Daily January 2015

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - Freitag 16-01-2015
by Daily end-of-shift report 16 Jan '15

16 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-01-2015 18:00 − Freitag 16-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Definitions matter. For crying out loud, securobods, BE SPECIFIC - ENISA *** --------------------------------------------- Use your words or the DDoSers will GET you.... Definitions matter when your infrastructure is under threat says European Union Agency for Network and Information Security (ENISA). --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/15/if_you_want… *** Critical Patch Update - January 2015 - Pre-Release Announcement *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for January 2015, which will be released on Tuesday, January 20, 2015. While this Pre-Release Announcement is as accurate as possible at the time of publication, the information it contains may change before publication of the Critical Patch Update Advisory. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html *** Google AdWords Campaigns Hijacked by Malvertisers *** --------------------------------------------- Two Google AdWords campaigns have been hijacked by malvertisers and users are being redirected to fraud sites without even clicking the poisoned ads. --------------------------------------------- http://threatpost.com/google-adwords-campaigns-hijacked-by-malvertisers/110… *** Telekom-Tools für sichere Server-Konfiguration *** --------------------------------------------- Die Telekom nimmt Admins an die Hand und liefert kostenlose Tools, die bei der Härtung von nginx, MySQL und Co. helfen. --------------------------------------------- http://heise.de/-2517840 *** Sicherheitsfirmen warnen vor "Je Suis Charlie"-Trojaner *** --------------------------------------------- Vermeintliches Solidaritätsvideo lädt tatsächlich Schadsoftware auf den Rechner --------------------------------------------- http://derstandard.at/2000010489196 *** Seven Months' Worth of Mistakes: A Longitudinal Study of Typosquatting Abuse *** --------------------------------------------- In particular we reveal that, even though 95 percent of the popular domains we investigated are actively targeted by typosquatters, only few trademark owners protect themselves against this practice by proactively registering their own typosquatting domains. A small fraction of those typosquatted domains -- such as gooogle.com for google.com -- were registered by the legitimate website in a bid to foil typosquatters. --------------------------------------------- https://lirias.kuleuven.be/bitstream/123456789/471369/3/typos-final.pdf *** Employee Threat Assessment Template for Large Organizations *** --------------------------------------------- Despite the popular image of the hacker cracking distant servers from his basement, studies show that people with legitimate access to your information pose an even bigger threat. And when information is stolen from within, it's often harder to trace and determine the extent of the problem. The larger your [...]The post Employee Threat Assessment Template for Large Organizations appeared first on InfoSec Institute. --------------------------------------------- http://resources.infosecinstitute.com/employee-threat-assessment-template-l… *** Details zur kritischen Lücke im Telnet-Server von Windows *** --------------------------------------------- Auf einer chinesischen Website ist eine detaillierte Analyse der gerade erst gepatchten Telnet-Lücke aufgetaucht - und ein Proof-of-Concept. --------------------------------------------- http://heise.de/-2518951 *** Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Hosted WebEx Meeting Center Information Disclosure *** --------------------------------------------- CVE-2015-0590 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** T-Mobile Internet Manager UpdateCfg.ini SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99945 *** Alienvault OSSIM Web UI command execution *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99951 *** Arbiter Systems 1094B GPS Clock Spoofing Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a GPS clock spoofing vulnerability in the Arbiter Systems 1094B clock. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-345-01 *** GE Proficy HMI/SCADA CIMPLICITY CimView Memory Access Violation *** --------------------------------------------- This advisory provides mitigation details for a memory access violation vulnerability in GE's CIMPLICITY CimView application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-289-02 *** Windows: Impersonation Check Bypass With CryptProtectMemory and CRYPTPROTECTMEMORY_SAME_LOGON flag *** --------------------------------------------- Platform: Windows 7, 8.1 Update 32/64 bit Class: Security Bypass/Information Disclosure The function CryptProtectMemory allows an application to encrypt memory for one of three scenarios, process, logon session and computer. When using the logon session option (CRYPTPROTECTMEMORY_SAME_LOGON flag) the encryption key is generated based on the logon session identifier, this is for sharing memory between processes running within the same logon. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=128 *** DSA-3129 rpm - security update *** --------------------------------------------- Two vulnerabilities have been discovered in the RPM package manager. --------------------------------------------- https://www.debian.org/security/2015/dsa-3129 *** Information Disclosure in Direct Mail Subscription (direct_mail_subscription) *** --------------------------------------------- It has been discovered that the extension "Direct Mail Subscription" (direct_mail_subscription) is susceptible to Information Disclosure. --------------------------------------------- http://www.typo3.org/news/article/information-disclosure-in-direct-mail-sub… *** WiFi File Browser Pro v2.0.8 Code Execution Vulnerability *** --------------------------------------------- Topic: WiFi File Browser Pro v2.0.8 Code Execution Vulnerability Risk: High Text:Document Title: WiFi File Browser Pro v2.0.8 - Code Execution Vulnerability References (Source): == http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010087

1 0

Tageszusammenfassung - Donnerstag 15-01-2015
by Daily end-of-shift report 15 Jan '15

15 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-01-2015 18:00 − Donnerstag 15-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** CryptoWall 3.0 Uses I2P Anonymity Network For CC Communications (SecurityWeek) *** --------------------------------------------- Almost two months have passed since the developers of CryptoWall released an updated version of the threat, but now they’re back to work. The malware, distributed via spam and malvertising campaigns, helped cybercriminals make a lot of money last year so it’s not surprising that its authors continue improving it. --------------------------------------------- http://www.securityweek.com/cryptowall-30-uses-i2p-anonymity-network-cc-com… *** AdSense Abused with Malvertising Campaign *** --------------------------------------------- Last weekend we noticed a large number of requests to scan websites for malware because they randomly redirected to some "magazine" websites. Most of them mentioned the lemode-mgz .com site. In all cases, the symptoms were the same. Some users randomly got redirected when they clicked on links or loaded new pages. They all reported... --------------------------------------------- http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campaign.ht… *** Anatomy Of A Cyber-Physical Attack (Dark Reading) *** --------------------------------------------- "If you only consider hackers, you don’t have to be concerned that much. They won't be able to take down a power grid or blow up chemical facilities," says Ralph Langer, founder of Langner Communications and a top Stuxnet expert. The danger is when attackers have an understanding of the physical and engineering aspects of the plant or site they are targeting, he says. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/anatomy-of-a-cyber-phy… *** Kritik an Apples Zwei-Faktor-Schutz *** --------------------------------------------- Apples zweistufige Bestätigung deckt mehrere Cloud-Dienste des Konzerns gar nicht ab, bemängelt eine Nutzerin - ein Angreifer könne auf diese Weise tiefe Einblicke erhalten. --------------------------------------------- http://heise.de/-2517903 *** Private Schlüssel: Gitrob sucht sensible Daten bei Github *** --------------------------------------------- Immer wieder tauchen Daten wie private Schlüssel oder Passwörter in Github-Repositories auf. Mit Hilfe von Gitrob sollen diese gefunden werden können, um sich besser zu schützen. Das öffnet aber auch die Möglichkeiten für einen interessanten Angriff. --------------------------------------------- http://www.golem.de/news/private-schluessel-gitrob-sucht-sensible-daten-bei… *** Security and Military Experts Fall For "Open" Wi-Fi *** --------------------------------------------- According to The Local, an English-language newspaper in Sweden, Gustav Nipe watched earlier this week as around 100 politicians, military officers and journalists logged into a network called “Open Guest” and proceeded to search for various non-work-related things including “forest hikes” and monitor eBay auctions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002783.html *** ATM: Attacking Multichannel Fraud (InfoRiskToday) *** --------------------------------------------- The increasing globalization of fraud perpetrated by sophisticated organized crime rings has spurred unprecedented growth in cross-channel attacks, security experts from three of the world's leading ATM manufacturers say. That's why ATM deployers can no longer build defenses that focus solely on the ATM channel, executives from Diebold Inc., Wincor Nixdorf AG and NCR Corp. say in this final part of an exclusive three-part interview with Information Security Media Group. --------------------------------------------- http://www.inforisktoday.com/interviews/atm-attacking-multichannel-fraud-i-… *** Patchday: Adobe schließt neun Lücken in Flash *** --------------------------------------------- Die Lücken, die Adobe nun in Flash geschlossen hat, betreffen alle Plattformen. Nutzer sollten die Updates schnellstmöglich installieren, da sie Angriffe aus dem Netz ermöglichen. --------------------------------------------- http://heise.de/-2517426 *** Cybercrime: Hacking als aufstrebender Wirtschaftszweig in Österreich *** --------------------------------------------- Internet-Sicherheitsbericht 2014 präsentiert - Ungeschützte Smartphones und Tablets als Ziele --------------------------------------------- http://derstandard.at/2000010445114 *** JSA10669 - 2015-01 Security Bulletin: Junos: Multiple vulnerabilities in libxml2 library *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10669&actp=RSS *** JSA10667 - 2015-01 Security Bulletin: Junos: Privilege escalation vulnerability (CVE-2014-6384) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10667&actp=RSS *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2014-8022 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability *** --------------------------------------------- CVE-2015-0591 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Simple Security plugin for WordPress wp-admin/users.php script cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99931 *** SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-022Project: nodeauthor (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module displays node author information in a jQuery slider.The module doesnt sufficiently sanitize Profile2 fields in a provided block.This vulnerability is mitigated by the fact that an attacker must have a user account allowed to --------------------------------------------- https://www.drupal.org/node/2407401 *** SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-021Project: Content Analysis (third-party module)Version: 6.xDate: 2014-January-14Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThe Content Analysis module is an API designed to help modules that need to analyze content.The module fails to sanitize user input in log messages, leading to a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by the fact --------------------------------------------- https://www.drupal.org/node/2407395 *** SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-020Project: Contact form fields (third-party module)Version: 6.xDate: 2014-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Contact Form Fields module enables you to create additional fields to site-wide contact form.Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the --------------------------------------------- https://www.drupal.org/node/2407357 *** SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-018Project: Video (third-party module)Version: 7.xDate: 2015-January-14Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescriptionThis module enables you to upload, convert and playback videos.The module doesnt sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is mitigated by --------------------------------------------- https://www.drupal.org/node/2407341 *** SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-015Project: Term merge (third-party module)Version: 7.xDate: 2015-January-14Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescriptionThis module enables you to merge (synonymous) taxonomy terms among themselves.The module doesnt sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting (XSS) vulnerability.This vulnerability is --------------------------------------------- https://www.drupal.org/node/2407315 *** PHPKIT result cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99904

