July 2015 - Daily

Tageszusammenfassung - Freitag 31-07-2015
by Daily end-of-shift report 31 Jul '15

31 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-07-2015 18:00 − Freitag 31-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Derelict TrueCrypt Russia portal is command hub for Ukraine spying op *** --------------------------------------------- Backdoored code slung at officials, journos etc Malware used to attack Ukrainian government, military, and major news agencies in the country, was distributed from the Russian portal of encryption utility TrueCrypt, new research has revealed. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/30/truecrypt_r… *** Username Enumeration against OpenSSH-SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM < 1.2.1 , which allows attackers to conduct username enumeration and denial of service attacks. Below I will provide more technical details about this vulnerability. The Past Time-based username enumeration is an... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag… *** Flash Threats: Not Just In The Browser *** --------------------------------------------- July has been a fairly poor month for Adobe Flash Player security, to say the least. Three separate zero-day vulnerabilities (all courtesy of the Hacking Team dump) have left many people concerned about Flash security, with many (including this blog) calling for it to go away. Some sort of reaction from Adobe to improve Flash... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/6YRcRVFMKYg/ *** Bundestags-Hack: Reparatur des Bundestagsnetzes soll vier Tage dauern *** --------------------------------------------- Das Netzwerk des Bundetages soll zwischen dem 13. und 17. August 2015 neu aufgesetzt werden. In dieser Zeit wird es komplett abgeschaltet. Auch E-Mails können dann nicht mehr empfangen oder versendet werden. --------------------------------------------- http://www.golem.de/news/bundestags-hack-reparatur-des-bundestagsnetzes-sol… *** Compromised site serves Nuclear exploit kit together with fake BSOD *** --------------------------------------------- Support scammers not lying about a malware infection for a change.During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the... --------------------------------------------- http://www.virusbtn.com/blog/2015/07_31.xml?rss *** MMS Not the Only Attack Vector for "Stagefright" *** --------------------------------------------- Earlier this week Zimperium zLabs revealed an Android vulnerability which could be used to install malware on a device via a simple multimedia message. This vulnerability, now known as Stagefright, has gained a lot of attention for the potential attacks it can cause. Stagefright makes it possible, for example, for an attacker to install a spyware app... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fiKsjboNusw/ *** Real World Ramifications of Cyber Attacks *** --------------------------------------------- Warning: the following blog contains gratuitous use of sarcasm and hyperbole from the start. Reader discretion is advised. And so, ladies and gentlemen, it has finally happened. The Internet-of-Things has risen up, Skynet style, and we are doomed. This much prophesied event finally came to pass with reports of hackers disabling cars from miles away, and altering rifle trajectories. At last, it seems, the crossover has been made from the digital world to the physical one; the end is nigh. Then... --------------------------------------------- https://blog.team-cymru.org/2015/07/real-world-ramifications-of-cyber-attac… *** Symantec Endpoint Protection Multiple Issues *** --------------------------------------------- Revisions None Severity CVSS2 Base Score ... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Prime Central Hosted Collaboration Solution Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40214 *** Cisco IM and Presence Service Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40217 *** Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40175 *** Cisco Unified Communications Manager Prime Collaboration Deployment Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a password storage vulnerability in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 *** ZDI-15-372: IBM Tivoli Storage Manager FastBack Server Opcode 4755 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/lONzWRepYUI/ *** ZDI-15-373: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Files Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Np2gm5rVOXQ/ *** ZDI-15-374: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Volumes Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/zJI4EVNVvMM/ *** ZDI-15-375: IBM Tivoli Storage Manager FastBack Server Opcode 4115 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x0uVs7pbpJo/ *** ZDI-15-376: IBM Tivoli Storage Manager FastBack Server Opcode 8192 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/L9RNtcsUYnU/ *** More IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 30-07-2015
by Daily end-of-shift report 30 Jul '15

30 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-07-2015 18:00 − Donnerstag 30-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Der Stagefright Bug *** --------------------------------------------- Bald ist die Blackhat Konferenz in Vegas und der Schwachstellen-Zirkus rundherum ist im vollen Gange. Aktuell sind eine Reihe von Verwundbarkeiten in der Stagefright Library von Android groß im Gespräch. Was steckt da .. --------------------------------------------- http://www.cert.at/services/blog/20150730175038-1560.html *** Anatomy of a Scamware Network - MultiPlug *** --------------------------------------------- While examining our cloud sandbox data recently, we uncovered a large MultiPlug network that caught our attention due to its use pattern of code signing certificates and the breadth of its hosting infrastructure. Overview of the Scamware .. --------------------------------------------- http://research.zscaler.com/2015/07/anatomy-of-scamware-network-multiplug.h… *** Tsar Team Microsoft Office Zero Day CVE-2015-2424 *** --------------------------------------------- After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Tsar-Team-Microsoft-Off… *** Telefonanlage gehackt – 14.000 Euro Schaden für Firma in Oberwart *** --------------------------------------------- Der Fall einer Firma, deren Telefonanlage von Unbekannten gehackt worden ist, beschäftigt Kriminalisten in Oberwart: Dem Unternehmer flatterten Rechnungen über insgesamt 14.000 Euro ins Haus. Wie der Schaden entstehen konnte, sei noch Gegenstand von Ermittlungen, teilte die Landespolizeidirektion Burgenland mit. --------------------------------------------- http://derstandard.at/2000019966507 *** Android: Video-Attacke kann Geräte unbenutzbar machen *** --------------------------------------------- Die Sicherheit von Googles mobilem Betriebssystem Android kommt einmal mehr unter Beschuss: Nur wenige Tage nachdem Zimperium vor mehreren Lücken im Media Framework Stagefright gewarnt hat, meldet sich nun auch Trend Micro zu Wort. In einem Blog-Eintrag warnt der Sicherheitsdienstleister vor zwei weiteren Fehlern in Stagefright, durch die ein Android-Gerät vorübergehend keinen Laut mehr von sich gibt. Auch reagiert ein solcherart angegriffenes Geräte kaum bis gar nicht mehr. --------------------------------------------- http://derstandard.at/2000019966485 *** Windows 10 speichert Festplattenverschlüsselungs-Keys in der Cloud *** --------------------------------------------- Mit Windows 10 steht seit kurzem die neueste Betriebssystemgeneration von Microsoft zur Verfügung. Die ersten Tests kommen zu überwiegende positiven Urteilen, und doch steht der Softwarehersteller nun einmal mehr in der Kritik – und zwar von Sicherheitsexperten. --------------------------------------------- http://derstandard.at/2000019972950 *** Throwback Thursday: Riotous Assembly *** --------------------------------------------- This Throwback Thursday, we turn the clock back to January 1994, shortly after Cyber Riot had emerged as the first virus capable of infecting the Windows kernel.Today, malware that affects the Windows kernel is ubiquitous - the .. --------------------------------------------- http://www.virusbtn.com/blog/2015/07_30.xml *** Beginners Guide to "Use after free Exploits #IE 6 0-day #Exploit Development" *** --------------------------------------------- Last week a friend asked few queries regarding use after free vulnerabilities, . Its been a while I wrote a tutorial so taught of cooking a beginners guide this week end. I wanted a live target for the tutorial so my plans were to .. --------------------------------------------- http://garage4hackers.com/content.php?r=143-Beginners-Guide-to-Use-after-fr… *** Admin-Oberfläche Froxlor verrät Datenbank-Passwörter *** --------------------------------------------- Das Server-Management-Panel Froxlor ist verwundbar und Angreifer können unter Umständen das Datenbank-Passwort aus der Ferne auslesen. Eine gefixte Version ist aber noch nicht für alle Linux-Distributionen verfügbar. --------------------------------------------- http://heise.de/-2765508 *** OpenBSD patch Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033126 *** CVE-2015-0097 Exploited in the Wild *** --------------------------------------------- In March 2015, Microsoft patched a remote code execution (RCE) vulnerability (CVE-2015-0097) in Microsoft Office. In July 2015, Eduardo Prado released a Proof of Concept (PoC) exploit for this vulnerability here. It did not take long for attackers to repackage this PoC and use it in attacks .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.h… *** l+f: Smarter Safe lässt sich clever ausrauben *** --------------------------------------------- Präparierten USB-Stick anstecken, 60 Sekunden warten und schon öffnen sich die Tresor-Türen: Mehr als 10.000 in den USA installierte vermeintlich smarte Tresore sollen sich so knacken lassen. Die Spuren lassen sich dabei restlos verwischen. --------------------------------------------- http://heise.de/-2765663 *** Why is Passive Mixed Content so serious? *** --------------------------------------------- One of the most important tools in web security is Transport Layer Security (TLS). It not only protects sensitive information during transit, but also verifies that .. --------------------------------------------- https://blog.whitehatsec.com/why-is-passive-mixed-content-so-serious/

1 0

Tageszusammenfassung - Mittwoch 29-07-2015
by Daily end-of-shift report 29 Jul '15

29 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-07-2015 18:00 − Mittwoch 29-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New RC4 Attack *** --------------------------------------------- New research: "All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," by Mathy Vanhoef and Frank Piessens: Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/07/new_rc4_attack_1.html *** Cisco UCS Central Software File Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40151 *** Cisco AnyConnect Secure Mobility Client Local Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40176 *** SweetCAPTCHA Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the .. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure *** --------------------------------------------- An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit. --------------------------------------------- https://kb.isc.org/article/AA-01272 *** Trend Micro Discovers Vulnerability That Renders Android Devices Silent *** --------------------------------------------- We have discovered a vulnerability in Android that can render a phone apparently dead - silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 (Jelly Bean) up to the current version, Android .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** Hackers Can Disable a Sniper Rifle - Or Change Its Target *** --------------------------------------------- If a hacker attacks your TrackingPoint smart gun over its Wi-Fi connection, you may find the weapon is aiming at a different target than you think. --------------------------------------------- http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-targ… *** Eigene Keys zum Verschlüsseln der Google Cloud Platform *** --------------------------------------------- Nutzer der Google Cloud Platform können ihre Umgebung nun mit eigenen Keys verschlüsseln. So sollen weder Betreiber noch Externe Zugriff auf die Daten erhalten. --------------------------------------------- http://heise.de/-2764751 *** Phishing: Betrüger zocken Nutzer mit "WhatsApp Gold" ab *** --------------------------------------------- Fake-Angebot lockt mit "besserer Audioqualität" und größeren Gruppen – bringt aber nur Werbung --------------------------------------------- http://derstandard.at/2000019919056 *** A third of workers admit theyd leak sensitive biz data for peanuts *** --------------------------------------------- And three per cent of employees would consider offers as low as 100 pound. A third of employees would sell information on company patents, financial records and customer credit card details .. --------------------------------------------- www.theregister.co.uk/2015/07/29/third_workers_would_leak_data_cash/ *** Die Git-Stolperfalle: Viele Webseiten geben sensible Daten preis *** --------------------------------------------- Wenn Web-Admins beim Hochladen von Projekten nicht aufpassen, stellen sie unter Umständen ohne es mitzubekommen Passwort-Datenbanken und weitere schützenswerte Daten zum Abruf für jedermann bereit. --------------------------------------------- http://heise.de/-2764756 *** Remote code execution via serialized data *** --------------------------------------------- Most programming languages contain powerful features, that used correctly are incredibly powerful, but used incorrectly can be incredibly dangerous. Serialization (and deserialization) is one such feature available in most modern programming .. --------------------------------------------- https://securityblog.redhat.com/2015/07/29/remote-code-execution-via-serial… *** Analyzing VUPEN's CVE-2012-1856 *** --------------------------------------------- Quite some time ago (more than a year before the HackingTeam leaks) I came across a number of interesting exploit samples that make use of CVE-2012-1856. With the recent HackingTeam leaks a .. --------------------------------------------- http://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/ *** Sicherheitsupdate von Chrysler gefährlicher als Hack *** --------------------------------------------- Zum Schließen einer Sicherheitslücke, die eine Fernsteuerung des Autos ermöglichen könnte, bot Chrysler den Download von ".exe"- und ".zip"-Dateien für die Autoelektronik an. --------------------------------------------- http://fm4.orf.at/stories/1761148/ *** Windows 10 Shares Your Wi-Fi With Contacts *** --------------------------------------------- Starting today, Microsoft is offering most Windows 7 and Windows 8 users a free upgrade to the software giants latest operating system -- Windows 10. But theres a very important security caveat that users should know about before transitioning to the .. --------------------------------------------- http://krebsonsecurity.com/2015/07/windows-10-shares-your-wi-fi-with-contac…

1 0

Tageszusammenfassung - Dienstag 28-07-2015
by Daily end-of-shift report 28 Jul '15

