Daily February 2015

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - Freitag 27-02-2015
by Daily end-of-shift report 27 Feb '15

27 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-02-2015 18:00 − Freitag 27-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** #JetLeak: Jetty-Webserver gibt Verbindungsdaten preis *** --------------------------------------------- Der Jetty-Server steckt unter anderem in Hadoop, Heroku, Eclipse und der Google AppEngine. Angreifer können eine jetzt entdeckte Lücke dazu nutzen, Daten aus den Verbindungen anderer Nutzer auszuspionieren. --------------------------------------------- http://heise.de/-2560894 *** Spam Uses Default Passwords to Hack Routers *** --------------------------------------------- In case you needed yet another reason to change the default username and password on your wired or wireless Internet router: Phishers are sending out links that, when clicked, quietly alter the settings on vulnerable routers to harvest online banking credentials and other sensitive data from victims. Sunnyvale, Calif. based security firm Proofpoint said it recently detected a four-week spam... --------------------------------------------- http://krebsonsecurity.com/2015/02/spam-uses-default-passwords-to-hack-rout… *** Adventures in Xen exploitation *** --------------------------------------------- tl;drThis post is about my experience trying to exploit the Xen SYSRET bug (CVE-2012-0217).This issue was patched in June 2012 and was dis ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/adventures-in-xen-exploitation/ *** Sicherheits-Tool PrivDog telefoniert nach Hause - unverschlüsselt *** --------------------------------------------- Das vermeintliche Sicherheits-Tool PrivDog steht erneut in der Kritik, denn es sendet alle besuchten URLs unverschlüsselt an den Hersteller. --------------------------------------------- http://heise.de/-2560926 *** Dridex Downloader Analysis *** --------------------------------------------- Introduction Yesterday I received in my company inbox an email with an attached .xlsm file named D92724446.xlsm coming from Clare588(a)78-83-77-53.spectrumnet.bg. Central and local AV engines did not find anything malicious, and a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file... --------------------------------------------- http://resources.infosecinstitute.com/dridex-downloader-analysis/ *** D-Link remote access vulnerabilities remain unpatched *** --------------------------------------------- D-Link routers have several unpatched vulnerabilities, the worst of which could allow an attacker to gain total control over a device, according to a systems engineer in Canada. Peter Adkins, who does security research in his free time, released details of the flaws on Thursday. Adkins said in a phone interview that he has been in intermittent contact with D-Link since Jan. 11 on the issues, but the company has not indicated when it might patch. --------------------------------------------- http://www.cio.com/article/2889994/dlink-remote-access-vulnerabilities-rema… *** Microsoft Malware Protection Center assists in disrupting Ramnit *** --------------------------------------------- Recent disruption of the Ramnit malware family was successful due to a multinational collaboration, led by Europol's European Cybercrime Center (EC3), in partnership with Financial Services and Information Sharing & Analysis Center (FS-ISAC), Symantec, AnubisNetworks, Microsoft's Digital Crimes Unit (DCU), and the Microsoft Malware Protection Center (MMPC). The MMPC has been closely monitoring Ramnit since its discovery in April 2010, as you can see by reading: Ramnit - The... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/25/microsoft-malware-protec… *** The Evil CVE: CVE-666-666 - "Report Not Read" *** --------------------------------------------- I had an interesting discussion with a friend this morning. He explained that, when he is conducting a pentest, he does not hesitate to add sometimes in his report a specific finding regarding the lack of attention given to the previous reports. If some companies are motivated by good intentions and ask for regular pentests against their infrastructure or a specific application, what if they even don't... --------------------------------------------- http://blog.rootshell.be/2015/02/26/the-evil-cve-cve-666-666-report-not-rea… *** Weekly Metasploit Wrapup *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/26/weekly-me… *** Threatpost News Wrap, February 27, 2015 *** --------------------------------------------- Mike Mimoso and Dennis Fisher discuss the news of the last week, including the Superfish fiasco, the Gemalto SIM hack controversy and the continuing NSA drama. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-february-27-2015/111312 *** VMSA-2015-0001.1 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** Security Advisory: BIG-IP ASM cross-site scripting (XSS) vulnerability CVE-2015-1050 *** --------------------------------------------- (SOL16081) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/000/sol16081.htm… *** Security Advisory: OpenSSL vulnerability CVE-2014-0160 *** --------------------------------------------- (SOL15159) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15159.htm… *** Security Advisory: XSS vulnerability in echo.jsp CVE-2014-4023 *** --------------------------------------------- (SOL15532) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15532.htm… *** Cisco Security Notices *** --------------------------------------------- *** Vulnerability in IPv6 Neighbor Discovery in Cisco IOS and IOS-XE Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Vulnerability in Authentication Proxy Feature in Cisco IOS Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Common Services Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco ACE 4710 Application Control Engine and Application Neworking Manager Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- *** DSA-3176 request-tracker4 - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in Request Tracker, anextensible trouble-ticket tracking system. The Common Vulnerabilitiesand Exposures project identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3176 *** Network Vision IntraVue Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability in Network Vision's IntraVue software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01 *** [2015-02-27] Multiple vulnerabilities in Loxone Smart Home *** --------------------------------------------- Multiple design and implementation flaws within Loxone Smart Home enable an attacker to control arbitrary devices connected to the system, execute JavaScript code in the users browser, steal the users credentials and cause a denial of service. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3 CMS 6.2.10 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.10 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6210-released/ *** IBM Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695042 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695037 --------------------------------------------- *** Huge-IT Slider - SQL Injection *** https://wpvulndb.com/vulnerabilities/7811 *** CrossSlide jQuery Plugin <= 2.0.5 - Stored XSS & CSRF *** https://wpvulndb.com/vulnerabilities/7812 *** WPBook - CSRF *** https://wpvulndb.com/vulnerabilities/7813 *** WPBook <= 2.7 - Cross-Site Request Forgery (CSRF) *** https://wpvulndb.com/vulnerabilities/7813 *** WP Media Cleaner <= 2.2.6 - Cross-Site Scripting (XSS) *** https://wpvulndb.com/vulnerabilities/7814 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 26-02-2015
by Daily end-of-shift report 26 Feb '15

