Daily March 2013

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - Freitag 15-03-2013
by Daily end-of-shift report 15 Mar '13

15 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-03-2013 18:00 − Freitag 15-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Vulnerability Summary for the Week of March 4, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains --------------------------------------------- http://www.us-cert.gov/ncas/bulletins/SB13-070 *** Debian Security Advisory DSA-2644 wireshark *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2644 *** Open-Xchange Server 6 - Multiple Vulnerabilities *** --------------------------------------------- Open-Xchange Server 6 - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24791 *** Mac OS X 10.8.3 steht bereit *** --------------------------------------------- Seit November testete Apple die nächste Version von Mountain Lion in Entwicklerkreisen schon, nun ist der Download für die Allgemeinheit verfügbar. Für Snow Leopard und Lion steht außerdem ein Sicherheitsupdate-Paket bereit. --------------------------------------------- http://www.heise.de/security/meldung/Mac-OS-X-10-8-3-steht-bereit-1823278.h… *** You've Been Hacked, But For How Long? *** --------------------------------------------- One of the big themes at the recent RSA Conference was awareness of threats already inside the network. The way you learn about these threats and lower your 'Mean Time To Know' (MTTW) about an intrusion is with profile-based network monitoring. --------------------------------------------- http://www.darkreading.com/blog/240150779/you-ve-been-hacked-but-for-how-lo… *** Security appliances are riddled with serious vulnerabilities, researcher says *** --------------------------------------------- The majority of email and Web gateways, firewalls, remote access servers, UTM (united threat management) systems and other security appliances have serious vulnerabilities, according to a security researcher who analyzed products from multiple vendors. --------------------------------------------- http://www.techworld.com.au/article/456433/security_appliances_riddled_seri… *** Trend Micro dupes wannabe hackers with honeypot scam *** --------------------------------------------- "Security firm Trend Micro has duped hackers into attacking fake industrial control systems (ICS), collecting invaluable data on their attack methods and goals and revealing surprising insights on the UKs hacking scene. The research was revealed at Blackhat Europe 2013 in Amsterdam on Friday and is the result of a collaborative project between Trend Micro and Scada security researcher Kyle Wilhoit. --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2254867/trend-micro-dupes-wannabe-hackers-wi… *** UMTS-Sticks von Huawei gefährden Sicherheit der Nutzer *** --------------------------------------------- Ein russischer Hacker hat die Treiber-Software der UMTS-Sticks von Huawei untersucht. Ergebnis: zahlreiche Schwachstellen, die es Angreifern leicht machen, die Rechner der Stick-Nutzer zu infizieren. Auch eine massenhafte Infektion ist denkbar. --------------------------------------------- http://www.heise.de/security/meldung/UMTS-Sticks-von-Huawei-gefaehrden-Sich… *** Der Feind in meinem Dock *** --------------------------------------------- In Notebook-Docks von Dell ist noch viel Platz. Ein Sicherheitsforscher hat darin einen Mini-PC untergebracht, der Netzwerkverkehr, Audio- und Videosignale sowie USB-Datenverkehr des angedockten Notebooks ausspioniert. --------------------------------------------- http://www.heise.de/security/meldung/Der-Feind-in-meinem-Dock-1823723.html *** Highlights from BlackHat Europe 2013 in Amsterdam *** --------------------------------------------- Every year as Europe wakes up from the cold winter to the warm days of spring, BlackHat traditionally descends to Amsterdam. This year's conference is taking place on March 14-15 at the NH Grand Hotel Krasnapolsky, right Dam Square, the heart of Amsterdam. As spring doesn't necessarily equal warm days here in Europe right now, the 500 or so BlackHat participants hit the conference rooms to attend quite a few interesting talks. Here's a summary of the best talks at BlackHat Europe --------------------------------------------- http://www.securelist.com/en/blog/208194175/Highlights_from_BlackHat_Europe… *** TeamViewer authentication protocol *** --------------------------------------------- When a coworker recently gave me access to his system he recommended I use TeamViewer. TeamViewer is a free tool that is used to set up and use a VPN connection as well as allowing the user to remotely take control of another person's computer from their system. Given that it was my first time using this software, I decided to take a peek at the traffic. --------------------------------------------- http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol *** Seagate blog compromised, leads to Blackhole and malware *** --------------------------------------------- A blog of well-known hard disk drive manufacturer Seagate has been compromised to contain malicious iFrame injections that redirect users to websites hosting the Blackhole exploit kit, warns Sophos. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2440

1 0

Tageszusammenfassung - Donnerstag 14-03-2013
by Daily end-of-shift report 14 Mar '13