1 0

Tageszusammenfassung - Mittwoch 14-01-2015
by Daily end-of-shift report 14 Jan '15

14 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-01-2015 18:00 − Mittwoch 14-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AMD plugs firmware holes that allowed command injection *** --------------------------------------------- Bug your notherboard vendor for a fix, says boffin VID Chip maker AMD has patched holes across its firmware lines that could allow hackers to inject malware. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/14/amd_plugs_c… *** Hintergrund: Universeller SSL-Tester SSLyze *** --------------------------------------------- SSL mit Kommandozeilen-Tools von Hand zu testen, ist mühselig; SSLyze nimmt Admins viel dieser Arbeit ab. --------------------------------------------- http://www.heise.de/security/artikel/Universeller-SSL-Tester-SSLyze-2470008… *** Patchday: Microsoft stopft acht Lücken in Windows *** --------------------------------------------- Am Januar-Patchday überrascht die Firma damit, ausschließlich Lücken in Windows zu schließen. Für den Internet Explorer wird lediglich ein Patch vom Dezember noch einmal aufgewärmt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Microsoft-stopft-acht-Lueck… *** MMD-0030-2015 New ELF malware on Shellshock: the ChinaZ *** --------------------------------------------- BackgroundThe bash Shellshock vulnerability is still proven to be one of the fastest way to spread ELF malware infection to NIX boxes in internet, along with Linux system that is still serving the vulnerable version. This fact that is not knowing only by internet security folks, but by the threat actors themself. Previously we announced linux/Mayhem malwarere was utilizing the shellshock previously, and now ELF malware actors in China is starting to utilized set of tools to spread more... --------------------------------------------- http://blog.malwaremustdie.org/2015/01/mmd-0030-2015-new-elf-malware-on.html *** Security updates available for Adobe Flash Player *** --------------------------------------------- Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system. ... CVE number: CVE-2015-0301, CVE-2015-0302, CVE-2015-0303, CVE-2015-0304, CVE-2015-0305, CVE-2015-0306, CVE-2015-0307, CVE-2015-0308, CVE-2015-0309 --------------------------------------------- http://helpx.adobe.com/security/products/flash-player/apsb15-01.html *** Asus schließt kritische Router-Lücke *** --------------------------------------------- Liefert wenige Tage nach Bekanntwerden Updates für zahlreiche Geräte --------------------------------------------- http://derstandard.at/2000010378742 *** Amsterdam 2015 FIRST Technical Colloquium *** --------------------------------------------- The FIRST Amsterdam Technical Colloquium (TC) 2015 will be hosted by Cisco Systems in Amsterdam, Netherlands. The event will be a plenary style conference held on the 5th and 6th of May 2015, with optional, free training sessions on May 4th. FIRST is looking for speakers that would like to present at this Technical Colloquium. This is a GREAT opportunity to give something back to FIRST and the industry, while practicing your speaking skills and sharing your hard work. --------------------------------------------- http://www.first.org/events/colloquia/amsterdam2015 *** At this rate it will hit the launch codes in... 5.3 minutes. *** --------------------------------------------- Hello everyone, in this post I would like to analyze an Android application which purpose is to manage and generate passwords securely. On their Play Store page they claim to use DES to encrypt passwords on local device and that DES key is derivated from you PIN code... --------------------------------------------- https://bughardy.me/at-this-rate-it-will-hit-the-launch-codes-in-5-3-minute… *** MSRT January 2015 - Dyzap *** --------------------------------------------- This month we added the Win32/Emotet and Win32/Dyzap malware families to the Malicious Software Removal Tool. Both Emotet and Dyzap are trojans that steal personal information, including banking credentials. In a previous blog we detailed how Emotet targets German-language banking websites. In this blog, we will focus on Dyzap - another prevalent banking trojan that predominantly targets English-speaking countries. Dyzap variants target credentials for online banking, crypto... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/13/msrt-january-2015-dyzap.… *** 4 Mega-Vulnerabilities Hiding in Plain Sight (Dark Reading) *** --------------------------------------------- How four recently discovered, high-impact vulnerabilities provided "god mode" access to 90% of the Internet for 15 years, and what that means for the future. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/4-mega-vulnerabilities… *** Phony Oracle Patches Making the Rounds *** --------------------------------------------- Attackers are circulating fake fixes for Oracle error messages and the company is warning users not to download any patches that don't come directly from Oracle. --------------------------------------------- http://threatpost.com/phony-oracle-patches-making-the-rounds/110415 *** Akamai: Probleme mit alten SSL-Implementierungen *** --------------------------------------------- Akamai verarbeitet eine Billiarde an Verbindungen pro Jahr. Brian Sniffen gibt Einblicke, was das bedeutet - und welche Schwierigkeiten darin bestehen, alte SSL-Implementierungen auszusperren. (Akamai, Android) --------------------------------------------- http://www.golem.de/news/akamai-probleme-mit-alten-ssl-implementierungen-15… *** JSA10670 - 2015-01 Security Bulletin: Junos: Malformed BGP FlowSpec prefix triggers rpd crash (CVE-2014-6386) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10670&actp=RSS *** JSA10668 - 2015-01 Security Bulletin: Junos: Fragmented OSPFv3 packets with IPsec AH may trigger kernel crash (CVE-2014-6385) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10668&actp=RSS *** JSA10666 - 2015-01 Security Bulletin: Junos: Firewall filter fails to match on port (CVE-2014-6383) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10666&actp=RSS *** JSA10665 - 2015-01 Security Bulletin: Junos: jpppd core when MX Series router receives crafted PAP Authenticate-Request (CVE-2014-6382) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10665&actp=RSS *** Cisco ASA DHCPv6 Relay DoS Vulnerability *** --------------------------------------------- CVE-2015-0578 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability *** --------------------------------------------- CVE-2015-0579 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS ISQ XSS Vulnerability *** --------------------------------------------- CVE-2015-0577 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AnyConnect User Interface Dialog Rendered When Connecting to Arbitrary Hosts Vulnerability *** --------------------------------------------- CVE-2014-3314 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** VU#117604: Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication *** --------------------------------------------- Vulnerability Note VU#117604 Panasonic Arbitrator Back-End Server (BES) uses unencrypted communication Original Release date: 13 Jan 2015 | Last revised: 13 Jan 2015 Overview Panasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data. Description CWE-319: Cleartext Transmission of Sensitive InformationPanasonic Arbitrator Back-End Server (BES) uses an unencrypted channel to transmit data between the client and server. It has been reported that Active Directory --------------------------------------------- http://www.kb.cert.org/vuls/id/117604 *** Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1031533 *** Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload *** --------------------------------------------- Topic: Foxit MobilePDF 4.4.0 Local File Inclusion / Arbitrary File Upload Risk: High Text:Document Title: Foxit MobilePDF v4.4.0 iOS - Multiple Web Vulnerabilities References (Source): == http://w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010071 *** Lexmark MarkVision Enterprise Arbitrary File Upload *** --------------------------------------------- This module exploits a code execution flaw in Lexmark MarkVision Enterprise before 2.1. A directory traversal in the fdFileUploadServlet servlet allows an unauthenticated attacker to upload arbitrary files, including arbitrary JSP code. This module has been tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2. --------------------------------------------- http://www.exploit-db.com/exploits/35776/ *** Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness *** --------------------------------------------- This tool checks whether a BMC machine is vulnerable to CVE-2014-8272 (http://www.kb.cert.org/vuls/id/843044) by logging the TemporarySessionID/SessionID in each IPMI v1.5 session, and checking that these values are incremental... --------------------------------------------- http://www.exploit-db.com/exploits/35770/ *** Simple Security <= 1.1.5 - Two Cross-Site Scripting (XSS) Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7753