26 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-02-2015 18:00 − Donnerstag 26-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** 2014 Spam Landscape: UPATRE Trojan Still Top Malware Attached to Spam *** --------------------------------------------- The malware UPATRE was first spotted in August 2013 following the demise of the Blackhole Exploit kit. It was since known as one of the top malware seen attached to spammed messages and continues to be so all throughout 2014 with particularly high numbers seen in the fourth quarter of the year. We have released... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jUSb_mMOQCc/ *** Webnic Registrar Blamed for Hijack of Lenovo, Google Domains *** --------------------------------------------- Two days ago, attackers allegedly associated with the fame-seeking group Lizard Squad briefly hijacked Googles Vietnam domain (google.com.vn). On Wednesday, Lenovo.com was similarly attacked. Sources now tell KrebsOnSecurity that both hijacks were possible because the attackers seized control over Webnic.cc, the Malaysian registrar that serves both domains and 600,000 others. --------------------------------------------- http://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-le… *** Why Websites Get Hacked *** --------------------------------------------- I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I'm talking large enterprise, there is a common question that often comes up: Why would anyone ever hack my website? Depending on who you are, the answer to this can vary. Nonetheless, it often revolves... --------------------------------------------- http://blog.sucuri.net/2015/02/why-websites-get-hacked.html *** 5 New Vulnerabilities Uncovered In SAP *** --------------------------------------------- ERP security researchers at Onapsis have discovered five new vulnerabilities in SAP BusinessObjects and SAP HANA, three of them high-risk. One in particular gives attackers the power to overwrite data within mission-critical systems. --------------------------------------------- http://www.darkreading.com/application-security/5-new-vulnerabilities-uncov… *** Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Title: Electronic Arts Origin Client 9.5.5 Multiple Privilege | Escalation Vulnerabilities | Advisory ID: ZSL-2015-5231 | Type: Local | Impact: Privilege Escalation | Risk: (3/5) | Release Date: 26.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5231.php *** Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation *** --------------------------------------------- Title: Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege | Escalation | Advisory ID: ZSL-2015-5230 | Type: Local | Impact: Privilege Escalation | Risk: (2/5) | Release Date: 25.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5230.php *** HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04580241 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04580241 Version: 1 HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04556853 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04556853 Version: 2 HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM Sterling Connect:Direct File Agent (CVE-2014-3065, CVE-2014-6468) *** --------------------------------------------- 2015-02-26T11:42:30-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696580 *** Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution (CVE-2014-3566, CVE-2014-6558) *** --------------------------------------------- 2015-02-25T12:49:31-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697112 *** Security Advisory-Multiple Vulnerabilities on Huawei Tecal Server Products *** --------------------------------------------- Feb 26, 2015 09:44 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory-Glibc Buffer Overflow Vulnerability *** --------------------------------------------- Feb 26, 2015 16:35 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** EasyCart 1.1.30 - 3.0.20 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7808 *** WP All Import Pro <= 4.1.0 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7810 *** WP All Import <= 3.2.3 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7809 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** SA-CONTRIB-2015-062 - Watchdog Aggregator - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437993 *** SA-CONTRIB-2015-061 - Ubercart Webform Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437991 *** SA-CONTRIB-2015-060 - Custom Sitemap - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437985 *** SA-CONTRIB-2015-059 - Spider Video Player - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437981 *** SA-CONTRIB-2015-058 - Spider Catalog - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437977 *** SA-CONTRIB-2015-057 - Spider Contacts - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437973 *** SA-CONTRIB-2015-056 - inLinks Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437969 *** SA-CONTRIB-2015-055 - Services single sign-on server helper - Open Redirect - Unsupported *** https://www.drupal.org/node/2437965 *** SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437943 *** SA-CONTRIB-2015-053 - Entity API - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437905 *** SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF) *** https://www.drupal.org/node/2424409 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 25-02-2015
by Daily end-of-shift report 25 Feb '15