28 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-07-2015 18:00 − Dienstag 28-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Firepower 9000 Series Unauthenticated Web Page Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40136 *** Cisco Email Security Appliance AsyncOS Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40172 *** Angler Exploit Kit Used to Find and Infect PoS Systems *** --------------------------------------------- An attack aiming to infect PoS systems was found using the Angler Exploit Kit to push a PoS reconnaissance Trojan,This Trojan, detected as TROJ_RECOLOAD.A, checks for multiple conditions in the infected system like if it is a PoS machine or part of a PoS .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/angler-exploit-k… *** PHP File Manager hat gravierende Sicherheitslücken *** --------------------------------------------- Seit Jahren ungepatchte Schwachstellen im PHP File Manager gefährden zahlreiche Server, darunter auch von großen Unternehmen. Der Hersteller reagiert nicht auf Anfragen --------------------------------------------- http://www.golem.de/news/security-php-file-manager-hat-gravierende-sicherhe… *** 2. Konferenz zur Cyber Security Challenge: Das Programm steht *** --------------------------------------------- Die Gefahren und andererseits die Möglichkeiten zum Schutz und der Prävention vor Cyberangriffen sind das zentrale Thema der 2. Konferenz zur Cyber Security Challenge Germany Mitte September in Berlin. --------------------------------------------- http://heise.de/-2761878 *** [2015-07-28] McAfee Application Control multiple vulnerabilities *** --------------------------------------------- McAfee Application Control contains multiple vulnerabilities which can be used by an attacker to bypass the provided application whitelisting protection and attack availability of the system. Moreover, the identified vulnerabilities negatively affect the security of the underlying operating system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** IMI 2015 - IT meets Industry 29.-30. September 2015 *** --------------------------------------------- Interconnecting IT and Automation offers great opportunities for the operation of industrial production sites. However, this may carry along some complex risks. With the title “IT meets Industry” IMI 2015 brings together the ICS- and IT-Community. The goal: make the most of opportunities – and minimise risks. --------------------------------------------- https://it-meets-industry.de/ *** Honeynet-Projekt analysiert Gefahren für Industrie 4.0 *** --------------------------------------------- Acht Monate lang beobachteten Experten des TÜV SÜD, welche Angriffe von wo aus auf ihr simuliertes Wasserwerk erfolgten. Ihre Erkenntnisse sollten arglose Unternehmen spätestens jetzt wachrütteln. --------------------------------------------- http://heise.de/-2763978 *** Aaron Zauner presented preliminary results on TLS usage in email *** --------------------------------------------- Aaron Zauner presented our preliminary results on the usage of TLS in the email ecosystem at the IETF meeting last week. As part of our project TLSiP we are actively scanning the Internet (/0) for TLS configurations as well as its problems with it. As .. --------------------------------------------- https://www.sba-research.org/2015/07/28/aaron-zauner-presented-preliminary-… *** The Russian Underground - Revamped *** --------------------------------------------- When big breaches happen and hundreds of millions of credit card numbers and SSNs get stolen, they resurface in other places. The underground now offers a vast landscape of shops, where criminals can buy credit cards and other things at irresistible prices. Million dollar breaches News and media coverage .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-russian-unde… *** Cisco 2015 Midyear Security Report [PDF] *** --------------------------------------------- http://www.cisco.com/web/offers/pdfs/cisco-msr-2015.pdf *** Security: Apples App Store als Einfallstor für Schadcode *** --------------------------------------------- Über eine Schwachstelle in der Verarbeitung von Belegen für Einkäufe in Apples App Store lässt sich Code auf fremden Rechnern einschleusen. --------------------------------------------- http://www.golem.de/news/security-apples-app-store-als-einfallstor-fuer-sch…

1 0

Tageszusammenfassung - Montag 27-07-2015
by Daily end-of-shift report 27 Jul '15

27 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-07-2015 18:00 − Montag 27-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Cisco Products LDAP Server SSL Certificate Validation Vulnerability *** --------------------------------------------- A vulnerability in SSL certificate validation of multiple Cisco products could allow an unauthenticated, remote attacker to stage a man-in-the-middle attack. The vulnerability is due to lack of SSL certificate validation for secure LDAP. An attacker could exploit this vulnerability to stage a man-in-the-middle attack when .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 *** IT-Sicherheit bei smarten Autos "viel zu lange ignoriert" *** --------------------------------------------- Nach dem Hack eines Jeeps gibt es Einigung darüber, dass noch viel Nachholbedarf besteht --------------------------------------------- http://derstandard.at/2000019712190 *** DSA-3317 lxc - security update *** --------------------------------------------- Several vulnerabilities have been discovered in LXC, the LinuxContainers userspace tools. Roman Fiedler discovered a directory traversal flaw in LXC when creating lock files. A local attacker could exploit this flaw to create an arbitrary .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3317 *** Hacking Team: "Wir sind das Opfer" *** --------------------------------------------- Der Hersteller von aggressiver Überwachungs-Software sieht sich als einziges Opfer in der Affäre um die Veröffentlichung von Daten, die die Zusammenarbeit des Unternehmens mit autoritären Staaten belegen sollen. --------------------------------------------- http://heise.de/-2763077 *** WP Statistics <= 9.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8116 *** WP Slimstat <= 4.1.5.2 - Referer Header Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8117 *** Password Hashing Competition: Hashfunktion Argon2 gewinnt Wettbewerb *** --------------------------------------------- In einem Wettbewerb ist nach neuen Hashfunktionen gesucht worden, die sich für das Hashen von Passwörtern eignen. Jetzt steht der Gewinner fest: Argon2, entwickelt von einem Team an der Universität Luxemburg. --------------------------------------------- http://www.golem.de/news/password-hashing-competition-hashfunktion-argon2-g… *** Security: Zahlreiche Steam-Konten gehackt *** --------------------------------------------- Die Steam-Konten mehrerer Twitch-Streamer wurden offenbar von Unbekannten übernommen. Sie nutzen einen Fehler in der Anmeldefunktion aus. Valve hat bereits ein Update bereitgestellt. --------------------------------------------- http://www.golem.de/news/security-zahlreiche-steam-konten-gehackt-1507-1154… *** Advertising hijacking made by Invisible rogue mobile apps are wasting petabytes of data a day *** --------------------------------------------- Mobile Malware is growing and crooks are targeting the advertising industry to redirect users to ad pages in a sort of Advertising hijacking. Mobile Malware is growing and crooks are targeting the advertising industry with malicious .. --------------------------------------------- http://securityaffairs.co/wordpress/38885/cyber-crime/mobile-advertising-hi… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host ... --------------------------------------------- http://support.citrix.com/article/CTX201145 *** ManageEngine Exchange Reporter Plus Auth Bypass / Arbitrary SQL Statement Execution *** --------------------------------------------- The ManageEngine Exchange Reporter product installs a JBoss server which listens on default port 8181 (tcp/http) for incoming requests. It offers an admin panel on that port. Without authorization/authentication it is possible to .. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2533 *** Experts Found a Unicorn in the Heart of Android *** --------------------------------------------- Gaining remote code execution privileges merely by having access to the mobile number? Enter Stagefright. The targets for this kind of attack can be anyone from Prime ministers, govt. officials, company executives, security officers to IT managers. --------------------------------------------- http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/

1 0

Tageszusammenfassung - Freitag 24-07-2015
by Daily end-of-shift report 24 Jul '15

24 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-07-2015 18:00 − Freitag 24-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Four Zero Days Disclosed in Internet Explorer Mobile *** --------------------------------------------- [...] The four vulnerabilities originally were reported to Microsoft as affecting IE on the desktop, and later on it was discovered that they also affected IE Mobile on Windows Phones. Microsoft has patched all of the vulnerabilities in the desktop version of the browser, but the bugs remain open on IE Mobile. ZDI’s original advisories on these flaws said that they were zero days on Internet Explorer, as well. The company updated the advisories late Thursday to reflect the fact that the bugs only affect IE Mobile. --------------------------------------------- http://threatpost.com/four-zero-days-disclosed-in-internet-explorer/113911 *** Fixing hundreds of websites in one day *** --------------------------------------------- Remedying Angler infections in Switzerland In recent weeks the Angler exploit kit has become the dominating tool for DriveBy attacks. Cleaning Angler compromised web servers is a challenge which has been well mastered in Switzerland, thanks to the close collaboration... --------------------------------------------- http://securityblog.switch.ch/2015/07/24/fixing-hundreds-of-websites-in-one… *** The OpenSSH Bug That Wasnt *** --------------------------------------------- Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Read on for the full story.It all started with a blog post dated July 16, 2015, titled OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass), where the TL;DR is that its possible to get an almost infinite number of tries at authentication -- good for bruteforce password guessing, for example -- if you only tickle the... --------------------------------------------- http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html *** Malicious Google Analytics Referral Spam *** --------------------------------------------- Robots (bots) have outnumbered people on the Internet for almost two years, and they browse much faster than your average visitor. Aside from spamming your comment systems and crawling for vulnerable websites to attack, bots can also cause a lot of confusion in your website traffic reporting systems. If you use analytics software on yourRead More The post Malicious Google Analytics Referral Spam appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/malicious-google-analytics-referral-spam.ht… *** libuser vulnerabilities *** --------------------------------------------- It was discovered that the libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges. libuser is a library that provides read and write access to files like /etc/passwd, which constitute the system user... --------------------------------------------- https://securityblog.redhat.com/2015/07/23/libuser-vulnerabilities/ *** Emerging Web Infrastructure Threats *** --------------------------------------------- A secure cloud relies on some weak Internet infrastructure with some new BGP vulnerabilities that will be disclosed at Black Hat USA. --------------------------------------------- http://www.darkreading.com/cloud/emerging-web-infrastructure-threats/d/d-id… *** Boffins sting spooks with HORNET onion router *** --------------------------------------------- Spies eyss will water with effort as they try to slice into 93 Gb/s Tor cousin Five academics have developed a Tor alternative network that can handle up to 93 Gb/s of traffic while maintaining privacy. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/24/hornet_high… *** SANS ICS Amsterdam 2015 - 22-28 September, 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 remains open for registration. This dedicated event for those tasked with securing Industrial Control Systems will be led by SANS ICS/SCADA Instructors and subject-matter experts from across the globe. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** IT-Sicherheitsgesetz tritt in Kraft *** --------------------------------------------- Das "Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme" bringt zunächst verschärfte Anforderungen für Serveradmins und Meldepflichten für Provider sowie Kernkraftwerksbetreiber mit sich. --------------------------------------------- http://www.heise.de/newsticker/meldung/IT-Sicherheitsgesetz-tritt-in-Kraft-… *** How to manage PCI DSS 3.1 Requirement 6.6 for your web applications *** --------------------------------------------- One of the PCI DSS 3.1 requirements is Requirement 6.6 dedicated to web application security. In this blog post we will try to understand how to comply with the requirement in cost-efficient manner. --------------------------------------------- https://www.htbridge.com/blog/how-to-manage-pci-dss-3-1-requirement-6-6-for… *** SweetCaptcha Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the sites that used this CAPTCHA service. After that incident, the SweetCaptcha WordPress plugin had been removed from the official plugin repository.Read More The post SweetCaptcha Returns Hijacking Another Plugin appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** DSA-3314 typo3-src - end of life *** --------------------------------------------- Upstream security support for Typo3 4.5.x ended three months ago and thesame now applies to the Debian packages as well. --------------------------------------------- https://www.debian.org/security/2015/dsa-3314 *** userhelper/libuser Multiple vulns *** --------------------------------------------- Topic: userhelper/libuser Multiple vulns Risk: Medium Text:Qualys Security Advisory CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070115 *** Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability (UPDATE A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-202-03 Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability that was published July 22, 2015 on the ICS-CERT web site. This advisory provides mitigation details for a Transport Layer Security Padding Oracle On Downgraded Legacy Encryption vulnerability in the web interface of the Siemens RuggedCom ROS and ROX-based devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A

1 0

Tageszusammenfassung - Donnerstag 23-07-2015
by Daily end-of-shift report 23 Jul '15

