Daily November 2015

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - Montag 16-11-2015
by Daily end-of-shift report 16 Nov '15

16 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-11-2015 18:00 − Montag 16-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** BitLocker encryption can be defeated with trivial Windows authentication bypass *** --------------------------------------------- Companies relying on Microsoft BitLocker to encrypt the drives of their employees computers should install the latest Windows patches immediately. A researcher disclosed a trivial Windows authentication bypass, fixed earlier this week, that puts data on BitLocker-encrypted drives at risk.Ian Haken, a researcher with software security testing firm Synopsys, demonstrated the attack Friday at the Black Hat Europe security conference in Amsterdam. The issue affects Windows computers that are part... --------------------------------------------- http://www.cio.com/article/3005178/bitlocker-encryption-can-be-defeated-wit… *** The November 2015 issue of our SWITCH Security Report is available! *** --------------------------------------------- Dear Reader! A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: No safe harbour in the Land of the Free - EU Court of Justice restricts data transfer to... --------------------------------------------- http://securityblog.switch.ch/2015/11/13/the-november-2015-issue-of-our-swi… *** Websicherheit: Datenleck durch dynamische Skripte *** --------------------------------------------- Moderne Webseiten erstellen häufig dynamischen Javascript-Code. Wenn darin private Daten enthalten sind, können fremde Webseiten diese auslesen. Bei einer Untersuchung von Sicherheitsforschern war ein Drittel der untersuchten Webseiten von diesem Problem betroffen. --------------------------------------------- http://www.golem.de/news/websicherheit-datenleck-durch-dynamische-skripte-1… *** Op-ed: (How) did they break Diffie-Hellman? *** --------------------------------------------- Relax - its not true that researchers have broken the Diffie-Hellman key exchange protocol. --------------------------------------------- http://arstechnica.com/security/2015/11/op-ed-how-did-they-break-diffie-hel… *** More POS malware, just in time for Christmas *** --------------------------------------------- VXers stuff evidence-purging malware in retailer stockings. Threat researchers are warning of two pieces of point of sales malware that have gone largely undetected during years of retail wrecking and now appear likely to earn VXers a haul over the coming festive break. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/16/more_pos_ma… *** Black Hat Europe 2015 slides *** --------------------------------------------- briefings - november 12-13 --------------------------------------------- https://www.blackhat.com/eu-15/briefings.html *** Choosing the Right Cryptography Library for your PHP Project: A Guide *** --------------------------------------------- ... conventional wisdom states that you almost certainly should not try to design your own cryptography. Instead, you should use an existing cryptography library. Okay, great. So which PHP cryptography library should I use? That depends on your exact requirements. Lets look at some good choices. (We wont cover any terrible choices.) --------------------------------------------- https://paragonie.com/blog/2015/11/choosing-right-cryptography-library-for-… *** Apple OS X authentication issue when recovering from sleep mode *** --------------------------------------------- When Apple Remote Desktop is used in full screen mode and the remote connection is alive upon entering sleep mode, the text entered in the dialog box upon recovering from sleep mode is sent to the remotely connected host instead of the local host. This may result in command execution at the remote host. --------------------------------------------- http://jvn.jp/en/jp/JVN56210048/index.html *** Programmbibliothek libpng verlangt nach Sicherheitsupdates *** --------------------------------------------- Eine Schwachstelle in libpng kann als Einfallstor für Angreifer dienen, um Anwendungen zum Absturz zu bringen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Programmbibliothek-libpng-verlangt-n… *** Container: CoreOS gibt CVE-Service als Open Source frei *** --------------------------------------------- Der Linux-Distributor CoreOS hat sein Container-Security-Werkzeug Clair als Open-Source-Software freigegeben. Das Tool ist in der Lage, jede einzelne Containerschicht nach Schwachstellen zu durchforsten und im Falle eines Fundes eine Meldung über die Art der Bedrohung zu übermitteln. Hierfür greift Clair auf die CVE-Datenbank (Common Vulnerabilities and Exposures) und ähnliche Ressourcen von Red Hat, Ubuntu, und Debian zurück. Clair hilft allerdings nicht, die... --------------------------------------------- http://www.heise.de/newsticker/meldung/Container-CoreOS-gibt-CVE-Service-al… *** LiME - Linux Memory Extractor *** --------------------------------------------- Features Full Android memory acquisition Acquisition over network interface Minimal process footprint --------------------------------------------- http://www.kitploit.com/2015/11/lime-linux-memory-extractor.html *** DD4BC / Armada Collective: Erpressung mittels DDoS *** --------------------------------------------- DD4BC / Armada Collective: Erpressung mittels DDoS16. November 2015Das ist mal wieder nichts wirklich Neues. Distributed Denial of Service Angriffe gibt es schon lange, das mag mit Turf-Fights in der Rotlicht-Szene angefangen haben, der Angriff auf Estland 2007 hat das Thema groß in die Presse gebracht, und spätestens seit den Angriffen der "Anonymous"-Bewegung sollte das Problem allgemein bekannt sein. Dazu gibt es auch einen Abschnitt in unserem letzten... --------------------------------------------- http://www.cert.at/services/blog/20151116114639-1627.html *** BlackBerry Enterprise Server Input Validation Flaw in Management Console Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1034154 *** D-link wireless router DIR-816L Cross-Site Request Forgery (CSRF) vulnerability *** --------------------------------------------- Cross-Site Request Forgery (CSRF) vulnerability in the DIR-816L wireless router enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated. --------------------------------------------- http://www.securityfocus.com/archive/1/536886 *** Debian: strongswan security update *** --------------------------------------------- Tobias Brunner found an authentication bypass vulnerability in strongSwan, an IKE/IPsec suite. Due to insufficient validation of its local state the server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin can be tricked into successfully concluding the authentication without providing valid credentials. --------------------------------------------- https://lists.debian.org/debian-security-announce/2015/msg00303.html *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Videoscape Distribution Suite Service Manager Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS Software Virtual PPP Interfaces Security Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco FireSIGHT Management Center Certificate Validation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Prime Collaboration Assurance Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** Apache Commons Vulnerability for handling Java object deserialization *** http://www.ibm.com/support/docview.wss?uid=swg21970575 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in GSKit affects IBM DataPower Gateways (CVE-2015-1788) *** http://www.ibm.com/support/docview.wss?uid=swg21969271 --------------------------------------------- *** IBM Security Bulletin: Certain cookies missing Secure attribute in IBM DataPower Gateways (CVE-2015-7427) *** http://www.ibm.com/support/docview.wss?uid=swg21969342 --------------------------------------------- *** Security Bulletin: Vulnerabilities in OpenSSL affect IBM System Networking RackSwitch (CVE-2015-1788, CVE-2015-1789, CVE-2015-1792) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098801 --------------------------------------------- *** IBM Security Bulletin: IBM Cúram Social Program Management contains an Apache Batik Vulnerability (CVE-2015-0250) *** http://www.ibm.com/support/docview.wss?uid=swg21970112 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Edition *** http://www.ibm.com/support/docview.wss?uid=swg21969225 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in qemu-kvm affects IBM SmartCloud Provisioning for IBM Software Virtual Appliance *** http://www.ibm.com/support/docview.wss?uid=swg21968929 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in FUSE affects PowerKVM (CVE-2015-3202) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022878 --------------------------------------------- *** IBM Security Bulletin: Lotus Protector for Mail Security affected by Opensource PHP Vulnerabilities (CVE-2015-6836 CVE-2015-6837 CVE-2015-6838) *** http://www.ibm.com/support/docview.wss?uid=swg21968353 --------------------------------------------- *** IBM Security Bulletin: GPFS security vulnerabilities in IBM SONAS (CVE-2015-4974 and CVE-2015-4981) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005425 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Mozilla gdk-pixbuf2 affects PowerKVM (CVE-2015-4491) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022833 --------------------------------------------- *** Vulnerability in bind affects AIX (CVE-2015-5722) *** http://www.ibm.com/support/ ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 13-11-2015
by Daily end-of-shift report 13 Nov '15