25 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-02-2015 18:00 − Mittwoch 25-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory - WP-Slimstat 3.9.5 and lower *** --------------------------------------------- Advisory for: WP-Slimstat Security Risk: Very high Exploitation level: Remote DREAD Score: 8/10 Vulnerability: Weak Cryptographic keys leading to SQL injections Patched Version: 3.9.6 WP-Slimstat's users should update as soon as possible! During a routine audit for our WAF, we discovered a security bug that an attacker could, by breaking the plugin's weak "secret" key, use to perform a SQL... --------------------------------------------- http://blog.sucuri.net/2015/02/security-advisory-wp-slimstat-3-9-5-and-lowe… *** Finding Unknown Malware *** --------------------------------------------- If you have ever been given the mission to "Find Evil" on a compromised system, you understand the enormity of that tasking. In this technical presentation, Alissa will introduce sound methodology for identifying malware, using strategies based on "Knowing Normal", "Data Reduction" and "Least Frequency of Occurrence" in order to identify malicious binaries and common methods of persistence. The skills and tools presented here will aid in efficient... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/24/finding-unknown-malw… *** A new strain of banking trojan VAWTRAK uses Macros and abuses Windows PowerShell *** --------------------------------------------- Security experts at TrendMicro observed significant improvements in VAWTRAK banking trojan which couples use malicious macros and Windows PowerShell. Early 2015 the Microsoft Malware Protection Center (MMPC) issued an alert about a surge in the infections of malware using macros to spread their malicious code. The experts MMPC have observed a significant increase in enable-macros ... --------------------------------------------- http://securityaffairs.co/wordpress/34107/cyber-crime/vawtrak-uses-macros-w… *** Scanning Internet-exposed Modbus devices for fun & fun *** --------------------------------------------- [...] here is a scan I have run against the whole IPv4 address space, looking for Internet-exposed Modbus services. --------------------------------------------- http://pierre.droids-corp.org/blog/html/2015/02/24/scanning_internet_expose… *** "Surreptitiously Weakening Cryptographic Systems" *** --------------------------------------------- New paper: "Surreptitiously Weakening Cryptographic Systems," by Bruce Schneier, Matthew Fredrikson, Tadayoshi Kohno, and Thomas Ristenpart. Abstract: Revelations over the past couple of years highlight the importance of understanding malicious and surreptitious weakening of cryptographic systems. We provide an overview of this domain, using a number of historical examples to drive development of a weaknesses taxonomy. This allows comparing different... --------------------------------------------- https://www.schneier.com/blog/archives/2015/02/surreptitiously_1.html *** Mozilla Thunderbird Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031792 *** Mozilla Firefox Multiple Flaws Let Remote Users Deny Service, Execute Arbitrary Code, Bypass Security Restrictions, and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031791 *** FreeBSD IGMP Integer Overflow Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031798 *** Splunk Enterprise 6.2.2 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.2.2 addresses two vulnerabilities Multiple vulnerabilities in OpenSSL prior to 1.0.1k (SPL-95203, CVE-2014-3572, CVE-2015-0204) Splunk Web crashes due to specific HTTP requests (SPL-93754) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in... --------------------------------------------- http://www.splunk.com/view/SP-CAAANV8 *** Software Toolbox Top Server Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Software Toolbox Top Server application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-01 *** Kepware Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Kepware Technologies DNP Master Driver for the KEPServerEX Communications Platform. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-02 *** Schneider Electric Invensys Positioner Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Device Type Manager software for Schneider Electric's Invensys SRD Control Valve Positioner product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-03 *** HPSBMU03260 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP System Management Homepage running OpenSSL on Linux and Windows. This vulnerability is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletins *** --------------------------------------------- Rational Reporting for Development Intelligence - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697194 AppScan Enterprise can be affected by multiple vulnerabilities (CVE-2014-6136, CVE-2014-8918) http://www.ibm.com/support/docview.wss?uid=swg21697249 Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697034 Rational Reporting for Development Intelligence - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697035 Tivoli Storage Manager client encryption key password vulnerability (CVE-2014-4818) http://www.ibm.com/support/docview.wss?uid=swg21697022 Tivoli Common Reporting(TCR) iFixes for Security Vulnerability http://www.ibm.com/support/docview.wss?uid=swg21695800 Multiple vulnerabilities in IBM Java SDK affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-3566, CVE-2014-6457, CVE-2014-6468) http://www.ibm.com/support/docview.wss?uid=swg21697112 Vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3513 and CVE-2014-3567) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097159 Rational Insight - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697193 --------------------------------------------- *** Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Dienstag 24-02-2015
by Daily end-of-shift report 24 Feb '15