23 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-07-2015 18:00 − Donnerstag 23-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Flash zero-day monster Angler dominates exploit kit crime market *** --------------------------------------------- If only you could buy shares SophosLabs researcher Fraser Howard says the Angler exploit kit is dominating the highly-competitive underground malware market, growing from exploding a quarter to 83 percent of market share within nine months . --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/23/sophos_angl… *** Hintergrund: Das Geschäft mit den Zero Days *** --------------------------------------------- Der Verkauf von bisher unbekannten Sicherheitslücken, sogenannten Zero Days, scheidet die Geister. Manche halten dieses Geschäft für unmoralisch, andere sagen, es sollte illegal sein. Vor allem ist es aber wohl sehr lukrativ. --------------------------------------------- http://heise.de/-2757303 *** Security: Schwachstelle erlaubt lokale Rechteausweitung in OS X 10.10 *** --------------------------------------------- Ein Fehler in Apples OS X 10.10.4 erlaubt es, sich administrative Privilegien zu verschaffen. Die Schwachstelle kann nur lokal ausgenutzt werden und wurde in der Beta von OS X 10.11 bereits behoben. --------------------------------------------- http://www.golem.de/news/security-schwachstelle-erlaubt-lokale-rechteauswei… *** 3 important questions raised by Wired's car hack *** --------------------------------------------- Wired.com broke a shocking but hardly surprising story on July 21st. The reporter was driving his Jeep on the highway when strange things started to happen. First the fan and radio went on and later the whole car came to a stop. On the highway! Andy Greenburg was not in control of the car anymore. --------------------------------------------- http://safeandsavvy.f-secure.com/2015/07/23/3-important-questions-raised-by… *** Löchrige VMs: Den PGP-Schlüssel des Nachbarn klauen *** --------------------------------------------- Teilt man sich auf einem virtuellen Server die gleiche Hardware mit anderen VMs, kann man diese ausspionieren. Dabei lassen sich auf überraschend vielen Wegen Side-Channel-Angriffe durchführen. --------------------------------------------- http://heise.de/-2760695 *** Hacking Team: a zero-day market case study *** --------------------------------------------- This article documents Hacking Teams third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Teams email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates on the ethics of its participants. The archive also offers insight into the capabilities and limits of offensive-intrusion software developers. Hacking Team was seriously exploit... --------------------------------------------- http://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ *** Securing Cookies using HTTP Headers *** --------------------------------------------- In the previous articles in this series on defending against web attacks using HTTP headers, we have seen the usage of X-Frame-Options and X-XSS-Protection headers. In this article, we will see some HTTP headers to secure cookies. Introduction: Cookies are one of the most sensitive items during a user's session. An authentication cookie is as... --------------------------------------------- http://resources.infosecinstitute.com/defending-against-web-attacks-using-h… *** Another Day, Another Patch *** --------------------------------------------- FreeBSD users were treated this week to an interesting new denial of service attack vector. All supported versions of the OS are affected by the bug, which has now been patched. Junos OS, which is based on FreeBSD, is also affected. If you're a FreeBSD admin and you haven't patched, feel free to disappear now and do so. Don't worry, we'll be here when you're done - Right, now that's out of the way, we can peruse the vulnerability at our leisure. The bug... --------------------------------------------- https://blog.team-cymru.org/2015/07/another-day-another-patch/ *** SBA Afterworks Summer Special: Hacking Team Hacked? => Lessons Learned! *** --------------------------------------------- August 06, 2015 - 5:00 pm - 6:00 pm SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/security-afterworks-hacking-team-hacked… *** Sicherheitsupdate für WordPress *** --------------------------------------------- WordPress 4.2.3 stopft unter anderem ein Sicherheitsloch, durch die Nutzer mit bestimmten Rechten die gesamte Site kompromittieren können. --------------------------------------------- http://heise.de/-2761788 *** Microsofts Advanced Threat Analytics soll Firmennetze schützen *** --------------------------------------------- Microsoft will Firmennetze mit Advanced Threat Analytics gegen Angriffe und Eindringlinge wappnen. Die Software setzt am Active Directory an, soll lernfähig sein und präsentiert Verdächtiges in einer Zeitleiste. --------------------------------------------- http://heise.de/-2761360 *** Cisco IOS Software TFTP Server Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Application Policy Infrastructure Controller Access Control Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR LPTS Network Stack Remote Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40068 *** Security Advisory: PCRE library vulnerability CVE-2015-2325 *** --------------------------------------------- (SOL16983) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16983.htm… *** Security Advisory: Multiple PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026 *** --------------------------------------------- (SOL16993) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16993.htm… *** DSA-3312 cacti - security update *** --------------------------------------------- Multiple SQL injection vulnerabilities were discovered in cacti, a webinterface for graphing of monitoring systems. --------------------------------------------- https://www.debian.org/security/2015/dsa-3312 *** DSA-3313 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a privilege escalation or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3313 *** EMC Avamar Lets Remote Users Traverse the Directory to View Files on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033026 *** USN-2676-1: NBD vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2676-122nd July, 2015nbd vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummarySeveral security issues were fixed in NBD.Software description nbd - Network Block Device protocol DetailsIt was discovered that NBD incorrectly handled IP address matching. Aremote attacker could use this issue with an IP address that has a partialmatch and bypass access restrictions. This... --------------------------------------------- http://www.ubuntu.com/usn/usn-2676-1/ *** Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-135Project: Time Tracker (third-party module)Version: 7.xDate: 2015-July-22Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Multiple vulnerabilitiesDescriptionThis module enables you to track time on entities and comments.The module doesnt sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by... --------------------------------------------- https://www.drupal.org/node/2537866 *** OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-134Project: OSF for Drupal (third-party module)Version: 7.xDate: 2015-July-22Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Scripting, Access bypass, Cross Site Request ForgeryDescriptionThe Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within... --------------------------------------------- https://www.drupal.org/node/2537860 *** FTC Uconnect Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report and video of researchers demonstrating remote exploits on a magazine reporter's automobile. The report and video focus on unauthorized remote access to the Fiat Chrysler Automobile (FCA) Connect automotive infotainment system. ICS-CERT is issuing this alert to provide notice of this report and video, and that a patch is available from the FCA. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-203-01 *** WordPress 4.2.3 Security and Maintenance Release *** --------------------------------------------- July 23, 2015 --------------------------------------------- https://wordpress.org/news/2015/07/wordpress-4-2-3/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21962496 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js in IBM Bluemix is affected by CVE-2015-5380 *** http://www.ibm.com/support/docview.wss?uid=swg21962754 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tealeaf Customer Experience (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21959030 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2015-4000, CVE-2015-0478, CVE-2015-1916). *** http://www.ibm.com/support/docview.wss?uid=swg21962216 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID) *** http://www.ibm.com/support/docview.wss?uid=swg21961812 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron (CVE-2015-0478, CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21961728 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Workload Deployer (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293) *** http://www.ibm.com/support/docview.wss?uid=swg21962334 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962370

1 0

Tageszusammenfassung - Mittwoch 22-07-2015
by Daily end-of-shift report 22 Jul '15

22 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-07-2015 18:00 − Mittwoch 22-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** WP-CLI Guide: Secure WordPress Backup and Update *** --------------------------------------------- Welcome to our second post in the series on WP-CLI for WordPress management over SSH. In our previous post, we discussed how to get your SSH credentials and use WP-CLI to connect to your website over the command line. Before we get into changing anything, we'll show you how to back up your database and compress... --------------------------------------------- https://blog.sucuri.net/2015/07/wp-cli-guide-secure-wordpress-backup-update… *** Exclusive: Visa application portal closed following SC Magazine investigation *** --------------------------------------------- VFS Global closes visa application portal following SC Magazine investigation. Editable Schengen visa application forms accessed FOUR DAYS after operating company VFS Global said a vulnerability had been fixed. --------------------------------------------- http://www.scmagazine.com/exclusive-visa-application-portal-closed-followin… *** Free security tools help detect Hacking Team malware *** --------------------------------------------- Vulnerabilities and other threats exposed in the Hacking Team leaks has spurred Rook Security and Facebook to each release free security tools. --------------------------------------------- http://www.scmagazine.com/rook-security-facebook-release-free-security-tool… *** "Super-Spion": Android-Überwachungssoftware von Hacking Team nutzt allerhand schmutzige Tricks *** --------------------------------------------- Eine Analyse der Spionage-App RCSAndroid zeigt umfassende Ausspähfunktionen auf. Die Infektion erfolgt über Exploits - und möglicherweise auch Google Play. --------------------------------------------- http://heise.de/-2759365 *** Introduction to Alternate Data Streams *** --------------------------------------------- In this post, we defined what is an alternate data stream (ADS), showed how it can be created and read, and how one can remove unwanted ADS.Categories: All Things DevTags: adsalternate data streamsPieter Arntzpowershellstreams(Read more...) --------------------------------------------- https://blog.malwarebytes.org/development/2015/07/introduction-to-alternate… *** Think your website isn't worth anything to hackers? Think again *** --------------------------------------------- Have you ever thought about the cost of your website compromise? --------------------------------------------- https://www.htbridge.com/blog/think-your-website-isn-t-worth-anything-to-ha… *** l+f: Falsche Microsoft-Techniker simulieren falsche Bluescreens *** --------------------------------------------- Die Telefonabzocker, die sich als Microsoft-Techniker ausgeben, haben sich eine neue Masche überlegt - und sind jetzt auch telefonisch erreichbar. --------------------------------------------- http://heise.de/-2760509 *** DFN-CERT-2015-1107: FreeBSD, Transmission Control Protocol (TCP): Eine Schwachstelle erlaubt einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle im Transmission Control Protocol (TCP) der TCP/IP Protocol Suite ermöglicht einem entfernten, nicht authentisierten Angreifer einen kompletten Denial-of-Service-Zustand zu bewirken. Von der Schwachstelle sind alle derzeit unterstützten FreeBSD-Versionen betroffen. Sicherheitsupdates stehen bereit. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1107/ *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco IOS XR Concurrent Data Management Replication Process BGP Process Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40067 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40021 *** [R1] PHP < 5.4.43 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-09 *** Hospira Symbiq Infusion System Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides compensating measures for a vulnerability in the Hospira Symbiq Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01 *** Counter-Strike 1.6 GameInfo Query Reflection DoS *** --------------------------------------------- Topic: Counter-Strike 1.6 GameInfo Query Reflection DoS Risk: Medium Text:#!/usr/bin/perl # # Counter-Strike 1.6 GameInfo Query Reflection DoS # Proof Of Concept # # Copyright 2015 (c) Todor ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070103

1 0

Tageszusammenfassung - Dienstag 21-07-2015
by Daily end-of-shift report 21 Jul '15

21 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-07-2015 18:00 − Dienstag 21-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl Co-Handler: Stephan Richter *** One Perfect Bug: Exploiting Type Confusion in Flash *** --------------------------------------------- Posted by Natalie Silvanovich, Dazed and (Type) ConfusedFor some attackers, it is important that an exploit be extremely reliable. That is to say, the exploit should consistently lead to code execution when it is run on a system with a known platform and Flash version. One way to create such an exploit is to use an especially high-quality bug. This post describes the exploitation of one such bug, and the factors that make it especially good for reliable exploitation.The BugCVE-2015-3077 is a... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-perfect-bug-exploiting-ty… *** Hackers Remotely Kill a Jeep on the Highway - With Me in It *** --------------------------------------------- I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. --------------------------------------------- http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ *** Searching Through the VirusTotal Database, (Tue, Jul 21st) *** --------------------------------------------- Now that my overview of Sysinternals tools with VirusTotal support is complete (Process Explorer, Autoruns and Sigcheck), lets address a couple of remarks I received (BTW, if I missed a Sysinternals tools, let me know with a comment). 1) Upload of files. Some people are worried that the Sysinternals tools will upload (confidential) files to VirusTotal. That is a valid concern, but for each tool I described, I showed how to enable hash searching first. Configured like this, the Sysinternals... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19945&rss *** Finding XSS Vulnerabilities More Quickly with Dynamic Contextual Analysis *** --------------------------------------------- Cross-Site Scripting (XSS) has been around since the 1990s and countless scanners have been created to find this vulnerability class. Each scanner has its own set of payloads with some more extensive than others. However, almost all of these payloads... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Finding-XSS-Vulnerabili… *** Black Hat 2015: 32 SCADA, mobile zero-day vulns will drop *** --------------------------------------------- Pwn storm brews Gird your loins, admins; researchers are set to drop 32 zero-day vulnerabilities at the Black Hat hacking fest in Las Vegas in August. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/21/black_hat_2… *** x86 Exploitation 101: "House of Spirit" - Friendly stack overflow *** --------------------------------------------- The last technique from the "Malloc Maleficarum" is different from all the others because, among the requirements, there's a stack overflow. --------------------------------------------- https://gbmaster.wordpress.com/2015/07/21/x86-exploitation-101-house-of-spi… *** Cybercrime - Tipping the Balance *** --------------------------------------------- It's been said before (on this very blog) but it's worth saying again; if you work back far enough from any cybercrime, eventually you find a person. Someone, somewhere is writing the code and calling the shots. When this statement is presented to a non-technical audience, the question that typically follows is "so who are these people?", and hot on it's heels "why are they doing this?". Simple and reasonable queries, but as most of us know, the answers... --------------------------------------------- https://blog.team-cymru.org/2015/07/cybercrime-tipping-the-balance/ *** Key findings from the ENISA Workshop: Protection of Electronic Communications Infrastructure and Information Sharing *** --------------------------------------------- ENISA’s Workshop on the Protection of Electronic Communications Infrastructure and Information Sharing successfully concluded with the participation of more than forty-five (45) participants from twenty (20) Member States. Representatives included Ministries and National Regulatory Agencies, Electronic communication providers and infrastructure owners. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/key-findings-from-the-enisa-wor… *** Operation Shrouded Horizon: Darkode and its Ties to Bulletproof Hosting Services *** --------------------------------------------- One of the challenges in fighting cybercrime is that it is borderless; cybercriminals can conduct their malicious activities in countries that do not have strict implementation of cybercrime laws. However, no matter how difficult and perilous the task of arresting attackers and taking down cybercriminal operations is, it can be achieved through collaboration between security researchers... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-S0neNV90as/ *** DFN-CERT-2015-1104: Microsoft Internet Explorer: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- ZDI-15-362-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CTreePos-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-361-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CCurrentStyle-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-360-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CAttrArray-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-359-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Verarbeitung von Arrays für die Repräsentation von HTML-Tabellen, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu einem Speicherüberlauf ("Out-Of-Bounds Memory Access") führt. Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1104/ *** MS15-078 - Critical: Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904) - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-078 *** ZDI-15-358: BitTorrent/uTorrent URI Protocol Command Line Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent and uTorrent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-358/ *** ZDI-15-363: (0Day) Hewlett-Packard Client Automation Agent Stack Based Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-363/ *** ZDI-15-364: (0Day) Hewlett-Packard Client Automation Agent Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-364/ *** ZDI-15-365: Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-365/ *** VU#912036: N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password *** --------------------------------------------- Vulnerability Note VU#912036 N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview SolarWinds N-Able N-Central is an agent-based enterprise support and management solution. N-Able N-Central contains several hard-coded encryption constants in the web interface that allow decryption of the password when combined. Description CWE-547: Use of Hard-coded,... --------------------------------------------- http://www.kb.cert.org/vuls/id/912036 *** Cisco WebEx Meetings Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39755 *** Cisco WebEx Training Center Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39753 *** Cisco WebEx Administration Site Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39756 *** Cisco Videoscape Policy Resource Manager Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40050 *** [R1] OpenSSL secadv_20150709 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-08 *** SSA-267489 (Last Update 2015-07-21): Vulnerabilities in Android App Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-396873 (Last Update: 2015-07-21): TLS Vulnerability in Ruggedcom ROS- and ROX-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Active Super Shop 1.0 Cross Site Scripting *** --------------------------------------------- Topic: Active Super Shop 1.0 Cross Site Scripting Risk: Low Text:# Exploit Title:Active Super Shop Persistent XSS # Date: Fri July 17 2015 # Exploit Author: Angelo Ruwantha # Vendor Homepag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070101 *** WordPress Mailcwp 1.99 Shell Upload *** --------------------------------------------- Topic: WordPress Mailcwp 1.99 Shell Upload Risk: High Text:Title: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin Author: Larry W. Cashdollar, @_larry0 Date: 2015-07... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070100

