Daily May 2015

daily@lists.cert.at

1 participants
18 discussions

Tageszusammenfassung - Freitag 29-05-2015
by Daily end-of-shift report 29 May '15

29 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-05-2015 18:00 − Freitag 29-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** The Empire Strikes Back Apple - how your Mac firmware security is completely broken *** --------------------------------------------- [...] What is that hole after all? Is Dark Jedi hard to achieve on Macs? No, it's extremely easy because Apple does all the dirty work for you. What the hell am I talking about? Well, Apple's S3 suspend-resume implementation is so f*cked up that they will leave the flash protections unlocked after a suspend-resume cycle. --------------------------------------------- https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-ma… *** HITB Amsterdam Wrap-Up Day #1 *** --------------------------------------------- The HITB crew is back in the beautiful city of Amsterdam for a new edition of their security conference. Here is my wrap-up for the first day! The opening keynote was assigned to Marcia Hofmann who worked for the EFF (the Electronic Frontier Foundation). Her keynote title was: "Fighting for Internet Security in the New Crypto Wars". EFF always fight for more privacy and she reviewed the history of encryption and... --------------------------------------------- http://blog.rootshell.be/2015/05/28/hitb-amsterdam-wrap-up-day-1-2/ *** Sicherheitslücken: Fehler in der Browser-Logik *** --------------------------------------------- Mit relativ simplen Methoden ist es dem 18-jährigen Webentwickler Bas Venis gelungen, schwerwiegende Sicherheitslücken im Chrome-Browser und im Flash-Plugin aufzudecken. Er ruft andere dazu auf, nach Bugs in der Logik von Browsern zu suchen. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-fehler-in-der-browser-logik-150… *** Tor: Hidden Services leichter zu deanonymisieren *** --------------------------------------------- Das Tor-Protokoll erlaubt es Angreifern relativ einfach, die Kontrolle über die Verzeichnisserver sogenannter Hidden Services zu erlangen. Dadurch ist die Deanonymisierung von Traffic deutlich einfacher als beim Zugriff auf normale Webseiten. --------------------------------------------- http://www.golem.de/news/tor-hidden-services-leichter-zu-deanonymisieren-15… *** Crypto flaws in Blockchain Android app sent Bitcoins to the wrong address *** --------------------------------------------- A comedy of programming errors could prove catastrophic for affected users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/9dMUjIT6yyo/ *** ZyXEL schützt seine Router vor NetUSB-Lücke *** --------------------------------------------- Mit Sicherheits-Updates schließt der Netzwerkausrüster ZyXEL die kritische NetUSB-Lücke in allen betroffenen Modellen. --------------------------------------------- http://heise.de/-2671364 *** Lessons learned from Flame, three years later *** --------------------------------------------- Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. Since that, we reported on many other advanced malware platform. Looking back at the discovery of Flame, here are some lessons we learned. --------------------------------------------- http://securelist.com/blog/opinions/70149/lessons-learned-from-flame-three-… *** Phishing Gang is Audacious Manipulator *** --------------------------------------------- Cybercriminals who specialize in phishing -- or tricking people into giving up usernames and passwords at fake bank and ecommerce sites -- arent generally considered the most sophisticated crooks, but occasionally they do exhibit creativity and chutzpah. Thats most definitely the case with a phishing gang that calls itself the "Manipulaters Team", whose Web site boasts that it specializes in brand research and development. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qKqrwDK8oQ8/ *** A Drafty House: Analysis of the Current Use of AWS EC2 Security Groups *** --------------------------------------------- After a very confusing set of results from a survey we ran and exploring the new world of threat detection and incident response in AWS, we decided to go out and do a little research to see how the world was faring with the new security features in Amazon AWS. In short, we can safely say there is a good chunk of the EC2 users who left their front door open (actually with this analogy they also left their back door, side window, and garage open). Our analysis showed that users are: Using... --------------------------------------------- https://feeds.feedblitz.com/~/93538286/0/alienvault-blogs~A-Drafty-House-An… *** Stegosploit hides malicious code in images, this is the future of online attacks *** --------------------------------------------- Stegosploit is the technique developed by the security researcher Saumil Shah that allows an attacker to embed executable JavaScript code within an image. The security researcher Saumil Shah from Net Square security has presented at Hack In The Box conference in Amsterdam his Stegosploit project which allows an attacker to embed executable JavaScript code within an... --------------------------------------------- http://securityaffairs.co/wordpress/37302/hacking/stegosploit-malware-image… *** Statistics on botnet-assisted DDoS attacks in Q1 2015 *** --------------------------------------------- One popular DDoS scenario is a botnet-assisted attack. In Q1 2015, 23,095 botnet-assisted DDoS attacks were reported. These statistics refer to those botnets which were detected and analyzed by Kaspersky Lab. --------------------------------------------- http://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddo… *** Linux Kernel __driver_rfc4106_decrypt() Buffer Overflow May Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032416 *** Pivotal Cloud Foundry directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103449 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** IBM Cognos Business Intelligence Developer 10.2.1 (backURL) Open Redirect *** --------------------------------------------- Input passed via the backURL GET parameter in /p2pd/servlet/dispatch is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5244.php *** DSA-3274 virtualbox - security update *** --------------------------------------------- Jason Geffner discovered a buffer overflow in the emulated floppydisk drive, resulting in potential privilege escalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3274 *** IDS RTU 850 Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in IDS RTU 850C. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-148-01 *** Security Notice - Statement on Security Researchers Revealing Security Issues on Huawei Products in HITB SecConf *** --------------------------------------------- May 29, 2015 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Notice-Statement on the Wooyun-disclosed XSS Vulnerability in Huawei Smartphone Browser *** --------------------------------------------- May 29, 2015 17:43 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36740 *** HPSBGN03332 rev.1 - HP Operations Analytics running SSLv3, Remote Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP Operations Analytics running SSLv3. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290405142… *** HPSBMU03267 rev.2 - HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with the HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL. These vulnerabilities comprise the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290406517… *** HPSBMU03263 rev.3 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Insight Control running OpenSSL. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290408721… *** HPSBMU03261 rev.2 - HP Systems Insight Manager running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Systems Insight Manager running OpenSSL on Linux and Windows. These vulnerabilities are related to the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290410464…

1 0

Tageszusammenfassung - Donnerstag 28-05-2015
by Daily end-of-shift report 28 May '15