14 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-03-2013 18:00 − Donnerstag 14-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Otmar Lendl *** Heimtückische Hintertür in TP-Link-Routern *** --------------------------------------------- Quasi auf Zuruf laden einige WLAN-Router eine ausführbare Datei aus dem Netz und führen die dann auch gleich mit Root-Rechten aus. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/298834fb/l/0L0Sheise0Bde0Csec… *** Kaspersky fixt IPv6-Problem der Internet Security Suite *** --------------------------------------------- Ein einziges, etwas seltsames IPv6-Paket genügt, um einen Windows-PC mit Kasperskys Firewall zum Stillstand zu bringen. Nach der Veröffentlichung des Problems will es der Hersteller jetzt beseitigen. --------------------------------------------- http://www.heise.de/security/meldung/Kaspersky-fixt-IPv6-Problem-der-Intern… *** Mobile Drive-By Malware example *** --------------------------------------------- "Several days ago we received a complaint about javascrpt. ru. After a bit of research, we found that it tries to mimic ajax...." --------------------------------------------- http://blog.avast.com/2013/03/11/mobile-drive-by-malware-example/ *** US national vulnerability database hacked *** --------------------------------------------- Malware infection forces government vuln catalog offline The US governments online catalog of cyber-vulnerabilities has been taken offline ironically, due to a software vulnerability. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/14/us_malware_… *** Encryption Trojan attacks Spain and France *** --------------------------------------------- March 13, 2013 Russian anti-virus company Doctor Web has registered an ongoing massive spread of the encryption malware Trojan.ArchiveLock across PCs outside Russia. The program, dubbed Trojan.ArchiveLock.20, is infecting increasingly more computers in France and Spain. Last August, Doctor Web issued a warning about Trojan.ArchiveLock encryption malware. This program uses the archiver WinRAR to encrypt files. To spread the malware, criminals mount a brute force attack via the RDP protocol on --------------------------------------------- http://news.drweb.com/show/?i=3379&lng=en&c=9 *** Drupal Node Parameter Control 6.x Access Bypass *** --------------------------------------------- Topic: Drupal Node Parameter Control 6.x Access Bypass Risk: High Text:View online: http://drupal.org/node/1942330 * Advisory ID: DRUPAL-SA-CONTRIB-2013-034 * Project: Node Parameter Control... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/D5fwYJPc7EI/WLB-20… *** Expert Finds Way to Retrieve Facebook Authentication Token and Hack Any Account *** --------------------------------------------- "Security researcher Nir Goldshlager has identified yet another Facebook OAuth vulnerability that can be exploited to hack any account. In the attack method he presented back in February, the expert used the app_id of the Facebook Messenger to gain full access to accounts. The social media company has addressed the issue by using regex protection, but Goldshlager has discovered another method to exploit the Facebook Messenger app_id...." --------------------------------------------- http://news.softpedia.com/news/Expert-Finds-Way-to-Retrieve-Facebook-Authen… *** Cyber-attack in the Czech Republic - Thieves in the night *** --------------------------------------------- "A MYSTERIOUS wave of cyber-attacks in the Czech Republicthe most extensive in the countrys historyon March 11th briefly disabled the web site for Unicredit, a bank. Other targets have included media, banks, mobile phone operators, the stock exchange and even the Czech National Bank. All but the Unicredit attack were so-called DDoS (distributed denial of service) attacks...." --------------------------------------------- http://www.economist.com/blogs/easternapproaches/2013/03/cyber-attack-czech… *** Check Point 2013 Security Report Released *** --------------------------------------------- "The Check Point company has just released its already well known Check Point 2013 Security Report series report. The Check point 2013 Security Report examines top security threats, risky web applications that compromise network security, and loss of data caused by employees unintentionally. Based on research of 900 companies and 120,000 hours of monitored traffic, Check Points research reveals startling details of real risks faced by enterprises including:64% infected with bots91% used --------------------------------------------- http://www.felipemartins.info/2013/03/check-point-2013-security-report-rele… *** Antiviren-Software AVG hielt Systemdatei für Trojaner *** --------------------------------------------- Eine fälschlicherweise als Malware identifizierte Windows-DLL bescherte einigen AVG-Nutzern einen unruhigen Vormittag. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/299137b5/l/0L0Sheise0Bde0Csec… *** Erneuter Krypto-Angriff auf SSL/TLS-Verschlüsselung *** --------------------------------------------- Der vorgestellte Angriff auf das häufig eingesetzte Verschlüsselungsverfahren RC4 ist zwar noch nicht wirklich praktikabel, erschüttert aber das Fundament für sichere Internet-Verbindungen. --------------------------------------------- http://www.heise.de/security/meldung/Erneuter-Krypto-Angriff-auf-SSL-TLS-Ve… *** Blog: Reminder: be careful opening invoices on the 21st March *** --------------------------------------------- On March 4th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment but were being sent from many different source addresses. --------------------------------------------- http://www.securelist.com/en/blog/837/Reminder_be_careful_opening_invoices_… *** Microsoft continues to focus on security in their products *** --------------------------------------------- "86% of vulnerabilities discovered in the most popular 50 programs in 2012 were in non-Microsoft (or third-party) programs. The result was published today in the Secunia Vulnerability Review 2013 that analyzes the evolution of software vulnerabilities from a global, industry, enterprise, and endpoint perspective. The identified 86% represent an increase from 2011, when non-Microsoft programs represented 78% of vulnerabilities discovered in the Top 50 most popular programs...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14595

1 0

Tageszusammenfassung - Mittwoch 13-03-2013
by Daily end-of-shift report 13 Mar '13

