗∗ AA22-265A: Control System Defense: Know the Opponent ∗∗∗
---------------------------------------------
This joint Cybersecurity Advisory, which builds on previous NSA and CISA guidance to stop malicious ICS activity and reduce OT exposure, describes TTPs that malicious actors use to compromise OT/ICS assets.
---------------------------------------------
https://us-cert.cisa.gov/ncas/alerts/aa22-265a
∗∗∗ MindShaRE: Analyzing BSD Kernels for Uninitialized Memory Disclosures using Binary Ninja ∗∗∗
---------------------------------------------
Disclosure of uninitialized memory is one of the common problems faced when copying data across trust boundaries. This can happen between the hypervisor and guest OS, kernel and user space, or across the network.
---------------------------------------------
https://www.thezdi.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-09-21 ∗∗∗
---------------------------------------------
IBM Security Guardium, IBM Cloud Pak for Multicloud Management Managed Services, IBM Tivoli Netcool Impact, IBM Maximo Asset Management, IBM Spectrum Protect Plus SQL.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Notfallpatch für Microsoft Endpoint Configuration Manager erschienen ∗∗∗
---------------------------------------------
Admins sollten die IT-Managementlösung Endpoint Configuration Manager von Microsoft aktualisieren. Es könnten Attacken bevorstehen.
---------------------------------------------
https://heise.de/-7272195
∗∗∗ Python: 15 Jahre alte Schwachstelle betrifft potenziell 350.000 Projekte ∗∗∗
---------------------------------------------
Das Issue zu der Directory-Traversal-Schwachstelle in dem Modul tarfile existiert seit 2007. Geschlossen wurde es mit einem Hinweis in der Dokumentation.
---------------------------------------------
https://heise.de/-7272186
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (e17, fish, mako, and tinygltf), Fedora (mingw-poppler), Mageia (firefox, google-gson, libxslt, open-vm-tools, redis, and sofia-sip), Oracle (dbus-broker, kernel, kernel-container, mysql, and nodejs and nodejs-nodemon), Slackware (bind), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer, [...]
---------------------------------------------
https://lwn.net/Articles/909051/
∗∗∗ Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414) ∗∗∗
---------------------------------------------
https://research.nccgroup.com/2022/09/22/technical-advisory-multiple-vulner…
∗∗∗ HP LaserJet: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1499
∗∗∗ Measuresoft ScadaPro Server ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-265-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 20-09-2022 18:00 − Mittwoch 21-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Angreifer könnten eigenen Code im Kontext von Thunderbird und Firefox ausführen ∗∗∗
---------------------------------------------
Wichtige Sicherheitsupdates schließen mehrere Lücken im E-Mail-Client Thunderbird und den Webbrowsern Firefox und Firefox ESR.
---------------------------------------------
https://heise.de/-7270944
∗∗∗ Hinter Massenmails zu Paketzustellung und Lagergebühr steckt Betrug! ∗∗∗
---------------------------------------------
Aktuell erhalten unzählige Menschen eine personalisierte E-Mail zu einem Paket mit dem Betreff „Label/abgerissen/Zustellung“. Wegen unlesbarer Adresse sollen Sie einen Chat öffnen und Daten ergänzen, um eine Lagergebühr über 29,99 Euro zu vermeiden. Folgen Sie dem Link nicht, geben Sie keine Daten bekannt und bezahlen Sie nichts. Es handelt sich um eine Abo-Falle!
---------------------------------------------
https://www.watchlist-internet.at/news/hinter-massenmails-zu-paketzustellun…
∗∗∗ Windows 11 22H2 adds kernel exploit protection to security baseline ∗∗∗
---------------------------------------------
Microsoft has released the final version of security configuration baseline settings for Windows 11, version 22H2, downloadable today using the Microsoft Security Compliance Toolkit.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/windows-11-22h2-adds-kernel…
∗∗∗ Identifying file manipulation in system files ∗∗∗
---------------------------------------------
Sometimes people send files to us that seem to be legitimate Microsoft system files at first glance, yet closer inspection reveals, that they have in fact been modified. Are those manipulations always malicious? And how can file manipulations be identified? Here are seven different ways to do that.
---------------------------------------------
https://www.gdatasoftware.com/blog/2022/09/37511-detecting-file-manipulatio…
∗∗∗ New Windows 11 security features are designed for hybrid work ∗∗∗
---------------------------------------------
With Windows 11, you can protect your valuable data and enable secure hybrid work with the latest advanced security. Were proud to announce the new security features you heard about this spring are now available.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/09/20/new-windows-11-security-…
∗∗∗ Defense-in-Depth Updates for Azure Identity SDK and Azure Key Vault SDK plus Best Practice Implementation Guidance ∗∗∗
---------------------------------------------
Today, Microsoft released a new version of the Azure Key Vault Software Development Kit (SDK) and Azure Identity SDK that includes defense-in-depth feature improvements. We also published best practice guidance to help protect applications and services that allow externally controlled input into the Azure Key Vault client URI for processing.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/09/20/defense-in-depth-updates-for-azu…
∗∗∗ Exploiting a Seagate service to create a SYSTEM shell (CVE-2022-40286) ∗∗∗
---------------------------------------------
This post covers a slightly different topic than my usual content: application vulnerability discovery and exploit development.
---------------------------------------------
https://www.x86matthew.com/view_post?id=windows_seagate_lpe
∗∗∗ Open Source Tool to Collect Volatile Data for Incident Response ∗∗∗
---------------------------------------------
Varc collects a snapshot of volatile data from a system. It tells you what is happening on a system, and is of particular use when investigating a security incident.
---------------------------------------------
https://github.com/cado-security/varc
∗∗∗ How we Abused Repository Webhooks to Access Internal CI Systems at Scale ∗∗∗
---------------------------------------------
As adoption of CI systems and processes becomes more prevalent, organizations opt for a CI/CD architecture which combines SaaS-based source control management systems (like GitHub or GitLab) with an internal, self-hosted CI solution (e.g. Jenkins, TeamCity). [...] To allow the webhook requests to access the internally-hosted CI system, the SaaS-based SCM vendors provide IP ranges from which their webhooks requests arrive, so these ranges can be allowed in the organization’s firewall. In this blog post, we’ll dive into the potential security pitfalls of this control, and explain why it provides organizations with a false sense of security.
---------------------------------------------
https://www.cidersecurity.io/blog/research/how-we-abused-repository-webhook…
∗∗∗ Securing Developer Tools: OneDev Remote Code Execution ∗∗∗
---------------------------------------------
OneDev is a self-hosted Git server that comes with a lot of development-oriented features such as CI/CD, code search, and static analysis integration. With almost 10,000 stars on GitHub, it is gaining popularity and becoming an open-source and low-maintenance alternative to GitHub, GitLab, and Bitbucket. [...] In this article, we describe the vulnerabilities we found in OneDev that could be used by attackers to take over vulnerable instances.
---------------------------------------------
https://blog.sonarsource.com/onedev-remote-code-execution/
∗∗∗ Hundreds of eCommerce Domains Infected With Google Tag Manager-Based Skimmers ∗∗∗
---------------------------------------------
Security researchers with Recorded Future have identified a total of 569 ecommerce domains infected with skimmers, 314 of which have been infected with web skimmers leveraging Google Tag Manager (GTM) containers.
---------------------------------------------
https://www.securityweek.com/hundreds-ecommerce-domains-infected-google-tag…
∗∗∗ Penetration testing is in the eye of the beholder ∗∗∗
---------------------------------------------
"Beauty is in the eye of the beholder." A famous phrase known to all indicates that our perceptions influence our definitions. The same can be said about penetration testing. Often when clients approach us for what they believe to be a penetration test, their definition and needs do not necessarily meet the accepted approach of those within the security field.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/penetration-testing…
∗∗∗ Authentication methods: choosing the right type ∗∗∗
---------------------------------------------
Recommended authentication models for organisations looking to move beyond passwords.
---------------------------------------------
https://www.ncsc.gov.uk/guidance/authentication-methods-choosing-the-right-…
∗∗∗ Native function and Assembly Code Invocation ∗∗∗
---------------------------------------------
For a reverse engineer, the ability to directly call a function from the analyzed binary can be a shortcut that bypasses a lot of grief. While in some cases it is just possible to understand the function logic and reimplement it in a higher-level language, this is not always feasible, and [...]
---------------------------------------------
https://research.checkpoint.com/2022/native-function-and-assembly-code-invo…
∗∗∗ Atlassian Confluence Vulnerability CVE-2022-26134 Abused For Cryptocurrency Mining, Other Malware ∗∗∗
---------------------------------------------
Users are advised to patch immediately: We found exploit samples abusing the Atlassian Confluence vulnerability (CVE-2022-26134) in the wild for malicious cryptocurrency mining.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/i/atlassian-confluence-vulnera…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (libconfuse, moodle, rizin, and thunderbird), Oracle (ELS kernel, gnupg2, ruby, and webkit2gtk3), Red Hat (booth, dbus-broker, gnupg2, kernel, kernel-rt, kpatch-patch, mysql, nodejs, nodejs-nodemon, ruby, and webkit2gtk3), Slackware (expat and mozilla), SUSE (kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container and vsftpd), and Ubuntu (bind9, ghostscript, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-kvm, linux-lowlatency, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux, linux-aws, linux-aws-hwe, linux-azure-4.15, linux-dell300x, linux-gcp, linux-gcp-4.15, lnux-hwe, inux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux-hwe-5.15, linux-lowlatency-hwe-5.15, and mako).
---------------------------------------------
https://lwn.net/Articles/908893/
∗∗∗ Information Disclosure in VIDEOJET Decoder and Operator Client application in BVMS ∗∗∗
---------------------------------------------
BOSCH-SA-464066-BT: BVMS Operator Client application or the VIDEOJET Decoder VJD-7513 may receive an *unencrypted* live-stream from a camera which allows a man-in-the-middle attacker to compromise the confidential video streams. This happens only in combination with cameras of platform CPP13 or CPP14.x when encrypted UDP connection is configured. Please be aware that encrypted UDP connection is default setting («Secure Connection» setting) for all cameras added into BVMS.
---------------------------------------------
https://psirt.bosch.com/security-advisories/bosch-sa-464066-bt.html
∗∗∗ [R1] Nessus Network Monitor 6.1.0 Fixes Multiple Third-party Vulnerabilities ∗∗∗
---------------------------------------------
Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several third-party components (OpenSSL and moment.js) were found to contain vulnerabilities, and updated versions have been made available by the providers.
---------------------------------------------
https://www.tenable.com/security/tns-2022-19
∗∗∗ Security Bulletin: Rational Performance Tester contains a vulnerability which could affect Eclipse Jetty. Rational Performance Tester has taken steps to mitigate this vulnerability. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-rational-performance-test…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to sensitive information exposure (CVE-2021-35550) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2022-0778 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-…
∗∗∗ Security Bulletin: Operations Dashboard is vulnerable to multiple Golang Go vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-operations-dashboard-is-v…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by a PolicyKit vulnerability (CVE-2021-4034) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to authentication bypass (CVE-2022-40616) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by a Missing HTTP Strict-Transport-Security Header vulnerability (CVE-2021-39072) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by FasterXML jackson-databind vulnerabilities (CVE-2020-25649, X-Force ID 217968) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by path traversal and crypto vulnerabilities (CVE-2021-29425, CVE-2021-39076) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Microsoft Endpoint Configuration Manager: Schwachstelle ermöglicht Umgehen von Sicherheitseinstellungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1488
∗∗∗ TIBCO Spotfire: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1487
∗∗∗ Grafana: Mehrere Schwachstellen ermöglichen Privilegieneskalation ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1486
∗∗∗ Hashicorp Vault: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1485
∗∗∗ Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1492
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 19-09-2022 18:00 − Dienstag 20-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ MFA Fatigue: Hackers’ new favorite tactic in high-profile breaches ∗∗∗
---------------------------------------------
Hackers are more frequently using social engineering attacks to gain access to corporate credentials and breach large networks. One component of these attacks that is becoming more popular with the rise of multi-factor authentication is a technique called MFA Fatigue.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/mfa-fatigue-hackers-new-favo…
∗∗∗ Handling WebAuthn over remote SSH connections ∗∗∗
---------------------------------------------
Being able to SSH into remote machines and do work there is great. Using hardware security tokens for 2FA is also great. But trying to use them both at the same time doesnt work super well, because if you hit a WebAuthn request on the remote machine it doesnt matter how much you mash your token - its not going to work. But could it?
---------------------------------------------
https://mjg59.dreamwidth.org/61232.html
∗∗∗ LastPass source code breach – incident response report released ∗∗∗
---------------------------------------------
Wondering how youd handle a data breach report if the worst happened to you? Heres a useful example.
---------------------------------------------
https://nakedsecurity.sophos.com/2022/09/19/lastpass-source-code-breach-inc…
∗∗∗ Chainsaw: Hunt, search, and extract event log records, (Mon, Sep 19th) ∗∗∗
---------------------------------------------
Chainsaw is a standalone tool that provides a simple and fast method to triage Windows event logs and identify interesting elements within the logs while applying detection logic (Sigma and Chainsaw) to detect malicious activity.
---------------------------------------------
https://isc.sans.edu/diary/rss/29066
∗∗∗ E-Mail von „GMX Sicherheit“ ist Fake ∗∗∗
---------------------------------------------
GMX-Nutzer:innen aufgepasst: Das E-Mail vom Absender „GMX Sicherheit“ ist nicht von GMX. Im betrügerischen E-Mail werden Sie aufgefordert, Ihre Kontoinformationen zu vervollständigen. Ansonsten wird angeblich Ihr Konto innerhalb von 24 Stunden gelöscht. Verschieben Sie das Mail in Ihren Spam-Ordner und klicken Sie nicht auf den Link!
---------------------------------------------
https://www.watchlist-internet.at/news/e-mail-von-gmx-sicherheit-ist-fake/
∗∗∗ Security Risks in Logistics APIs Used by E-Commerce Platforms ∗∗∗
---------------------------------------------
Our research examines the security flaws that we found in the logistics API implementation of e-commerce platforms that can potentially expose the consumers’ personal information. We discuss the security risks that such flaws present for software engineers, e-commerce platform providers, and consumers.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/i/security-risks-in-logistics-…
=====================
= Vulnerabilities =
=====================
∗∗∗ Most common SAP vulnerabilities attackers try to exploit ∗∗∗
---------------------------------------------
Unpatched vulnerabilities, common misconfigurations and hidden flaws in custom code continue to make enterprise SAP applications a target rich environment for attackers at a time when threats like ransomware and credential theft have emerged as major concerns for organizations.
---------------------------------------------
https://www.csoonline.com/article/3674119/most-common-sap-vulnerabilities-a…
∗∗∗ Vulnerabilities Identified in EZVIZ Smart Cams ∗∗∗
---------------------------------------------
As the creator of the world’s first smart home cybersecurity hub, Bitdefender regularly audits popular IoT hardware for vulnerabilities that might affect customers if left unaddressed. This research paper is part of a broader program that aims to shed light on the security of the world’s best-sellers in the IoT space.
---------------------------------------------
https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-ezviz-s…
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (dokuwiki and rizin), SUSE (libcontainers-common, permissions, sqlite3, and wireshark), and Ubuntu (tiff, vim, and xen).
---------------------------------------------
https://lwn.net/Articles/908779/
∗∗∗ Moodle: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Dateien zu manipulieren.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1475
∗∗∗ Hitachi Energy PROMOD IV ICS Advisory (ICSA-22-263-01) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-01
∗∗∗ Hitachi Energy AFF660/665 Series ICS Advisory (ICSA-22-263-02) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-02
∗∗∗ Medtronic NGP 600 Series Insulin Pumps ICS Medical Advisory (ICSMA-22-263-01) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsma-22-263-01
∗∗∗ Dataprobe iBoot-PDU ICS Advisory (ICSA-22-263-03) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
∗∗∗ Host Engineering Communications Module ICS Advisory (ICSA-22-263-04) ∗∗∗
---------------------------------------------
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04
∗∗∗ Security Bulletin: A security vulnerability in react-scripts affects IBM Cloud Pak for Multicloud Management Managed Services ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Bulletin: Due to use of Apache Commons, IBM Cloud PAK for Watson AI Ops is vulnerable to remote code execution (CVE-2022-33980) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-due-to-use-of-apache-comm…
∗∗∗ Security Bulletin: A security vulnerability in Nodejs marked affects IBM Cloud Pak for Multicloud Management Managed Services ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Bulletin: Provision to add https and Secure Flag to bayeux_browser cookie for IBM Control Desk. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-provision-to-add-https-an…
∗∗∗ Security Bulletin: Vulnerabilities in libcurl affect IBM Spectrum Protect Plus SQL, File Indexing, and Windows Host agents ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-libcur…
∗∗∗ Security Bulletin: Multiple vulnerabilities in log4j-1.2.16.jar used by IBM Operations Analytics – Log Analysis ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: A security vulnerability in Node.js dicer affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Managed Services ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Vulnerabilities fixed in Thunderbird 91.13.1 ∗∗∗
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/
∗∗∗ Security Vulnerabilities fixed in Firefox ESR 102.3 ∗∗∗
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/
∗∗∗ Security Vulnerabilities fixed in Firefox 105 ∗∗∗
---------------------------------------------
https://www.mozilla.org/en-US/security/advisories/mfsa2022-40/
∗∗∗ Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-036/
∗∗∗ JetBrains IntelliJ IDEA: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1474
∗∗∗ Apache Kafka: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1473
∗∗∗ Budibase: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1472
∗∗∗ Spring Data REST Vulnerability (CVE-2022-31679) ∗∗∗
---------------------------------------------
https://spring.io/blog/2022/09/19/spring-data-rest-vulnerability-cve-2022-3…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 16-09-2022 18:00 − Montag 19-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Gratis-Entschlüsselungstool: Opfer von Ransomware LockerGoga können aufatmen ∗∗∗
---------------------------------------------
Wer sich den Erpressungstrojaner LockerGoga unter Windows eingefangen hat, kann seine Daten nun ohne Lösegeldzahlung entschlüsseln.
---------------------------------------------
https://heise.de/-7268170
∗∗∗ Umfrage zu Cyberattacken: Viele Unternehmen haben keinen Notfallplan ∗∗∗
---------------------------------------------
Cyberangriff auf ein Unternehmen - und nun? 46 Prozent der Unternehmen in Deutschland haben dafür keinen Plan, sagt eine Studie des Digitalverbands Bitkom.
---------------------------------------------
https://heise.de/-7268938
∗∗∗ Gold kaufen: Gold-Handel-sofort.de ist Fake ∗∗∗
---------------------------------------------
Sie überlegen sich, in Gold zu investieren und suchen nach einem passenden Anbieter? Vorsicht: Nicht jeder Gold-Händler ist seriös. Gold-Handel-sofort.de wirkt zwar professionell, ist aber Fake. Wenn Sie dort bestellen, erhalten Sie trotz Bezahlung keine Ware. Wir zeigen Ihnen, wie Sie einen Online-Shop für Gold überprüfen.
---------------------------------------------
https://www.watchlist-internet.at/news/gold-kaufen-gold-handel-sofortde-ist…
∗∗∗ Chrome & Edge senden persönliche Daten (u.a. Passwörter) an Google bzw. Microsoft ∗∗∗
---------------------------------------------
Neue, und irgendwie unschöne, aber erwartbare Entdeckung, die ein Sicherheitsforscher die Tage öffentlich gemacht hat. Der Google Chrome-Browser, und auch der auf Chromium basierende Microsoft Edge-Browser, übermitteln persönliche Daten aus Formularen an Google bzw. Microsoft (beim Edge).
---------------------------------------------
https://www.borncity.com/blog/2022/09/19/chrome-edge-senden-persnliche-date…
∗∗∗ Preventing ISO Malware , (Sun, Sep 18th) ∗∗∗
---------------------------------------------
In the last few weeks, Ive seen a significant uptick in systems infected with Chromeloader malware. This malware is a malicious extension for your browser, redirecting it to ad sites and hijacking searches. But with the success of this technique recently, I would not be surprised if others will take notice and switch to using it for other things.
---------------------------------------------
https://isc.sans.edu/diary/rss/29062
∗∗∗ Can reflections in eyeglasses actually leak info from Zoom calls? Heres a study into it ∗∗∗
---------------------------------------------
About time someone shone some light onto this Boffins at the University of Michigan in the US and Zhejiang University in China want to highlight how bespectacled video conferencing participants are inadvertently revealing sensitive on-screen information via reflections in their eyeglasses.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/09/17/glasses_refl…
∗∗∗ A Guide to Improving Security Through Infrastructure-as-Code ∗∗∗
---------------------------------------------
Modern organizations evolved and took the next step when they became digital. Organizations are using cloud and automation to build a dynamic infrastructure to support more frequent product release and faster innovation. This puts pressure on the IT department to do more and deliver faster.
---------------------------------------------
https://research.nccgroup.com/2022/09/19/a-guide-to-improving-security-thro…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-09-15 and 2022-09-16 ∗∗∗
---------------------------------------------
IBM Spectrum Protect Plus, IBM Spectrum Copy Data Management, IBM Spectrum Plus Container Backup, Restore for Kubernetes, Red Hat OpenShift, IBM Spectrum Protect Operations Center, Client Management Service, IBM Spectrum Protect Server, IBM Security QRadar Network Threat Analytics, IBM Sterling Control Center, Rational Test Control Panel, Rational Test Workbench.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ High severity vulnerabilities found in Harbor open-source artifact registry ∗∗∗
---------------------------------------------
Oxeye security researchers have uncovered several new high severity variants of the IDOR (Insecure Director Object Reference) vulnerabilities (CVE-2022-31671, CVE-2022-31666, CVE-2022-31670, CVE-2022-31669, CVE-2022-31667) in CNCF-graduated project Harbor, the popular open-source artifact registry by VMware.
---------------------------------------------
https://www.helpnetsecurity.com/2022/09/19/vulnerabilities-harbor-open-sour…
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (connman and e17), Fedora (curl, open-vm-tools, pcs, and python-lxml), Mageia (curl, dpkg, freecad, gimp, libtar, libtiff, mediawiki, ostree, python-lxml, schroot, SDL12, sdl2, wireshark, and zlib), Oracle (kernel and php:7.4), Red Hat (php:7.4), Slackware (vim), SUSE (chromium, kernel, libarchive, libtirpc, mupdf, python-rsa, ruby2.5, and virtualbox), and Ubuntu (linux-intel-iotg).
---------------------------------------------
https://lwn.net/Articles/908627/
∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0009 ∗∗∗
---------------------------------------------
CVE identifiers: CVE-2022-32886, CVE-2022-32891,CVE-2022-32912.
Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
---------------------------------------------
https://webkitgtk.org/security/WSA-2022-0009.html
∗∗∗ Lexmark Firmware-Update schließt Schwachstelle und korrigiert Windows-Druckerproblem ∗∗∗
---------------------------------------------
Gute Nachrichten für Besitzer von Lexmark-Druckern. Der Hersteller hat endlich die Firmware-Updates für diverse Modelle bereitgestellt. Diese sollen einerseits eine Schwachstelle in mehr als Hundert Lexmark-Druckermodellen beseitigen, vor der Lexmark bereits im Juni 2022 gewarnt hat [...]
---------------------------------------------
https://www.borncity.com/blog/2022/09/19/lexmark-firmware-update-schliet-sc…
∗∗∗ Netgear Routers impacted by FunJSQ Game Acceleration Module flaw ∗∗∗
---------------------------------------------
https://securityaffairs.co/wordpress/135887/security/netgear-game-accelerat…
∗∗∗ Mattermost: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1455
∗∗∗ Kubernetes: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1458
∗∗∗ WithSecure Produkte: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1464
∗∗∗ Dell NetWorker: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1460
∗∗∗ HPE Integrated Lights-Out: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1459
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 15-09-2022 18:00 − Freitag 16-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Sicherheitslücke in WordPress-Plug-in WPGateway macht Angreifer zu Admins ∗∗∗
---------------------------------------------
Angreifer attackieren WordPress-Websites mit WPGateway. Sicherheitsupdates sind noch nicht verfügbar.
---------------------------------------------
https://heise.de/-7265906
∗∗∗ Update für Exchange Extended Protection-Script, aber weiterhin Fehler ∗∗∗
---------------------------------------------
Mit den Sicherheitsupdates vom August 2022 für Microsoft Exchange (On-Premises-Lösung) ist es erforderlich, Extended Protection (EP) zu aktivieren, um alle Schwachstellen zu schließen. Die Aktivierung erfolgt per Script, welches Microsoft bereitgestellt hat – was aber zu Problemen führte.
---------------------------------------------
https://www.borncity.com/blog/2022/09/16/update-fr-exchange-extended-protec…
∗∗∗ PS2 Emulator: Exploit in PS4 und PS5 soll nicht behebbar sein ∗∗∗
---------------------------------------------
Eine Lücke im integrierten PS2-Emulator der Playstation 4 und 5 soll sich "grundsätzlich" nicht beheben lassen. Das reicht, um Code auszuführen.
---------------------------------------------
https://www.golem.de/news/ps2-emulator-exploit-in-ps4-und-ps5-soll-nicht-be…
∗∗∗ Bitdefender releases free decryptor for LockerGoga ransomware ∗∗∗
---------------------------------------------
Romanian cybersecurity firm Bitdefender has released a free decryptor to help LockerGoga ransomware victims recover their files without paying a ransom.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/bitdefender-releases-free-de…
∗∗∗ Microsoft Edge’s News Feed ads abused for tech support scams ∗∗∗
---------------------------------------------
An ongoing malvertising campaign is injecting ads in the Microsoft Edge News Feed to redirect potential victims to websites pushing tech support scams.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/microsoft-edge-s-news-feed-a…
∗∗∗ Water Tank Management System Used Worldwide Has Unpatched Security Hole ∗∗∗
---------------------------------------------
A water tank management system used by organizations worldwide is affected by a critical vulnerability that can be exploited remotely and the vendor does not appear to want to patch it.read more
---------------------------------------------
https://www.securityweek.com/water-tank-management-system-used-worldwide-ha…
∗∗∗ Word Maldoc With CustomXML and Renamed VBAProject.bin, (Fri, Sep 16th) ∗∗∗
---------------------------------------------
Friend and colleague 0xThiebaut just gave me a heads up for this interesting sample: 2056b52f8c2f62e222107e6fb6ca82708cdae73a91671d40e61aef8698e3e139
---------------------------------------------
https://isc.sans.edu/diary/rss/29056
∗∗∗ Hackers Targeting WebLogic Servers and Docker APIs for Mining Cryptocurrencies ∗∗∗
---------------------------------------------
Malicious actors such as Kinsing are taking advantage of both recently disclosed and older security flaws in Oracle WebLogic Server to deliver cryptocurrency-mining malware.
