November 2012 - Daily

Tageszusammenfassung - Freitag 30-11-2012
by Daily end-of-shift report 30 Nov '12

30 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-11-2012 18:00 − Freitag 30-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Server der Atombehörde IAEA erneut attackiert *** --------------------------------------------- Die Internationale Atombehörde IAEA wurde zum zweiten Mal binnen weniger Tage attackiert. Dabei sollen Hacker geheime Daten gestohlen haben. Über die Herkunft der Hacker ist nichts bekannt, bei den zweiten Angreifern könnte es sich allerdings um Mitglieder von Anonymous handeln. --------------------------------------------- http://futurezone.at/netzpolitik/12741-server-der-atombehoerde-iaea-erneut-… *** Virtualization Security: Protecting Virtualized Environments *** --------------------------------------------- "Virtualization changes the playing field when it comes to security. There are new attack vectors, new operational patterns and complexity, and changes in IT architecture and deployment life cycles. Whats more, the technologies, best practices, and strategies used for securing physical environments do not provide sufficient protection for virtual environments...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14030 *** Sprachtwittern für Syrer *** --------------------------------------------- Nachdem Syrien seit Donnerstag nahezu komplett vom Internet abgeschnitten ist haben Google und Twitter den Dienst "speak2tweet" wieder aufgenommen. Der Dienst nimmt Sprachnachrichten unter vier internationalen Rufnummern an, legt sie auf Google-Servern ab und veröffentlicht die Links auf Twitter (siehe da auch #SyriaBlackout). --------------------------------------------- http://www.heise.de/security/meldung/Sprachtwittern-fuer-Syrer-1760015.html… *** Mail hackt Router *** --------------------------------------------- Eine ganze Reihe von Routern von Arcor, Asus und TP-Link sind anfällig für eine ungewollte Fernkonfiguration. Der Sicherheitsforscher Bogdan Calin demonstriert in seinem Blog eindrucksvoll, dass im Netz der Router schon das Anzeigen einer Mail weitreichende Konsequenzen haben kann: Seine speziell präparierte Testmail konfiguriert beim Öffnen den WLAN-Router so um, dass der Internet-Datenverkehr umgeleitet wird. --------------------------------------------- http://www.heise.de/security/meldung/Mail-hackt-Router-1759354.html/from/at… *** Nmap 6.25 released - lots of new goodies, see http://nmap.org/changelog.html, (Fri, Nov 30th) *** --------------------------------------------- (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14599&rss *** Microsoft Security Essentials Loses AV-Test Certificate *** --------------------------------------------- helix2301 writes "Every two months, AV-Test takes a look at popular antivirus software and security suites and tests them in several ways. In their latest test which was performed on Windows 7 during September and October, Microsoft Security Essentials didnt pass the test to achieve certification. Although that may not sound that impressive, Microsofts program was the only one which didnt receive AV-Tests certificate. For comparison, the other free antivirus software, including Avast, AVG --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/jXCBvPS16VQ/story01.htm *** Hotel-Einbrecher werden zu Arduino-Tüftlern *** --------------------------------------------- Der auf der diesjährigen Hackerkonferenz BlackHat demonstrierte Angriff auf die elektronischen Türschlösser der Marke Onity HT wurde weiter perfektioniert und möglicherweise auch schon von Einbrechern eingesetzt. Inzwischen gibt es im Netz eine Vielzahl detaillierter Anleitungen und Videos über das Aushebeln der Türsperre. --------------------------------------------- http://www.heise.de/security/meldung/Hotel-Einbrecher-werden-zu-Arduino-Tue… *** Crooks inject malicious Java applet into FOREX trading website *** --------------------------------------------- VXers wouldnt give a XXXX for anything else A FOREX trading website has been contaminated with a malicious Java applet that is designed to install malware on the systems of visiting surfers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/30/forex_tradi… *** Latest phishing security test shows Chrome is the best, followed by IE10, Safari, and then Firefox *** --------------------------------------------- "Phishing scams are becoming more and more prevalent, but thankfully browser makers have also stepped up their game: the average phishing URL catch rate in the top four browsers has jumped from 46 percent in 2009 to 92 percent in 2012 and the average time it took to block a new phishing URL also improved from 16. 43 hours to 4. 87 hours...." --------------------------------------------- http://thenextweb.com/apps/2012/11/28/latest-phishing-security-test-shows-c…

1 0

Tageszusammenfassung - Donnerstag 29-11-2012
by Daily end-of-shift report 29 Nov '12

29 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-11-2012 18:00 − Donnerstag 29-11-2012 18:00 Handler: Robert Waldner Co-Handler: n/a *** New version of wireshark is available (1.8.4), some security fixes included. , (Wed, Nov 28th) *** --------------------------------------------- (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14587&rss *** Good Practice Guide for Addressing Network and Information Security Aspects of Cybercrime *** --------------------------------------------- "In 2010 ENISA started its support for operational collaboration between the Computer Emergency Response Teams (CERTs) in the Member States on the one hand and Law Enforcing Agencies (LEA) on the other hand. Various activities have since been launched, including stock takings of legal and operational obstacles that prevent collaboration, advice resulting from that, workshops that brought together members of both communities, consultation with members of both communities, etc. It was soon --------------------------------------------- http://www.enisa.europa.eu/activities/cert/support/fight-against-cybercrime… *** Vuln: OpenDNSSEC cURL API Security Bypass Vulnerability *** --------------------------------------------- OpenDNSSEC cURL API Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56679 *** How to Minimize Medical Device Risks - Ethical Hacker Offers Action Items *** --------------------------------------------- "Malware and hackers present potential security threats to wireless medical devices and safety risks to the patients who use them. But healthcare organizations and device manufacturers can take several steps to curtail those risks, says an ethical hacker who has demonstrated the vulnerability of various devices. Barnaby Jack, director of embedded device security at services firm IOActive, recently demonstrated how an implanted wireless heart defibrillator can be hacked from 50 feet away to --------------------------------------------- http://www.healthcareinfosecurity.com/how-to-minimize-medical-device-risks-… *** [webapps] - Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities *** --------------------------------------------- Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/23004 *** Bugtraq: Wordpress Plugin Simple Gmail Login Stack Trace Vulnerability *** --------------------------------------------- Wordpress Plugin Simple Gmail Login Stack Trace Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/524863 *** WhatsApp: Schwere Sicherheitslücke entdeckt *** --------------------------------------------- Über die Handynummer sowie die Seriennummer kann relativ einfach das WhatsApp-Passwort erzeugt und so ein fremder Accounts übernommen werden. Das hat das deutsche Online-Portal heise Security aufgedeckt. Die Entwickler von WhatsApp wollen aber offenbar nichts von der Lücke wissen. --------------------------------------------- http://futurezone.at/produkte/12738-whatsapp-schwere-sicherheitsluecke-entd…

1 0

Tageszusammenfassung - Mittwoch 28-11-2012
by Daily end-of-shift report 28 Nov '12

28 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-11-2012 18:00 − Mittwoch 28-11-2012 18:00 Handler: Robert Waldner Co-Handler: n/a *** Java Zero-Day Exploit on Sale for ‘Five Digits’ *** --------------------------------------------- Miscreants in the cyber underground are selling an exploit for a previously undocumented security hole in Oracles Java software that attackers can use to remotely seize control over systems running the program, KrebsOnSecurity has learned. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/P9epzhQazQ0/ *** Cooperation is key for Europes cyber security - Conclusion of ENISA Brussels event *** --------------------------------------------- "A high-level event organised by Europes cyber security agency, ENISA, recognised closer cyber cooperation and mutual support as key factors for boosting cyber security for Europes citizens, governments and businesses. The meeting, held today (27th November) in Brussels, was led by ENISAs Executive Director, Professor Udo Helmbrecht, and brought together key figures from the European Parliament, European Commission and the computer industry. Participants included Ms Amelia Andersdotter, --------------------------------------------- http://mb.cision.com/Main/119/9341197/71035.pdf *** Sysadmin creates tool to scour web for hacked data *** --------------------------------------------- "A Wellington system administrator has developed a tool to identify corporate secrets, hacked data and even stolen credit cards as they emerge on social networks and online clipboards. Users could set the OSINT OPSEC (Open Source Intelligence / Operational Security) Tool to monitor for keywords, allowing, for example, an organisation to be alerted if a hacking group dumped its sensitive data to clipboard site Pastebin. Or it could scour Stack Exchange for intellectual property code --------------------------------------------- http://www.itnews.com.au/News/324176,sysadmin-creates-tool-to-scour-web-for… *** Vuln: Tor Remote Denial of Service Vulnerability *** --------------------------------------------- Tor Remote Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56675 *** Yahoo zero day exploit goes on sale for $700 *** --------------------------------------------- "A hacker has begun selling what they claim is a zero-day exploit that will let criminals hijack control of Yahoo Mail users accounts. The hacker, who goes by the moniker TheHell, posted a video marketing a $700 exploit kit on the secretive Darkode cybercrime market on Monday. The video was later spotted and re-posted onto YouTube by security blogger Brian Krebs."Im selling Yahoo stored xss that steal Yahoo emails cookies and works on ALL browsers...." --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2227722/yahoo-zero-day-exploit-goes-on-sale-… *** DNS servers filled with wrong Kool-Aid, big names waylaid in Romania *** --------------------------------------------- Microsoft, Yahoo!, Google, PayPal all graffitid A hacker today redirected web surfers looking for Yahoo, Microsoft or Google to a page showing a TV test card by apparently poisoning Googles public DNS system.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/28/google_roma…

1 0

Tageszusammenfassung - Dienstag 27-11-2012
by Daily end-of-shift report 27 Nov '12