13 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-03-2013 18:00 − Mittwoch 13-03-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** MS13-026 - Important : Vulnerability in Office Outlook for Mac Could Allow Information Disclosure (2813682) - Version: 1.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-026 *** MS13-003 - Important : Vulnerabilities in System Center Operations Manager Could Allow Elevation of Privilege (2748552) - Version: 2.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-003 *** Flash: Unseren monatlichen Patch gib uns heute *** --------------------------------------------- Adobe veröffentlicht wieder Sicherheits-Updates für den Flash-Player, diesmal ausnahmsweise nicht außer der Reihe. Eine wesentliche Lücke bleibt dabei aber ungestopft. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/297e24e3/l/0L0Sheise0Bde0Csec… *** ASUS RT-N66U multiple vulns *** --------------------------------------------- Topic: ASUS RT-N66U multiple vulns Risk: Medium Text:Vulnerable product: ASUS RT-N66U Vulnerabilities: - Linux 2.6.22.19 - Old libraries and executables Interesting vulnerabili... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/o7EbpwGc_yk/WLB-20… *** Google rolls out initiative to help hacked sites *** --------------------------------------------- "With its new informational series, the Web giant aims to answer questions about why a site was hacked, what malware may have been used, and how to wipe the site clean of bugs. Its not pretty when a Web site gets a "this site may be compromised" or "this site may harm your computer" status note. Many webmasters and Web site owners can be at a loss of what to do in these situations...." --------------------------------------------- http://news.cnet.com/8301-1023_3-57573986-93/google-rolls-out-initiative-to… *** Security-Linux Kali tritt Nachfolge von BackTrack an *** --------------------------------------------- Mit einer neuen Tool-Auswahl und einem modernen Linux-Unterbau lässt Kali die Altlasten von BackTrack hinter sich. Die Distribution für Pentester, Admins und Forensiker steht ab sofort zum Download bereit. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2983f19a/l/0L0Sheise0Bde0Csec… *** Security agency tells Europe to find alternative to risky email *** --------------------------------------------- "European governments and businesses should investigate alternative communication channels to e-mail in the longer term after a string of alarming attacks, the EUs cyber security agency warned today (13 March) in a special alert. The European Network and Information Security Agency (ENISA) issued the so-called Flash Note in the wake of recent major cyber-attacks, calling for Europes businesses and governments to take urgent action to combat emerging cyber-attack trends. The report cites... --------------------------------------------- http://www.euractiv.com/infosociety/security-agency-tells-europe-fin-news-5… *** Exploit Kit Distribution in the Wild *** --------------------------------------------- Have you ever wondered which exploit kits are the most prevalent?We have been tracking several exploit kits that we have identified these past few months and its interesting to see which gets the biggest chunk of the pie:56% of the coverage is owned by only three exploit kits: Blackhole, Sweet Orange, and Cool.Blackhole, a kit that has been around for almost three years, is still keeping a strong presence at no. 1 with 27% of the exploit kit coverage. Followed by Sweet Orange with 18% and Cool... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002522.html *** (IN)SECURE Magazine Issue 37 released *** --------------------------------------------- "IN)SECURE Magazine is a freely available digital security magazine discussing some of the hottest information security topics. Issue #37 has just been released - download the magazine! The articles in this issue include:Becoming a malware analystReview: Nipper StudioFive questions for Microsofts Chief Privacy OfficerApplication security testing for AJAX and JSONPenetrating and achieving persistence in highly secured networksReport: RSA Conference 2013Social engineering: An underestimated... --------------------------------------------- http://www.net-security.org/insecuremag.php *** Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1, (Wed, Mar 13th) *** --------------------------------------------- At Shmoocon 2013 Jake Williams (@MalwareJake) and I gave a presentation entitled Wipe the Drive. The point of the presentation was that you should always wipe the drive and reinstall the OS after a confirmed malware infection. We all know wiping the drive is the safest move but there are business pressures to simply remove the known malware and move on. Also, because we are security professionals there is often an expectation that we are able to remove all the malware. But, in my and Jakes... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15394&rss *** Bugtraq: Open-Xchange Security Advisory 2013-03-13 *** --------------------------------------------- http://www.securityfocus.com/archive/1/525979 *** Bugtraq: SEC Consult SA-20130313-0 :: QlikView Desktop Client Integer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/525980 *** Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing *** --------------------------------------------- Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week. --------------------------------------------- https://threatpost.com/en_us/blogs/issue-swfuploader-could-lead-xss-vulnera…

1 0

Tageszusammenfassung - Dienstag 12-03-2013
by Daily end-of-shift report 12 Mar '13