---------------------------------------------
https://thehackernews.com/2022/09/hackers-targeting-weblogic-servers-and.ht…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (bzip2, chromium, glib2.0, libraw, mariadb-10.3, and mod-wsgi), Fedora (kdiskmark, wordpress, and zlib), Oracle (.NET 6.0, .NET Core 3.1, mariadb:10.3, nodejs:14, nodejs:16, ruby:2.7, and ruby:3.0), Red Hat (.NET 6.0, php:7.4, and webkit2gtk3), SUSE (389-ds, flatpak, kernel, libgit2, and thunderbird), and Ubuntu (sqlite3, vim, and wayland).
---------------------------------------------
https://lwn.net/Articles/908297/
∗∗∗ Synology-SA-22:15 GLPI ∗∗∗
---------------------------------------------
Multiple vulnerabilities allow remote attackers or remote authenticated users to obtain sensitive information, inject arbitrary web script or HTML or inject SQL command via a susceptible version of GLPI.
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_15
∗∗∗ CISA Adds Six Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the "Date Added to Catalog" column, which will sort by descending dates.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/09/15/cisa-adds-six-kno…
∗∗∗ Achtung: Backdoor in TechLogix Networx Power Delivery-Unit, vom Internet isolieren und patchen ∗∗∗
---------------------------------------------
In Stromversorgungskomponenten (Power Delivery-Units) des US-Herstellers TechLogix Networx gibt es eine gravierende Schwachstelle in deren Firmware. Die Firmware nimmt in älteren Versionen (vor Version 2.0.2a) keine Authentifizierung vor, d.h. man kann über Netzwerk die Power Delivery-Unit abschalten.
---------------------------------------------
https://www.borncity.com/blog/2022/09/16/achtung-backdoor-in-techlogix-netw…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to sensitive information exposure (CVE-2021-35550) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct for UNIX container is vulnerable to obtain sensitive information due to OpenSSL (CVE-2022-2097) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to Denial of Service (CVE-2021-35578) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to exposure of sensitive information (CVE-2021-35603) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Dell BSAFE: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1452
∗∗∗ xpdf: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1451
∗∗∗ NGINX: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1450
∗∗∗ Nextcloud: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1449
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 13-09-2022 18:00 − Mittwoch 14-09-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Securing your IoT devices against cyber attacks in 5 steps ∗∗∗
---------------------------------------------
How is IoT being used in the enterprise, and how can it be secured? We will demonstrate important security best practices and how a secure password policy is paramount to the security of devices.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/securing-your-iot-devices-ag…
∗∗∗ Easy Process Injection within Python, (Wed, Sep 14th) ∗∗∗
---------------------------------------------
Process injection is a common technique used by malware to cover their tracks. What looks more legit than a process called "notepad.exe" or "explorer.exe"?
---------------------------------------------
https://isc.sans.edu/diary/rss/29048
∗∗∗ Neue Phishing-Masche: Fake-Konversationen für mehr Glaubwürdigkeit ∗∗∗
---------------------------------------------
Sicherheitsforscher warnen vor einer neuen Taktik, die Phishing-Mails noch glaubhafter erscheinen lässt.
---------------------------------------------
https://heise.de/-7263942
∗∗∗ Passengers Exposed to Hacking via Vulnerabilities in Airplane Wi-Fi Devices ∗∗∗
---------------------------------------------
Researchers have discovered two potentially serious vulnerabilities in wireless LAN devices that they say are often used in airplanes.
---------------------------------------------
https://www.securityweek.com/passengers-exposed-hacking-vulnerabilities-air…
∗∗∗ Malware Infects Magento-Powered Stores via FishPig Distribution Server ∗∗∗
---------------------------------------------
For the past several weeks, Magento stores have been injected with malware via a supply chain attack that targeted the FishPig distribution server.
---------------------------------------------
https://www.securityweek.com/malware-infects-magento-powered-stores-fishpig…
∗∗∗ Mail „Energiekosten: Jetzt 475,00 Euro erhalten“ ist Betrug! ∗∗∗
---------------------------------------------
In Zeiten von 150 Euro Energiegutschein oder 500 Euro Klimabonus kann eine E-Mail mit dem Betreff „Energiekosten: Jetzt 475,00 Euro erhalten“ durchaus für echt gehalten werden. Doch Vorsicht: Die Nachricht leitet auf eine Website zum „Lars Meyer Geld-System“ weiter – eine betrügerische Investment-Plattform, auf der Sie nicht investieren dürfen.
---------------------------------------------
https://www.watchlist-internet.at/news/mail-energiekosten-jetzt-47500-euro-…
∗∗∗ CISA Adds Two Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/09/14/cisa-adds-two-kno…
=====================
= Vulnerabilities =
=====================
∗∗∗ Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs ∗∗∗
---------------------------------------------
Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-…
∗∗∗ IBM Security Bulletins 2022-09-13 ∗∗∗
---------------------------------------------
IBM WebSphere Application Server, IBM SPSS Statistics, IBM Maximo Asset Management, IBM Maximo Manage, IBM App Connect Enterprise, IBM Integration Bus, IBM App Connect Professional.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Patchday: Angreifer attackieren Windows 7 bis 11 ∗∗∗
---------------------------------------------
Kritische Lücken bedrohen Microsoft Dynamics 365 und Windows. Sicherheitsupdates stehen zur Installation bereit.
---------------------------------------------
https://heise.de/-7263140
∗∗∗ Patchday Adobe: Schadcode-Attacken auf InDesign, Photoshop & Co. möglich ∗∗∗
---------------------------------------------
Es gibt wichtige Sicherheitsupdates für verschiedene Anwendungen von Adobe. Derzeit sind keine dokumentierten Attacken bekannt.
---------------------------------------------
https://heise.de/-7263205
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (open-vm-tools), Debian (freecad and sqlite3), Fedora (qt5-qtwebengine and vim), SUSE (firefox, kernel, libzapojit, perl, postgresql14, and samba), and Ubuntu (dotnet6, dpdk, gdk-pixbuf, rust-regex, and systemd).
---------------------------------------------
https://lwn.net/Articles/907983/
∗∗∗ Zero-day in WPGateway Wordpress plugin actively exploited in attacks ∗∗∗
---------------------------------------------
https://www.bleepingcomputer.com/news/security/zero-day-in-wpgateway-wordpr…
∗∗∗ Atlassian Confluence: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1422
∗∗∗ Delta Industrial Automation DIAEnergie ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-256-03
∗∗∗ Kingspan TMS300 CS ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-256-04
∗∗∗ Honeywell SoftMaster ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-256-02
∗∗∗ Hitachi Energy TXpert Hub CoreTec 4 Sudo Vulnerability ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-256-01
∗∗∗ Multi-Vendor BIOS Security Vulnerabilities (September 2022) ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500519-MULTI-VENDOR-BIOS-SECUR…
∗∗∗ Quectel Wireless WAN Driver Command Injection Vulnerability ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500515
∗∗∗ genua genucenter: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1412
∗∗∗ Zoom Video Communications On-Premise: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1420
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 12-09-2022 18:00 − Dienstag 13-09-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ New PsExec spinoff lets hackers bypass network security defenses ∗∗∗
---------------------------------------------
Security researchers have developed an implementation of the Sysinternals PsExec utility that allows moving laterally in a network using a less monitored port.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-psexec-spinoff-lets-hack…
∗∗∗ Security pros get ability to manually add incidents to Microsoft Sentinel ∗∗∗
---------------------------------------------
Microsoft is introducing a feature to Sentinel to enable security analysts to manually create an incident report and the ability to manually delete the incident if needed.
---------------------------------------------
https://www.theregister.com/2022/09/12/microsoft_sentinel_manual_siem_repor…
∗∗∗ Letting off steam ∗∗∗
---------------------------------------------
In July alone, CERT-GIB specialists identified more than 150 fraudulent resources mimicking Steam, a major online gaming platform. To steal Steam credentials, hackers have been using a new phishing technique called browser-in-the-browser, which tricks users into thinking that a fake webpage is a legal resource.
---------------------------------------------
https://blog.group-ib.com/steam
∗∗∗ Tool Release – Monkey365 ∗∗∗
---------------------------------------------
Monkey 365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365, but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead of learning tool APIs or complex admin panels from the start.
---------------------------------------------
https://research.nccgroup.com/2022/09/07/tool-release-monkey365/
∗∗∗ OriginLogger: A Look at Agent Tesla’s Successor ∗∗∗
---------------------------------------------
We provide an overview of the OriginLogger keylogger, including info on a dropper lure and OriginLogger’s configuration and infrastructure.
---------------------------------------------
https://unit42.paloaltonetworks.com/originlogger/
∗∗∗ How to tighten your security in Microsoft Edge ∗∗∗
---------------------------------------------
Edge offers several options to help protect you from malicious websites and other online hazards.
---------------------------------------------
https://www.zdnet.com/article/how-to-tighten-your-security-in-microsoft-edg…
∗∗∗ MISP 2.4.162 released with a new periodic notification system, workflow updates and many improvements ∗∗∗
---------------------------------------------
We are pleased to announce the immediate availability of MISP v2.4.162 with a new periodic notification system, workflow updates and many improvements.
---------------------------------------------
https://github.com/MISP/MISP/releases/tag/v2.4.162
=====================
= Vulnerabilities =
=====================
∗∗∗ Trend Micro warns of actively exploited Apex One RCE vulnerability ∗∗∗
---------------------------------------------
Security software firm Trend Micro warned customers today to patch an actively exploited Apex One security vulnerability as soon as possible.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/trend-micro-warns-of-activel…
∗∗∗ Firmware: Etliche HP-Rechner mit Sicherheitslücken, aber ohne Patches ∗∗∗
---------------------------------------------
Gemeldet wurden die Sicherheitslücken vor vielen Monaten, doch etliche Businessgeräte von HP haben noch keine Updates erhalten.
---------------------------------------------
https://www.golem.de/news/firmware-etliche-hp-rechner-mit-sicherheitsluecke…
∗∗∗ iPadOS, macOS Monterey und altes iOS: Apple patcht Lücken ∗∗∗
---------------------------------------------
iPadOS 16 ist noch nicht fertig, dafür kommt ein Sicherheitsupdate. Auf dem Mac gibts nun Safari 16 – und ebenfalls viele Patches. Auch iOS 15 wird bedacht.
---------------------------------------------
https://heise.de/-7261410
∗∗∗ Lorenz Ransomware nutzt VoIP-Telefone MiVoice Connect von Mitel als Sprungbrett ∗∗∗
---------------------------------------------
Angreifer nutzen derzeit eine kritische Sicherheitslücke in Telefonsystemen von Mitel aus. Sicherheitsupdates sind verfügbar.
---------------------------------------------
https://heise.de/-7261947
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (connman and python-oslo.utils), Fedora (libapreq2), Red Hat (booth, gnupg2, kernel, kernel-rt, mariadb:10.3, nodejs:14, nodejs:16, python3, ruby:2.7, and ruby:3.0), SUSE (chromium, opera, python2-numpy, and rubygem-kramdown), and Ubuntu (poppler).
---------------------------------------------
https://lwn.net/Articles/907869/
∗∗∗ FBI warns of vulnerabilities in medical devices following several CISA alerts ∗∗∗
---------------------------------------------
The FBI on Monday warned that hundreds of vulnerabilities in widely used medical devices are leaving a door open for cyberattacks.
---------------------------------------------
https://therecord.media/fbi-warns-of-vulnerabilities-in-medical-devices-fol…
∗∗∗ SSA-638652 V1.0: Authentication Bypass Vulnerability in Mendix SAML Module ∗∗∗
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-638652.txt
∗∗∗ SSA-637483 V1.0: Third-Party Component Vulnerabilities in SINEC INS before V1.0 SP2 ∗∗∗
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-637483.txt
∗∗∗ SSA-589975 V1.0: Improper Access Control Vulnerability in CoreShield OWG Software ∗∗∗
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-589975.txt
∗∗∗ SSA-518824 V1.0: Multiple File Parsing Vulnerabilities in Simcenter Femap and Parasolid ∗∗∗
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-518824.txt
∗∗∗ SSA-459643 V1.0: Denial of Service Vulnerability in RUGGEDCOM ROS before V5.6.0 ∗∗∗
---------------------------------------------
https://cert-portal.siemens.com/productcert/txt/ssa-459643.txt
∗∗∗ Security Bulletin: IBM CICS TX Standard is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cics-tx-standard-is-v…
∗∗∗ Security Bulletin: Vulnerability in MIT Kerberos 5 affects PowerSC (CVE-2021-37750) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-mit-kerb…
∗∗∗ Security Bulletin: AIX is vulnerable to a privilege escalation vulnerability due to invscout (CVE-2022-36768) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-a-pr…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a denial of service after entering a specially crafted malformed SQL statement into the db2expln tool. (CVE-2022-35637) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: IBM WebSphere Application Server is vulnerable to cross-site scripting in the Admin Console (CVE-2022-34336) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application…
∗∗∗ Security Bulletin: Provision to add https and Secure Flag to bayeux_browser cookie for IBM Control Desk. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-provision-to-add-https-an…
∗∗∗ Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing with authenticated user and ability to bypass security restrictions due to Eclipse Paho Java client (CVE-2019-11777, CVE-2022-22476) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application…
∗∗∗ Security Bulletin: IBM CICS TX Advanced is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cics-tx-advanced-is-v…
∗∗∗ Security Bulletin: AIX is vulnerable to a denial of service due to libxml2 (CVE-2022-29824) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-a-de…
∗∗∗ Security Bulletin: AIX is vulnerable to a privilege escalation vulnerability (CVE-2022-34356) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-a-pr…
∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure in some scenarios due to unauthorized access caused by improper privilege management when CREATE OR REPLACE command is used. (CVE-2022-22483) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-…
∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects TXSeries for Multiplatforms ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja…
∗∗∗ SAP Patchday September 2022 ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1400
∗∗∗ TYPO3 Core: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1402
∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2020-35498 ∗∗∗
---------------------------------------------
https://support.citrix.com/article/CTX463901/citrix-hypervisor-security-bul…
∗∗∗ AMI MegaRAC SP-X BMC Vulnerabilities ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500518-AMI-MEGARAC-SP-X-BMC-VU…
∗∗∗ Brocade Fabric OS - Security Update ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500517-BROCADE-FABRIC-OS-SECUR…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 09-09-2022 18:00 − Montag 12-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ Krypto-Malware Shikitega überlistet den herkömmlichen Linux-Schutz ∗∗∗
---------------------------------------------
AT&T Alien Labs hat eine Analyse zur neuen Linux-Malware Shikitega veröffentlicht. Der Schädling verschafft sich Root-Zugriff, seine Entdeckung ist schwierig.
---------------------------------------------
https://heise.de/-7260803
∗∗∗ Bericht: Um nicht erwischt zu werden, verschlüsselt Ransomware Daten partiell ∗∗∗
---------------------------------------------
Sicherheitsforscher beobachten bei Erpressungstrojanern einen Trend zur schnelleren Verschlüsselung.
---------------------------------------------
https://heise.de/-7261001
∗∗∗ SMS von der Post? Klicken Sie nicht auf den Link! ∗∗∗
---------------------------------------------
„Die Zustellung Ihres letzten Pakets hat sich aufgrund zusätzlicher Zollgebühren verzögert“ lautet eine SMS-Benachrichtigung von der Post. Im SMS ist ein Link, den Sie anklicken sollten, um das Problem zu lösen. Wir raten zur Vorsicht: Diese Nachricht ist nicht von der Post. Wer auf den Link klickt, tappt in eine Internetfalle!
---------------------------------------------
https://www.watchlist-internet.at/news/sms-von-der-post-klicken-sie-nicht-a…
∗∗∗ SharkBot-Trojaner im Play Store – Risiko "Antivirus-Apps" ∗∗∗
---------------------------------------------
Im Google Play Store ist erneut der Banking-Trojaner SharkBot aufgetaucht und hat sich als Antiviren- und Cleaner-App getarnt. Sicherheitsforscher von CyberNews schreiben: Android-Nutzer sollten es sich zweimal überlegen, bevor sie kostenlose Apps zur Reinigung ihres Mobiltelefons und zum "Schutz" vor Viren herunterladen - denn viele von ihnen enthalten Daten-Tracker und einige scheinen sogar Links zu potenziell bösartigen Domains zu beinhalten.
---------------------------------------------
https://www.borncity.com/blog/2022/09/12/sharkbot-trojaner-im-play-store-ri…
∗∗∗ Maldoc With Decoy BASE64, (Fri, Sep 9th) ∗∗∗
---------------------------------------------
There is also a video for this analysis: "Maldoc Analysis: Rehearsed vs. Unrehearsed".
I analysed this maldoc. It contains an old exploit for the equation editor. Nothing special. And it's easy to analyze.
But there is one more thing: it contains a very long BASE64 string, 800,000+ characters, and it turns out to be a decoy.
---------------------------------------------
https://isc.sans.edu/diary/rss/29032
∗∗∗ WMI Internals Part 3 ∗∗∗
---------------------------------------------
In a previous blog post of mine — WMI Internals Part 2: Reversing a WMI Provider I walked through how the WMI architecture is foundationally built upon COM and in turn how WMI classes can end up invoking COM methods to perform actions. I used the PS_ScheduledTask WMI class as an example and how when an instance of this class is created the COM method ITaskServices:NewTask is invoked.
This blog will take this process a step further and look at what happens after the COM method ITaskServices:NewTask.
---------------------------------------------
https://posts.specterops.io/wmi-internals-part-3-38e5dad016be?source=rss---…
∗∗∗ Dead or Alive? An Emotet Story ∗∗∗
---------------------------------------------
In this intrusion from May 2022, we observed a domain-wide compromise that started from a malware ridden Excel document containing the never-dying malware, Emotet. The post-exploitation started very soon after [...]
---------------------------------------------
https://thedfirreport.com/2022/09/12/dead-or-alive-an-emotet-story/
∗∗∗ Ransomware attacks on retail increase, average retail payment grows to more than $200K ∗∗∗
---------------------------------------------
More than 300 organizations in the retail industry said they were hit with ransomware attacks in 2021, according to a survey conducted by security company Sophos. Sophos researchers spoke to 422 IT workers at mid-sized organizations in the retail sector across 31 countries, finding startling increases in the number of respondents who said their organizations [...]
---------------------------------------------
https://therecord.media/ransomware-attacks-on-retail-increase-average-retai…
∗∗∗ Security Breaks: TeamTNT’s DockerHub Credentials Leak ∗∗∗
---------------------------------------------
One of our honeypots based on exposed Docker REST APIs showed cybercriminal group TeamTNT’s potential attack scenario and leak of container registry credentials for docker-abuse malware. The full version of this research will be presented at the c0c0n XV Hacking and Cyber Security Conference in September 2022.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/i/security-breaks-teamtnts-doc…
=====================
= Vulnerabilities =
=====================
∗∗∗ Firmware bugs in many HP computer models left unfixed for over a year ∗∗∗
---------------------------------------------
A set of six high-severity firmware vulnerabilities impacting a broad range of HP devices used in enterprise environments are still waiting to be patched, although some of them were publicly disclosed since July 2021.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/firmware-bugs-in-many-hp-com…
∗∗∗ Patchday: Ansatzpunkte für Angreifer in Android 10, 11 und 12 geschlossen ∗∗∗
---------------------------------------------
Angreifer könnten sich auf Android-Geräten weitreichende Nutzerrechte erschleichen. In Googles Pixel-Serie wurden kritische Lücken ausgebessert.
---------------------------------------------
https://heise.de/-7260572
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gdk-pixbuf, libxslt, linux-5.10, paramiko, and zlib), Fedora (webkit2gtk3), Mageia (gstreamer1.0-plugins-good, jupyter-notebook, kernel, and rpm), Slackware (vim), SUSE (bluez, clamav, freetype2, frr, gdk-pixbuf, keepalived, libyang, nodejs16, python-PyYAML, qpdf, samba, and vim), and Ubuntu (linux-azure-fde and tiff).
---------------------------------------------
https://lwn.net/Articles/907770/
∗∗∗ Critical KEPServerEX Flaws Can Put Attackers in Powerful Position in OT Networks ∗∗∗
---------------------------------------------
Critical KEPServerEX vulnerabilities that impact the products of several major industrial automation vendors can put attackers in a powerful position in OT networks.read more
---------------------------------------------
https://www.securityweek.com/critical-kepserverex-flaws-can-put-attackers-p…
∗∗∗ Octopus Deploy: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Octopus Deploy ausnutzen, um beliebigen Programmcode auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1376
∗∗∗ JFrog Artifactory: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in JFrog Artifactory ausnutzen, um seine Privilegien zu erweitern, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial-of-Service-Zustand auszulösen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1375
∗∗∗ Jenkins: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Jenkins ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1373
∗∗∗ Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite may be vulnerable to arbitrary code execution due to Apache Log4j 1.2 (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme…
∗∗∗ Security Bulletin: Multiple vulnerabilities in WebSphere Liberty affect SPSS Collaboration and Deployment Services ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: qs (QueryString) package in the Service Portal of IBM Control Desk is vulnerable (CVE-2014-7191 and CVE-2017-1000048) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-qs-querystring-package-in…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 08-09-2022 18:00 − Freitag 09-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Bumblebee malware adds post-exploitation tool for stealthy infections ∗∗∗
---------------------------------------------
A new version of the Bumblebee malware loader has been spotted in the wild, featuring a new infection chain that uses the PowerSploit framework for stealthy reflective injection of a DLL payload into memory.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/bumblebee-malware-adds-post-…
∗∗∗ GIFShell attack creates reverse shell using Microsoft Teams GIFs ∗∗∗
---------------------------------------------
A new attack technique called GIFShell allows threat actors to abuse Microsoft Teams for novel phishing attacks and covertly executing commands to steal data using ... GIFs.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/gifshell-attack-creates-reve…
∗∗∗ What Is Clickjacking and How Do I Prevent It? ∗∗∗
---------------------------------------------
There are a plethora of techniques that attackers use to redirect site visitors and harvest sensitive information on compromised websites. But when most webmasters think about securing their website, they often don’t think about how attackers can inject clicks on it from another site.
---------------------------------------------
https://blog.sucuri.net/2022/09/what-is-clickjacking-and-how-do-i-prevent-i…
∗∗∗ Credential Gathering From Third-Party Software ∗∗∗
---------------------------------------------
Users often store passwords in third-party software for convenience – but credential gathering techniques can target this behavior.
---------------------------------------------
https://unit42.paloaltonetworks.com/credential-gathering-third-party-softwa…
=====================
= Vulnerabilities =
=====================
∗∗∗ Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts ∗∗∗
---------------------------------------------
A zero-day flaw in a WordPress plugin called BackupBuddy is being actively exploited, WordPress security company Wordfence has disclosed. "This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information," it said.
---------------------------------------------
https://thehackernews.com/2022/09/hackers-exploit-zero-day-in-wordpress.html
∗∗∗ Sicherheitslücke in vorinstalliertem Tool HP Support Assistant geschlossen ∗∗∗
---------------------------------------------
HP Support Assistant ist standardmäßig auf HP-Computern installiert. Eine Schwachstelle gefährdet nun Systeme.
---------------------------------------------
https://heise.de/-7258790
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (mediawiki), SUSE (libEMF, libnl-1_1, libnl3, mariadb, nodejs16, php8-pear, postgresql12, and rubygem-rake), and Ubuntu (linux-raspi, linux-raspi-5.4, and tiff).
---------------------------------------------
https://lwn.net/Articles/907573/
∗∗∗ CISA Adds Twelve Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added twelve new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/09/08/cisa-adds-twelve-…
∗∗∗ Security Bulletin: Multiple vulnerabilities have been identified in Oracle April 2022 CPU for Java 8 shipped with IBM® Intelligent Operations Center(CVE-2022-21496, CVE-2022-21434, CVE-2022-21443) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: A vulnerability foud in IBM Installation Manager which is shipped with IBM® Intelligent Operations Center(CVE-2021-36374) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-foud-in-i…
∗∗∗ Security Bulletin: A vulnerability have been identified in Java 8 shipped with IBM® Intelligent Operations Center (CVE-2021-35561) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-have-been…
∗∗∗ Security Bulletin: A vulneraqbility in Zlib affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2018-25032) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-zlib-…
∗∗∗ Security Bulletin: A vulnerability foud in IBM Installation Manager which is shipped with IBM® Intelligent Operations Center(CVE-2021-36373) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-foud-in-i…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct for i5/OS is vulnerable to denial of service due to Zlib (CVE-2018-25032) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: Multiple vulnerabilities found in IBM DB2 which is shipped with IBM® Intelligent Operations Center(CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: A vulnerability found in Apache HttpClient which is shipped with IBM® Intelligent Operations Center (CVE-2020-13956) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-found-in-…
∗∗∗ Security Bulletin: XML vulnerability found in IBM Java 8.0 which is shipped with IBM® Intelligent Operations Center (CVE-2022-21299) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-xml-vulnerability-found-i…
∗∗∗ Security Bulletin: A vulnerability found in XMLBeans which hipped with IBM® Intelligent Operations Center (CVE-2021-23926) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-found-in-…
∗∗∗ Security Bulletin: Multiple vulnerabilities found in IBM MQ and Java 8 which is shipped with IBM® Intelligent Operations Center(CVE-2021-2388, CVE-2021-2369, CVE-2021-2432) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: A vulnerability have been identified in IBM Java 8 shipped with IBM® Intelligent Operations Center (CVE-2021-35603) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-have-been…
∗∗∗ Security Bulletin: A vulneraqbility in Zlib affects IBM Tivoli Composite Application Manager for Transactions Response Time agents (CVE-2018-25032) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-zlib-…
∗∗∗ Security Bulletin: A vulnerabilities have been identified in IBM WebSphere Application Server Liberty shipped with IBM® Intelligent Operations Center (CVE-2021-29842) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerabilities-have-be…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 07-09-2022 18:00 − Donnerstag 08-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ RAID-Manager von Hitachi könnte Ansatzpunkt für Schadcode-Attacken sein ∗∗∗
---------------------------------------------
Für einige Versionen von Hitachi RAID Manager SRA sind Sicherheitsupdates erschienen. Für einige Ausgaben gibt es jedoch keinen Support mehr.
---------------------------------------------
https://heise.de/-7257664
∗∗∗ Threat landscape for industrial automation systems for H1 2022 ∗∗∗
---------------------------------------------
This report is based on an analysis of statistical data collected through the Kaspersky Security Network (KSN), a distributed antivirus network.