1 0

Tageszusammenfassung - Montag 20-07-2015
by Daily end-of-shift report 20 Jul '15

20 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-07-2015 18:00 − Montag 20-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cyber-securitys dirty little secret: Its not as bad as you think *** --------------------------------------------- And as for botnets - on their way out A new research report from the Global Commission on Internet Governance has reached a surprising conclusion: cyberspace is actually getting safer. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/18/cybersecuri… *** Its the Data, Stupid! *** --------------------------------------------- At least with MySQL, PostgreSQL and much of the relational database software the defaults are fairly secure: listen on the local interface only and provide some form of authorization by default. This isnt the case with some of the newer NoSQL products that started entering mainstream fairly recently. For the purpose of this article I will talk about one of the more popular NoSQL products called MongoDB, though much of what is being said also applies to other software (Im looking at you Redis). --------------------------------------------- https://blog.shodan.io/its-the-data-stupid/ *** RedStar OS Watermarking *** --------------------------------------------- During the last few months information about one of North Koreas operating systems was leaked. It is a Linux based OS that tries to simulate the look and feel of a Mac. Some of it's features have already been discussed on various blog posts and news articles. We thought we would take a short look at the OS. This blog post contains some of the results. --------------------------------------------- http://www.insinuator.net/2015/07/redstar-os-watermarking/ *** Autoruns and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at autoruns. Autoruns is another fine Sysinternals tool that comes with VirusTotal integration. If you are not familiar with autoruns, it scans all auto-starting locations in Windows and provides a comprehensive report. This gives you an overview of all programs that start automatically on the scanned Windows machine. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19933 *** Sigcheck and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at sigcheck. Sigcheck is a command-line utility to check the digital signature of files like PE files (EXEs). --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19935 *** Disabled Adobe Flash browser plugin? This might not be enough *** --------------------------------------------- I went to the Adobes Flash test page and opened it in IE (top left). As expected, the plugin couldnt run because (see the Manage Add-ons window in the bottom-left corner) it has been disabled. And yet when I opened the same test URL in HH - Flash was right there. And this is a problem. Yes, by disabling Flash in the main browsers we have significantly reduced the risk but we have not eliminated it. --------------------------------------------- http://blog.kulshitsky.com/2015/07/disabled-adobe-flash-browser-plugin.html *** Parlamentswebsite nur mehr mit aktuellen Browsern nutzbar *** --------------------------------------------- SSL-Verschlüsselungsprotokolle werden auf den neuesten Stand gebracht --------------------------------------------- http://derstandard.at/2000019420275 *** Ashley Madison hacked: Site for people who cant be trusted cant be trusted *** --------------------------------------------- Bin site or well spaff everything, say hax0rz Adulterers hookup website Ashley Madison has been hacked, with the miscreants threatening to release personal details, including users sexual fantasies, unless the site is shut down. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/20/ashley_madi… *** BSI warnt vor Sicherheitslücke in Blackberry-Link-App für Mac und PC *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik warnt vor einem Fehler in dem Synchronisationstool. Nutzer sollten aktualisieren. --------------------------------------------- http://heise.de/-2753660 *** Zero Days, the documentary *** --------------------------------------------- VPRO (the Dutch public broadcasting organisation) produced a 45-minute documentary about hacking and the trade of zero days. The documentary has now been released in English on Youtube. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002821.html *** BGP Security Alerts Coming to Twitter *** --------------------------------------------- At Black Hat, researchers from OpenDNS are expected to launch a new Twitter feed called BGP Stream that will send out alerts on possible BGP and DNS hijacking attacks. --------------------------------------------- http://threatpost.com/bgp-security-alerts-coming-to-twitter/113843 *** Maligno: An Open Source Pentesting Tool *** --------------------------------------------- Today I want show you a new tool that could help in your penetration testing activity. Maligno is an open source penetration-testing tool under the FreeBSD license, written in Python for maximum compatibility with Metasploit. It uses the Metasploit framework, in particular msfvenom, to generate the shellcode AES encrypted and encoded prior to transmission. Maligno... --------------------------------------------- http://resources.infosecinstitute.com/maligno-open-source-penetration-testi… *** Cyber savvy? Take a Quick Security Awareness Quiz to Find Out *** --------------------------------------------- So you think you are cyber-savvy knowledgeable in the cyber security risks you face every day in the digital world? Take this quick security quiz and find out. Just get record your answers as you take the quiz. There are 10 questions for this security awareness quiz. You can refer to the Answers Section to... --------------------------------------------- http://resources.infosecinstitute.com/cyber-savvy-take-a-quick-security-awa… *** Free Tool Looks for HackingTeam Malware *** --------------------------------------------- Researchers at Rook Security have released a new tool that looks for HackingTeam malware on target systems, and also have published a set of indicators of compromise to help organizations look for signs of an infection from the intrusion software. The HackingTeam Remote Control System is the company's flagship surveillance and intrusion platform. It sold... --------------------------------------------- http://threatpost.com/free-tool-looks-for-hackingteam-malware/113850 *** OpenSSH anfällig für Bruteforce-Angriffe *** --------------------------------------------- Die eingestellte Grenze der maximal möglichen Passwort-Angaben vor einem Verbindungsabbruch lässt sich in einigen Konfigurationen recht einfach austricksen. --------------------------------------------- http://heise.de/-2753501 *** OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) *** --------------------------------------------- Topic: OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) Risk: Low Text:OpenSSH has a default value of six authentication tries before it will close the connection (the ssh client allows only three p... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070097 *** VU#813631: Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read *** --------------------------------------------- Vulnerability Note VU#813631 Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview Total Commanders File Info plugin version 2.21 attempts an out-of-bounds read when reading a file carefully crafted by an attacker. Description CWE-125: Out-of-bounds Read - CVE-2015-2869An attacker that can control the contents of certain file types may be able to cause an out-of-bounds read error in --------------------------------------------- http://www.kb.cert.org/vuls/id/813631 *** DFN-CERT-2015-1093: JBoss Enterprise Portal Platform: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsmaßnahmen *** --------------------------------------------- Durch eine Schwachstelle in JBoss Portal Plattform ist es einem entfernten, einfach authentifizierten Angreifer möglich, Sicherheitsvorkehrungen zu umgehen. Red Hat stellt für die Komponente PortletBridge von Red Hat JBoss Portal 6.2.0 ein Sicherheitsupdate zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1093/ *** Security Advisory: PCRE library vulnerability CVE-2015-2326 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16984.htm… *** HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04745746 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Power Systems Firmware affected by Open Source - 2 issues for OpenSSL (CVE-2015-0286, CVE-2015-0287) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022521 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Analytic Server (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961993 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Virtualization Engine TS7700 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005295 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Content Manager Enterprise Edition (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962455 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Websphere Partner Gateway Enterprise/Advanced Editions (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962162 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Publishing Engine (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961086 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961214 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808, CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960528 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDKs affect IBM Virtualization Engine TS7700 - April 2015 *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005294 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=swg21957734 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Publishing Engine (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21961080 *** IBM Security Bulletin: Security Vulnerability in IBM WebSphere Application Server affects IBM WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-1920) *** http://www.ibm.com/support/docview.wss?uid=swg21957802 *** IBM Security Bulletin: Insufficient authorization in Service REST API and cross site scripting vulnerability in REST API affecting IBM Business Process Manager (CVE-2015-1905, CVE-2015-1906) *** http://www.ibm.com/support/docview.wss?uid=swg21700717 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962372

1 0

Tageszusammenfassung - Freitag 17-07-2015
by Daily end-of-shift report 17 Jul '15

17 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-07-2015 18:00 − Freitag 17-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** MSRT July 2015: Crowti *** --------------------------------------------- In our ongoing effort to provide malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Crowti Win32/Reveton Crowti, a file encryption threat, is one of the top prevalent ransomware families. We have recently seen it sent as a spam email attachment with formats similar to those shown below: Figure 1: Email spam samples delivering Crowti as an attachment As well as using spam emails as the entry point or infection... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/07/14/msrt-july-2015-crowti.as… *** Running SAP? Checked for patches lately? Nows a good time *** --------------------------------------------- New round of fixes includes one for security bypass flaw SAP has released its July pack of security fixes, including critical patches one researcher says demand your urgent attention. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/running_sap… *** Ad networks beware; Google raises Red Screen of malware Dearth *** --------------------------------------------- Chrome to take shine off dodgy ad networks. Watch out dodgy ad slingers and news sites; Google is expanding its last line of defence Chrome feature to brand all security-slacker ad networks as unsafe. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/google_safe… *** Fake News App in Hacking Team Dump Designed to Bypass Google Play *** --------------------------------------------- Looking into the app's routines, we believe the app can circumvent Google Play restrictions by using dynamic loading technology. Initially, it only asks for three permissions and can be deemed safe by Google's security standards as there are no exploit codes to be found in the app. However, dynamic loading technology allows the app to download and execute a partial of code from the Internet. It will not load the code while Google is verifying the app but will later push the code once... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/fake-news-app-in… *** Significant Flash exploit mitigations are live in v18.0.0.209 *** --------------------------------------------- Whilst Project Zero has gained a reputation for vulnerability and exploitation research, thats not all that we do. One of the main reasons we perform this research is to provide data to defenders; and one of the things that defenders can do with this data is to devise exploit mitigations. Sometimes, well take on exploit mitigations ourselves. Recently, weve been working with Adobe on Flash mitigations, and this post describes some significant mitigations have landed over the past couple of... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/07/significant-flash-exploit-m… *** Save the Date: 2 November NCSRA-Symposium 2015 *** --------------------------------------------- For the second time the NCSC will be co-organizing the NCSRA Symposium, which will be held on 2 November during Alert Online (the Dutch national cyber security awareness campaign). This symposium offers possibilities for knowledge sharing and community building in cybersecurity research and innovation. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/save-the-date-2-november-nc… *** Process Explorer and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- About a year ago, Rob had a diary entry about checking a file from Process Explorer with VirusTotal. Did you know you can have all EXEs of running processes scanned with VirusTotal? In Process Explorer, add column VirusTotal: Enable VirusTotal checks: And accept the VirusTotal terms: And now you can see the VirusTotal scores: Process Explorer is not the only Sysinternals tool that comes with VirusTotal support. Ill showcase more tools in upcoming diary entries. Sysinternals:... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19931&rss *** SANS: Kostenloser Webcast: 5 Jahre nach Stuxnet: Was hat sich geändert, was nicht und was liegt vor uns *** --------------------------------------------- Wednesday, July 29, 2015 at 17:00 CEST Thomas Brandstetter | In der industriellen Welt war die Entdeckung der Stuxnet-Malware das markanteste Ereignis der letzten Jahre. Viele Präsentationen über Industrial Security haben seither mit dem Satz Seit Stuxnet ist alles anders begonnen. Anlässlich des 5-Jahres-Jubiläums der Entdeckung von Stuxnet lohnt es zu fragen: Stimmt das? Welche Auswirkungen hatte Stuxnet tatsächlich auf die industrielle Welt? Thomas Brandstetter war im... --------------------------------------------- https://www.sans.org/webcasts/5-years-stuxnet-changed-didnt-lies-100617 *** Flash-Updates für Linux und noch einmal für die Extended-Support-Version *** --------------------------------------------- Auch Linux-Nutzer, die nicht mit Chrome unterwegs sind, kommen nun in den Genuss des neuesten Flash-Updates. Außerdem müssen Extended-Support-Nutzer noch mal patchen. --------------------------------------------- http://heise.de/-2752440 *** Kommentar: Weg mit Flash! *** --------------------------------------------- Bei Adobes Plug-in stimmt die Balance aus Nutzen und Risiko nicht mehr. Es wird Zeit, dieses Relikt abzuschalten, meint Herbert Braun --------------------------------------------- http://heise.de/-2751583 *** TotoLink Routers Plagued By XSS, CSRF, RCE Bugs *** --------------------------------------------- A slew of routers manufactured in China are fraught with vulnerabilities, some which have existed in products for as long as six years. --------------------------------------------- http://threatpost.com/totolink-routers-plagued-by-xss-csrf-rce-bugs/113816 *** Bugtraq: Novell GroupWise 2014 WebAccess vulnerable to XSS attacks *** --------------------------------------------- http://www.securityfocus.com/archive/1/536023 *** Elasticsearch 1.6.0 Remote Code Execution *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Remote Code Execution Risk: High Text:Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol that enables r... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070089 *** Elasticsearch 1.6.0 Directory Traversal *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Directory Traversal Risk: Medium Text:Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070090 *** WP Backitup <= 1.9.1 - Backup File Disclosure *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8105 *** Cisco Prime Collaboration Assurance Web Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40003 *** EMC Documentum WebTop Lets Remote Users Redirect the Target User to an Arbitrary Site *** --------------------------------------------- http://www.securitytracker.com/id/1032965 *** EMC Documentum CenterStage Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032966 *** Eaton's Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on January 6, 2015, and is now being released to the ICS-CERT web site. This advisory provides mitigation details for a predictable TCP sequence vulnerability in Eaton's Cooper Power Systems Form 6 and Idea/IdeaPLUS relays with Ethernet application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01 *** SSA-732541 (Last Update 2015-07-17): Denial-of-Service Vulnerability in SIPROTEC 4 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** IBM Security Bulletins *** --------------------------------------------- IBM Vulnerability in Apache Tomcat may affect IBM WebSphere Application Server Community Edition (CVE-2014-0230) IBM Security Bulletin: Open Source Apache Tomcat vulnerability and vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2014-0230, CVE-2014-7810, CVE-2015-4000) IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Secure Proxy and Sterling External Authentication Server (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0478, CVE-2015-0204) IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Application Developer for WebSphere Software (CVE-2015-4000, CVE-2015-1793) IBM Security Bulletin: Vulnerability in OpenSSL affects IBM SDK for Node.js (CVE-2015-1793) IBM Security Bulletin: Vulnerability in the Dojo Toolkit affects IBM Business Process Manager, which is shipped with IBM SmartCloud Orchestrator and IBM SmartCloud Orchestrator Enterprise (CVE-2014-8917) IBM Security Bulletin: Tivoli Workload Scheduler Distributed Potential Security vulnerabilities with IBM WebSphere Application Server (CVE-2015-1920) --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 16-07-2015
by Daily end-of-shift report 16 Jul '15