12 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-03-2013 18:00 − Dienstag 12-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Improving the security for Android embedded systems *** --------------------------------------------- "McAfee has delivered a whitelisting security solution for Android based embedded systems. McAfee Application Control for Android resides in the Android kernel, embedded in the operating system and provides protection from the installation or execution of a malicious application on an Android-based device. McAfee also provides protection at the application layer to Android devices...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14574 *** Blacklist NJABL geht außer Betrieb *** --------------------------------------------- Die Anti-Spam-Blacklist NJABL hat ihre Datenbasis bereits ausgeblendet. Verantwortlichen von Mailservern, die sie dennoch weiterhin abfragen, droht Ungemach, sobald der Hoster auch die Namensdienst-Einträge abklemmt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971dffa/l/0L0Sheise0Bde0Csec… *** Australien: Hackerangriffe auf die Zentralbank *** --------------------------------------------- Australische Medien berichten von Hackerangriffen auf die Zentralbank des Landes und sprechen dabei von Spuren nach China und kompromittierten Informationen. Die Zentralbank bestätigt, dass es Cyberattacken gab, sonst nichts. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971ee42/l/0L0Sheise0Bde0Csec… *** Google Docs CSRF & Clickjacking *** --------------------------------------------- Topic: Google Docs CSRF & Clickjacking Risk: Medium Text:CSRF & Clickjacking : Google Document, Drawing, Forms, Spreadsheet, Presentation Attacker can create Google Document, Dra... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/K1SfuqKrTTM/WLB-20… *** Vuln: Piwik Unspecified Cross Site Scripting Vulnerability *** --------------------------------------------- Piwik Unspecified Cross Site Scripting Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58392 *** TinyMCE XSS Vulnerability *** --------------------------------------------- Topic: TinyMCE XSS Vulnerability Risk: Low Text:Vulnerability Report Author: Justin C. Klein Keane Date: 5 March, 2013 CVE-2012-4230 Descrip... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vAEUomxc8S8/WLB-20… *** Windows 8: Flash als Standard *** --------------------------------------------- Der Internet Explorer unter Windows 8 und RT soll wesentlich mehr Flash-Inhalte per default zulassen. Damit rückt der Software-Hersteller noch weiter von seiner bisherigen Linie bei der Flash-Unterstützung ab. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2977bea5/l/0L0Sheise0Bde0Csec… *** Chess CAPTCHA - a serious defence against spammers? *** --------------------------------------------- "CAPTCHAs - the questions that a website asks you to answer to prove if youre a human being or not - come in many shapes and forms. Although they most commonly ask you to decipher some words hidden in a distorted graphic, there are more elaborate versions which can ask you to solve some complicated mathematical calculation or ask you to add toppings to a pizza in an attempt to stop automated bots leaving spammy messages...." --------------------------------------------- http://nakedsecurity.sophos.com/2013/03/12/chess-captcha/ *** Phishing emails sent in pairs to lend authenticity, says training company *** --------------------------------------------- "Phishing emails are now being deployed in pairs to create the illusion of authenticity, says security awareness training firm PhishMe. Phishing emails try to trick the recipient into doing something risky by disguising malicious attachments or links in seemingly genuine content. In this new type of phishing email campaign, attackers typically send out a benign email that contains nothing harmful and does not ask for any information or response from the recipient...." --------------------------------------------- http://www.computerweekly.com/news/2240179364/Phishing-emails-sent-in-pairs… *** Google Play: Potentially Unwanted *** --------------------------------------------- Google Play has a problem and it isnt malware.Depending on location, Potentially Unwanted Applications (PUA) can be rather difficult to avoid.Heres a screenshot of User Reviews from a "weather widget" application:In English (both U.S. and U.K.), there are eight user reviews. Just eight. Even if you click on a link to "Read All User Reviews".But if you use the Danish UI this is one additional review youll see:And its good that Danes can see it, because the --------------------------------------------- http://www.f-secure.com/weblog/archives/00002521.html

1 0

Tageszusammenfassung - Montag 11-03-2013
by Daily end-of-shift report 11 Mar '13

11 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-03-2013 18:00 − Montag 11-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Yahoo! webmail! hijacks! are! back!... *** --------------------------------------------- Didnt! they! fix! that?! Yahoo! has blamed cross-site scripting security bugs, which it claims to have squashed, for a recent upsurge in webmail account takeovers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/yahoo_webma… *** Pwn2Own ends with all attackers winning *** --------------------------------------------- "The Pwn2Own competition at CanSecWest has come to an end with the second day being like the first day. No web browser plugin survived being attacked and Adobe Flash, Adobe Reader XI and Java were all successfully hacked. Vupen security, who had demonstrated exploits of Internet Explorer 10, Firefox and Java on day one, returned with an exploit for Adobe Flash...." --------------------------------------------- http://www.h-online.com/open/news/item/Pwn2Own-ends-with-all-attackers-winn… *** DNS Hijack Leads To Bitcoin Heist *** --------------------------------------------- First time accepted submitter FearTheFez writes "Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000. Bitcoin broker Bitinstant was robbed after thieves managed to take over ownership of their domains. While Bitinstant claims that no customers lost any money, without 2 factor authentication all it took was a place of birth and a mothers maiden name to gain access. This looks like poor security from everyone involved." --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/_Jp5n8Dt8jA/story01.htm *** Trend Micro Examines Asprox Botnet *** --------------------------------------------- "TrendLabs recently published a research paper providing a detailed look at the Asprox botnet, which delivers malware via spam e-mails that claim to come from package delivery companies like FedEx, DHL, and the U.S. Postal Service."While Asprox has only been mentioned sporadically in the past few years, other spam campaigns with similar tactics as well as fake ticket scams using well-known airlines like Delta and American Airlines have received significant attention," --------------------------------------------- http://www.esecurityplanet.com/malware/trend-micro-examines-asprox-botnet.h… *** Raspberry Pi Hit by Cyber Attack (DDoS) *** --------------------------------------------- It's sad to see the Raspberry Pi Foundation, a charity with a good cause at its heart, has been the focus of a vicious attack. This stunt goes to highlight the unfortunate fact that any organisation, of any size and nature, is vulnerable. --------------------------------------------- http://www.esecurityplanet.com/network-security/raspberry-pi-hit-by-cyber-a… *** ICS-CERT sums up 2012 cyber security response activities *** --------------------------------------------- "The Industrial Control System Cyber Emergency Response Team (ICS-CERT) issued on March 7 a report on its activities in 2012. ICS-CERT provides Cyber security evaluations to support the reliability and resiliency of the systems that comprise and interconnect critical infrastructures. It develops and implements coordinated security measures in collaboration with partners from across public, private and international communities...." --------------------------------------------- http://www.gsnmagazine.com/node/28699?c=cyber_security *** Zimmerspion SmartTV *** --------------------------------------------- Ein Sicherheitsforscher hat SmartTVs von Samsung so manipuliert, dass er ihre Webcam zur Raumüberwachung nutzen konnte während der Fernseher augenscheinlich ausgeschaltet war. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/296010ec/l/0L0Sheise0Bde0Csec… *** Think your internet password is safe? Think again... *** --------------------------------------------- "Are you one of those naive types who believes that choosing the name of your first pet as an internet password is going to protect you from hacking and fraud? Be very, very afraid, warns Memphis Barker, who has discovered some deeply unsettling facts about the increasing sophistication of data breaches...." --------------------------------------------- http://www.independent.co.uk/life-style/gadgets-and-tech/features/think-you… *** Debian Security Advisory DSA-2642 sudo *** --------------------------------------------- several issues --------------------------------------------- http://www.debian.org/security/2013/dsa-2642 *** Apple schließt kritische Lücke in App Store *** --------------------------------------------- Eine Sicherheitslücke, die Angriffe auf iOS-Geräte ermöglichte, wurde nun endlich geschlossen. Gemeldet worden war das Problem bereits vor mehr als einem halben Jahr von einem Google-Sicherheitsforscher. Bekannt gemacht wurde es aber erst jetzt. --------------------------------------------- http://futurezone.at/digitallife/14564-apple-schliesst-kritische-luecke-in-… *** WordPress plugins vulnerable to CVE-2013-1808 *** --------------------------------------------- Topic: WordPress plugins vulnerable to CVE-2013-1808 Risk: Low Text: I tested WordPress plugins to see which are vulnerable to CVE-2013-1808, because original founder of this vulnerability did not... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/qEk7pVSgvcw/WLB-20… *** Kundendaten des deutschen Avast-Distributors im Netz *** --------------------------------------------- Wer über Avast.de eine Virenschutzsoftware gekauft hat, hat ein Problem: Im Netz kursieren offenbar die Daten von über 16.000 Kunden; darunter auch Zahlungsinformationen und Passwort-Hashes. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29698122/l/0L0Sheise0Bde0Csec… *** Vuln: Perl CVE-2013-1667 Input Rehashing Denial of Service Vulnerability *** --------------------------------------------- Perl CVE-2013-1667 Input Rehashing Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58311 *** Miniduke: web based infection vector *** --------------------------------------------- Together with our partner CrySyS Lab, weve discovered two new, previously-unknown infection mechanisms for Miniduke. These new infection vectors rely on Java and IE vulnerabilities to infect the victims PC. --------------------------------------------- http://www.securelist.com/en/blog/208194159/Miniduke_web_based_infection_ve… *** Help Keep Threats at Bay With 'Click-to-Play' *** --------------------------------------------- Muzzling buggy and insecure Web browser plugins like Java and Flash goes a long way toward blocking attacks from drive-by downloads and hacked or malicious Web sites. But leaving them entirely unplugged from the browser is not always practical, particularly with Flash, which is used on a majority of sites. Fortunately, there is a relatively simple and effective alternative: Click-to-Play.Related Posts:How to Unplug Java from the BrowserWhat You Need to Know About the Java ExploitBlocking --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/fXtHr18Ampk/ *** Bugtraq: Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 *** --------------------------------------------- Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 --------------------------------------------- http://www.securityfocus.com/archive/1/525958