---------------------------------------------
https://securelist.com/threat-landscape-for-industrial-automation-systems-f…
∗∗∗ Profiling DEV-0270: PHOSPHORUS’ ransomware operations ∗∗∗
---------------------------------------------
Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosp…
∗∗∗ Analyzing Obfuscated VBS with CyberChef, (Thu, Sep 8th) ∗∗∗
---------------------------------------------
I took a closer look at this sample on MalwareBazaar, because it had no tags (now it has a VBS tag).
---------------------------------------------
https://isc.sans.edu/diary/rss/29028
∗∗∗ HTTPS-Zertifikate: Die Rückkehr der Sperrlisten ∗∗∗
---------------------------------------------
Zukünftig soll es endlich wieder möglich sein, kompromittierte Zertifikate einfach zu sperren. Apple und Mozilla preschen vor und Lets Encrypt zieht mit.
---------------------------------------------
https://heise.de/-7257554
∗∗∗ Tensel-markt.de ist Fake! ∗∗∗
---------------------------------------------
Vorsicht vor Fake-Elektronik und Technik-Shops! Tensel-markt.de, gohlke-shop.de und Techno-max.de locken mit ihrem professionellen Design zahlreiche Konsument:innen in die Falle. Bestellen Sie nicht bei diesen Shops, Sie verlieren Ihr Geld!
---------------------------------------------
https://www.watchlist-internet.at/news/tensel-marktde-ist-fake/
∗∗∗ Lazarus and the tale of three RATs ∗∗∗
---------------------------------------------
Cisco Talos has been tracking a new campaign operated by the Lazarus APT group, attributed to North Korea by the United States government. This campaign involved the exploitation of vulnerabilities in VMWare Horizon to gain an initial foothold into targeted organizations.
---------------------------------------------
http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
∗∗∗ How Malicious Actors Abuse Native Linux Tools in Attacks ∗∗∗
---------------------------------------------
Through our honeypots and telemetry, we were able to observe instances in which malicious actors abused native Linux tools to launch attacks on Linux environments. In this blog entry, we discuss how these utilities were used and provide recommendations on how to minimize their impact.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-n…
=====================
= Vulnerabilities =
=====================
∗∗∗ HP fixes severe bug in pre-installed Support Assistant tool ∗∗∗
---------------------------------------------
HP issued a security advisory alerting users about a newly discovered vulnerability in HP Support Assistant, a software tool that comes pre-installed on all HP laptops and desktop computers, including the Omen sub-brand.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hp-fixes-severe-bug-in-pre-i…
∗∗∗ Cisco Security Advisories 2022-09-07 ∗∗∗
---------------------------------------------
Cisco published 4 security advisories (2 high, 2 medium severity)
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&secur…
∗∗∗ VPN-Lücke in älteren Cisco-Routern wird nicht mehr geschlossen ∗∗∗
---------------------------------------------
Für einige Cisco-Router ist der Support ausgelaufen. Es gibt wichtige Sicherheitsupdates für unter anderem Webex.
---------------------------------------------
https://heise.de/-7257206
∗∗∗ IBM Security Bulletins 2022-09-07 ∗∗∗
---------------------------------------------
IBM Java 8, IBM Aspera Faspex, IBM WebSphere Application Server, IBM WebSphere Application Server Liberty, Enterprise Content Management System Monitor, IBM DB2, IBM Semeru Runtime, IBM Robotic Process Automation for Cloud Pak, IBM Intelligent Operations Center
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (libgoogle-gson-java), Fedora (autotrace, insight, and open-vm-tools), Oracle (open-vm-tools), Red Hat (open-vm-tools, openvswitch2.13, openvswitch2.15, openvswitch2.16, openvswitch2.17, ovirt-host, and rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon), Scientific Linux (open-vm-tools), Slackware (python3), SUSE (clamav, gdk-pixbuf, gpg2, icu, ImageMagick, java-1_8_0-ibm, libyajl, mariadb, udisks2, webkit2gtk3, and yast2-samba-provision), and Ubuntu (dnsmasq).
---------------------------------------------
https://lwn.net/Articles/907508/
∗∗∗ Nagios Enterprises Nagios XI: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Nagios Enterprises Nagios XI ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen und Daten zu manipulieren.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1338
∗∗∗ Xerox FreeFlow Print Server: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1335
∗∗∗ Drupal: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Drupal ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1341
∗∗∗ Aruba ClearPass Policy Manager: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in Aruba ClearPass Policy Manager ausnutzen, um Daten zu manipulieren oder offenzulegen, seine Rechte zu erweitern, Code auszuführen oder einen Denial of Service zu verursachen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1340
∗∗∗ MZ Automation libIEC61850 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-251-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 06-09-2022 18:00 − Mittwoch 07-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ So schützen Sie sich vor Schadsoftware! ∗∗∗
---------------------------------------------
Auf dubiosen Websites, in betrügerischen E-Mails, in scheinbar harmlosen Chat-Nachrichten oder durch Sicherheitslücken in nicht aktualisierten Programmen: Schadsoftware kann auf unterschiedlichen Wegen auf Ihren Computer gelangen, um dort beispielsweise sensible Daten auszulesen und zu stehlen oder gar ganze Systeme lahmzulegen.
---------------------------------------------
https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-vor-schadsoftw…
∗∗∗ Worok: The big picture ∗∗∗
---------------------------------------------
Focused mostly on Asia, this new cyberespionage group uses undocumented tools, including steganographically extracting PowerShell payloads from PNG files.
---------------------------------------------
https://www.welivesecurity.com/2022/09/06/worok-big-picture/
∗∗∗ Wie Cyberkriminelle USB missbrauchen ∗∗∗
---------------------------------------------
Den Fluch des Universal Serial Bus (USB) und die Attraktion für Cyberkriminelle untersucht Andrew Rose, Resident CISO, EMEA bei Proofpoint, in einem Gastbeitrag.
---------------------------------------------
https://www.zdnet.de/88403293/wie-cyberkriminelle-usb-missbrauchen/?utm_sou…
∗∗∗ AA22-249A: #StopRansomware: Vice Society ∗∗∗
---------------------------------------------
This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors.
---------------------------------------------
https://us-cert.cisa.gov/ncas/alerts/aa22-249a
∗∗∗ Multiple ransomware data leak sites experience DDoS attacks, facing intermittent outages and connectivity issues ∗∗∗
---------------------------------------------
Since Aug. 20, 2022, Cisco Talos has been monitoring suspected distributed denial-of-service (DDoS) attacks resulting in intermittent downtime and outages affecting several ransomware-as-a-service (RaaS) data leak sites.
---------------------------------------------
http://blog.talosintelligence.com/2022/09/ransomware-leaksite-ddos.html
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-09-06 ∗∗∗
---------------------------------------------
IBM Elastic Storage System, IBM Planning Analytics Workspace, IBM Rational Asset analyzer, IBM App Connect Enterprise, IBM Integration Bus, IBM WebSphere Application Server Liberty, IBM Sterling Connect, IBM Spectrum Scale, IBM SPSS Analytic Server, IBM Business Automation Workflow.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Auf NAS-Systeme von Zyxel könnte Schadcode gelangen ∗∗∗
---------------------------------------------
Aktualisierte Firmware-Versionen schließen eine kritische Sicherheitslücke in mehreren NAS-Modellen des Herstellers Zyxel.
---------------------------------------------
https://heise.de/-7255585
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (curl, protobuf-c, and vim) and SUSE (gimp, java-1_8_0-openj9, libostree, openvswitch, python-bottle, python-Flask-Security-Too, and zabbix).
---------------------------------------------
https://lwn.net/Articles/907382/
∗∗∗ K12055286: Intel CPU vulnerability CVE-2021-33060 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K12055286
∗∗∗ Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-039/
∗∗∗ Helmholz: Unauthenticated user enumeration in myREX24 and myREX24.virtual ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-017/
∗∗∗ MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24 ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-011/
∗∗∗ [R1] Stand-alone Security Patch Available for Tenable.sc versions 5.19.0 to 5.21.0: Patch SC-202209.1 ∗∗∗
---------------------------------------------
https://www.tenable.com/security/tns-2022-18
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 05-09-2022 18:00 − Dienstag 06-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ New EvilProxy service lets all hackers use advanced phishing tactics ∗∗∗
---------------------------------------------
A reverse-proxy Phishing-as-a-Service (PaaS) platform called EvilProxy has emerged, promising to steal authentication tokens to bypass multi-factor authentication (MFA) on Apple, Google, Facebook, Microsoft, Twitter, GitHub, GoDaddy, and even PyPI.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-evilproxy-service-lets-a…
∗∗∗ Mythic Case Study: Assessing Common Offensive Security Tools ∗∗∗
---------------------------------------------
Having covered the Sliver C2 framework in a previous post (May 2022), this blog will continue our examination of Cobalt Strike “alternatives”, focusing on the Mythic C2 framework.
---------------------------------------------
https://team-cymru.com/blog/2022/09/06/mythic-case-study-assessing-common-o…
∗∗∗ Analysis of an Encoded Cobalt Strike Beacon, (Tue, Sep 6th) ∗∗∗
---------------------------------------------
Someone reached out to me for the analysis of a Cobalt Strike beacon. This is the sample.
---------------------------------------------
https://isc.sans.edu/diary/rss/29014
∗∗∗ TA505 Groups TeslaGun In-Depth Analysis ∗∗∗
---------------------------------------------
TA505 is a financially motivated threat group that has been active since 2014. The group frequently changes its malware attack strategies in response to global cybercrime trends. It opportunistically adopts new technologies in order to gain leverage over victims before the wider cybersecurity industry catches on.
---------------------------------------------
https://www.prodaft.com/resource/detail/ta505-ta505-groups-tesla-gun-depth-…
∗∗∗ Vorsicht vor gefälschten PayPal-Nachrichten ∗∗∗
---------------------------------------------
Gefälschte PayPal-Nachrichten befinden sich momentan vermehrt im Umlauf. Sie haben eine angebliche Rechnung von PayPal erhalten, über ein Produkt, das Sie nicht bestellt haben? Oder es wird eine Vorabzahlung für eine angebliche Transaktion gefordert? Ignorieren Sie diese Nachrichten, sie sind Fake!
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-paypal-nac…
∗∗∗ Mirai Variant MooBot Targeting D-Link Devices ∗∗∗
---------------------------------------------
Attackers are leveraging known vulnerabilities in D-Link devices to deliver MooBot, a Mirai variant, potentially leading to further DDoS attacks.
---------------------------------------------
https://unit42.paloaltonetworks.com/moobot-d-link-devices/
∗∗∗ Shikitega - New stealthy malware targeting Linux ∗∗∗
---------------------------------------------
Alien Labs has discovered a new malware targeting endpoints and IoT devices that are running Linux operating systems. Shikitega is delivered in a multistage infection chain where each module responds to a part of the payload and downloads and executes the next one. An attacker can gain full control of the system, in addition to the cryptocurrency miner that will be executed and set to persist.
---------------------------------------------
https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-ma…
∗∗∗ Over Half of Global Firms Supply Chains Compromised by Ransomware ∗∗∗
---------------------------------------------
Cybersecurity leader Trend Micro announced new research today that reveals global organizations are increasingly at risk of ransomware compromise via their extensive supply chains.
---------------------------------------------
https://newsroom.trendmicro.com/2022-09-06-Over-Half-of-Global-Firms-Supply…
∗∗∗ Play Ransomwares Attack Playbook Similar to that of Hive, Nokoyawa ∗∗∗
---------------------------------------------
Play is a new ransomware that takes a page out of Hive and Nokoyawas playbook. The many similarities among them indicate that Play, like Nokoyawa, are operated by the same people.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-pla…
=====================
= Vulnerabilities =
=====================
∗∗∗ Fortinet Security Advisories 2022-09-06 ∗∗∗
---------------------------------------------
On Sep 06, 2022, Fortinet has released 12 advisories for issues resolved in Fortinet products. (Severity: Low (2), Medium (9), High (1))
---------------------------------------------
https://fortiguard.fortinet.com/psirt?date=09-2022
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Red Hat (pcs), SUSE (389-ds and firefox), and Ubuntu (linux-hwe-5.4 and linux-oracle).
---------------------------------------------
https://lwn.net/Articles/907275/
∗∗∗ Hitachi Storage: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer kann mehrere Schwachstellen in Hitachi Storage ausnutzen, um Informationen offenzulegen und beliebigen Code zur Ausführung zu bringen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1292
∗∗∗ Hitachi Energy TXpert Hub CoreTec 4 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-249-04
∗∗∗ Triangle Microworks Libraries ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-249-01
∗∗∗ AVEVA Edge 2020 R2 SP1 and all prior versions ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-249-02
∗∗∗ Cognex 3D-A1000 Dimensioning System ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-249-03
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 02-09-2022 18:00 − Montag 05-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Malware dev open-sources CodeRAT after being exposed ∗∗∗
---------------------------------------------
The source code of a remote access trojan (RAT) dubbed CodeRAT has been leaked on GitHub after malware analysts confronted the developer about attacks that used the tool.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/malware-dev-open-sources-cod…
∗∗∗ Quickie: Grep & Tail -f With Notepad++, (Mon, Sep 5th) ∗∗∗
---------------------------------------------
Notepad++ is a free and open source text editor for Windows. You can simulate grep-like functionality with Notepad++ in 2 steps.
---------------------------------------------
https://isc.sans.edu/diary/rss/29018
∗∗∗ Prynt Stealer Contains a Backdoor to Steal Victims Data Stolen by Other Cybercriminals ∗∗∗
---------------------------------------------
Researchers discovered a private Telegram channel-based backdoor in the information stealing malware, dubbed Prynt Stealer, which its developer added with the intention of secretly stealing a copy of victims exfiltrated data when used by other cybercriminals.
---------------------------------------------
https://thehackernews.com/2022/09/prynt-stealer-contains-backdoor-to.html
∗∗∗ Win32/Hive.ZY: Update stoppt Fehlalarmserie von Microsoft Defender unter Windows ∗∗∗
---------------------------------------------
Die Windows-Virenabwehr Defender hat fälschlicherweise Chrome, Edge & Co. als Trojaner eingestuft.
---------------------------------------------
https://heise.de/-7253919
∗∗∗ Ransomware: Der Trend geht zum Angriff auf Linux-Server ∗∗∗
---------------------------------------------
Trend Micro sieht im ersten Halbjahr 2022 ein Wachstum bei Ransomware-Angriffen. Linux-Umgebungen sind 75 Prozent häufiger ein Ziel als im Vorjahreszeitraum.
---------------------------------------------
https://heise.de/-7254059
∗∗∗ There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities ∗∗∗
---------------------------------------------
As part of this research, NCC Group focused on the secure boot chain implemented by UNISOC processors used in Android phones and tablets. Several vulnerabilities in the Boot ROM were discovered which could persistently undermine secure boot.
---------------------------------------------
https://research.nccgroup.com/2022/09/02/theres-another-hole-in-your-soc-un…
∗∗∗ Was tun, wenn mein Gerät mit Schadsoftware infiziert wurde? ∗∗∗
---------------------------------------------
Schadsoftware (auch Malware) kann viele Formen annehmen und mit unterschiedlichen Bedrohungen für Sie und Ihr Gerät einhergehen. Schäden, die dabei entstehen können, bewegen sich vom Datendiebstahl, über das Zuspammen mit Werbung bis hin zu Lösegeldforderungen.
---------------------------------------------
https://www.watchlist-internet.at/news/was-tun-wenn-mein-geraet-mit-schadso…
=====================
= Vulnerabilities =
=====================
∗∗∗ Jetzt patchen! Google warnt vor möglichen Attacken auf Chrome ∗∗∗
---------------------------------------------
Ein wichtiges Sicherheitsupdate schließt eine Lücke im Webbrowser Chrome.
---------------------------------------------
https://heise.de/-7253510
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (flac, ghostscript, libmodbus, qemu, rails, ruby-rack, and thunderbird), Fedora (kernel, kernel-headers, kernel-tools, libtar, qt5-qtwebengine, subscription-manager-cockpit, tcpreplay, and vim), Mageia (chromium-browser-stable, webkit2, and ytnef), SUSE (curl, firefox, freerdp, gdk-pixbuf, ImageMagick, json-c, libgda, php-composer2, and python-pyxdg), and Ubuntu (libzstd, linux-aws, linux-aws-5.4, linux-azure-5.4, and linux-oem-5.17).
---------------------------------------------
https://lwn.net/Articles/907201/
∗∗∗ DeadBolt Ransomware ∗∗∗
---------------------------------------------
QNAP detected a new DeadBolt ransomware campaign on the morning of September 3rd, 2022 (GMT+8).
---------------------------------------------
https://www.qnap.com/en-us/security-advisory/QSA-22-24
∗∗∗ Security Bulletin: DataStage on Cloud Pak for Data Is Vulnerable to Sensitive Information Disclosure Error (CVE-2022-38714) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-datastage-on-cloud-pak-fo…
∗∗∗ Security Bulletin: Information Disclosure and Denial of Service Vulnerabilities in the IBM Spectrum Protect Backup-Archive Client may affect IBM Spectrum Protect for Space Management (CVE-2022-22478, CVE-2022-22474) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-an…
∗∗∗ Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2022 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Prototype pollution vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – [CVE-2021-23450] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-prototype-pollution-vulne…
∗∗∗ Security Bulletin: Persistent Cross-Site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2022-35644 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-persistent-cross-site-scr…
∗∗∗ OTRS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1286
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 01-09-2022 18:00 − Freitag 02-09-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Microsoft will disable Exchange Online basic auth next month ∗∗∗
---------------------------------------------
Microsoft warned customers today that it will finally disable basic authentication in random tenants worldwide to improve Exchange Online security starting October 1, 2022.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-will-disable-exch…
∗∗∗ Sharkbot is back in Google Play ∗∗∗
---------------------------------------------
This new dropper doesn’t rely Accessibility permissions to automatically perform the installation of the dropper Sharkbot malware. Instead, this new version ask the victim to install the malware as a fake update for the antivirus to stay protected against threats.
---------------------------------------------
https://blog.fox-it.com/2022/09/02/sharkbot-is-back-in-google-play/
∗∗∗ NSA gibt Sicherheitstipps gegen Supply-Chain-Attacken ∗∗∗
---------------------------------------------
Die Cybersecurity and Infrastructure Agency (CISA), die National Security Agency (NSA) und das Office of the Director of National Intelligence (ODNI) haben wichtige Tipps zum Entwickeln von sicherer Software veröffentlicht.
---------------------------------------------
https://heise.de/-7251765
∗∗∗ Unverschlüsselte Access Tokens: Sicherheitslücke in tausenden Apps ∗∗∗
---------------------------------------------
Sicherheitsforscher warnen vor unverschlüsselten Access Tokens in Apps. Oft holen sich Entwickler Probleme ungewollt ins Haus. Besonders betroffen: iOS-Apps.
---------------------------------------------
https://heise.de/-7252134
∗∗∗ When disclosure goes wrong. People ∗∗∗
---------------------------------------------
My experience of vulnerability disclosure is that it is rarely as easy or simple as it could be. I had hoped that bug bounty programmes and vulnerability disclosure programmes (VDPs) would help matters. Broadly that doesn’t seem to be the case, often for unexpected reasons.
---------------------------------------------
https://www.pentestpartners.com/security-blog/when-disclosure-goes-wrong-pe…
∗∗∗ Ransomware auf IoT: Anderer Sicherheitsansatz bei IoT-Geräten erforderlich ∗∗∗
---------------------------------------------
Wir haben uns vermutlich an die täglichen Ransomware-Angriffe auf IT-Systeme gewöhnt. Aber mit der Zunahme von IoT-Geräten droht eine wachsende Gefahr für solche Sicherheitsvorfälle. CheckPoint meint, dass IoT-Geräte einen anderen Sicherheitsansatz brauchen, um dieser Gefahr (z.B. Infektionen durch Ransomware) zu begegnen.
---------------------------------------------
https://www.borncity.com/blog/2022/09/02/ransomware-auf-iot-anderer-sicherh…
∗∗∗ Architecting for Extortion: Acting on the IST’s Blueprint for Ransomware Defense ∗∗∗
---------------------------------------------
Last month, the Institute for Security and Technology’s Ransomware Task Force launched the Blueprint for Ransomware Defense.
---------------------------------------------
https://www.rapid7.com/blog/post/2022/09/02/architecting-for-extortion-acti…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (firefox, rsync, systemd, and thunderbird), Debian (chromium, dpdk, and sofia-sip), Fedora (kernel, thunderbird, and zlib), Red Hat (pcs and rh-mariadb103-galera and rh-mariadb103-mariadb), Slackware (poppler), SUSE (cifs-utils, curl, dwarves and elfutils, firefox, flatpak, gnutls, gpg2, harfbuzz, ignition, kernel, ldb, samba, libslirp, libsolv, libzypp, zypper, libtirpc, logrotate, mozilla-nss, ncurses, open-vm-tools, openssl-1_1, p11-kit, pcre, pcre2, podman, postgresql12, postgresql13, postgresql14, python-M2Crypto, python3, rsync, salt, spice, systemd-presets-common-SUSE, tiff, ucode-intel, xen, and zlib), and Ubuntu (curl, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-ibm, linux-kvm, linux-lowlatency, linux, linux-azure-4.15, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-snapdragon, linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, and linux-aws-hwe).
---------------------------------------------
https://lwn.net/Articles/906973/
∗∗∗ NetApp ActiveIQ Unified Manager: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1263
∗∗∗ Security Bulletin: Vulnerability in IBM® Java SDK affects IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to July 2022 CPU plus deferred CVE-2021-2163 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java…
∗∗∗ Security Bulletin: Vulnerabilities with Kernel, GnuTLS affect IBM Cloud Object Storage Systems (August 2022v1) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-kern…
∗∗∗ Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vul…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 31-08-2022 18:00 − Donnerstag 01-09-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Robert Waldner
=====================
= News =
=====================
∗∗∗ Apple backports fix for actively exploited iOS zero-day to older iPhones ∗∗∗
---------------------------------------------
Apple has released new security updates to backport patches released earlier this month to older iPhones and iPads addressing a remotely exploitable WebKit zero-day that allows attackers to execute arbitrary code on unpatched devices.
---------------------------------------------
https://www.bleepingcomputer.com/news/apple/apple-backports-fix-for-activel…
∗∗∗ Underscores and DNS: The Privacy Story, (Wed, Aug 31st) ∗∗∗
---------------------------------------------
The use of underscores in DNS records can easily trigger DNS purists into a rage. Since the beginning of (DNS) time, only the letters a-z, numbers, and dashes are allowed in DNS labels (RFC 1035 section 2.3.1). After all, we want to remain compatible with ARPANET.
---------------------------------------------
https://isc.sans.edu/diary/rss/29002
∗∗∗ Jolokia Scans: Possible Hunt for Vulnerable Apache Geode Servers (CVE-2022-37021), (Thu, Sep 1st) ∗∗∗
---------------------------------------------
On Tuesday, the Apache project released an update for Geode. The update patches a typical deserialization issue we often see in Java software like Geode (CVE-2022-37021). [...] But the vulnerability has a few dependencies: [...] JMX and RMI are used for the attack.
[...]
And here comes Jolokia. "JMX on Capsaicin," as it calls itself. It provides a simple HTTP to JMX gateway. So it is somewhat interesting that I also saw some scans for Jol[o]kia starting yesterday.
---------------------------------------------
https://isc.sans.edu/diary/rss/29006
∗∗∗ Authority-Scam: Neue Welle von Fake-Mails der Polizei ∗∗∗
---------------------------------------------
Kriminelle geben dem Authority-Scam einen neuen Anstrich: Momentan befinden sich wieder viele gefälschte E-Mails der Polizei im Umlauf. Die Empfänger:innen werden beschuldigt eine Straftat begangen zu haben. Die Anschuldigungen umfassen Pädophilie, Cyberpornographie und Exhibitionismus. Antworten Sie nicht und ignorieren Sie das Schreiben, es ist Fake!
---------------------------------------------
https://www.watchlist-internet.at/news/authority-scam-neue-welle-von-fake-m…
∗∗∗ Over 900K Kubernetes clusters are misconfigured! Is your cluster a target? ∗∗∗
---------------------------------------------
Kubernetes is an amazing platform for managing containers at scale. However, a recent study found that over 900,000 Kubernetes clusters are vulnerable to attack because they are misconfigured! This means that your Kubernetes cluster could be a target for malicious actors if it is not properly secured. In this blog post, we will discuss how to secure your Kubernetes cluster and protect it from attack.
---------------------------------------------
https://grahamcluley.com/feed-sponsor-teleport-4/
∗∗∗ Android TikTok-App: Microsoft findet 1-Klick-Schwachstelle, die Kontenübernahme erlaubte ∗∗∗
---------------------------------------------
Microsoft hat eine gefährliche Sicherheitslücke in der TikTok-App für Android entdeckt, die es ermöglichte, Benutzerkonten mit einem einzigen Klick zu kompromittieren. Inzwischen wurde diese Schwachstelle in der TikTok-App für Android geschlossen.
---------------------------------------------
https://www.borncity.com/blog/2022/09/01/android-tiktok-app-microsoft-finde…
∗∗∗ RAT Tool Disguised as Solution File (*.sln) Being Distributed on Github ∗∗∗
---------------------------------------------
The ASEC analysis team has recently discovered the distribution of a RAT Tool disguised as a solution file (*.sln) on GitHub. As shown in Figure 1, the malware distributor is sharing a source code on GitHub titled “Jpg Png Exploit Downloader Fud Cryter Malware Builder Cve 2022”. The file composition looks normal, but the solution file (*.sln) is actually a RAT tool. It is through methods like this that the malware distributor lures users to run the RAT tool by disguising it as a solution file (*.sln). Generally, programmers who receive the code that includes the solution file run the file in order to open the project. Users should take caution against social engineering techniques that take advantage of such a thought process.
---------------------------------------------
https://asec.ahnlab.com/en/38150/
∗∗∗ Azure Synapse: Local Privilege Escalation Vulnerability in Spark ∗∗∗
---------------------------------------------
The story of a simple race condition leading to a Local Privilege Escalation, and how we discovered, in retrospect, that we crossed paths with another researcher and a previous Microsoft case.
---------------------------------------------
https://orca.security/resources/blog/synapse-local-privilege-escalation-vul…
=====================
= Vulnerabilities =
=====================
∗∗∗ Kritische Lücke in zlib-Bibliothek ermöglicht Codeschmuggel ∗∗∗
---------------------------------------------
In der weit verbreiteten Kompressionsbibliothek zlib könnten Angreifer unter Umständen Schadcode einschleusen und ausführen. Erste Patches sind verfügbar.