28 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-05-2015 18:00 − Donnerstag 28-05-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39012 http://tools.cisco.com/security/center/viewAlert.x?alertId=39013 http://tools.cisco.com/security/center/viewAlert.x?alertId=39015 http://tools.cisco.com/security/center/viewAlert.x?alertId=38349 http://tools.cisco.com/security/center/viewAlert.x?alertId=39041 http://tools.cisco.com/security/center/viewAlert.x?alertId=39042 *** Microsoft to Detect Search Protection Code as Malware *** --------------------------------------------- Microsoft security products will begin detecting software containing search protection functions and classifying it as malicious on June 1. --------------------------------------------- http://threatpost.com/microsoft-to-detect-search-protection-code-as-malware… *** ZDI-15-246: (0Day) Wavelink Emulation ConnectPro TermProxy WLTermProxyService.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation ConnectPro TermProxy. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-246/ *** ZDI-15-245: (0Day) Wavelink Emulation License Server LicenseServer.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation License Server. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-245/ *** Ransomware threat Locker has sleeper component *** --------------------------------------------- KnowBe4 is alerting IT managers to be vigilant of a new ransomware threat that leverages a sleeper function. --------------------------------------------- http://www.scmagazine.com/alert-warns-it-managers-of-locker-ransomware/arti… *** Apple iOS Notification Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032408 *** Angler exploit kit pushing CryptoWall 3.0, (Thu, May 28th) *** --------------------------------------------- In the past two days, Ive infected two hosts from Angler exploit kit (EK) domains at 216.245.213.0/24. Both hosts were infected with CryptoWall 3.0 ransomware using the same bitcoin address for the ransom payment: 16Z6sidfLrfNoxJNu4qM5zhRttJEUD3XoB On Tuesday, 2015-05-26 at 15:17 UTC, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19737 *** APPLE-SA-2015-05-27-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00002.ht… *** Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities *** --------------------------------------------- Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities Multiple vulnerabilities in OpenSSL versions before 1.0.1m and 0.9.8zf (SPL-98351) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on .. --------------------------------------------- http://www.splunk.com/view/SP-CAAAN4P *** Grabit and the RATs *** --------------------------------------------- Not so long ago, Kaspersky clients in the United States approached Kaspersky researchers with a request to investigate a new type of malicious software that they were able to recover from their organizations' servers. The malware calls itself Grabit. --------------------------------------------- http://securelist.com/blog/research/70087/grabit-and-the-rats/ *** Trend Micro Discovers Apache Cordova Vulnerability that Allows One-Click Modification of Android Apps *** --------------------------------------------- We've discovered a vulnerability in the Apache Cordova app framework that allows attackers to modify the behavior of apps just by clicking a URL. The extent of the modifications can range from causing nuisance for app users to crashing the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** SAP HANA Log Injection *** --------------------------------------------- Under certain conditions the SAP HANA XS engine is vulnerable to arbitrary log injection, allowing remote authenticated attackers to write arbitrary information in log files. This could be .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050172 *** SAP HANA Information Disclosure *** --------------------------------------------- Under certain conditions some SAP HANA Database commands could be abused by a remote authenticated attacker to access information which is restricted. This could be used to gain access .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050171 *** SOPHOS WAF JSON Filter Bypass *** --------------------------------------------- Topic: SOPHOS WAF JSON Filter Bypass Risk: Low Text:SECURITYLABS INTELLIGENT RESEARCH - SECURITY ADVISORY http://www.securitylabs.com.br/ ADVISORY/0115 - SOPHOS WAF (WEBSERV... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050169 *** Phishers register domain names, hammer traditional targets *** --------------------------------------------- The number of domain names used for phishing reached an all-time high, according to a new report by the the Anti-Phishing Working Group (APWG). Many of these were registered by .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18429 *** Crash-Benachrichtigung für iOS-Geräte: Apple stellt Bugfix in Aussicht *** --------------------------------------------- Apple will den 'Unicode of Death'-Fehler, der iPhone und iPad durch eine bestimmte Zeichenfolge zum Absturz bringt, mit einem Software-Update beheben - das Problem betrifft weit mehr als nur iMessage. --------------------------------------------- http://heise.de/-2669432 *** Oracle PeopleSoft admin credentials open to hackers *** --------------------------------------------- SAP Security experts discovered a number of unpatched vulnerabilities and weaknesses in Oracle PeopleSoft that could be exploited to obtain admin passwords. The SAP security experts, Alexander Polyakov and Alexey Tyurin, revealed that Oracle .. --------------------------------------------- http://securityaffairs.co/wordpress/37270/hacking/oracle-peoplesoft-vulnera… *** Bugtraq: [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices *** --------------------------------------------- http://www.securityfocus.com/archive/1/535626 *** IDS, IPS and UTM - What's the Difference? *** --------------------------------------------- In our last webcast, we learned about lingering and general confusion over these crazy acronyms IDS and IPS, and how they are like or unlike UTM software modules. Everyone likes primers and simple descriptive definitions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/ids-ips-and-utm-whats-…

1 0

Tageszusammenfassung - Mittwoch 27-05-2015
by Daily end-of-shift report 27 May '15