1 0

Tageszusammenfassung - Dienstag 13-01-2015
by Daily end-of-shift report 13 Jan '15

13 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-01-2015 18:00 − Dienstag 13-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Remember Corel? Its just entered .DLL hell *** --------------------------------------------- Hijack hole found in Corel Draw and other doodleware Local zero day vulnerabilities have been disclosed in Corel applications, potentially affecting more than 100 million users. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/13/hijack_hole… *** Windows logging cheat sheet - Win 7/Win 2008 or later *** --------------------------------------------- This "Windows Logging Cheat Sheet" is intended to help you get started setting up basic and necessary Windows Audit Policy and Logging. By no means is this list extensive; but it does include some very common items that should be enabled, configured, gathered and harvested for any Log Management Program. Start with these settings and add to it as you understand better what is in your logs and what you need. --------------------------------------------- http://sniperforensicstoolkit.squarespace.com/storage/logging/Windows%20Log… *** Docker Secure Deployment Guidelines *** --------------------------------------------- The GitHub repository referenced below aims at providing some deployment guidelines for Docker developers and system administrators alike, that can be used to improve the security posture of Linux containers within a Dockerized environment. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/1/12/docker-secure-deployment-guideli… *** Alert on unauthorized use of domain administrative account for Active Directory *** --------------------------------------------- At JPCERT/CC, we have observed multiple targeted attacks against domestic organizations where attackers intruded and stay within a corporate network for long periods of time and steal information. One characteristic of these attacks is that the attackers in the network steal credentials for the domain administrator account (herein, administrator account) in Active Directory, and leverage this administrator account to launch various attacks across the network. --------------------------------------------- https://www.jpcert.or.jp/english/at/2014/at140054.html *** Skeleton Key Malware Analysis *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers discovered malware that bypasses authentication on Active Directory (AD) systems that implement single-factor (password only) authentication. Threat actors can use a password of their choosing to authenticate as any user. ... Skeleton Key is deployed as an in-memory patch on a victims AD domain controllers to allow the threat actor to authenticate as any user, while legitimate users can continue to authenticate as normal. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-m… *** KeySweeper - Arduino-based Keylogger for Wireless Keyboards *** --------------------------------------------- Security researcher has developed a cheap USB wall charger that is capable to eavesdrop on almost any Microsoft wireless keyboard. MySpace mischief-maker Samy Kamkar has released a super-creepy keystroke logger for Microsoft wireless keyboards cunningly hidden in what appears to be a rather cheap, but functioning USB wall charger. The stealthy Arduino-based device,... --------------------------------------------- http://thehackernews.com/2015/01/KeySweeper-Arduino-Keyboard-Keylogger.html *** Gitrob: Putting the Open Source in OSINT *** --------------------------------------------- Sometimes employees might publish things that should not be publicly available. Things that contain sensitive information or things that could even lead to direct compromise of a system. This can happen by accident or because the employee does not know the sensitivity of the information. Gitrob is a command line tool that can help organizations and security professionals find such sensitive information. --------------------------------------------- http://michenriksen.com/blog/gitrob-putting-the-open-source-in-osint/ *** Aggressive Riskware Installation on Amazon Kindle (and Android) *** --------------------------------------------- As malware continues to grow on Android (900K malicious samples and 1,300 new per day), we sometimes forget attacks can also affect other devices... like Amazons Kindle. The Kindle indeed runs Fire OS, a fork of Android. Thus, in several cases, Android malware also work on Fire OS, and reciprocally. Proof below. ... --------------------------------------------- http://blog.fortinet.com/post/aggressive-riskware-installation-on-amazon-ki… *** OSXCollector: Forensic Collection and Automated Analysis for OS X *** --------------------------------------------- OSXCollector is an open source forensic evidence collection and analysis toolkit for OS X. It was developed in-house at Yelp to automate the digital forensics and incident response (DFIR) our crack team of responders had been doing manually. --------------------------------------------- http://engineeringblog.yelp.com/2015/01/osxcollector-forensic-collection-an… *** ICS London 2015 *** --------------------------------------------- SANS ICS London 2015 hosts four dedicated training courses for those tasked with securing Industrial Control Systems. This specialist training event takes place at the Grand Connaught Rooms in Londons West End, from April 27th to May 2nd 2015. --------------------------------------------- https://www.sans.org/event/ics-london-2015 *** Millionen Android-Geräte mit Sicherheitslücken auf Lebenszeit *** --------------------------------------------- Eine Kernkomponente von Android wird auf Geräten mit älteren Versionen nicht mehr mit Patches versorgt. Dabei ist vor allem deren Standardbrowser Einfallstor für Angreifer. --------------------------------------------- http://www.heise.de/security/meldung/Millionen-Android-Geraete-mit-Sicherhe… *** [2015-01-13] Multiple critical vulnerabilities in all snom desktop IP phones *** --------------------------------------------- All snom desktop IP phones are affected by multiple critical security issues in all available firmware versions. Attackers are able to completely compromise the phone with root access rights and install backdoors to the device which will even survive a factory reset. Furthermore, tapping into phone calls or surveilling the room is possible. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Privilege Escalation & XSS & Missing Authentication in Ansible Tower *** --------------------------------------------- Attackers are able to elevate privileges and gain access to sensitive data of other organizations in Ansible Tower. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** [2015-01-13] Cross site request forgery vulnerability in XBMC / Kodi *** --------------------------------------------- An attacker could potentially gain access to sensitive information stored on the system where XBMC / Kodi is installed by exploiting CSRF issues. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** VU#533140: Tianocore UEFI implementation reclaim function vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140 *** Cisco WebEx Meetings Server Information Disclosure Vulnerability *** --------------------------------------------- CVE-2015-0583 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** SSA-311299 (Last Update 2015-01-13): Vulnerabilities in iOS App SIMATIC WinCC Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** DFN-CERT-2015-0037 - Red Hat JBoss Data Virtualization: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0037/