---------------------------------------------
https://heise.de/-7250044
∗∗∗ Sicherheitsupdate: Präparierte Mails könnten Thunderbird gefährlich werden ∗∗∗
---------------------------------------------
Es ist ein wichtiges Sicherheitsupdate für den Mailclient Thunderbird erschienen. Damit haben die Entwickler vier Lücken geschlossen.
---------------------------------------------
https://heise.de/-7250566
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (pdns-recursor, thunderbird, and vim), Gentoo (firefox, thunderbird-bin, virtualbox, and webkit-gtk), Red Hat (convert2rhel), SUSE (gstreamer-plugins-good, open-vm-tools, postgresql12, rsync, and ucode-intel), and Ubuntu (linux-azure, linux-gcp, linux-hwe).
---------------------------------------------
https://lwn.net/Articles/906778/
∗∗∗ libTIFF: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in libTIFF ausnutzen, um einen Denial of Service Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1250
∗∗∗ D-LINK Router: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in D-LINK Router ausnutzen, um Code auszuführen oder einen Denial of Service zu verursachen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1253
∗∗∗ Xerox FreeFlow Print Server: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1251
∗∗∗ Security Advisory - Out-of-bounds Read and Write Vulnerability in Some Huawei Headset Products ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20220826-…
∗∗∗ Security Bulletin:IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from openssl, pcre2 and Golang Go ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletinibm-mq-operator-and-queue-…
∗∗∗ Security Bulletin: CVE-2021-2163 may affect IBM® SDK, Java™ Technology Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-cve-2021-2163-may-affect-…
∗∗∗ Security Bulletin: Netcool Operations Insight v1.6.5 contains fixes for multiple security vulnerabilities. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh…
∗∗∗ Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to spoofing due to Eclipse Paho (CVE-2019-11777) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-liberty-for-java-for-ibm-…
∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-…
∗∗∗ Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-35714) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme…
∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8, affect IBM Workload Scheduler. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Delta Electronics DOPSoft ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-244-01
∗∗∗ Contec Health CMS8000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsma-22-244-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 30-08-2022 18:00 − Mittwoch 31-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Hackers hide malware in James Webb telescope images ∗∗∗
---------------------------------------------
Threat analysts have spotted a new malware campaign dubbed GO#WEBBFUSCATOR that relies on phishing emails, malicious documents, and space images from the James Webb telescope to spread malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-hide-malware-in-jame…
∗∗∗ Watering Hole Attacks Push ScanBox Keylogger ∗∗∗
---------------------------------------------
Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool.
---------------------------------------------
https://threatpost.com/watering-hole-attacks-push-scanbox-keylogger/180490/
∗∗∗ Infoblox Threat Intelligence: IOCs related to the Russia-Ukraine conflict ∗∗∗
---------------------------------------------
This folder contains IOCs related to the Russian invasion of Ukraine. The majority of the content is based on Infoblox internal analytics and validation analysis, though some OSINT is also included.
---------------------------------------------
https://github.com/infobloxopen/threat-intelligence/tree/main/ukraine
∗∗∗ Webinar: Betrugsfallen im Internet erkennen ∗∗∗
---------------------------------------------
Am Dienstag, den 06.09.2022 von 18:30 – 20:00 Uhr findet das kostenlose Webinar zum Thema „Betrugsfallen im Internet erkennen" statt. Melden Sie sich jetzt an!
---------------------------------------------
https://www.watchlist-internet.at/news/webinar-betrugsfallen-im-internet-er…
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins 2022-08-30 ∗∗∗
---------------------------------------------
IBM TRIRIGA Application Platform, IBM b-type SAN directors and switches, IBM Integration Bus, IBM App Connect Enterprise, IBM Watson Assistant for IBM Cloud Pak for Data, IBM Engineering Lifecycle Engineering, IBM Cloud Transformation Advisor, IBM Cloud Object Storage Systems.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Sicherheitsupdate: Angreifer könnten WordPress-Websites attackieren ∗∗∗
---------------------------------------------
Die WordPress-Entwickler haben drei Lücken im Content-Management-System geschlossen.
---------------------------------------------
https://heise.de/-7249431
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (dpdk, net-snmp, php-horde-mime-viewer, php-horde-turba, and webkit2gtk), Fedora (rsync), Oracle (openssl and systemd), Red Hat (booth, kernel, kernel-rt, and openssl), Slackware (vim), SUSE (bluez, java-1_8_0-ibm, postgresql10, and zlib), and Ubuntu (kernel, linux, linux-raspi, linux-aws, and linux-oem-5.14).
---------------------------------------------
https://lwn.net/Articles/906579/
∗∗∗ Security Advisory - Traffic Hijacking Vulnerability in Huawei Routers ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20220831-…
∗∗∗ Grafana: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1221
∗∗∗ GitLab: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1239
∗∗∗ ArubaOS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1238
∗∗∗ GNU libc: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1234
∗∗∗ tribe29 checkmk: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1230
∗∗∗ Xerox FreeFlow Print Server: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1228
∗∗∗ Chrome 105.0.5195.5x fixt 24 Schwachstellen ∗∗∗
---------------------------------------------
https://www.borncity.com/blog/2022/08/31/chrome-105-0-5195-5x-fixt-24-schwa…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 29-08-2022 18:00 − Dienstag 30-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Windows malware delays coinminer install by a month to evade detection ∗∗∗
---------------------------------------------
A new malware campaign disguised as Google Translate or MP3 downloader programs was found distributing cryptocurrency mining malware across 11 countries.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/windows-malware-delays-coinm…
∗∗∗ Two things that will never die: bash scripts and IRC!, (Tue, Aug 30th) ∗∗∗
---------------------------------------------
Last week, Brock Perry, one of our SANS.edu undergraduate students, came across a neat bash script uploaded to the honeypot as part of an attack. I am sure this isn't new, but I never quite saw something like this before myself.
---------------------------------------------
https://isc.sans.edu/diary/rss/28998
∗∗∗ Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users ∗∗∗
---------------------------------------------
A few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting affiliate IDs into cookies of eCommerce sites. Since that time, we have investigated several other malicious extensions and discovered 5 extensions with a total install base of over 1,400,000.
---------------------------------------------
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/malicious-cookie-stuff…
∗∗∗ Keine „Testzahlungen“ auf Kleinanzeigen-Plattformen durchführen! ∗∗∗
---------------------------------------------
Auf Kleinanzeigen-Plattformen wie Willhaben, Vinted, eBay Kleinanzeigen und Co finden Sie tolle Schnäppchen oder können Gebrauchtes zu Geld machen. Doch Vorsicht: Auch Kriminelle, die Ihnen das Geld aus der Tasche ziehen wollen, tummeln sich dort zuhauf. Bei einer aktuellen Masche fälschen diese die Zahlungsseiten der Plattformen und fordern zu Testzahlungen auf. Brechen Sie sofort den Kontakt ab. Man will Sie betrügen!
---------------------------------------------
https://www.watchlist-internet.at/news/keine-testzahlungen-auf-kleinanzeige…
∗∗∗ ModernLoader delivers multiple stealers, cryptominers and RATs ∗∗∗
---------------------------------------------
Cisco Talos recently observed three separate, but related, campaigns between March and June 2022 delivering a variety of threats, including the ModernLoader bot, RedLine information-stealer and cryptocurrency-mining malware to victims.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-st…
=====================
= Vulnerabilities =
=====================
∗∗∗ Sicherheitslücken in Foxit PDF Editor und Reader ermöglichen Codeschmuggel ∗∗∗
---------------------------------------------
Angreifer könnten etwa mit manipulierten Dokumenten in Foxit PDF Editor und Reader Schadcode einschleusen. Aktualisierte Software schließt die Sicherheitslücke.
---------------------------------------------
https://heise.de/-7247760
∗∗∗ Sicherheitslücke: Zwischenablage in Chromium-basierten Browsern frei zugreifbar ∗∗∗
---------------------------------------------
Webseiten können derzeit in aktuellen Chromium-basierten Webbrowsern beliebig auf die Zwischenablage zugreifen. Das ermöglicht etwa Angriffe auf Nutzer.
---------------------------------------------
https://heise.de/-7248070
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (thunderbird), Fedora (ctk, dcmtk, OpenImageIO, and varnish-modules), Red Hat (systemd), SUSE (libslirp, open-vm-tools, and opera), and Ubuntu (jupyter-notebook, libsdl1.2, and systemd).
---------------------------------------------
https://lwn.net/Articles/906461/
∗∗∗ [20220801] - Core - Multiple Full Path Disclosures because of missing _JEXEC or die check ∗∗∗
---------------------------------------------
https://developer.joomla.org:443/security-centre/884-20220801-core-multiple…
∗∗∗ Security Bulletin: Tririga is vulnerable to remote hacker due to dom4j open source ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-tririga-is-vulnerable-to-…
∗∗∗ Security Bulletin: A security vulnerability has been fixed in IBM Security Identity Manager (CVE-2021-29864) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Bulletin: glibc vulnerability affects IBM Elastic Storage System (CVE-2021-3999) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-glibc-vulnerability-affec…
∗∗∗ Security Bulletin: Linux Kernel vulnerability may affect IBM Elastic Storage System (CVE-2021-4203) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-linux-kernel-vulnerabilit…
∗∗∗ Security Bulletin: There are multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-there-are-multiple-vulner…
∗∗∗ Security Bulletin: Due to use of OpenSSL, IBM Virtualization Engine TS7700 is vulnerable to denial of service (CVE-2022-0778) and privilege escalation (CVE-2022-1292) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-due-to-use-of-openssl-ibm…
∗∗∗ Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring Agent (CVE-2021-45346) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-sqlit…
∗∗∗ Security Bulletin: There are multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-there-are-multiple-vulner…
∗∗∗ K00994461: GSON vulnerability CVE-2022-25647 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K00994461
∗∗∗ poppler: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1214
∗∗∗ Moodle: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1212
∗∗∗ Hitachi Energy FACTS Control Platform (FCP) Product ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-01
∗∗∗ Hitachi Energy Gateway Station (GWS) Product ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-02
∗∗∗ Hitachi Energy MSM Product ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-03
∗∗∗ Hitachi Energy RTU500 series ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-04
∗∗∗ Fuji Electric D300win ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-05
∗∗∗ Honeywell ControlEdge ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-06
∗∗∗ Honeywell Experion LX ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-07
∗∗∗ Honeywell Trend Controls Inter-Controller Protocol ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-08
∗∗∗ Omron CX-Programmer ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-09
∗∗∗ PTC Kepware KEPServerEX ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-242-10
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 26-08-2022 18:00 − Montag 29-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: n/a
=====================
= News =
=====================
∗∗∗ Fake Cthulhu World P2E project used to push info-stealing malware ∗∗∗
---------------------------------------------
Hackers have created a fake Cthulhu World play-to-earn community, including websites, Discord groups, social accounts, and a Medium developer site, to distribute the Raccoon Stealer, AsyncRAT, and RedLine password-stealing malware infections on unsuspecting victims.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fake-cthulhu-world-p2e-proje…
∗∗∗ HTTP/2 Packet Analysis with Wireshark, (Fri, Aug 26th) ∗∗∗
---------------------------------------------
I have been getting these queries in my honeypot logs since end of December 2021 and decided to a diary on some of these packets using some basic analysis with Wireshark.
---------------------------------------------
https://isc.sans.edu/diary/rss/28986
∗∗∗ Sysinternals Updates: Sysmon v14.0 and ZoomIt v6.01, (Sun, Aug 28th) ∗∗∗
---------------------------------------------
Both Sysinternals utilities (Sysmon and ZoomIt) received updates that significantly extends their scope: Sysmon can now also block actions, and ZoomIt can record videos.
---------------------------------------------
https://isc.sans.edu/diary/rss/28988
∗∗∗ Dealing With False Positives when Scanning Memory Dumps for Cobalt Strike Beacons, (Sun, Aug 28th) ∗∗∗
---------------------------------------------
I updated my Cobalt Strike beacon analysis tool 1768.py to deal with false positives in Windows system's memory dumps.
---------------------------------------------
https://isc.sans.edu/diary/rss/28990
∗∗∗ Aggressive Adware: PDF-Reader für Android mit Millionen Downloads ∗∗∗
---------------------------------------------
Ein PDF-Reader im Google Play-Store kommt auf über eine Million Downloads. Es handelt sich jedoch um Adware, die sogar ungenutzt Vollbild-Werbung einblendet.
---------------------------------------------
https://heise.de/-7246842
∗∗∗ Fake Wohnungsinserate auf eBay und Co.! ∗∗∗
---------------------------------------------
Fake-Inserate finden Sie auf allen gängigen Portalen zur Wohnungssuche. Kriminelle kontaktieren Sie auch direkt, wenn Sie eine „Gesucht-Anzeige“ veröffentlicht haben. Gefälschte Wohnungsinserate erkennen Sie an zwei Merkmalen: Die gebotenen Wohnungen sind sehr günstig und Sie müssen noch vor der Besichtigung die Kaution und erste Monatsmiete bezahlen.
---------------------------------------------
https://www.watchlist-internet.at/news/fake-wohnungsinserate-auf-ebay-und-c…
∗∗∗ Tor 101: How Tor Works and its Risks to the Enterprise ∗∗∗
---------------------------------------------
The Tor project provides one of the most well-known tools that users can leverage to stay anonymous on the internet. People use Tor for many different reasons, both benign and malicious. However, allowing Tor traffic on enterprise networks opens the door to a variety of potential abuses and security risks.
---------------------------------------------
https://unit42.paloaltonetworks.com/tor-traffic-enterprise-networks/
∗∗∗ Lookout: Wie man sich vor SMS-Phishing und ähnlichen Angriffen schützt ∗∗∗
---------------------------------------------
Momentan gibt fast jede Woche ein anderes bekanntes Unternehmen bekannt, dass es Opfer eines Hacks geworden ist, bei dem Daten abgeflossen sind. Für Administratoren in Unternehmen stellt sich die Frage, wie man die internen Systeme vor SMS-Phishing und ähnlichen Angriffen, die auf Mitarbeiter zielen, schützen kann.
---------------------------------------------
https://www.borncity.com/blog/2022/08/28/lookout-wie-man-sich-vor-sms-phish…
=====================
= Vulnerabilities =
=====================
∗∗∗ Atlassian Bitbucket Server vulnerable to critical RCE vulnerability ∗∗∗
---------------------------------------------
Atlassian has published a security advisory warning Bitbucket Server and Data Center users of a critical security flaw that attackers could leverage to execute arbitrary code on vulnerable instances.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/atlassian-bitbucket-server-v…
∗∗∗ Lexmark: Angreifer können sich durch Firmware-Lücke einnisten ∗∗∗
---------------------------------------------
In über 100 Drucker-Modellen von Lexmark steckt eine kritische Lücke in der Firmware. Angreifer könnten sich nach einem Einbruch in den Geräten einnisten.
---------------------------------------------
https://heise.de/-7247068
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (curl, exim4, maven-shared-utils, ndpi, puma, webkit2gtk, and wpewebkit), Fedora (dotnet3.1, firefox, and webkit2gtk3), Mageia (clamav, mariadb, net-snmp, postgresql, python-ldap, and thunderbird), SUSE (freeciv, gnutls, keepalived, libyang, nim, python-Django, and varnish), and Ubuntu (schroot).
---------------------------------------------
https://lwn.net/Articles/906355/
∗∗∗ Security Bulletin: Custom "Execution States" names on IBM Engineering Test Management TCER pages are vulnerable to XSS ( CVE-2021-38934 ) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-custom-execution-states-n…
∗∗∗ D-LINK Router: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1203
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 25-08-2022 18:00 − Freitag 26-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Living off the land, AD CS style ∗∗∗
---------------------------------------------
Unless you have been living under a rock for the last year or so, Active Directory Certificate Services (AD CS) abuse continues to be a hot topic in offensive security, ever since the excellent research released by Will Schroeder (@harmj0y) and Lee Christensen (@tifkin_).
---------------------------------------------
https://www.pentestpartners.com/security-blog/living-off-the-land-ad-cs-sty…
∗∗∗ Threat Assessment: Black Basta Ransomware ∗∗∗
---------------------------------------------
Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.
---------------------------------------------
https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomwar…
∗∗∗ Automatic Execution of Code Upon Package Download on Python Package Manager ∗∗∗
---------------------------------------------
Automatic code execution is triggered upon downloading approximately one third of the packages on PyPi. A worrying feature in pip/PyPi allows code to automatically run when developers are merely downloading a package.
---------------------------------------------
https://checkmarx.com/blog/automatic-execution-of-code-upon-package-downloa…
=====================
= Vulnerabilities =
=====================
∗∗∗ Lücken in Ciscos FXOS und NX-OS ermöglichen Übernahme der Kontrolle ∗∗∗
---------------------------------------------
In Ciscos Router- und Firewall-Betriebssystemen FXOS und NX-OS hätten Angreifer beliebigen Code mit root-Rechten ausführen können. Updates stehen bereit.
---------------------------------------------
https://heise.de/-7244032
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (zlib), Fedora (dotnet3.1, firefox, java-1.8.0-openjdk-aarch32, thunderbird, and zlib), Mageia (canna, chromium-browser-stable, dovecot, firefox/nss, freeciv, freetype2, gnutls, kernel, kernel-linus, kicad, ldb/samba/sssd, libgsasl, microcode, nodejs, rsync, thunderbird, and unbound), Oracle (php:7.4 and systemd), Scientific Linux (firefox, rsync, systemd, and thunderbird), Slackware (vim), and SUSE (bluez, gstreamer-plugins-good, java-1_7_1-ibm, java-1_8_0-ibm, kernel, libcroco, postgresql10, postgresql13, python-lxml, and webkit2gtk3).
---------------------------------------------
https://lwn.net/Articles/906232/
∗∗∗ CISA Adds Ten Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added ten new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisa-adds-ten-kno…
∗∗∗ [R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified, reported and fixed. With the release of Nessus Agent 8.3.4, Tenable has mitigated the reported issues by enabling the ability to sign and verify custom audit files.
---------------------------------------------
https://www.tenable.com/security/tns-2022-17
∗∗∗ ABB Security Advisory: ARM600 Cyber Security Notification: UEFI vulnerability ∗∗∗
---------------------------------------------
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001477&Language…
∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime(CVE-2021-35603) affects DB2 Recovery Expert for Linux, Unix and Windows ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java…
∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-i…
∗∗∗ Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vul…
∗∗∗ Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-35714) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme…
∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: IBM Security Directory Integrator as shipped with IBM Security Directory Suite is affected by Apache Log4j vulnerability (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-directory-in…
∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Java SE related to the JSSE component ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-manage…
∗∗∗ F5: K42795243: Apache Xalan Java Library vulnerability CVE-2022-34169 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K42795243
∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 ∗∗∗
---------------------------------------------
https://webkitgtk.org/security/WSA-2022-0008.html
∗∗∗ vBulletin Connect: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1190
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 24-08-2022 18:00 − Donnerstag 25-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ PyPI packages hijacked after developers fall for phishing emails ∗∗∗
---------------------------------------------
A phishing campaign caught yesterday was seen targeting maintainers of Python packages published to the PyPI registry. Python packages exotel and spam are among hundreds seen laced with malware after attackers successfully compromised accounts of maintainers who fell for the phishing email.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/pypi-packages-hijacked-after…
∗∗∗ More hackers adopt Sliver toolkit as a Cobalt Strike alternative ∗∗∗
---------------------------------------------
Threat actors are dumping the Cobalt Strike penetration testing suite in favor of similar frameworks that are less known. After Brute Ratel, the open-source, cross-platform kit called Sliver is becoming an attractive alternative.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/more-hackers-adopt-sliver-to…
∗∗∗ Twilio hackers hit over 130 orgs in massive Okta phishing attack ∗∗∗
---------------------------------------------
Threat analysts have discovered the phishing kit responsible for thousands of attacks against 136 high-profile organizations that have compromised 9,931 accounts.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/twilio-hackers-hit-over-130-…
∗∗∗ MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone ∗∗∗
---------------------------------------------
Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, which is used by a threat actor we track as NOBELIUM to maintain persistent access to compromised environments.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-…
∗∗∗ whids - Open Source EDR for Windows ∗∗∗
---------------------------------------------
EDR with artifact collection driven by detection. The detection engine is built on top of a previous project Gene specially designed to match Windows events against user defined rules.
---------------------------------------------
https://github.com/0xrawsec/whids
∗∗∗ EDR: Nachfolger der Antiviren-Software kämpfen mit altbekannten Problemen ∗∗∗
---------------------------------------------
Die Security-Industrie preist Endpoint Detection & Response als das bessere Antivirus an. Tests zeigen, dass es oft an den gleichen Problemen scheitert.
---------------------------------------------
https://heise.de/-7241955
∗∗∗ Firefox ESR, Thunderbird: Angreifer könnten Nutzereingaben abfangen ∗∗∗
---------------------------------------------
Es gibt wichtige Sicherheitsupdates für den Mailclient Thunderbird und den Webbrowser Firefox ESR.
---------------------------------------------
https://heise.de/-7242897
∗∗∗ Doxing – was ist das und wie schützt man sich davor? ∗∗∗
---------------------------------------------
Doxing kann jeden treffen - hier erfahren Sie, wie Sie die Wahrscheinlichkeit verringern können, dass Ihre persönlichen Daten als Waffe gegen Sie eingesetzt werden.
---------------------------------------------
https://www.welivesecurity.com/deutsch/2022/08/25/doxing-was-ist-das-und-wi…
∗∗∗ Vorsicht vor Coin-Fallen auf Dating-Portalen ∗∗∗
---------------------------------------------
Sie wollen herausfinden, ob es Ihrer Internetbekanntschaft wirklich ernst ist? Haben Sie Geld für Coins oder Guthaben investiert, um mit Ihrer Bekanntschaft zu chatten, es kommt aber nie zu einem persönlichen Treffen? Hier erfahren Sie alles über die Maschen von moderierten Dating-Portalen.
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-coin-fallen-auf-dating-…
∗∗∗ Preparing Critical Infrastructure for Post-Quantum Cryptography ∗∗∗
---------------------------------------------
CISA has released CISA Insights: Preparing Critical Infrastructure for Post-Quantum Cryptography, which outlines the actions that critical infrastructure stakeholders should take now to prepare for their future migration to the post-quantum cryptographic standard that the National Institute of Standards and Technology (NIST) will publish in 2024.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/24/preparing-critica…
∗∗∗ Palo Alto warns of firewall vulnerability used in DDoS attack on service provider ∗∗∗
---------------------------------------------
Palo Alto Networks is urging customers to patch a line of firewall products after finding that the vulnerability was used in a distributed denial-of-service (DDoS) attack. On August 19, the company made all patches available for CVE-2022-0028 – which affects the PA-Series, VM-Series and CN-Series of the PAN-OS firewall software.
---------------------------------------------
https://therecord.media/palo-alto-warns-of-firewall-vulnerability-used-in-d…
∗∗∗ New Golang Ransomware Agenda Customizes Attacks ∗∗∗
---------------------------------------------
A new piece of ransomware written in the Go language has been targeting healthcare and education enterprises in Asia and Africa. This ransomware is called Agenda and is customized per victim.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda…
=====================
= Vulnerabilities =
=====================
∗∗∗ VU#309662: Signed third party UEFI bootloaders are vulnerable to Secure Boot bypass ∗∗∗
---------------------------------------------
The following vendor-specific bootloaders were found vulnerable:
Inherently vulnerable bootloader to bypass Secure Boot
New Horizon Datasys Inc (CVE-2022-34302)
UEFI Shell execution to bypass Secure Boot
CryptoPro Secure Disk (CVE-2022-34301)
Eurosoft (UK) Ltd (CVE-2022-34303)
Microsoft has provided details with their KB5012170 article released on August 9th 2022. Note, these updates can be delivered from your OEM vendor or the OS vendor to install an updated Secure Boot Forbidden Signature Database (DBX).
---------------------------------------------
https://kb.cert.org/vuls/id/309662
∗∗∗ Movable Type XMLRPC API vulnerable to command injection ∗∗∗
---------------------------------------------
Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability.
---------------------------------------------
https://jvn.jp/en/jp/JVN57728859/
∗∗∗ Commerce Elavon - Moderately critical - Access bypass - SA-CONTRIB-2022-053 ∗∗∗
---------------------------------------------
Project: Commerce Elavon
Security risk: Moderately critical
Vulnerability: Access bypass
Description: This module enables you to accept payments from the Elavon payment provider. [..] This vulnerability is mitigated by the fact that an attacker must be able to spoof the Elavon DNS received by your site.
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-053
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (firefox-esr, libxslt, and open-vm-tools), Fedora (dotnet6.0 and firefox), Oracle (curl, firefox, rsync, and thunderbird), Red Hat (curl, firefox, php:7.4, rsync, systemd, and thunderbird), SUSE (bluez, chromium, freerdp, glibc, gnutls, kernel, postgresql10, raptor, rubygem-rails-html-sanitizer, and spice), and Ubuntu (firefox, linux, linux-kvm, linux-lts-xenial, linux-aws, linux-azure-fde, open-vm-tools, and varnish).
---------------------------------------------
https://lwn.net/Articles/906055/
∗∗∗ Atlassian Bitbucket: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Atlassian Bitbucket ausnutzen, um beliebigen Programmcode auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1185
∗∗∗ HCL Notes und Domino: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL Notes und HCL Domino ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1180
∗∗∗ Mattermost security updates 7.1.3 (ESR), 7.0.2, 6.3.10 (ESR) released ∗∗∗
---------------------------------------------
We’re informing you about a Mattermost security update, which addresses a medium-level severity vulnerability. We highly recommend that you apply the update. The security update is available for Mattermost dot releases 7.1.3 (Extended Support Release), 7.0.2, and 6.3.10 (Extended Support Release) for both Team Edition and Enterprise Edition.
---------------------------------------------
https://mattermost.com/blog/mattermost-security-updates-7-1-3-esr-7-0-2-6-3…
∗∗∗ Cisco Releases Security Updates for Multiple Products ∗∗∗
---------------------------------------------
Cisco has released security updates for vulnerabilities affecting ACI Multi-Site Orchestrator, FXOS, and NX-OS software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisco-releases-se…
∗∗∗ SMA100 Exposure of Sensitive Information to an Unauthorized Actor ∗∗∗
---------------------------------------------
A vulnerability in the SonicWall SMA100 appliance could potentially expose sensitive information i.e., third-party packages and library versions used in the appliance firmware to a pre-authenticated actor.IMPORTANT: SMA 1000 series products are not affected by this vulnerability.