13 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-11-2015 18:00 − Freitag 13-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Using Facebook to log in - safe or not? *** --------------------------------------------- Open up your favorite web site and you can see what this is about right away. There are in many cases two options, an ordinary log-in and "Log in with Facebook". Have you been using the Facebook option? It is quite convenient, isn't it? I was talking to a journalist about privacy a while ago... --------------------------------------------- http://safeandsavvy.f-secure.com/2015/11/12/using-facebook-to-log-in-safe-o… *** MIG Mozilla InvestiGator *** --------------------------------------------- Search through your infrastructure in real-time from the command line --------------------------------------------- https://jve.linuxwall.info/ressources/taf/LISA15/ *** ZipInputStream Armageddon *** --------------------------------------------- Again, again, again .. and again these bugs are turning up because of the general lack of validation occurring on the ZIP contents. In most cases this is probably due to the fact that developers are making assumptions that these ZIP files are not being tampered with, and therefore dont really consider the ramifications. --------------------------------------------- http://rotlogix.com/2015/11/12/zipinputstream-armageddon/ *** botfrei.de: Werbeblocker-Sanktionen "der falsche Weg" *** --------------------------------------------- Das "Anti-Botnet Beratungszentrums" botfrei.de und der Betreiber, der eco Verband der Internetwirtschaft, halten Online-Werbung für wichtig. Sanktionen gegen Werbeblocker würden aber wichtige Nutzerinteressen unberücksichtigt lassen. --------------------------------------------- http://heise.de/-2920022 *** One BadBarcode Spoils Whole Bunch *** --------------------------------------------- At PacSec 2015, researchers demonstrated attacks using poisoned barcodes scanned by numerous keyboard wedge barcode scanners to open a shell on a machine and virtually type control commands. --------------------------------------------- http://threatpost.com/one-badbarcode-spoils-whole-bunch/115362/ *** Google Reconnaissance, Sprinter-style, (Fri, Nov 13th) *** --------------------------------------------- When doing security assessments or penetration tests, theres a significant amount of findings that you can get from search engines. For instance, if a client has sensitive information or any number of common vulnerabilities, you can often find those with a Google or Bing search, without sending a single packet to the clients infrastructure. This concept is called google dorking, and was pioneered by Johnny Long back in the day (he has since moved on to other projects see... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20375&rss *** Researchers Discover Two New Strains of POS Malware *** --------------------------------------------- Two new and different strains of point of sale malware have come to light, including one that's gone largely undetected for the past five years. --------------------------------------------- http://threatpost.com/researchers-discover-two-new-strains-of-pos-malware/1… *** Spring Social Core Vulnerability Disclosure *** --------------------------------------------- Today we would like to announce the discovery of a vulnerability in the Spring Social Core library. Spring Social provides Java bindings to popular service provider APIs like GitHub, Facebook, Twitter, etc., and is widely used by developers. All current versions (1.0.0.RELEASE to 1.1.2.RELEASE) of the library are affected by this vulnerability. --------------------------------------------- https://blog.srcclr.com/spring-social-core-vulnerability-disclosure/ *** Unitronics VisiLogic OPLC IDE Vulnerabilities *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on November 3, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in Unitronics VisiLogic OPLC IDE. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-274-02 *** Security Advisory - App Validity Check Bypass Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Notice - Statement on Black Hat Europe 2015 Revealing Security Vulnerability in Huawei P7 Smart Phone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DFN-CERT-2015-1761: Jenkins: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1761/ *** Cisco AnyConnect Secure Mobility Client Arbitrary File Move Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Tunnel Interfaces Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Aironet 1800 Series Access Point SSHv2 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Donnerstag 12-11-2015
by Daily end-of-shift report 12 Nov '15

12 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-11-2015 18:00 − Donnerstag 12-11-2015 18:01 Handler: Robert Waldner Co-Handler: Stephan Richter *** Distributed Vulnerability Search - Told via Access Logs *** --------------------------------------------- Sometimes just a few lines of access logs can tell a whole story: Many ongoing attacks against WordPress and Joomla sites use a collection of known vulnerabilities in many different plugins, themes and components. This helps hackers maximize the number of sites they can compromise. Google Dorks Do you ever think about how hackers find... --------------------------------------------- https://blog.sucuri.net/2015/11/distributed-vulnerability-search-told-via-a… *** Latest Android phones hijacked with tidy one-stop-Chrome-pop *** --------------------------------------------- Chinese researcher burns exploit for ski trip. PacSec: Googles Chrome for Android has been popped in a single exploit that could lead to the compromise of any handset. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/mobile_pwn2… *** Samsung S6 calls open to man-in-the-middle base station snooping *** --------------------------------------------- Their cheap man-in-the-middle attack requires an OpenBTS base station to be established and located near target handsets. Handsets will automatically connect to the bogus station. The malicious base station then pushes firmware to the phones baseband processor (the chip that handles voice calls, and which isnt directly accessible to end users). ... The Register would speculate that since the Qualcomm silicon in question isnt unique to Samsung kit, other researchers are probably setting to work... --------------------------------------------- http://www.theregister.co.uk/2015/11/12/mobile_pwn2own1/ *** Geschäftsgeheimnisse: Sicherheitsforscher warnt vor TTIP *** --------------------------------------------- Das Freihandelsabkommmen TTIP hat eine weitere Gegnergruppe: IT-Sicherheitsforscher. Das jedenfalls sagt René Pfeiffer, Organisator der Deepsec in Wien. Er fürchtet, dass Informationen über Sicherheitsrisiken damit noch stärker unterbunden werden. --------------------------------------------- http://www.golem.de/news/geschaeftsgeheimnisse-sicherheitsforscher-warnt-vo… *** Outlook-Probleme: Microsoft fixt Sicherheits-Update für Windows *** --------------------------------------------- Microsoft hat ein fehlerhaftes Update zurückgezogen und durch eine gefixte Version ersetzt. Nach der Installation soll Outlook nicht mehr abstürzen. Doch es gibt noch weitere Probleme. --------------------------------------------- http://heise.de/-2919456 *** Pentesting SAP Applications : An Introduction *** --------------------------------------------- Introduction to SAP SAP (Systems-Applications-Products) is a software suite that offers standard business solutions; it is used by thousands of customers across the globe to manage their business. In other words, SAP systems provide the capability to manage financial, asset, and cost accounting, production operations and materials, personnel and many more tasks. Before we jump... --------------------------------------------- http://resources.infosecinstitute.com/pen-stesting-sap-applications-part-1/ *** EMV Protocol Fuzzer *** --------------------------------------------- The world-wide introduction of the Europay, MasterCard and Visa standard (EMV), to facilitate communication between smartcards and EMV-enabled devices, such as point-of-sale (POS) terminals and automatic teller machines (ATMs), has altered the security landscape of the daily markets. Surprisingly limited public research exists addressing security aspects of hardware and software specific implementations. This is something we wanted to put right and therefore started a new research programme to... --------------------------------------------- https://labs.mwrinfosecurity.com/blog/2015/11/11/emv-protocol-fuzzer/ *** Got a time machine? Good, you can brute-force 2FA *** --------------------------------------------- Security researcher Gabor Szathmari says the problem is that if your 2FA tokens depend on the network time protocol (NTP), its too easy for a sysadmin to put together an attackable implementation. As he explains in two posts.., if an attacker can trick NTP, they can mount a brute-force attack against the security tokens produced by Google Authenticator (the example in the POC) and a bunch of other Time-based One-time Password Algorithm-based (TOTP) 2FA mechanisms. --------------------------------------------- http://www.theregister.co.uk/2015/11/12/got_a_time_machine_good_you_can_bru… *** Spam and phishing in Q3 2015 *** --------------------------------------------- The dating theme is typical for spam emails, but in the third quarter of 2015 we couldn't help but notice the sheer variety appearing in these types of mailings. We came across some rather interesting attempts to deceive recipients and to bypass filters, as well as new types of spam mailings that were bordering on fraud. --------------------------------------------- https://securelist.com/analysis/quarterly-spam-reports/72724/spam-and-phish… *** Oracle WebLogic Server: CVE-2015-4852 patched, (Thu, Nov 12th) *** --------------------------------------------- Lost in the hoopla around Microsoft and Adobe patch Tuesday was a critical patch released by Oracle which addressed CVE-2015-4852. CVE-2105-4852is a critical vulnerability in Apache Commons which affects Oracle WebLogic Server. This vulnerability permits remote exploitation without authentication and should be patchedas soon as practical. More information can be found at the Oracle Blog. -- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ -... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20369&rss *** Cisco Cloud Web Security DNS Hijack, (Thu, Nov 12th) *** --------------------------------------------- We have received a report that a domain critical in delivering the Cisco Cloud Web Security product had for a while earlier today been hijacked. The report indicates thatthe DNS entrys forscansafe.net were hijacked and pointed to 208.91.197.132, a site which both VirusTotal and Web of Trust indicate has a reputation for delivering malware.">Guidance that has been provided to customers is that the issue has been resolved but that the TTL on the DNS entries are 48 hours so it will take a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20371&rss *** Volatility 2.5 released *** --------------------------------------------- This is the first release since the publication of The Art of Memory Forensics! It adds support for Windows 10 (initial), Linux kernels 4.2.3, and Mac OS X El Capitan. Additionally, the unified output rendering gives users the flexibility of asking for results in various formats (html, sqlite, json, xlsx, dot, text, etc.) while simplifying things for plugin developers. In short, less code... --------------------------------------------- http://www.volatilityfoundation.org/?_escaped_fragment_=25/c1f29 *** Die Apache Software Foundation zu dem Java Commons Collection/Java (De)Serialization Problem *** --------------------------------------------- Die Apache Software Foundation zu dem Java Commons Collection/Java (De)Serialization Problem12. November 2015Die Apache Software Foundation hat dazu einen ausführlichen Blog-Post verfasst. Die Money Quote daraus: "Even when the classes implementing a certain functionality cannot be blamed for this vulnerability, and fixing the known cases will also not make the usage of serialization in an untrusted context safe, there is still demand to fix at least the known cases, even when this... --------------------------------------------- http://www.cert.at/services/blog/20151112140918-1625.html *** R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities *** --------------------------------------------- The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Stored cross-site scripting vulnerabilitity was also discovered. The issue is triggered when input passed via multiple POST parameters is not properly sanitized before being returned to the user. This can be exploited to execute... --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5274.php *** Cisco FireSight Management Center Web Framework Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Google Picasa CAMF Section Integer Overflow Vulnerability *** --------------------------------------------- 2) Severity Rating: Highly critical Impact: System Access Where: From remote ... 4) Solution Update to version 3.9.140 Build 259. --------------------------------------------- http://www.securityfocus.com/archive/1/536878 *** Citrix XenServer Security Update for CVE-2015-5307 and CVE-2015-8104 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to crash the host. This vulnerability affects all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1. --------------------------------------------- http://support.citrix.com/article/CTX202583 *** Security Notice - Statement on Security Researchers Revealing a Security Vulnerability in Huawei HG630a&HG630a-50 on Packet Storm Website *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 11-11-2015
by Daily end-of-shift report 11 Nov '15

11 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-11-2015 18:00 − Mittwoch 11-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** November 2015 Security Update Release Summary *** --------------------------------------------- Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month's security updates and advisories can be found in the Security TechNet Library. MSRC Team --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/11/10/november-2015-security-u… *** MSRT November 2015: Detection updates *** --------------------------------------------- The Microsoft Malicious Software Removal Tool (MSRT) is updated monthly with new malware detections - so far this year we have added 29 malware families. This month we are updating our detections for some of the malware families already included in the tool. We choose the malware families we add to the MSRT each month using several criteria. One of the most common reasons is the prevalence of a family in the malware ecosystem. For example, in recent months we focused on... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/11/10/msrt-november-2015-detec… *** Patchday: Adobe pflegt den Flash-Patienten *** --------------------------------------------- Flash liegt mal wieder auf dem OP-Tisch und wird geflickt. Nutzer sollten ihren Flash-Patienten zügig behandeln, denn die Lücken gelten als kritisch. Exploits sollen aber noch nicht kursieren. --------------------------------------------- http://www.heise.de/newsticker/meldung/Patchday-Adobe-pflegt-den-Flash-Pati… *** What You Should Know about Triangulation Fraud and eBay *** --------------------------------------------- The increasing phenomenon of triangulation fraud on eBay has led to a published analysis on behalf of the company, as to how buyers should get informed and what they should pay attention to. Over the past few months, a new phenomenon has risen and its proportions have been growing exponentially. It seems that, even if... --------------------------------------------- http://securityaffairs.co/wordpress/41891/cyber-crime/triangulation-fraud-a… *** Symantec Endpoint Protection: Alte Sicherheitslücke bricht wieder auf *** --------------------------------------------- Eine totgeglaubte Schwachstelle ist wieder da, da ein älterer Patch nur Teile des Problems angegangen ist. Das aktuelle Update für Symantecs Endpoint Protection soll es nun richten und noch weitere Schwachstellen abdichten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Symantec-Endpoint-Protection-Alte-Si… *** What Happens to Hacked Social Media Accounts *** --------------------------------------------- This article is going to look at a few reasons why a social media account is hacked. The goal is for you to understand why you will want to better protect your account, regardless of whether or not you see yourself as "important". --------------------------------------------- http://www.tripwire.com/state-of-security/security-awareness/what-happens-t… *** InstaAgent: Passwort-sammelnder Instagram-Client fliegt aus App Store und Google Play *** --------------------------------------------- Die App, die Nutzern verschiedene Zusatzinformationen zu ihrem Profil bei Facebooks populärem Foto-Dienst verspricht, sendete offenbar Instagram-Benutzernamen und Passwort im Klartext an einen Dritt-Server. --------------------------------------------- http://heise.de/-2917792 *** GasPot Integrated Into Conpot, Contributing to Open Source ICS Research *** --------------------------------------------- In August of this year, we presented at Blackhat our paper titled The GasPot Experiment: Unexamined Perils in Using Gas-Tank-Monitoring Systems. GasPot was a honeypot designed to mimic the behavior of the Guardian AST gas-tank-monitoring system. It was designed to look like no other existing honeypot, with each instance being unique to make fingerprinting by attackers impossible. These were deployed within networks located in various countries, to give us a complete picture of the attacks... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/4jNwbTj60bk/ *** Questions are the answeres - How to avoid becoming the blamed victim *** --------------------------------------------- "You have to ask questions", I say. Questions before, during, and after a breach. If you ask the right questions at the right time, you'll be able to make better decisions than the knee-jerk ones you've been making. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/questions-are-the-answ… *** TA15-314A: Web Shells - Threat Awareness and Guidance *** --------------------------------------------- Original release date: November 10, 2015 Systems Affected Web servers that allow web shells Overview This alert describes the frequent use of web shells as an exploitation vector. Web shells can be used to obtain unauthorized access and can lead to wider network compromise. This alert outlines the threat and provides prevention, detection, and mitigation strategies.Consistent use of web shells by Advanced Persistent Threat (APT) and criminal groups has led to significant cyber incidents.This... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-313A *** Bugtraq: [security bulletin] HPSBGN03507 rev.2 - HP Arcsight Management Center, Arcsight Logger, Remote Cross-Site Scripting (XSS) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536877 *** Huawei HG630a / HG630a-50 Default SSH Admin Password *** --------------------------------------------- Topic: Huawei HG630a / HG630a-50 Default SSH Admin Password Risk: High Text:# Exploit Title: Huawei HG630a and HG630a-50 Default SSH Admin Password on Adsl Modems # Date: 10.11.2015 # Exploit Author: M... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110087 *** Huawei Security Advisories *** --------------------------------------------- *** Security Advisory - Input Validation Vulnerability in Huawei VP9660 Products *** http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… --------------------------------------------- *** Security Advisory - Directory Traversal Vulnerability in Huawei AR Router *** http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… --------------------------------------------- *** Security Advisory - DoS Vulnerability in Huawei U2990 and U2980 *** http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… --------------------------------------------- *** Security Advisory - DoS Vulnerability in Huawei eSpace 8950 IP Phone *** http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… --------------------------------------------- *** Security Advisory - DoS Vulnerability in Huawei eSpace 7900 IP Phone *** http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… --------------------------------------------- *** ZDI-15-549: AlienVault Unified Security Management av-forward Deserialization of Untrusted Data Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/eDK-If3dTI8/ *** ZDI-15-548: AlienVault Unified Security Management Local Privilege Escalation Vulnerability *** --------------------------------------------- This vulnerability allows local attackers to escalate privileges to root on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/TpChWMSd5n0/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM FileNet eForms is affected by vulnerabilities in Apache HttpComponents(CVE-2012-6153 and CVE-2014-3577) *** http://www.ibm.com/support/docview.wss?uid=swg21962659 --------------------------------------------- *** IBM Security Bulletin: IBM Forms Server could be affected by a denial of service attack (CVE-2013-4517) *** http://www.ibm.com/support/docview.wss?uid=swg21962659 --------------------------------------------- *** IBM Security Bulletin: Fix Available for Denial of Service Vulnerability in IBM WebSphere Portal (CVE-2015-7419) *** http://www.ibm.com/support/docview.wss?uid=swg21969906 --------------------------------------------- *** IBM Security Bulletin: Additional Password Disclosure via application tracing in FlashCopy Manager on Windows, Data Protection for Exchange, and Data Protection for SQL CVE-2015-7404 *** http://www.ibm.com/support/docview.wss?uid=swg21969514 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in libuser affect Power Hardware Management Console (CVE-2015-3245 CVE-2015-3246) *** http://www.ibm.com/support/docview.wss?uid=nas8N1020961 --------------------------------------------- *** IBM Security Bulletin: IBM Cúram Social Program Management is vulnerable to a SQL injection attack *** http://www.ibm.com/support/docview.wss?uid=swg21967851 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Content Collector and IBM CommonStore for Lotus Domino (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21969654 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM WebSphere MQ *** http://www.ibm.com/support/docview.wss?uid=swg21970103 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Expeditor (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21959292 --------------------------------------------- *** Security Bulletin: Multiple vulnerabilities in IBM Java SDK 7 affect IBM Systems Director Storage Control *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098822 --------------------------------------------- *** IBM Security Bulletin: IBM FileNet eForms is affected by vulnerabilities in Apache HttpComponents(CVE-2012-6153 and CVE-2014-3577) *** http://www.ibm.com/support/docview.wss?uid=swg21970090 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 10-11-2015
by Daily end-of-shift report 10 Nov '15

10 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-11-2015 18:00 − Dienstag 10-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** The Internet of Bad Things, Observed *** --------------------------------------------- In his VB2015 keynote address, Ross Anderson described attacks against EMV cards.The VB2015 opening keynote by Ross Anderson could hardly have been more timely. In his talk "The Internet of Bad Things, Observed", the Cambridge professor looked at various attacks against the EMV standard for payment cards - attacks that have been used to steal real money from real people.Such cards, often called chip-and-PIN or chip-and-signature, are generally seen as better protected against... --------------------------------------------- http://www.virusbtn.com/blog/2015/11_10.xml?rss *** Linux.Encoder.1: Ransomware greift Magento-Nutzer an *** --------------------------------------------- Eine Malware für Linux verschlüsselt zurzeit die Daten von Nutzern des Magento-Shopsystems. Für die Entschlüsselung sollen die Opfer zahlen, doch die Angreifer haben geschlampt: Die Verschlüsselung lässt sich knacken. --------------------------------------------- http://www.golem.de/news/linux-encoder-1-ransomware-greift-magento-nutzer-a… *** Comodo fixes bug, revokes banned certificates *** --------------------------------------------- After reporting last week that it had issued banned certificates that could facilitate man in the middle (MitM) attacks, Comodo has fixed the "subtle bug" that the companys Senior Research and Development Scientist Rob Stradling wrote prompted the problem. --------------------------------------------- http://www.scmagazine.com/comodo-fixes-bug-revokes-banned-certificates/arti… *** Proof-of-concept threat is reminder OS X is not immune to crypto ransomware *** --------------------------------------------- Symantec analysis confirms that in the wrong hands, Mabouia ransomware could be used to attack Macs. Twitter Card Style: summary Analysis by Symantec has confirmed that the proof-of-concept (PoC) threat known as Mabouia works as described and could be used to create functional OS X crypto ransomware if it fell into the wrong hands.read more --------------------------------------------- http://www.symantec.com/connect/blogs/proof-concept-threat-reminder-os-x-no… *** Protecting Users and Enterprises from the Mobile Malware Threat, (Mon, Nov 9th) *** --------------------------------------------- With recent news of mobile malicious adware that roots smartphones, attention is again being paid to mobile security and the malware threat that is posed to it. While mobile ransomware is also a pervasive and growing threat, there are mobile RATs (such as JSocket and OmniRAT) that are also able to take full remote control of mobile devices. Some of the functionality of those tolls includes the ability to use the microphone to listen in on victims and to view whatever is in front of the camera... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20355&rss *** Cisco Connected Grid Network Management System Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Citrix XenServer Security Update for CVE-2015-5307 and CVE-2015-8104 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to crash the host. ... --------------------------------------------- http://support.citrix.com/article/CTX202583 *** PowerDNS Security Advisory 2015-03: Packet parsing bug can lead to crashes *** --------------------------------------------- A bug was found using afl-fuzz in our packet parsing code. This bug, when exploited, causes an assertion error and consequent termination of the the pdns_server process, causing a Denial of Service. ... PowerDNS Authoritative Server 3.4.4 - 3.4.6 are affected. No other versions are affected. The PowerDNS Recursor is not affected. --------------------------------------------- https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/

1 0

Tageszusammenfassung - Montag 9-11-2015
by Daily end-of-shift report 09 Nov '15

09 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-11-2015 18:00 − Montag 09-11-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** ICYMI: Widespread Unserialize Vulnerability in Java, (Mon, Nov 9th) *** --------------------------------------------- On Friday, a blog post from Fox Glove Security was posted that details a widespread Java unserialize vulnerability that affects all the major flavors of middleware (WebSphere, WebLogic, et al). There is a lot of great details, including exploitation instructions for pentesters, in the post so go take a look. It didnt get much press because admittedly its complicated to explain. It also doesnt have a logo. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20353&rss *** SSH-Client PuTTY 0.66 schließt Sicherheitslücke *** --------------------------------------------- Die neue Version des SSH- und Telnet-Clients bringt ein paar kleine Verbesserungen und Fehlerkorrekturen. Zudem wurde eine Sicherheitslücke geschlossen. --------------------------------------------- http://www.heise.de/newsticker/meldung/SSH-Client-PuTTY-0-66-schliesst-Sich… *** Gratis-WLAN: Welche Risiken es gibt und wie man sich schützt *** --------------------------------------------- Ein öffentliches Netzwerk ist praktisch, Nutzer sollten sich aber nicht blindlings einloggen --------------------------------------------- http://derstandard.at/2000025293625 *** Guide to application whitelisting *** --------------------------------------------- The National Institute of Standards and Technology (NIST) has published a guide to deploying automated application whitelisting to help thwart malicious software from gaining access to organizations' computer systems. --------------------------------------------- http://www.net-security.org/secworld.php?id=19079 *** Dangerous bugs leave open doors to SAP HANA systems *** --------------------------------------------- The most serious software flaws ever have been found in SAPs HANA platform, the in-memory database platform that underpins many of the German companys products used by large companies.Eight of the flaws are ranked critical, the highest severity rating ... --------------------------------------------- http://www.cio.com/article/3003054/dangerous-bugs-leave-open-doors-to-sap-h… *** Vbulletin 5.1.X Unserialize Preauth RCE Exploit *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110060 *** Ransomware meets CMS / Linux *** --------------------------------------------- Ransomware am PC gibt es schon seit Jahren: Die Malware sperrt/verschlüsselt den infizierten PC und verlangt Lösegeld dafür, damit der User weiterarbeiten kann.Dass schlecht gewartete Webseiten mit Joomla, Wordpress, Drupal & co ein Fressen für Hacker sind, ist auch nichts neues. Wir sehen regelmäßig Wellen an Defacements und Exploitpacks, wenn mal wieder jemand das Ausnutzen einer Web-Schwachstelle automatisiert. --------------------------------------------- http://www.cert.at/services/blog/20151109095947-1618.html *** Google AdWords API client libraries - XML eXternal Entity Injection (XXE) *** --------------------------------------------- Confirmed in googleads-php-lib <= 6.2.0 for PHP, AdWords libraries: googleads-java-lib for Java, and googleads-dotnet-lib for .NET are also likely to be affected. --------------------------------------------- http://legalhackers.com/advisories/Google-AdWords-API-libraries-XXE-Injecti… *** Closing the Open Door of Java Object Serialization *** --------------------------------------------- If you can communicate with a JVM using Java object serialization using java.io.ObjectInputStream, then you can send a class that can execute commands against the OS from inside of the readObject method, and thereby get shell access. Once you have shell access, you can modify the Java server however you feel like. This is a class of exploit called 'deserialization of untrusted data', aka CWE-502. It's a class of bug that has been encountered from Python, PHP, and from Rails. --------------------------------------------- https://tersesystems.com/2015/11/08/closing-the-open-door-of-java-object-se… *** Protecting Windows Networks - Defeating Pass-the-Hash *** --------------------------------------------- Pass-the-hash is popular attack technique to move laterally inside the network that relies on two components - the NTLM authentication protocol and ability to gain password hashes. This attack allows you to log in on the systems via stolen hash instead of providing clear text password, so there is no need to crack those hashes. To make use of this attack, attacker already has to have admin rights on the box, which is a plausible scenario in a modern "assume breach" mindset. --------------------------------------------- https://dfirblog.wordpress.com/2015/11/08/protecting-windows-networks-defea… *** Security Notice - Statement about Path Traversal Vulnerability in Huawei HG532 Routers Disclosed by CERT/CC *** --------------------------------------------- It is confirmed that some customized versions of Huawei HG532, HG532e, HG532n, and HG532s have this vulnerability. Huawei has prepared a fixed version for affected carriers and is working with them to release the fixed version. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** No surprise here: Adobes Flash is a hackers favorite target *** --------------------------------------------- Adobe Systems Flash plugin gets no love from anyone in the security field these days. A new study released Monday shows just how much it is favored by cybercriminals to sneak their malware onto computers. --------------------------------------------- http://www.cio.com/article/3002668/no-surprise-here-adobes-flash-is-a-hacke… *** Joomla CMS - Bad Cryptography - Multiple Vulnerabilities *** --------------------------------------------- heres a complete enumeration of what Ive found: - JCrypt: Silent fallback to a weak, userspace PRNG (which is very bad for cryptography purposes) - JCryptCipherSimple: Homegrown weak cipher (XOR-ECB) - JCryptCipher: Chosen ciphertext attacks (no authentication) - JCryptCipher: Data corruption / padding oracle attack - JCryptCipher: Static IV for CBC mode (stored with JCryptKey under the misnomer property, "public") -- this sort of defeats the purpose of using CBC mode - JCryptPasswordSimple: PHP Non-Strict Type Comparison (a.k.a. Magic Hash vulnerability) --------------------------------------------- http://www.openwall.com/lists/oss-security/2015/11/08/1 *** HTTP Evasions Explained - Part 7 - Lucky Numbers *** --------------------------------------------- This is part seven in a series which will explain the evasions done by HTTP Evader. This part will be about using the wrong or even invalid status codes to evade the analysis. For 30% of the firewalls in the tests reports Ive got it is enough to use a status code of 100 instead of 200 to bypass analysis and at least Chrome, IE and Edge will download the data even with this wrong status code: --------------------------------------------- http://noxxi.de/research/http-evader-explained-7-lucky-number.html *** Security Advisory: Linux kernel vulnerability CVE-2014-9419 *** --------------------------------------------- F5 Product Development has assigned ID 530413 (BIG-IP), ID 530553 (BIG-IQ), ID 530554 (Enterprise Manager), ID 520651 (FirePass), ID 461496 (ARX), and INSTALLER-1299 (Traffix) to this vulnerability, and has evaluated the currently supported releases for potential vulnerability. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17551.htm… *** IBM Security Bulletins *** --------------------------------------------- *** Vulnerabilities in Qemu affect PowerKVM (Multiple Vulnerabilities) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022875 --------------------------------------------- *** IBM Smart Analytics System 5600 is affected by vulnerabilities in IBM GPFS (CVE-2015-4974, CVE-2015-4981) *** http://www.ibm.com/support/docview.wss?uid=swg21969198 --------------------------------------------- *** Authentication Bypass vulnerability found in IBM Sterling B2B Integrator (CVE-2015-5019) *** http://www.ibm.com/support/docview.wss?uid=swg21967781 --------------------------------------------- *** IBM Smart Analytics System 5600 is affected by a vulnerability in BIND (CVE-2015-5722) *** http://www.ibm.com/support/docview.wss?uid=swg21964962 --------------------------------------------- *** Vulnerability in Net-SNMP affects PowerKVM (CVE-2015-5621) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022903 --------------------------------------------- *** Multiple vulnerabilities in IBM Java SDK affect IBM Emptoris Strategic Supply Management, and IBM Emptoris Services Procurement. *** http://www.ibm.com/support/docview.wss?uid=swg21969875 --------------------------------------------- *** Multiple OpenSSL Vulnerabilities affect IBM WebSphere MQ 5.3 on HP NonStop (CVE-2015-1788) (CVE-2015-1789) (CVE-2015-1791) *** http://www.ibm.com/support/docview.wss?uid=swg21966723 --------------------------------------------- *** Multiple vulnerabilities in IBM Java Runtime affect Security Directory Integrator *** https://www-304.ibm.com/support/docview.wss?uid=swg21969901 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 6-11-2015
by Daily end-of-shift report 06 Nov '15

06 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-11-2015 18:00 − Freitag 06-11-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** jQuery.min.php Malware Affects Thousands of Websites *** --------------------------------------------- Fake jQuery injections have been popular among hackers since jQuery itself went mainstream and became one of the most widely adopted JavaScript libraries. Every now and then we write about such attacks. Almost every week we see new fake jQuery domains and scripts that mimic jQuery. --------------------------------------------- https://blog.sucuri.net/2015/11/jquery-min-php-malware-affects-thousands-of… *** OmniRAT malware scurrying into Android, PC, Mac, Linux systems *** --------------------------------------------- Leverages Stagefright scare for installs As police across Europe crack down on the use of the DroidJack malware, a similar software nasty has emerged that can control not just Android, but also Windows, Mac, and Linux systems and is being sold openly at a fraction of the cost. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/06/omnirat_mal… *** Check Point Discovers Critical vBulletin 0-Day *** --------------------------------------------- As widely reported, the main vBulletin.org forum was compromised earlier this week and an exploit for a vBulletin 0-day was up for sale in online markets. A patch later released by vBulletin fixes the vulnerability reported, but fails to neither credit any reporting nor mention the appropriate CVE number. As the vulnerability is now fixed and an exploit exists in the wild with public analyses, we follow with the technical description as submitted to vBulletin. --------------------------------------------- http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulle… *** Peter Kieseberg @ 5th KIRAS Fachtagung *** --------------------------------------------- Today Peter Kieseberg (SBA Research) presented the results of the SCUDO-Project together with Alexander Szönyi (Thales Austria) and Wolfgang Rosenkranz (Repuco) at the 5th 'KIRAS Fachtagung' in the Austria Trend Hotel Savoyen Vienna. This project was focused on the development of a training process for defence simulation trainings in the area of critical infrastructures ... --------------------------------------------- https://www.sba-research.org/2015/11/05/peter-kieseberg-5th-kiras-fachtagun… *** Bundestag will Mitarbeitern Flash verbieten *** --------------------------------------------- Nach dem schweren Hackerangriff vor rund sechs Monaten will der Deutsche Bundestag mit einigen Maßnahmen die IT-Sicherheit erhöhen. Mitarbeiter und Abgeordnete sollen zu längeren Passwörtern und PINs mit mindestens acht Zeichen verpflichtet werden, außerdem werden Flash und andere Browsererweiterungen von den Rechnern verbannt, wie Spiegel Online unter Berufung auf ein internes Dokument der Bundestagsverwaltung berichtet. --------------------------------------------- http://www.golem.de/news/nach-hackerangriff-bundestag-will-flash-verbieten-… *** Slides from RUXCON, Oct. 24-25, Melbourne *** --------------------------------------------- * DNS as a Defense Vector, Paul Vixie * High Performance Fuzzing, Richard Johnson * MalwAirDrop: Compromising iDevices via AirDrop, Mark Dowd * Broadcasting Your Attack: Security Testing DAB Radio In Cars, Andy Davis * Windows 10: 2 Steps Forward, 1 Step Back, James Forshaw ... --------------------------------------------- https://ruxcon.org.au/slides/?year=2015 *** Tracking HTTP POST data with ELK, (Fri, Nov 6th) *** --------------------------------------------- The Apache webserver has a very modular logging system. It is possible to customize what to log and how. But it lacks in logging data submitted to the server via POST HTTP requests. Recently, I had to investigate suspicious HTTP traffic and one of the requirements was to analyze POST data. If you already have a solution which performs full packet capture, youre lucky but it could quickly become a pain to search for information across gigabytes of PCAP files. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20345&rss *** Encryption ransomware threatens Linux users *** --------------------------------------------- November 6, 2015 Doctor Web warns users about new encryption ransomware targeting Linux operating systems. Judging from the directories in which the Trojan encrypts files, one can draw a conclusion that the main target of cybercriminals is website administrators whose machines have web servers deployed on. Doctor Web security researchers presume that at least tens of users have already fallen victim to this Trojan. --------------------------------------------- http://news.drweb.com/show/?i=9686&lng=en&c=9 *** Advantech EKI Hard-coded SSH Keys Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a hard-coded SSH key vulnerability in Advantech's EKI-122X series products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-309-01 *** ICIT Brief: Know Your Enemies - A Primer on Advanced Persistent Threat Groups *** --------------------------------------------- This primer provides an overview of the threat landscape, attack vectors, size and sophistication of threat actors. Some of the Groups and Platforms include: The Elderwood Platform, Topsec, Axiom, Hidden Lynx, Deep Panda, PLA Unit 61398, Putter Panda, Tarh Andishan, Ajax, Bureau 121, Energetic Bear, Uroburos, APT 28, Hammertoss, CrazyDuke, Sandworm, Syrian Electronic Army, Anonymous and Butterfly Group among others. --------------------------------------------- http://icitech.org/icit-brief-know-your-enemies-a-primer-on-advanced-persis… *** Security Advisory: NTP vulnerability CVE-2015-7704 *** --------------------------------------------- An off-path attacker can send a crafted Kiss of Death (KoD) packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17566.htm… *** Security Advisory - DoS Vulnerability in GPU Driver of Huawei Products *** --------------------------------------------- Some Huawei products have a DoS vulnerability. An attacker may trick a user into installing a malicious application and use it to input invalid parameters into the GPU driver program of the products, which can crash the system of the device. (Vulnerability ID: HWPSIRT-2015-09017) This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-7740. Huawei has released software updates to fix these vulnerabilities. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - DoS Vulnerability in Camera Driver of Huawei Products *** --------------------------------------------- Some Huawei products have a DoS vulnerability. An attacker who has the system or camera permission can input invalid parameters into the camera driver program to crash the system. (Vulnerability ID: HWPSIRT-2015-09013) Huawei has released software updates to fix these vulnerabilities. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Donnerstag 5-11-2015
by Daily end-of-shift report 05 Nov '15

05 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-11-2015 18:00 − Donnerstag 05-11-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** A Technical Look At Dyreza *** --------------------------------------------- Inside the core of Dyreza - a look at its malicious functions and their implementation.Categories: Malware AnalysisTags: dyrezamalware(Read more...) --------------------------------------------- https://blog.malwarebytes.org/intelligence/2015/11/a-technical-look-at-dyre… *** Malicious spam with links to CryptoWall 3.0 - Subject: Domain [name] Suspension Notice, (Thu, Nov 5th) *** --------------------------------------------- Introduction Since Monday 2015-10-26, weve noticed a particular campaign sending malicious spam (malspam) with links to download CryptoWall 3.0 ransomware. This campaign has been impersonating domain registrars. Conrad Longmore blogged about it last week [1], and Techhelplist.com has a good write-up on the campaign [2]. Several other sources have also discussed this wave of malspam [3, 4, 5, 6, 7, 8 to name a few]. For this diary, well take a closer look at the emails and associated CryptoWall --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20333&rss *** CryptoWall 4.0 Released with a New Look and Several New Features *** --------------------------------------------- The fourth member of the CryptoWall family of ransomware, CryptoWall 4.0, has just been released, complete with new features and a brand new look. We recently reported that CryptoWall 3.0 has allegedly caused over $325 million in annual damages. CryptoWall first emerged in April 2014. Its first major upgrade was dubbed CryptoWall 2.0, and first emerged in October... --------------------------------------------- http://securityaffairs.co/wordpress/41718/cyber-crime/cryptowall-4-0-releas… *** SSL-Zertifikate: Microsoft will sich schon nächstes Jahr von SHA-1 trennen *** --------------------------------------------- Die Firma überlegt ob der neuen Qualität von Angriffen auf den Hash-Algorithmus, diesen schon Mitte 2016 auf die verbotene Liste zu setzen. Google und Mozilla gehen ähnliche Wege. --------------------------------------------- http://heise.de/-2880134 *** Mabouia: The first ransomware in the world targeting MAC OS X *** --------------------------------------------- Rafael Salema Marques, a Brazilian researcher, published a PoC about the existence of Mabouia ransomware, the first ransomware that targets MAC OS X. Imagine this scenario: You received a ransom warning on your computer stating that all your personal files had been locked. In order to unlock the files, you would have to pay $500. --------------------------------------------- http://securityaffairs.co/wordpress/41755/cyber-crime/mabouia-ransomware-ma… *** Meet the Android rooting adware that cannot be removed *** --------------------------------------------- Researchers have identified a new strain of malicious adware that is impossible for affected Android device owners to uninstall. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Prm6r3X3tzk/ *** No C&C server needed: Russia menaced by offline ransomware *** --------------------------------------------- Harder to take down, nyet? Miscreants have cooked up a new strain of ransomware that works offline and so might be more resistant to law enforcement takedown efforts as a result. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/05/offline_ran… *** Thousands of legitimate iOS apps discovered containing ad library backdoors *** --------------------------------------------- More than 2,000 iOS apps stocked in Apples legitimate App Store reportedly contained backdoored versions of an ad library, which could have allowed for surveillance without users knowledge. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/nxOb5Ac0sYo/ *** The Omnipresence of Ubiquiti Networks Devices on the Public Web *** --------------------------------------------- There are ongoing in the wild attacks against Ubiquiti Networks devices. Attackers are using default credentials to gain access to the affected devices via SSH. The devices are infected by a botnet client that is able to infect other devices.Further information about these attacks is available at:Krebs on Security: http://krebsonsecurity.com/2015/06/crooks-use-hacked-routers-to-aid-cyberhe… Research: https://www.incapsula.com/blog/ddos-botnet-soho-router.htmlCARISIRT --------------------------------------------- http://blog.sec-consult.com/2015/11/the-omnipresence-of-ubiquiti-networks.h… *** vBulletin Exploits in the Wild *** --------------------------------------------- The vBulletin team patched a serious object injection vulnerability yesterday, that can lead to full command execution on any site running on an out-of-date vBulletin version. The patch supports the latest versions, from 5.1.4 to 5.1.9. The vulnerability is serious and easy to exploit; it was used to hack and deface the main vBulletin.com website. As aRead More The post vBulletin Exploits in the Wild appeared first on Sucuri Blog. --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NNlPrHaDARs/vbulletin-exploit… *** TalkTalk, Script Kids & The Quest for "OG" *** --------------------------------------------- So youve got two-step authentication set up to harden the security of your email account (you do, right?). But when was the last time you took a good look at the security of your inboxs recovery email address? That may well be the weakest link in your email security chain, as evidenced by the following tale of a IT professional who saw two of his linked email accounts recently hijacked in a bid to steal his Twitter identity.Earlier this week, I heard from Chris Blake, a longtime KrebsOnSecurity... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/im8m6Imwfsk/ *** Connecting the Dots in Cyber Threat Campaigns, Part 2: Passive DNS *** --------------------------------------------- This is the second part of our series on "connecting the dots", where we investigate ways to link attacks together to gain a better understanding of how they are related. In Part 1, we looked... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/7x_ynKHJKns/ *** Xen Project 4.5.2 Maintenance Release Available *** --------------------------------------------- I am pleased to announce the release of Xen 4.5.2. Xen Project Maintenance releases are released roughly every 4 months, in line with our Maintenance Release Policy. We recommend that all users of the 4.5 stable series update to this point release. --------------------------------------------- https://blog.xenproject.org/2015/11/05/xen-project-4-5-2-maintenance-releas… *** Open-Xchange Input Validation Flaw in Printing Dialogs Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1034018 *** Bugtraq: [KIS-2015-10] Piwik <= 2.14.3 (DisplayTopKeywords) PHP Object Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536839 *** Bugtraq: [KIS-2015-09] Piwik <= 2.14.3 (viewDataTable) Autoloaded File Inclusion Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536838 *** MIT Kerberos Multiple Bugs Let Remote Users Cause the Target Service to Crash *** --------------------------------------------- http://www.securitytracker.com/id/1034084 *** [2015-11-05] Insecure default configuration in Ubiquiti Networks products *** --------------------------------------------- Ubiquiti Networks products have remote administration enabled by default (WAN port). Additionally these products use the same certificates and private keys for administration via HTTPS. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to compromise ... --------------------------------------------- http://support.citrix.com/article/CTX202404 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ is affected by multiple vulnerabilities in IBM Runtime Environments Java Technology Edition, Versions 5, 6 & 7 *** http://www.ibm.com/support/docview.wss?uid=swg21968485 --------------------------------------------- *** IBM Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to Denial of Service Attack. (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=swg21970036 --------------------------------------------- *** IBM Security Bulletin: Openstack Nova vulnerability affects IBM Cloud Manager with OpenStack (CVE-2015-2687) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022691 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM DB2 LUW (CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=swg21968869 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities identified in IBM Java SDK affect WebSphere Service Registry and Repository Studio (CVE-2015-2613 CVE-2015-2601 CVE-2015-2625 CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21969911 --------------------------------------------- *** PowerHA SystemMirror privilege escalation vulnerability (CVE-2015-5005) *** http://www.ibm.com/support/ --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to change work orders that the user should not have access to change (CVE-2015-7395 ) *** http://www.ibm.com/support/docview.wss?uid=swg21969072 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in the Linux Kernel affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1022785 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Python affect PowerKVM (CVE-2013-5123, CVE-2014-8991) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022786 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSLP affects PowerKVM (CVE-2015-5177) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022876 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Python-httplib2 affects PowerKVM (CVE-2013-2037) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022877 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in lcms affects PowerKVM (CVE-2015-4276) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022834 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Libcrypt++ affects PowerKVM (CVE-2015-2141) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022879 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in lighttpd affects PowerKVM (CVE-2015-3200) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022837 --------------------------------------------- *** IBM Security Bulletin:Vulnerabilities in wpa_supplicant may affect PowerKVM (CVE-2015-1863 and CVE-2015-4142) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022832 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in libXfont affect PowerKVM (CVE-2015-1802, CVE-2015-1803, CVE-2015-1804) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022787 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Mozilla NSS affects PowerKVM (CVE-2015-2730) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022790 --------------------------------------------- *** IBM Security Bulletin: Information disclosure vulnerability could expose user personal data in IBM WebSphere Commerce (CVE-2015-5015) *** http://www.ibm.com/support/docview.wss?uid=swg21969174 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager is affected by a vulnerability from FSM's use of strongswan: (CVE-2015-4171) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022817 --------------------------------------------- *** IBM Security Bulletin: IBM Netezza Host Management is vulnerable to a BIND 9 utility issue (CVE-2015-5722) *** http://www.ibm.com/support/docview.wss?uid=swg21966952 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 4-11-2015
by Daily end-of-shift report 04 Nov '15

04 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-11-2015 18:00 − Mittwoch 04-11-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Return of the EXIF PHP Joomla Backdoor *** --------------------------------------------- Our Remediation and Research teams are in constant communication and collaboration. It's how we stay ahead of the latest threats, but it also presents an opportunity to identify interesting threats that aren't new but may be reoccuring. Such as today's post, in which we explore a case we shared close to two years ago where... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/VZAI0vVYGjI/exif-php-joomla-b… *** Researchers map out hard-to-kill, multi-layered spam botnet *** --------------------------------------------- A dropper component sent to the Akamai researchers led them to the discovery of a spamming botnet that consists of at least 83,000 compromised systems. The botnet is multi-layered, decentralized, a... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/B72jnhO-1Ds/secworld.php *** Nach Hack des Support-Forums: Mysteriöser vBulletin-Patch erschienen *** --------------------------------------------- Nach einem Angriff auf das offizielle Support-Forum der Forensoftware vBulletin ist ein Sicherheitsupdate erschienen. Ob dies die Lücke stopft, die bei dem Angriff ausgenutzt wurde, ist nicht ganz klar. --------------------------------------------- http://heise.de/-2869989 *** Internet Wide Scanners Wanted, (Wed, Nov 4th) *** --------------------------------------------- In our data, we often find researchers performing internet wide scans. To better identify these scans, we would like to add a label to these IPs identifying them as part of a research project. If you are part of such a project, or if you know of a project, please let me know. You can submit any information as a comment or via our contact form. If the IP addresses change often, then a URLs with a parseable list would be appreciated to facilitate automatic updates. --- Johannes B. Ullrich, Ph.D. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20337&rss *** GovRAT, the malware-signing-as-a-service platform in the underground *** --------------------------------------------- Security Experts at InfoArmor discovered GovRAT, a malware-signing-as-a-service platform that is offered to APT groups in the underground. In the past, I have explained why digital certificates are so attractive for crooks and intelligence agencies, one of the most interesting uses is the signature of malware code in order to fool antivirus. Naturally, digital certificates... --------------------------------------------- http://securityaffairs.co/wordpress/41714/cyber-crime/govrat-platform.html *** Confusing Convenience for Security: SSH Keys *** --------------------------------------------- Secure Shell (SSH) keys are a common part of accessing Unix systems, and you need to put some focus specifically on your organization's use of SSH keys. --------------------------------------------- http://blog.beyondtrust.com/confusing-convenience-for-security-ssh-keys *** Security Fixes in Firefox 42 *** --------------------------------------------- https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… *** VU#391604: ZTE ZXHN H108N R1A routers contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#391604 ZTE ZXHN H108N R1A routers contains multiple vulnerabilities Original Release date: 03 Nov 2015 | Last revised: 03 Nov 2015 Overview ZTE ZXHN H108N R1A router, version ZTE.bhs.ZXHNH108NR1A.h_PE, and ZXV10 W300 router, version W300V1.0.0f_ER1_PE, contain multiple vulnerabilities. Description CWE-200: Information Exposure - CVE-2015-7248 Multiple information exposure vulnerabilities enable an attacker to obtain credentials and other sensitive details about the ZXHN... --------------------------------------------- http://www.kb.cert.org/vuls/id/391604 *** Alcatel-Lucent Home Device Manager Spoofing *** --------------------------------------------- Topic: Alcatel-Lucent Home Device Manager Spoofing Risk: Low Text: ## # # SWISSCOM CSIRT ADVISORY - https://www.swisscom.ch/en/about/sustainability/digital- #switze... --------------------------------------------- https://cxsecurity.com/issue/WLB-2015110029 *** DSA-3391 php-horde - security update *** --------------------------------------------- It was discovered that the web-based administration interface in theHorde Application Framework did not guard against Cross-Site RequestForgery (CSRF) attacks. As a result, other, malicious web pages couldcause Horde applications to perform actions as the Horde user. --------------------------------------------- https://www.debian.org/security/2015/dsa-3391 *** DSA-3392 freeimage - security update *** --------------------------------------------- Pengsu Cheng discovered that FreeImage, a library for graphic imageformats, contained multiple integer underflows that could lead to adenial of service: remote attackers were able to trigger a crash bysupplying a specially crafted image. --------------------------------------------- https://www.debian.org/security/2015/dsa-3392 *** Bugtraq: [security bulletin] HPSBGN03425 rev.1 - HP ArcSight SmartConnectors, Remote Disclosure of Information, Local Escalation of Privilege *** --------------------------------------------- http://www.securityfocus.com/archive/1/536827 *** Bugtraq: [security bulletin] HPSBGN03386 rev.2 - HP Central View Fraud Risk Management, Revenue Leakage Control, Dealer Performance Audit, Credit Risk Control, Roaming Fraud Control, Subscription Fraud Prevention, Remote Disclosure of Information, *** --------------------------------------------- http://www.securityfocus.com/archive/1/536824 *** Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Notice - Statement on Venustech Revealing Heap Overflow Vulnerability in Huawei Smart Phone *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-15:25.ntp [REVISED] *** --------------------------------------------- http://www.securityfocus.com/archive/1/536833 *** Cisco Security Advisories *** --------------------------------------------- *** Cisco SocialMiner WeChat Page Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Web Security Appliance Cache Reply Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Mobility Services Engine Static Credential Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco AsyncOS TCP Flood Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Web Security Appliance Range Request Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Mobility Services Engine Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Web Security Appliance Certificate Generation Command Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Email Security Appliance Email Scanner Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Dienstag 3-11-2015
by Daily end-of-shift report 03 Nov '15