24 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-02-2015 18:00 − Dienstag 24-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Open Source Threat Intelligence - Developing a Threat intelligence program using open source tools and public sources *** --------------------------------------------- Overview of building a threat intelligence program outlining the processes, tasks and activities associated with the development of a functional intelligence program. Developing an Open Source Threat Intelligence Program from Open Source Tools and Public Sources is aimed at bringing business value and technical mitigation efforts, while dispelling common myths like "We're too small", "Who would attack us, we make widgets?" and "We have nothing anyone would... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/23/open-source-threat-i… *** RIG Exploit Kit - Diving Deeper into the Infrastructure *** --------------------------------------------- Following our previous blog post about the leaking of the RIG exploit kits source code, we dug deeper into the architecture that facilitates the massive infections using RIG. The screen shot below diagrams RIGs infrastructure. RIG Exploit Kit Infrastructure Most... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%e2%80%… *** Insider threats continue to dominate *** --------------------------------------------- Ordinary employees, privileged users and the supply chain - such as contractors and third party service providers - are all conduits for a traditional insider threat, according to Vormetric. But the s... --------------------------------------------- http://www.net-security.org/secworld.php?id=17993 *** Overview of handheld malware for 2014 *** --------------------------------------------- February 24, 2015 Russian anti-virus company Doctor Web presents its 2014 overview of malware for handheld devices. The last year proved to be rather turbulent and rich in terms of information security events. We witnessed the emergence of a variety of new malicious applications for Android. In particular, the number of banking Trojans whose numerous modifications attacked devices in many countries increased significantly. Furthermore, 2014 saw the discovery of the first ransomware programs as... --------------------------------------------- http://news.drweb.com/show/?i=9222&lng=en&c=9 *** Bypassing Windows Lock Screen via Flash Screensaver *** --------------------------------------------- bypass windows lock screen We have recently discovered an easy method to bypass the Windows Lock screen when a flash screensaver is running. The method allows an attacker to gain unauthorized access to a user’s Windows session if he has physical access to a locked machine. --------------------------------------------- http://securitycafe.ro/2015/02/23/bypassing-windows-lock-screen-via-flash-s… *** Windows Exploit Mitigation Technology - Part 2 *** --------------------------------------------- In Part 1, we explained GS cookies and Safe SEH. If you haven't read that part, it is highly recommended to read it first. The Enhanced Mitigation Experience Toolkit, or EMET, is rudimentally a shield or a shell that runs over Windows applications and protects them, regardless of how those applications have authentically been coded... --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology… *** Announcing TYPO3 CMS 7.1 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS 7.1, the second version within the CMS 7 development cycle. --------------------------------------------- http://typo3.org/news/article/typo3-cms-71-released-home-improvement/ *** DSA-3171 samba - security update *** --------------------------------------------- Richard van Eeden of Microsoft Vulnerability Research discovered thatSamba, a SMB/CIFS file, print, and login server for Unix, contains aflaw in the netlogon server code which allows remote code execution withroot privileges from an unauthenticated connection. --------------------------------------------- https://www.debian.org/security/2015/dsa-3171 *** DSA-3170 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a denial of service, information leaks or privilegeescalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3170

1 0

Tageszusammenfassung - Montag 23-02-2015
by Daily end-of-shift report 23 Feb '15

23 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-02-2015 18:00 − Montag 23-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Wichtige Sicherheitsupdates für PHP *** --------------------------------------------- Neue PHP-Versionen schließen unter anderem eine kritische Sicherheitslücke, zu der bereits ein Exploit kursiert. Admins sollten daher keine Zeit verlieren. --------------------------------------------- http://heise.de/-2557586 *** Data Traffic & Network Security *** --------------------------------------------- Introduction Last year - dubbed "the Year of the Hack" - saw numerous major cyber attacks against prominent corporations, including JP Morgan bank and Sony Pictures Entertainment. And after Target in 2013, another retailer, Home Depot, suffered a data breach with more than 56 million credit cards stolen. The consequences of these incidents can be... --------------------------------------------- http://resources.infosecinstitute.com/data-traffic-network-security/ *** Flaw makes Cisco routing hardware vulnerable to DoS attacks *** --------------------------------------------- A serious vulnerability affecting the software of some of Ciscos routing hardware systems for telecommunications and Internet service providers could be exploited to mount DoS attacks, the company ha... --------------------------------------------- http://www.net-security.org/secworld.php?id=17990 *** Samba vulnerability (CVE-2015-0240) *** --------------------------------------------- CVE-2015-0240 is a security flaw in the smbd file server daemon. It can be exploited by a malicious Samba client, by sending specially-crafted packets to the Samba server. No authenticated is required to exploit this flaw. It can result in remotely controlled execution of arbitrary code as root. --------------------------------------------- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-024… *** Superfish not the only app using Komodias SSL-busting code *** --------------------------------------------- As Lenovo backtracked on its initial position that the Superfish adware pre-installed on some of its notebooks is not a security danger, and released a security advisory about the "vulnerability" that... --------------------------------------------- http://www.net-security.org/secworld.php?id=17991 *** Privdog: Comodo-Adware hebelt HTTPS-Sicherheit aus *** --------------------------------------------- Die Adware Privdog hebelt ähnlich wie Superfish den Schutz von HTTPS komplett aus. Pikant daran: Privdog wurde von Comodo verbreitet, einer der größten Zertifizierungsstellen für TLS-Zertifikate. --------------------------------------------- http://www.golem.de/news/privdog-comodo-adware-hebelt-https-sicherheit-aus-… *** FireEye shares details on Masque Attack II affecting iOS devices *** --------------------------------------------- Masque Attack II entails bypassing an iOS prompt for trust and app URL scheme hijacking, FireEye said. --------------------------------------------- http://www.scmagazine.com/fireeye-shares-details-on-masque-attack-ii-affect… *** Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0631 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS Software HTTP Redirect Vulnerability *** --------------------------------------------- CVE-2015-0624 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletins *** --------------------------------------------- Tivoli Storage Manager Stack-based Buffer Overflow Elevation of Privilege: CVE-2014-6184 http://www.ibm.com/support/docview.wss?uid=swg21695878 Vulnerability in SSLv3 affects Tivoli Storage Manager for Virtual Environments 7.1 and FlashCopy Manager for VMware 4.1 (CVE-2014-3566) http://www.ibm.com/support/docview.wss?uid=swg21690828 OpenSSL vulnerabilities announced August 6th 2014 affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (9 CVEs) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097073 Vulnerabilities in OpenSSL. Juniper EX Series Network Switches sold by IBM for use in IBM Products. (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097126 --------------------------------------------- *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-050-01 *** Vibe 3.4 - Hot Patch 1 *** --------------------------------------------- Abstract: This patch addresses the Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability and also provides a number of general bug fixes for Novell Vibe 3.4.Document ID: 5198730Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:NV-Vibe60DayEval-001.xml (719 bytes)NV-Vibe10Usr-001.xml (730 bytes)novell-vibe-3.4.0-windows.zip (185.69 MB)readme-Vibe-3.4-HP1.txt (4.13 kB)novell-vibe-3.4.0-linux.tar (187.8 MB)Products:Vibe 3.4Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=EaNhJs2Offs~ *** Bugtraq: iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:\Program Files\... *** --------------------------------------------- http://www.securityfocus.com/archive/1/534728 *** MyBB 1.8.3 Multiple stored XSS-vulnerabilities *** --------------------------------------------- Topic: MyBB 1.8.3 Multiple stored XSS-vulnerabilities Risk: Low Text: The researchers adamziaja, Devilshakerz, DingjieYang and me found multiple stored XSS-vulnerabilities in the administrative ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020109 *** DSA-3169 eglibc - security update *** --------------------------------------------- Several vulnerabilities have been fixed in eglibc, Debians version ofthe GNU C library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3169 *** DSA-3164 typo3-src - security update *** --------------------------------------------- Pierrick Caillon discovered that the authentication could be bypassed inthe Typo 3 content management system. Please refer to the upstreamadvisory for additional information: --------------------------------------------- https://www.debian.org/security/2015/dsa-3164 *** Security Advisory: Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. Fixed versions: Versions 1.3.8 and 1.4.3 disable sandboxing for Groovy by default. As a consequence, dynamic script execution is disabled for Groovy. CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://securityvulns.com/docs31742.html *** HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Denial of Service (DoS), or Other Vulnerabilties *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Freitag 20-02-2015
by Daily end-of-shift report 20 Feb '15