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0020
∗∗∗ SonicWall SMA100 Post-Auth Heap-based Buffer Overflow Vulnerability ∗∗∗
---------------------------------------------
A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions.IMPORTANT: SMA 1000 series products are not affected by this vulnerability. CVE: CVE-2022-2915
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0019
∗∗∗ Security Bulletin: IBM Connect:Direct Web Services vulnerable to remote security bypass due to PostgreSQL (CVE-2022-1552) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-connectdirect-web-ser…
∗∗∗ Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service due to Linux Kernel (CVE-2020-35513) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-vulne…
∗∗∗ FATEK Automation FvDesigner ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-237-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 23-08-2022 18:00 − Mittwoch 24-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Fake Chrome extension Internet Download Manager has 200,000 installs ∗∗∗
---------------------------------------------
Google Chrome extension Internet Download Manager installed by more than 200,000 users is adware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/fake-chrome-extension-intern…
∗∗∗ Hackers use AiTM attack to monitor Microsoft 365 accounts for BEC scams ∗∗∗
---------------------------------------------
A new business email compromise (BEC) campaign has been discovered combining sophisticated spear-phishing with Adversary-in-The-Middle (AiTM) tactics to hack corporate executives Microsoft 365 accounts, even those protected by MFA.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/hackers-use-aitm-attack-to-m…
∗∗∗ Ransomware updates & 1-day exploits ∗∗∗
---------------------------------------------
In this report, we discuss the new multi-platform ransomware RedAlert (aka N13V) and Monster, as well as private 1-day exploits for the CVE-2022-24521 vulnerability.
---------------------------------------------
https://securelist.com/ransomware-updates-1-day-exploits/107291/
∗∗∗ Monster Libra (TA551/Shathak) --> IcedID (Bokbot) --> Cobalt Strike & DarkVNC, (Wed, Aug 24th) ∗∗∗
---------------------------------------------
On Monday, 2022-08-22, I generated an IcedID (Bokbot) infection based on Monster Libra (also known as TA551 or Shathak).
---------------------------------------------
https://isc.sans.edu/diary/rss/28974
∗∗∗ Bomber is an application that scans SBoMs for security vulnerabilities. ∗∗∗
---------------------------------------------
So youve asked a vendor for an Software Bill of Materials (SBOM) for one of their products, and they provided one to you in a JSON file... now what?
---------------------------------------------
https://github.com/devops-kung-fu/bomber
∗∗∗ Cyber-Angriff: Griechischer Gasnetzbetreiber Desfa Opfer von Ransomware-Gang ∗∗∗
---------------------------------------------
Die Ransomware-Gang hinter Ragnar Locker ist in die Netze des Betreibers des griechischen Erdgas-Netzes Desfa eingebrochen. Die Versorgung bleibt gesichert.
---------------------------------------------
https://heise.de/-7241322
∗∗∗ Einbruch bei Plex: Daten abgezogen, Passwortänderung nötig ∗∗∗
---------------------------------------------
Bösartige Akteure sind offenbar in die Datenbanken des Streaming-Dienstes und Medienservers Plex eingebrochen. Dort konnten sie persönliche Daten stehlen.
---------------------------------------------
https://heise.de/-7241975
∗∗∗ Ethernet LEDs Can Be Used to Exfiltrate Data From Air-Gapped Systems ∗∗∗
---------------------------------------------
A researcher from the Ben-Gurion University of the Negev in Israel has published a paper describing a method that can be used to silently exfiltrate data from air-gapped systems using the LEDs of various types of networked devices.
---------------------------------------------
https://www.securityweek.com/ethernet-leds-can-be-used-exfiltrate-data-air-…
∗∗∗ Old, Inconspicuous Vulnerabilities Commonly Targeted in OT Scanning Activity ∗∗∗
---------------------------------------------
Data collected by IBM shows that old and inconspicuous vulnerabilities affecting industrial products are commonly targeted in scanning activity seen by organizations that use operational technology (OT).
---------------------------------------------
https://www.securityweek.com/old-inconspicuous-vulnerabilities-commonly-tar…
∗∗∗ HavanaCrypt Ransomware tarnt sich als Google Update ∗∗∗
---------------------------------------------
Die neu entdeckte HavanaCrypt Ransomware nutzt ausgefeilte Techniken und verkleidet sich als Google Update. Lösegeldforderungen gab es bisher nicht.
---------------------------------------------
https://www.zdnet.de/88403049/havanacrypt-ransomware-tarnt-sich-als-google-…
∗∗∗ But You Told Me You Were Safe: Attacking the Mozilla Firefox Sandbox (Part 2) ∗∗∗
---------------------------------------------
In this blog post, we discuss a second prototype pollution vulnerability that allowed the execution of attacker-controlled JavaScript in the privileged parent process, escaping the sandbox.
---------------------------------------------
https://www.thezdi.com/blog/2022/8/23/but-you-told-me-you-were-safe-attacki…
∗∗∗ BitRAT and XMRig CoinMiner Being Distributed via Windows License Verification Tool ∗∗∗
---------------------------------------------
The ASEC analysis team has recently discovered the distribution of BitRAT and XMRig CoinMiner disguised as a Windows license verification tool.
---------------------------------------------
https://asec.ahnlab.com/en/37939/
∗∗∗ AsyncRAT Being Distributed in Fileless Form ∗∗∗
---------------------------------------------
The ASEC analysis team has recently discovered that malicious AsyncRAT codes are being distributed in fileless form.
---------------------------------------------
https://asec.ahnlab.com/en/37954/
=====================
= Vulnerabilities =
=====================
∗∗∗ Gefährliche Lücken bedrohen Sicherheit von kritischen Infrastrukturen ∗∗∗
---------------------------------------------
Angreifer könnten Industrie-Steuerungssysteme attackieren und im schlimmsten Fall die volle Kontrolle erlangen. Sicherheitsupdates sind verfügbar.
---------------------------------------------
https://heise.de/-7241733
∗∗∗ Updates für GitLab schließen kritische Sicherheitslücke ∗∗∗
---------------------------------------------
Für die GitLab Community- und Enterprise-Edition haben die Entwickler aktualisierte Versionen veröffentlicht, die eine kritische Sicherheitslücke schließen.
---------------------------------------------
https://heise.de/-7241481
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (vim), SUSE (cosign, dpdk, freeciv, gfbgraph, kernel, nim, p11-kit, perl-HTTP-Daemon, python-lxml, and python-treq), and Ubuntu (linux-oem-5.14, open-vm-tools, and twisted).
---------------------------------------------
https://lwn.net/Articles/905853/
∗∗∗ Oracle SBC: Multiple Security Vulnerabilities Leading to Unauthorized Access and Denial of Service ∗∗∗
---------------------------------------------
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/oracle-sbc-…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to sensitive information exposure (CVE-2021-35550) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: A security vulnerability has been identified in in IBM Java SDK shipped with IBM Tivoli Business Service Manager (CVE-2021-35603) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-…
∗∗∗ Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-discover-is-…
∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to Denial of Service (CVE-2021-35578) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover…
∗∗∗ Security Bulletin: IBM Security Identity Governance and Intelligence is vulnerable to exposure of sensitive information (CVE-2021-35603) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-gov…
∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover…
∗∗∗ Security Bulletin: IBM QRadar SIEM includes components with multiple known vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-includes-…
∗∗∗ VMSA-2022-0024 ∗∗∗
---------------------------------------------
https://www.vmware.com/security/advisories/VMSA-2022-0024.html
∗∗∗ vim: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1157
∗∗∗ Jenkins Plugins: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1166
∗∗∗ F-Secure Produkte: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1165
∗∗∗ tribe29 checkmk: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1160
∗∗∗ Mozilla Releases Security Updates for Firefox, Firefox ESR, and Thunderbird ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/23/mozilla-releases-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 22-08-2022 18:00 − Dienstag 23-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Internet-Kernprotokoll: Das Transmission Control Protocol erhält Update ∗∗∗
---------------------------------------------
TCP ist der Motor des Internet. Mit einem gerade aktualisierten RFC bekommt er eine Generalüberholung. Aber kann er sich gegen neue Konkurrenz behaupten?
---------------------------------------------
https://heise.de/-7239713
∗∗∗ Cyber-Attacken: CISA warnt vor Angriffen auf neu entdeckte Sicherheitslücken ∗∗∗
---------------------------------------------
Die US-Cybersicherheitsbehörde CISA warnt vor einigen erst seit Kurzem bekannten Sicherheitslücken. Cyberkriminelle greifen diese bereits aktiv an.
---------------------------------------------
https://heise.de/-7240372
∗∗∗ Whos Looking at Your security.txt File? ∗∗∗
---------------------------------------------
In April 2022, the RFC related to the small file “security.txt” was released. It was already popular for a while, but an RFC is always a good way to “promote” some best practices! If you're unaware of this file, it helps to communicate security contacts (email addresses, phone, ...) to people who would like to contact you to report an issue with your website or your organization.
---------------------------------------------
https://isc.sans.edu/diary/rss/28972
∗∗∗ Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts ∗∗∗
---------------------------------------------
Budget Android device models that are counterfeit versions associated with popular smartphone brands are harboring multiple trojans designed to target WhatsApp and WhatsApp Business messaging apps.
---------------------------------------------
https://thehackernews.com/2022/08/researchers-find-counterfeit-phones.html
∗∗∗ New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data ∗∗∗
---------------------------------------------
A novel data exfiltration technique has been found to leverage a covert ultrasonic channel to leak sensitive information from isolated, air-gapped computers to a nearby smartphone that doesn't even require a microphone to pick up the sound waves.
---------------------------------------------
https://thehackernews.com/2022/08/new-air-gap-attack-uses-mems-gyroscope.ht…
∗∗∗ If you havent patched Zimbra holes by now, assume youre toast ∗∗∗
---------------------------------------------
Heres how to detect an intrusion via vulnerable email systems Organizations that didnt immediately patch their Zimbra email systems should assume miscreants have already found and exploited the bugs, and should start hunting for malicious activity across IT networks, according to Uncle Sam.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/08/23/cisa_zimbra_…
∗∗∗ Ransomware Gang Leaks Data Allegedly Stolen From Greek Gas Supplier ∗∗∗
---------------------------------------------
The cybergang behind the Ragnar Locker ransomware has published more than 360 gigabytes of data allegedly stolen from Greece’s largest natural gas supplier Desfa.Established in 2007 as a subsidiary of Depa (Public Gas Corporation of Greece), Desfa operates both the country’s natural gas transmission system and its gas distribution networks.
---------------------------------------------
https://www.securityweek.com/ransomware-gang-leaks-data-allegedly-stolen-gr…
∗∗∗ Online-Marktplatz: Vorsicht, wenn Käufer:innen Links zu Kurierdiensten und Zahlungsplattformen schicken ∗∗∗
---------------------------------------------
Sie verkaufen über willhaben, laendleanzeiger.at, shpock und Co? Nehmen Sie sich vor betrügerischen Käufer:innen in Acht.
---------------------------------------------
https://www.watchlist-internet.at/news/online-marktplatz-vorsicht-wenn-kaeu…
∗∗∗ The Rise of Data Exfiltration and Why It Is a Greater Risk Than Ransomware ∗∗∗
---------------------------------------------
Threat actors have been searching for another opportunity – and found one. It's called data exfiltration, or exfil, a type of espionage causing headaches at organizations worldwide. Let's take a look.
---------------------------------------------
https://thehackernews.com/2022/08/the-rise-of-data-exfiltration-and-why.html
=====================
= Vulnerabilities =
=====================
∗∗∗ GitLab Critical Security Release: 15.3.1, 15.2.3, 15.1.5 ∗∗∗
---------------------------------------------
Today we are releasing versions 15.3.1, 15.2.3, 15.1.5 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important security fixes, and we strongly recommend that all GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version.
---------------------------------------------
https://about.gitlab.com/releases/2022/08/22/critical-security-release-gitl…
∗∗∗ SECURITY BULLETIN AVEVA-2022-005 ∗∗∗
---------------------------------------------
Multiple vulnerabilities in AVEVA Edge (formerly known as InduSoft Web Studio). Rating: High
---------------------------------------------
https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-up…
∗∗∗ [CVE-2020-2733] JD Edwards EnterpriseOne Tools admin password not adequately protected ∗∗∗
---------------------------------------------
JD Edwards EnterpriseOne Tools 9.2 or lower versions allow unauthenticated attackers to bypass the authentication and get Administrator rights on the system.
---------------------------------------------
https://redrays.io/cve-2020-2733-jd-edwards/
∗∗∗ Einbruchsgefahr: Über 80.000 Hikvision-Kameras verwundbar ∗∗∗
---------------------------------------------
Hikvision hat zwar Updates für die Kameras veröffentlicht, mehr als 2300 Firmen ignorieren diese jedoch. Angreifer könnten dadurch in deren Netze einbrechen.
---------------------------------------------
https://heise.de/-7239986
∗∗∗ Firefox 104: Verbesserungen am PDF-Viewer und Stromverbrauch-Profiler ∗∗∗
---------------------------------------------
Die neue Version von Firefox bringt neben sechs gefixten Sicherheitslücken auch Re-Snapping sowie die Möglichkeit, im PDF-Viewer zu unterschreiben.
---------------------------------------------
https://heise.de/-7240408
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Oracle (kernel and kernel-container), SUSE (bluez, gimp, rubygem-rails-html-sanitizer, systemd-presets-common-SUSE, and u-boot), and Ubuntu (libxslt).
---------------------------------------------
https://lwn.net/Articles/905730/
∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s…
∗∗∗ Security Bulletin: Multiple security vulnerabilities have been identified in dojo library shipped with IBM Security Guardium Key Lifecycle Manager (SKLM/GKLM) (CVE-2019-10785, CVE-2020-5259, CVE-2020-4051, CVE-2018-15494, CVE-2021-23450) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2021-22931) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea…
∗∗∗ Security Bulletin: IBM has announced a release for IBM Security Verify Governance in response to a security vulnerability (CVE-2022-21824) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-relea…
∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover…
∗∗∗ Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-i…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to denial of service due to Google Gson (CVE-2022-25647) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-verify-gover…
∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Apache Commons Compress ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat…
∗∗∗ D-LINK Router: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1151
∗∗∗ Trellix Data Loss Prevention: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1149
∗∗∗ xpdf: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1144
∗∗∗ PowerDNS: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1152
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 19-08-2022 18:00 − Montag 22-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ 241 npm and PyPI packages caught dropping Linux cryptominers ∗∗∗
---------------------------------------------
More than 200 malicious packages were discovered infiltrating the PyPI and npm open source registries this week. These packages are largely typosquats of widely used libraries and each one of them downloads a Bash script on Linux systems that run cryptominers.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/241-npm-and-pypi-packages-ca…
∗∗∗ New tool checks if in-app mobile browsers inject risky code on sites ∗∗∗
---------------------------------------------
A new online tool named InAppBrowser lets you analyze the behavior of in-app browsers embedded within mobile apps and determine if they inject privacy-threatening JavaScript into websites you visit.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-tool-checks-if-in-app-mo…
∗∗∗ LockBit claims ransomware attack on security giant Entrust, leaks data ∗∗∗
---------------------------------------------
The LockBit ransomware gang has claimed responsibility for the June cyberattack on digital security giant Entrust.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/lockbit-claims-ransomware-at…
∗∗∗ Multi-Faktor-Authentisierung umgehen: Malware klaut automatisiert Cookies ∗∗∗
---------------------------------------------
Um Multi-Faktor-Authentisierung umgehen zu können, klauen Kriminelle vermehrt Browser-Cookies mittels Malware.
---------------------------------------------
https://www.golem.de/news/multi-faktor-authentisierung-umgehen-malware-klau…
∗∗∗ Meet Borat RAT, a New Unique Triple Threat ∗∗∗
---------------------------------------------
Atlanta-based cyber risk intelligence company, Cyble discovered a new Remote Access Trojan (RAT) malware. What makes this particular RAT malware distinct enough to be named after the comic creation of Sacha Baron Cohen?
---------------------------------------------
https://thehackernews.com/2022/08/meet-borat-rat-new-unique-triple-threat.h…
∗∗∗ Sicherer im Internet surfen: Obacht vor gefälschten DDoS-Check-Websites ∗∗∗
---------------------------------------------
Wer im Internet ohne Nachzudenken klickt, kann sich schnell einen Trojaner einfangen. Nun warnen Sicherheitsforscher vor einer weiteren Malware-Masche.
---------------------------------------------
https://heise.de/-7238985
∗∗∗ Bösartige Apps im Google Play Store: Mehr als zwei Millionen Downloads ∗∗∗
---------------------------------------------
Bitdefender hat 35 bösartige Apps in Googles Play Store entdeckt. Sie kommen zusammen auf mehr als zwei Millionen Downloads.
---------------------------------------------
https://heise.de/-7239109
∗∗∗ Kriminelle kapern Facebook-Konten und bewerben Fake-Investment-Plattformen ∗∗∗
---------------------------------------------
Tom und zahlreiche andere Personen wurden von Claudia auf Facebook bei einem Beitrag markiert. Der Beitrag ist ein Link zu einem Artikel, wie man mit einer Investment-Plattform in kurzer Zeit viel Geld verdienen kann. Vorsicht: Dabei handelt es sich um Betrug.
---------------------------------------------
https://www.watchlist-internet.at/news/kriminelle-kapern-facebook-konten-un…
∗∗∗ Network Security Trends: Recent Exploits Observed in the Wild Include Remote Code Execution, Cross-Site Scripting and More ∗∗∗
---------------------------------------------
Recent exploits observed in the wild are highlighted based on the availability of proofs of concept, the severity of the vulnerabilities the exploits are based on and the ease of exploitation.
---------------------------------------------
https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/
∗∗∗ Hackers are using this sneaky exploit to bypass Microsofts multi-factor authentication ∗∗∗
---------------------------------------------
Attackers guessed the password of a dormant account and were able to apply their own MFA to it - providing access to the victims network.
---------------------------------------------
https://www.zdnet.com/article/hackers-are-using-this-sneaky-trick-to-exploi…
∗∗∗ Sicherheitslücken - jetzt auch in deiner Appliance ∗∗∗
---------------------------------------------
Die Entwickler des quelloffenen Frameworks YARA haben vor knapp zwei Wochen fast schon heimlich still und leise eine neue Version veröffentlicht, v4.2.3, welche in der medialen Berichterstattung beinahe untergegangen ist.
---------------------------------------------
https://cert.at/de/blog/2022/8/sicherheitslucken-jetzt-auch-in-deiner-appli…
∗∗∗ CISA Adds One Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/22/cisa-adds-one-kno…
∗∗∗ Sicherheit: Wenn plötzlich ein (Fake-)"Office 365-Paket" per Post kommt ∗∗∗
---------------------------------------------
Kleine Warnung, die sich vor allem an unerfahrene Leser dieses Blogs bzw. Nutzer richtet. Kriminelle verschicken wohl Päckchen an (vorwiegend ältere Leute), in denen vorgeblich ein Microsoft Office enthalten ist.
---------------------------------------------
https://www.borncity.com/blog/2022/08/21/sicherheit-wenn-pltzlich-ein-offic…
=====================
= Vulnerabilities =
=====================
∗∗∗ Uncovering a ChromeOS remote memory corruption vulnerability ∗∗∗
---------------------------------------------
Microsoft discovered a memory corruption vulnerability in a ChromeOS component that could have been triggered remotely, allowing attackers to perform either a denial-of-service (DoS) or, in extreme cases, remote code execution (RCE).
---------------------------------------------
https://www.microsoft.com/security/blog/2022/08/19/uncovering-a-chromeos-re…
∗∗∗ "As Nasty as Dirty Pipe" — 8 Year Old Linux Kernel Vulnerability Uncovered ∗∗∗
---------------------------------------------
Details of an eight-year-old security vulnerability in the Linux kernel have emerged that the researchers say is "as nasty as Dirty Pipe." Dubbed DirtyCred by a group of academics from Northwestern University, the security weakness exploits a previously unknown flaw (CVE-2022-2588) to escalate privileges to the maximum level.
---------------------------------------------
https://thehackernews.com/2022/08/as-nasty-as-dirty-pipe-8-year-old-linux.h…
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (jetty9 and kicad), Fedora (community-mysql and trafficserver), Gentoo (chromium, gettext, tomcat, and vim), Mageia (apache-mod_wsgi, libitrpc, libxml2, teeworlds, wavpack, and webkit2), Red Hat (podman), Slackware (vim), SUSE (java-1_8_0-openjdk, nodejs10, open-iscsi, rsync, and trivy), and Ubuntu (exim4).
---------------------------------------------
https://lwn.net/Articles/905590/
∗∗∗ YARA 4.2.3 Released, (Sat, Aug 20th) ∗∗∗
---------------------------------------------
https://isc.sans.edu/diary/rss/28964
∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2021-29891 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-…
∗∗∗ Security Bulletin: This Power System update is being released to address CVE-2019-16649 and CVE-2019-16650 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-…
∗∗∗ Security Bulletin: Vulnerabilities with OpenJDK affect IBM Cloud Object Storage Systems (August 2022v1) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-with-open…
∗∗∗ Security Bulletin: This Power System update is being released to address CVE 2022-0778 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-this-power-system-update-…
∗∗∗ Security Bulletin: A vulneraqbility in SQLite affects IBM Cloud Application Performance Managment R esponse Time Monitoring RRT Agent (CVE-2021-45346) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulneraqbility-in-sqlit…
∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 18-08-2022 18:00 − Freitag 19-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Honeypot Attack Summaries with Python ∗∗∗
---------------------------------------------
We are lucky to have a variety of tools available to enrich existing honeypot data, but also automate that enrichment. I put together a script to try and help myself achieve a simple goal.
---------------------------------------------
https://isc.sans.edu/diary/rss/28956
∗∗∗ Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads ∗∗∗
---------------------------------------------
Under normal circumstances, DDoS pages usually don’t affect users much — they simply perform a check or request a skill testing question in order to proceed to the desired webpage. However, a recent surge in JavaScript injections targeting WordPress sites has resulted in fake DDoS prevent prompts which lead victims to download remote access trojan malware.
---------------------------------------------
https://blog.sucuri.net/2022/08/fake-ddos-pages-on-wordpress-lead-to-drive-…
∗∗∗ But You Told Me You Were Safe: Attacking the Mozilla Firefox Renderer (Part 1) ∗∗∗
---------------------------------------------
At Pwn2Own Vancouver 2022, Manfred Paul compromised the Mozilla Firefox browser using a full chain exploit that broke the mold. Although his exploit used some memory corruptions, the vulnerable code was written in a memory-safe programming language: JavaScript!
---------------------------------------------
https://www.zerodayinitiative.com/blog/2022/8/17/but-you-told-me-you-were-s…
∗∗∗ Auch TikTok-App soll mit internem iPhone-Browser spionieren können ∗∗∗
---------------------------------------------
Nachdem das Problem bereits bei Facebook und Instagram aufgedeckt worden war, hat sich ein Sicherheitsforscher nun auch den chinesischen Videodienst angesehen.
---------------------------------------------
https://heise.de/-7235891
∗∗∗ Aktive Angriffe auf iPhones, iPads und Macs: Was Nutzer jetzt tun sollten ∗∗∗
---------------------------------------------
Erneut warnt Apple vor schweren Sicherheitslücken, die wohl aktiv ausgenutzt werden. Es gibt Patches, aber nicht für alle Systeme und Bugs. Ein Überblick.
---------------------------------------------
https://heise.de/-7237518
∗∗∗ Back in Black: Unlocking a LockBit 3.0 Ransomware Attack ∗∗∗
---------------------------------------------
This post explores some of the TTPs employed by a threat actor who were observed deploying LockBit 3.0 ransomware during an incident response engagement.
---------------------------------------------
https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-…
∗∗∗ SAP Vulnerability Exploited in Attacks After Details Disclosed at Hacker Conferences ∗∗∗
---------------------------------------------
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SAP vulnerability to its Known Exploited Vulnerabilities Catalog less than one week after its details were disclosed at the Black Hat and Def Con hacker conferences.
---------------------------------------------
https://www.securityweek.com/sap-vulnerability-exploited-attacks-after-deta…
∗∗∗ Fake-Shop-Alarm: getvoltplug.com hilft Ihnen nicht beim Stromsparen ∗∗∗
---------------------------------------------
In Zeiten der Energiekrise wirbt getvoltplug.com mit einem attraktiven Angebot: Ein Gerät soll Ihnen helfen bis zu 90% Ihrer Stromrechnung zu sparen. Aber Achtung! Dieses Gerät existiert gar nicht, es handelt sich um Betrug.
---------------------------------------------
https://www.watchlist-internet.at/news/fake-shop-alarm-getvoltplugcom-hilft…
∗∗∗ Wissen: Webseite als kompromittiert gemeldet? Wie geht man vor? ∗∗∗
---------------------------------------------
Wer eine Webseite betreibt, wird möglicherweise gelegentlich mit dem Problem konfrontiert, dass diese von Sicherheitsportalen oder Benutzern als "riskant" gemeldet wird. Dann stellt sich die Frage, wie man vorgehen könnte, um herauszufinden, ob dies ein Fehlalarm ist oder die Webseite kompromittiert wurde.
---------------------------------------------
https://www.borncity.com/blog/2022/08/19/wissen-webseite-als-kompromittiert…
∗∗∗ Ukraine war spotlights agriculture sectors vulnerability to cyber attack ∗∗∗
---------------------------------------------
The agriculture sector is highly vulnerable to cyber-attacks given its low downtime tolerance, insufficient cyber defenses, and far-reaching ripple effects of disruption. We assess those future threats to the agriculture section will mainly include financially motivated ransomware actors and disruptive attacks carried out by state-sponsored APTs.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/ukraine-and-fragility-of-agricult…
∗∗∗ Business Email Compromise Attack Tactics ∗∗∗
---------------------------------------------
Is BEC more damaging than ransomware? What tactics are BEC actors using? How can organizations bolster their defenses?
---------------------------------------------
https://www.trendmicro.com/en_us/ciso/22/h/business-email-compromise-bec-at…
=====================
= Vulnerabilities =
=====================
∗∗∗ ZDI-22-1076: PDF-XChange Editor submitForm Out-Of-Bounds Read Remote Code Execution Vulnerability ∗∗∗
---------------------------------------------
This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1076/
∗∗∗ DSA-2022-241: Dell EMC PowerFlex Rack Security Update for Multiple Third-Party Component Vulnerabilities ∗∗∗
---------------------------------------------
Dell EMC PowerFlex Rack remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
---------------------------------------------
https://www.dell.com/support/kbdoc/de-at/000202540/dsa-2022-241-dell-emc-po…
∗∗∗ Virenscanner: Schwachstelle von McAfee erleichtert Angreifern das Einnisten ∗∗∗
---------------------------------------------
Angreifer hätten aufgrund einer Sicherheitslücke im Virenschutz McAfee Security Scan Plus ihre Rechte erhöhen können. Das erleichterte das Einnisten im System.