27 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-05-2015 18:00 − Mittwoch 27-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** This is not the UEFI backdoor you are looking for *** --------------------------------------------- This is currently the top story on the Linux subreddit. It links to this Tweet which demonstrates using a System Management Mode backdoor to perform privilege escalation under Linux. This is not a story.But first, some background. System Management Mode (SMM) is a feature in most x86 processors since the 386SL back in 1990. It allows for certain events to cause the CPU to stop executing the OS, jump to an area of hidden RAM and execute code there instead, and then hand off back to the OS... --------------------------------------------- http://mjg59.dreamwidth.org/35110.html *** Breach detection: Five fatal flaws and how to avoid them *** --------------------------------------------- When the Sarbanes-Oxley Act of 2002 was passed, it fell on corporate security teams to translate its requirements into technical controls. That threw the IT Security function into the deep end of the ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uoHRSOyKltE/article.php *** Five Mistakes MSSPs Should Avoid *** --------------------------------------------- MSSPs, or Managed Security Service Providers, are at an exciting point where market acceptance, awareness and demand have converged. I view this as a positive for a potential MSSP but also for the customers and businesses they will protect, enhancing security for everyone. However, excitement and the prospect of profits can create haste, and with haste comes an increased risk of mistakes. In my role at AlienVault, Ive been fortunate enough to work with and help ensure the success of a number of... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/five-mistakes-mssps-sh… *** Over 30% of Official Images in Docker Hub Contain High Priority Security Vulnerabilities *** --------------------------------------------- Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of official repositories contain images that are highly susceptible to a variety of security attacks (e.g., Shellshock, Heartbleed, Poodle, etc.). For general images... --------------------------------------------- http://www.banyanops.com/blog/analyzing-docker-hub/ *** Jetzt patchen: Synology-NAS über Fotoalbum angreifbar *** --------------------------------------------- Synologys Web-Fotoalbum Photo Station gewährt Angreifern ungewollt Zugriff auf DiskStation NAS-Systeme. Wer nicht will, dass Fremde beliebigen Code auf dem eigenen NAS ausführen, sollte den Patch des Herstellers jetzt einspielen. --------------------------------------------- http://heise.de/-2668853 *** How to Prevent a Domain Name Theft *** --------------------------------------------- 1. Introduction The domain names may cost far more than a real estate. For instance, Facebook paid USD 8.5 million to buy fb.com. The high prices of the domain names attract not only businesses, but also thieves. The domain name theft can be huge trouble for companies because it effects their brand and reputation. This... --------------------------------------------- http://resources.infosecinstitute.com/how-to-prevent-a-domain-name-theft/ *** SQL-Injection-Lücke in xt:Commerce *** --------------------------------------------- Sicherheitsupdates schließen in der Shop-Software eine Lücke, durch die Angreifer potenziell Datenbankbefehle einschleusen können. --------------------------------------------- http://heise.de/-2667569 *** Possible Wordpress Botnet C&C: errorcontent.com, (Tue, May 26th) *** --------------------------------------------- Thanks to one of our readers, for sending us this snipped of PHP he found on a Wordpress server (I added some line breaks and comments in red for readability): #2b8008# ">">/* turn off error reporting */ @ini_set(display_errors ">/* do not display errors to the user */ $wp_mezd8610 = @$_SERVER[HTTP_USER_AGENT">/* only run the code if this is Chrome or IE and not a bot */ if (( preg_match (/Gecko|MSIE/i, $wp_mezd8610) !preg_match (/bot/i, $wp_mezd8610))) { --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19733&rss *** Researchers Exploit Patched Windows Group Policy Bug *** --------------------------------------------- Researchers from Core Security were able to exploit a security vulnerability in Windows group policy -- MS15-011 -- that was patched by Microsoft in February. --------------------------------------------- http://threatpost.com/researchers-exploit-patched-windows-group-policy-bug/… *** Online-Dienst erstellt maßgeschneiderte Krypto-Trojaner *** --------------------------------------------- Die Einstiegshürde für angehende Online-Erpresser ist erneut gesunken: Ein Dienst im Tor-Netz erstellt nach wenigen Klicks den individuellen Erpressungs-Trojaner. Falls ein Opfer das geforderte Lösegeld zahlt, verdienen die Betreiber mit. --------------------------------------------- http://heise.de/-2668860 *** Security: Zwei neue Exploits auf Router entdeckt *** --------------------------------------------- Unsichere Router sind aktuell von gleich zwei Versionen von Malware bedroht. Die eine verteilt Spam über soziale Medien, die andere leitet Anfragen auf manipulierte Webseiten um. (Router, Virus) --------------------------------------------- http://www.golem.de/news/security-zwei-neue-exploits-auf-router-entdeckt-15… *** extjs Arbitrary File Read / ssrf Vulnerability *** --------------------------------------------- Topic: extjs Arbitrary File Read / ssrf Vulnerability Risk: High Text:Hi all： Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050162 *** USN-2622-1: OpenLDAP vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2622-126th May, 2015openldap vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryOpenLDAP could be made to crash if it received specially crafted networktraffic.Software description openldap - OpenLDAP utilities DetailsIt was discovered that OpenLDAP incorrectly handled certain search queriesthat returned empty attributes. A remote attacker could use this issue tocause... --------------------------------------------- http://www.ubuntu.com/usn/usn-2622-1/ *** Cisco IP Phone 7861 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39011 *** ZDI-15-240: Dell NetVault Backup Heap Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell NetVault Backup. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/y6osEWmyti0/ *** ZDI-15-244: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicies Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NFGleCbsATc/ *** ZDI-15-243: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicy Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OV8j2fD9GSM/ *** ZDI-15-242: Arcserve Unified Data Protection Management Service exportServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/CxxqPV5u-0s/ *** ZDI-15-241: Arcserve Unified Data Protection Management Service reportFileServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/MNmtjnSQ_b4/ *** SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information --------------------------------------------- http://www.securitytracker.com/id/1032402 *** Security Advisory: Point-to-Point Protocol (PPP) vulnerability CVE-2015-3310 *** --------------------------------------------- (SOL16686) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/600/sol16686.htm… *** lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries *** --------------------------------------------- lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries --------------------------------------------- http://www.securitytracker.com/id/1032405 *** Rockwell Automation RSView32 Weak Encryption Algorithm on Passwords *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on May 12, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a password encryption vulnerability in RSView32. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02 *** Thycotic Password Manager Secret Server iOS Application MITM *** --------------------------------------------- Topic: Thycotic Password Manager Secret Server iOS Application MITM Risk: Medium Text:Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability -- http://www.info-sec.ca/adviso... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050167

1 0

Tageszusammenfassung - Dienstag 26-05-2015
by Daily end-of-shift report 26 May '15