27 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-11-2012 18:00 − Dienstag 27-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Call for Entries: RSA Conference 2013 Innovation Sandbox *** --------------------------------------------- "RSA Conference (www. rsaconference. com), the worlds leading information security conferences and expositions, today announced its annual Innovation Sandbox program has opened a call for submissions to name the Most Innovative Company at RSA Conference 2013...." --------------------------------------------- http://www.virtual-strategy.com/2012/11/26/call-entries-rsa%C2%AE-conferenc… *** Hintertür in Traffic-Analyse-Software Piwik *** --------------------------------------------- Über eine nachträglich eingefügte Hintertür in der Web-Server-Analyse-Software Piwik können Angreifer die volle Kontrolle über das System erlangen. Wer Piwik in den vergangenen Wochen vom Server des Open-Source-Projekts geladen und installiert hat, sollte seine Server sofort überprüfen. --------------------------------------------- http://www.heise.de/security/meldung/Hintertuer-in-Traffic-Analyse-Software… *** CyberCity allows government hackers to train for attacks *** --------------------------------------------- "CyberCity has all the makings of a regular town. Theres a bank, a hospital and a power plant. A train station operates near a water tower...." --------------------------------------------- http://www.washingtonpost.com/investigations/cybercity-allows-government-ha… *** Go Daddy Resets Passwords of Customers Whose Sites Are Used to Spread Malware *** --------------------------------------------- "Last week, researchers found that cybercriminals were altering the DNS records of Go Daddy websites in an effort to redirect their visitors to their own malware-spreading domains. Go Daddy reveals that the attackers compromised the accounts by phishing out the affected customers credentials. Go Daddy representatives have told The Next Web that theyve begun identifying the affected accounts...." --------------------------------------------- http://news.softpedia.com/news/Go-Daddy-Resets-Passwords-of-Customers-Whose… *** Yahoo! email! hijack! exploit!... Yours! for! $700! *** --------------------------------------------- Cybercrook: Its a bargain, guys... They usually cost way more A cross-site scripting (XSS) flaw on Yahoo! Mail creates a means to steal cookies and hijack accounts, according to a hacker who is offering to sell an alleged zero-day vulnerability exploit for $700.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/27/yahoo_email… *** Samsung-Netzwerkdrucker mit Hintertür *** --------------------------------------------- Das US-CERT warnt vor einem fest einprogrammierten Administrator-Account in Samsung-Druckern, der die volle Kontrolle über die Geräte ermöglicht. --------------------------------------------- http://www.heise.de/security/meldung/Samsung-Netzwerkdrucker-mit-Hintertuer…

1 0

Tageszusammenfassung - Montag 26-11-2012
by Daily end-of-shift report 26 Nov '12

26 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-11-2012 18:00 − Montag 26-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Mystery Chrome 0-day exploit to be unveiled in India on Saturday *** --------------------------------------------- I dont want $60k, I want FAME? A Georgian security researcher is due to present details of an unpatched vulnerability in Googles Chrome browser at the Malcon security conference in India over the weekend. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/23/mystery_chr… *** eBay schließt kritische Sicherheitslöcher *** --------------------------------------------- Das Online-Auktionshaus hat unter anderem eine Lücke geschlossen, durch die man lesend und schreibend auf eine seiner Datenbanken zugreifen konnte. --------------------------------------------- http://www.heise.de/security/meldung/eBay-schliesst-kritische-Sicherheitslo… *** Dreamhost Breached, Server & client information leaked *** --------------------------------------------- A pastebin user using the handle Syst3mswt has posted a a dump of server information which appears to come from the well known and popular web hosting service Dream Host (http://www.dreamhost.com). --------------------------------------------- http://www.cyberwarnews.info/2012/11/24/dreamhost-breached-server-client-in… *** Digitally signed ransomware lurking in the wild *** --------------------------------------------- "Trend Micro researchers have spotted two ransomware variants bearing the same (probably stolen) digital signature in order to fool users into running the files. Other than that, the malware acts like any other ransomware: it blocks the victims computer and shows messages that seem to come either from the FBI or the UKs Police Central e-crime Unit:"Users may encounter these files by visiting malicious sites or sites exploiting a Java vulnerability," say the researchers...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2331 *** Symantec Warns of New Malware Targeting SQL Databases *** --------------------------------------------- "Symantec is warning of a new bit of malware that appears to be modifying corporate databases, particularly in the Middle East, though its showing up elsewhere in the world too. W32. Narilam, first discovered Nov. 15, follows a similar pattern of other worms by copying itself onto infected machines, adding registry keys and propogating through removable drives and network shares...." --------------------------------------------- http://threatpost.com/en_us/blogs/symantec-warns-new-malware-targeting-sql-… *** Google.com.pk and 284 Other .PK Domains Hacked *** --------------------------------------------- ryzvonusef writes with news that hackers have taken down the local Pakistan versions of many popular websites, including google.com.pk, apple.pk, microsoft.pk and yahoo.pk. 284 sites were affected in total. Many of the sites were defaced, and a group called Eboz is taking credit for the hack. According to TechCrunch, "The root of today's attack, it seems, came via a breach of Pakistan's TLD operator, PKNIC, which administers and registers all .pk domains. Looking at affected --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/iiSda5ExrUk/story01.htm *** New Cyber Security challenges take on Stuxnet and Malware *** --------------------------------------------- "The Cyber Security Challenge UK has launched four new cyber challenges for budding information security experts. Professional teams from Orange, Prodrive, (ISC)2, the SANS Institute, QiniteQ and Sophos will be testing over 100 amatuer cyber defenders who will qualify via the first-round virtual contest. The challengers will have the opportunity to compete in one of four competitions:The Orange and Prodrive Risk Analysis Candidates will have to develop a complex security architecture to --------------------------------------------- http://www.info4security.com/story.asp?sectioncode=9&storycode=4129799&c=1 *** 1-15 November 2012 Cyber Attacks Statistics *** --------------------------------------------- "This November 2012 seems really to be endless from an Information Security Perspective. We have assisted so far to a remarkable number of Cyber Attacks. As usual is it time to provide the partial snapshot of November taken from the corresponding Cyber Attack Timeline and covering the first half of the month...." --------------------------------------------- http://hackmageddon.com/2012/11/23/1-15-november-2012-cyber-attacks-statist… *** EU plant Meldepflicht für Cyber-Attacken *** --------------------------------------------- Zum besseren Schutz vor Cyber-Attacken denkt die EU auch über eine Meldepflicht von Cyberattacken für Unternehmen nach. "Ich bin ein großer Befürworter von Selbstregulierung, aber in diesem Fall fürchte ich, dass wir damit nicht weiterkommen", sagte die für die Digitale Agenda zuständige EU-Kommissarin Neelie Kroes der Süddeutschen Zeitung. --------------------------------------------- http://www.heise.de/newsticker/meldung/EU-plant-Meldepflicht-fuer-Cyber-Att… *** Phishing-Mail bittet um fotografierte TAN-Liste *** --------------------------------------------- Die Ideen gehen den Phishern nicht aus: Eine neue Phishing-Mail bittet Kunden der Deutschen Bank AG, ihre TAN-Liste zu fotografieren oder einzuscannen und über eine präparierte Seite hochzuladen. --------------------------------------------- http://www.heise.de/security/meldung/Phishing-Mail-bittet-um-fotografierte-… *** Websense Proxy Filter Bypass *** --------------------------------------------- Topic: Websense Proxy Filter Bypass Risk: Low Text:Websense Proxy Filter Bypass 1. Advisory Information Date published: 2012-11-25 Vendors contacted: Websense Release mo... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/OpLiRLavk6Y/WLB-20… *** Vuln: ModSecurity POST Parameters Security Bypass Vulnerability *** --------------------------------------------- ModSecurity POST Parameters Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56096

1 0

Tageszusammenfassung - Freitag 23-11-2012
by Daily end-of-shift report 23 Nov '12

23 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-11-2012 18:00 − Freitag 23-11-2012 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** PASSTEAL Malware Lurking on File Sharing Sites *** --------------------------------------------- "Variants of the PASSTEAL malware are propagating by masquerading as key generators for paid applications, popular e-books, and other software on file sharing services, according Alvin John Nieto, a threat response engineer at TrendMicros TrendLabs. PASSTEAL, as its name suggests, is a piece of malware that uses various password recovery tools to steal passwords stored in the browsers of its victims. Nieto claims PASSTEAL is novel in its deviation from keyloggers that simply log... --------------------------------------------- http://threatpost.com/en_us/blogs/passteal-malware-lurking-file-sharing-sit… *** Infographic of the week: Why ignoring information security is lethal *** --------------------------------------------- "Infographic of the week: Why ignoring information security is lethal...." --------------------------------------------- http://www.londonlovesbusiness.com/3978.article *** New report by EU Agency ENISA on digital trap honeypots to detect cyber-attacks creates a buzz *** --------------------------------------------- "The EU cyber security Agency ENISA is launching an in-depth study on 30 different digital traps or honeypots that can be used by Computer Emergency Response Teams (CERT)s and National/Government CERTs to proactively detect cyber-attacks. The study reveals barriers to understanding basic honeypot concepts and presents recommendations on which honeypot to use. An increasing number of complex cyber-attacks demand better early warning detection capabilities for CERTs...." --------------------------------------------- http://www.cisionwire.com/enisa---european-network-and-information-security… *** Netherlands - One in Five pay Police Virus ransom - Free tool to fix available *** --------------------------------------------- "Comment Bricade: one of the Bricade Research Analysts, Arjen de Landgraaf, is also on this Dutch Zembla television program, where he is commenting on the new Gozi Prinimalka banking trojan, amongst others. Translated Article:According to the Dutch Team High Tech Crime (THTC) of the KLPD, one in five victims of the police ransomware scam is actually paying the 100 Euros ransom. Team Leader Pim Takkenberg says (Zembla, tonight on Dutch television, 21...." --------------------------------------------- http://copsincyberspace.wordpress.com/2012/11/23/een-op-vijf-slachtoffers-b… *** Wurm manipuliert Datenbanken im Iran *** --------------------------------------------- Das Sicherheitsunternehmen Symantec hat einen spezialisierten Wurm namens W32.Narilam entdeckt, der SQL-Datenbanken kompromittieren kann. Wie Symantec schreibt, "spricht" die Schadsoftware Persisch und Arabisch und scheint sich vor allem gegen Unternehmen im Iran zu richten. --------------------------------------------- http://www.heise.de/security/meldung/Wurm-manipuliert-Datenbanken-im-Iran-1… *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-12:07.hostapd *** --------------------------------------------- FreeBSD Security Advisory FreeBSD-SA-12:07.hostapd --------------------------------------------- http://www.securityfocus.com/archive/1/524811 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-12:06.bind *** --------------------------------------------- FreeBSD Security Advisory FreeBSD-SA-12:06.bind --------------------------------------------- http://www.securityfocus.com/archive/1/524810 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-12:08.linux *** --------------------------------------------- FreeBSD Security Advisory FreeBSD-SA-12:08.linux --------------------------------------------- http://www.securityfocus.com/archive/1/524813