---------------------------------------------
https://heise.de/-7235809
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (ruby-tzinfo), Mageia (nvidia-current and nvidia390), SUSE (python-PyYAML, ucode-intel, and zlib), and Ubuntu (linux-aws, postgresql-10, postgresql-12, postgresql-14, and rsync).
---------------------------------------------
https://lwn.net/Articles/905265/
∗∗∗ vim: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1076
∗∗∗ Security Advisory - JAD-AL50: Permission Bypass Vulnerability in Huawei Products ∗∗∗
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20220819-…
∗∗∗ Security Bulletin: IBM MQ Explorer is vulnerable to an XML External Entity Injection (XXE) attack (CVE-2022-22489) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-explorer-is-vulner…
∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s…
∗∗∗ Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to loss of confidentiality due to CVE-2022-35948 and CVE-2022-35949 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-…
∗∗∗ Security Bulletin: IBM Spectrum Discover is vulnerable to Docker CLI (CVE-2021-41092) and Apache Log4j (CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) weaknesses ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-discover-is-…
∗∗∗ Security Bulletin: IBM Spectrum Control is vulnerable to multiple weaknesses related to IBM WebSphere Application Server Liberty and OpenSSL (CVE-2022-2068, CVE-2022-2097, CVE-2022-22475) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-spectrum-control-is-v…
∗∗∗ Security Bulletin: IBM DataPower Gateway affected by vulnerabilities in ICU [CVE-2017-14952 and CVE-2020-10531] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-aff…
∗∗∗ Security Bulletin: Vulnerability in SANNav Software used by IBM b-type SAN directors and switches. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-sannav-s…
∗∗∗ Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining . CVE-2022-2048 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-eclipse-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 17-08-2022 18:00 − Donnerstag 18-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ BlackByte ransomware gang is back with new extortion tactics ∗∗∗
---------------------------------------------
The BlackByte ransomware is back with version 2.0 of their operation, including a new data leak site utilizing new extortion techniques borrowed from LockBit.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/blackbyte-ransomware-gang-is…
∗∗∗ Microsoft Sysmon can now block malicious EXEs from being created ∗∗∗
---------------------------------------------
Microsoft has released Sysmon 14 with a new FileBlockExecutable option that lets you block the creation of malicious executables, such as EXE, DLL, and SYS files, for better protection against malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-can-now-bl…
∗∗∗ Schwere Lücken: Vorsicht bei VPN-Nutzung auf Apple-Geräten ∗∗∗
---------------------------------------------
Wer über Apples iOS einen VPN-Dienst nutzt, ist nicht so sicher unterwegs, wie man es eigentlich vermuten würde.
---------------------------------------------
https://futurezone.at/produkte/schwere-luecken-vorsicht-vpn-apple-iphone-ip…
∗∗∗ Clop: Ransomwaregruppe erpresst wohl falsches Wasserwerk ∗∗∗
---------------------------------------------
Eine Ransomwaregruppe hat sich nach einem Hack eines Wasserversorgungsunternehmens in Großbritannien offenbar vertan und ein anderes Werk erpresst.
---------------------------------------------
https://www.golem.de/news/clop-ransomwaregruppe-erpresst-scheinbar-falsches…
∗∗∗ Hacking: Der Bad-USB-Stick Rubber Ducky wird noch gefährlicher ∗∗∗
---------------------------------------------
Mit einer neuen Version des Bad-USB-Sticks Rubber Ducky lassen sich Rechner noch leichter angreifen und neuerdings auch heimlich Daten ausleiten.
---------------------------------------------
https://www.golem.de/news/hacking-der-bad-usb-stick-rubber-ducky-wird-noch-…
∗∗∗ Hackers Using Bumblebee Loader to Compromise Active Directory Services ∗∗∗
---------------------------------------------
The malware loader known as Bumblebee is being increasingly co-opted by threat actors associated with BazarLoader, TrickBot, and IcedID in their campaigns to breach target networks for post-exploitation activities.
---------------------------------------------
https://thehackernews.com/2022/08/hackers-using-bumblebee-loader-to.html
∗∗∗ Deluge of of entries to Spamhaus blocklists includes various household names ∗∗∗
---------------------------------------------
Nastymail tracking service blames sloppy sending practices for swelling lists of dangerous mailers Spam-tracking service Spamhaus reported Tuesday that some of the worlds biggest brands are getting loose with their email practices, causing its spam blocklists (SBL) to swell significantly.
---------------------------------------------
https://go.theregister.com/feed/www.theregister.com/2022/08/18/deluge_of_en…
∗∗∗ Real-Time Behavior-Based Detection on Android Reveals Dozens of Malicious Apps on Google Play Store ∗∗∗
---------------------------------------------
Cybersecurity researchers identify 35 apps, many downloaded over 100,000 times, that have been serving up malware to millions of Android users.
---------------------------------------------
https://www.bitdefender.com/blog/labs/real-time-behavior-based-detection-on…
∗∗∗ PayPal Phishing Scam Uses Invoices Sent Via PayPal ∗∗∗
---------------------------------------------
Scammers are using invoices sent through PayPal.com to trick recipients into calling a number to dispute a pending charge.
---------------------------------------------
https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent…
∗∗∗ ASEC Weekly Malware Statistics (August 8th, 2022 – August 14th, 2022) ∗∗∗
---------------------------------------------
This post will list weekly statistics collected from August 8th, 2022 (Monday) to August 14th, 2022 (Sunday).
---------------------------------------------
https://asec.ahnlab.com/en/37837/
∗∗∗ Analyzing the Hidden Danger of Environment Variables for Keeping Secrets ∗∗∗
---------------------------------------------
While DevOps practitioners use environment variables to regularly keep secrets in applications, these could be conveniently abused by cybercriminals for their malicious activities, as our analysis shows.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/h/analyzing-hidden-danger-of-e…
=====================
= Vulnerabilities =
=====================
∗∗∗ Aktive Exploits: macOS 12.5.1, iOS 15.6.1 und iPadOS 15.6.1 verfügbar ∗∗∗
---------------------------------------------
Apple legt nochmals Aktualisierungen für seine 2021er Betriebssysteme vor. Grund sind wichtige Sicherheitsfixes. Für die Apple Watch kommt ein Extra-Update.
---------------------------------------------
https://heise.de/-7223549
∗∗∗ Cisco Secure Web Appliance Privilege Escalation Vulnerability ∗∗∗
---------------------------------------------
A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root.
---------------------------------------------
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco…
∗∗∗ Webkonferenzen: Teils kritische Lücken in Zoom ∗∗∗
---------------------------------------------
In mehreren Zoom-Varianten stecken teilweise kritische Sicherheitslücken. Updates sollen sie abdichten. Mac-Nutzer müssen erneut aktualisieren.
---------------------------------------------
https://heise.de/-7223873
∗∗∗ TP-Link: Schadcode-Schmuggel durch Sicherheitslücke in Routern ∗∗∗
---------------------------------------------
Sicherheitsforscher aus Vietnam haben im WLAN-Router TL-WR841N von TP-Link einen kritischen Fehler festgestellt, der Code-Ausführung auf dem Gerät ermöglicht.
---------------------------------------------
https://heise.de/-7224392
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, epiphany-browser, freecad, and schroot), Fedora (freeciv, microcode_ctl, qemu, and rsync), Oracle (httpd), SUSE (aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures, python-coverage, python-oniconfig, python-unittest-mixins, bluez, curl, gnutls, kernel, ntfs-3g_ntfsprogs, podman, and ucode-intel), and Ubuntu (zlib).
---------------------------------------------
https://lwn.net/Articles/905072/
∗∗∗ Apache ActiveMQ Artemis: Schwachstelle ermöglicht Darstellen falscher Informationen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache ActiveMQ Artemis ausnutzen, um falsche Informationen darzustellen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1069
∗∗∗ TypeORM 0.3.7 Information Disclosure ∗∗∗
---------------------------------------------
TypeORM 0.3.7 Information Disclosure Risk: I found what I think is a vulnerability in the latest typeorm 0.3.7.
---------------------------------------------
https://cxsecurity.com/issue/WLB-2022080057
∗∗∗ DSA-2022-238: Dell Client BIOS Security Update for Multiple Tianocore EDK2 Vulnerabilities ∗∗∗
---------------------------------------------
https://www.dell.com/support/kbdoc/de-at/000202475/dsa-2022-238-dell-client…
∗∗∗ Security Bulletin: Vulnerability in Moment affects IBM Process Mining . CVE-2022-31129 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-moment-a…
∗∗∗ Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Apr 2022 – Includes Oracle April 2022 CPU (minus CVE-2022-21426)affects IBM Security Verify Governance, Identity Manager virtual appliance component ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sdk-java-technology-e…
∗∗∗ Security Bulletin: Vulnerability in FasterXML jackson-databind affects IBM Process Mining . CVE-2020-36518 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-fasterxm…
∗∗∗ Security Bulletin: AIX is vulnerable to arbitrary command execution (CVE-2022-1292 and CVE-2022-2068) or an attacker may obtain sensitive information (CVE-2022-2097) due to OpenSSL ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-arbi…
∗∗∗ Security Bulletin: Multiple vulnerabilities due to OpenSSL and Node js which affect IBM App Connect Enterprise and IBM Integration Bus ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: Multiple Vulnerabilities in Node.js affect IBM Cloud Pak System ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-an-eclipse-jetty-vulnerab…
∗∗∗ Security Bulletin: Samba for IBM i is vulnerable to attacker obtaining sensitive information due to a memory leak with SMB1 requests (CVE-2022-32742) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-samba-for-ibm-i-is-vulner…
∗∗∗ Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining . CVE-2020-36518 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-eclipse-…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 16-08-2022 18:00 − Mittwoch 17-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Malware devs already bypassed Android 13s new security feature ∗∗∗
---------------------------------------------
Android malware developers are already adjusting their tactics to bypass a new Restricted settings security feature introduced by Google in the newly released Android 13.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/malware-devs-already-bypasse…
∗∗∗ SocGholish: 5+ Years of Massive Website Infections ∗∗∗
---------------------------------------------
Earlier this June, we shared information about the ongoing NDSW/NDSX malware campaign which has been one of the most common website infections detected and cleaned by our remediation team in the last few years.This NDSW/NDSX malware — also referred to as FakeUpdates or SocGholish by other research groups — is responsible for redirecting site visitors to malicious pages designed to trick victims into loading and installing fake browser updates.
---------------------------------------------
https://blog.sucuri.net/2022/08/socgholish-5-years-of-massive-website-infec…
∗∗∗ RubyGems now requires multi-factor auth for top package maintainers ∗∗∗
---------------------------------------------
Sign-on you crazy diamond: RubyGems.org, the Ruby programming communitys software package registry, now requires maintainers of popular "gems" to secure their accounts using multi-factor authentication (MFA).
---------------------------------------------
https://www.theregister.com/2022/08/16/rubygems_package_registry_mfa/
∗∗∗ Phishing Site used to Spread Typhon Stealer ∗∗∗
---------------------------------------------
During a routine threat hunting exercise, Cyble Research Labs (CRL) came across a Twitter post wherein researchers mentioned a URL that hosts a Windows executable payload with the name systemupdate.exe.
---------------------------------------------
https://blog.cyble.com/2022/08/16/phishing-site-used-to-spread-typhon-steal…
∗∗∗ Cisco-ASA-Firewalls hacken per Metasploit und Open-Source-Tools ∗∗∗
---------------------------------------------
Ein Forscher hat zahlreiche Tools und Metasploit-Module zum Hacken von Cisco-Firewalls veröffentlicht. Ein aktuelles Update hilft nicht gegen eines der Tools.
---------------------------------------------
https://heise.de/-7222976
∗∗∗ Achtung: Disney+ Phishing-Mails im Umlauf! ∗∗∗
---------------------------------------------
Besitzen Sie ein Disney+ Konto? Dann nehmen Sie sich vor betrügerischen Phishing-Nachrichten in Acht. Kriminelle versenden massenhaft E-Mails, in denen behauptet wird, Sie müssten Ihre Zahlungsinformationen aktualisieren, da Ihr Abonnement abgelaufen sei.
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-disney-phishing-mails-im-uml…
∗∗∗ How a spoofed email passed the SPF check and landed in my inbox ∗∗∗
---------------------------------------------
The Sender Policy Framework can’t help prevent spam and phishing if you allow billions of IP addresses to send as your domain.
---------------------------------------------
https://www.welivesecurity.com/2022/08/16/spoofed-email-passed-spf-check-in…
∗∗∗ Los VMware, noch einmal! ∗∗∗
---------------------------------------------
In den Monaten April und Mai dieses Jahres veröffentlichte VMware zwei Security Advisories (VMSA-2022-0011 & VMSA-2022-0014) zu schwerwiegenden Sicherheitslücken in mehreren Produkten, zu denen teilweise bereits Patches zur Verfügung standen. Besagte Sicherheitsaktualisierungen wurden daraufhin von verschiedenen Bedrohungsakteuren untersucht und dienten als Basis für erste Exploits, welche wiederum bereits binnen 48 Stunden nach dem Erscheinen der Advisories genutzt wurden um großflächig Systeme zu kompromittieren.
---------------------------------------------
https://cert.at/de/blog/2022/8/los-vmware-machs-nochmal
∗∗∗ GCP, therefore IAM ∗∗∗
---------------------------------------------
Managing access authorization for your cloud assets is a challenging task. Certainly, when dealing with multiple public/private resources, environments, services, providers, and users.
---------------------------------------------
https://blog.checkpoint.com/2022/08/17/gcp-therefore-iam/
∗∗∗ Vulnerability Spotlight: Vulnerabilities in WWBN AVideo web app could lead to command injection, authentication bypass ∗∗∗
---------------------------------------------
Cisco Talos recently discovered multiple vulnerabilities in the WWBN AVideo web application that could allow an attacker to carry out a wide range of malicious actions, including command injection and authentication bypass.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/vuln-spotlight-wwbn-avideo-stream…
∗∗∗ Top Five Patch Management & Process Best Practices ∗∗∗
---------------------------------------------
Explore the top patch management best practices to mitigate the growing threat of vulnerability exploits in your organization.
---------------------------------------------
https://www.trendmicro.com/en_us/ciso/22/h/patch-management-process-best-pr…
=====================
= Vulnerabilities =
=====================
∗∗∗ RTLS systems vulnerable to MiTM attacks, location manipulation ∗∗∗
---------------------------------------------
Security researchers have uncovered multiple vulnerabilities impacting UWB (ultra-wideband) RTLS (real-time locating systems), enabling threat actors to conduct man-in-the-middle attacks and manipulate tag geo-location data.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/rtls-systems-vulnerable-to-m…
∗∗∗ IBM Security Bulletins 2022-08-16 ∗∗∗
---------------------------------------------
IBM Cloud Pak System, BM Security Verify Governance, IBM Sterling Connect:Direct for Microsoft Windows, IBM InfoSphere Identity Insight, PowerVC.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Google Chrome-Update: Exploit im Umlauf ∗∗∗
---------------------------------------------
Google hat in Chrome mehrere Sicherheitslücken gestopft. Mindestens eine davon gilt dem Hersteller als kritisch. Für eine weitere kursiert bereits ein Exploit.
---------------------------------------------
https://heise.de/-7222389
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (epiphany-browser, net-snmp, webkit2gtk, and wpewebkit), Fedora (python-yara and yara), Red Hat (kernel and kpatch-patch), SUSE (ceph, compat-openssl098, java-1_8_0-openjdk, kernel, python-Twisted, rsync, and webkit2gtk3), and Ubuntu (pyjwt and unbound).
---------------------------------------------
https://lwn.net/Articles/904955/
∗∗∗ Quarterly Security Patches Released for Splunk Enterprise ∗∗∗
---------------------------------------------
Splunk this week announced the release of a new set of quarterly patches, to address multiple vulnerabilities in Splunk Enterprise.
---------------------------------------------
https://www.securityweek.com/quarterly-security-patches-released-splunk-ent…
∗∗∗ WAGO: Multiple Products Series affected by multiple CODESYS vulnerabilities ∗∗∗
---------------------------------------------
VDE-2022-031Vendor(s)WAGO GmbH & Co. KGProduct(s) Article No° Product Name Affected Version(s) 752-8303/8000-0002EC300 750-8100/xxx-xxxPFC 100 750-8102/xxx-xxxPFC 100 750-8101/xxx-xxxPFC 100 750-8217/xxx-xxxPFC 200 750-8216/xxx-xxxPFC 200 750-8215/xxx-xxxPFC 200 750-8214/xxx-xxxPFC 200 750-8213/xxx-xxxPFC 200 750-8212/xxx-xxxPFC 200 750-8211/xxx-xxxPFC 200 750-8210/xxx-xxxPFC 200 750-8207/xxx-xxxPFC 200 750-8206/xxx-xxxPFC 200 750-8204/xxx-xxxPFC 200 750-8203/xxx-xxxPFC 200
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-031/
∗∗∗ WAGO: Multiple product series affected by multiple CODESYS vulnerabilities ∗∗∗
---------------------------------------------
VDE-2022-035Vendor(s)WAGO GmbH & Co. KGProduct(s) Article No° Product Name Affected Version(s) 751-9301CC100 752-8303/8000-0002EC300 750-8100/xxx-xxxPFC 100 750-8102/xxx-xxxPFC 100 750-8101/xxx-xxxPFC 100 750-8216/xxx-xxxPFC 200 750-8215/xxx-xxxPFC 200 750-8214/xxx-xxxPFC 200 750-8213/xxx-xxxPFC 200 750-8212/xxx-xxxPFC 200 750-8211/xxx-xxxPFC 200 750-8210/xxx-xxxPFC 200 750-8207/xxx-xxxPFC 200 750-8206/xxx-xxxPFC 200 750-8204/xxx-xxxPFC 200 750-8203/xxx-xxxPFC 200 750-8202/xxx-xxxPFC
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-035/
∗∗∗ Microsoft Windows Defender: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1053
∗∗∗ Ansible Automation Platform: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1058
∗∗∗ Delta Industrial Automation DRAS ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-03
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 12-08-2022 18:00 − Dienstag 16-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ SOVA malware adds ransomware feature to encrypt Android devices ∗∗∗
---------------------------------------------
The SOVA Android banking trojan continues to evolve with new features, code improvements, and the addition of a new ransomware feature that encrypts files on mobile devices.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/sova-malware-adds-ransomware…
∗∗∗ John Deere: Hacker präsentiert Jailbreak für Traktoren ∗∗∗
---------------------------------------------
Nicht nur Telefonhersteller vernageln ihre Geräte. Der Hacker Sick Codes zeigt, wie Root-Zugriff auf die Systeme der Traktoren zu erlangen ist.
---------------------------------------------
https://www.golem.de/news/john-deere-ein-hacker-praesentiert-ein-jailbreak-…
∗∗∗ Threat in your browser: what dangers innocent-looking extensions hold for users ∗∗∗
---------------------------------------------
In this research, we observed various types of threats that mimic useful web browser extensions, and the number of users attacked by them.
---------------------------------------------
https://securelist.com/threat-in-your-browser-extensions/107181/
∗∗∗ Two more malicious Python packages in the PyPI ∗∗∗
---------------------------------------------
We used our internal automated system for monitoring open-source repositories and discovered two other malicious Python packages in the PyPI.
---------------------------------------------
https://securelist.com/two-more-malicious-python-packages-in-the-pypi/10721…
∗∗∗ Disrupting SEABORGIUM’s ongoing phishing operations ∗∗∗
---------------------------------------------
The Microsoft Threat Intelligence Center (MSTIC) has observed and taken actions to disrupt campaigns launched by SEABORGIUM in campaigns involve persistent phishing and credential theft campaigns leading to intrusions and data theft.
---------------------------------------------
https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-o…
∗∗∗ Realtek SDK SIP ALG Vulnerability: A Big Deal, but not much you can do about it. CVE 2022-27255, (Sun, Aug 14th) ∗∗∗
---------------------------------------------
On Friday, Octavio Gianatiempo & Octavio Galland released details about a vulnerability in Realtek's eCos SDK.
---------------------------------------------
https://isc.sans.edu/diary/rss/28940
∗∗∗ Finanzsanierungen nicht mit Krediten verwechseln! ∗∗∗
---------------------------------------------
Kreditsuchende stoßen bei ihren Recherchen immer wieder auf Werbeanzeigen für Finanzsanierungsangebote. Achtung: Bei Finanzsanierungsangeboten handelt es sich um keine Kredite, sondern um eine sogenannte Schuldenregulierung. Diese ist in Österreich kostenlos erhältlich, weshalb bei kostenpflichtigen Angeboten zu Abstand zu raten ist!
---------------------------------------------
https://www.watchlist-internet.at/news/finanzsanierungen-nicht-mit-krediten…
∗∗∗ Typosquatting Campaign Targeting Python’s Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities ∗∗∗
---------------------------------------------
On Saturday, August 13th, Checkmarx’s Software Supply Chain Security Typosquatting engine detected a large-scale attack on the Python ecosystem with multi-stage persistent malware.
---------------------------------------------
https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-pac…
∗∗∗ What Exposed OPA Servers Can Tell You About Your Applications ∗∗∗
---------------------------------------------
This blog entry discusses what an OPA is and what it’s for, what we’ve discovered after identifying 389 exposed OPA servers via Shodan, and how exposed OPAs can negatively impact your applications’ overall security.
---------------------------------------------
https://www.trendmicro.com/en_us/research/22/h/what-exposed-opa-servers-can…
=====================
= Vulnerabilities =
=====================
∗∗∗ Evil PLC Attack: Using a Controller as Predator Rather than Prey ∗∗∗
---------------------------------------------
Team82 has developed a novel attack that weaponizes programmable logic controllers (PLCs) in order to exploit engineering workstations and further invade OT and enterprise networks.
---------------------------------------------
https://claroty.com/team82/blog/evil-plc-attack-using-a-controller-as-preda…
∗∗∗ Process injection: breaking all macOS security layers with a single vulnerability ∗∗∗
---------------------------------------------
In this post, we will first describe what process injection is, then the details of this vulnerability and finally how we abused it.
---------------------------------------------
https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-ma…
∗∗∗ Database Integrity Vulnerabilities in Boeing’s Onboard Performance Tool ∗∗∗
---------------------------------------------
Security gaps in older, unprotected Windows desktop versions of Boeing’s Onboard Performance Tool (OPT) could make certain Electronic Flight Bags (EFB) more susceptible to attack.
---------------------------------------------
https://www.pentestpartners.com/security-blog/database-integrity-vulnerabil…
∗∗∗ IBM Security Bulletins 2022-08-15 ∗∗∗
---------------------------------------------
IBM Sterling B2B Integrator, IBM SPSS Modeler, IBM Cloud Pak System, IBM Sterling File Gateway
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Zoom für macOS: Update-Funktion reißt Sicherheitslücke ∗∗∗
---------------------------------------------
Die populäre Videokonferenz-App hat auf dem Mac einmal mehr ein Security-Problem. Nutzer sollten dringend aktualisieren. Perfekt ist der Fix noch nicht.
---------------------------------------------
https://heise.de/-7219942
∗∗∗ DefCon 30: Unsicherheiten durch Microsoft in UEFI Secure Boot ∗∗∗
---------------------------------------------
Microsofts ausschweifende Signier-Praxis produziert Schwachstellen der Secure-Boot-Umgebung. Das kritisierten Sicherheitsforscher auf der DefCon 30.
---------------------------------------------
https://heise.de/-7221728
∗∗∗ Fernwartung: Kritische Sicherheitslücken in HPE Integrated Lights-Out (iLO) ∗∗∗
---------------------------------------------
Die Fernverwaltung HPE Integrated Lights-Out ermöglichte Angreifern das Einschmuggeln von Schadcode. Aktualisierte Software behebt die Fehler.
---------------------------------------------
https://heise.de/-7219923
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (trafficserver), Fedora (freeciv, gnutls, kernel, libldb, mingw-gdk-pixbuf, owncloud-client, rust-ffsend, samba, thunderbird, and zlib), Gentoo (apache, binutils, chromium, glibc, gstreamer, libarchive, libebml, nokogiri, puma, qemu, xen, and xterm), Mageia (golang, libtiff, poppler, python-django, and ruby-sinatra), Red Hat (.NET 6.0 and .NET Core 3.1), SUSE (chromium, cifs-utils, kernel, open-iscsi, and trousers), and Ubuntu (webkit2gtk).
---------------------------------------------
https://lwn.net/Articles/904741/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (kernel), Debian (kernel), Fedora (webkit2gtk3), Oracle (.NET 6.0, .NET Core 3.1, kernel, and kernel-container), Slackware (rsync), and SUSE (canna, ceph, chromium, curl, kernel, opera, python-Twisted, and seamonkey).
---------------------------------------------
https://lwn.net/Articles/904842/
∗∗∗ Vulnerability Spotlight: Three vulnerabilities in HDF5 file format could lead to remote code execution ∗∗∗
---------------------------------------------
Cisco Talos recently discovered three vulnerabilities in a library that works with the HDF5 file format that could allow an attacker to execute remote code on a targeted device.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/vuln-spotlight-hdf5-library.html
∗∗∗ TRUMPF: Products prone to Unified Automation vulnerabilities ∗∗∗
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-034/
∗∗∗ Google Android: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1042
∗∗∗ CoreDNS: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1047
∗∗∗ ESRI ArcGIS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1046
∗∗∗ npm: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1049
∗∗∗ vim: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1048
∗∗∗ Yokogawa CENTUM Controller FCS ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-01
∗∗∗ LS ELECTRIC PLC and XG5000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-02
∗∗∗ Softing Secure Integration Server ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-04
∗∗∗ B&R Industrial Automation Automation Studio 4 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-05
∗∗∗ Emerson Proficy Machine Edition ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-06
∗∗∗ Sequi PortBloque S ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-228-07
∗∗∗ Two DoS vulnerabilities eliminated from Mitsubishi industrial controllers ∗∗∗
---------------------------------------------
https://www.ptsecurity.com/ww-en/about/news/two-dos-vulnerabilities-elimina…
∗∗∗ Multiple Vulnerabilities in Samba ∗∗∗
---------------------------------------------
https://www.qnap.com/en-us/security-advisory/QSA-22-22
∗∗∗ Multiple Vulnerabilities in Apache HTTP Server ∗∗∗
---------------------------------------------
https://www.qnap.com/en-us/security-advisory/QSA-22-23
∗∗∗ Remote Support Authentication Vulnerability in IBM Spectrum Virtualize and Lenovo Storage V Series ∗∗∗
---------------------------------------------
http://support.lenovo.com/product_security/PS500514-REMOTE-SUPPORT-AUTHENTI…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 11-08-2022 18:00 − Freitag 12-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ I’m a security reporter and got fooled by a blatant phish ∗∗∗
---------------------------------------------
Think youre too smart to be fooled by a phisher? Think again.