1 0

Tageszusammenfassung - Montag 12-01-2015
by Daily end-of-shift report 12 Jan '15

12 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-01-2015 18:00 − Montag 12-01-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** SnoopSnitch Android app notifies users of IMSI catchers, SS7 attacks *** --------------------------------------------- SnoopSnitch requires a rooted device with a Qualcomm chipset that runs stock Android 4.1 or higher. --------------------------------------------- http://www.scmagazine.com/free-app-flags-attempts-to-spy-on-mobile-phones/a… *** Cisco WebEx Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** SAP NetWeaver Business Client for HTML Input Validation Flaws Permit Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in SAP NetWeaver Business Client for HTML. A remote user can conduct cross-site scripting attacks. The Business Client for HTML component does not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. --------------------------------------------- http://www.securitytracker.com/id/1031509 *** PLAID: Die seltsame Welt der ISO-Standards *** --------------------------------------------- Auf der Real World Crypto berichten Sicherheitsforscher über ihre Erfahrungen mit der ISO. Bei der Standardisierung des Authentifizierungsprotokolls PLAID offenbart sich teilweise eine erschreckende Unkenntnis in Sachen Kryptographie. --------------------------------------------- http://www.golem.de/news/plaid-die-seltsame-welt-der-iso-standards-1501-111… *** Dan J. Bernstein: Krypto-Algorithmen sicher designen *** --------------------------------------------- Der Kryptograph Dan Bernstein fordert auf der Real World Crypto seine Kollegen auf, kryptographische Algorithmen so zu designen, dass ein fehlerhafter Einsatz vermieden wird. Es sei keine gute Idee, immer den Programmierern die Schuld zu geben. --------------------------------------------- http://www.golem.de/news/dan-j-bernstein-krypto-algorithmen-sicher-designen… *** Google No Longer Provides Patches for WebView Jelly Bean and Prior *** --------------------------------------------- Google will no longer be providing security patches for vulnerabilities reported to affect only versions of Android's native WebView prior to 4.4. In other words, Google is now only supporting the current named version of Android (Lollipop, or 5.0) and the prior named version (KitKat, or 4.4). Jelly Bean (versions 4.0 through 4.3) and earlier will no longer see security patches for WebView from Google ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no… *** Securitys revamped index of pain readies for release *** --------------------------------------------- Comments sought on draft Common Vulnerability Scoring System 3.0 bug rating scheme The great unwashed has been afforded an opportunity to comment on a new scheme for classifying the severity of infosec vulnerabilities issued by the National Institute of Standards and Technology. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/12/securitys_r… *** Ntpdc Local Buffer Overflow *** --------------------------------------------- Alejandro Hdez (@nitr0usmx) recently tweeted about a trivial buffer overflow in ntpdc, a deprecated NTP query tool still available and packaged with any NTP install. He posted a screenshot of the crash as the result of a large buffer passed into a vulnerable gets call. After digging into it a bit, I decided it'd be a fun exploit to write, and it was. There are a few quarks to it that make it of particular interest, of which I've detailed below. --------------------------------------------- http://hatriot.github.io/blog/2015/01/06/ntpdc-exploit/ *** Deciphering the landscape for Privacy by Design. ENISA publishes its recommendations for policy makers, data protection authorities and experts *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/deciphering-the-landscape-for-p… *** Windows Elevation of Privilege in User Profile Service *** --------------------------------------------- Platform: Windows 8.1 Update 32/64 bit (No other OS tested) When a user logs into a computer the User Profile Service is used to create certain directories and mount the user hives (as a normal user account cannot do so). ... However there seems to be a bug in the way it handles impersonation, the first few resources in the profile get created under the user's token, but this changes to impersonating Local System part of the way through. --------------------------------------------- https://code.google.com/p/google-security-research/issues/detail?id=123 *** Do we need regular IT security fire drills? *** --------------------------------------------- IT security 'fire drills', supported by executive management and the risk committee should be conducted regularly in organizations, in order to understand the appropriate course of action in advance of a security breach. ... Organizations need to move beyond focusing purely on the prevention of security incidents, and start to concentrate on what they will do when an incident occurs. --------------------------------------------- http://www.net-security.org/secworld.php?id=17810 *** Diving into a Silverlight Exploit and Shellcode - Analysis and Techniques *** --------------------------------------------- http://www.checkpoint.com/downloads/partners/TCC-Silverlight-Jan2015.pdf *** Open-Source USB Exploitation Library - Teensyduino *** --------------------------------------------- What is Paensy? Paensy [pan-zee] is a combination of the word payload and Teensy - Paensy is an attacker-oriented, C-based library written for the development of Teensy devices. Paensy simplifies and optimizes mundane tasks and allows an easier platform for scripting. --------------------------------------------- http://malware.cat/?p=89 *** Protecting yourself from Powershell based VBA Macro Attacks *** --------------------------------------------- As some of you may know, I released a standalone Powershell script that will automatically generate a malicious VBA macro using different payloads and persistence methods. This can be found here: https://github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1 As a response, I have gotten a few questions from sysadmins about protecting their organizations from an attack like this. Since this type of attack relies on social engineering, there are only a handful of things you can do to --------------------------------------------- https://enigma0x3.wordpress.com/2015/01/11/protecting-yourself-from-powersh…