1 0

Tageszusammenfassung - Donnerstag 22-11-2012
by Daily end-of-shift report 22 Nov '12

22 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-11-2012 18:00 − Donnerstag 22-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Researcher Claims To Have Chrome Zero-Day, Google Says "Prove It" *** --------------------------------------------- chicksdaddy writes "Googles been known to pay $60,000 for information on remotely exploitable vulnerabilities in its Chrome web browser. So, when a researcher says that he has one, but isnt interested in selling it, eyebrows get raised. And thats just whats happening this week, with Google saying it will wait and see what Georgian researcher Ucha Gobejishvili has up his sleeve in a presentation on Saturday at the Malcon conference in New Delhi. Gobejishvili has claimed that he will --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Rd8KcBlxVgQ/story01.htm *** Vuln: NetIQ Privileged User Manager ldapagnt_eval() Remote Code Execution Vulnerability *** --------------------------------------------- NetIQ Privileged User Manager ldapagnt_eval() Remote Code Execution Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56539 *** Bug-Jäger entdeckt SCADA-Lücken – und verkauft sie *** --------------------------------------------- Der Schwachstellen-Händler ReVuln rührt weiter die Werbetrommeln und hat ein Video veröffentlicht, das Sicherheitslücken in weit verbreiteten SCADA-Industriesteueranlagen zeigen soll. Insgesamt will das Unternehmen neun Zero-Day-Lücken in SCADA-Produkten von Eaton, General Electric, Kaskad, Rockwell Automation, Schneider Electric und Siemens gefunden haben. Welche Produkte im einzelnen lückenhaft sind, gab ReVuln jedoch nicht an. --------------------------------------------- http://www.heise.de/security/meldung/Bug-Jaeger-entdeckt-SCADA-Luecken-und-… *** lighttpd 1.4.31 DOS POC *** --------------------------------------------- Topic: lighttpd 1.4.31 DOS POC Risk: High Text:#!/bin/bash # simple lighttpd 1.4.31 DOS POC # CVE-2012-5533 # http://www.lighttpd.net/2012/11/21/1-4-32/ # http://download... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/oPnZGgMtSWc/WLB-20…

1 0

Tageszusammenfassung - Mittwoch 21-11-2012
by Daily end-of-shift report 21 Nov '12

21 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-11-2012 18:00 − Mittwoch 21-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Hosting Provider Automatically Fixes Vulnerabilities In Customers Websites *** --------------------------------------------- An anonymous reader writes "Dutch hosting provider Antagonist announced their in-house developed technology that automatically detects and fixes vulnerabilities in their customers websites. The service is aimed at popular software such as WordPress, Drupal and Joomla. As soon as a vulnerability is detected, we inform the customer. We also explain how the customer can resolve the issue. In case the customer does not respond to our first notice within the next two weeks, we automatically --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/VJkhR6QbCeA/story01.htm *** PGP Zimmermann teams with Navy SEALs, SAS techies in London *** --------------------------------------------- Offers Silent Phone crypto to biz, aid workers Encryption guru Phil Zimmermann is going after security conscious users with his new venture Silent Circle, a security start-up offering ultra-secure VoIP and texting services.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/21/silent_circ… *** Vuln: Ruby CVE-2012-5371 Hash Collision Denial of Service Vulnerability *** --------------------------------------------- Ruby CVE-2012-5371 Hash Collision Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56484 *** Profi-Banking-Trojaner unterstützt SEPA-Überweisungen *** --------------------------------------------- Cyber-Ganoven versuchen Geld von den Konten deutscher Online-Banking-Kunden über SEPA-Transaktionen abzubuchen, wie die zu Intel gehörende Sicherheitsfirma McAfee berichtet. Durch SEPA werden Transaktionen innerhalb der EU unkomplizierter, da nicht mehr zwischen inländischen und grenzüberschreitenden Vorgängen unterschieden wird. --------------------------------------------- http://www.heise.de/security/meldung/Profi-Banking-Trojaner-unterstuetzt-SE… *** HTTP Strict Transport Security als Internet-Standard *** --------------------------------------------- Die Internet Engineering Task Force (IETF) hat die HTTPS-Sicherung HTTP Strict Transport Security (HSTS) als Internet-Standard im RFC 6797 veröffentlicht. Mit HSTS können einerseits (HTTP-)Server vorgeben, dass man die angebotenen Dienste ausschließlich über sichere, etwa per TLS verschlüsselte Verbindungen erreicht. Andererseits zwingt HSTS auch Anwendungsprogramme (User Agents) dazu, die Kommunikation mit Websites nur über verschlüsselte Verbindungen abzuwickeln. --------------------------------------------- http://www.heise.de/security/meldung/HTTP-Strict-Transport-Security-als-Int… *** Bugtraq: ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities *** --------------------------------------------- ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/524794

1 0

Tageszusammenfassung - Dienstag 20-11-2012
by Daily end-of-shift report 20 Nov '12

20 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-11-2012 18:00 − Dienstag 20-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Bugtraq: CVE-2012-4366: Insecure default WPA2 passphrase in multiple Belkin wireless routers *** --------------------------------------------- CVE-2012-4366: Insecure default WPA2 passphrase in multiple Belkin wireless routers --------------------------------------------- http://www.securityfocus.com/archive/1/524767 *** Hotfix für ColdFusion 10 *** --------------------------------------------- Das Update schließt eine DoS-Lücke in der Windows-Version von Adobes Anwendungsserver. --------------------------------------------- http://www.heise.de/security/meldung/Hotfix-fuer-ColdFusion-10-1752975.html… *** Vuln: Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities *** --------------------------------------------- Splunk Multiple Cross-Site Scripting and Denial of Service Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56581 *** An Android Malware Analysis: DroidKungFu *** --------------------------------------------- "Few users are aware of how Android malware works. Few understand their complexity or the amount of data they can pillage from handsets. As such, we decided to come up with a short series of articles to take apart some of the most common and potentially dangerous Android malware strands that wreak havoc on smartphones...." --------------------------------------------- http://www.hotforsecurity.com/blog/an-android-malware-analysis-droidkungfu-… *** Nintendo fixes Wii U network after claims of accidental hack *** --------------------------------------------- "Just hours after the US launch of Nintendos latest game console, the Wii U, a video game fan claims that he accidentally "hacked" into the consoles online component - the Miiverse. A Wii U user called "Trike" posted on NeoGAF that he had stumbled across a secret debug menu in the Miiverse that gave him access to a Japanese language list of administrators, with seemingly the ability to regenerate passwords and delete the access rights of admins."At first it asked... --------------------------------------------- http://nakedsecurity.sophos.com/2012/11/19/nintendos-wii-u-network-hack/ *** Malware made which can share a smartcard over the internet *** --------------------------------------------- Use a bank or ID card as though you had it with you Security researchers have developed proof-of-concept malware that allows attackers to obtain remote access to smart card readers attached to compromised Windows PCs.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/20/smart_card_… *** Raiffeisen Introduces PhotoTAN to Protect Customer Transactions Against Malware *** --------------------------------------------- "European banks, which are said to have implemented far more advanced security mechanisms to protect their customers than the ones from the US, are trying to live up to their reputation. Swiss bank Raiffeisen has introduced a new security feature that relies on Crontos Visual Transaction Signing Solution. Available for customers in Switzerland starting today, the CrontoSign is designed to protect online transactions against cyberattacks that rely on clever information-stealing Trojans such... --------------------------------------------- http://news.softpedia.com/news/Raiffeisen-Introduces-PhotoTAN-to-Protect-Cu… *** WhatsApp stopft Sicherheitsloch – und verlangt Abo-Gebühren *** --------------------------------------------- Der Betreiber der beliebten SMS-Alternative WhatsApp hat heimlich Änderungen an seinem Dienst vorgenommen, um eine seit längerer Zeit bekannte Schwachstelle zu stopfen. Auf viele Nutzer wartete jedoch gleich die nächste böse Überraschung: Die WhatsApp-Nutzung kostet auf den meisten Smartphone-Plattformen ab sofort Geld. --------------------------------------------- http://www.heise.de/security/meldung/WhatsApp-stopft-Sicherheitsloch-und-ve… *** Bugtraq: OSSIM 4.0.2 open-source SIEM solution does not verify .deb signatures *** --------------------------------------------- OSSIM 4.0.2 open-source SIEM solution does not verify .deb signatures --------------------------------------------- http://www.securityfocus.com/archive/1/524779 *** Bugtraq: SonicWALL CDP 5040 v6.x - Multiple Web Vulnerabilities *** --------------------------------------------- SonicWALL CDP 5040 v6.x - Multiple Web Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/524777