1 0

Tageszusammenfassung - Freitag 8-03-2013
by Daily end-of-shift report 08 Mar '13

08 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-03-2013 18:00 − Freitag 08-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Advance Notification for March 2013 - Version: 1.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-mar *** IPv6 Focus Month: Barriers to Implementing IPv6, (Thu, Mar 7th) *** --------------------------------------------- Ive been trying for a few months now to get my lab running IPv6 natively, with mixed success. Whats standing in my way you ask? A couple of things, which in turn have further implications:... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15361&rss *** IPv6 Focus Month: Filtering ICMPv6 at the Border, (Fri, Mar 8th) *** --------------------------------------------- Paulgear1 asked on twitter: help on interpreting RFC4890. I still havent turned on IPv6 because Im not confident in my firewall. First of all, what is RFC4890 all about [1]? The RFC is considered informational, not a standard. Usual guidance for IPv4 is to not block ICMP error messages, but one can get away with blocking all ICMP messages. The situation is a bit different when it comes to ICMPv6... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15367&rss *** Bugtraq: [security bulletin] HPSBGN02854 SSRT100881 rev.1 - HP Intelligent Management Center (iMC), iMC TACACS+ Authentication Manager (TAM), and iMC User Access Manager (UAM), Cross Site Scripting (XSS), Remote Code Execution, Remote Disclosure of *** --------------------------------------------- http://www.securityfocus.com/archive/1/525928 *** More Info on Recent ICS-CERT Advisories *** --------------------------------------------- "ICS-CERT has been busy this week. They updated an alert on Tuesday and issued two advisories yesterday. In two of those three actions there were some interesting questions raised about some of the information provided, or not provided in their documents...." --------------------------------------------- http://chemical-facility-security-news.blogspot.in/2013/03/more-info-on-rec… *** What ICS-CERT Is and Isnt *** --------------------------------------------- "When ICS-CERT was created I expected a lot more. I expected analysis and insight from skilled ICS security experts. The reality is ICS-CERT is merely a coordinator of communication between vulnerability finders and the vendor...." --------------------------------------------- http://www.digitalbond.com/blog/2013/03/07/what-ics-cert-is-and-isnt/ *** Android accounted for 79% of all mobile malware in 2012 *** --------------------------------------------- "A new study has found that Googles (GOOG) mobile operating system is targeted by hackers far more than any other mobile platform. Security firm F-Secure found that Android accounted for 79% of all mobile malware in 2012, an increase from 66. 7% in 2011 and 11...." --------------------------------------------- http://bgr.com/2013/03/07/android-malware-2012-362787/ *** Vuln: CoDeSys Gateway Server Multiple Security Vulnerabilities *** --------------------------------------------- CoDeSys Gateway Server Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/58032 *** Pwn2Own: IE10, Firefox, Chrome, Reader, Java hacks land $500k *** --------------------------------------------- Googles Chrome OS withstands attack in security contest Its back to the drawing board for coders at Microsoft, Google, Adobe, Mozilla, and Oracle after entrants in the annual Pwn2Own contest waltzed off with over half a million dollars in prizes for exploiting security holes in popular software... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/pwn2own_con… *** Bugtraq: SEC Consult SA-20130308-0 :: Multiple critical vulnerabilities in GroundWork Monitor Enterprise (part 1) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525938 *** Bugtraq: SEC Consult SA-20130308-1 :: Multiple vulnerabilities in GroundWork Monitor Enterprise (part 2) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525941 *** Leaked: The secret OAuth app keys to Twitters VIP lounge *** --------------------------------------------- Rogue apps could pose as micro-blogging sites Very Important Programs Twitters private OAuth login keys, used by the websites official applications to get preferential treatment from the micro-blogging site, have apparently been leaked. The secret credentials could now allow any software to masquerade as an approved Twitter client... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/twitter_oau… *** Heads-Up - Citadel Command and Control Domains *** --------------------------------------------- "We have detected new Citadel malware activity, again coming from within large, some Dutch, organizations. These Citadel Trojans are not part of the Pobelka botnet (Dutch) that we discovered last year on September 7, 2012. From the data we have gathered so far, we believe this new campaign is running since late November 2012...." --------------------------------------------- http://www.surfright.nl/en/citadel