03 Nov '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-11-2015 18:00 − Dienstag 03-11-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** UK-US Cyberattack Simulation On Finance Sector Set For This Month *** --------------------------------------------- US-CERT and CERT-UK putting President and Prime Ministers earlier plans into action. --------------------------------------------- http://www.darkreading.com/operations/uk-us-cyberattack-simulation-on-finan… *** Latest Adobe Flash vulnerability now in Angler, Nuclear EKs *** --------------------------------------------- Malwarebytes is reporting that once again Adobe Flash Player has become a target as the recently patched zero-day exploit that was discovered and patched has become a part of several exploit kits (EK). --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/s2Q_P9QhW74/ *** WoW! Want to beat Microsofts Windows security defenses? Poke some 32-bit software *** --------------------------------------------- Compatibility tool hampers EMET anti-malware protections Two chaps claim to have discovered how to trivially circumvent Microsofts Enhanced Mitigation Experience Toolkit (EMET) using Redmonds own compatibility tools. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/32bit_softw… *** Web server secured? Good, now lets talk about e-mail *** --------------------------------------------- Its not just Hillary whose servers a spillory While Website owners may have noticed the need to get rid of old, buggy or weak crypto, those operating e-mail servers seem to be operating on autopilot. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/web_server_… *** Dev to Mozilla: Please dump ancient Windows install processes *** --------------------------------------------- Old habits die hard Security bod Stefan Kanthak is asking Mozilla to quit using Windows self-extracting installs. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/dev_to_mozi… *** The official website of the popular vBulletin forum has been hacked *** --------------------------------------------- The website of the vBulletin forum software is down for maintenance following a data breach that exposed personal information of hundreds of thousands users On Sunday, the vBulletin official website has been hacked by an attacker using the moniker "Coldzer0". The website has been defaced and the vBulletin forum was displaying the message "Hacked by Coldzer0." At the... --------------------------------------------- http://securityaffairs.co/wordpress/41656/cyber-crime/vbulletin-forum-hacke… *** Chimera crypto-ransomware is hitting German companies *** --------------------------------------------- A new piece of crypto-ransomware is targeting German companies: its called Chimera, and the criminals behind the scheme are threatening to release sensitive corporate data on the Internet if the targ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/D53NfnuVrIM/malware_news.… *** KeyPass looter: The password plunderer to hose pwned sys admins *** --------------------------------------------- When youre owned, youre boned. Kiwi hacker Denis Andzakovic has developed an application that steals password vaults from the popular local storage vault KeyPass. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/11/03/keypass_loo… *** Security: Kommandozeilen-Zugriff auf Bankterminal dokumentiert *** --------------------------------------------- Ein deutscher Sicherheitsforscher hat eine Sicherheitslücke in Geldautomaten-Software gefunden. Die Schwachstelle ermöglichte den Zugriff auf die Kommandozeile des Geräts und das Auslesen zahlreicher kritischer Daten. --------------------------------------------- http://www.golem.de/news/security-kommandozeilen-zugriff-auf-bankterminal-d… *** OTA-Patch: Google verteilt Sicherheitsupdate für Android 6.0 *** --------------------------------------------- Die neue Android-Version 6.0 alias Marshmallow bekommt nach einem Monat ihre erste Sicherheitsaktualisierung. Grund sind insgesamt sieben Bedrohungen, von denen Google zwei als kritisch einstuft. --------------------------------------------- http://www.golem.de/news/ota-patch-google-verteilt-sicherheitsupdate-fuer-a… *** Kaspersky DDoS Intelligence Report Q3 2015 *** --------------------------------------------- In the third quarter of 2015 botnet-assisted DDoS attacks targeted victims in 79 countries around the world; 91.6% of targeted resources were located in 10 countries. The largest numbers of DDoS attacks targeted victims in China, the US and South Korea. The longest DDoS attack in Q3 2015 lasted for 320 hours. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/72560/kaspersky-dd… *** Wormhole-Schwachstelle: Backdoor in über 14.000 Android-Apps *** --------------------------------------------- Das Moplus SDK hält in zahlreichen Apps eine Hintertür für Angreifer auf, sodass diese etwa heimlich Dateien von Android-Gerät abziehen und SMS-Nachrichten versenden können. --------------------------------------------- http://www.heise.de/newsticker/meldung/Wormhole-Schwachstelle-Backdoor-in-u… *** A few things about Redis security *** --------------------------------------------- >From time to time I get security reports about Redis. It's good to get reports, but it's odd that what I get is usually about things like Lua sandbox escaping, insecure temporary file creation, and similar issues, in a software which is designed (as we explain in our security page here http://redis.io/topics/security) to be totally insecure if exposed to the outside world. Yet these bug reports are often useful since there are different levels of security concerning any software in... --------------------------------------------- http://antirez.com/news/96 *** How Carders Can Use eBay as a Virtual ATM *** --------------------------------------------- How do fraudsters "cash out" stolen credit card data? Increasingly, they are selling in-demand but underpriced products on eBay that they dont yet own. Once the auction is over, the auction fraudster uses stolen credit card data to buy the merchandise from an e-commerce store and have it shipped to the auction winner. Because the auction winners actually get what they bid on and unwittingly pay the fraudster, very often the only party left to dispute the charge is the legitimate... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/E4QijbOr8i0/ *** ORX-Locker, a Web Platform to Create Ransomware *** --------------------------------------------- The only thing more dangerous than cryptolocker-type ransomware in the hands of a highly skilled hacker is the same ransomware offered as a service and made available to the general public. Similar to the private TOX RaaS (Ransomware as a Service) platform discovered in August, ORX-Locker is a free-to-use web platform where anyone can create and download malware that will encrypt a victim's file system and demand payment for recovery. This is one of the first public RaaS sites we've... --------------------------------------------- https://feeds.feedblitz.com/~/122089935/0/alienvault-blogs~ORXLocker-a-Web-… *** XcodeGhost S: A New Breed Hits the US *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/11/xcodeghost_s_a_new.html *** Enhancing pentesting recon with nmap, (Tue, Nov 3rd) *** --------------------------------------------- You might have used nmap several times for recon using the conventional portscan functionality (Connect scan, SYN Scan, FIN scan, UDP scan, ...) but for gathering extra info like HTTP directories, DNS host enumeration without performing zone transfer, Microsoft SQL Server enumeration and SMB device info people usually uses additional tools. I will show you how nmap can provide that information without use of extra tools: 1. HTTP Directories The http-enum script is able to test for the existence... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20331&rss *** VU#316888: MobaXterm server may allow arbitrary command injection due to missing X11 authentication *** --------------------------------------------- Vulnerability Note VU#316888 MobaXterm server may allow arbitrary command injection due to missing X11 authentication Original Release date: 02 Nov 2015 | Last revised: 02 Nov 2015 Overview The MobaXterm server prior to verion 8.3 is vulnerable to arbitrary command injection over port 6000 when using default X11 settings. Description CWE-306: Missing Authentication for Critical Function - CVE-2015-7244MobaXterm server prior to version 8.3 includes an X11 server listening on all IP addresses... --------------------------------------------- http://www.kb.cert.org/vuls/id/316888 *** Security Advisory - Local Permission Escalation Vulnerability in GPU of P7 Phones *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Cisco Unified Computing System Blade Server Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7852 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17516.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7850 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17528.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7701 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17517.htm… --------------------------------------------- *** Security Advisory: NTP vulnerabilities CVE-2015-7704 and CVE-2015-7705 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17527.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7703 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17529.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7848 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17526.htm… --------------------------------------------- *** Security Advisory: NTP vulnerabilities CVE-2015-7691, CVE-2015-7692, and CVE-2015-7702 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17530.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7871 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17518.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7849 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17521.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7854 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17524.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7853 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17525.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7855 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17515.htm… --------------------------------------------- *** Security Advisory: NTP vulnerability CVE-2015-7851 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/500/sol17522.htm… ---------------------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily November 2015