1 0

Tageszusammenfassung - Montag 19-11-2012
by Daily end-of-shift report 19 Nov '12

19 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-11-2012 18:00 − Montag 19-11-2012 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** Bugtraq: [SE-2012-01] Security vulnerabilities in Java SE (details released) *** --------------------------------------------- [SE-2012-01] Security vulnerabilities in Java SE (details released) --------------------------------------------- http://www.securityfocus.com/archive/1/524746 *** Bugtraq: DC4420 - London DEFCON - November meet - Tuesday 20th November *** --------------------------------------------- DC4420 - London DEFCON - November meet - Tuesday 20th November --------------------------------------------- http://www.securityfocus.com/archive/1/524745 *** Stealing VM Keys from the Hardware Cache *** --------------------------------------------- "This paper details the construction of an access-driven side-channel attack by which a malicious virtual machine (VM) extracts fine-grained information from a victim VM running on the same physical computer. This attack is the first such attack demonstrated on a symmetric multiprocessing system virtualized using a modern VMM (Xen). Such systems are very common today, ranging from desktops that use virtualization to sandbox application or OS compromises, to clouds that co-locate the... --------------------------------------------- http://www.schneier.com/blog/archives/2012/11/stealing_vm_key.html *** Whats stopping your company from implementing full disk encryption? *** --------------------------------------------- "You may have heard about the stolen NASA laptop, with its large amount of personally identifiable information of at least 10,000 NASA employees and contractors. The surprising question here, of course, has to do with the glaring absence of encryption. NASA says that that the laptop in question is scheduled to get encryption, though it would seem that not all laptops will get the same treatment...." --------------------------------------------- http://www.fiercecio.com/techwatch/story/whats-stopping-your-company-implem… *** perl-CGI Newline injection in Set-Cookie and P3P headers *** --------------------------------------------- Topic: perl-CGI Newline injection in Set-Cookie and P3P headers Risk: Low Text:header() can generate Set-Cookie and P3P headers which contain invalid newlines. use CGI qw/header/; print header( -c... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/CF3xwRXWBfs/WLB-20… *** NFR Agent FSFUI Record File Upload RCE *** --------------------------------------------- Topic: NFR Agent FSFUI Record File Upload RCE Risk: High Text:## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/zr0GNt7G1z0/WLB-20… *** FreeBSD Project Discloses Security Breach Via Stolen SSH Key *** --------------------------------------------- An anonymous reader writes "Following recent compromises of the Linux kernel.org and Sourceforge, the FreeBSD Project is now reporting that several machines have been broken into. After a brief outage, ftp.FreeBSD.org and other services appear to be back. The project announcement states that some deprecated services (e.g., cvsup) may be removed rather than restored. Users are advised to check for packages downloaded between certain dates and replace them, although not because known trojans... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/KpcXI-S6fFw/freebsd-project… *** Hackers Hate MVIS Security Center - the New WordPress Security Plugin *** --------------------------------------------- "SEC Consult launches the beta phase of MVIS Security Center, an enterprise-grade security plugin for WordPress, the worlds most widely used content management system (CMS). WordPress attracts millions of users from around the world, and these users are facing increasing attacks from hackers. Even more alarming, these attacks occur on all types of websites, big or small which makes security an indispensable part of creating websites...." --------------------------------------------- http://news.yahoo.com/hackers-hate-mvis-security-center-wordpress-security-… *** Trojaner benutzt Google Docs als Kommunikationskanal *** --------------------------------------------- Ein neue entdeckter Trojaner verwendet die Viewer-Funktion von Googles Office-Anwendung, um Verbindung mit seinem Kontrollrechner aufzunehmen. Google könnte das mit einer Firewall unterbinden. --------------------------------------------- http://www.heise.de/security/meldung/Trojaner-benutzt-Google-Docs-als-Kommu… *** Why smart people do dumb things online *** --------------------------------------------- "David Petraeus is probably the last person you might have expected to wreck his career with an email scandal. Petraeus is smart: He graduated in the top five percent of his class at West Point and went on to earn a Ph.D. Petraeus has self-control: His self-discipline was " legendary," according to Time Magazine...." --------------------------------------------- http://computerworld.co.nz/news.nsf/news/why-smart-people-do-dumb-things-on… *** Active XSS flaw discovered on eBay *** --------------------------------------------- "According to XSSed, Indian security researcher Shubham Upadhyay has discovered an active XSS flaw affecting Ebay. com. The potential attacker would need an Ebay seller account, where he would put XSS code into the HTML...." --------------------------------------------- http://www.zdnet.com/active-xss-flaw-discovered-on-ebay-7000007539/ *** German Police Warn Mobile Phone Users of ZeuS Malware *** --------------------------------------------- "Germanys Berlin Police Department has issued a warning after numerous bank customers have reported fraudulent cash withdrawals. All the victims own Android smartphones and they all rely on mTAN (mobile transaction authentication numbers) when performing banking transactions. F-Secure experts reveal that the malware involved in these incidents is most likely the mobile version of ZeuS, also known as ZeuS-in-the-Mobile or Zitmo...." --------------------------------------------- http://news.softpedia.com/news/German-Police-Warns-Mobile-Phone-Users-of-Ze… *** How Malware survives to Malware detection mechanisms *** --------------------------------------------- Today I'd like to share some basic techniques that Malware(s) use to protect themselves from being detected. Some of the most used approaches to detect Maware could be described as follows: 1. Virtualize the environment in where Malware(s) run. 2. Attach a debugger to Malware processes and 3. Sandbox the execution of the analyzed Malware. It comes straight forward that Malware writers need new techniques to... --------------------------------------------- http://marcoramilli.blogspot.nl/2012/11/how-malware-survives-to-malware.html *** Vuln: IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities *** --------------------------------------------- IBM Business Process Manager Multiple Cross Site Scripting Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56583 *** Vuln: Moodle Multiple Security Vulnerabilities *** --------------------------------------------- Moodle Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56505

1 0

Tageszusammenfassung - Freitag 16-11-2012
by Daily end-of-shift report 16 Nov '12

16 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-11-2012 18:00 − Freitag 16-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Google Chrome mit Sandbox für OS X *** --------------------------------------------- Google Chrome sperrt das Flash-Plug-in mit dem aktuellen Stable-Release 23 auch unter OS X in eine Sandbox, wie die Entwickler in ihrem Blog berichten. --------------------------------------------- http://www.heise.de/security/meldung/Google-Chrome-mit-Sandbox-fuer-OS-X-17… *** Antivirus startup linked to infamous Chinese hacker *** --------------------------------------------- "Anvisoft, a Chinese antivirus startup, has been linked to an infamous hacker suspected of developing sophisticated malware used to siphon sensitive information from Defense Department contractors in 2006. Through some high-tech sleuthing on the Web, Brian Krebs, author of the KrebsonSecurity blog, found Anvisoft-connected IP addresses connected Anvisoft to registered to "tandailin" in Gaoxingu, China. Tan Dailin, a.k.a. Withered Rose, was the subject of Verisigns 2007 iDefense --------------------------------------------- http://www.csoonline.com/article/721678/antivirus-startup-linked-to-infamou… *** Proof-of-concept malware can share USB smart card readers with attackers over Internet *** --------------------------------------------- "A team of researchers have created a proof-of-concept piece of malware that can give attackers control of USB smart card readers attached to an infected Windows computer over the Internet. The malware installs a special driver on the infected computer which allows for the USB devices connected to it to be shared over the Internet with the attackers computer. In the case of USB smart card readers, the attacker can use the middleware software provided by the smart card manufacturer to --------------------------------------------- http://www.cio.com.au/article/442216/proof-of-concept_malware_can_share_usb… *** Password Reset Zero-Day Reported to Skype Since October (Updated) *** --------------------------------------------- "The details of a zero-day vulnerability that allows attackers to change the password of any Skype user have been posted on a Russian hacking forum. A similar security hole was identified by Vulnerability Lab researchers and it was reported to Skype at the beginning of October. The Next Web, which was the first to publicly reveal the existence of the flaw, reports that its details have been posted on the forum some two months ago...." --------------------------------------------- http://news.softpedia.com/news/Skype-Password-Reset-Zero-Day-Reported-to-Sk… *** Trojan.Gapz.1 infecting Windows in a new manner *** --------------------------------------------- November 12, 2012 The anti-virus lab of Doctor Web - the Russian IT security vendor - has been informed of another piece of bootkit malware that is capable of concealing itself in an infected system. This application, added into virus databases under the name Trojan.Gapz.1, employs fairly interesting mechanisms to infect user computers. One of the rootkit´s purposes in an infected PC is to create an environment for loading its core modules which feature various functions. --------------------------------------------- http://news.drweb.com/show/?i=2979&lng=en&c=9 *** How to report a computer crime: SQL injection website attack *** --------------------------------------------- "Do you know how to report a computer crime? Or even who you would report it to? So far, weve looked at unauthorised email account access and malware in our series of articles on how to report a computer crime...." --------------------------------------------- http://nakedsecurity.sophos.com/2012/11/15/computer-crime-sql-injection/ *** [papers] - Guidelines for Pentesting a Joomla Based Site *** --------------------------------------------- Guidelines for Pentesting a Joomla Based Site --------------------------------------------- http://www.exploit-db.com/download_pdf/22763 *** VMware security updates for vSphere API and ESX Service Console *** --------------------------------------------- VMware has updated the vSphere API to address a denial of service vulnerability in ESX and ESXi. VMware has also updated the ESX Service Console to include several open source security updates. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2012-0016.html

1 0

Tageszusammenfassung - Donnerstag 15-11-2012
by Daily end-of-shift report 15 Nov '12