1 0

Tageszusammenfassung - Donnerstag 7-03-2013
by Daily end-of-shift report 07 Mar '13

07 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-03-2013 18:00 − Donnerstag 07-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Programm-Aktualisierer für kleine Unternehmen *** --------------------------------------------- Den Patch-Stand von Microsoft- sowie Drittanbieter-Programmen überprüfen die Werkzeuge von Secunia. Nun gibt es eine Version für KmU. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2946529e/l/0L0Sheise0Bde0Csec… *** D-Link fixes router vulnerabilities very quietly *** --------------------------------------------- "In November last year D-Link fixed critical vulnerabilities in its cylinder-shaped DIR-645 wireless router, but neglected to let its customers in on the secret. Users looking for firmware updates on D-Links US customer site for the router will come across a version 1. 03, dated 21 November 2012...." --------------------------------------------- http://www.h-online.com/security/news/item/D-Link-fixes-router-vulnerabilit… *** Vuln: WordPress Events Manager Plugin Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/57477 http://www.securityfocus.com/archive/1/525914 *** Java pfuscht bei Zertifikatschecks *** --------------------------------------------- Auf den Seiten der TU Chemnitz platzierten Gauner ein Java-Applet, das Rechner infizierte. Allerdings hätte das trotz digitaler Signatur nicht so einfach funktionieren sollen, weil das Zertifikat bereits gesperrt war. Aber wir reden ja von Oracle. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29482e3c/l/0L0Sheise0Bde0Csec… *** IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses, (Wed, Mar 6th) *** --------------------------------------------- [Guest Diary: Stephen Groat] [Geolocation Using IPv6 Addresses] Today we bring you a guest diary from Stephen Groat where he speaks about validating that IPv6 address tracking and monitoring are possible. IPv6 designers developed a technique called stateless address autoconfiguration (SLAAC) to reduce the administrative burden of managing the immense IPv6 address space. To most operating systems current accepted definition of SLAAC, a nodes IPv6 addresss interface identifier (IID), or host... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15349&rss *** Bugtraq: Verax NMS (CVE-2013-1350) (CVE-2013-1631) (CVE-2013-1352 (CVE-2013-1351) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525907 http://www.securityfocus.com/archive/1/525918 http://www.securityfocus.com/archive/1/525917 http://www.securityfocus.com/archive/1/525916 *** 99 percent of web apps vulnerable to attack *** --------------------------------------------- "A new Cenzic report demonstrates that the overwhelming presence of web application vulnerabilities remains a constant problem, with an astounding 99 percent of applications tested revealing security risks, while additionally shedding light on pressing vulnerabilities within mobile application security. The report reveals the massive number of vulnerabilities prevalent in web and mobile applications today. It highlights the type, frequency and severity of vulnerabilities found and predicts... --------------------------------------------- http://www.net-security.org/secworld.php?id=14556 *** Ruby Entity expansion DoS vulnerability in REXML (XML bomb) *** --------------------------------------------- Topic: Ruby Entity expansion DoS vulnerability in REXML (XML bomb) Risk: Medium Text:http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ == Unrestricted entity expansion can lead to a DoS vul... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/R4X5eZcZsGY/WLB-20… *** Heads-Up - Cybersecurity directive faces uncertain fate in Parliament *** --------------------------------------------- "EU attempts to introduce comprehensive new cybersecurity rules risk failure in the European Parliament, where senior administrators doubt the package will pass before the legislatures mandate expires, EurActiv has learned. In addition to the launch of its new over-arching Cybersecurity Strategy, the European Commission last month proposed a Directive with measures to ensure harmonised network and information security across the EU. The proposed legislation will oblige companies to be... --------------------------------------------- http://www.euractiv.com/specialreport-cybersecurity/cybersecurity-directive… *** [TYPO3-announce] Announcing TYPO3 CMS 4.5.25, 4.6.18, 4.7.10 and 6.0.4 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS versions 4.5.25, 4.6.18, 4.7.10 and 6.0.4, which are now ready for you to download. These versions are maintenance releases and contain bug fixes only. All packages fix one regression that has been introduced with the security releases yesterday: --------------------------------------------- http://typo3.org/news/article/typo3-cms-4525-4618-4710-and-604-released/ http://typo3.org/download/packages/ *** Cybercriminals Predicted To Expand Use Of Browser Proxies *** --------------------------------------------- "A technique for controlling a compromised systems browser, widely used in Brazilian banking schemes, will likely become popular amongst global cybercriminals in the next few years, say security experts. The technique abuses a legitimate way to control where a browser sends its requests, known as proxy auto-configuration or PAC, to take over a victims browser and send traffic--say, requests to a bank--to an attacker-controlled server instead. While the attackers still have to find a way to... --------------------------------------------- http://www.darkreading.com/advanced-threats/167901091/security/attacks-brea… *** [security bulletin] HPSBMU02849 SSRT101124 rev.1 - HP ServiceCenter, Remote Denial of Service (DoS) *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03680085 *** [security bulletin] HPSBPI02851 SSRT101078 rev.1 - Certain HP LaserJet Pro Printers, Unauthorized Access to Data *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03684249