20 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-02-2015 18:00 − Freitag 20-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Gemalto hack - lessons learned *** --------------------------------------------- In der Nacht auf FR, 20.2.2015 ist die nächste Bombe aus den Snowden leaks eingeschlagen: der niederländische Chipkartenhersteller Gemalto ist zumindest im Zeitraum Jänner 2010 bis März 2010 von GCHQ und NSA gehackt worden. Hierbei sind angeblich .. --------------------------------------------- https://www.cert.at/services/blog/20150220150747-1386.html *** Superfish - Eine Zusammenfassung *** --------------------------------------------- Die meisten im Handel erhältlichen Notebooks werden mit einer vorinstallierten Version von Windows in Kombination mit weiterer "nützlicher" Software - gemeinhin als "Bloatware" bezeichnet - ausgeliefert. Für die meisten Leute ist diese auf Notebooks vorinstallierte Bloatware .. --------------------------------------------- http://www.cert.at/services/blog/20150220162905-1395.html *** The Great SIM Heist - How Spies Stole the Keys to the Encryption Castle *** --------------------------------------------- American and british spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden. --------------------------------------------- https://firstlook.org/theintercept/2015/02/19/great-sim-heist/ *** Hackers now popping Cisco VPN portals *** --------------------------------------------- Crackers are popping customised Cisco virtual private networks, stealing credentials and spraying malware using a flaw reported by Aussie hacker Alec Stuart-Muirk, the company warns. Organisations running the Cisco Clientless SSL .. --------------------------------------------- http://www.theregister.co.uk/2015/02/20/hackers_popping_cisco_vpn_portals/ *** Suit Up and Protect WordPress *** --------------------------------------------- In the final part of the series, I am going to show a few practical tips and tricks for protecting your WordPress blog. --------------------------------------------- https://blog.gaborszathmari.me/2015/02/19/suit-up-and-protect-wordpress/ *** Evil CSS injection bug warning: Dont let hackers cross paths with your website (The Register) *** --------------------------------------------- http://www.theregister.co.uk/2015/02/20/prssi_web_vuln/ *** Filme, Musik, Logindaten: 190.000 Festplatten sind ungesichert im Netz *** --------------------------------------------- Junger Informatiker grast das Netz mit eigenem Tool ab und wundert sich über "Fahrlässigkeit" --------------------------------------------- http://derstandard.at/2000011951714 *** 'TNT' gang has released a new hardware TDoS tool in the criminal underground *** --------------------------------------------- Telephone DDoS attacks are on the rise, the criminal group known as 'TNT' gang has released a new hardware tool in the underground ecosystem. The IntelCrawler cyber threat intelligence company has discovered a new advanced tool, dubbed .. --------------------------------------------- http://securityaffairs.co/wordpress/33867/cyber-crime/tnt-gang-released-tdo… *** IETF verbietet RC4-Verschlüsselung in TLS *** --------------------------------------------- Das Gremium für Internet-Standards will den Einsatz des als geknackt betrachteten Verschlüsselungsverfahrens RC4 offenbar den Garaus machen. --------------------------------------------- http://heise.de/-2556520 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Donnerstag 19-02-2015
by Daily end-of-shift report 19 Feb '15