15 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-11-2012 18:00 − Donnerstag 15-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Battery-Powered Transmitter Could Crash A Citys 4G Network *** --------------------------------------------- DavidGilbert99 writes "With a £400 transmitter, a laptop and a little knowledge you could bring down an entire citys high-speed 4G network. This information comes from research carried out in the U.S. into the possibility of using LTE networks as the basis for a next-generation emergency response communications system. Jeff Reed, director of the wireless research group at Virginia Tech, along with research assistant Marc Lichtman, described the vulnerabilities to the National --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/RXIyRXl8838/story01.htm *** Hacker Grabs 150k Adobe User Accounts Via SQL Injection *** --------------------------------------------- CowboyRobot writes "Adobe today confirmed that one of its databases has been breached by a hacker and that it had temporarily taken offline the affected Connectusers.com website. The hacker, who also goes by Adam Hima, told Dark Reading that the server he attacked was the Connectusers.com Web server, and that he exploited a SQL injection flaw to execute the attack. It was an SQL Injection vulnerability, somehow I was able to dump the database in less requests than normal people do, he --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/xRkFposRNps/story01.htm *** Free hacking tool kits fuel cyber arms race *** --------------------------------------------- "Ryan Linns hacks into corporate networks have become almost a matter of routine. On one recent morning, he woke up at his home near the Research Triangle in eastern North Carolina and walked down to an extra bedroom that he uses as an office. He sat at a workbench laden with computers, signed on to one of them and loaded a program called Metasploit...." --------------------------------------------- http://www.smh.com.au/it-pro/security-it/free-hacking-tool-kits-fuel-cyber-… *** Top 25 passwords of 2012 revealed *** --------------------------------------------- "Just under a year ago we published a blog about the most popular passwords on the web as announced by security app company SplashData. The ranking is based on password information from compromised accounts posted by hackers online. This year, the list is back!..." --------------------------------------------- http://blogs.avg.com/consumer/top-25-passwords-2012-revealed/?utm_source=AV… *** Obama segnet angeblich Direktive zur Cyber-Sicherheit ab *** --------------------------------------------- US-Präsident Obama hat vor einigen Wochen eine geheime Anweisung unterzeichnet, die die Operationen der USA im Cyberspace neu regeln soll. Das berichtete die Washington Post und beruft sich auf mehrere Quellen, die sich jedoch nicht öffentlich dazu äußern dürften. --------------------------------------------- http://www.heise.de/security/meldung/Obama-segnet-angeblich-Direktive-zur-C… *** NASA To Encrypt All of Its Laptops *** --------------------------------------------- pev writes "After losing another laptop containing personal information, NASA wants to have all of its laptops encrypted within a months time with an intermediate ban of laptops containing sensitive information leaving its facilities. Between April 2009 and April 2011 it lost or had stolen 48 mobile computing devices. I wonder how it will be before other large organisations start following suit as a sensible precaution?" Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/vvQZvrqrp34/story01.htm *** Opera site served Blackhole malvertising, says antivirus firm *** --------------------------------------------- No need to issue a press release, firm tells press Opera has suspended ad-serving on its portal as a precaution while it investigates reports that surfers were being exposed to malware simply by visiting the Norwegian browser firms home page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/15/opera_black… *** Sicherheitsupdate für Mac Office 2008 und 2011 *** --------------------------------------------- Microsoft hat in der Nacht zum Donnerstag für zwei Versionen seines Büropakets größere Aktualisierungen online gestellt. Laut Aussage des Konzerns beheben das Office 2008 for Mac 12.3.5 Update sowie Office for Mac 2011 14.2.5 signifikante Sicherheitslücken. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsupdate-fuer-Mac-Office-2008… *** Bugzilla Informartion Leak & Cross Site Scripting *** --------------------------------------------- Topic: Bugzilla Informartion Leak & Cross Site Scripting Risk: Medium Text:Summary = Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following securit... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/IoQFDSoFWoc/WLB-20…

1 0

Tageszusammenfassung - Mittwoch 14-11-2012
by Daily end-of-shift report 14 Nov '12

14 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-11-2012 18:00 − Mittwoch 14-11-2012 18:21 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Skype Disables Password Resets After Huge Security Hole Discovered *** --------------------------------------------- another random user writes with news of a vulnerability in the Skype password reset tool "All you need to do is register a new account using that email address, and even though that address is already used (and the registration process does tell you this) you can still complete the new account process and then sign in using that account Info (original post in Russian)" concealment adds a link to another article with an update that Skype disabled the password reset page as a temporary --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/XnPnK6MWZdY/story01.htm *** Wichtige Updates für alle Windows-Nutzer *** --------------------------------------------- An seinem November-Patchday hat Microsoft kritische Lücken in allen noch unterstützen Windows-Versionen geschlossen - von Windows XP SP3 bis hin zu dem gerade erst veröffentlichten Windows 8. --------------------------------------------- http://www.heise.de/security/meldung/Wichtige-Updates-fuer-alle-Windows-Nut… *** Lockheed Martin: dramatischer Anstieg von Cyber-Angriffen *** --------------------------------------------- Die Anzahl der Attacken auf das Firmennetzwerk des US-Rüstungskonzerns Lockheed Martin haben sich in den letzten Jahren deutlich verstärkt. Das erklärte die Lockheed-Vizepräsidentin Chandra McMahon, wie die BBC berichtete. --------------------------------------------- http://www.heise.de/security/meldung/Lockheed-Martin-dramatischer-Anstieg-v… *** Trojan Horses, Malware and Other Cyber Attack Tools are Just a Click Away *** --------------------------------------------- "Ryan Linns hacks into corporate networks have become almost a matter of routine. On one recent morning, he woke up at his home near the Research Triangle in eastern North Carolina and walked down to an extra bedroom that he uses as an office. He sat at a workbench laden with computers, signed on to one of them and loaded a program called Metasploit...." --------------------------------------------- http://www.oregonlive.com/newsflash/index.ssf/story/trojan-horses-malware-a… *** Online-Banking-Trojaner mit Android-Komplizen *** --------------------------------------------- Online-Ganoven versuchen offenbar verstärkt auch die Smartphones von Online-Banking-Nutzern zu infizieren, um mTans abzugreifen. Bei der Berliner Polizei sind "in den letzten Wochen" mehrere Strafanzeigen von Opfern betrügerischer Geldabbuchungen eingegangen, bei denen die Smartphones der Opfer eine entscheidende Rolle spielten. --------------------------------------------- http://www.heise.de/security/meldung/Online-Banking-Trojaner-mit-Android-Ko… *** Windows 8 security is like a swiss cheese flak jacket - sez AV firm *** --------------------------------------------- "The knives are out for Windows Defender, the basic anti-malware protection bundled with Windows 8: makers of rival antivirus products are lining up to criticise Microsofts efforts to secure its operating system. Windows 8 can be infected by 16 percent of the most common malware families, even with Windows Defender activated, according to tests by Romanian antivirus vendor Bitdefender. The latest version of Microsofts OS was compromised by 61 of 385 malware samples flung at it by --------------------------------------------- http://www.theregister.co.uk/2012/11/13/win_defender_inadequate/

1 0

Tageszusammenfassung - Dienstag 13-11-2012
by Daily end-of-shift report 13 Nov '12

13 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-11-2012 18:00 − Dienstag 13-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: Stefan Lenzhofer *** Ruby-Update behebt DoS-Lücke *** --------------------------------------------- Die Entwickler der Programmiersprache Ruby schließen mit Version 1.9.3-p327 eine Schwachstelle, die es Angreifern erlaubt, ein System durch hohe CPU-Last lahm zu legen (Denial of Service, DoS). Der Fehler tritt beim Verarbeiten speziell präparierter Zeichenketten durch die Hash-Funktion MurmurHash auf. --------------------------------------------- http://www.heise.de/security/meldung/Ruby-Update-behebt-DoS-Luecke-1748451.… *** Cybercriminals start spamvertising Xmas themed scams and malware campaigns *** --------------------------------------------- "Security researchers from Symantec are warning about a recently intercepted flood of Xmas themed malicious and fraudulent campaigns. Isn't it too early for such type of campaigns to be launched, or are the spammers behind these campaigns relying on a different set of marketing tactics? The campaign is a great example of a flawed event-based social engineering attempt...." --------------------------------------------- http://www.zdnet.com/cybercriminals-start-spamvertising-xmas-themed-scams-a… *** Firefox users slowest to update browser, Kaspersky Lab finds out *** --------------------------------------------- "Nearly one in four PC users run out-of-date or obsolete versions of the most popular browsers for a month or longer with Mozilla Firefox users the slowest to update their software, Kaspersky Lab has found. The company looked at the browsers installed on a random 10-million sample of its antivirus user base, finding that Internet Explorer was marginally the most common default browser on 37,8 percent of users...." --------------------------------------------- http://news.techworld.com/security/3410386/firefox-users-slowest-update-bro… *** First Windows 8 and Windows RT Security Updates Due Next Week *** --------------------------------------------- "Plenty is happening on the Microsoft patch management front. First, Adobe agreed to sync up its patch release cycles with Microsofts on the second Tuesday of every month, moving away from quarterly releases. And now on Tuesday, Microsoft will release its first security updates since the release of Windows 8...." --------------------------------------------- http://threatpost.com/en_us/blogs/first-windows-8-and-windows-rt-security-u… *** New report warns of SCADA CYBERGEDDON* *** --------------------------------------------- In the worst case. The industrial control system fright machine is getting another kick along today, via a survey by Russian vendor Positive Technologies. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/12/scada_vulne… *** Samsung Galaxy S3 sichert Passwörter im Klartext *** --------------------------------------------- Beim beliebten Samsung Galaxy S3 ist eine Sicherheitslücke gefunden worden. Die interne App S-Memo speichert Passwörter im Klartext. Damit wird es möglich, dass jeder, der sich Zugriff beschaffen kann und weiß, wo das entsprechende File liegt, dieses auch tatsächlich lesen kann. --------------------------------------------- http://futurezone.at/digitallife/12422-galaxy-s3-sichert-passwoerter-im-kla… *** Even a CHILD can make a Trojan to pillage Windows Phone 8 *** --------------------------------------------- Whippersnapper will reveal all in the Malcon tent A teenager has crafted prototype malware for Windows Phone 8 just weeks after the official unveiling of the smartphone platform. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/13/windows_pho… *** BSI-Test: Verwundbarkeit von Windows-Rechnern im Netz *** --------------------------------------------- Windows-Systeme soll man stets auf dem aktuellen Stand halten, beim Browser greift man am besten zu Google Chrome, auf Java verzichtet man möglichst ganz - das predigen sowohl c't als auch das Bundesamt für Sicherheit in der Informationstechnik (BSI). --------------------------------------------- http://www.heise.de/security/meldung/BSI-Test-Verwundbarkeit-von-Windows-Re… *** Top 5 Security Predictions for 2013 from Symantec *** --------------------------------------------- "With this year quickly coming to an end, its time for us at Symantec to publish our predictions on what we expect will happen in the world of cybersecurity for the coming year. Most of us at Symantec tend to be fact-based, data-driven individuals. However, predicting the future always involves a bit of speculation...." --------------------------------------------- http://www.symantec.com/connect/blogs/top-5-security-predictions-2013-syman… *** Vuln: libproxy CVE-2012-4504 Stack-Based Buffer Overflow Vulnerability *** --------------------------------------------- libproxy CVE-2012-4504 Stack-Based Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/55909