16 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-07-2015 18:00 − Donnerstag 16-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RC4 crypto: Get RID of it already, say boffins *** --------------------------------------------- This one simple attack busts WPA-TKIP in less than an hour ... As they explain here, the weakness of RC4 (inherited by systems using it) is based on biases in the RC4 keystream. The bias was already known, and is why vendors like Microsoft are working to deprecate it. Whats different in the new work is the acceleration of the cryptanalysis Vanhoef and Piessens carry out. --------------------------------------------- http://www.theregister.co.uk/2015/07/16/rc4_get_rid_of_it_already_say_boffi… *** RC4 in HTTPS & Verbreitung *** --------------------------------------------- RC4 gehört nicht zu den stärksten Verschlüsselungsmethoden, und sollte eigentlich nach RFC7465 (aktuell noch ein Draft) gar nicht mehr verwendet werden. Neue Angriffe ermöglichen im Nachhinein das entschlüsseln von sensitiven Informationen wie zum Beispiel Session cookies innerhalb von wenigen Tagen. In den letzten Wochen haben wir ca. 2 Millionen TLS Konfigurationen weltweit mittels dem Tool... --------------------------------------------- https://www.sba-research.org/2015/07/16/rc4-in-https-verbreitung/ *** Poodle-Nachspiel: Mace und weitere Lücken in TLS-Servern *** --------------------------------------------- Cisco, F5, Juniper, Fortinet: Ein Sicherheitsforscher hat eine Reihe von TLS-Servern entdeckt, die den sogenannten Message Authentication Code (MAC) von Verbindungen nicht prüfen. Andere Serverimplementierungen prüfen eine Checksumme am Ende des Handshakes nicht. --------------------------------------------- http://www.golem.de/news/poodle-nachspiel-mace-und-weitere-luecken-in-tls-s… *** Adobe's CVE-2015-5090 - Updating the Updater to become the bossman *** --------------------------------------------- Amongst the many bugs Adobe patched in July 2015, CVE-2015-5090 stands out as being worth a closer look. Adobe lists this vulnerability as a privilege escalation from low to medium integrity, but this doesn’t tell the whole story. In actuality, this bug can used to execute code with SYSTEM privileges, which could allow an attacker to completely take over a target. Since this affects the Adobe updater service, the bug exists in both Adobe Reader and Acrobat Pro. Both of these programs install the ARMSvc service (Updater) and both keep AdobeARM.exe/AdobeARMHelper.exe in c:\progra~1\common~1\Adobe\ARM\1.0. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Adobe-s-CVE-2015-509… *** Mozilla Winter of Security is back! *** --------------------------------------------- The first edition of MWoS was a success, and a lot of fun for students and mentors, so we decided to run it again this year. For the 2015 edition, we are proposing six projects that directly contribute to our most impactful security tools. Students will be able to work on digital forensics with MIG, SSL/TLS configurations with Menagerie, certificate management with LetsEncrypt, security visualization with MozDef, and web security scanning with OWASP ZAP. --------------------------------------------- https://blog.mozilla.org/security/2015/07/15/mozilla-winter-of-security-is-… *** Understanding PCI compliance fines: Who is in charge of enforcing PCI? *** --------------------------------------------- If your business stores, processes, or transmits data from payment cards, then you are subject to the requirements of the PCI DSS. This set of security controls is designed to help merchants combat da... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/--jT_s5xAyE/article.php *** Researchers prove HTML5 can be used to hide malware *** --------------------------------------------- A group of Italian researchers have come up with new obfuscation techniques that can be used to dupe malware detection systems and allow malicious actors to execute successful drive-by download attack... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/9k3wj_RIqQ8/malware_news.… *** Authentication Bypass Bug Hits Siemens Energy Automation Device *** --------------------------------------------- An authentication bypass vulnerability in a Siemens device that's used in energy automation systems could allow an attacker to gain control of the device. The vulnerability is in the Siemens SICAM MIC, a small telecontrol system that performs a number of functions and includes an integrated Web server and several other features. The devices consist of... --------------------------------------------- http://threatpost.com/authentication-bypass-bug-hits-siemens-energy-automat… *** Are smart infrastructures experts in cyber security? *** --------------------------------------------- [...] Prof. Helmbrecht said: “Currently there is no clear definition of cyber security for smart infrastructures at an EU level. It will be beneficial to increase information sharing and coordination for example on public transport. As new technologies and applications are developed, their security aspects also need to be developed from the design phase, allowing for improved services, user experience and safety in a connected online world”. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/are-smart-infrastructures-exper… *** Bugtraq: ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536014 *** Bugtraq: ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536015 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco WebEx Meetings Server Remote Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39938 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39920 *** Cisco Email Security Appliance Malformed DMARC Policy Records File Modification Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39940 *** Oracle Critical Patch Update Advisory - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Oracle Critical Patch Update - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Solaris Third Party Bulletin - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.h…

1 0

Tageszusammenfassung - Mittwoch 15-07-2015
by Daily end-of-shift report 15 Jul '15

15 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-07-2015 18:00 − Mittwoch 15-07-2015 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** July 2015 Security Updates *** --------------------------------------------- Today we released security updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, and Internet Explorer. As a best practice, we encourage customers to apply security updates as soon as they are released. For more information about this month's security updates and advisories visit the Security TechNet Library. You can also follow the Microsoft Security Response Center (MSRC) team on Twitter at @MSFTSecResponse MSRC Team --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/07/14/july-2015-security-updat… https://technet.microsoft.com/en-us/library/security/MS15-JUL *** TA15-195A: Adobe Flash and Microsoft Windows Vulnerabilities *** --------------------------------------------- Original release date: July 14, 2015 Systems Affected Microsoft Windows systems with Adobe Flash Player installed. Overview Used in conjunction, recently disclosed vulnerabilities in Adobe Flash and Microsoft Windows may allow a remote attacker to execute arbitrary code with system privileges. Since attackers continue to target and find new vulnerabilities in popular, Internet-facing software, updating is not sufficient, and it is important to use exploit mitigation and other defensive --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-195A *** Microsoft Patch Tuesday July 2015 *** --------------------------------------------- Julys Patch Tuesday is here and brings with it a rather large 14 bulletins with 4 Critical and 10 Important rated patches. All combined this months release patches 59 vulnerabilities 29 of which are in the old stalwart Internet Explorer.... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Microsoft-Patch-Tuesday-July… *** Adobe, MS, Oracle Push Critical Security Fixes *** --------------------------------------------- This being the second Tuesday of the month, its officially Patch Tuesday. But its not just Windows users who need to update today: Adobe has released fixes for several products, including a Flash Player bundle that patches two vulnerabilities for which exploit code is available online. Separately, Oracle issued a critical patch update that plugs more than two dozen security holes in Java. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/GZ70l-ulAqw/ *** Oracle Critical Patch Update dichtet 193 Lücken ab *** --------------------------------------------- Wie üblich bei Oracles quartalsweisen Updates stopft die Firma massenweise Lücken in fast allen ihrer Produkte. Sogar die Ghost-Lücke vom Januar feiert ein Comeback. Besonders die Updates für Java und MySQL sollten baldigst installiert werden. --------------------------------------------- http://heise.de/-2750641 *** Microsoft Ends Support for Windows Server 2003, Migration a Must *** --------------------------------------------- End-of-life fun times are coming to infosec departments everywhere again. Just a year after the announcement of Windows XP's end-of-life, we see another body in the OS graveyard: Windows Server 2003. After July 14th, servers running this venerable OS will no longer be receiving any more security updates. This would leave you out in the cold --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/sr3phsOSoFM/ *** Microsoft Security Essentials is no longer available for Windows XP *** --------------------------------------------- We strongly recommend that you complete your migration to a supported operating system as soon as possible so that you can receive regular security updates to help protect your computer from malicious attacks. --------------------------------------------- http://windows.microsoft.com/en-us/windows/security-essentials-download?os=… *** Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39907 *** Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39872 *** Unit 42 Technical Analysis: Seaduke *** --------------------------------------------- Earlier this week Symantec released a blog post detailing a new Trojan used by the "Duke" family of malware. Within this blog post, a payload containing a function named "forkmeiamfamous" was mentioned. While performing some ... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/y_CGsjS6Bio/ *** An In-Depth Look at How Pawn Storm's Java Zero-Day Was Used *** --------------------------------------------- Operation Pawn Storm is a campaign known to target military, embassy, and defense contractor personnel from the United States and its allies. The attackers behind Operation Pawn Storm have been active since at least 2007 and they continue to launch new campaigns. Over the past year or so, we have seen numerous techniques and tactics --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gJtU9nel0NM/ *** Hideouts for Lease: The Silent Role of Bulletproof Hosting Services in Cybercriminal Operations *** --------------------------------------------- What do LeaseWeb, Galkahost, and Spamz have in common? All of them, at one point or another, have functioned as cybercriminal hideouts in the form of bulletproof hosting services (BPHS). Simply put, BPHS is any hosting facility that can store any type of malicious content like phishing sites, pornography, and command-and-control (C&C) infrastructure. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ojxl_6lsUjU/ *** DFN-CERT-2015-1068/ BlackBerry Link: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1068/ *** Rootkits: User Mode *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Rootkits: Kernel Mode *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** Rootkits: User Mode & Kernel Mode-Part 2 *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** FBI paid Hacking Team to identify Tor users *** --------------------------------------------- Documents leaked online after the Hacking Team data breach revealed that the company supported the FBI in the investigation on Tor users. While the security experts are continuing to analyze the impressive amount of data stolen from the Hacking Team, new revelation are circulating over the Internet. Among the clients of the Italian security firm, there ... --------------------------------------------- http://securityaffairs.co/wordpress/38601/cyber-crime/fbi-hacking-team-tor.… *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- We have our hands on the code repositories of HackingTeam, and inside of them we've found the source code for a cross-platform, highly-featured, government-grade RAT (Remote Access Trojan). It's rare that we get to do analysis of complex malware at the source-code level, so I couldn't wait to write a blog about it! --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Epic Games, Epic Fail: Forumers info blown into dust by hack *** --------------------------------------------- Company sorry for the inconvenience caused. Great Epic Games, known for its Unreal Engine and the Games of War series, sent a grovelling letter to its forum users this morning explaining that a hack "may have resulted in unauthorised access to your username, email address, password, and the date of birth you provided at registration." --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/15/epic_games_… *** Details on Internet-wide Scans from SBA *** --------------------------------------------- To clarify what we are scanning on the Internet, here are some details on the project and which tools we use. Most importantly: if you want your IP to be excluded from future scans, please send an email to abuse(a)sba-research.org. For quite some time now we scan Internet-wide for well-known ports that use TLS, most ... --------------------------------------------- https://www.sba-research.org/2015/07/15/details-on-internet-wide-scans-from…

1 0

Tageszusammenfassung - Dienstag 14-07-2015
by Daily end-of-shift report 14 Jul '15