19 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-02-2015 18:00 − Donnerstag 19-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** SA-CONTRIB-2015-052 - RESTful Web Services - Access Bypass *** --------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The RESTWS Basic Auth submodule doesn't sufficiently disable page caching for ... --------------------------------------------- https://www.drupal.org/node/2428863 *** SA-CONTRIB-2015-048 - Avatar Uploader - Arbitrary PHP code execution *** --------------------------------------------- Avatar Uploader module provides an alternative way to upload user pictures. The module doesn't sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal's normal file upload protections to .. --------------------------------------------- https://www.drupal.org/node/2428793 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** BIND: A Problem with Trust Anchor Management Can Cause named to Crash *** --------------------------------------------- BIND servers which are configured to perform DNSSEC validation and which are using managed-keys (which occurs implicitly when using "dnssec-validation auto;" or "dnssec-lookaside auto;") may terminate with an assertion failure when . --------------------------------------------- https://kb.isc.org/article/AA-01235/0 *** OWASP AppSensor - implement real-time intrusion detection within in your software *** --------------------------------------------- Free, open source, DevOps friendly and cloud compatible AppSensor provides real-time application-layer attack detection and response. --------------------------------------------- https://www.owasp.org/images/8/8e/Appsensor_intro_for_developers.pdf *** Lenovo-Laptops durch Superfish-Adware angreifbar *** --------------------------------------------- Eine Adware namens Superfish wird offenbar schon seit mehreren Monaten auf Laptops von Lenovo ausgeliefert. Diese fügt Werbung in fremde Webseiten ein und installiert dafür ein Root-Zertifikat - eine riesige Sicherheitslücke. --------------------------------------------- http://www.golem.de/news/adware-lenovo-laptops-durch-superfish-adware-angre… *** Macros? Really?! *** --------------------------------------------- .. macro-based malware is now making a "successful" comeback. Last week, we saw a significant Dridex malware run that was using macros in Excel files (.XLSM), and earlier this week, the crooks behind the banking spyware "Vawtraq" started to spam the usual "Fedex Package" and "Tax Refund" emails, .. --------------------------------------------- https://isc.sans.edu/diary/Macros%3F+Really%3F!/19349 *** Automating Removal of Java Obfuscation *** --------------------------------------------- In this post we detail a method to improve analysis of Java code for a particular obfuscator, we document the process that was followed and demonstrate the results of automating our method. Obscurity will not stop an attacker and once the method is known, methodology can be developed to automate the process. --------------------------------------------- http://www.contextis.com/resources/blog/automating-removal-java-obfuscation/ *** IETF: RC4 in TLS offiziell nicht mehr erlaubt *** --------------------------------------------- Die RC4-Verschlüsselung darf laut dem neuen RFC 7465 nicht mehr für TLS-Verbindungen genutzt werden. Der Algorithmus gilt schon lange als problematisch, Details über neue Angriffe sollen in Kürze veröffentlicht werden. --------------------------------------------- http://www.golem.de/news/ietf-rc4-in-tls-offiziell-nicht-mehr-erlaubt-1502-… *** Cross-Site Tracing (XST): The misunderstood vulnerability *** --------------------------------------------- Alas, the 'XS' in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript. (Thankfully, character encoding attacks have avoided the term Cross-Site Unicode, XSU.) Although XST attacks rely on browser scripting .. --------------------------------------------- http://deadliestwebattacks.com/2010/05/18/cross-site-tracing-xst-the-misund… *** Duplicator 0.5.8 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7799 *** Technology doping: Competitive advantage by abusing security flaws in smart sports equipment *** --------------------------------------------- The term 'Technology doping' has recently been used [1] to mean the practice of gaining a competitive advantage through using sports equipment e.g. The LZR Racer bodysuit [2] that was used by many of the swimmers during the Beijing Olympics, resulting in world records being broken. Shortly afterwards, FINA (Federation Internationale de Natation), the international .. --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/technology-doping-competitive-adva… *** l+f: Geklonte SSH-Schlüssel sind böse *** --------------------------------------------- Tausende von Geräten im Netz verwenden ein und den selben SSH-Schlüssel. Das birgt Gefahren. --------------------------------------------- http://heise.de/-2555229 *** Erpressungs-Software im Aufstieg: Wenn Daten zur Geisel werden *** --------------------------------------------- Immer mehr Kriminelle setzen auf "Ransomware", um Lösegeld zu erpressen. Ihr nächstes Ziel: Mobiltelefone. --------------------------------------------- http://derstandard.at/2000011389615

1 0

Tageszusammenfassung - Mittwoch 18-02-2015
by Daily end-of-shift report 18 Feb '15