26 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-05-2015 18:00 − Dienstag 26-05-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Annual Privacy Forum 2015: Call for Papers and latest news *** --------------------------------------------- The Annual Privacy Forum (APF) meeting will be taking place on the 7th and 8th of October 2015 in Luxembourg, during its Presidency of the Council of the EU. This year, the main focus of the APF will be on privacy of electronic communications. Current open calls:... --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2015-call-… *** Securing Web APIs: The Basics with Node.js Examples *** --------------------------------------------- Introduction Public-facing APIs have tremendously increased in the last couple of years. Businesses have seen that sharing their business data with the public can be beneficial. There are many reasons for this: such as the fact that it allows the API users to create something new and interesting with the shared data, and that APIs... --------------------------------------------- http://resources.infosecinstitute.com/securing-web-apis-the-basics-with-nod… *** Android: Schlüssel werden auf zurückgesetzten Smartphones nicht gelöscht *** --------------------------------------------- Auf zurückgesetzten Android-Smartphones lassen sich Daten wiederherstellen, auch auf solchen, die zuvor verschlüsselt wurden. Anwender können kaum etwas dagegen tun. --------------------------------------------- http://www.golem.de/news/android-schluessel-werden-auf-zurueckgesetzten-sma… *** Recent Breaches a Boon to Extortionists *** --------------------------------------------- The recent breaches involving the leak of personal data on millions of customers at online hookup site Adult Friend Finder and mobile spyware maker mSpy give extortionists and blackmailers plenty of ammunition with which to ply their trade. And there is some evidence that neer-do-wells are actively trading this data and planning to abuse it for financial gain. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/spK0KOTLf64/ *** Travel smart: Tips for staying secure on the road *** --------------------------------------------- Cybercriminals dont take vacations. In fact, they feast on tourists and travelers, taking advantage of people when their guards are down or when theyre distracted by other pursuits. Wombat Security Technologies pulled together four essential tips from our security awareness and training materials that you can use to stay safe when you travel --------------------------------------------- http://www.net-security.org/secworld.php?id=18421 *** How to Pass-the-Hash with Mimikatz *** --------------------------------------------- A hidden gem in mimikatz is its ability to create a trust relationship from a username and password hash. --------------------------------------------- http://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/ *** Windows Functions in Malware Analysis - Cheat Sheet - Part 1 *** --------------------------------------------- In this article, we will learn briefly about the various windows functions commonly encountered by malware analysts. Windows Functions Accept: This function is used to listen for incoming connections. This function indicates that the program will listen for incoming connections on a socket. It is mostly used by malware to communicate with their Command and... --------------------------------------------- http://resources.infosecinstitute.com/windows-functions-in-malware-analysis… *** Exploit-Kit greift über 50 Router-Modelle an *** --------------------------------------------- Wer einen unsicher konfigurierten Router betreibt, könnte schon bald Probleme bekommen: Ein Virenforscher hat ein Exploit-Kit entdeckt, das zahlreiche Router-Modelle bekannter Hersteller angreifen kann. --------------------------------------------- http://heise.de/-2665387 *** How often should companies conduct web penetration testing? *** --------------------------------------------- Following our previous blog post "How long does website penetration testing take" we received a lot of questions from our customers and partners about the recommended frequency of penetration testing for their web applications. In this blog post we will answer that question. --------------------------------------------- https://www.htbridge.com/blog/how_often_conduct_web_penetration_testing.html *** Cisco Unified Communications Manager Multiple Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38964 *** Cisco HCS Administrative Web Interface Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38969 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** PostgreSQL Bugs Let Remote Users Deny Service and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032396 *** Cacti Input Validation Flaw in graph.php Lets Remote Authenticated Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032385 *** VU#551972: Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files *** --------------------------------------------- Vulnerability Note VU#551972 Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files Original Release date: 26 May 2015 | Last revised: 26 May 2015 Overview The Synology Cloud Station sync client for OS X contains a setuid root executable that allows regular users to claim ownership of system files. Description CWE-276: Incorrect Default Permissions - CVE-2015-2851The Synology Cloud Station sync client for OS X contains an executable named --------------------------------------------- http://www.kb.cert.org/vuls/id/551972 *** Bugtraq: Synology Photo Station multiple Cross-Site Scripting vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535607 *** Bugtraq: Reflected Cross-Site Scripting in Synology DiskStation Manager *** --------------------------------------------- http://www.securityfocus.com/archive/1/535606 *** Bugtraq: Command injection vulnerability in Synology Photo Station *** --------------------------------------------- http://www.securityfocus.com/archive/1/535605 *** HP SiteScope Unspecified Flaw Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1032395 *** GigPress <= 2.3.8 - Authenticated SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8003 *** NewStatPress 0.9.8 - XSS and SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8004

1 0

Tageszusammenfassung - Freitag 22-05-2015
by Daily end-of-shift report 22 May '15

22 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-05-2015 18:00 − Freitag 22-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake jQuery Scripts in Nulled WordPress Plugins *** --------------------------------------------- We recently investigated some random redirects on a WordPress website that would only happen to certain visitors. Traffic analysis showed us that it was not a server-side redirect, rather it happened due to some script loaded by the web pages. A quick look through the HTML code revealed this script: It was very suspicious for... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NmLDakrD_1U/fake-jquery-scrip… *** Researchers publish developer guidance for medical device security *** --------------------------------------------- The guidance is organized into 10 categories, and serves as "starting point for a more complete code," report authors said. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/jvWoZydXqwc/ *** Researchers observe SVG files being used to distribute ransomware *** --------------------------------------------- When downloaded and executed, the SVG files cause websites to open up that download what appears to be CryptoWall ransomware. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Aa-yVI5Bd-A/ *** Exploring CVE-2015-1701 - A Win32k Elevation of Privilege Vulnerability Used in Targeted Attacks *** --------------------------------------------- Our analysis of the win32k.sys vulnerability used in a recent targeted attack reveals that it opens up an easy way to bypass the sandbox, making it a bigger threat than originally thought. As mentioned in Microsoft security bulletin MS15-051, CVE-2015-1701 is an elevation of privilege vulnerability that exists when the Win32k.sys kernel-mode driver improperly handles... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RuzGqW0kQdY/ *** Digital Agenda Seminar: European Cyber Security Month *** --------------------------------------------- Within the context of European Cyber Security Month (ECSM) preparations, the ENISA team is organising several seminars and trainings in order to build up the coalition for Cybersecurity Education action. You are invited to participate in the second seminar in Berlin, Germany on June 5th, 2015. In this half-day seminar we discuss and provide the latest information on Digital Agenda topics such as e-skills, Network Information Security, educational tools and advocacy initiatives. To participate it is necessary to confirm participation to daria.catalui(a)enisa.europa.eu by June 4th, 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/digital-agenda-seminar-european… *** Daten von Millionen zurückgesetzten Android-Smartphones wiederherstellbar *** --------------------------------------------- Wer sein Android-Smartphone verkauft hat, muss befürchten, dass trotz gelöschten Gerätespeichers noch private Daten wie etwa Nachrichten und Log-in-Daten im Speicher schlummern, die unter Umständen wiedergehergestellt werden können. --------------------------------------------- http://heise.de/-2663267 *** Forensic Analysis of Smartphone Factory Reset Function *** --------------------------------------------- ADISA, the organisation that sets security standards around the secure disposal of IT Assets, has released new research into the forensic analysis of smartphone factory reset functions. Written by Steve Mellings, Founder of ADISA, and Professor Andrew Blyth of the University of South Wales, the white paper explores how effective smartphone factory reset functions actually are at removing data. This data is then used to offer businesses and individual users advice on how best to protect their... --------------------------------------------- http://www.informationsecuritybuzz.com/forensic-analysis-of-smartphone-fact… *** When Security Makes Users Asleep! *** --------------------------------------------- It's a fact, in industries or on building sites, professional people make mistakes or, worse, get injured. Why? Because their attention is reduced at a certain point. When you're doing the same job all day long, you get tired and lack of concentration. The same can apply in information security! For a long time, more and more solutions are deployed in companies to protect their data and users. Just... --------------------------------------------- http://blog.rootshell.be/2015/05/22/when-security-makes-users-asleep/ *** Citrix Security Advisory for DHE_EXPORT TLS Vulnerability CVE-2015-4000 *** --------------------------------------------- A TLS protocol vulnerability has been recently disclosed that could result in attackers being able to intercept and modify SSL/TLS encrypted traffic ... --------------------------------------------- http://support.citrix.com/article/CTX201114 *** Citrix Security Advisory for CVE-2015-3456 *** --------------------------------------------- Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the ... --------------------------------------------- http://support.citrix.com/article/CTX201078 *** python-kerberos checkPassword() spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103310 *** Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38946 *** ICU Buffer Overflows in resolveImplicitLevels() Let Remote Users Deny Service and Potentially Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032366 *** Schneider Electric OFS Server Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a DLL hijacking vulnerability in the Schneider Electric OPC Factory Server (OFS) server application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 *** Emerson AMS Device Manager SQL Injection Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an SQL injection vulnerability in the Emerson AMS Device Manager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 *** OleumTech WIO Family Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-202-01 OleumTech WIO Family Vulnerabilities that was published July 21, 2014. This advisory provides vulnerability details in the OleumTech WIO family including the sensors and the DH2 data collector. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-202-01A *** HPSBMU03336 rev.1- HP Helion OpenStack affected by VENOM, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has identitfied with HP Helion OpenStack. The vulnerability could be exploited resulting in Denial of Service (DoS) or execution of arbitrary code. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c… *Next End-of-Shift report on 2015-05-26*

1 0

Tageszusammenfassung - Donnerstag 21-05-2015
by Daily end-of-shift report 21 May '15

21 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-05-2015 18:00 − Donnerstag 21-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RIG Exploit Kit Infection Cycle Analysis *** --------------------------------------------- Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes weve observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post well cover an example of a full RIG infection cycle. Delivery... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JM9Mp15Wupg/rig-exploit-… *** New Router Attack Displays Fake Warning Messages *** --------------------------------------------- Just because security researchers report about threats doesn't mean we're exempted from them. I recently experienced an incident at home that involved tampered DNS router settings. I was redirected to warning pages that strongly resemble those used in previous FAKEAV attacks. I noticed that my home internet router DNS settings have been modified from its default settings. (My router... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/dJj2wXBlvgk/ *** Exploit kits delivering Necurs, (Thu, May 21st) *** --------------------------------------------- Introduction In the past few days, weve seenNuclear and Anglerexploit kits (EKs) deliveringmalware identified as Necurs. It certainly isntthe only payload sentfrom Nuclear and otherEKs, but I hadnt really looked into EK traffic sending Necurs lately. Documented as early as 2012, Necurs is a type of malware that opens a back door on the infected computer [1]. It may also disable antivirus products as well as download additional malware [1][2]. I sawNecurs as a malware payload from Nuclear and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19719&rss *** Das Erste-Hilfe-Kit gegen Krypto-Trojaner *** --------------------------------------------- Mit einer Reihe von Werkzeugen will ein Forscher den Opfern von Erpressungs-Trojanern helfen, ihre Daten zu retten und ihre Systeme zu reinigen. Allerdings ist bei der Anwendung Vorsicht geboten. --------------------------------------------- http://heise.de/-2661154 *** Mumblehard Malware *** --------------------------------------------- Introduction In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives the full control of the infected machine to cybercriminals. Mumblehard malware -Components Perl Backdoor Perl backdoor will request for commands from its Command &Control Server and... --------------------------------------------- http://resources.infosecinstitute.com/mumblehard-malware/ *** Logjam: the latest TLS vulnerability explained *** --------------------------------------------- 21 May 2015 by Filippo Valsorda --------------------------------------------- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ *** The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange *** --------------------------------------------- Logjam is a new attack against the Diffie-Hellman key-exchange protocol used in TLS. Basically: The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html *** CVE-2015-4000 alias "Logjam" .. *** --------------------------------------------- http://www.cert.at/services/blog/20150521111403-1485.html *** Vuln: OpenSSL CVE-2015-0288 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73237 *** Vuln: OpenSSL /evp/encode.c Remote Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73228 *** Samba Memory Corruption Error in prs_append_some_prs_data() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032362 *** Cisco Security Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 *** Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38937 *** Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 *** DSA-3265 zendframework - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in Zend Framework, a PHPframework. Except for CVE-2015-3154, all these issues were already fixedin the version initially shipped with Jessie. --------------------------------------------- https://www.debian.org/security/2015/dsa-3265

1 0

Tageszusammenfassung - Mittwoch 20-05-2015
by Daily end-of-shift report 20 May '15

20 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-05-2015 18:00 − Mittwoch 20-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS, (Wed, May 20th) *** --------------------------------------------- Theres a new vulnerability in town... As reported by the Wall Street Journal, The new bug, dubbed LogJam, is a cousin of Freak. But its in the basic design of TLS itself, meaning all Web browsers, and some email servers, are vulnerable. [1] According to the article, Internet-security experts crafted a fix for a previously undisclosed bug in security tools used by all modern Web browsers. But deploying the fix could break the Internet for thousands of websites. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19717&rss *** Logjam: PFS Deployment Guide *** --------------------------------------------- Guide to Deploying Diffie-Hellman for TLS | Our study finds that the current real-world deployment of Diffie-Hellman is less secure than previously believed. This page explains how to properly deploy Diffie-Hellman on your server. | We have three recommendations for correctly deploying Diffie-Hellman for TLS:... --------------------------------------------- https://weakdh.org/sysadmin.html *** DDoS Attacks on the rise in Q1 2015, says Akamai *** --------------------------------------------- DDoS attacks even more dangerous according to the last report published by Akamai Technologies, the "Q1 2015 State of the Internet - Security Report". According to Akamai Technologies, Q1 2015 showed that distributed denial-of-service attacks are on the rise again, and according to Akamai Technologies, Q1 set a record for the number of DDoS attacks,... --------------------------------------------- http://securityaffairs.co/wordpress/36983/security/akamai-ddos-q1-2015.html *** "Los Pollos Hermanos" ransomware - what will they think of next? *** --------------------------------------------- The latest visual meme in ransomware comes from a cult TV show...about ficticious crooks. Paul Ducklin walks you through "PolloCrypt," more correctly known as Troj/LPoLock-A... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/jdSKvU31t58/ *** JSON, Homoiconicity, and Database Access *** --------------------------------------------- During a recent review of an internal web application based on the Node.js platform, we discovered that combining JavaScript Object Notation (JSON) and database access (database query generators or object-relational mappers, ORMs) creates interesting security challenges, particularly for JavaScript programming... --------------------------------------------- https://securityblog.redhat.com/2015/05/20/json-homoiconicity-and-database-… *** iOS Security Guide (iOS 8.3) *** --------------------------------------------- https://www.apple.com/business/docs/iOS_Security_Guide.pdf *** What We Learned From a Data Exfiltration Incident at an Electric Utility *** --------------------------------------------- We often hear about the dangers of a cyberattacks taking down the grid, but seldom is public information available about the loss of sensitive information, particularly from the OT. The confidential information in this case was the utilitys smart grid and metering R&D knowledge base, which is intellectual property and information that attackers can use to compromise the smart grid. --------------------------------------------- http://www.elp.com/articles/powergrid_international/print/volume-20/issue-5… *** 5 Signs Credentials In Your Network Are Being Compromised *** --------------------------------------------- Where should you start to keep ahead of attackers using insiders to steal corporate secrets or personal identifiable information? Check out these common scenarios. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/5-signs-credentials-in… *** Update soll Mac-Outlook 2011 reanimieren *** --------------------------------------------- Mit Version 14.5.1 der Office-Version 2011 für OS X will Microsoft ein Problem bei Outlook beseitigen - der E-Mail-Client ließ sich nach Installation des vorausgehehenden Updates unter Umständen nicht mehr verwenden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-soll-Mac-Outlook-2011-reanimi… *** MS15-046 - Version: 2.0 *** --------------------------------------------- V2.0 (May 19, 2015): Bulletin revised to announce the release of the Microsoft Office for Mac 14.5.1 update. The release addresses a potential issue with Microsoft Outlook for Mac when customers install the Microsoft Office for Mac 14.5.0 update. Customers who have not already installed the 14.5.0 update should install the 14.5.1 update to be fully protected from this vulnerability. To avoid the possibility of future issues with Microsoft Outlook for Mac, Microsoft recommends that customers... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-046 *** HPSBGN03286 rev.1 - HP LoadRunner, Buffer Overflow *** --------------------------------------------- A potential security vulnerability has been identified with HP LoadRunner. The vulnerability could be exploited remotely to allow a buffer overflow. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04594015 *** HPSBUX03334 SSRT102000 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679334 *** HPSBUX03333 SSRT102029 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS), or Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679309 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- 38913 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38913 *** ZDI-15-235: ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x_So65VKXQk/ *** ZDI-15-234: ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NDUhf-djzIs/ *** ZDI-15-233: Valve Steam Client Detection Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute a denial of service attack on vulnerable installations of Valve Steam. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/z6v9MWWd9O4/ *** Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities *** --------------------------------------------- Topic: Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities Risk: High Text:Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Bru... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050127 *** IPsec-Tools 0-day Denial of Service *** --------------------------------------------- Topic: IPsec-Tools 0-day Denial of Service Risk: High Text:Denial of Service in IPsec-Tools Vulnerability Report May 19, 2015 Product: IPsec-Tools Version: 0.8.2 Website: http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050128 *** Security Advisory - Two Privilege Escalation Vulnerabilities in Huawei Mate 7 Smartphones *** --------------------------------------------- May 20, 2015 14:40 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23257]: Stored XSS in WP Photo Album Plus WordPress Plugin *** --------------------------------------------- Product: WP Photo Album Plus WordPress Plugin v6.1.2Vulnerability Type: Cross-Site Scripting [CWE-79]Risk level: Medium Creater: J.N. BreetveltAdvisory Publication: April 29, 2015 [without technical details]Public Disclosure: May 20, 2015 CVE Reference: CVE-2015-3647 CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N) Vulnerability Details: High-Tech Bridge Security Research Lab discovered stored XSS vulnerability in WP Photo Album Plus WordPress plugin, which can be exploited to perform... --------------------------------------------- https://www.htbridge.com/advisory/HTB23257 *** Bugtraq: Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535576

1 0

Tageszusammenfassung - Dienstag 19-05-2015
by Daily end-of-shift report 19 May '15

19 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-05-2015 18:00 − Dienstag 19-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tracking SSL Issues with the SSL Labs API *** --------------------------------------------- The SSL and TLS protocols have been on the front of the stage for months. Besides many vulnerabilities disclosed in the OpenSSL library, the deployment of SSL and TLS is not always easy. They are weak cyphers (like RC4), weak signatures, certificates issues (self-signed, expiration or fake ones). Other useful features are mis-understood and not often not configured like PFS ("Perfect Forward Secrecy"). Encryption effectiveness is directly related... --------------------------------------------- http://blog.rootshell.be/2015/05/18/tracking-ssl-issues-with-the-ssl-labs-a… *** Magnitude Exploit Kit leading to Ransomware via Malvertising *** --------------------------------------------- Magnitude Exploit Kit is a malicious exploit package that leverages a victim's vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack, which is often leveraged on compromised websites and malicious advertising networks. We recently found a number of compromised pages following the structure of fake search engine... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/YQBX1Zq733A/magnitude-ex… *** Website Security - How Do Websites Get Hacked? *** --------------------------------------------- In 2014 the total number of websites on the internet reached 1 billion, today it's hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let's take a minute to absorb that number for a moment. Another surprising statistic is... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/w0FMyW_q_bA/website-security-… *** Cyber Security Challenge 2015 *** --------------------------------------------- Cyber Security Challenge 2015 | 19. Mai 2015 | Auch heuer gibt es wieder die Cyber Security Challenge zur Suche von Hacker-Nachwuchstalenten. 2015 wird das europäische Finale zwischen 6 Ländern ausgespielt, und Österreich muss den Titel verteidigen.Die Qualifizierungsrunde läuft heuer von 4. Mai bis 3. August und steht Schülern und Studenten offen. Details siehe www.verbotengut.at.Wir wollen wieder ein gutes Team zusammenbekommen, wir bitten daher alle Leser, diesen Hinweis... --------------------------------------------- http://www.cert.at/services/blog/20150519084602-1482.html *** Cmstar Downloader: Lurid and Enfal's New Cousin *** --------------------------------------------- In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as "Enfal". Cmstar was named for the log message "CM**" used by the downloader. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-… *** SSH-Client Putty: Trojaner-Version im Umlauf *** --------------------------------------------- Wer mit dem SSH-Client Putty auf Geräte zugreifen will, sollte auf die Quelle des Clients achten. Aktuell geistert nämlich eine Version durch das Internet, die einen Trojaner auf Computer schmuggelt, um Daten abzugreifen. --------------------------------------------- http://heise.de/-2654274 *** More on Chris Roberts and Avionics Security *** --------------------------------------------- Last month ago I blogged about security researcher Chris Roberts being detained by the FBI after tweeting about avionics security while on a United flight: But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/more_on_chris_r.html *** How much money do cyber crooks collect via crypto ransomware? *** --------------------------------------------- FireEye researchers have calculated that the cybercriminals wielding TeslaCrypt and AlphaCrypt have managed to extort $76,522 from 163 victims in only two months. "This amount may seem trivial co... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uK_6Ovw0K9M/malware_news.… *** Address spoofing Safari bug opens door for phishing attacks *** --------------------------------------------- Hacker David Leo has released a PoC exploit for a Safari vulnerability that can be misused to trick users into thinking they are on one site while they are actually on another - a boon for phishers. ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/6F6ptWfI8rw/secworld.php *** Address-Spoofing Bug Haunts Android Stock Browser *** --------------------------------------------- There's an easily exploitable vulnerability in the Android stock browser that enables an attacker to spoof the URL in the address bar and force a victim to visit a malicious site while believing he is visiting a benign one. Security researcher Rafay Baloch discovered the vulnerability and developed the technique for exploiting it. The problem... --------------------------------------------- http://threatpost.com/address-spoofing-bug-haunts-android-stock-browser/112… *** KCodes NetUSB: How a Small Taiwanese Software Company Can Impact the Security of Millions of Devices Worldwide *** --------------------------------------------- Today the SEC Consult Vulnerability Lab released an advisory regarding a vulnerability in a software component called NetUSB. This post intends to give some background information about this vulnerability.NetUSB is a proprietary technology developed by the Taiwanese company KCodes, intended to provide "USB over IP" functionality. USB devices (e.g. printers, external hard drives, flash drives) plugged into a Linux-based embedded system (e.g. a router, an access point or a dedicated... --------------------------------------------- http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html *** [2015-05-19] Critical buffer overflow vulnerability in KCodes NetUSB *** --------------------------------------------- KCodes NetUSB is vulnerable to a buffer overflow via the network that results in a denial of service or code execution. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38905 *** IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by cross-site scripting (XSS) Vulnerabilities in Dojo Toolkit *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21902837 *** Moodle Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1032358 *** Bugtraq: [SECURITY] [DSA 3175-2] kfreebsd-9 security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/535562

1 0

Tageszusammenfassung - Montag 18-05-2015
by Daily end-of-shift report 18 May '15

18 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-05-2015 18:00 − Montag 18-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyberattacks on Oil and Gas Firms Launched with no Malware at all *** --------------------------------------------- Oil and gas industry targeted by hackers with a genuine looking windows file, not a malware. The attacks are ongoing for about two years. A unique targeted attack being underway for about two consecutive years exploits Windows file functions that look legitimate and a couple of homemade scripts - but not malware - in order... --------------------------------------------- http://securityaffairs.co/wordpress/36843/cyber-crime/cyberattacks-on-oil-a… *** Microsoft Stops Chinese Group from Using TechNet Site for Attacks (May 14, 2015) *** --------------------------------------------- Microsoft and FireEye have taken steps to prevent a group of Chinese cyber criminals known as APT17 from using the companys TechNet website in its attacks... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/38/302 *** VENOM - Does it live up to the hype?, (Sat, May 16th) *** --------------------------------------------- Unless you have been hiding under a rock this week you have heard about VENOM. The first article that I saw was fromZDNet with the headline of Bigger than Heartbleed, Venom security vulnerability threatens most datacenters. Pretty provocative stuff. Is VENOM really worth that much hype? VENOM stands for Virtualized Environment Neglected Operations Manipulation. The cuteacronym basically means that the exploit takes advantage of a vulnerability in legacy code.In short thevulnerability is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19701&rss *** AEADs: getting better at symmetric cryptography *** --------------------------------------------- I gave a talk a couple of weeks ago at the Yahoo Unconference. The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer, articulation of its contents. --------------------------------------------- http://www.imperialviolet.org/2015/05/16/aeads.html *** About the supposed factoring of a 4096 bit RSA key *** --------------------------------------------- tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key. Earlier today a blog post claiming the factoring of a 4096 bit RSA key was published and quickly made it to the top of Hacker News. The key in question was the PGP key of a well-known Linux kernel developer. I already commented on Hacker News why this is most likely wrong, but I thought Id write up some more details. To understand what is going on I have to explain some background both on RSA and... --------------------------------------------- https://blog.hboeck.de/archives/872-No,-nobody-has-factored-a-4096-bit-RSA-… *** Google App Engine: Google reagiert träge auf Java-Sicherheitslücken *** --------------------------------------------- Klammheimlich patcht Google Java-Schwachstellen in seiner Entwicklungsumgebung App Engine und ignoriert den Entdecker der Lücken weitgehend. Einige Sicherheitslücken klaffen immer noch. --------------------------------------------- http://heise.de/-2652121 *** Angreifer nutzen kritische Lücke in ProFTPD aus *** --------------------------------------------- Wer den FTP-Server ProFTPD betreibt, muss handeln: Durch eine schwerwiegende Schwachstelle können Online-Ganoven beliebigen Code ausführen. Und das tun sie auch bereits. --------------------------------------------- http://heise.de/-2652114 *** Screech! Grand Theft Auto V malware mods warning *** --------------------------------------------- Gamers find themselves in latest Mods & Rockstar punch-up Cybercrooks are cooking up malware disguised as mods for the Grand Theft Auto V video game. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/18/gta_malware… *** Rombertiks disk wiping mechanism is aimed at pirates, not researchers *** --------------------------------------------- Rombertik, the information-stealing malware that was recently analyzed by Cisco researchers and which apparently tries to prevent researchers from doing so by rewriting the computers Master Boot Reco... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/oE0fh7NZ4sg/malware_news.… *** Oracle Patches VENOM Vulnerability *** --------------------------------------------- Oracle on Saturday released its patch for the VENOM vulnerability, a guest escape flaw that affects many virtualization platforms. --------------------------------------------- http://threatpost.com/oracle-patches-venom-vulnerability/112868 *** openssh 6.8p1 heap buffer overflow *** --------------------------------------------- Topic: openssh 6.8p1 heap buffer overflow Risk: High Text:Quick background story: I started a while ago to develop a solution to use american fuzzy lop with networking input. I did so b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050105 *** Bugtraq: [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine *** --------------------------------------------- http://www.securityfocus.com/archive/1/535548 *** ZDI-15-230: ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/qN5KZVA4xgA/ *** ZDI-15-229: ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/PLAGhXOxQh0/ *** ZDI-15-231: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/HtMlLoJoKXI/ *** Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38884 *** DSA-3261 libmodule-signature-perl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libmodule-signature-perl, aPerl module to manipulate CPAN SIGNATURE files. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3261 *** SAP Sybase Unwired Platform Online Data Proxy Discloses Password and Username Information to Local Users *** --------------------------------------------- http://www.securitytracker.com/id/1032310 *** SAP Customer Relationship Management Bugs Let Users Execute Arbitrary Code and Remote Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032309 *** SAP NetWeaver RFC SDK Discloses Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032308