14 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-07-2015 18:00 − Dienstag 14-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Been hacked? Now to decide if you chase the WHO or the HOW *** --------------------------------------------- Imagine a security researcher has plucked your customer invoice database from a command and control server. Youre nervous and angry. Your boss will soon be something worse and will probably want you to explain who pulled off the heist, and how. But only one of these questions, the how, is worth your precious resources; security experts say the who is an emotional distraction. --------------------------------------------- http://www.theregister.co.uk/2015/07/14/attribution_feature/ *** Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems *** --------------------------------------------- Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets' systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running. They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops). However, the code can very likely work on AMI BIOS as well. A Hacking Team slideshow... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-use… *** Lowering Defenses to Increase Security *** --------------------------------------------- Starting at WhiteHat was a career change for me. I wasn't sure exactly what to expect, but I knew there was a lot of unfamiliar terminology: "MD5 signature", "base64", "cross-site request forgery", "'Referer' header", to name a few. When I started testing real websites, I was surprised that a lot of what I was doing... --------------------------------------------- https://blog.whitehatsec.com/lowering-defenses-to-increase-security/ *** Adobe Updates Flash Player, Shockwave and PDF Reader, (Tue, Jul 14th) *** --------------------------------------------- In a warm up to patch Tuesday, it looks like we have a new version for Adobe Flash Player, Shockwave Player and PDF Reader. Given that some of the exploits against the vulnerabilities patchedare public, you may want to expedite patching and review your Flash Player and browser configuration. the latest (patched) versions are (thanks Dave!): - FlashPlayer 18.0.0.209 - Flash Player EST 13.0.0.305 - Reader 10.1.15 - Reader 11.0.12 - Shockwave Player">12.1.9.159 Bulletins: --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19917&rss *** Adobe: Look, honestly, we really do take Flash security seriously *** *** Mozilla: Right, THATS IT. You, Flash, behind the shed with me. *snick snack* *** *** FLASH MUST DIE, says Facebook security chief *** --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/adobe_respo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/firefox_blo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/facebook_fl… *** Security Bulletins Posted *** --------------------------------------------- Security Bulletins for Adobe Acrobat and Reader (APSB15-15), Adobe Shockwave Player (APSB15-17) and Adobe Flash Player (APSB15-18) have been published. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1247 *** SSA-632547 (Last Update 2015-07-14): Authentication Bypass Vulnerability in SICAM MIC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** VU#919604: Kaseya Virtual System Administrator contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#919604 Kaseya Virtual System Administrator contains multiple vulnerabilities Original Release date: 13 Jul 2015 | Last revised: 13 Jul 2015 Overview Kaseya Virtual System Administrator (VSA), versions R9 and possibly earlier, contains arbitrary file download and open redirect vulnerabilities. Description CWE-22: Improper Limitation of Pathname to a Restricted Directory (Path Traversal) - CVE-2015-2862Kaseya VSA is an IT management platform with a help desk ticketing --------------------------------------------- http://www.kb.cert.org/vuls/id/919604 *** Cisco Vulnerability Alerts *** --------------------------------------------- *** Cisco Identity Services Engine Cross-Frame Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 *** Cisco TelePresence Integrator C Series Multiple Request Parameter Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39880 *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39873 *** Cisco Unified Communications Manager Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39877 *** Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerabilities *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39879 *** Cisco Unified Communications Manager ccmivr Page Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39905 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Moodle Bugs Permit Cross-Site Scripting and Open Redirect Attacks and Let Remote Authenticated Users Modify Data *** --------------------------------------------- http://www.securitytracker.com/id/1032877 *** F5 Security Advisory: Multiple PHP CDF vulnerabilities CVE-2014-0237 and CVE-2014-0238 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16954.htm… *** DFN-CERT-2015-1009: Django: Mehrere Schwachstellen ermöglichen u.a. Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1009/

1 0

Tageszusammenfassung - Montag 13-07-2015
by Daily end-of-shift report 13 Jul '15

13 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-07-2015 18:00 − Montag 13-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- Security researchers the world over have been digging through the massive HackingTeam dump for the past five days, and what we've found has been surprising. I've heard this situation called many things, and there's one description that I can definitely agree with: it's like Christmas for hackers. "On the fifth day of Christmas Bromium sent to... --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Pawn Storm Update: Trend Micro Discovers New Java Zero-Day Exploit *** --------------------------------------------- Analysis and data by Brooks Li (Threats Analyst) and Feike Hacquebord (Senior Threat Researcher) Zero-day exploits continued to be used in targeted attacks because they are effective, given that software vendors have yet to create patches for them. Throughout our on-going investigation and monitoring of a targeted attack campaign, Operation Pawn Storm, we found suspicious URLs that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5OzXdZhhVhc/ *** New Zero-Day Vulnerability (CVE-2015-5123) in Adobe Flash Emerges from Hacking Team Leak *** --------------------------------------------- After two Adobe Flash player zero-days disclosed in a row from the leaked data of Hacking Team, we discovered another Adobe Flash Player zero-day (assigned with CVE number, CVE-2015-5123) that surfaced from the said leak. Adobe has already released a security advisory after we reported the said zero-day. This vulnerability is rated as critical and... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rV5yri4x48E/ *** Mit Windows 10 kommen Updates automatisch *** --------------------------------------------- Windows 10-Kunden können sich künftig nur noch sehr begrenzt aussuchen, wann sie ein Update erhalten. --------------------------------------------- http://futurezone.at/produkte/mit-windows-10-kommen-updates-automatisch/141… *** Jump List Files Are OLE Files, (Sun, Jul 12th) *** --------------------------------------------- Jump List files are another type of files that are actually OLE files. They can contain useful data for forensic investigations. There are a couple of tools that can extract information from these files. Here you can see oledump analyzing an automatic Jump List file: The stream DestList contains the Jump List data: There are several sites on the Internet explaining the format of this data, like this one. I used this information to code a plugin for Jump List files: The plugin takes an option... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19911&rss *** Identifying the five principal methods of network attacks *** --------------------------------------------- Companies are underestimating the risk of failing to provide security training to non-technical staff. A new Intel Security study, which surveyed IT decision makers in European-based companies, fo... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/gSbxVIXvO94/secworld.php *** Mobile SSL failures: More common than they should be *** --------------------------------------------- Securing your mobile application traffic is apparently more difficult than it should be, as researchers Anthony Trummer and Tushar Dalvi discovered when looking into SSL/TLS usage on the Android opera... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/dY8mHp2RDC4/article.php *** Identifying and exploiting IBM WebSphere Application Server *** --------------------------------------------- IBM WebSphere is application server similar to Tomcat, JBoss and WebLogic. Therefore, it should be interesting to any penetration tester doing enterprise scale work where Websphere might be present. It should be also interesting to anyone who is working on securing enterprise environment since Websphere allows deploying own (malicious or not) code to the server. I have written NSE scripts to identify IBM Websphere consoles of application servers and to brute force any usernames and passwords. I... --------------------------------------------- https://k0st.wordpress.com/2015/07/13/identifying-and-exploiting-ibm-websph… *** Start Secure 2015 - Sicherheits-Start-ups gesucht *** --------------------------------------------- Der Wettbewerb "Start Secure 2015" wird gemeinsam vom Innenministerium und der futurezone veranstaltet. Als Organisationspartner fungieren SBA Research, das die Sieger-Start-ups auf Wunsch auch als Inkubator bei der Investorensuche berät, sowie das Kuratorium Sicheres Österreich. --------------------------------------------- http://futurezone.at/thema/start-ups/sicherheits-start-ups-gesucht/139.420.… *** Common Assessment Tool Cheatsheets *** --------------------------------------------- I have an unhealthy obsession for time savers when im doing pentest work. Since a lot of my time is spent on the command line I love cheatsheets. I thought id use this thread to post some of the more awesome cheat sheets I find... --------------------------------------------- https://forum.bugcrowd.com/t/common-assessment-tool-cheatsheets/502 *** Tunneling Data and Commands Over DNS to Bypass Firewalls *** --------------------------------------------- No matter how tightly you restrict outbound access from your network, you probably allow DNS queries to at least one server. Adversaries can abuse this "hole" in your firewall to exfiltrate data and establish stealthy Command and Control (C2) channels that are very difficult to block. ... I am struggling to come up with a solution to plug this firewall "hole", but I have a few risk mitigation recommendations:... --------------------------------------------- https://zeltser.com/c2-dns-tunneling/ *** Google Photo App Uploads Your Images To Cloud, Even After Uninstalling *** --------------------------------------------- Have you ever seen any mobile application working in the background silently even after you have uninstalled it completely? I have seen Google Photos app doing the same. Your Android smartphone continues to upload your phone photos to Google servers without your knowledge, even if you have already uninstalled the Google Photos app from your device. Nashville Business... --------------------------------------------- http://feedproxy.google.com/~r/TheHackersNews/~3/yxF2id-ZsHg/google-photo-a… *** "Forkmeiamfamous": Seaduke, latest weapon in the Duke armory *** --------------------------------------------- Low-profile information-stealing Trojan is used only against high-value targets --------------------------------------------- http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon… *** BGP Hijacking - why you need to care! *** --------------------------------------------- This came across our desk this morning when we were putting together Dragon News Bytes. There is lots of talk about what has been discovered in the recent reporting on the data dump from the Hacking Team incident. A lot of the reporting discusses the ethics of the company's services and whom they have been selling them to. Concentrating for a moment on the technology deployed in this activity, it is suggested that BGP hijacking was involved. This is described the article entitled... --------------------------------------------- https://blog.team-cymru.org/2015/07/bgp-hijacking-why-do-you-need-to-care/ *** Allerletzter Aufruf: Support fÜr Windows 2003 Server endet *** --------------------------------------------- Am 14. Juli ist endgÜltig Schluss. FÜr Windows 2003 Server liefert Microsoft keine Updates mehr aus, auch nicht bei Sicherheitsproblemen. Wobei auch hier zu gelten scheint: Ausnahmen bestÄtigen die Regel. --------------------------------------------- http://www.heise.de/newsticker/meldung/Allerletzter-Aufruf-Support-fuer-Win… *** Hacking Team 0-day Flash Wave with Exploit Kits *** --------------------------------------------- https://www.f-secure.com/weblog/archives/00002819.html *** New PHP Releases Fix BACRONYM MySQL Flaw *** --------------------------------------------- Several new versions of PHP have been released, all of which contain a number of bug fixes, most notably a patch for the so-called BACKRONYM vulnerability in MySQL. That bug in MySQL is caused by a problem with the way that the database software handles requests for secure connections. Researchers at Duo Security disclosed the... --------------------------------------------- http://threatpost.com/new-php-releases-fix-bacronym-mysql-flaw/113740 *** The Adobe Flash Conundrum: Old Habits Die Hard *** --------------------------------------------- Is it time to hop off the endless cycle of Flash vulnerabilities and updates? Last week has not been great for Adobe Flash. The 440GB of leaked Hacking Team emails has become a treasure trove for vulnerability hunters. Over the past 7 days, Flash was hit by three separate vulnerabilities: CVE-2015-5119 CVE-2015-5122 CVE-2015-5123 At this time, only the... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/AmkybOPif7Y/ *** Bugtraq: ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535981 *** Cisco Mobility Services Engine Control And Provisioning Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39825 *** Juniper Security Advisories *** --------------------------------------------- *** Juniper Junos IPv6 SEND Processing Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032849 *** Juniper Junos SRX Network Security Daemon Bug Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032848 *** Juniper Junos EX4600 and QFX Series Unspecified Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032847 *** Juniper Junos J-Web Bugs Let Remote Users Conduct Cross-Site Scripting and Denial of Service Attacks *** http://www.securitytracker.com/id/1032846 *** Bugtraq: [security bulletin] HPSBGN03373 rev.1 - HP Release Control running TLS, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535983 *** Cisco WebEx Meeting Center Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39782 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Boost memory allocator vulnerability CVE-2012-2677 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16946.htm… *** Security Advisory: Multiple SQLite vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16950.htm… *** Security Advisory: Mailx vulnerabilities CVE-2004-2771 and CVE-2014-7844 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16945.htm… *** Security Advisory: Expat vulnerabilities CVE-2012-0876 and CVE-2012-1148 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16949.htm… *** Splunk Enterprise and Splunk Light Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032859 *** Squid CONNECT Method Peer Response Processing Flaw Lets Remote Users Bypass Security Controls *** --------------------------------------------- http://www.securitytracker.com/id/1032873 *** PHP 5.x Security Updates, (Sun, Jul 12th) *** --------------------------------------------- PHP 5.6.11, 5.5.27 and 5.4.43 were updated fixing numerous bugs in the various components of PHP including CVE-2015-3152. PHP recommend testing and upgrading to the current release. The binaries and packages are available here and the release notes here. [1] http://www.php.net/ChangeLog-5.php [2] http://windows.php.net/download/ ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19907&rss *** Joomla J2Store 3.1.6 SQL Injection *** --------------------------------------------- Topic: Joomla J2Store 3.1.6 SQL Injection Risk: Medium Text:J2Store v3.1.6, a Joomla! extension that adds basic store functionality to a Joomla! instance, suffered from two unauthenticate... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070053 *** DFN-CERT-2015-0907 FreeRADIUS: Eine Schwachstelle ermÖglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0907/ *** DFN-CERT-2015-1030 strongSwan: Zwei Schwachstellen ermöglichen das Ausspähen von Informationen und Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1030/

1 0

Tageszusammenfassung - Freitag 10-07-2015
by Daily end-of-shift report 10 Jul '15