---------------------------------------------
https://arstechnica.com/?p=1873356
∗∗∗ The Importance of Website Logs ∗∗∗
---------------------------------------------
In this post, we’ll explain why logs are so important and help you understand how to use website logs to level up your security and maintain compliance.
---------------------------------------------
https://blog.sucuri.net/2022/08/importance-of-website-logs-for-security.html
∗∗∗ Conti Cybercrime Cartel Using BazarCall Phishing Attacks as Initial Attack Vector ∗∗∗
---------------------------------------------
A trio of offshoots from the notorious Conti cybercrime cartel have resorted to the technique of call-back phishing as an initial access vector to breach targeted networks.
---------------------------------------------
https://thehackernews.com/2022/08/conti-cybercrime-cartel-using-bazarcall.h…
∗∗∗ Sloppy Software Patches Are a ‘Disturbing Trend’ ∗∗∗
---------------------------------------------
The Zero Day Initiative has found a concerning uptick in security updates that fail to fix vulnerabilities.
---------------------------------------------
https://www.wired.com/story/software-patch-flaw-uptick-zdi/
∗∗∗ Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike ∗∗∗
---------------------------------------------
Since 2019, threat actor Monster Libra (also known as TA551 or Shathak) has pushed different families of malware.
---------------------------------------------
https://isc.sans.edu/diary/rss/28934
∗∗∗ Details zum Einbruch bei Cisco – Einfallstor persönliches Google-Konto ∗∗∗
---------------------------------------------
Cisco wurde Opfer eines Cyber-Angriffs, bei dem Kriminelle Zugriff auf das interne Netz erlangten. Jetzt veröffentlicht das Unternehmen Details dazu.
---------------------------------------------
https://heise.de/-7218236
∗∗∗ Input-Device-Monitoring bei Windows: Finde die Wanze! ∗∗∗
---------------------------------------------
Für moderne Malware, die im Userland agiert, sind forensische Aufspürmethoden für Abhörversuche quasi nicht existent. Ein Forscherteam will Abhilfe schaffen.
---------------------------------------------
https://heise.de/-7218864
∗∗∗ O’Neill-Kleidung online kaufen? Nicht auf backmanboats.com! ∗∗∗
---------------------------------------------
Wir erhalten immer wieder Meldungen zu Online-Shops, die entweder gar keine Ware verschicken oder etwas, das nichts mit der Produktbeschreibung zu tun hat. Haben Sie ein teures Marken T-Shirt bestellt, aber eine billige Kopie erhalten? Solche Online-Shops nennt man Markenfälscher, da sie angeben, bekannte Marken wie O'Neill zu verkaufen.
---------------------------------------------
https://www.watchlist-internet.at/news/oneill-kleidung-online-kaufen-nicht-…
∗∗∗ CISA Adds Two Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/11/cisa-adds-two-kno…
∗∗∗ Windows Sicherheitsupdate KB5012170 für Secure Boot DBX (9. August 2022) ∗∗∗
---------------------------------------------
Noch ein kurzer Nachtrag vom Patchday, 9. August 2022. Dort wurde auch ein Sicherheitsupdate für das Secure Boot Modul durch Microsoft bereitgestellt.
---------------------------------------------
https://www.borncity.com/blog/2022/08/12/windows-sicherheitsupdate-kb501217…
=====================
= Vulnerabilities =
=====================
∗∗∗ Researchers Find Vulnerability in Software Underlying Discord, Microsoft Teams, and Other Apps ∗∗∗
---------------------------------------------
The popular apps used by millions of users all run the same software, called Electron.
---------------------------------------------
https://www.vice.com/en/article/m7gb7y/researchers-find-vulnerability-in-so…
∗∗∗ Groupware Zimbra "trivial angreifbar" – Admins sollten schnell updaten ∗∗∗
---------------------------------------------
Mit der Verkettung zweier Security-Bugs in der Groupware haben Angreifer seit Ende Juni tausende Zimbra-Installationen übernommen.
---------------------------------------------
https://heise.de/-7218354
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gnutls28, libtirpc, postgresql-11, and samba), Fedora (microcode_ctl, wpebackend-fdo, and xen), Oracle (.NET 6.0, galera, mariadb, and mysql-selinux, and kernel), SUSE (dbus-1 and python-numpy), and Ubuntu (booth).
---------------------------------------------
https://lwn.net/Articles/904549/
∗∗∗ OT Security Firm Warns of Safety Risks Posed by Alerton Building System Vulnerabilities ∗∗∗
---------------------------------------------
OT and IoT cybersecurity company SCADAfence has discovered potentially serious vulnerabilities in a widely used building management system made by Alerton, a brand of industrial giant Honeywell.
---------------------------------------------
https://www.securityweek.com/ot-security-firm-warns-safety-risks-posed-aler…
∗∗∗ Realtek SDK Vulnerability Exposes Routers From Many Vendors to Remote Attacks ∗∗∗
---------------------------------------------
A serious vulnerability affecting the eCos SDK made by Taiwanese semiconductor company Realtek could expose the networking devices of many vendors to remote attacks.
---------------------------------------------
https://www.securityweek.com/realtek-sdk-vulnerability-exposes-routers-many…
∗∗∗ Bitdefender: Schwachstelle in Device42 ∗∗∗
---------------------------------------------
Wegen einer mittlerweile behobenen Schwachstelle in Device42 gibt Bitdefender eine Empfehlung zum Update auf die Version 18.01.00 von Device42.
---------------------------------------------
https://www.zdnet.de/88402845/bitdefender-schwachstelle-in-device42/
∗∗∗ Vulnerabilities on Xiaomi’s mobile payment mechanism which could allow forged transactions : A Check Point Research analysis ∗∗∗
---------------------------------------------
Check Point Research (CPR) analyzed the payment system built into Xiaomi smartphones powered by MediaTek chips CPR found vulnerabilities that could allow forging of payment and disabling the payment system directly.
---------------------------------------------
https://blog.checkpoint.com/2022/08/12/vulnerabilities-on-xiaomis-mobile-pa…
∗∗∗ VU#309662: Signed third party UEFI bootloaders are vulnerable to Secure Boot bypass ∗∗∗
---------------------------------------------
https://kb.cert.org/vuls/id/309662
∗∗∗ Security Bulletin: Watson Knowledge Catalog InstaScan is vulnerable to an XML External Entity (XXE) Injection vulnerability due to IBM WebSphere Application Server Liberty ( CVE-2021-20492 ) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-watson-knowledge-catalog-…
∗∗∗ Security Bulletin: IBM Sterling Connect:Direct File Agent is vulnerable to remote code execution due to Apache Commons Configuration (CVE-2022-33980) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec…
∗∗∗ Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2022 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Operations Dashboard is vulnerable to remote connection exploit by Go CVE-2022-30629 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-operations-dashboard-is-v…
∗∗∗ Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote code execution due to ejs [CVE-2022-29078] ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-automation-assets-in-ibm-…
∗∗∗ Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to a remote authenticated attacker due to Node.js (CVE-2022-29244, CVE-2022-33987) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-app-connect-enterpris…
∗∗∗ Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthenticated attacker to cause a denial of service or low integrity impact due to multiple vulnerabilities. ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java…
∗∗∗ PostgreSQL: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1013
∗∗∗ Emerson ROC800, ROC800L and DL8000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-223-04
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 10-08-2022 18:00 − Donnerstag 11-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ OpenTIP, command line edition ∗∗∗
---------------------------------------------
We released Python-based command line tools for our OpenTIP service that also implement a client class that you can reuse in your own tools.
---------------------------------------------
https://securelist.com/opentip-command-line-edition/107109/
∗∗∗ InfoStealer Script Based on Curl and NSudo, (Thu, Aug 11th) ∗∗∗
---------------------------------------------
If sudo is a well known tool used daily by most UNIX system administrators, NSudo remains less below the radar. This is a tool running on Microsoft Windows which allows you to execute processes with different access tokens and privileges like System, TrustedInstaller and CurrentUser.
---------------------------------------------
https://isc.sans.edu/diary/rss/28932
∗∗∗ capa v4: casting a wider .NET ∗∗∗
---------------------------------------------
We are excited to announce version 4.0 of capa with support for analyzing .NET executables. This open-source tool automatically identifies capabilities in programs using an extensible rule set. The tool supports both malware triage and deep dive reverse engineering.
---------------------------------------------
https://www.mandiant.com/resources/capa-v4-casting-wider-net
∗∗∗ Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study ∗∗∗
---------------------------------------------
A recently uncovered malware sample dubbed ‘Saitama’ was uncovered by security firm Malwarebytes in a weaponized document, possibly targeted towards the Jordan government. This Saitama implant uses DNS as its sole Command and Control channel and utilizes long sleep times and (sub)domain randomization to evade detection.
---------------------------------------------
https://research.nccgroup.com/2022/08/11/detecting-dns-implants-old-kitten-…
∗∗∗ Palo Alto Networks Firewalls Targeted for Reflected, Amplified DDoS Attacks ∗∗∗
---------------------------------------------
Palo Alto Networks is working on fixes for a reflected amplification denial-of-service (DoS) vulnerability that impacts PAN-OS, the platform powering its next-gen firewalls.
---------------------------------------------
https://www.securityweek.com/palo-alto-networks-firewalls-targeted-reflecte…
∗∗∗ Years after claiming DogWalk wasn’t a vulnerability, Microsoft confirms flaw is being exploited and issues patch ∗∗∗
---------------------------------------------
This week Microsoft finally released a patch for a zero-day security flaw being exploited by hackers, that the company had claimed since 2019 was not actually a vulnerability.
---------------------------------------------
https://www.bitdefender.com/blog/hotforsecurity/years-after-claiming-dogwal…
∗∗∗ BlueSky Ransomware: Fast Encryption via Multithreading ∗∗∗
---------------------------------------------
BlueSky ransomware is an emerging family that has adopted modern techniques to evade security defenses.
---------------------------------------------
https://unit42.paloaltonetworks.com/bluesky-ransomware/
∗∗∗ AA22-223A: #StopRansomware: Zeppelin Ransomware ∗∗∗
---------------------------------------------
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint CSA to disseminate known Zeppelin ransomware IOCs and TTPs associated with ransomware variants identified through FBI investigations as recently as 21 June 2022.
---------------------------------------------
https://us-cert.cisa.gov/ncas/alerts/aa22-223a
∗∗∗ Cisco Talos shares insights related to recent cyber attack on Cisco ∗∗∗
---------------------------------------------
On May 24, 2022, Cisco became aware of a potential compromise. Since that point, Cisco Security Incident Response (CSIRT) and Cisco Talos have been working to remediate.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/recent-cyber-attack.html
=====================
= Vulnerabilities =
=====================
∗∗∗ Critical Flaws Disclosed in Device42 IT Asset Management Software ∗∗∗
---------------------------------------------
Cybersecurity researchers have disclosed multiple severe security vulnerabilities asset management platform Device42 that, if successfully exploited, could enable a malicious actor to seize control of affected systems.
---------------------------------------------
https://thehackernews.com/2022/08/critical-flaws-disclosed-in-device42-it.h…
∗∗∗ [R1] Nessus Version 8.15.6 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Two separate vulnerabilities that utilize the Audit functionality in Nessus were discovered, reported and fixed.
---------------------------------------------
https://www.tenable.com/security/tns-2022-16
∗∗∗ Cisco: Angreifer könnten an private RSA-Schlüssel in ASA und Firepower gelangen ∗∗∗
---------------------------------------------
Der Netzwerkausrüster Cisco schließt mit aktualisierter Software eine Sicherheitslücke in ASA und Firepower. Angreifer könnten private RSA-Keys auslesen.
---------------------------------------------
https://heise.de/-7216863
∗∗∗ Kritische Sicherheitslücke in Zoho ManageEngine OpManager ∗∗∗
---------------------------------------------
Zoho hat Updates veröffentlicht, die eine kritische und weitere Sicherheitslücken in ManageEngine OpManager schließen. Angreifer könnten unbefugt zugreifen.
---------------------------------------------
https://heise.de/-7217521
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Gentoo (aiohttp, faac, isync, motion, and nextcloud), Red Hat (.NET 6.0), SUSE (libnbd, oracleasm, python-codecov, rubygem-tzinfo, sssd, and thunderbird), and Ubuntu (http-parser, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux, linux-hwe-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-ibm, linux-kvm, linux-oracle, linux-raspi, linux-intel-iotg, linux-oem-5.14, linux-oem-5.17, and node-moment).
---------------------------------------------
https://lwn.net/Articles/904457/
∗∗∗ Organizations Warned of Critical Vulnerabilities in NetModule Routers ∗∗∗
---------------------------------------------
Flashpoint is warning organizations of two newly identified critical vulnerabilities in NetModule Router Software (NRSW) that could be exploited in attacks.
---------------------------------------------
https://www.securityweek.com/organizations-warned-critical-vulnerabilities-…
∗∗∗ BOSCH-SA-463993: SafeLogic Designer vulnerabilities ∗∗∗
---------------------------------------------
https://psirt.bosch.com/security-advisories/bosch-sa-463993.html
∗∗∗ Drupal: jQuery UI Checkboxradio - Moderately critical - Cross site scripting - SA-CONTRIB-2022-052 ∗∗∗
---------------------------------------------
https://www.drupal.org/sa-contrib-2022-052
∗∗∗ Security Bulletin: Vulnerability in the Node.js got module affects IBM Event Streams (CVE-2022-33987) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-the-node…
∗∗∗ Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to denial of service due to CVE-2022-31129 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-automation-assets-in-ibm-…
∗∗∗ Security Bulletin: Multiple security vulnerabilities has been identified in IBM® DB2® shipped with IBM PureData System for Operational Analytics ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera…
∗∗∗ Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-platform-navigator-and-au…
∗∗∗ Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to remote access due to Go CVE-2022-29526 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-platform-navigator-and-au…
∗∗∗ Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to information disclosure CVE-2022-30629 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-platform-navigator-and-au…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 09-08-2022 18:00 − Mittwoch 10-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Stephan Richter
=====================
= News =
=====================
∗∗∗ BSI warnt vor dem Einsatz unsicherer Funk-Türschlösser der Marke ABUS ∗∗∗
---------------------------------------------
Das Bundesamt für Sicherheit in der Informationstechnik (BSI) warnt nach §7 BSI-Gesetz vor dem Einsatz des digitalen Türschlosses "HomeTec Pro CFA3000" des Herstellers ABUS und empfiehlt, das Produkt zu ersetzen.
---------------------------------------------
https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse202…
∗∗∗ Achtung: Fake-Shops! Kaufen Sie nichts bei diesen Garten-Online-Shops ∗∗∗
---------------------------------------------
Online finden Sie viele Shops zu jedem Bereich. Auch Garten-Shops bilden da keine Ausnahme. Die Online-Shops gartenland-paradies.de, home-garten-shop.de und rasengarten.com sind allesamt Fake-Shops und versuchen, Sie zu betrügen.
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-fake-shops-kaufen-sie-nichts…
∗∗∗ Microsoft veröffentlicht Bedrohungsmatrix zu Azure für Sicherheits-Evaluierungen ∗∗∗
---------------------------------------------
Analog zum in Sicherheitskreisen vielgenutzten MITRE ATT&CK Framework hat Microsoft für Azure und Azure AD Informationen zu potenziellen Angriffen aufbereitet.
---------------------------------------------
https://heise.de/-7216398
∗∗∗ UnRAR Vulnerability Exploited in the Wild, Likely Against Zimbra Servers ∗∗∗
---------------------------------------------
The US Cybersecurity and Infrastructure Security Agency (CISA) revealed on Tuesday that a recently patched vulnerability affecting the UnRAR archive extraction tool is being exploited in the wild.
---------------------------------------------
https://www.securityweek.com/unrar-vulnerability-exploited-wild-likely-agai…
∗∗∗ Novel News on Cuba Ransomware aka Greetings From Tropical Scorpius ∗∗∗
---------------------------------------------
Beginning in early May 2022, Unit 42 observed a threat actor deploying Cuba Ransomware using novel tools and techniques. Using our naming schema, Unit 42 tracks the threat actor as Tropical Scorpius.
---------------------------------------------
https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/
∗∗∗ 10 malicious PyPI packages found stealing developers credentials ∗∗∗
---------------------------------------------
Threat analysts have discovered ten malicious Python packages on the PyPI repository, used to infect developers systems with password-stealing malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/10-malicious-pypi-packages-f…
∗∗∗ VileRAT: DeathStalker’s continuous strike at foreign and cryptocurrency exchanges ∗∗∗
---------------------------------------------
VileRAT is a Python implant, part of an evasive and highly intricate attack campaign against foreign exchange and cryptocurrency trading companies.
---------------------------------------------
https://securelist.com/vilerat-deathstalkers-continuous-strike/107075/
∗∗∗ Security Update Guide Notification System News: Create your profile now ∗∗∗
---------------------------------------------
Sharing information through the Security Update Guide (SUG) is an important part of our ongoing effort to help customers manage security risks and keep systems protected.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/08/09/security-update-guide-notificati…
∗∗∗ Attacking and Remediating Excessive Network Share Permissions in Active Directory Environments ∗∗∗
---------------------------------------------
In this blog, I’ll explain how to quickly inventory, exploit, and remediate network shares configured with excessive permissions at scale in Active Directory environments. Excessive share permissions represent a risk that can lead to data exposure, privilege escalation, and ransomware attacks within enterprise environments.
---------------------------------------------
https://www.netspi.com/blog/technical/network-penetration-testing/network-s…
∗∗∗ Discovering Domains via a Timing Attack on Certificate Transparency ∗∗∗
---------------------------------------------
There is a flaw in a way that deployment of TLS certificates might be set up. It allows anyone to discover all domain names used by the same server. Sometimes, even when there is no HTTPS there!
---------------------------------------------
https://swarm.ptsecurity.com/discovering-domains-via-timing-attack/
∗∗∗ The Security Pros and Cons of Using Email Aliases ∗∗∗
---------------------------------------------
One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a "+" character after the username portion of your email address -- followed by a notation specific to the site youre signing up at -- lets you create an infinite number of unique email addresses tied to the same account.
---------------------------------------------
https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-ema…
=====================
= Vulnerabilities =
=====================
∗∗∗ Neue Sicherheitslücken in AMD- und Intel-Prozessoren: AEPIC & SQUIP ∗∗∗
---------------------------------------------
Internationale Expertenteams weisen Schwachstellen in zahlreichen aktuellen CPU-Typen von AMD und Intel nach, die auch künftige ARM-Chips treffen könnten.
---------------------------------------------
https://heise.de/-7211904
∗∗∗ Intel Patches Severe Vulnerabilities in Firmware, Management Software ∗∗∗
---------------------------------------------
Intel on Tuesday published 27 security advisories detailing roughly 60 vulnerabilities across firmware, software libraries, and endpoint and data center management products.
---------------------------------------------
https://www.securityweek.com/intel-patches-severe-vulnerabilities-firmware-…
∗∗∗ Microsoft Security Update Summary (9. August 2022) ∗∗∗
---------------------------------------------
Am 9. August 2022 hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office usw. – sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen zudem 118 Schwachstellen, davon 17 kritisch und zwei 0-day-Schwachstellen.
---------------------------------------------
https://www.borncity.com/blog/2022/08/10/microsoft-security-update-summary-…
∗∗∗ Exchange Server Sicherheitsupdates (9. August 2022) ∗∗∗
---------------------------------------------
Microsoft hat zum 9. August Sicherheitsupdates für Exchange Server 2013, Exchange Server 2016 und Exchange Server 2019 veröffentlicht.
---------------------------------------------
https://www.borncity.com/blog/2022/08/10/exchange-server-sicherheitsupdates…
∗∗∗ Patchday: Adobe schließt kritische Lücken in Commerce und Kreativprogrammen ∗∗∗
---------------------------------------------
Adobe schließt zum August-Patchday mehrere, teils kritische Sicherheitslücken. Betroffen sind Adobe Commerce und Magento sowie PDF- und Kreativ-Software.
---------------------------------------------
https://heise.de/-7215839
∗∗∗ Jetzt handeln! Exploit-Code für VMware-Lücke aufgetaucht, neue Updates verfügbar ∗∗∗
---------------------------------------------
VMware hat für neu entdeckte Sicherheitslücken Updates bereitgestellt. Für eine ältere Schwachstelle ist jetzt Exploit-Code aufgetaucht, warnt der Hersteller.
---------------------------------------------
https://heise.de/-7216296
∗∗∗ IBM Security Bulletins 2022-08-09 ∗∗∗
---------------------------------------------
IBM Netezza, IBM Sterling Connect, IBM MQ Operator, IBM Queue manager, IBM Cloud Pak, IBM Sterling B2B Integrator, IBM Event Streams, IBM InfoSphere Information Server, IBM Process Mining.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Lenovo Product Security Advisories and Announcements 2022-08-09 ∗∗∗
---------------------------------------------
Lenovo published 9 security advisories.
---------------------------------------------
https://support.lenovo.com/de/de/product_security/home
∗∗∗ Dell Security Advisories and Notices ∗∗∗
---------------------------------------------
Dell published 1 security advisory.
---------------------------------------------
https://www.dell.com/support/security/en-us/
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gst-plugins-good1.0), Fedora (firefox and ghostscript), Gentoo (consul, firefox, libass, libraw, lxml, mdbtools, pam_u2f, spice, and thunderbird), Oracle (kernel, kernel-container, and vim), Red Hat (galera, mariadb, and mysql-selinux, kernel, and kernel-rt), Scientific Linux (kernel), SUSE (bind, java-11-openjdk, kernel, mokutil, ncurses, and u-boot), and Ubuntu (epiphany-browser, libcdio, linux, linux-aws, linux-azure-4.15, linux-dell300x, linux-gcp-4.15, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon, linux, linux-aws, linux-kvm, linux-lts-xenial, and linux-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-oracle).
---------------------------------------------
https://lwn.net/Articles/904374/
∗∗∗ PaloAlto Networks PAN-OS: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in PaloAlto Networks PAN-OS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Code zur Ausführung zu bringen, einen Denial of Service Angriff durchzuführen oder vertrauliche Daten einzusehen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0952
∗∗∗ FreeBSD: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in FreeBSD ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder Code auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0995
∗∗∗ F5: K21600298: OpenSSL vulnerability CVE-2022-1292 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K21600298
∗∗∗ Red Hat Ceph Storage: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0979
∗∗∗ Apache Traffic Server: Mehrere Schwachstellen ermöglichen Manipulation von Dateien ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0992
∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0989
∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2022-33745 ∗∗∗
---------------------------------------------
https://support.citrix.com/article/CTX463455/citrix-hypervisor-security-bul…
∗∗∗ SonicWall SMA1000 CVE-2021-33909 and CVE-2022-0847 ∗∗∗
---------------------------------------------
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Montag 08-08-2022 18:00 − Dienstag 09-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Kollaborationssoftware: Slack schließt jahrelanges Datenleck ∗∗∗
---------------------------------------------
Slack hat etliche Nutzer aufgefordert, ihr Passwort zu ändern. Über eine Sicherheitslücke wurden über Jahre Hashes der Passwörter versendet.
---------------------------------------------
https://www.golem.de/news/kollaborationssoftware-slack-schliesst-jahrelange…
∗∗∗ The Truth About False Positives in Security ∗∗∗
---------------------------------------------
As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Lets explain why.
---------------------------------------------
https://thehackernews.com/2022/08/the-truth-about-false-positives-in.html
∗∗∗ Cyberangriffe auf Medizingeräte: Risikobewusstsein hoch, aber wenig Prävention ∗∗∗
---------------------------------------------
Seit 2020 fahren Cyberkriminelle ihre Angriffe verstärkt auf Gesundheitsinfrastrukturen. Schlecht gesicherte IoMT/IoT-Geräte erleichtern ihnen die Arbeit.
---------------------------------------------
https://heise.de/-7206153
∗∗∗ IT-Sicherheit: meistverbreitete Malware-Stämme im Jahr 2021 ∗∗∗
---------------------------------------------
Die US-IT-Sicherheitsbehörde CISA und das australische Cyber Security Center haben zusammengetragen, welche Malware-Stämme 2021 am häufigsten beobachtet wurden.
---------------------------------------------
https://heise.de/-7206775
∗∗∗ Twilio: Konten von Mitarbeitern und Kunden kompromittiert ∗∗∗
---------------------------------------------
Angestellte des Diensteanbieters Twilio sind Opfer von Phishing-Angriffen geworden. Die Angreifer konnten unbefugt auf Informationen zugreifen.
---------------------------------------------
https://heise.de/-7207070
∗∗∗ Open Redirect Flaws in American Express and Snapchat Exploited in Phishing Attacks ∗∗∗
---------------------------------------------
Open redirect vulnerabilities affecting American Express and Snapchat websites were exploited earlier this year as part of phishing campaigns targeting Microsoft 365 users, email security firm Inky reports.
---------------------------------------------
https://www.securityweek.com/open-redirect-flaws-american-express-and-snapc…
∗∗∗ Günstiges Brennholz: Vorsicht vor Fake-Angeboten im Facebook Marketplace ∗∗∗
---------------------------------------------
Sie haben auf Facebook ein günstiges Angebot für Brennholz gefunden? Vorsicht: Möglicherweise handelt es sich um ein betrügerisches Inserat. Überprüfen Sie das Angebot und Verkäufer:innen sehr genau und zahlen Sie nicht vorab!
---------------------------------------------
https://www.watchlist-internet.at/news/guenstiges-brennholz-vorsicht-vor-fa…
∗∗∗ Shodan Verified Vulns 2022-08-01 ∗∗∗
---------------------------------------------
Im Vergleich zum Juli gab es praktisch keine Veränderung. Die Schwachstellen FREAK (CVE-2015-0204) und Logjam (CVE-2015-4000) sind in den Daten für diesen Monat nicht enthalten (bzw. wird die Anzahl für beide mit 0 angegeben). Dabei handelt es sich aber offensichtlich um einen Fehler, auch bei den Shodan Trends ist für beide Schwachstellen ein plötzlicher Abfall zu sehen. Ob das seitens Shodan beabsichtig ist, da vielleicht nicht mehr nach diesen CVEs gescannt wird, wissen wir derzeit nicht; sachdienliche Hinweise dazu nehmen wir aber dankend entgegen.
---------------------------------------------
https://cert.at/de/aktuelles/2022/8/shodan-verified-vulns-2022-08-01
∗∗∗ SmarterTrack Full disclosure ∗∗∗
---------------------------------------------
On 27 October 2021 Wietse Boonstra found several vulnerabilities in the latest version of SmarterTrack. There were two XSS, an unauthenticated download and an upload / overwrite vulnerability. The researcher Wietse Boonstra and Finn van der Knaap, examined the vulnerability and made the proof of concept.