1 0

Tageszusammenfassung - Mittwoch 6-03-2013
by Daily end-of-shift report 06 Mar '13

06 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-03-2013 18:00 − Mittwoch 06-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** [TYPO3-announce] TYPO3 CMS Core Security Advisory TYPO3-CORE-SA-2013-001 *** --------------------------------------------- It has been discovered that the TYPO3 Core is susceptible to SQL Injection and Open Redirection For more details on the issues please read the accordant advisory --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… *** Bugtraq: [IA32] HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting *** --------------------------------------------- [IA32] HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting --------------------------------------------- http://www.securityfocus.com/archive/1/525888 *** Vuln: Schneider Electric Products Multiple Security Vulnerabilities *** --------------------------------------------- Schneider Electric Products Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/57435 *** Blackhole outfitted with exploit for recently patched Java flaw *** --------------------------------------------- "The exploit for the recently patched CVE-2013-0431 Java vulnerability has been added to the Blackhole exploit kit, Trend Micro researchers report. The fact was discovered through the analysis of the latest PayPal-themed spam run that leads to a page hosting the exploit kit. Users are presented with a "Receipt for your PayPal payment to" email, and are urged to verify the details of the payment order by clicking on a link included in the message...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2430 *** CSA: What are 2013s top cloud security threats? *** --------------------------------------------- "The Cloud Security Alliance (CSA) has released a new report designed to examine the most pervasive security threats still threatening cloud in 2013. Called The Notorious Nine presumably using the same nomenclature that Enid Blyton employed for the protagonists of her fabled childrens books the CSA enlisted the help of industry experts, and is designed to be used in conjunction with other CSA best practice guides; Security Guidance for Critical Areas in Cloud Computing V. 3 and Security as... --------------------------------------------- http://www.cloudcomputing-news.net/news/2013/mar/04/csa-what-are-2013s-top-… *** Pwn Pad Steals the Show at RSA Cyber Security Conference in San Francisco *** --------------------------------------------- "Pwnie Express, the Vermont-based firm known for the Pwn Plug and Power Pwn, released a new appliance at RSA: the Pwn Pad. This handheld tablet allows security-and-IT-focused personnel to safely test their own network for wireless and wired security issues. The product brings an unprecedented level of ease to security testing, and has been met with critical acclaim at RSA...." --------------------------------------------- http://www.sfgate.com/business/prweb/article/Pwn-Pad-Steals-the-Show-at-RSA…

1 0

Tageszusammenfassung - Dienstag 5-03-2013
by Daily end-of-shift report 05 Mar '13

05 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-03-2013 18:00 − Dienstag 05-03-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** D-Link DSL-2740B (ADSL Router) Authentication Bypass *** --------------------------------------------- Topic: D-Link DSL-2740B (ADSL Router) Authentication Bypass Risk: High Text:+ + # Exploit Title : D-Link DSL-2740B (ADSL Router) Authentication Bypass # Date : 10-02-2013 #... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2Fn9pSNqklg/WLB-20… *** Cloudflare Briefly Drops Off Internet Deflecting DDOS Attack *** --------------------------------------------- "CloudFlares Juniper routers choked on a slight programming change designed to deflect a distributed denial-of-service attack, knocking the companys services off the Internet for about an hour early Sunday morning. The San Francisco-based company provides a service that speeds up the delivery of web pages and reduces bandwidth. It also provides a suite of security tools that helps website owners identify and filter malicious traffic...." --------------------------------------------- http://www.cio.com/article/729658/Cloudflare_Briefly_Drops_Off_Internet_Def… *** Cyber Security Bulletin (SB13-063) - Vulnerability Summary for the Week of February 25, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability... --------------------------------------------- http://www.us-cert.gov/ncas/bulletins/SB13-063 *** Vuln: OpenStack Keystone CVE-2013-0282 Security Bypass Vulnerability *** --------------------------------------------- OpenStack Keystone CVE-2013-0282 Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58033 *** Heads-UP - EU, US go separate ways on cybersecurity *** --------------------------------------------- "Europe and the United States look set to implement different approaches to cybersecurity, with Washington adopting voluntary reporting mechanisms against Brussels compulsory measures. The difference approaches threaten to create problems for companies across the two major trade blocs. President Barack Obama on 12 February issued an executive order on cybersecurity that calls for voluntary sharing of information on cyberattacks between business and government...." --------------------------------------------- http://www.euractiv.com/specialreport-cybersecurity/eu-us-set-different-app… *** Java trotz Notfall-Patch verwundbar *** --------------------------------------------- Oracle hat aktualisierte Versionen von Java 5, 6 und 7 bereitgestellt. Sie schließen zwei kritische Lücken, von denen eine bereits von Cyber-Kriminellen ausgenutzt wird. Sicher ist Java allerdings trotzdem nicht. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2936e0b6/l/0L0Sheise0Bde0Csec… *** Open standards are key for security in the cloud *** --------------------------------------------- "The current divide between proprietary and open approaches to enterprise cloud computing has implications beyond the obvious. More than just issues of cloud interoperability and data portability, open standards have benefits for user identity, authentication and security intelligence that closed or proprietary clouds threaten to compromise. Our belief is that an open cloud is a more secure one and it begins with identity...." --------------------------------------------- http://www.net-security.org/article.php?id=1812