1 0

Tageszusammenfassung - Montag 12-11-2012
by Daily end-of-shift report 12 Nov '12

12 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-11-2012 18:00 − Montag 12-11-2012 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Webmix - 26 Terabyte Webseiten zu Österreich gesammelt *** --------------------------------------------- Web@rchiv Österreich umfasst mittlerweile eine Milliarde Einzeldateien --------------------------------------------- http://text.derstandard.at/1350260844999/26-Terabyte-Webseiten-zu-Oesterrei… *** Windows 8 Defeats 85% of Malware Detected In the Past 6 Months *** --------------------------------------------- An anonymous reader writes "Now that Windows 8 is on sale and has already been purchased by millions, expect very close scrutiny of Microsofts latest and greatest security features. 0-day vulnerabilities are already being claimed, but what about the malware thats already out there? When tested against the top threats, Windows 8 is immune to 85 percent of them, and gets infected by 15 percent, according to tests run by BitDefender." Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/HOHG0NiFov4/windows-8-defea… *** Stuxnet Infected Chevrons IT Network *** --------------------------------------------- "Stuxnet, a sophisticated computer virus created by the United States and Israel, to spy on and attack Irans nuclear enrichment facilities in Natanz also infected Chevron s network in 2010, shortly after it escaped from its intended target. Chevron found Stuxnet in its systems after the malware was first reported in July 2010, said Mark Koelmel, general manager of the earth sciences department at Chevron. I dont think the U.S. government even realized how far it had spread, he told CIO --------------------------------------------- http://www.cyberwarzone.com/stuxnet-infected-chevron%E2%80%99s-it-network *** Hintergrund: Dropbox ist "ziemlich sicher" *** --------------------------------------------- Die beiden Sicherheitsexperten Florian Ledoux und Nicolas Ruff aus der IT-Abteilung von EADS haben einen kritischen Blick auf Dropbox geworfen und ihre Ergebnisse kürzlich auf der Security-Koferenz hack.lu vorgestellt. --------------------------------------------- http://www.heise.de/security/artikel/Dropbox-ist-ziemlich-sicher-1746596.ht… *** Weaponized Malware: Top Four Cyberattack Tools *** --------------------------------------------- "Over the past two years, four pieces of malware have emerged as veritable weapons and have been used for destructive purposes or to assist in such attacks.1. Stuxnet is the most widely known of the four. Stuxnet was designed with a highly specialized malware payload that targeted SCADA systems that control specific industrial processes...." --------------------------------------------- http://cyberwarzone.com/weaponized-malware-top-four-cyberattack-tools *** Ransom malware gangs making huge profits, Symantec discovers *** --------------------------------------------- "The problem of ransom malware has reached epidemic proportions and could be extracting fraudulent payments from as many as 3 percent of victims, a Symantec report has calculated. In a world already afflicted by botnets, banking Trojans and established problems such as keyloggers and spam, ransomware programs that lock victims computers or files until a ransom payment is made - has grown into a major problem, with surprisingly little coverage from security vendors until recently. Symantecs --------------------------------------------- http://news.techworld.com/security/3410078/ransom-malware-gangs-making-huge… *** Critical Vulnerabilities In Call of Duty: Modern Warfare 3, CryEngine 3 *** --------------------------------------------- hypnosec writes with news that two security consultants have found vulnerabilities in Call of Duty: Modern Warfare 3 and the CryEngine 3 graphics engine that could harm game makers and players alike. Presenting at the Power of Community (POC2012) security conference, the researchers demonstrated how a denial-of-service attack could affect Modern Warfare 3, and how a server-level attack on CryEngine 3 allowed them to "create a remote shell on a game-players computer." "Once you --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/itbD8UlgSco/critical-vulner… *** Sandy turned off the lights, the phones, and the heat. A cyber attack could make it all happen again *** --------------------------------------------- "Verizons chief technology officer surveyed a flooded major switching facility in lower Manhattan and put it bluntly: "There is nothing working here. Quite frankly, this is wider than the impacts of 9/11." Damage from Sandy is estimated to reach $20 billion, and interrupted phone service is among the least of it. Flooding in New Yorks century-old subway system is without parallel...." --------------------------------------------- http://www.foreignpolicy.com/articles/2012/11/07/network_news?page=0,0 *** Malware Spy Network Targeted Israelis, Palestinians *** --------------------------------------------- Researchers in Norway have uncovered evidence of a vast Middle Eastern espionage network that for the past year has deployed malicious software to spy on Israeli and Palestinian targets. The discovery, by Oslo-based antivirus and security firm Norman ASA, is the latest in a series of revelations involving digital surveillance activity of unknown origin that [...] --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/k12j_R4yBAo/ *** Telekom regt Sicherheits-Allianz der Unternehmen an *** --------------------------------------------- Die Deutsche Telekom wirbt verstärkt um ein gemeinsames Vorgehen der Wirtschaft im Kampf gegen Gefahren aus dem Internet. Der Chef der Geschäftskundentochter T-Systems, Reinhard Clemens, macht sich jetzt für eine gemeinsame IT-Sicherheitstruppe mit der Gründung eines spezialisierten Unternehmens stark, wie die Financial Times Deutschland berichtet. --------------------------------------------- http://www.heise.de/security/meldung/Telekom-regt-Sicherheits-Allianz-der-U… *** Citadel Trojan Tough for Banks to Beat *** --------------------------------------------- "The banking Trojan known as Citadel, which debuted in underground forums in January 2012, has evolved to become one of the financial industrys greatest worries, cybersecurity experts say. Citadel, an advanced variant of Zeus, is a keylogger that steals online-banking credentials by capturing keystrokes. Fraudsters then use stolen login IDs and passwords to access online accounts, take them over and schedule fraudulent transactions...." --------------------------------------------- http://www.bankinfosecurity.com/citadel-trojan-tough-for-banks-to-beat-a-52…

1 0

Tageszusammenfassung - Freitag 9-11-2012
by Daily end-of-shift report 09 Nov '12

09 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-11-2012 18:00 − Freitag 09-11-2012 18:00 Handler: Stephan Richter Co-Handler: Matthias Fraidl *** PixSteal-A Trojan Steals Images, Uploads to Iraqi FTP Server *** --------------------------------------------- "A new Trojan has been identified that has the capability of stealing images from infected computers, setting the stage for anything from identity theft to blackmail. PixSteal-A also pilfers . dmp, or Windows memory dump files that contain data on system crashes and sends all stolen data to a remote FTP server in Iraq, according to Sophos. This isnt the first malware to target non text-based files...." --------------------------------------------- http://threatpost.com/en_us/blogs/pixsteal-trojan-steals-images-uploads-ira… *** Microsoft Security Bulletin Advance Notification for November 2012 *** --------------------------------------------- "This is an advance notification of security bulletins that Microsoft is intending to release on November 13, 2012. This bulletin advance notification will be replaced with the November bulletin summary on November 13, 2012. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification...." --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms12-nov *** QRishing Study: Curiosity Is the Largest Motivating Factor for Scanning QR Codes *** --------------------------------------------- "Researchers from the Carnegie Mellon Universitys CyLab have released the results of a study QRishing: The Susceptibility of Smartphone Users to QR Code Phishing Attacks which focuses on phishing attacks that rely on QR (Quick Response) codes. QRishing is a term utilized for phishing attacks initiated via the scanning of QR codes. Such attacks are not new, but in the past period researchers have started examining them because theyre becoming more and more common...." --------------------------------------------- http://news.softpedia.com/news/QRishing-Study-Curiosity-is-the-Largest-Moti… *** Windows 8, Surface slabs ALREADY need critical security patch *** --------------------------------------------- Mega vulns affect ALL Windows kit from XP onward Microsoft will release critical updates for Windows 8 and other software on Novembers Patch Tuesday next week. The upgrades will arrive within weeks of the Win 8 launch at the end of last month. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/09/nov_patch_t… *** IT-Business - Cisco warnt: "Cyberkriminelle nur einen Mausklick entfernt" *** --------------------------------------------- Internetumfrage ortet große Mängel in Österreichs Unternehmen --------------------------------------------- http://derstandard.at/1350260880632/Cisco-warnt-Cyberkriminelle-nur-einen-M… *** Siemens software targeted by Stuxnet still full of holes *** --------------------------------------------- Software made by Siemens and targeted by the Stuxnet malware is still full of other dangerous vulnerabilities, according to Russian researchers whose presentation at the Defcon security conference earlier this year was cancelled following a request from the company. --------------------------------------------- https://www.computerworld.com/s/article/9233378/Siemens_software_targeted_b… *** Kreditkarte mit Display und Tastatur *** --------------------------------------------- Mastercard hat eine neue Kreditkarte vorgestellt, die mit einem monochromen LCD-Display und numerischen Tasten ausgestattet ist. Sie bietet laut dem Unternehmen neben den normalen Funktionen einer Kreditkarte auch die Möglichkeit, Einmal-Passworte zur Authentifizierung zu generieren. --------------------------------------------- http://www.heise.de/security/meldung/Kreditkarte-mit-Display-und-Tastatur-1… *** Facebook Chat Can Be Used to Launch DOS Attacks, Expert Finds *** --------------------------------------------- Security researcher Chris C. Russo claims to have discovered a way to use Facebook's chat module to launch denial-of-service (DOS) attack against any user, even if they're not friends with the attacker. --------------------------------------------- http://news.softpedia.com/news/Facebook-Chat-Can-Be-Used-to-Launch-DOS-Atta…

1 0

Tageszusammenfassung - Donnerstag 8-11-2012
by Daily end-of-shift report 08 Nov '12