1 0

Tageszusammenfassung - Freitag 9-01-2015
by Daily end-of-shift report 09 Jan '15

09 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-01-2015 18:00 − Freitag 09-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** AIX for penetration testers (SANS Reading Room) *** --------------------------------------------- AIX is a widely used operating system by banks, insurance companies, power stations and universities. The operating system handles various sensitive or critical information for these services. There is limited public information for penetration testers about AIX hacking, compared the other common operating systems like Windows or Linux. --------------------------------------------- https://www.sans.org/reading-room/whitepapers/unix/aix-penetration-testers-… *** Datenschutzpanne in Mac OS X Yosemite *** --------------------------------------------- Die Spotlight genannte Suchfunktion der aktuellen Mac-OS-X-Version hat erneut ein Datenschutzproblem: Stößt sie auf HTML-Mails, lädt sie ungefragt Inhalte aus externen Quellen nach - zur Freude der Spammer. --------------------------------------------- http://www.heise.de/security/meldung/Datenschutzpanne-in-Mac-OS-X-Yosemite-… *** Netflix Credentials Targeted By Phishing Campaign *** --------------------------------------------- A new malicious email campaign has been observed by security researchers to target customers of Netflix by feeding them a message purporting to be an important notification from the media streaming service. ... Users are advised to check the legitimacy of the emails straight on the official page of the service and to avoid clicking on the provided link. All phishing messages can be forwarded to phishing(a)netflix.com for investigation. --------------------------------------------- http://news.softpedia.com/news/Netflix-Credentials-Targeted-By-Phishing-Cam… *** Microsoft advanced notification service changes. , (Fri, Jan 9th) *** --------------------------------------------- Quite a few of you have written in to let us know that Microsoft is changing the way in which they provide information (thanks to you all). ">You can read the full blog here --">/archive/2015/01/08/evolving-advance-notification-service-ans-in-2015.aspx In a nutshell if you want to be advised in advance younow need to register, select the products used and you will then be provided with information relating to the patches that will be released. If you are a premier customer your... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19167&rss *** Banking Trojans Disguised As ICS/SCADA Software Infecting Plants *** --------------------------------------------- Researcher spots spike in traditional financial malware hitting ICS/SCADA networks -- posing as popular GE, Siemens, and Advantech HMI products. A renowned ICS/SCADA security researcher has discovered a surprising twist in cyberattacks hitting plant floor networks: traditional banking Trojan malware posing as legitimate ICS software updates and files rather than the dreaded nation-state custom malware in the wake of Stuxnet. --------------------------------------------- http://www.darkreading.com/attacks-breaches/banking-trojans-disguised-as-ic… *** OpenBSD Releases a Portable Version of OpenNTPD *** --------------------------------------------- Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues! --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/NJ1R-3x9MVI/story01.htm *** No, the Linux leap second bug WONT crash the web *** --------------------------------------------- Fear the fear, not the second There's a reason space missions don't launch on the day a leap second is added to international clocks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/09/leap_second… *** Asus-Router schutzlos bei Angriffen aus dem eigenen Netz *** --------------------------------------------- Mindestens die Router RT-AC66 und RT-N66U können von Angreifern aus dem LAN komplett gekapert werden. Wahrscheinlich sind weitere Modelle betroffen. Firmware-Updates, die das Loch stopfen, gibt es noch nicht. --------------------------------------------- http://www.heise.de/security/meldung/Asus-Router-schutzlos-bei-Angriffen-au… *** USN-2456-1: GNU cpio vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2456-18th January, 2015cpio vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Ubuntu 10.04 LTSSummaryThe GNU cpio program could be made to crash or run programs if itopened a specially crafted file or received specially crafted input.Software description cpio - a program to manage archives of files DetailsMichal Zalewski discovered an out of bounds write issue in theprocess_copy_in... --------------------------------------------- http://www.ubuntu.com/usn/usn-2456-1/ *** Cisco Unified Communications Domain Manager Platform High CPU DoS Vulnerability *** --------------------------------------------- CVE-2014-8020 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco WebEx Meetings Server Authentication Bypass Vulnerability *** --------------------------------------------- CVE-2014-8033 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** DSA-3122 curl - security update *** --------------------------------------------- Andrey Labunets of Facebook discovered that cURL, an URL transferlibrary, fails to properly handle URLs with embedded end-of-linecharacters. An attacker able to make an application using libcurl toaccess a specially crafted URL via an HTTP proxy could use this flaw todo additional requests in a way that was not intended, or insertadditional request headers into the request. --------------------------------------------- https://www.debian.org/security/2015/dsa-3122 *** DSA-3121 file - security update *** --------------------------------------------- Multiple security issues have been found in file, a tool/library todetermine a file type. Processing a malformed file could result indenial of service. Most of the changes are related to parsing ELFfiles. --------------------------------------------- https://www.debian.org/security/2015/dsa-3121 *** Emerson HART DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights HART DTM library utilized in Emerson's HART DTM. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-01-0 *** Schneider Electric Wonderware InTouch Access Anywhere Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the Wonderware InTouch Access Anywhere Server product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-008-02 *** TP-Link TL-WR840N Cross Site Request Forgery *** --------------------------------------------- Topic: TP-Link TL-WR840N Cross Site Request Forgery Risk: Low Text:Classification: //Dell SecureWorks/Confidential - Limited External Distribution: # # * Title: TP-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010041 *** Wireshark Security Advisories *** --------------------------------------------- wnpa-sec-2015-05. TLS/SSL decryption crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-04. SMTP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-03. DEC DNA Routing Protocol dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-02. LPP dissector crash. Fixed in 1.12.3, 1.10.12. | wnpa-sec-2015-01. WCCP dissector crash. Fixed in 1.12.3, 1.10.12. --------------------------------------------- https://www.wireshark.org/security/ *** Several vulnerabilities have been found in the third party TYPO3 extensions *** --------------------------------------------- extension "Content Rating": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… | extension "Content Rating Extbase": http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… --------------------------------------------- http://typo3.org/teams/security/security-bulletins

1 0

Tageszusammenfassung - Donnerstag 8-01-2015
by Daily end-of-shift report 08 Jan '15

08 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-01-2015 18:00 − Donnerstag 08-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Why patch management is ALSO REQUIRED in ICS infrastructure, (Wed, Jan 7th) *** --------------------------------------------- Security patch management is a delicate issue in critical infrastructure. This is caused for the specific configuration, operating system version and related software required by the ICS platform. Most support contracts states that any modification outside the parameters stated by the manufacturer will void the relation and release manufacturer and seller from any responsibility about malfunction and any consequence on the industrial process. Unfortunately, when we talk about ICS software... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19157&rss *** Assessing the risk of POODLE, (Thu, Jan 8th) *** --------------------------------------------- One of the biggest security announcements in the last year was definitely the POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, which marked the real end of SSLv3. In a contrast with many other previously identified vulnerabilities in encryption algorithms used by SSLv3, this vulnerability is viable, and can be exploited by an attacker without jumping over too many obstacles or requiring large resources the POODLE vulnerability is real. While this raised quite a bit of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19159&rss *** wmap - A Chrome Extension for Taking Screenshots of Web Services In Bulk *** --------------------------------------------- wmap is a Chrome extension written mostly in JavaScript which uses the Chrome browser to generate HTML screenshot reports of web services. --------------------------------------------- http://thehackerblog.com/wmap-a-chrome-extension-for-taking-screenshots-of-… *** B-Sides Ljubljana *** --------------------------------------------- First Security B-Sides Ljubljana is about to *happen*. BSides is community driven information security conference that will be held March 12th in Ljubljana, Slovenia, day after Cloud Security Alliance CEE Summit 2015. Call for papers is now online. --------------------------------------------- http://bsidesljubljana.si/ *** Bypassing OpenSSL Certificate Pinning in iOS Apps *** --------------------------------------------- When mobile applications communicate with an API or web service, this should generally happen via TLS/SSL (e.g., HTTPS). ... Since any of the CAs may issue a certificate for any hostname/server, security-conscious applications should "pin" the expected server certificate in the application, i.e., not accept any certificate but the one issued by the known-good CA which the application developer uses. --------------------------------------------- http://chargen.matasano.com/chargen/2015/1/6/bypassing-openssl-certificate-… *** PowerShell Toolkit: PowerSploit *** --------------------------------------------- PowerSploit is a collection of PowerShell scripts which can prove to be very useful during some exploitation and mostly post-exploitation phases of a penetration test. To get the latest version of PowerSploit, visit this URL: https://github.com/mattifestation/PowerSploit If you have GIT, then you can simply run the following command to get... --------------------------------------------- http://resources.infosecinstitute.com/powershell-toolkit-powersploit/ *** Using Free Tools To Detect Attacks On ICS/SCADA Networks *** --------------------------------------------- ICS/SCADA experts say open-source network security monitoring software is a simple and cheap way to catch hackers targeting plant operations. --------------------------------------------- http://www.darkreading.com/perimeter/using-free-tools-to-detect-attacks-on-… *** State of the Internet: Attack traffic, DDoS, IPv4 and IPv6 *** --------------------------------------------- Akamai today released its latest State of the Internet report, which provides insight into key global statistics such as connection speeds and broadband adoption across fixed and mobile networks, over... --------------------------------------------- http://www.net-security.org/secworld.php?id=17798 *** Windows exploitation in 2014 *** --------------------------------------------- Today, we published our research about Windows exploitation in 2014. This report contains interesting information about vulnerabilities in Microsoft Windows and Office patched over the course of the year, drive-by download attacks and mitigation techniques. --------------------------------------------- http://www.welivesecurity.com/2015/01/08/windows-exploitation-2014/ *** Netskope Cloud Report - January 2015 *** --------------------------------------------- In this quarterly Netskope Cloud Report, a key find in that as many as 15 percent of business users have had their credentials compromised. Since up to half of users re-use passwords for multiple accounts, the likelihood of users logging into business-critical apps with these credentials is high, putting business-sensitive data at risk. --------------------------------------------- https://www.netskope.com/reports/netskope-cloud-report-january-2015/ *** Deobfuscating Malicious Macros Using Python *** --------------------------------------------- Over the past few weeks, weve observed cybercriminals spamming users, particularly in the UK, using document files embedded with malicious macros masquerading as invoices. The attachment is either a Word or an Excel document file. Here are some examples incorporating brands based in the UK: Users must enable macros in order for these malicious documents to work. In some cases, the documents include instructions for enabling macros. You may think of document macro viruses as a thing... --------------------------------------------- http://blog.spiderlabs.com/2015/01/tips-for-deobfuscating-the-malicious-mac… *** vBulletin Releases Serious Vulnerability in VBSEO *** --------------------------------------------- The vBulletin team sent an email yesterday to all their clients about a potential security vulnerability on VBSEO. VBSEO is widely used SEO module for vBulletin that was discontinued last year. This makes the problem worse, no patches will be released for it. If you are using VBSEO, you have 3 options: Completely remove VBSEO... --------------------------------------------- http://blog.sucuri.net/2015/01/serious-vulnerability-on-vbseo.html *** Aviator Going Open Source *** --------------------------------------------- One of the most frequent criticisms we've heard at WhiteHat Security about Aviator is that it's not open source. There were a great many reasons why we didn't start off that way, not the least of which was getting the legal framework in place to allow it, but we also didn't want our efforts to... --------------------------------------------- https://blog.whitehatsec.com/aviator-going-open-source/ *** Evolving Microsofts Advance Notification Service in 2015 *** --------------------------------------------- Our Advance Notification Service (ANS) was created more than a decade ago as part of Update Tuesday to broadly communicate in advance, about the security updates being released for Microsoft products and services each month. Over the years, technology environments and customer needs have evolved, prompting us to evaluate our existing information and distribution channels. This desire to improve is why customers may have seen us introduce myBulletins to provide bulletin reports tailored to... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/01/07/evolving-advance-notific… *** OpenSSL Fixes Eight Security Vulnerabilities *** --------------------------------------------- The OpenSSL Project has released several new versions of the software that fix eight security vulnerabilities, including several certificate issues and a couple of denial-of-service flaws. The patches included in OpenSSL 1.0.0p, 1.0.1k and 0.98zd are not for critical or high-risk vulnerabilities, but they do fix some interesting vulnerabilities. Two of the bugs are rated moderate and the other... --------------------------------------------- http://threatpost.com/openssl-fixes-eight-security-vulnerabilities/110279 https://www.openssl.org/news/secadv_20150108.txt *** Cisco Secure Access Control Server Privilege Escalation Vulnerability *** --------------------------------------------- CVE-2014-8027 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- CVE-2014-8028 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Secure Access Control Server Open Redirect Vulnerability *** --------------------------------------------- CVE-2014-8029 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Brother MFC-J4410DW Cross Site Scripting *** --------------------------------------------- Topic: Brother MFC-J4410DW Cross Site Scripting Risk: Low Text:Class Cross-Site Scripting Remote Yes Disclosed 9th October 2014 Published 7th January 2015 Credit Dave Daly of Dionach (vu... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010034 *** Pirelli Router WPA weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99682 *** SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-010Project: Log Watcher (third-party module)Version: 6.xDate: 2015-January-07Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionLog Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types.The report administration links are not properly protected from CSRF. A malicious user could cause a log --------------------------------------------- https://www.drupal.org/node/2403463 *** SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-007Project: htaccess (third-party module)Version: 7.xDate: 2015-January-07Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionThe Htaccess module allows the creation and deployment of .htaccess files based on custom settings.Some administration links were not properly protected from Cross Site Request Forgery (CSRF). A malicious user could cause an administrator to deploy or --------------------------------------------- https://www.drupal.org/node/2403445 *** SA-CONTRIB-2015-005 - WikiWiki - SQL injection *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-005Project: WikiWiki (third-party module)Version: 6.xDate: 2015-January-07Security risk: 22/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:AllVulnerability: SQL InjectionDescriptionWikiWiki module gives you one place to create, share and find wiki pages in your site.The module did not sanitize user input inside a database query thereby leading to a SQL Injection vulnerability.CVE identifier(s) issuedA CVE identifier will be requested, and --------------------------------------------- https://www.drupal.org/node/2403375

1 0

Tageszusammenfassung - Mittwoch 7-01-2015
by Daily end-of-shift report 07 Jan '15

07 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-01-2015 18:00 − Mittwoch 07-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Debunking Myths Around Industrial Control Systems Cybersecurity *** --------------------------------------------- General awareness for the need to improve cybersecurity in industrial control systems (ICS) has increased significantly in recent years, but there are still plenty of misconceptions. A recent incident that can be used to highlight... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/debunking-myths-around-i… *** Who's Attacking Whom? Realtime Attack Trackers *** --------------------------------------------- It seems nearly every day were reading about Internet attacks aimed at knocking sites offline and breaking into networks, but its often difficult to visualize this type of activity. In this post, well take a look at multiple services for tracking online attacks and attackers around the globe and in real-time. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qZhz3RO9frg/ *** l+f: SSH mit Alu-Hut *** --------------------------------------------- Wer der NSA das Leben schwer machen will, kann das Fernwartungsprotokoll mit einigen Handgriffen auf der Kommandozeile abhärten. --------------------------------------------- http://www.heise.de/security/meldung/l-f-SSH-mit-Alu-Hut-2512471.html *** Inside Cryptowall 2.0 Ransomware *** --------------------------------------------- An analysis of Cryptowall 2.0 reveals that the ransomware relies on complex encryption routines and sandbox detection capabilities to survive. It also uses Tor for command and control, and can execute on 32- and 64-bit systems. --------------------------------------------- http://threatpost.com/inside-cryptowall-2-0-ransomware/110228 *** New Variant of Emotet Banking Malware targets German Users *** --------------------------------------------- A new Spam email campaign making the rounds in Germany are delivering a new variant of a powerful banking malware, a financial threat designed to steal users' online banking credentials, according to security researchers from Microsoft. The malware, identified as Emotet, was first spotted last June by security vendors at Trend Micro. The most standout features of Emotet is its network... --------------------------------------------- http://thehackernews.com/2015/01/emotet-banking-malware.html *** Linux DDoS Trojan hiding itself with an embedded rootkit *** --------------------------------------------- At the end of September 2014, a new threat for the Linux operating system dubbed XOR.DDoS forming a botnet for distributed denial-of-service attacks was reported ... In this blog post, we will describe the installation steps, the rootkit itself, and the communication protocol for getting attack commands. --------------------------------------------- https://blog.avast.com/2015/01/06/linux-ddos-trojan-hiding-itself-with-an-e… *** AOL Advertising Network Abused to Distribute Malware *** --------------------------------------------- Security researchers have uncovered a malvertising campaign used to distribute malware to visitors of The Huffington Post website, as well as several other sites, through malicious advertisements served over the AOL advertising network. At the end of last year, Cyphort Labs, security firm specialized in detecting malware threats, came across some malicious advertisements that were being --------------------------------------------- http://thehackernews.com/2015/01/aol-advertising-network-abused-to_6.html *** SPARTA - Network Infrastructure Penetration Testing Tool *** --------------------------------------------- SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenient way. If little time is spent setting up commands and tools, more time can be spent focusing on analysing results. --------------------------------------------- http://hack-tools.blackploit.com/2015/01/sparta-network-infrastructure.html *** Malformed AndroidManifest.xml in Apps Can Crash Mobile Devices *** --------------------------------------------- Every Android app comprises of several components, including something called the AndroidManifest.xml file or the manifest file. This manifest file contains essential information for apps, "information the system must have before it can run any of the app's code." We came across a vulnerability related to the manifest file that may cause an affected device... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/malformed-androi… *** Interview with NYU-Poly's Professor Justin Cappos: Security Lessons From Retail Breaches *** --------------------------------------------- In our discussion, Professor Cappos has a lot to say about weaknesses with our current approach to password-based security as well as new technologies that can be applied to credit card transactions. ... Cappos offers some very practical advice on securing systems. --------------------------------------------- http://blog.varonis.com/conversation-nyu-polys-professor-justin-cappos-data… *** Is now the time to deploy embedded hypervisors for BYOD security? *** --------------------------------------------- The operating systems deployed on smartphones and tables, such as Apple IOS or Google Android, are designed as single-user platforms that dont offer much of the security or virtualization technology ... There are a number of approaches that seem viable to address the challenge including the following: ... Making enterprise or personal applications execute in a virtual machine that could either have sharply curtailed access to the device and the data it contains --------------------------------------------- http://www.zdnet.com/article/is-now-the-time-to-deploy-embedded-hypervisors… *** Spam Nation, book review: Inside todays cybercrime ecosystem *** --------------------------------------------- In Spam Nation, Krebs tells the tale of the Pharma Wars, in which duelling Russian spam kings squabble over territory, hacking each others systems, paying police to investigate each other. The even larger story is the economic conditions that fuel all this. Who clicks on these ads? --------------------------------------------- http://www.zdnet.com/article/spam-nation-book-review-inside-todays-cybercri… *** Twitter AnomalyDetection tool goes open source *** --------------------------------------------- Twitter has opened up suspicious activity tracker AnomalyDetection to developers. The social media giant said on Tuesday the tool, dubbed AnomalyDetection, is used by the firms team to detect unusual traffic events including traffic spikes and surges, as well as the presence of spam bots. --------------------------------------------- http://www.zdnet.com/article/twitter-anomalydetection-tool-goes-open-source/ *** CVE-2014-7911 - A Deep Dive Analysis of Android System Service Vulnerability and Exploitation *** --------------------------------------------- In this post we discuss CVE-2014-7911 and the various techniques that can be used to achieve privilege escalation. We also examine how some of these techniques can be blocked using several security mechanisms. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-… *** The Connections Between MiniDuke, CosmicDuke and OnionDuke *** --------------------------------------------- In September, we blogged about CosmicDuke leveraging timely, political topics to deceive the recipient into opening the malicious document. After a more detailed analysis of the files we made two major discoveries. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002780.html *** DNS-Blacklist AHBL stellt Betrieb ein *** --------------------------------------------- Die DNS-Blacklist Abusive Hosts Blocking List (AHBL) stellt ihre Dienste endgültig ein. Wer sie befragt, erhält grundsätzlich einen Treffer als Antwort. Administratoren von Mailservern müssen jetzt handeln. --------------------------------------------- http://www.heise.de/newsticker/meldung/DNS-Blacklist-AHBL-stellt-Betrieb-ei… *** US-Cert warnt vor weiteren UEFI-BIOS-Lücken *** --------------------------------------------- Durch neue Lücken kann man die Schutzmechanismen abermals austricksen. Angreifer könnten so tief im System ein Bootkit verankern, dem kein Virenscanner etwas anhaben kann. Wieder sollen BIOS-Updates helfen. --------------------------------------------- http://www.heise.de/security/meldung/US-Cert-warnt-vor-weiteren-UEFI-BIOS-L… *** JSA10663 - Out of Cycle Security Bulletin: Multiple vulnerabilities in NTP *** --------------------------------------------- Product Affected: Junos OS, NSM Series devices, NSMXpress and NSM server software. | Problem: NTP.org has published a security advisory for six vulnerabilities resolved in ntpd (NTP daemon) that have been assigned four CVE IDs. In the worst case, some of these issues may allow remote unauthenticated attackers to execute code with the privileges of ntpd or cause a denial of service condition. --------------------------------------------- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10663 *** Open-Xchange XHTML File Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1031488 *** Mantis BugTracker 1.2.17 XSS / DoS / Redirect *** --------------------------------------------- Topic: Mantis BugTracker 1.2.17 XSS / DoS / Redirect Risk: Medium Text:Mantis BugTracker 1.2.17 multiple security vulnerabilities. ****************************************************************... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010024 *** Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting *** --------------------------------------------- Topic: Open-Xchange Server 6 / OX AppSuite 7.6.1 Cross Site Scripting Risk: Low Text:Product: Open-Xchange Server 6 / OX AppSuite Vendor: Open-Xchange GmbH Internal reference: 35512 (Bug ID) Vulnerability ty... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010020 *** DFN-CERT-2015-0005/ - ISC BIND: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle in BIND ermöglicht einem entfernten, nicht authentifizierten Angreifer einen Denial-of-Service-Zustand zu bewirken. Die Schwachstelle wird mit einem Update auf Version 9.9.6P1 für die SUSE Linux Enterprise 11 SP3 Produkte Software Development Kit, Server, Server für VMware und Desktop behoben. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0005/ *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM QRadar SIEM (CVE-2014-3567, CVE-2014-3568, CVE-2014-3508, CVE-2014-3511) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM QRadar SIEM. IBM QRadar SIEM has addressed the applicable CVEs. CVE(s): CVE-2014-3567 , CVE-2014-3568 , CVE-2014-3511 and CVE-2014-3508 ... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691210 *** IBM Security Bulletin: Connect:Enterprise For UNIX and Connect:Enterprise clients are affected by the POODLE and OpenSSL vulnerabilities (CVE-2014-3566, CVE-2014-3567) *** --------------------------------------------- SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption (POODLE) attack. SSLv3 is enabled in Connect:Enterprise For UNIX, Connect:Enterprise Command Line Client, Connect:Enterprise HTTP Option, and... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21690537 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Master Data Management (CVE-2014-3511, CVE-2014-3507, CVE-2014-3506, CVE-2014-3505 ) *** --------------------------------------------- OpenSSL vulnerabilities were disclosed on August 6th, 2014 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Master Data Management. IBM InfoSphere Master Data Management has addressed the applicable CVEs provided by OpenSSL. CVE(s):... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21691162 *** EMC Documentum Web Development Kit cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99632 *** EMC Documentum Web Development Kit weak security *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/99636 *** Apache Traffic Server HttpTransact Boundary Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031499 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Operational Decision Manager, WebSphere ILOG JRules and WebSphere Business Events (CVE-2014-6506, CVE-2014-6511, CVE-2014-6457, CVE-2014-6558, CVE-2014-3065) *** --------------------------------------------- There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 6 and 7 that is used by IBM Operational Decision Manager (ODM), IBM ILOG JRules and IBM WebSphere Business Events (WBE). These issues were disclosed as part of the IBM... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21693686 *** DFN-CERT-2015-0012 - Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Use-after-Free-Schwachstelle in Xen ermöglicht einem lokalen, nicht authentifizierten Angreifer Denial-of-Service-Angriffe durchzuführen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0012/ *** DFN-CERT-2015-0013 - Exiv2: Eine Schwachstelle ermöglicht Denial-of-Service-Angriffe *** --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann durch einen langen 'IKEY INFO Tag' Wert in einer AVI-Datei einen Absturz der Anwendung verursachen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0013/ *** ZDI-15-006: ManageEngine Desktop Central MSP StatusUpdateServlet fileName File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-006/