1 0

Tageszusammenfassung - Montag 4-03-2013
by Daily end-of-shift report 04 Mar '13

04 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 01-03-2013 18:00 − Montag 04-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Bit9 Breach Began in July 2012 *** --------------------------------------------- Cyber espionage hackers who broke into security firm Bit9 initially breached the companys defenses in July 2012, according to evidence being gathered by security experts investigating the incident. Bit9 remains reluctant to name customers that were impacted by the intrusion, but the custom-made malicious software used in the attack was deployed last year in highly targeted attacks against U.S. Defense contractors.Related Posts:New Java 0-Day Attack Echoes Bit9 BreachSecurity Firm Bit9 Hacked, --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/T12Pp-nAeFw/ *** Exploit Sat on LA Times Website for 6 Weeks *** --------------------------------------------- The Los Angeles Times has scrubbed its Web site of malicious code that served browser exploits and malware to potentially hundreds of thousands of readers over the past six weeks.Related Posts:Amnesty International Site Serving Java ExploitWhat You Need to Know About the Java ExploitAttackers Pounce on Zero-Day Java ExploitNasty Twitter Worm OutbreakNew Java 0-Day Attack Echoes Bit9 Breach --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/6Ws9-MtXu3w/ *** Flame Windows Update Attack Could Have Been Repeated in 3 Days, Says Microsoft *** --------------------------------------------- "When the sophisticated state-sponsored espionage tool known as Flame was exposed last year, there was probably no one more concerned about the discovery than Microsoft, after realizing that the tool was signed with an unauthorized Microsoft certificate to verify its trustworthiness to victim machines. The attackers also hijacked a part of Windows Update to deliver it to targeted machines. After examining the nature of the certificate attack and everything the malicious actors needed to --------------------------------------------- http://www.wired.com/threatlevel/2013/03/flame-windows-update-copycat/ *** Apple blockiert veraltete Flash-Plug-ins in Safari *** --------------------------------------------- Apples hauseigener Browser lässt den Start alter Versionen des Flash-Plug-in nicht mehr zu. Das soll offenbar kürzlich bekanntgewordene Angriffsmöglichkeiten unterbinden. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2921880b/l/0L0Sheise0Bde0Csec… *** Notiz-Dienst Evernote wurde gehackt *** --------------------------------------------- Die Betreiber des Online-Notizbuchs haben alle Anwender aufgefordert, ihre Passwörter zu ändern, nachdem sich Kriminelle Zugang zur Benutzerdatenbank verschafft hatten. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2925520f/l/0L0Sheise0Bde0Csec… *** More Java-based malware plagues the cross-platform runtime *** --------------------------------------------- "Java cannot seem to get a break. Only a few days after patching the last zero-day vulnerability, two more exploits are being found that make use of the runtime. One, as noted by Kaspersky, is a recent exploit of the latest runtimes attempts to install a McRAT executable by overwriting memory in the JVM that will trigger the executable to run...." --------------------------------------------- http://reviews.cnet.com/8301-13727_7-57572168-263/more-java-based-malware-p… *** Kaspersky Internet Security 2013 Remote system freeze *** --------------------------------------------- Topic: Kaspersky Internet Security 2013 Remote system freeze Risk: Medium Text:I usually do not write security advisories unless absolutely necessary. This time I should, however I have neither the time,... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/MKm3MtRa-Q0/WLB-20… *** Need an army of killer zombies? Yours for just $25 per 1,000 PCs *** --------------------------------------------- Bring out your dead - theres a price per botnet head As little as $25 will buy you access to a thousand malware-infected PCs, neatly packaged as a botnet army to control or spy on. Thats according to a security researcher studying underground souks of zombie computers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/04/botnet_pric… *** Prices fall, services rise in malware-as-a-service market *** --------------------------------------------- "Prices are falling and the number of services is increasing as developers in the online underground compete fiercely for criminals looking to purchase botnets and other tools to mount cyber attacks. The trends in the so-called malware-as-a-service market reflect a maturing business in which any non-professional can buy or rent all the tools needed to build the malware, distribute it, and then siphon credit card and banking data and other personal information from compromised PCs. --------------------------------------------- http://www.infoworld.com/d/security/prices-fall-services-rise-in-malware-se…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily March 2013