10 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-07-2015 18:00 − Freitag 10-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco TelePresence products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39798 http://tools.cisco.com/security/center/viewAlert.x?alertId=39802 http://tools.cisco.com/security/center/viewAlert.x?alertId=39801 http://tools.cisco.com/security/center/viewAlert.x?alertId=39795 http://tools.cisco.com/security/center/viewAlert.x?alertId=39796 http://tools.cisco.com/security/center/viewAlert.x?alertId=39800 http://tools.cisco.com/security/center/viewAlert.x?alertId=39797 *** VMSA-2015-0005 *** --------------------------------------------- VMware Workstation, Player and Horizon View Client for Windows do not set a discretionary access control list (DACL) for one of their processes. This may allow a local attacker to elevate their privileges and execute code in the security context of the affected process. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0005.html *** The Massive OPM Hack Actually Hit 21 Million People *** --------------------------------------------- The massive hack that struck the US Office of Personnel Management affected some 21.5 million people, all of them people who had information stolen about them from a backgrounds investigation database used for evaluating people who sought classified clearances from the government. --------------------------------------------- http://www.wired.com/2015/07/massive-opm-hack-actually-affected-25-million/ *** Yubikeys Zwei-Faktor-Authentifizierung unter Linux nutzen *** --------------------------------------------- Mit Hilfe des Yubikeys lässt sich eine verschlüsselte Systempartition unter Linux zusätzlich per Zwei-Faktor-Authentifizierung absichern. In dieser Kombination kann auch ein bequemeres Kennwort genutzt werden. --------------------------------------------- http://www.golem.de/news/systemverschluesselung-yubikeys-zwei-faktor-authen… *** Magento-Patch: Update soll Kundendaten-Leck stopfen *** --------------------------------------------- Im Shop-System Magento klaffen Lücken, die es Angreifern erlauben, Admin-Konten zu kapern und Kundendaten auszulesen. Der Hersteller hat jetzt einen Patch veröffentlicht, der Abhilfe schaffen soll. --------------------------------------------- http://heise.de/-2747984 *** Hacking Team Shows the World How Not to Stockpile Exploits *** --------------------------------------------- Bank robber Willie Sutton’s famous line about why he robs banks—“because that’s where the money is”—was particularly apt this week after the Italian firm Hacking Team was hacked and at least two zero-day exploits the firm possessed were spilled to the public, along with about 400 gigabytes of company emails and other data. --------------------------------------------- http://www.wired.com/2015/07/hacking-team-shows-world-not-stockpile-exploit… *** Rootkits: User Mode & Kernel Mode - Part 1 *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. In this Part we will learn .. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Programmier-Tipps für die BIOS-Backdoor *** --------------------------------------------- Der Hacker Cr4sh erklärt, wie er eine Hintertür in die UEFI-Firmware eines Intel-Mainboards einbaut. Dabei zeigen sich einmal mehr kritische Lücken in der x86-Plattform, vor allem beim System Management Mode. --------------------------------------------- http://heise.de/-2748219

1 0

Tageszusammenfassung - Donnerstag 9-07-2015
by Daily end-of-shift report 09 Jul '15

09 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-07-2015 18:00 − Donnerstag 09-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Hacking Team Flash Zero-Day Tied To Attacks In Korea and Japan... on July 1 *** --------------------------------------------- Earlier this week several vulnerabilities were disclosed as part of the leak of information from the Italian company Hacking Team. We've noted that this exploit is now in use by various exploit kits. However, feedback provided by the Smart Protection Network also indicates that this exploit was also used in limited attacks in Korea and Japan.... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ys8noghmsHc/ *** Ding! Your RAT has been delivered *** --------------------------------------------- Talos is constantly observing malicious spam campaigns delivering various different types of payloads. Common payloads include things like Dridex, Upatre, and various versions of Ransomware. One less common payload that Talos analyzes periodically are Remote Access Trojans or RATs. A recently observed spam campaign was using freeware remote access trojan DarkKomet (a.k.a DarkComet). This isn't a novel approach since threat actors have been leveraging tools like DarkKomet or Hawkeye... --------------------------------------------- http://blogs.cisco.com/security/talos/darkkomet-rat-spam *** Finnland: 17-jähriger Botnetz-Betreiber verurteilt *** --------------------------------------------- Über 50.000 Rechner für ein Botnetz gekapert, DDoS-Attacken geritten und Kreditkartendaten geklaut: Ein 17-jähriger Finne, angeblich Mitglied der Hackergruppe Lizard Squad, wird zu zwei Jahren auf Bewährung verurteilt. --------------------------------------------- http://heise.de/-2745646 *** Detecting Random - Finding Algorithmically chosen DNS names (DGA), (Thu, Jul 9th) *** --------------------------------------------- Most normal user traffic communicates via a hostname and not an IP address. So looking at traffic communicating directly by IP with no associated DNS request is a good thing do to. Some attackers use DNS names for their communications. There is also malware such as Skybot and the Styx exploit kit that use algorithmically chosen host name rather than IP addresses for their command and control channels. This malware uses what has been called DGA or Domain Generation Algorithms to create random... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19893&rss *** Happy Video Game Day 2015 *** --------------------------------------------- Gamers are being targeted more and more by malware, trojans, and keyloggers, especially those that participate in pay-to-play games and MMORPGs (Massively Multiplayer Online Role-Playing Game). Your accounts, personal identity, banking information and even credit card numbers can be stolen if you are playing without a cyber-security solution. The PC gaming market is increasing rapidly and is expected to reach $30.9 Billion in 2016, and with that, the targets are getting bigger and more... --------------------------------------------- http://www.webroot.com/blog/2015/07/08/happy-video-game-day-2015 *** Cisco PSIRT reporting Customers affected by ASA VPN DoS attacks, (Thu, Jul 9th) *** --------------------------------------------- Patch your firewalls! 2015-July-08 UPDATE:">Cisco PSIRT is aware of disruption to some Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this Security Advisory. Traffic causing the disruption was isolated to a specific source IPv4 address. Cisco has engaged the provider and owner of that device and determined that the traffic was sent with no malicious intent. Cisco strongly recommends that customers... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19895&rss *** Sicherheitslücke: OpenSSL akzeptiert falsche Zertifikate *** --------------------------------------------- Ein OpenSSL-Update behebt eine kritische Sicherheitslücke. Mittels einiger Tricks kann ein Angreifer damit ein gewöhnliches Zertifikat zu einer Zertifizierungsstelle machen. Betroffen sind vor allem Clients. --------------------------------------------- http://www.golem.de/news/sicherheitsluecke-openssl-akzeptiert-falsche-zerti… *** OpenSSL CVE-2015-1793: Man-in-the-Middle Attack *** --------------------------------------------- As announced at the beginning of this week, OpenSSL has released the fix for CVE-2015-1793. --------------------------------------------- https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/ *** OpenSSL Security Advisory [9 Jul 2015] *** --------------------------------------------- An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. (original advisory). Reported by Adam Langley and David Benjamin (Google/BoringSSL). --------------------------------------------- https://openssl.org/news/secadv_20150709.txt *** Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-132Project: Administration Views (third-party module)Version: 7.xDate: 2015-July-08Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionAdministration Views module replaces overview/listing pages with actual views for superior usability.The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have --------------------------------------------- https://www.drupal.org/node/2529378

1 0

Tageszusammenfassung - Mittwoch 8-07-2015
by Daily end-of-shift report 08 Jul '15

08 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-07-2015 18:00 − Mittwoch 08-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory for Adobe Flash Player (APSA15-03) *** --------------------------------------------- A Security Advisory (APSA15-03) has been published regarding a critical vulnerability (CVE-2015-5119) in Adobe Flash Player 18.0.0.194 and earlier versions for Windows, .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1223 *** Security Updates Available for Adobe Flash Player (APSB15-16) *** --------------------------------------------- A security bulletin (APSB15-16) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1228 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39675 http://tools.cisco.com/security/center/viewAlert.x?alertId=39643 http://tools.cisco.com/security/center/viewAlert.x?alertId=39641 http://tools.cisco.com/security/center/viewAlert.x?alertId=39623 *** CVE-2015-5119 (HackingTeam 0d - Flash up to 18.0.0.194) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/hackingteam-flash-0d-cve-2015-xxx… *** When ‘int’ is the new ‘short’ *** --------------------------------------------- This is going to be a quick post, just describing a particularly interesting Chrome issue that I found last month; how I found it; and what is interesting about it�I was looking through some Chrome networking code; and I noticed an interesting API design .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/when-int-is-new-short.html *** Windows 10 kann WLAN-Passwörter an Kontakte verteilen *** --------------------------------------------- In Windows 10 lässt sich das WLAN-Passwort automatisch an Facebook-Freunde oder Skype-Kontakte verteilen. Das erspart das lästige Diktieren von Kennwörtern bei Besuch, bringt aber auch Risiken mit sich. --------------------------------------------- http://www.golem.de/news/it-sicherheit-windows-10-kann-wlan-passwoerter-an-… *** Schwachstelle in Nameserversoftware BIND 9 *** --------------------------------------------- Ein Angreifer, der einen Nameserver mit aktivierter DNSSEC-Validierung dazu bringen kann, eine Zone mit speziellem Inhalt abzufragen, kann den Nameserver zum Absturz bringen. --------------------------------------------- https://cert.at/warnings/all/20150708.html *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) - Patches jetzt verfügbar *** --------------------------------------------- Durch Ausnutzen dieser Lücke kann ein Angreifer vermutlich vollständige Kontrolle über betroffene Systeme erlangen. Damit sind alle Daten auf diesen Systemen, sowie alle durch diese erreichbaren (etwa durch Login, VPN etc.) Daten und Systeme gefährdet. --------------------------------------------- https://cert.at/warnings/all/20150708-2.html *** Dyre Banking Trojan Exploits CVE-2015-0057 *** --------------------------------------------- CVE-2015-0057 is a Use-After-Free vulnerability that exists in the win32k.sys component of the Windows Kernel which can be exploited to perform local privilege escalation. The vulnerability was reported to Microsoft by Udi Yavo, and, after the patch .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/dyre_banking_trojan.ht… *** Prenotification: Upcoming Security Updates for Adobe Acrobat and Reader (APSB15-15) *** --------------------------------------------- A prenotification security advisory has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, July 14, 2015. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1232 *** Wild Neutron – Economic espionage threat actor returns with new tricks *** --------------------------------------------- A powerful threat actor known as “Wild Neutron” (also known as “Jripbot” and “Morpho”) has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware. --------------------------------------------- https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-…

1 0

Tageszusammenfassung - Dienstag 7-07-2015
by Daily end-of-shift report 07 Jul '15

07 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-07-2015 18:00 − Dienstag 07-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory: BIG-IQ remote authentication vulnerability CVE-2015-4637 *** --------------------------------------------- When remote authentication is configured on the BIG-IQ system for a LDAP server that allows anonymous BIND operations, a unauthenticated user may obtain an authentication token from the REST API for any known (or guessed) LDAP user account and will receive all the access and privileges of that user account for REST API calls. (CVE-2015-4637) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16861.htm… *** Fraudulent BatteryBot Pro App Yanked from Google Play *** --------------------------------------------- A malicious Android app spoofing the popular BatteryBot Pro app has been pulled from Google Play. Researchers at Zscaler reported the app, which had a package name of com.polaris.BatteryIndicatorPro. The app requested excessive permissions from the user in an attempt to get full control of an .. --------------------------------------------- http://threatpost.com/fraudulent-batterybot-pro-app-yanked-from-google-play… *** Malvertisement - A Nuclear EK Tale *** --------------------------------------------- Over the past couple of years delivering malware via advertisements, or "malvertisement," has become one of the most popular methods of distribution for exploit kits. Like most trends in the world of Internet security, the longer it endures - the .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Malvertisement-%e2%80%9… *** Social Engineering - A Case Study *** --------------------------------------------- In this article, I am going to illustrate a real life social engineering hack that I did it for my friend. My friend saw some property ads on internet. He filled the query form for that ad, and after a day he got a call fraudulent call .. --------------------------------------------- http://resources.infosecinstitute.com/social-engineering-a-case-study/ *** Two major IT-Security Myths debunked *** --------------------------------------------- There are two statements G DATA’s security experts hear and read time and again: “I do not surf on porn websites, my computer can’t get infected” as well as “my computer does not hold anything valuable and I have nothing to hide – why should I be a target?” It would be a pleasure to confirm this, but, unfortunately, we do not live in an ideal world. The company’s latest Malware Report underlines why such sentences should be regarded as myths and IT-Security is important for everyone. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/two-major-it-security-myths-deb… *** NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8081 *** NewStatPress <= 1.0.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8080 *** Safer Internet *** --------------------------------------------- Anna is the director of a small kindergarten in Zurich. To give the kindergarten a home on the Internet, she registered a domain name and put up a website where parents can get up-to-date information about the kindergarten. A friend .. --------------------------------------------- http://securityblog.switch.ch/2015/07/07/safer-internet/ *** Kritischer OpenSSL-Patch voraus *** --------------------------------------------- Mit einer kurzen Notiz verkündet Mark J. Cox, dass man Donnerstag, den 9. Juli, ein Sicherheits-Update für OpenSSL veröffentlichen wolle. Dies sei der höchsten Sicherheitsstufe zuzurechnen (high). Das bedeutet, dass gängige Konfigurationen betroffen sind und die Lücke sich wahrscheinlich ausnutzen lässt, um Denial-of-Service-Angriffe durchzuführen, Daten zu klauen oder sogar betroffene System zu kapern. --------------------------------------------- http://heise.de/-2739804 *** Landeskriminalamt Salzburg warnt vor gefälschten Paketdienst-E-Mails *** --------------------------------------------- In Salzburg sind derzeit verstärkt Internet-Betrüger aktiv. Die Polizei warnt akut vor gefälschten E-Mails im Namen bekannter Paketdienste, die vorgeben, dass eine Postsendung unterwegs sei. Über einen Link könne man den aktuellen Paketstatus abrufen. Ein Klick darauf installiert in Wirklichkeit aber die Schadsoftware "CryptoLocker", welche die auf der Festplatte gespeicherten Daten verschlüsselt. --------------------------------------------- http://derstandard.at/2000018700461 *** Fuzzing: Auf Fehlersuche mit American Fuzzy Lop *** --------------------------------------------- Programme testweise mit massenhaft fehlerhaften Daten zu füttern, ist eine effektive Methode, um Fehler zu finden. Das sogenannte Fuzzing ist schon seit Jahrzehnten bekannt, doch bessere Tools und einige spektakuläre Funde von Sicherheitslücken haben zuletzt das Interesse daran erneut geweckt. --------------------------------------------- http://www.golem.de/news/fuzzing-auf-fehlersuche-mit-american-fuzzy-lop-150… *** New Android Malware Family Evades Antivirus Detection by Using Popular Ad Libraries *** --------------------------------------------- Unit 42 discovered a new family of Android malware that successfully evaded all antivirus products on the VirusTotal web service. We named this malware family 'Gunpoder' based on the main malicious component name, .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/new-android-malware-fami… *** Hacked Hacking Team *** --------------------------------------------- Wie ja seit gestern gross durch die diversen Medien getrommelt wird (siehe etwa heise.de, derstandard.at), wurde das Unternehmen "Hacking Team" anscheinend selbst Opfer eines Angriffs. In den dabei geleakten Daten sind auch etliche Hinweise auf bislang unbekannte Exploits ("0-days") zu finden. Leider fehlt uns die Kapazität, die gesamten geleakten Daten (gut 160.000 Dateien mit insg. rund 400GB!) in endlicher Zeit selbst zu analysieren, daher müssen wir uns dabei auf die Community verlassen. --------------------------------------------- http://www.cert.at/services/blog/20150707141314-1556.html *** Attack of the Zombie Orkut Phishing Pages *** --------------------------------------------- Sometimes long dead websites are targeted by phishing pages. When those sites made use of single sign-on, the danger will never quite go away. Orkut may be gone, but the fake login pages persist .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/07/attack-of-the-zombie-orkut…