---------------------------------------------
https://csirt.divd.nl/2022/08/09/Smartertrak-Full-Disclosure/
=====================
= Vulnerabilities =
=====================
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
Platform Navigator and Automation Assets in IBM Cloud Pak for Integration, IBM Netezza for Cloud Pak for Data, node.js, IBM® SDK Java Technology Edition (Version 8), IBM Security SiteProtector System, Spring Framework, IBM Workload Scheduler, Liberty for Java for IBM Cloud.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Siemens Security Advisories ∗∗∗
---------------------------------------------
4 new, 38 updated
---------------------------------------------
https://new.siemens.com/global/en/products/services/cert.html?d=2022-08#Sec…
∗∗∗ Schneider Electric Security Advisories ∗∗∗
---------------------------------------------
Schneider Electric released 11 security advisories.
---------------------------------------------
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.…
∗∗∗ AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service ∗∗∗
---------------------------------------------
The SIMA² Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP).
---------------------------------------------
https://cert.vde.com/de/advisories/VDE-2022-032/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (gnutls28 and unzip), Fedora (dovecot and net-snmp), Red Hat (kernel-rt and vim), and Ubuntu (gst-plugins-good1.0).
---------------------------------------------
https://lwn.net/Articles/904271/
∗∗∗ SAP Patchday August 2022 ∗∗∗
---------------------------------------------
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0949
∗∗∗ Keycloak: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0948
∗∗∗ ImageMagick: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0946
∗∗∗ NetApp StorageGRID: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0945
∗∗∗ Red Hat OpenShift Service Mesh: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0944
∗∗∗ Mitsubishi Electric GT SoftGOT2000 ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-221-01
∗∗∗ Emerson ControlWave ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-221-02
∗∗∗ Emerson OpenBSI ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-221-03
∗∗∗ Open Source Varnish Cache Denial of Service ∗∗∗
---------------------------------------------
https://docs.varnish-software.com/security/VSV00009/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 05-08-2022 18:00 − Montag 08-08-2022 18:00
Handler: Stephan Richter
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ New GwisinLocker ransomware encrypts Windows and Linux ESXi servers ∗∗∗
---------------------------------------------
A new ransomware family called GwisinLocker targets South Korean healthcare, industrial, and pharmaceutical companies with Windows and Linux encryptors, including support for encrypting VMware ESXi servers and virtual machines.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-gwisinlocker-ransomware-…
∗∗∗ Microsoft Office to publish symbols starting August 2022 ∗∗∗
---------------------------------------------
We are excited to announce that Microsoft Office will begin publishing Office symbols for Windows via the Microsoft Public Symbol Server on August 9th 2022. The publication of Office symbols is a part of our continuing investment to improve security and performance for customers and partners.
---------------------------------------------
https://msrc-blog.microsoft.com/2022/08/08/microsoft-office-to-publish-symb…
∗∗∗ BumbleBee Roasts Its Way to Domain Admin ∗∗∗
---------------------------------------------
In this intrusion from April 2022, the threat actors used BumbleBee as the initial access vector. BumbleBee is a malware loader that was first reported by Google Threat Analysis Group in March 2022. Google TAG attributes this malware to an initial access broker (IAB) dubbed EXOTIC LILY, working with the cybercrime group FIN12/WIZARD SPIDER/DEV-0193.
---------------------------------------------
https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-adm…
∗∗∗ "Command&Control as a Service" – Cybercrime auf dem Weg in die Cloud ∗∗∗
---------------------------------------------
Ein neues As-a-Service-Angebot hat im Cybercrime-Untergrund innerhalb weniger Monate bereits tausende Kunden gewonnen.
---------------------------------------------
https://heise.de/-7204112
∗∗∗ Security-Informationen: Neues Ampel-Protokoll soll Vertraulichkeit vereinfachen ∗∗∗
---------------------------------------------
Das Trafic Light Protocol hat sich für die Kennzeichnung vertraulicher Informationen etabliert. TLP Version 2.0 soll die Absicht des Autors klarer machen.
---------------------------------------------
https://heise.de/-7205920
∗∗∗ Fake-Gewinnspiel für JBL-Lautsprecher auf Instagram ∗∗∗
---------------------------------------------
Zahlreiche Instagram-Nutzer:innen werden momentan von Fake-JBL-Profilen auf Beiträgen markiert: „Wenn du markiert wurdest, hast du einen tragbaren Lautsprecher von JBL gewonnen“ lautet der Beitrag.
---------------------------------------------
https://www.watchlist-internet.at/news/fake-gewinnspiel-fuer-jbl-lautsprech…
∗∗∗ Ransomware-Attacken zurück im Geschäft ∗∗∗
---------------------------------------------
Doch keine Sommerpause: Nach einem leichten Rückgang zu Beginn des Jahres hat die Zahl der Ransomware-Angriffe im zweiten Quartal 2022 erneut zugelegt.
---------------------------------------------
https://www.zdnet.de/88402769/ransomware-attacken-zurueck-im-geschaeft/
∗∗∗ Google-Report von VirusTotal über Trends bei Malware ∗∗∗
---------------------------------------------
Auf seinem Dienst VirusTotal erhält Google täglich zahlreiche Einreichungen von Dateien zur Überprüfung, ob es sich um Malware handelt. In einem neuen Bericht "Deception at scale: Wie Malware Vertrauen missbraucht" hat ein Team von Google die Erkenntnisse zu verschiedene Techniken zusammengetragen, die Malware einsetzt, um Abwehrmechanismen zu umgehen und Social-Engineering-Angriffe effektiver zu gestalten.
---------------------------------------------
https://www.borncity.com/blog/2022/08/07/google-report-von-virustotal-ber-t…
∗∗∗ Small-time cybercrime is about to explode — We arent ready ∗∗∗
---------------------------------------------
The cybersecurity industry tends to focus on extremely large-scale or sophisticated, state-sponsored attacks. Rightfully so, as it can be the most interesting, technically speaking. When most people think of cybercrime they think of large-scale breaches because thats what dominates the headlines. However, the problem is much bigger.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/smalltime-cybercrime.html
=====================
= Vulnerabilities =
=====================
∗∗∗ Cross-Site Request Forgery Vulnerability Patched in Ecwid Ecommerce Shopping Cart Plugin ∗∗∗
---------------------------------------------
On June 24, 2022, the Wordfence Threat Intelligence team initiated the responsible disclosure process for a Cross-Site Request Forgery vulnerability we discovered in Ecwid Ecommerce Shopping Cart, a WordPress plugin installed on over 30,000 sites. This vulnerability made it possible for attackers to modify some of the plugin’s more advanced settings via a forged request.
---------------------------------------------
https://www.wordfence.com/blog/2022/08/cross-site-request-forgery-vulnerabi…
∗∗∗ Webbrowser: Google Chrome und Microsoft Edge 104 schließen Sicherheitslücken ∗∗∗
---------------------------------------------
Die Version 104 der Webbrowser Chrome und Edge dichten zahlreiche Sicherheitslecks ab. Einige Features von Chrome haben zudem eine Politur erfahren.
---------------------------------------------
https://heise.de/-7205970
∗∗∗ Übernahme möglich: DrayTek-Router mit kritischer Sicherheitslücke ∗∗∗
---------------------------------------------
Eine Schwachstelle in den Routern von DrayTek ermöglicht Angreifern aus dem Netz die Kompromittierung der Geräte. Nicht einmal eine Anmeldung ist dafür nötig.
---------------------------------------------
https://heise.de/-7206059
∗∗∗ Patchday: F5 dichtet Schwachstellen in BIG IP und Nginx ab ∗∗∗
---------------------------------------------
Zum Schließen von 21 Sicherheitslücken liefert F5 Software-Updates aus. Die meisten Fehler mit hohem Risiko betreffen die BIG-IP-Systeme des Anbieters.
---------------------------------------------
https://heise.de/-7205758
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (chromium, libtirpc, and xorg-server), Fedora (giflib, mingw-giflib, and teeworlds), Mageia (chromium-browser-stable, kernel, kernel-linus, mingw-giflib, osmo, python-m2crypto, and sqlite3), Oracle (httpd, php, vim, virt:ol and virt-devel:ol, and xorg-x11-server), SUSE (caddy, crash, dpkg, fwupd, python-M2Crypto, and trivy), and Ubuntu (gdk-pixbuf, libjpeg-turbo, and phpliteadmin).
---------------------------------------------
https://lwn.net/Articles/904191/
∗∗∗ Security Bulletin: Apache log4j vulnerabilities in Spark and Zookeeper affect QRadar User Behavior Analytics(CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-vulnerabilit…
∗∗∗ Security Bulletin: Multiple vulnerabilities in Jquery-Ui, highcharts, and datatables are affecting QRadar User Behavior Analytics (CVE-2021-41182, CVE-2021-41183, CVE-2021-41184, CVE-2021-23445, CVE-2021-29489) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-…
∗∗∗ Nextcloud Talk: Schwachstelle ermöglicht Offenlegung von Informationen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0935
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Donnerstag 04-08-2022 18:00 − Freitag 05-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ ENISA Threat Landscape for Ransomware Attacks ∗∗∗
---------------------------------------------
This report aims to bring new insights into the reality of ransomware incidents through mapping and studying ransomware incidents from May 2021 to June 2022.
---------------------------------------------
https://www.enisa.europa.eu/publications/enisa-threat-landscape-for-ransomw…
∗∗∗ Kopieren mit rsync anfällig für Angriffe ∗∗∗
---------------------------------------------
Die angekündigte neue rsync-Version soll verhindern, dass ein Server gezielt Dateien auf dem Client überschreibt und diesen damit kompromittiert.
---------------------------------------------
https://heise.de/-7202888
∗∗∗ VMware-Updates: Schnelles Handeln "extrem wichtig" ∗∗∗
---------------------------------------------
Admin-Zugang ohne Passwort – und das ist nur eine der zehn Lücken, für die VMware dringliche Updates bringt.
---------------------------------------------
https://heise.de/-7204524
∗∗∗ Achtung vor falschen Polizeianrufen! ∗∗∗
---------------------------------------------
Werden Sie von einer unauffälligen Nummer angerufen, wo Ihnen angeblich die Polizei verwirft, ein Verbrechen begangen zu haben? Bekommen Sie viele Anrufe, Nachrichten oder Sprachboxnachrichten von fremden Personen, die auf ein Telefongespräch hinweisen, welches Sie nicht führten? Das ist alles Teil einer Betrugsmasche.
---------------------------------------------
https://www.watchlist-internet.at/news/achtung-vor-falschen-polizeianrufen/
∗∗∗ New Linux malware brute-forces SSH servers to breach networks ∗∗∗
---------------------------------------------
A new botnet called RapperBot has emerged in the wild since mid-June 2022, focusing on brute-forcing its way into Linux SSH servers and then establishing persistence.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/new-linux-malware-brute-forc…
∗∗∗ Facebook finds new Android malware used by APT hackers ∗∗∗
---------------------------------------------
Meta (Facebook) has released its Q2 2022 adversarial threat report, and among the highlights is the discovery of two cyber-espionage clusters connected to hacker groups known as Bitter APT and APT36 (aka Transparent Tribe) using new Android malware.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/facebook-finds-new-android-m…
∗∗∗ Finding hooks with windbg ∗∗∗
---------------------------------------------
In this blogpost we are going to look into hooks, how to find them, and how to restore the original functions.
---------------------------------------------
https://blog.nviso.eu/2022/08/05/finding-hooks-with-windbg/
=====================
= Vulnerabilities =
=====================
∗∗∗ Kritische Lücken in Ciscos SMB-Routern ∗∗∗
---------------------------------------------
Das Web-Interface der Cisco-Router der RV-Serie ermöglicht diverse unauthentifizierte Aktionen - Updates stellen das ab.
---------------------------------------------
https://heise.de/-7203891
∗∗∗ VU#495801: muhttpd versions 1.1.5 and earlier are vulnerable to path traversal ∗∗∗
---------------------------------------------
Versions 1.1.5 and earlier of the mu HTTP deamon (muhttpd) are vulnerable to path traversal via crafted HTTP request from an unauthenticated user. This vulnerability can allow unauthenticated users to download arbitrary files and collect private information on the target device.
---------------------------------------------
https://kb.cert.org/vuls/id/495801
∗∗∗ IBM Security Bulletins 2022-08-04 ∗∗∗
---------------------------------------------
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data, IBM Security Identity Manager Virtual Appliance, IBM Robotic Process Automation, IBM Spectrum Scale Data Access Services, IBM Sterling Connect:Direct for UNIX Certified Container
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security update available in Foxit Reader for Linux 2.4.5 ∗∗∗
---------------------------------------------
Addressed a potential issue where the application could be exposed to Use-After-Free vulnerability. This occurs as the application executes the destructor under png_safe_execute. (CVE-2019-7317)
---------------------------------------------
https://www.foxit.com/support/security-bulletins.html
∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (firefox, thunderbird, and xorg-x11-server), Debian (xorg-server), Gentoo (Babel, go, icingaweb2, lib3mf, and libmcpp), Oracle (389-ds:1.4, go-toolset:ol8, httpd, mariadb:10.5, microcode_ctl, and ruby:2.5), Red Hat (xorg-x11-server), Scientific Linux (xorg-x11-server), SUSE (buildah, go1.17, go1.18, harfbuzz, python-ujson, qpdf, u-boot, and wavpack), and Ubuntu (gnutls28, libxml2, mod-wsgi, openjdk-8, openjdk-8, openjdk-lts, openjdk-17, openjdk-18, [...]
---------------------------------------------
https://lwn.net/Articles/903997/
∗∗∗ Regarding vulnerability measure against buffer overflow for Laser Printers and Small Office Multifunction Printers – 04 August 2022 ∗∗∗
---------------------------------------------
Multiple cases of buffer overflow vulnerabilities have been identified with Canon Laser Printers and Small Office Multifunctional Printers. Related CVEs are: CVE-2022-24672, CVE-2022-24673 and CVE-2022-24674. A list of affected models is given below.
---------------------------------------------
https://www.canon-europe.com/support/product-security-latest-news/
∗∗∗ ZDI-22-1064: OPC Foundation UA .NET Standard BrowseRequest Missing Authentication Information Disclosure Vulnerability ∗∗∗
---------------------------------------------
http://www.zerodayinitiative.com/advisories/ZDI-22-1064/
∗∗∗ F-Secure Linux Security und Internet GateKeeper: Schwachstelle ermöglicht Denial of Service ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0928
∗∗∗ vim: Schwachstelle ermöglicht Codeausführung ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0926
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Mittwoch 03-08-2022 18:00 − Donnerstag 04-08-2022 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ TLP 2.0 is here ∗∗∗
---------------------------------------------
Earlier this week, the global Forum of Incident Response and Security Teams – or FIRST, as it is commonly known – published a new version of its Traffic Light Protocol standard. The Traffic Light Protocol (TLP) is commonly used in the incident response community, as well as in the wider security space, to quickly and in a standardized way indicate any limitations on further sharing of any transferred information.
---------------------------------------------
https://isc.sans.edu/diary/rss/28914
∗∗∗ PersistenceSniper ∗∗∗
---------------------------------------------
PersistenceSniper is a Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.
---------------------------------------------
https://github.com/last-byte/PersistenceSniper
∗∗∗ Woody RAT: A new feature-rich malware spotted in the wild ∗∗∗
---------------------------------------------
The Malwarebytes Threat Intelligence team has identified a new Remote Access Trojan we are calling Woody Rat that has been in the wild for at least one year.
---------------------------------------------
https://blog.malwarebytes.com/threat-intelligence/2022/08/woody-rat-a-new-f…
∗∗∗ Dreiecksbetrug beim Verkauf von Gaming-Accounts über Kleinanzeigen ∗∗∗
---------------------------------------------
Vorsicht beim Kauf und Verkauf von Gaming-Accounts. Abgesehen davon, dass Kauf und Verkauf häufig durch die Spieleentwickler:innen verboten werden, kommt es immer wieder zu einem Dreiecksbetrug. Verkaufende verlieren ihren Gaming-Account und bekommen kein Geld oder Kaufende bekommen keinen Account und buchen das Geld zurück.
---------------------------------------------
https://www.watchlist-internet.at/news/dreiecksbetrug-beim-verkauf-von-gami…
∗∗∗ Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware ∗∗∗
---------------------------------------------
This blog presents a case study from recent Bumblebee malware activity distributed through Projector Libra that led to Cobalt Strike. Information presented here should provide a clearer picture of the group’s tactics and help security professionals better defend their organizations against this threat.
---------------------------------------------
https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/
∗∗∗ Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns ∗∗∗
---------------------------------------------
In early 2022, a new C2 platform called "Dark Utilities" was established, offering a variety of services such as remote system access, DDoS capabilities and cryptocurrency mining. The operators of the service also established Discord and Telegram communities where they provide technical support and assistance for customers on the platform.
---------------------------------------------
http://blog.talosintelligence.com/2022/08/dark-utilities.html
=====================
= Vulnerabilities =
=====================
∗∗∗ Cisco fixes critical remote code execution bug in VPN routers ∗∗∗
---------------------------------------------
Cisco has fixed critical security vulnerabilities affecting Small Business VPN routers and enabling unauthenticated, remote attackers to execute arbitrary code or commands and trigger denial of service (DoS) conditions on vulnerable devices.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-remote-…
∗∗∗ Critical RCE Bug in DrayTek Routers Opens SMBs to Zero-Click Attacks ∗∗∗
---------------------------------------------
A critical, pre-authenticated remote code execution (RCE) vulnerability has cropped up in the widely used line of DrayTek Vigor routers for smaller businesses. If it's exploited, researchers warn that it could allow complete device takeover, along with access to the broader network.
---------------------------------------------
https://www.darkreading.com/endpoint/critical-rce-bug-draytek-routers-smbs-…
∗∗∗ IBM Security Bulletins 2022-08-03 ∗∗∗
---------------------------------------------
IBM Watson Discovery for IBM Cloud Pak for Data, IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data, IBM Db2, IBM Sterling File Gateway, IBM Sterling B2B Integrator, IBM Data Risk Manager, IBM Tivoli Application Dependency Discovery Manager, IBM Java SDK Technology Edition.
---------------------------------------------
https://www.ibm.com/blogs/psirt/
∗∗∗ Security Advisory - The input verification vulnerability of a Huawei Device product is involved. ∗∗∗
---------------------------------------------
A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks. (Vulnerability ID: HWPSIRT-2022-49379) Affected Product: CV81-WDM FW
---------------------------------------------
http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20220810-…
∗∗∗ Security updates for Thursday ∗∗∗
---------------------------------------------
Security updates have been issued by Fedora (lua), Oracle (kernel), Red Hat (389-ds:1.4, django, firefox, go-toolset and golang, go-toolset-1.17 and go-toolset-1.17-golang, go-toolset:rhel8, java-1.8.0-ibm, java-17-openjdk, kernel, kernel-rt, kpatch-patch, mariadb:10.5, openssl, pcre2, php, rh-mariadb105-galera and rh-mariadb105-mariadb, ruby:2.5, thunderbird, vim, and virt:rhel and virt-devel:rhel), Scientific Linux (firefox and thunderbird), SUSE (drbd, java-17-openjdk, java-1_8_0-ibm, keylime, ldb, samba, mokutil, oracleasm, pcre2, permissions, postgresql-jdbc, python-numpy, samba, tiff, u-boot, and xscreensaver), and Ubuntu (nvidia-graphics-drivers-390, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-470, nvidia-graphics-drivers-470-server, nvidia-graphics-drivers-510, nvidia-graphics-drivers-510-server, nvidia-graphics-drivers-515, nvidia-graphics-drivers-515-server).
---------------------------------------------
https://lwn.net/Articles/903816/
∗∗∗ genua genugate: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
Ein Angreifer kann eine Schwachstelle in genua genugate ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0906
∗∗∗ D-LINK Router: Mehrere Schwachstellen ermöglichen Codeausführung ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in D-LINK Router ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0907
∗∗∗ PostgreSQL: Schwachstelle ermöglicht SQL Injection ∗∗∗
---------------------------------------------
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in PostgreSQL ausnutzen, um eine SQL Injection durchzuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0910
∗∗∗ Nextcloud Server und Nextcloud Mail: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0912
∗∗∗ Cisco Security Advisories 2022-08-03 ∗∗∗
---------------------------------------------
Cisco published 5 security advisories (1 critical, 4 medium severity).
---------------------------------------------
https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&secur…
∗∗∗ Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0901
∗∗∗ Digi ConnectPort X2D ∗∗∗
---------------------------------------------
https://us-cert.cisa.gov/ics/advisories/icsa-22-216-01
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 02-08-2022 18:00 − Mittwoch 03-08-2022 18:00
Handler: Michael Schlagenhaufer
Co-Handler: Thomas Pribitzer
=====================
= News =
=====================
∗∗∗ Wolf in sheep’s clothing: how malware tricks users and antivirus ∗∗∗
---------------------------------------------
One of the primary methods used by malware distributors to infect devices is by deceiving people into downloading and running malicious files, and to achieve this deception, malware authors are using a variety of tricks.
---------------------------------------------
https://www.bleepingcomputer.com/news/security/wolf-in-sheep-s-clothing-how…
∗∗∗ Open Source: Gut getarnte Malware-Kampagne in Tausenden Github Repos ∗∗∗
---------------------------------------------
Ein Sicherheitsforscher hat eine groß angelegte Malware-Kampagne entdeckt, die versucht, sich durch einfache Pull Requests einzuschmuggeln.
---------------------------------------------
https://www.golem.de/news/open-source-gut-getarnte-malware-kampagne-in-taus…
∗∗∗ Creating Processes Using System Calls ∗∗∗
---------------------------------------------
When we think about EDR or AV evasion, one of the most widespread methods adopted by offensive teams is the use of system calls (syscalls) to carry out specific actions.
---------------------------------------------
https://www.coresecurity.com/core-labs/articles/creating-processes-using-sy…
∗∗∗ EMBA v1.1.0: The security analyzer for embedded device firmware ∗∗∗
---------------------------------------------
EMBA is designed as the central firmware analysis tool for penetration testers. It supports the complete security analysis process starting with the firmware extraction process, doing static analysis and dynamic analysis via emulation and finally generating a report.
---------------------------------------------
https://github.com/e-m-b-a/emba/releases
∗∗∗ PART 3: How I Met Your Beacon – Brute Ratel ∗∗∗
---------------------------------------------
In part three of this series, we will analyse Brute Ratel, a command and control framework developed by Dark Vortex.
---------------------------------------------
https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/
∗∗∗ Ransomware in Python-Paketmanager PyPI: Die Rückkehr der Skriptkiddies ∗∗∗
---------------------------------------------
Eine Reihe von Paketen hat auf Typosquatting gesetzt und Code verbreitet, der unter Windows Dateien verschlüsselt. Die Motive sind schleierhaft.
---------------------------------------------
https://heise.de/-7200335
∗∗∗ Vorsicht vor Fake-Mails der bank99 ∗∗∗
---------------------------------------------
Kriminelle geben sich als bank99 aus und wollen, dass Sie die „Okay99 App“ herunterladen. Klicken Sie nicht auf „Aktivierung starten“, da sonst Ihre Daten in die Hände der Kriminellen kommen.
---------------------------------------------
https://www.watchlist-internet.at/news/vorsicht-vor-fake-mails-der-bank99/
∗∗∗ Detection Rules for Lightning Framework (and How to Make Them With Osquery) ∗∗∗
---------------------------------------------
On 21 July, 2022, we released a blog post about a new malware called Lightning Framework. Lightning is a modular malware framework targeting Linux. At the time of the publication, the Core module had one suspicious detection and the Downloader module was not detected by any scanning engines on VirusTotal.
---------------------------------------------
https://www.intezer.com/blog/threat-hunting/lightning-framework-linux-detec…
=====================
= Vulnerabilities =
=====================
∗∗∗ Forti Security Advisories 2022-08-02 ∗∗∗
---------------------------------------------
Forti published 3 Security Advisories (1 High, 2 Medium Severity).
---------------------------------------------
https://fortiguard.fortinet.com/psirt?date=08-2022
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by CentOS (389-ds-base, firefox, java-1.8.0-openjdk, java-11-openjdk, kernel, postgresql, python, python-twisted-web, python-virtualenv, squid, thunderbird, and xz), Fedora (ceph, firefox, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk, and kubernetes), Oracle (firefox, go-toolset and golang, libvirt libvirt-python, openssl, pcre2, qemu, and thunderbird), SUSE (connman, drbd, kernel, python-jupyterlab, samba, and seamonkey), [...]
---------------------------------------------
https://lwn.net/Articles/903676/
∗∗∗ Android Patchday August 2022 ∗∗∗
---------------------------------------------
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erweitern, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen und beliebigen Code auszuführen.
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0887
∗∗∗ Chrome 104.0.5112.x fixt Schwachstellen ∗∗∗
---------------------------------------------
Google hat zum 2. August 2022 das Update des Google Chrome 104.0.5112.79 für Linux und MacOS sowie 104.0.5112.79/80/81 für Windows auf dem Desktop im Stable Channel freigegeben. Mit dem Sicherheitsupdate werden zahlreiche Schwachstellen geschlossen.
---------------------------------------------
https://www.borncity.com/blog/2022/08/03/chrome-104-0-5112-x-fixt-schwachst…
∗∗∗ Security Bulletin: IBM Security SOAR is using a component with multiple known vulnerabilities – IBM JDK 8.0.7.6 ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-usin…
∗∗∗ K14649763: Overview of F5 vulnerabilities (August 2022) ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K14649763
∗∗∗ High Severity Vulnerability Patched in Download Manager Plugin ∗∗∗
---------------------------------------------
https://www.wordfence.com/blog/2022/08/high-severity-vulnerability-patched-…
∗∗∗ Synology-SA-22:14 USB Copy ∗∗∗
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_14
∗∗∗ Synology-SA-22:13 SSO Server ∗∗∗
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_13
∗∗∗ Synology-SA-22:12 Synology Note Station Client ∗∗∗
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_12
∗∗∗ Synology-SA-22:11 Storage Analyzer ∗∗∗
---------------------------------------------
https://www.synology.com/en-global/support/security/Synology_SA_22_11
∗∗∗ Ipswitch WS_FTP Server: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0895
∗∗∗ Nvidia GPU Treiber und NVIDIA vGPU software: Mehrere Schwachstellen ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0894
∗∗∗ Rsync: Schwachstelle ermöglicht Manipulation von Dateien ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0891
∗∗∗ 2022-13 Denial of Service Vulnerability in EagleSDV ∗∗∗
---------------------------------------------
https://dam.belden.com/dmm3bwsv3/assetstream.aspx?assetid=14662&mediaformat…
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily