Daily May 2015

daily@lists.cert.at

1 participants
18 discussions

Tageszusammenfassung - Mittwoch 13-05-2015
by Daily end-of-shift report 13 May '15

13 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-05-2015 18:00 − Mittwoch 13-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-09: Security updates available for Adobe Flash Player APSB15-10: Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1197 *** How Social Media Blacklisting Happens *** --------------------------------------------- In today's world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in .. --------------------------------------------- https://blog.sucuri.net/2015/05/how-social-media-blacklisting-happens.html *** Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web-based administration interface of the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38767 *** Another look at Niteris : post exploitation WMI and Fiddler checks *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html *** Adobe, Microsoft Push Critical Security Fixes *** --------------------------------------------- Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-f… *** [2015-05-13] Multiple critical vulnerabilities in WSO2 Identity Server *** --------------------------------------------- An unauthenticated attacker is able to read arbitrary local files from the WSO2 Identity Server by using the SAMLv2 authentication interface. Moreover, targeted attacks against users or administrators of the Identity Server may be conducted using CSRF and XSS vulnerabilities. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security: Wie Google Android sicher macht *** --------------------------------------------- HTTPS soll ausgemustert, Android sicherer werden, und es soll ein PGP-Plugin für Gmail geben: Google verstärkt seinen Einsatz im Bereich IT-Sicherheit enorm. Wir haben mit Googles IT-Sicherheitsexperten Stephan Somogyi darüber gesprochen. (Google, Gmail) --------------------------------------------- http://www.golem.de/news/security-wie-google-android-sicher-macht-1505-1140… *** Microsoft Security Bulletin Summary for May 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for May 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. Microsoft also .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-may *** VENOM, don't get bitten. *** --------------------------------------------- QEMU is a generic and open source machine emulator and virtualizer and is incorporated in some Red Hat products as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM hypervisors. CVE-2015-3456 (aka VENOM) .. --------------------------------------------- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ *** Anatomy of an APT Attack: Step by Step Approach *** --------------------------------------------- This article will explore the technique, design and the inner workings of an APT (Advanced Persistent Threat) attack. It will also relate various stages of attack with a few attacks that were custom-created to penetrate enterprises for extraction of internal data, trade secrets, and sensitive business .. --------------------------------------------- http://resources.infosecinstitute.com/anatomy-of-an-apt-attack-step-by-step… *** Spam and Phishing in the First Quarter of 2015 *** --------------------------------------------- The share of spam in email traffic in the first quarter of 2015 was 59.2%; the percentage of spam gradually declined during the quarter. Spam traffic included a large number of mass mailings with Microsoft Word or Excel attachments containing macro viruses. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/69932/spam-and-phishi… *** OSIsoft PI AF Incorrect Default Permissions Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 *** Edge: Wie Microsoft seinen neuen Browser absichern will *** --------------------------------------------- Detailliert beschreibt Microsoft neue und bekannte Techniken, mit denen die Sicherheit des Edge-Browsers "fundamental" verbessert werden soll. Dabei hilft auch der Verzicht auf alte Technik des Internet Explorers. --------------------------------------------- http://www.golem.de/news/edge-wie-microsoft-seinen-neuen-browser-absichern-… Aufgrund des morgigen (14.05.2015) Feiertages erscheint der nächste End-of-Shift-Report erst am Freitag, den 15.05.2015.

1 0

Tageszusammenfassung - Dienstag 12-05-2015
by Daily end-of-shift report 12 May '15

12 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-05-2015 18:00 − Dienstag 12-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Steganography and Malware: Concealing Code and C&C Traffic *** --------------------------------------------- In our earlier post discussing steganography, I discussed how it is now being used to hide configuration data by malware attackers. Let's go discuss this subject another facet of this topic in this post: how actual malware code is hidden in similar ways. Security analysts will probably throw their hands up in the air and say, 'we've .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/steganography-an… *** Add GitHub dorking to list of security concerns *** --------------------------------------------- One of the big lessons that weve learned in the last 10 years is that even little pieces of once disparate data, gathered in a single location, can yield startling truths. With Facebook, that lesson crystallized with the introduction of its Graph Search feature in 2013, when the online world .. --------------------------------------------- http://www.csoonline.com/article/2921177/application-security/add-github-do… *** Golem.de-Test mit Kaspersky: So sicher sind Fototerminals und Copyshops *** --------------------------------------------- Wie gefährlich ist es, mit beschreibbaren USB-Sticks und SD-Karten Fotos und Dateien ausdrucken zu lassen? Golem.de hat zusammen mit dem Sicherheitsunternehmen Kaspersky getestet, ob auch Windows-XP-Terminals ohne Virenscanner sicher sind. --------------------------------------------- http://www.golem.de/news/golem-de-test-mit-kaspersky-so-sicher-sind-fototer… *** Verschlüsselte OSGP-Kommunikation von Smart Metern leicht belauschbar *** --------------------------------------------- Wenn Geräte im Smart Grid Informationen austauschen, könnten Angreifer trotz Krypto-Einsatz zumindest beim Standard Open Smart Grid Protocol Daten abgreifen. Sicherheitsforscher machen dafür das schwache Protokoll verantwortlich. --------------------------------------------- http://heise.de/-2642228 *** The State of ASLR on Android Lollipop *** --------------------------------------------- Modern platforms like Android devices enforce execute protections on memory, so injecting code into the process is often no longer the lowest hanging fruit for exploitation. Reusing the existing code and data has become the norm, and statistical defense via Address-Space Layout randomization is still the only widely available .. --------------------------------------------- https://copperhead.co/2015/05/11/aslr-android-zygote *** How secure will our data be in the post-quantum era? *** --------------------------------------------- Build your security for the next 50 years. If the speed of processing doubles every two years, make sure your cryptographic systems can't be brute forced in 50 years. If you use 2048 bit RSA, it will take some quadrillion years to break it. Good enough, right? --------------------------------------------- https://medium.com/@amarchenkova/how-secure-will-our-data-be-in-the-post-qu… *** Bublik Trojan - Variant Evolves with New Features *** --------------------------------------------- While there are many similar types of malware in use today, Bublik is being used for malicious activity and appears to be under active development, suggesting that its creators have paying customers. Because security involves a dynamic interaction .. --------------------------------------------- http://www.isightpartners.com/2015/05/bublik-trojan-variant-evolves-with-ne…

1 0

Tageszusammenfassung - Montag 11-05-2015
by Daily end-of-shift report 11 May '15

11 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-05-2015 18:00 − Montag 11-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 *** VMSA-2015-0003.8 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38763 *** Who's Scanning Your Network? (A: Everyone) *** --------------------------------------------- Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldnt believe that people actually still cared about scanning, and I told him as much: These days there are .. --------------------------------------------- http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/ *** NCSC publishes factsheet Help! My website has been defaced *** --------------------------------------------- To deface a website the attacker changes the content of existing pages or adds new ones. Hundreds of websites are defaced every day, often without being specifically targeted. It is becoming increasingly common for defacements to .. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-he… *** Jellyfish: Malware nistet sich in GPUs ein *** --------------------------------------------- Nutzt eine Malware den Prozessor einer Grafikkarte, ist sie nicht nur schwerer aufzuspüren, sondern kann auch die höhere Rechenleistung der GPU nutzen. Jellyfish will zeigen, dass solcher Schadcode funktioniert. --------------------------------------------- http://www.golem.de/news/jellyfish-malware-nistet-sich-in-gpus-ein-1505-113… *** Yubikey: Nie mehr schlechte Passwörter *** --------------------------------------------- Unser Autor hat 152 Onlinekonten, die er möglichst gut absichern will. Mit dem Passwortmanager Keepass und einem sogenannten Token - dem Yubikey Neo. Eine Anleitung. --------------------------------------------- http://www.golem.de/news/yubikey-nie-mehr-schlechte-passwoerter-1505-113872… *** Tor-Bridges für Amazon EC2 eingestampft *** --------------------------------------------- Ab sofort wird es schwerer, Nutzern alternative Zugänge zum Anonymisierungsnetz Tor zur Verfügung zu stellen. Das entsprechende Projekt für Cloud-Images wurde eingestellt. --------------------------------------------- http://heise.de/-2640793 *** 60 Days of Watching Hackers Attack Elasticsearch *** --------------------------------------------- Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the .. --------------------------------------------- https://jordan-wright.github.io/blog/2015/05/11/60-days-of-watching-hackers… *** Finger printing: Print the Finger of an Application *** --------------------------------------------- When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, .. --------------------------------------------- http://resources.infosecinstitute.com/finger-printing-print-the-finger-of-a… *** Angler exploit kit using tricks to avoid referrer chain leading back to malvertisement provider *** --------------------------------------------- For some time I've been seeing the Angler exploit kit pop up and infect clients without through malvertising campaigns without having a referer when visitng the landing page. The reason why this is interesting is that it makes it a lot harder to track down the malicious creative IDs which can .. --------------------------------------------- http://blog.0x3a.com/post/118366451134/angler-exploit-kit-using-tricks-to-a…

1 0

{Spam?} Tageszusammenfassung - Freitag 8-05-2015
by Daily end-of-shift report 08 May '15

08 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-05-2015 18:00 − Freitag 08-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB15-10) *** --------------------------------------------- A prenotification Security Advisory has been posted regarding upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 12, 2015. We will continue to provide updates on the upcoming release via the Security Advisory as well as the Adobe PSIRT blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1193 *** Compromised WordPress sites leaking credentials *** --------------------------------------------- Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/63XGcunva0k/compromised-… *** GPU-based malware, the evolution of rootkits and keyloggers *** --------------------------------------------- Malware developers have presented two proof-of-concept malware, a rootkit and a keylogger, which exploit the GPU of the infected host. Malware authors always demonstrate a great creativity and the ability to propose even more effective solutions, recently developers have published two strains of malware, Jellyfish rootkit and the Demon keylogger, that implement an unusual way to run on a victim's... --------------------------------------------- http://securityaffairs.co/wordpress/36634/malware/gpu-based-malware.html *** Almost EVERY SAP install hackable, researchers say *** --------------------------------------------- Even worse when you tinker with it. A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/08/sap_95_perc… *** l+f: Kritische Lücke in Überwachungs-Software für kritische Systeme *** --------------------------------------------- Über einen Bug in Symantecs Server-Überwachungs-Software können Angreifer den Systemen beliebige Dateien unterjubeln und diese ausführen. --------------------------------------------- http://heise.de/-2638669 *** The USBKILL anti-forensics tool - it doesnt do *quite* what it says on the tin *** --------------------------------------------- A hacker who very modestly goes by the handle Hephaestos has just announced an "anti-forensic kill switch" dubbed, well, usbkill. It doesnt do quite what the name might suggest, and it could cut either way, so use it with care! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/tzGEjCOTbq4/ *** Flawed Open Smart Grid Protocol is a risk for Smart Grid *** --------------------------------------------- More than four million smart meters and similar devices worldwide are open to cyber attacks due to the security issued in the Open Smart Grid Protocol. The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) that are implemented today by more than four million smart... --------------------------------------------- http://securityaffairs.co/wordpress/36648/hacking/flaws-open-smart-grid-pro… *** IETF spezifiziert Richtlinien für den Einsatz von Verschlüsselung *** --------------------------------------------- Das Gremium für Internet-Standards dokumentiert Richtlinien für den sinnvollen Einsatz der Transportverschlüsselung TLS. Der RFC 7525 enthält gute Anleitungen, Tipps und Hinweise auf Fallstricke für jeden, der Verschlüsselung selbst einrichtet. --------------------------------------------- http://heise.de/-2639221 *** Angreifer können Viren-Scanner von BullGuard und Panda lahmlegen *** --------------------------------------------- Mehrere Antiviren-Anwendungen von BullGuard und Panda weisen eine Sicherheitslücke auf, über die Angreifer die Schutzfunktionen deaktivieren können. --------------------------------------------- http://heise.de/-2639307 *** DSA-3253 pound - security update *** --------------------------------------------- Pound, a HTTP reverse proxy and load balancer, had several issuesrelated to vulnerabilities in the Secure Sockets Layer (SSL) protocol. --------------------------------------------- https://www.debian.org/security/2015/dsa-3253 *** Sentinel 7.3 HF1 (Sentinel 7.3.0.1) Build 1800 7.3.0.1 *** --------------------------------------------- Abstract: Sentinel 7.3.0.1 upgrade patch for Sentinel 7.Document ID: 5202070Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:sentinel_server-7.3.0.1-1817.x86_64.tar.gz.sha256 (109 bytes)sentinel_server-7.3.0.1-1817.x86_64.tar.gz (1.67 GB)Products:Sentinel 7.1SentinelSentinel 7.1.1Sentinel 7.1.2Sentinel 7.XSentinel 7.3Sentinel 7.2.2Sentinel 7.2.1Sentinel 7.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=mBuUwDq2kD0~ *** Rockwell Automation RSLinx Classic Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Rockwell Automation's OPCTest.exe, which is a test client for RSLinx Classic's support of the OPC-DA protocol. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02 *** VMSA-2015-0003.7 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** ZDI Security Advisories for EMC AutoStart and for ManageEngine Products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/published/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21902444 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli System Automation for Multiplatforms (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21882749 *** IBM Security Bulletin: Multiple Kernel vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022146 *** IBM Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer *** http://www.ibm.com/support/docview.wss?uid=swg21883926 *** Security Bulletin: Vulnerability in SSLv3 affects Upward Integration Modules (UIM) (CVE-2014-3566) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097659 *** IBM Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022149 *** IBM Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022145 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Endpoint Manager (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883852 *** Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097676

1 0

Tageszusammenfassung - Donnerstag 7-05-2015
by Daily end-of-shift report 07 May '15

07 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-05-2015 18:00 − Donnerstag 07-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco UCS Central Software Arbitrary Command Execution Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco UCS Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** eShop 6.3.11 - Remote Code Execution *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7967 *** Multiple vulnerabilities in ManageEngine Applications Manager *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-170 http://www.zerodayinitiative.com/advisories/ZDI-15-169 http://www.zerodayinitiative.com/advisories/ZDI-15-168 http://www.zerodayinitiative.com/advisories/ZDI-15-167 http://www.zerodayinitiative.com/advisories/ZDI-15-166 *** Macro Malware: When Old Tricks Still Work, Part 2 *** --------------------------------------------- In the first part of this series, we discussed about the macro malware we have recently seen in the threat landscape. This second entry will delve deeper into the techniques or routines of macro malware. Unintended consequences Let us put things into .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/macro-malware-wh… *** APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 *** --------------------------------------------- Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00000.ht… *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Wie gestern (06. Mai) bekannt wurde, gibt es eine Sicherheitslücke im "Genericons icon font package" von WordPress, welches in vielen populären Themes und Erweiterungen, darunter das .. --------------------------------------------- http://cert.at/warnings/all/20150507.html *** Protect your network with DNS Firewall *** --------------------------------------------- If you run your own mail server, you will quickly find out that 90% of the e-mails you receive are spam. The solution .. --------------------------------------------- http://securityblog.switch.ch/2015/05/07/protect-your-network-with-dns-fire… *** Security Operations Center *** --------------------------------------------- Ensuring the confidentiality, integrity, and availability of a modern information technology enterprise is a big job. Cyber security breaches are becoming common news. The role of .. --------------------------------------------- http://resources.infosecinstitute.com/security-operations-center/ *** Analyzing Quantum Insert Attacks *** --------------------------------------------- A Quantum Insert Attack is a classic example of man-in-the-middle attacks which resurfaced into news among the top 10 biggest .. --------------------------------------------- http://resources.infosecinstitute.com/analyzing-quantum-insert-attacks/ *** Avast verdächtigt Windows-Bibliotheken als Trojaner *** --------------------------------------------- Der Virenwächter Avast hat DLL-Dateien von Windows als gefährlich eingestuft und in Quarantäne verschoben. Danach liefen bei betroffenen Nutzern einige Programme nicht mehr. --------------------------------------------- http://heise.de/-2638093 *** Falscher PC-Experte überwies während Fernwartung Geld nach Bangkok *** --------------------------------------------- Mehrere Hundert Euro Schaden - Bank konnte Transaktion nicht mehr rückgängig machen - Polizei warnt vor Betrugsmasche mit falschen Microsoft-Mitarbeitern --------------------------------------------- http://derstandard.at/2000015448793 *** How to make two binaries with the same MD5 hash *** --------------------------------------------- One question I was asked when I demod creating two PHP files with the same hash is; does it work on compiled binaries? --------------------------------------------- http://natmchugh.blogspot.co.uk/2015/05/how-to-make-two-binaries-with-same-…

1 0

Tageszusammenfassung - Mittwoch 6-05-2015
by Daily end-of-shift report 06 May '15

06 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-05-2015 18:00 − Mittwoch 06-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Root-Shell im Krankenhaus: Hospira-Infusionspumpe mit Telnet-Lücke *** --------------------------------------------- Computer, die in Krankenhäusern die Abgabe von Medikamenten direkt ins Blut der Patienten steuern, sollten eigentlich einigermaßen abgesichert sein. Bei in US-Kliniken verbreiteten Infusionspumpen wurde jedoch eine "game-over vulnerability" entdeckt. --------------------------------------------- http://heise.de/-2633529 *** Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the CUCReports page of Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the CUCReports web interface. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38675 *** Cisco Unified Communications Manager SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38674 *** Spearphishing: A New Weapon in Cyber Terrorism *** --------------------------------------------- Introduction: Spear phishing attacks Spear phishing and its evolutions like the watering hole attack represent one of the most insidious attack techniques adopted by the majority of threat actors in cyber space. According to the experts .. --------------------------------------------- http://resources.infosecinstitute.com/spearphishing-a-new-weapon-in-cyber-t… *** Hospira LifeCare PCA Infusion System Vulnerabilities *** --------------------------------------------- This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in the Hospira LifeCare PCA Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 *** Studie: Die Smart City ist intelligent, aber angreifbar *** --------------------------------------------- Smarte Städte könnten zum Ziel von Hackerangriffen werden. Durch die zunehmende Vernetzung potenzieren sich die Sicherheitslücken, wie eine Studie zeigt. --------------------------------------------- http://www.golem.de/news/studie-die-smart-city-ist-intelligent-aber-angreif… *** Tinba - Yet another anti-sandbox tricks *** --------------------------------------------- Malware authors certainly do not take a breather when it comes to inventing new tricks for detecting sandbox, a very useful system to automatically analyze millions of samples nowadays. Recently, Seculert unveiled an unprecedented sandbox detection method that was employed by the Dyre/Dyreza malware. We had seen similar anti-sandbox tricks used by the .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002810.html *** Erneut massive Sicherheitslücke bei Lenovo-Rechnern *** --------------------------------------------- Hacker konnten durch Fehler im Update-System Schadprogramme als Lenovo-Software ausgeben --------------------------------------------- http://derstandard.at/2000015349945 *** IT threat evolution in Q1 2015 *** --------------------------------------------- In the first quarter of 2015 Kaspersky Lab products detected a total of 2,2 bln malicious attacks and more than 93 mln unique malicious URLs. The story of the powerful Equation cyberespionage group was perhaps the most talked-about news story of Q1. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/69872/it-threat-ev… *** Nmap Cheat Sheet 5: The Final View of a Ninja Pentester *** --------------------------------------------- As we discussed in the last topic of our Nmap Series, this will be our final touch for the cheat sheet. Here we will try to cover most of the topic as required for Vulnerability Assessment and Penetration Testing. As a Ninja Pentester, .. --------------------------------------------- http://resources.infosecinstitute.com/nmap-cheat-sheet-5-the-final-view-of-… *** Explaining Security Lingo *** --------------------------------------------- This post is aimed to clarify certain terms often used in the security community. Let's start with the easiest one: vulnerability. A vulnerability is a flaw in a selected system .. --------------------------------------------- https://securityblog.redhat.com/2015/05/06/explaining-security-lingo/ *** Multiple Fortiguard products cross-site scripting vulnerabilities *** --------------------------------------------- The Web User Interface of FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiADC D models are vulnerable to reflected cross-site scripting vulnerabilities. --------------------------------------------- http://www.fortiguard.com/advisory/FG-IR-15-005/ *** JetPack and TwentyFifteen Vulnerable to DOM-based XSS - Millions of WordPress Websites Affected *** --------------------------------------------- Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with .. --------------------------------------------- https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom… *** Google-Studie: Millionen Computer mit Adware infiziert *** --------------------------------------------- Fast 5,4 Millionen Google-Besucher haben Adware auf ihren Computern installiert. Ein Grossteil davon geht auf Googles eigene Kappe, denn viele der Werbe-Einblender stammen aus dem Chrome Web Store. --------------------------------------------- http://heise.de/-2636130

1 0

Tageszusammenfassung - Dienstag 5-05-2015
by Daily end-of-shift report 05 May '15

05 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-05-2015 18:00 − Dienstag 05-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** In-Console-Able *** --------------------------------------------- Posted by James Forshaw, giving the security community a shoulder to cry on.TL;DR; this blog post describes an unfixed bug in Windows 8.1 which allows you to escape restrictive job objects in order to help to develop a sandbox escape chain in Chrome or similar sandboxes. If you're trying to develop a secure application sandbox in user-mode you're at the mercies of the underlying operating system. While you can try and use every available security feature, sometimes the OS developer... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/05/in-console-able.html *** Upatre/Dyre - the daily grind of botnet-based malspam, (Tue, May 5th) *** --------------------------------------------- Malicious spam (malspam) delivering Upatre/Dyre has been an ongoing issue for quite some time. Many organizations have posted articles about this malware. Ive read good information on Dyre last year [1, 2] and this year [3]. Upatre is the malware downloader that retrieves Dyre (Dyreza), an information stealer described as a Zeus-like banking Trojan [4]. Earlier this year, EmergingThreats reported Upatre and Dyre are under constant development [5], while SecureWorks told us banking botnets... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19657&rss *** Analogue modems allow UNSTOPPABLE Android attack ... at 13bps *** --------------------------------------------- Yes its slow, but its enough to leak data to another Android The better your Android smartphones audio, the worse its security - the audio channel is the latest path for "low and slow" data leak attacks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/boffins_rev… *** Rombertik malware kills host computers if you attempt a cure *** --------------------------------------------- Say goodbye to your master boot record and home directory if you try to stop it Cisco researchers Ben Baker and Alex Chiu have found new malware that destroys a machines Master Boot Record and home directories if it detects meddling white hats. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/rombertik_m… *** Macro Malware: When Old Tricks Still Work, Part 1 *** --------------------------------------------- Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters: Figure 1. Microsoft Word security warning for macros I went around my peers this afternoon and asked, "On the top of your head, can you give me a name of an effective macro malware? Better if its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/LjTF4yhzWt8/ *** Introducing FIDO: Automated Security Incident Response *** --------------------------------------------- Were excited to announce the open source release of FIDO (Fully Integrated Defense Operation - apologies to the FIDO Alliance for acronym collision), our system for automatically analyzing security events and responding to security incidents. --------------------------------------------- http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html *** Revealing the Secrets: Advances in Android and iOS Attacks *** --------------------------------------------- In recent months, Unit 42, the cyber threat intelligence team at Palo Alto Networks, has encountered several game-changing advances in mobile malware for both iOS and Android. For example, WireLurker employed a multistage infection that... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/revealing-secrets-advanc… *** Steganography and Malware: Why and How *** --------------------------------------------- Threats that can evade detection are among the most dangerous kind we're facing today. We see these characteristics in the most challenging security issues like targeted attacks and zero-day exploits. Being able to stay hidden can determine the success of an attack, making it something that attackers continuously want to achieve. In this series of blog posts, we... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G-eR3GU5L3Y/ *** ICU Project Overflow Vulnerabilities Patched *** --------------------------------------------- Buffer and integer overflow vulnerabilities have been patched in the ICU Project ICU4C library, used in hundreds of open source and enterprise software packages. --------------------------------------------- http://threatpost.com/icu-project-overflow-vulnerabilities-patched/112623 *** Usbkill Script Can Render Computers Useless *** --------------------------------------------- The idea of needing to disable a computer quickly as the police - or another potential adversary - comes through the door typically has been the concern of criminals. But in today's climate activists, journalists, and others may find themselves wanting to make their laptops unusable in short order, and that's where usbkill comes in. The new tool is a... --------------------------------------------- http://threatpost.com/usbkill-script-can-render-computers-useless/112622 *** VU#978652: Bomgar Remote Support Portal deserializes untrusted data *** --------------------------------------------- Vulnerability Note VU#978652 Bomgar Remote Support Portal deserializes untrusted data Original Release date: 05 May 2015 | Last revised: 05 May 2015 Overview Bomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data without sufficient validation, allowing an attacker to potentially execute arbitrary PHP code. Description CWE-502: Deserialization of Untrusted DataBomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data... --------------------------------------------- http://www.kb.cert.org/vuls/id/978652 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM OS Images for Red Hat Linux Systems and AIX. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883879 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005217 *** IBM Security Bulletin: IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models nodes are affected by vulnerabilities in Apache's Struts library (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005078 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor (CVE-2014-6585, CVE-2014-6591, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21883285 *** DSA-3250 wordpress - security update *** --------------------------------------------- Multiple security issues have been discovered in Wordpress, a weblogmanager, that could allow remote attackers to upload files with invalidor unsafe names, mount social engineering attacks or compromise a sitevia cross-site scripting, and inject SQL commands. --------------------------------------------- https://www.debian.org/security/2015/dsa-3250

1 0

Tageszusammenfassung - Montag 4-05-2015
by Daily end-of-shift report 04 May '15

04 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-04-2015 18:00 − Montag 04-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** eBay ignoriert XSS-Lücke ein Jahr lang *** --------------------------------------------- Eine Schwachstelle in eBay erlaubt es Angreifern eine Session mitzuschneiden und im schlimmsten Fall einen Account zu übernehmen. Die Lücke ist ein Jahr alt und wurde immer noch nicht geschlossen. --------------------------------------------- http://heise.de/-2630964 *** Threatpost News Wrap, May 1, 2015 *** --------------------------------------------- Dennis Fisher and Mike Mimoso discuss the post-RSA news, including the MySQL bug, the progress of the OpenSSL overhaul and the wildly entertaining House hearing on crypto backdoors. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-may-1-2015/112538 *** 3062591 - Local Administrator Password Solution (LAPS) Now Available - Version: 1.0 *** --------------------------------------------- Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3062591 *** New Google Password Alert extension already hacked *** --------------------------------------------- A few hours after the presentation of the Google Password Alert extension a researcher already have developed two methods to bypass it. A few hours ago, Google released the Password Alert extension that was designed to warn users when they are submitting their Google credentials to fraudulent websites. Here's how it works for consumer accounts. Once you've... --------------------------------------------- http://securityaffairs.co/wordpress/36483/hacking/password-alert-extension-… *** VolDiff, for memory image differential analysis, (Sun, May 3rd) *** --------------------------------------------- VolDiff is a bash script that runs Volatility plugins against memory images captured before and after malware execution providing a differential analysis, helping identify IOCs and understand advanced malware behaviour. I had intended to include it in my latest toolsmith article, Attack Detection: Hunting in-memory adversaries with Rekall and WinPmem, but quite literally ran out of space and time. Using WinPmem, as part of Rekall and GRR offerings, you can acquire two memory images, one clean --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19651&rss *** Traffic pattern change noted in Fiesta exploit kit, (Mon, May 4th) *** --------------------------------------------- A few hours ago, Jerome Segura, the Senior Security Researcher at Malwarebytes, tweeted about a change in traffic patterns from Fiesta exploit kit (EK) [1]. What had been semi-colons in the URLs from Fiesta EK are now commas. Here" /> Here" /> Any signatures for detecting Fiesta EK that depend on those semi-colons will need to be updated. A pcap of the traffic is available at http://malware-traffic-analysis.net/2015/05/04/2015-05-04-Fiesta-EK-traffic…, and a zip file of the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19655&rss *** Securing the smart grid: European Network of Cyber Security *** --------------------------------------------- Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this int... --------------------------------------------- http://www.net-security.org/article.php?id=2270 *** Nasty Dyre malware bests white hat sandboxes *** --------------------------------------------- Core checker a defensive wrecker Seculert CTO Aviv Raff says a nasty piece of malware linked to widespread destruction and bank account plundering has become more dangerous with the ability to evade popular sandboxes. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/04/dyre_malwar… *** Anti-Phishing-Erweiterung für Chrome mehrfach unterwandert *** --------------------------------------------- Eigentlich soll das Chrome-Plug-in Passwort-Warnung Alarm schlagen, wenn Nutzer ihre Log-in-Daten auf Phishing-Webseiten eingeben. Mittlerweile wurde die Funktion aber schon zum wiederholten Male ausgehebelt. --------------------------------------------- http://heise.de/-2632031 *** Linuxwochen von 7. bis 9. Mai in Wien *** --------------------------------------------- Am FH Technikum Wien finden von Donnerstag bis Sonntag Workshops und Vorträge zu Verschlüsselung, 3D-Druck und Open Hardware statt. --------------------------------------------- http://futurezone.at/produkte/linuxwochen-von-7-bis-9-mai-in-wien/128.621.4… *** AlphaCrypt *** --------------------------------------------- We've encountered yet another encrypting ransomware variant and at this point it's expected since the scam has exploaded in popularity since it's inception in late 2013. This one has a GUI that is almost... --------------------------------------------- http://www.webroot.com/blog/2015/05/04/alphacrypt/ *** Microsoft Security Bulletin MS15-032 - Critical *** --------------------------------------------- V2.0 (April 30, 2015): Updated bulletin to inform customers running Internet Explorer on Windows Server 2003 Service Pack 2 that the 3038314 update on the Microsoft Download Center was updated on April 22, 2015. Microsoft recommends that customers who installed the 3038314 update prior to April 22 should reinstall the update to be fully protected from the vulnerabilities discussed in this bulletin. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-032 *** DSA-3249 jqueryui - security update *** --------------------------------------------- Shadowman131 discovered that jqueryui, a JavaScript UI library fordynamic web applications, failed to properly sanitize its titleoption. This would allow a remote attacker to inject arbitrary codethrough cross-site scripting. --------------------------------------------- https://www.debian.org/security/2015/dsa-3249 *** DSA-3244 owncloud - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in ownCloud, a cloud storageweb service for files, music, contacts, calendars and many more. --------------------------------------------- https://www.debian.org/security/2015/dsa-3244 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco Finesse Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38607 *** Squid SSL-Bump Certificate Validation Flaw Lets Remote Servers Bypass Client-side Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032221 *** VMSA-2015-0003.6 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** VU#581276: EMC AutoStart is vulnerable to remote code execution via specially crafted packets *** --------------------------------------------- Vulnerability Note VU#581276 EMC AutoStart is vulnerable to remote code execution via specially crafted packets Original Release date: 30 Apr 2015 | Last revised: 30 Apr 2015 Overview EMC AutoStart, version 5.5.0 and earlier, is vulnerable to remote command execution via specially crafted packets. Description EMC AutoStart is an enterprise software application developed to help networks and service maintain a high level of availability. AutoStart can manage clusters of applications or nodes --------------------------------------------- http://www.kb.cert.org/vuls/id/581276 *** Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities *** --------------------------------------------- Description Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities. Multiple vulnerabilities in OpenSSL prior to 1.0.1m (SPL-98351) Disable SSLv3 in KV Store Replication (SPL-96280) Secure flag inconsistently set for session cookies when appServerPorts!=0 (SPL-95798) Cross-site scripting in Search (SPL-95594) Cross-site scripting in management and configuration (SPL-93516) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have --------------------------------------------- http://www.splunk.com/view/SP-CAAANZ7 *** RSA Identity Management and Governance Password Reset Weakness Lets Remote Users Gain Privileged Access *** --------------------------------------------- http://www.securitytracker.com/id/1032218 *** Security Advisory: TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 *** --------------------------------------------- (SOL14190) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/14000/100/sol14190.htm… *** OPTO 22 Multiple Product Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that are present in the OPTO 22 PAC Project Professional, PAC Project Basic, OptoOPCServer, OptoDataLink, PAC Display Basic, and PAC Display Professional products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 *** Clam AntiVirus Multiple File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032223 *** Dell SonicWALL Secure Remote Access Access Control Flaw in cgi-bin/editBookmark Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032227 *** SSA-311412 (Last Update 2015-05-04): Incorrect Certificate Verification in Android App HomeControl for Room Automation *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily May 2015