18 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-02-2015 18:00 − Mittwoch 18-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Sicher surfen trotz Android 4.3 *** --------------------------------------------- Der WebView-Bug von Android 4.3 könnte sich stärker auswirken als bisher bekannt. Auch wenn die Angriffsszenarien bisher nur theoretische Proof-of-Concepts sind, sollten Sie ein paar Vorsichtsmaßnahmen ergreifen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicher-surfen-trotz-Android-4-3-2552… *** Bug des Tages: Der FreeBSD-Zufallszahlengenerator war ... *** --------------------------------------------- Bug des Tages: Der FreeBSD-Zufallszahlengenerator war seit vier Monaten kaputt. Das betrifft glaube ich nur FreeBSD-current. Wer in der Zeit PGP- oder SSH- oder sonstige Krypto-Keys generiert hat, sollte die dann wohl auch mal zurückrufen und neue machen. --------------------------------------------- http://blog.fefe.de/?ts=aa1d7111 *** Fuzzing for MS15-010 *** --------------------------------------------- Intro This past Patch Tuesday Microsoft released MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution. This patch addressed multiple privately reported vulnerabilities in .. --------------------------------------------- http://blog.beyondtrust.com/fuzzing-for-ms15-010 *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-01 *** Siemens SIMATIC WinCC TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC WinCC TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-02 *** Yokogawa HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library utilized in Yokogawa's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-03 *** D-Link DSL-2640B DNS hijacking *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/100955 *** Duplicate SSH Keys Everywhere *** --------------------------------------------- Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. --------------------------------------------- https://blog.shodan.io/duplicate-ssh-keys-everywhere/ *** Beware of fake Facebook "Copyright Violations" warnings *** --------------------------------------------- The latest Facebook-themed phishing messages doing rounds are trying to trick users into believing they are "making copyright violations" on their Facebook page. "Please review your .. --------------------------------------------- http://www.net-security.org/secworld.php *** Microsoft wirbt mit Sicherheit nach ISO 27018 *** --------------------------------------------- Microsofts Cloud-Dienste Office 365 und Dynamics CRM Online sind von dem British Standards Institute (BSI) nach den Sicherheitsstandards zertifiziert worden, wie sie in ISO/IEC 27018 definiert sind. Diese Standards sollen für Microsoft weltweit gelten. Azure hat bereits eine solche .. --------------------------------------------- http://www.golem.de/news/cloud-dienste-microsoft-wirbt-mit-sicherheit-nach-… *** Kippo Modifications - New Features *** --------------------------------------------- Since summer last year I've been working on extensions and contributions to the well known Kippo honeypot developed by desaster. ... New Features: SFTP support, Exec support, SSH tunnelling (direct-tcpip) support, SSH Fingerprint .. --------------------------------------------- http://www.micheloosterhof.com/kippo-modifications/ *** ENISA's recommendations for Certifying ICS/SCADA professionals *** --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa2019s-recommendations-… *** Die Geister, die ich rief: Netgear-Router über Genie-App angreifbar *** --------------------------------------------- Eine Reihe von Netgear-Routerm plaudern durch die Schnittstelle für die Fernwartungs-App Genie wichtige Informationen über das eigene Netzwerk aus. Unter anderem können Angreifer aus dem Netz so Passwörter auslesen. --------------------------------------------- http://heise.de/-2553224

1 0

Tageszusammenfassung - Dienstag 17-02-2015
by Daily end-of-shift report 17 Feb '15

17 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-02-2015 18:00 − Dienstag 17-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** HITBSecConf2015 Amsterdam *** --------------------------------------------- Held once again at De Beurs van Berlage, HITB2015AMS takes place from the 26th till the 29th of May 2015 and runs alongside HITB Haxpo - our 3-day technology expo for hackers, makers, builders and breakers. --------------------------------------------- http://conference.hitb.org/hitbsecconf2015ams/ *** Anunak (aka Carbanak) Update *** --------------------------------------------- ... basically Anunak is the name the malware author gave to the main malware used in these attacks. Carbanak is the name the AV industry gave to this malware, which is a combination of the .. --------------------------------------------- http://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/ *** HTTP Strict Transport Security comes to Internet Explorer *** --------------------------------------------- As part of our ongoing commitment to help build an interoperable, secure web that just works, were excited to announce support for HTTP Strict Transport Security (HSTS) in Internet Explorer. This change can be previewed using Internet Explorer in the Windows 10 Technical Preview, and will come to Project Spartan in a later update. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-securit… *** TYPO3-EXT-SA-2015-005: Cross-Site Scripting in extension Gridelements (gridelements) *** --------------------------------------------- The extension fails to properly escape user input in HTML context. Backend Editor permissions with access to any text field within any data table are required to exploit this vulnerability. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** MongoDB: Tipps für sichere Benutzung veröffentlicht *** --------------------------------------------- Nach Schlagzeilen über ungesicherte Online-Installationen der Datenbank MongoDB gibt der Hersteller der kommerziellen Variante Sicherheits-Empfehlungen. Sie zeigen, wie man die populäre Software ohne Datenleck übers Netz nutzen kann. --------------------------------------------- http://www.heise.de/newsticker/meldung/MongoDB-Tipps-fuer-sichere-Benutzung… *** TYPO3: Important Security-Bulletin Pre-Announcement *** --------------------------------------------- A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. --------------------------------------------- http://typo3.org/news/article/important-security-bulletin-pre-announcement/ *** Bericht: Lightning-Anschluss gehackt *** --------------------------------------------- Einem Entwickler hat es geschafft, den von Apple verwendeten Sicherheitschip für die Anschlusskabel von iPhone und Co. teilweise zu entschlüsseln und eine serielle Konsole aufzurufen. Das könnte zu ganz neuen Angriffsformen führen. --------------------------------------------- http://heise.de/-2550921 *** Defeating TrueCrypt: Practical Attacks against TrueCrypt Security *** --------------------------------------------- The need to defend confidentiality of our sensitive information against persistently rising cyber threats has turned most of us toward using encryption on a daily basis. This is facilitated by easy-to-use GUI tools like TrueCrypt that offer advanced encryption without hassles. TrueCrypt .. --------------------------------------------- http://resources.infosecinstitute.com/defeating-truecrypt-practical-attacks… *** SSA-315836 (Last Update 2015-02-17): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V12 and V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Vawtrack malware peddlers turn to malicious macros *** --------------------------------------------- Cybercriminals spreading new versions of the Vawtrak banking Trojan are the latest ones to use the once again popular macro-based attack. Popular in the early 2000s, this type of attack was abandon... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2967 *** APT Groups Emerging in Middle East *** --------------------------------------------- Since security researchers and vendors began exposing the inner workings of APT groups a few years ago, virtually all of the operations that have been made public have been the work of attackers in Europe, Asia or North America. But .. --------------------------------------------- http://threatpost.com/apt-groups-emerging-in-middle-east/111124 *** Inside nls_933w.dll, the Equation APT Persistence Module *** --------------------------------------------- The persistence module used by the Equation APT Group uncovered by researchers at Kaspersky Lab has been called the ultimate cyberattack tool. --------------------------------------------- http://threatpost.com/inside-nls_933w-dll-the-equation-apt-persistence-modu… *** Keeping Up with SSL *** --------------------------------------------- SSL is becoming an evermore important aspect of serving and consuming content on the Internet, so its only fit that Shodan extends the information that it gathers for every SSL-capable service. The banners for SSL services, such as HTTPS, have included the certificate in PEM format for a long time and youve been able to access that data through the REST API or real-time stream. --------------------------------------------- https://blog.shodan.io/ssl-update/

1 0

Tageszusammenfassung - Montag 16-02-2015
by Daily end-of-shift report 16 Feb '15

16 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-02-2015 18:00 − Montag 16-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Microsoft February Patch Failures Continue: KB3023607 vs. Cisco AnyConnect Client *** --------------------------------------------- Another patch released by Microsoft this month is causing problems. This time it is KB3023607,which was supposed to mitigate the POODLE vulnerability. Once applied, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19331 *** PostgreSQL Bugs Let Remote Authenticated Users Obtain Potentially Sensitive Information, Execute Arbitrary Code, and Deny Service *** --------------------------------------------- Several vulnerabilities were reported in PostgreSQL. A remote authenticated user can execute arbitrary code on the target system. A remote authenticated user can cause denial of service conditions. A remote authenticated user can obtain .. --------------------------------------------- http://www.securitytracker.com/id/1031742 *** SSA-234789 (Last Update 2015-02-13): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerShell: Better phishing for all! *** --------------------------------------------- PowerShell is able to import functions from any DLL, this allows you to use functions like VirtualAlloc, memset and CreateThread. This will allow you to allocate executable memory, fill it with your program and execute it. --------------------------------------------- http://d.uijn.nl/?p=116 *** Analysis of the Fancybox-For-WordPress Vulnerability *** --------------------------------------------- We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the details explaining how attackers could use this .. --------------------------------------------- http://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulne… *** Probleme mit Windows RT: Microsoft zieht PowerPoint-Patch zurück *** --------------------------------------------- Per Patch wollte Microsoft die Stabilität von PowerPoint verbessern. Nutzer von Windows RT-Geräten hatten jedoch nach der Installation des Patches berichtet, dass sich Powerpoint nicht mehr starten lasse. Jetzt hat Microsoft den Patch zurückgezogen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Probleme-mit-Windows-RT-Microsoft-zi… *** Sicherheitslücke in Gruppenrichtlinien: Mit dem Patchen allein ist es nicht getan *** --------------------------------------------- Admins aufgepasst: Eines der am Februar-Patchday ausgelieferten Updates schützt nur, wenn man eine Reihe von Anweisungen befolgt. Tut man das nicht, bleibt die Infrastruktur für Man-in-the-Middle-Angriffe anfällig. --------------------------------------------- http://heise.de/-2550209 *** The Great Bank Heist, or Death by 1,000 Cuts? *** --------------------------------------------- I received a number of media requests and emails from readers over the weekend to comment on a front-page New York Times story about an organized gang of cybercriminals pulling off 'one of the largest bank heists ever.' Turns out, I reported on this gang's activities in December 2014, although my story ran minus many of the superlatives in the Times piece. --------------------------------------------- http://krebsonsecurity.com/2015/02/the-great-bank-heist-or-death-by-1000-cu… *** The research: Mobile Internet traffic hijacking via GTP and GRX *** --------------------------------------------- Most users assume that mobile network access is much safer because a big mobile-telecoms provider will protect subscribers. Unfortunately, as practice shows, mobile Internet is a great opportunity for the attacker. --------------------------------------------- http://blog.ptsecurity.com/2015/02/the-research-mobile-internet-traffic.html *** Angriffsziel Bitcoinbörse: Bter und Exco.in gehackt *** --------------------------------------------- Die Jagdsaison auf Bitcoinbörsen scheint wieder loszugehen: Unbekannte haben die Handelsplattform Bter um Coins im Wert von fast 1,5 Millionen Euro erleichtern können. Die Börse Exco.in wurde gleich aller Bitcoins beraubt. --------------------------------------------- http://heise.de/-2550175

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily February 2015