1 0

Tageszusammenfassung - Freitag 15-05-2015
by Daily end-of-shift report 15 May '15

15 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-05-2015 18:00 − Freitag 15-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38789 http://tools.cisco.com/security/center/viewAlert.x?alertId=38808 http://tools.cisco.com/security/center/viewAlert.x?alertId=38811 http://tools.cisco.com/security/center/viewAlert.x?alertId=38833 http://tools.cisco.com/security/center/viewAlert.x?alertId=38864 http://tools.cisco.com/security/center/viewAlert.x?alertId=38865 http://tools.cisco.com/security/center/viewAlert.x?alertId=38866 http://tools.cisco.com/security/center/viewAlert.x?alertId=38869 http://tools.cisco.com/security/center/viewAlert.x?alertId=38868 *** Multiple vulnerabilities in Loxone Smart Home (part 2) *** --------------------------------------------- The Loxone Smart Home vulnerabilities published in February 2015 (SA-20150227-0) have not been fixed entirely and can still be exploited. Furthermore, new security issues have been identified. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Openlitespeed <= 1.3.10 Multiple Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050096 *** Hospira LifeCare PCA Infusion System Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification .. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A *** Organizational Challenges in the Internet of Things *** --------------------------------------------- As a result of the increase in cyber-attacks launched by nation-states, cybercriminals, hacktivist groups and other entities, it has become increasingly important to understand the ecosystem of hardware, O/S, software, and services that are used in each organization's network, including .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/organizational-c… *** Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked *** --------------------------------------------- mSpy, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the companys servers was posted on the Dark Web, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-cu… *** Vulnerabilities in PHPMyAdmin *** --------------------------------------------- http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php *** Kritik an fehlenden Sicherheitsfunktionen der Apple Watch *** --------------------------------------------- Die Apple Watch lässt sich ohne Kenntnis des Gerätecodes zurücksetzen – im Unterschied zu iPhone und iPad gibt es allerdings keine Aktivierungssperre, die die frische Inbetriebnahme durch einen Dieb verhindert. --------------------------------------------- http://heise.de/-2650499 *** Erpresser drohen zahlreichen deutschen Shops mit DDoS-Attacken *** --------------------------------------------- Eine Erpresserwelle verunsichert Betreiber von deutschen Online-Shops: Wer nicht zahlt, verliert womöglich Kunden. Was tun? --------------------------------------------- http://heise.de/-2650465 *** McAfees Reinigungs-Tool Stinger installiert heimlichen Wächter *** --------------------------------------------- Wer McAfees Scan-Tool "Stinger" benutzt, um seinen PC zu säubern, bekommt ungefragt einen Virenwächter im Betastadium untergeschoben. Einen Opt-Out gibt es nicht. --------------------------------------------- http://heise.de/-2645759 *** Hacking communities in the Deep Web *** --------------------------------------------- The role of hackers has changed over the years, in the past these professionals were viewed as dangerous criminals that needed to be kept at arm's length; meanwhile today they are highly sought from private companies, intelligence .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-communities-in-the-deep-web/ *** SAP LZC LZH Compression Multiple Vulnerabilities *** --------------------------------------------- SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the .. --------------------------------------------- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vul… *** Latest Microsoft Security Intelligence Report Now Available *** --------------------------------------------- This volume of the SIR focuses on the second half of 2014 and contains longer term trend data as well. SIR volume 18 contains data, insights and practical guidance on a range of global and regional cybersecurity threats including vulnerability disclosures, malware and unwanted software including the latest on .. --------------------------------------------- http://blogs.microsoft.com/cybertrust/2015/05/14/latest-microsoft-security-… *** If Youre Typing the Word MCRYPT Into Your Code, Youre Doing It Wrong *** --------------------------------------------- Foreword: You probably should not be deploying your own cryptography to begin with, especially if you dont already understand that encryption is not authentication. For production systems, use PECL libsodium or defuse/php-encryption and save yourself the headache. The rest of this post is intended for PHP developers who still want to write their own cryptography code, or already have. --------------------------------------------- https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-c… *** One year of DANE Tales and Lessons Learned *** --------------------------------------------- https://ripe70.ripe.net/presentations/183-dane-ripe.pdf *** Cylance SPEAR Team: A Threat Actor Resurfaces *** --------------------------------------------- Attackers typically shut down campaigns or halt activity after they are exposed by security researchers, thereby creating the impression they have dropped off the map. This often leads to a false sense of security within the community and perpetuates the idea that public exposure makes us all safer. While the .. --------------------------------------------- http://blog.cylance.com/spear-a-threat-actor-resurfaces

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily May 2015