08 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-11-2012 18:00 − Donnerstag 08-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** New Backdoor DDoS Malware Co-Existing on Gh0stRAT-Infected Machines *** --------------------------------------------- "Gh0st RAT has a new roommate. A new backdoor called ADDNEW has been discovered on machines infected with the Gh0st remote access Trojan, adding new distributed denial of service attack capabilities, as well as a feature that targets passwords and credentials stored on the Firefox browser. Gh0st RAT is a notorious piece of malware having been used in the Aurora attacks on Google, Adobe and other large manufacturers and technology companies...." --------------------------------------------- http://threatpost.com/en_us/blogs/new-backdoor-ddos-malware-co-existing-gh0… *** Experts Warn of Zero-Day Exploit for Adobe Reader *** --------------------------------------------- Software vendor Adobe says it is investigating claims that instructions for exploiting a previously unknown critical security hole in the latest versions of its widely-used PDF Reader software are being sold in the cybercriminal underground.The finding comes from malware analysts at Moscow-based forensics firm Group-IB, who say theyve discovered that a new exploit capable of compromising the security of computers running Adobe X and XI (Adobe Reader 10 and 11) is being sold in the underground --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Kr8ZV2vC2Fc/ *** Malware Forum Logs from Control Systems, Part Deux *** --------------------------------------------- "Last September, I did a guest blog post titled Online-Malware-Support-Shows-Infected-ICS-Computers, where I searched for HiJackThis posts containing automation software. Basically, there are forums available to users that had been infected with viruses. These users can run a set of programs, including HijackThis, DDS, OTS, and others, to pull information from the system...." --------------------------------------------- http://www.digitalbond.com/2012/11/07/malware-forum-logs-from-control-syste… *** Innenministerium plant IT-Sicherheitsgesetz *** --------------------------------------------- Die IT-Beauftragte der Bundesregierung, Cornelia Rogall-Grothe, hat eine neue Security-Initiative umrissen. Mit einem IT-Sicherheitsgesetz sollten einschlägige Mindeststandards für Betreiber kritischer Infrastrukturen etwa in den Bereichen Energie, Informations- und Kommunikationstechnologien oder der Wasserversorgung verankert werden, erklärte die Staatssekretärin auf einem Symposium in Washington. Sie würden mit dem Vorhaben zudem dazu verpflichtet, "erhebliche IT-Sicherheitsvorfälle" zu melden. --------------------------------------------- http://www.heise.de/security/meldung/Innenministerium-plant-IT-Sicherheitsg… *** Apple patcht Quicktime für Windows *** --------------------------------------------- Apple hat die Windows-Ausgabe seines Multimedia-Abspielsystems Quicktime auf Version 7.7.3 aktualisiert. Die neue Ausgabe behebt zahlreiche kritische Sicherheitslücken. --------------------------------------------- http://www.heise.de/security/meldung/Apple-patcht-Quicktime-fuer-Windows-17… *** [TYPO3-announce] Announcing TYPO3 CMS 4.5.21, 4.6.14 and 4.7.6 *** --------------------------------------------- the TYPO3 Community has just released TYPO3 CMS versions 4.5.21, 4.6.14 and 4.7.6 which are now ready for you to download. All versions are maintenance releases and contain bug fixes and security fixes. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… *** E-Mail-Sicherheit: Hilfe gegen DKIM-Schwäche *** --------------------------------------------- Lange und wechselnde Schlüssel mit Verfallsdatum sowie der nötige Nachdruck beim E-Mail-Provider helfen laut der Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) gegen die kürzlich bekannt gewordene Lücke bei DKIM, der Authentizitäts-Sicherung von E-Mail-Absendern. --------------------------------------------- http://www.heise.de/security/meldung/E-Mail-Sicherheit-Hilfe-gegen-DKIM-Sch… *** Sicherheitslücke im TOR-Client *** --------------------------------------------- Wie Code-Experte Andrey Karpov bei einer Analyse des TOR-Quellcodes herausfand, verwendet die Anonymisierungssoftware eine Funktion namens memset() zum Löschen von Cache-Daten, welche nicht von allen Compilern unterstützt wird. Das kann unter Umständen dazu führen, dass der TOR-Client vertrauliche Daten wie etwa Passwörter im Speicher zurück lässt, wenn er beendet wird. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-im-TOR-Client-174652…

1 0

Tageszusammenfassung - Mittwoch 7-11-2012
by Daily end-of-shift report 07 Nov '12

07 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 06-11-2012 18:00 − Mittwoch 07-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Nachfolger für RFC-Ignorant.Org in Sicht *** --------------------------------------------- Der Datenbestand der im Oktober außer Betrieb gegangenen Anti-Spam-Blacklist RFC-Ignorant.Org wird unter RFC-Ignorant.de bei einem neuen Hoster weitergepflegt. --------------------------------------------- http://www.heise.de/security/meldung/Nachfolger-fuer-RFC-Ignorant-Org-in-Si… *** Epic FAIL: Anonymous didnt hack PayPal, managed to frighten Oz hippies *** --------------------------------------------- #OpNov5 pyrotechnics disappear in puff of smoke The smoke has cleared from Anonymouss Bonfire Night hacking spree with a denial from PayPal that it had been hacked. The payments-processing firm appeared to have been highest profile target of the hacking spree, but apparently this was an error caused by the tweeting and retweeting of an erroneous post by a cyber security blogger. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/06/anon_opnov5… *** Adobe Ships Election Day Security Update for Flash *** --------------------------------------------- Adobe has released a critical security update for its Flash Player and Adobe AIR software that fixes at least seven dangerous vulnerabilities in these products. Updates are available for Windows, Mac, Linux and Android systems. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/czXcgBruHcM/ *** Volunteering falls short on threat information sharing *** --------------------------------------------- "Critical infrastructure security apparently has its own version of Dont Ask, Dont Tell, despite calls in the public and private sector for better information sharing. And this one goes both ways. The private sector is not telling the government about its vulnerabilities, and government is also keeping threat and vulnerability information from the private sector...." --------------------------------------------- http://www.csoonline.com/article/720881/volunteering-falls-short-on-threat-… *** [remote] - EMC Networker Format String *** --------------------------------------------- EMC Networker Format String --------------------------------------------- http://www.exploit-db.com/exploits/22525 *** Cisco Security Advisory: Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability *** --------------------------------------------- Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Security Advisory: Cisco Nexus 1000V Series Switch Software Release 4.2(1)SV1(5.2) Virtual Security Gateway Bypass Issue *** --------------------------------------------- Cisco Nexus 1000V Series Switch Software Release 4.2(1)SV1(5.2) Virtual Security Gateway Bypass Issue http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 6-11-2012
by Daily end-of-shift report 06 Nov '12

06 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-11-2012 18:00 − Dienstag 06-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: Oracle MySQL Server CVE-2012-3163 Remote MySQL Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3163 Remote MySQL Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56036 *** Vuln: Oracle MySQL Server CVE-2012-3173 Remote MySQL Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3173 Remote MySQL Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56041 *** Vuln: Oracle MySQL Server CVE-2012-3158 Remote Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3158 Remote Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56017 *** European Smart Grid Cyber and SCADA Security *** --------------------------------------------- "Event Name : European Smart Grid Cyber and SCADA SecurityEvent Date : March 11-12, 2013Location : London, United KingdomWebsite : www. smi-online. co. uk/2013cybergrids2...." --------------------------------------------- http://www.ecoseed.org/more/events/15779-european-smart-grid-cyber-and-scad… *** [dos] - Adobe Reader 11.0.0 Stack Overflow Crash PoC *** --------------------------------------------- Adobe Reader 11.0.0 Stack Overflow Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22464 *** Possible Fake-AV Ads from Doubleclick Servers, (Mon, Nov 5th) *** --------------------------------------------- Reader James ran into a Fake AV ad delivered by Double click. It is not clear if this is the result of a compromise of double click, or a paid ad that slipped through doubleclicks content review process. James started out at a local new paper web site, that like many others features ads served by double click. Luckily, James used a proxy tool (Fiddler) to record the session. Here are some of the excerpts (slightly anonymized and spaces inserted to avoid accidental clicks): GET [...] --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14455&rss *** Vuln: Multiple Symantec Products CAB Files Handling Memory Corruption Vulnerability *** --------------------------------------------- Multiple Symantec Products CAB Files Handling Memory Corruption Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56399 *** Apache Tomcat 6.x / 7.x Denial Of Service *** --------------------------------------------- Topic: Apache Tomcat 6.x / 7.x Denial Of Service Risk: Medium Text:CVE-2012-2733 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affe... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/zhdqQvlbO2c/WLB-20… *** Apache Tomcat 5.x / 6.x / 7.x DIGEST Authentication Weaknesses *** --------------------------------------------- Topic: Apache Tomcat 5.x / 6.x / 7.x DIGEST Authentication Weaknesses Risk: Medium Text:CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses Severity: Moderate Vendor: The Apache Software Foundation ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Suq__thlFNM/WLB-20… *** Java - Sicherheitsexperte schließt Java-Lücke auf eigene Faust *** --------------------------------------------- Oracle vertröstet auf Patchday im Februar --------------------------------------------- http://text.derstandard.at/1350259245198/Sicherheitsexperte-schliesst-Java-… *** Bugtraq: multiple critical vulnerabilities in sophos products *** --------------------------------------------- multiple critical vulnerabilities in sophos products --------------------------------------------- http://www.securityfocus.com/archive/1/524641 *** Bugtraq: Wisecracker 1.0 - A high performance distributed cryptanalysis framework *** --------------------------------------------- Wisecracker 1.0 - A high performance distributed cryptanalysis framework --------------------------------------------- http://www.securityfocus.com/archive/1/524640 *** [dos] - Internet Explorer 9 Memory Corruption Crash PoC *** --------------------------------------------- Internet Explorer 9 Memory Corruption Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22401 *** Bugtraq: [security bulletin] HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure *** --------------------------------------------- [security bulletin] HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure... --------------------------------------------- http://www.securityfocus.com/archive/1/524644