1 0

Tageszusammenfassung - Montag 5-01-2015
by Daily end-of-shift report 05 Jan '15

05 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-01-2015 18:00 − Montag 05-01-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Before you enable those macros... *** --------------------------------------------- The Microsoft Malware Protection Center (MMPC) has recently seen an increasing number of threats using macros to spread their malicious code. This technique uses spam emails and social engineering to infect a system. Using macros in Microsoft Office can help increase productivity by automating some processes. However, malware authors have also exploited these capabilities. Since Microsoft set the default setting to "Disable all macros with notification", the number of macro-related... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/01/02/before-you-enable-those-… *** OpenSSL Cookbook *** --------------------------------------------- A short book that covers the most frequently used OpenSSL features and commands, by Ivan Ristić. OpenSSL Cookbook is a free ebook built around one chapter from Bulletproof SSL and TLS, a larger work that teaches how to deploy secure servers and web applications. --------------------------------------------- https://www.feistyduck.com/books/openssl-cookbook/ *** Defensible network architecture, (Mon, Jan 5th) *** --------------------------------------------- For the nearly 20 years since Zwicky, Cooper and Chapman first wrote about Firewalls the firewall has been the primary defense mechanism of nearly every entity attached to the Internet. While perimeter protection is still important in the modern enterprise, the fact is that the nature of Internet business has vastly changed and the crunchy perimeter and squishy inside approach has long since become outdated. You can two aspects of your business model that you cannot do without and which can give... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19141&rss *** Snooker WPA secrets with this WiFi tool *** --------------------------------------------- Jammed and canned Crypto geek George Chatzisofroniou has published a WiFi social engineering tool used to steal credentials and credit cards from users of secure wireless networks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/01/05/snooker_wpa… *** Hard disk hacking *** --------------------------------------------- ... Research like this has been done before for various bits of hardware: from PCI extension cards to embedded controllers in laptops to even Apple keyboards. Usually the research has been done in order to prove the hackability of these devices can lead to compromised software, so I decided to take the same approach: for this hack, I wanted to make a hard disk that could bypass software security. --------------------------------------------- http://spritesmods.com/?art=hddhack&page=1 *** Sicherheitslücke: Bitcoinbörse Bitstamp stellt vorerst Betrieb ein *** --------------------------------------------- Schon wieder eine Bitcoinbörse gehackt? Der Anbieter Bitstamp ist wegen einer kompromittierten Wallet fürs erste offline gegangen. Nutzer sollten keinesfalls Coins auf alte Einzahladressen überweisen. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-Bitcoinboerse-Bitsta… *** Several Electronic Arts Origin accounts hacked *** --------------------------------------------- Many gamers are finding purchases that they never made their accounts for Electronic Arts Origin service. Once again the gaming industry under attack. --------------------------------------------- http://securityaffairs.co/wordpress/31799/cyber-crime/electronic-arts-origi… *** Active Directory Recycle Bin: What is it, and how can I use it? *** --------------------------------------------- Remember the Windows 95 Recycle Bin? It was a big leap forward to recovering "deleted" files. Well, it turns out that Active Directory has it's own Recycle Bin for users, groups and computers, and it's called... wait for it.. the Active Directory Recycle Bin. Here's the good news about the Active Directory Recycle bin:... --------------------------------------------- http://blog.beyondtrust.com/active-directory-recycle-bin-what-is-it-and-how… *** Openwall 3.1 Released With Fixes for Shellshock, POODLE Attack *** --------------------------------------------- The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact Linux distribution for servers, appliances and... --------------------------------------------- http://threatpost.com/openwall-3-1-released-with-fixes-for-shellshock-poodl… *** ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution *** --------------------------------------------- Topic: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution Risk: High Text:#!/usr/bin/env python3 # Exploit Title: ASUSWRT 3.0.0.4.376_1071 LAN Backdoor Command Execution # Date: 2014-10-11 # Vend... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015010009 *** USN-2450-1: strongSwan vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2450-15th January, 2015 | strongswan vulnerability | A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.10 Ubuntu 14.04 LTS | Summary | strongSwan could be made to crash or run programs if it received specially crafted network traffic. | Software description | strongswan - IPsec VPN solution | Details | Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2payloads that contained the Diffie-Hellman group 1025. A remote attackercould use this... --------------------------------------------- http://www.ubuntu.com/usn/usn-2450-1/ *** VU#976132: Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script *** --------------------------------------------- Vulnerability Note VU#976132 Some UEFI systems do not properly secure the EFI S3 Resume Boot Path boot script Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview Some UEFI systems fail to properly restrict access to the boot script used by the EFI S3 Resume Boot Path, allowing an authenticated, local attacker to bypass various firmware write protections. Description According to Rafal Wojtczuk and Corey Kallenberg of The MITRE Corporation:"During the UEFI S3 Resume... --------------------------------------------- http://www.kb.cert.org/vuls/id/976132 *** VU#766164: Intel BIOS locking mechanism contains race condition that enables write protection bypass *** --------------------------------------------- Vulnerability Note VU#766164 Intel BIOS locking mechanism contains race condition that enables write protection bypass Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview A race condition exists in Intel chipsets that rely solely on the BIOS_CNTL.BIOSWE and BIOS_CNTL.BLE bits as a BIOS write locking mechanism. Successful exploitation of this vulnerability may result in a bypass of this locking mechanism. Description CWE-362: Concurrent Execution using Shared Resource with... --------------------------------------------- http://www.kb.cert.org/vuls/id/766164 *** VU#533140: UEFI EDK1 vulnerable to buffer overflow *** --------------------------------------------- Vulnerability Note VU#533140 UEFI EDK1 vulnerable to buffer overflow Original Release date: 05 Jan 2015 | Last revised: 05 Jan 2015 Overview The EDK1 UEFI reference implementation contains a buffer overflow vulnerability. Description The open source EDK1 project provides a reference implementation of the Unified Extensible Firmware Interface (UEFI). Commercial UEFI implementations may incorporate portions of the EDK1 source code.According to Rafal Wojtczuk and Corey Kallenberg, a buffer... --------------------------------------------- http://www.kb.cert.org/vuls/id/533140

1 0

Tageszusammenfassung - Freitag 2-01-2015
by Daily end-of-shift report 02 Jan '15

02 Jan '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-12-2014 18:00 − Freitag 02-01-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Miss a talk from the 31st CCC this year? No worries - theyre all already available online. (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qvuog/miss_a_talk_from_the_31st_cc… *** Wordpress 4.1 XSS & CSRF Web Vulnerability *** --------------------------------------------- The Hackyard Security Group Researcher-Team leaded by 0x0A discovered a cross site request forgery issue and a cross site vulnerability in the Wordpress 4.1 --------------------------------------------- http://cxsecurity.com/issue/WLB-2014120203 *** Log Analysis for Web Attacks: A Beginner's Guide *** --------------------------------------------- It is often the case that web applications face suspicious activities due to various reasons, such as a kid scanning a website using an automated vulnerability scanner or a person trying to fuzz a parameter for SQL Injection, etc. In many such cases, logs on the webserver have to the webserver have to be analyzed to figure out what is going on. If it is a serious case, it may require a forensic investigation. Apart from this, there are other scenarios as well. --------------------------------------------- http://resources.infosecinstitute.com/log-analysis-web-attacks-beginners-gu… *** Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability *** --------------------------------------------- An anonymous reader writes "Googles security research database has after a 90 day timeout automatically undisclosed a Windows 8.1 vulnerability which Microsoft hasnt yet patched. By design the system call NtApphelpCacheControl() in ahcache.sys allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Q5qBW3crGPY/story01.htm *** 2014 Website Defacements *** --------------------------------------------- Defacements are the most visual and obvious hack that a website can suffer from. They also come parcelled with their own exquisite sense of dread. Nothing gives that gut-wrenching feeling of "I've been hacked" more than seeing this: Most malware that we see on a daily basis is driven by some desire to profit offRead More --------------------------------------------- http://blog.sucuri.net/2015/01/website-hacks-defacements-2014.html *** Spamhaus Botnet Summary 2014 *** --------------------------------------------- As 2014 ends, Spamhaus reviews the botnet threats that it detected in the past year, and provides facts and useful suggestions for ISPs and web hosts on the front lines of the battle against cybercrime. To nobodys surprise, botnet activity appears to be increasing. The majority of detected botnets are targeted at obtaining and exploiting banking and financial information. Botnet controllers (C&Cs) are hosted disproportionately on ISPs with understaffed abuse departments, inadequate abuse --------------------------------------------- http://www.spamhaus.org/news/article/720/spamhaus-botnet-summary-2014 *** Phil Zimmerman (PGP), Ladar Levison (Lavabit), & Team release Secure Email Protocol DIME *** --------------------------------------------- Full specs here: https://darkmail.info/downloads/dark-internet-mail-environment-december-201… (PDF) Full source code (libraries) here: https://github.com/lavabit/ Website: http://darkmail.info/ --------------------------------------------- http://www.reddit.com/r/netsec/comments/2qu2er/phil_zimmerman_pgp_ladar_lev… *** Trojan-horse hardware - a student prank demonstrates how easy it is to substitute a PIC for a dumb logic chip (Reddit) *** --------------------------------------------- http://www.reddit.com/r/netsec/comments/2r3cfs/trojanhorse_hardware_a_stude… *** Introduction to RFID Security *** --------------------------------------------- The main problem with RFID is related to its frequency. Someone with specific tools and enough knowledge on RFID (including complete documentation) could analyze the working frequency of an RFID tag and then decode the data or perform an attack such as cloning the RFID or doing a Denial-of-Service attack. --------------------------------------------- http://resources.infosecinstitute.com/introduction-rfid-security/ *** Hackers claim theyve found a frighteningly easy way to hack your iCloud account (Yahoo Security) *** --------------------------------------------- ... a hacker known as Pr0x13 has released a tool called iDict on GitHub that is capable of bypassing restrictions and authentication on any iCloud account, potentially giving hackers unfettered access to iOS devices. --------------------------------------------- http://news.yahoo.com/hackers-claim-ve-found-frighteningly-easy-way-hack-15…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily January 2015