1 0

Tageszusammenfassung - Montag 5-11-2012
by Daily end-of-shift report 05 Nov '12

05 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-11-2012 18:00 − Montag 05-11-2012 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** Studie: Informationen trotz SSL-Verschlüsselung nicht sicher *** --------------------------------------------- Mit einer seit Jahren bekannten Angriffstechnik kann man die SSL-Verschlüsselung im Browser austricksen. Wie eine Untersuchung zeigt, setzt kaum jemand den ebenfalls bekannten Schutzmechanismus ein. Auch unterstützen diesen nicht alle aktuellen Browser. --------------------------------------------- http://www.heise.de/security/meldung/Studie-Informationen-trotz-SSL-Verschl… *** VUPEN Researchers Say They Have Zero-Day Windows 8 Exploit *** --------------------------------------------- "Controversial bug hunters and exploit sellers VUPEN claimed to have cracked the low-level security enhancements featured in Windows 8, Microsofts latest operating system. VUPEN CEO and head of research Chaouki Bekrar sent out a pair of ominous Tweets yesterday claiming to have developed the first zero-day exploit for Windows 8 and Internet Explorer 10, both released Oct. 26. Bekrar hints the exploit is a sandbox bypass for IE10 with ASLR, DEP and anti-ROP mitigations enabled...." --------------------------------------------- http://threatpost.com/en_us/blogs/vupen-researchers-say-they-have-zero-day-… *** Deep Inside a DNS Amplification DDoS Attack *** --------------------------------------------- "A few weeks ago I wrote about DNS Amplification Attacks. These attacks are some of the largest, as measured by the number of Gigabits per second (Gbps), that we see directed toward our network. For the last three weeks, one persistent attacker has been sending at least 20Gbps twenty-four hours a day as an attack against one of our customers...." --------------------------------------------- http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack *** How Georgia doxed a Russian hacker (and why it matters) *** --------------------------------------------- "On October 24, the country of Georgia took an unusual step: it posted to the Web a 27-page writeup (PDF), in English, on how it has been under assault from a hacker allegedly based in Russia. The paper included details of the malware used, how it spread, and how it was controlled. Even more unusually, the Georgians released pictures of the alleged hackertaken with his own webcam after the Georgians hacked the hacker with the help of the FBI and others...." --------------------------------------------- http://arstechnica.com/tech-policy/2012/11/how-georgia-doxed-a-russian-hack… *** Firefox gets strict about enforcement of HTTPS protection *** --------------------------------------------- "Developers of Mozillas Firefox browser are experimenting with a new security feature that connects to a specified set of websites only when presented with a cryptographic certificate validating the connection is secure. A beta version of the open-source browser contains a list of sites known to deploy the HTTP Strict Transport Security mechanism that requires a browser to use the secure sockets layer or transport layer security protocols when communicating. HSTS is designed to provide an... --------------------------------------------- http://arstechnica.com/security/2012/11/firefox-gets-strict-about-enforceme… *** Android Modding for the Security Practitioner *** --------------------------------------------- "After getting involved in the Android rooting scene, I observed that there is a disconnect between the community interested in "modding" (modifying) their devices and those looking at Android from a security practitioners perspective. In this talk, I will provide technical details on many key concepts in the modding world, including rooting, locked/unlocked bootloaders, S-ON/S-OFF, fastboot, ROM flashing, and various other techniques. Well look at real examples of... --------------------------------------------- http://www.securitytube.net/video/6080 *** Anonymous ransomware - but who is hiding behind this malwares mask? *** --------------------------------------------- "Heres an interesting twist of the Reveton/FBI/police ransomware that has been plaguing internet users lately. In this example, the malware that locks you out of your data, and demands 100 be paid via Ukash to gain access back to your files, claims to be from the Anonymous hacktivist group. Of course, just as when ransomware victims see demands from cash on their computer seemingly coming from the police, they should be equally dubious about whether this particular attack originated from... --------------------------------------------- http://nakedsecurity.sophos.com/2012/11/02/anonymous-ransomware/ *** Shopping The Russian Cybercrime Underground *** --------------------------------------------- "If you werent already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report...." --------------------------------------------- http://www.darkreading.com/threat-intelligence/167901121/security/vulnerabi… *** In Pictures: 20 notorious worms, viruses and botnets *** --------------------------------------------- "The earliest worms and viruses were created for geeky fun and did little harm - oh, how times have changed. Here are 20 worms, viruses and botnets that show the evolution of malware, from Creeper to Flame. CreeperThe first real computer virus, Creeper was released "in lab" in 1971 by an employee of a company working on building ARPANET, the Internets ancestor, according to Guillaume Lovet, Senior Director, FortiGuard Labs...." --------------------------------------------- http://www.computerworld.com.au/slideshow/440948/pictures_20_notorious_worm… *** Searching for Silver Bullets In SCADA and ICS Environments *** --------------------------------------------- "With Halloween past us, theres an excess of sugar in our blood, and remnant imaginings of monsters under the bed. So perhaps thats why when the topic of silver bullet security recently came up, my mind immediately went to Werewolves. The term was used, as it often is, in a discussion about Application Whitelistingthe industrial automation industrys rightful poster child for endpoint security...." --------------------------------------------- http://www.securityweek.com/searching-silver-bullets-scada-and-ics-environm… *** Vuln: Ubercart SecureTrading Payment Method Drupal Module Security Bypass Vulnerability *** --------------------------------------------- Ubercart SecureTrading Payment Method Drupal Module Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54395 *** ZPanel <= 10.0.1 CSRF, XSS, SQLi, Password Reset *** --------------------------------------------- Topic: ZPanel --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/cET4kw8gtsc/WLB-20… *** Anonymous am Werk? Symantec, ImageShack, Paypal und VMWare gehackt *** --------------------------------------------- Eine Hackergruppe will zum zweiten Mal den Bilder-Upload-Dienst ImageShack gehackt haben und auch das Sicherheits-Unternehmen Symantec soll ihnen zum Opfer gefallen sein. Der Schaden bei ImageShack soll sich auf die Preisgabe aller vorhandenen, auch als privat eingestuften, Bilder belaufen. Von Symantec sollen nun unter anderem alle Mitarbeiter-E-Mailadressen öffentlich sein. Außerdem haben die Hacker eine Lücke für die OpenSource-Software ZPanel veröffentlicht. Obendrein stellt Anonymous den Kernel von... --------------------------------------------- http://www.heise.de/security/meldung/Anonymous-am-Werk-Symantec-ImageShack-… *** Bugtraq: Vulnerable MSVC++ 2008 runtime libraries distributed with and installed by eM client *** --------------------------------------------- Vulnerable MSVC++ 2008 runtime libraries distributed with and installed by eM client --------------------------------------------- http://www.securityfocus.com/archive/1/524621 *** New Blackhole Targets Mobile Banking Services *** --------------------------------------------- "According to a report published by antivirus software developer AVG, there is a significant growth in malicious software and malicious ads with hidden malware behind images posed on social media. The report revealed details about the newly released 2. 0 version of Blackhole Exploit Toolkit that targets mobile banking services...." --------------------------------------------- http://www.technologybanker.com/security-risk-management/new-blackhole-targ…

1 0

Tageszusammenfassung - Freitag 2-11-2012
by Daily end-of-shift report 02 Nov '12

02 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 31-10-2012 18:10 − Freitag 02-11-2012 18:10 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities *** --------------------------------------------- Topic: Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities Risk: Low Text:Advisory: Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities Advisory ID: SSCHADV2012-014 Author: Stefan Schurtz ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/kE0J4Z10zwA/WLB-20… *** [webapps] - Wordpress bbpress Plugin Multiple Vulnerabilities *** --------------------------------------------- Wordpress bbpress Plugin Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/22396 *** How to Fight New Gozi Banking Trojan - Crimeware Exploits Basic Authentication Used in U.S. *** --------------------------------------------- "Fighting the new Trojan aimed at U.S. banks will require multiple measures, says RSA researcher Mor Ahuvia. Gozi Prinimalka is different, and institutions have to be mindful of its characteristics. Ahuvia, a cybercrime communications specialist for RSA FraudAction, says a new Trojan identified by RSA in early October will pose one of the greatest fraud threats U.S. banking institutions have ever seen...." --------------------------------------------- http://www.bankinfosecurity.com/how-to-fight-new-gozi-banking-trojan-a-5256… *** Bugtraq: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Web Conferencing *** --------------------------------------------- Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Web Conferencing --------------------------------------------- http://www.securityfocus.com/archive/1/524565 *** New Hacker Weapon Surfaces *** --------------------------------------------- "A High Orbit Ion Cannon (HOIC) could just broaden the possibilities for attackers of all skill sets. The High Orbit Ion Cannon is a dangerous free-to-download, open-source program that can turn any user of any skill level into a powerful hacker, at least in terms of one form of attack, a distributed denial-of-service (DDoS). It is extremely easy to use...." --------------------------------------------- http://www.isssource.com/new-hacker-weapon-surfaces/ *** Costs of tools and activities in the Russian cybercriminal underground *** --------------------------------------------- "A new Trend Micro research paper describes a broad offering of tools and activities that can be bought and sold on underground forum shopping sites. It examines the prices charged for various types of services, while also providing examples of information shared among cybercriminals. In examining two dozen basic and fundamental tools and technologies that cybercriminals create and use to enhance their business, researchers also assess the top-ten ranked malicious activities and --------------------------------------------- http://www.net-security.org/secworld.php?id=13884 *** One year after DigiNotar breach, Fox-IT details extent of compromise *** --------------------------------------------- "The 2011 security breach at Dutch certificate authority (CA) DigiNotar resulted in an extensive compromise and was facilitated in part by shortcomings in the companys network segmentation and firewall configuration, according to Fox-IT, the security company contracted by the Dutch government to investigate the incident."The DigiNotar network was divided into 24 different internal network segments," Fox-IT said in its final investigation report, published earlier this week by the --------------------------------------------- http://www.computerworld.com/s/article/9233138/One_year_after_DigiNotar_bre… *** Joe Weiss 2012 ICS Security Conference Highlights *** --------------------------------------------- "The twelfth ICS Security has come and gone, and it sounds from the tone of Joes write-up that whatever progress theres been to date in awareness and/or improved capabilities has been frustratingly slow and incremental. After twelve years, I guess we can call that a trend. Nevertheless, the best parts often seem to involve drama related to actual events in the field...." --------------------------------------------- http://smartgridsecurity.blogspot.nl/2012/11/joe-weiss-2012-ics-security-co… *** Windows 8 exploit combining several 0-days already up for sale *** --------------------------------------------- "Less that a week after Microsoft released is long awaited Windows 8, with new and improved security features, French bug hunters VUPEN Security have announced that they have created an exploit for the new OS version that takes advantage of several zero-day flaws:In the light of this discovery, the tweet that VUPEN CEO and head researcher Chaouki Bekrar posted upon the OSs release seems almost to mock Microsofts efforts. The company, which has become well known in security circles --------------------------------------------- http://www.net-security.org/secworld.php?id=13890

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily November 2012