1 0

Tageszusammenfassung - Montag 6-07-2015
by Daily end-of-shift report 06 Jul '15

06 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-07-2015 18:00 − Montag 06-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** [20150602] - Core - CSRF Protection *** --------------------------------------------- http://developer.joomla.org/security-centre/618-20150602-core-remote-code-e… *** [20150601] - Core - Open Redirect *** --------------------------------------------- http://developer.joomla.org/security-centre/617-20150601-core-open-redirect… *** This 20-year-old Student Has Written 100 Malware Programs in Two Years *** --------------------------------------------- Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around .. --------------------------------------------- http://thehackernews.com/2015/07/student-hacker.html *** A .BUP File Is An OLE File *** --------------------------------------------- Yesterday I mentioned that McAfee quarantine files on Windows (.BUP extension) are actually OLE files. Im going to write a couple of diary entries highlighting some file types that are OLE files, and .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19869 *** MMD-0036-2015 - KINS (or ZeusVM) v2.0.0.0 tookit (builder & panel) leaked. *** --------------------------------------------- The background KINS (or ZeusVM to be precised) v2.0.0.0 tookit (builder & panel) was leaked and spread all over the internet. On Jun 26th 2015 we were informed about this and after several internal discussion, considering that: "so .. --------------------------------------------- http://blog.malwaremustdie.org/2015/07/mmd-0036-2015-kins-or-zeusvm-v2000.h… *** A fileless Ursnif doing some POS focused reco *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.… *** BizCN gate actor changes from Fiesta to Nuclear exploit kit *** --------------------------------------------- Introduction An actor using gates registered through BizCN recently switched from Fiesta to Nuclear exploit kit (EK). This happened around last month, and we first noticed the change on 2015-06-15. I started writing about this actor in 2014 .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19875 *** Don't Be Fooled By Phony Online Reviews *** --------------------------------------------- The Internet is a fantastic resource for researching the reputation of companies with which you may wish to do business. Unfortunately, this same ease-of-use can lull the unwary into falling for marketing scams originally perfected .. --------------------------------------------- http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/ *** Spionagefirma Hacking Team: "Feind des Internets" selbst gehackt *** --------------------------------------------- Die italienische Überwachungsfirma Hacking Team wurde selbst Opfer eines massiven Hacks: Eindringlinge konnten rund 480 GB an internen Daten übernehmen und diese als Download bereitstellen. Auch der Twitter-Account des Unternehmens wurde übernommen und in "Hacked Team" umbenannt. Die veröffentlichten Informationen .. --------------------------------------------- http://derstandard.at/2000018630550 *** Blue-Pill-Lücke in Xen geschlossen *** --------------------------------------------- In der langen Liste der Sicherheits-Verbesserungen von Xen 4.5.1 finden sich auch eine Lücke, die den Ausbruch aus einer virtuellen Maschine erlaubt - und ein geheimnisvoller, noch undokumentierte Eintrag. --------------------------------------------- http://heise.de/-2736158 *** ManageEngine Password Manager Pro 8.1 SQL Injection *** --------------------------------------------- An authenticated user (even the guest user) is able to execute arbitrary SQL code using a forged request to the SQLAdvancedALSearchResult.cc. The SQL query is build manually and is not escaped properly in the AdvanceSearch.class of AdventNetPassTrix.jar. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070020 *** Insider Threats Defined *** --------------------------------------------- According to the second annual SANS survey on the security of the financial services sector, the number one threat companies are concerned about doesn’t relate to nation-states, organised criminal gangs or ‘APTs’. Rather the main worry revolves around insider threats – but what exactly is an insider threat and what can be done to detect and respond to these threats? --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/insider-threats-defined *** How to Deal with Reverse Domain Name Hijacking *** --------------------------------------------- The fact that one owns a trademark which is identical or confusingly similar to a domain name does not necessarily mean that she is entitled to that domain name. For .. --------------------------------------------- http://resources.infosecinstitute.com/how-to-deal-with-reverse-domain-name-… *** Rätselaufgaben gegen DDoS-Angriffe auf TLS *** --------------------------------------------- Ein Akamai-Mitarbeiter beschreibt, wie mit einfachen Rechenaufgaben DDoS-Angriffe durch Clients auf TLS-Verbindungen minimiert werden könnten. Die Idee ist zwar noch ein Entwurf, könnte aber als Erweiterung für TLS 1.3 standardisiert werden. --------------------------------------------- http://www.golem.de/news/ietf-raetselaufgaben-gegen-ddos-angriffe-auf-tls-1… *** AWS Best Practices for DDoS Resiliency (PDF) *** --------------------------------------------- http://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf *** No one expect command execution ! *** --------------------------------------------- Unix is a beautiful world where your shell gives you the power of launching any command you like. But sometimes, command can be used to launch another commands, and thats sometimes unexpected. --------------------------------------------- http://0x90909090.blogspot.fr/2015/07/no-one-expect-command-execution.html

1 0

Tageszusammenfassung - Freitag 3-07-2015
by Daily end-of-shift report 03 Jul '15

03 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-07-2015 18:00 − Freitag 03-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory: PHP vulnerability CVE-2015-4024 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16826.html *** Angler Exploit Kit Evasion Techniques Keep Cryptowall Thriving *** --------------------------------------------- Since the Angler Exploit Kit began pushing the latest version of Cryptowall ransomware, the kit has gone to great lengths to evade detection from IDS and other security technologies. The latest tactic is an almost-daily change to URL patterns used by the kit in HTTP GET requests for the Angler landing .. --------------------------------------------- http://it.slashdot.org/story/15/07/02/1829244/angler-exploit-kit-evasion-te… *** Plex: Foren des Media Servers gehackt *** --------------------------------------------- Unbekannten Angreifern ist es offenbar gelungen das zum Service gehörige Forum zu hacken, und Zugriff auf sensible Daten zu erhalten. Neben Mail-Adressen sollen dabei auch Passwort-Hashes, private Nachrichten und IP-Adressen abgegriffen worden sein. ... So wurden alle betroffenen User mittlerweile per .. --------------------------------------------- http://derstandard.at/2000018475799/Plex-Foren-des-Media-Servers-gehackt *** Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39612 *** DSA-3299 stunnel4 - security update *** --------------------------------------------- Johan Olofsson discovered an authentication bypass vulnerability inStunnel, a program designed to work as an universal SSL tunnel fornetwork daemons. When Stunnel in .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3299 *** REcon Recap: Here's What Caught My Eye *** --------------------------------------------- A few weeks ago I was fortunate enough to attend REcon in Montreal, Canada. This conference focuses on reverse engineering and exploitation techniques and has been .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/recon-recap/ *** WordPress File Upload <= 2.7.6 - Multiple Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8070 *** Sicherheitsrisiko: LGs Update-App für Smartphones ist anfällig *** --------------------------------------------- Smartphones von LG sind aufgrund einer schlecht umgesetzten SSL-Verschlüsselung anfällig für Man-in-the-Middle-Attacken. Offenbar weiß der Hersteller schon länger davon, ein Patch soll das Problem beheben - auf manchen Geräten ist dieser aber noch nicht angekommen. --------------------------------------------- http://www.golem.de/news/sicherheitsrisiko-lgs-update-app-fuer-smartphones-… *** Viele VPNs plaudern wahre Identität ihrer Nutzer aus *** --------------------------------------------- Forscher finden grobe Implementationsprobleme - IPv6 und DNS-Abfragen unterwandern Sicherheit --------------------------------------------- http://derstandard.at/2000018498920 *** Mozilla: Firefox 39 schmeisst alte Krypto raus *** --------------------------------------------- SSLv3 ist aus Firefox 39 endgültig entfernt worden, und RC4 ist nur noch temporär für einige wenige Seiten erlaubt. Das Mozilla-Team erweitert den Schutz des Browsers vor Malware, daneben gibt es noch viele kleinere Neuerungen. --------------------------------------------- http://www.golem.de/news/mozilla-firefox-39-schmeisst-alte-krypto-raus-1507… *** Kovter AdFraud is updating Flash Player (and Internet Explorer) *** --------------------------------------------- Checking my systems I noticed multiple VM trying to grab last version of Flash and thought they were not properly setup allowing Flash Player to auto-update (which we do not want obviously - we want to keep them exploitable and also avoid behavioural/network noise). --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/kovter-adfraud-is-updating-flash-… *** l+f: Noch mehr Hintertüren bei Cisco *** --------------------------------------------- http://heise.de/-2734480 *** Apple: EFI-Sicherheits-Update nicht für ältere Macs *** --------------------------------------------- Das Sicherheits-Update, das eine mögliche Modifikation der Firmware verhindert, steht zwar für ältere OS-X-Versionen zur Verfügung – lässt sich jedoch nur auf jüngeren Macs installieren. --------------------------------------------- http://heise.de/-2735051

1 0

Tageszusammenfassung - Donnerstag 2-07-2015
by Daily end-of-shift report 02 Jul '15

02 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-07-2015 18:00 − Donnerstag 02-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Attackers Revive Deprecated RIPv1 Routing Protocol in DDoS Attacks *** --------------------------------------------- An advisory from Akamai warns of a recent reflection style DDoS attack in which the deprecated RIPv1 routing protocol was leveraged against targets. --------------------------------------------- http://threatpost.com/attackers-revive-deprecated-ripv1-routing-protocol-in… *** EMC Documentum D2 Input Validation Flaw Lets Remote Authenticated Users Obtain Potentially Sensitive Information *** --------------------------------------------- A remote authetnicated user can send specially crafted data to inject data query language (DQL) commands and obtain potentially sensitive information from the database on the target system. ... The D2CenterstageService.getComments method is affected [CVE-2015-0547]. ... The D2DownloadService.getDownloadUrls method is affected [CVE-2015-0548]. --------------------------------------------- http://www.securitytracker.com/id/1032769 *** Updated Point-to-Point Encryption standard now provides more flexibility *** --------------------------------------------- The Payment Card Industry Security Standards Council (PCI SSC) published an important update to one of its eight security standards, simplifying the development and use of Point-to-Point Encryption (P2PE) solutions that make payment card data unreadable and less valuable to criminals if stolen in a breach. --------------------------------------------- http://www.net-security.org/secworld.php?id=18581 *** Final Year Dissertation Paper Release: An Evaluation of the Effectiveness of EMET 5.1 *** --------------------------------------------- My paper covers three separate exploits that I converted to try bypass EMET 5.1s protections as best I could and the techniques that I used to do so as well as how successful EMET 5.1 was at preventing me from exploiting the vulnerable programs. --------------------------------------------- http://tekwizz123.blogspot.co.at/2015/07/final-year-dissertation-paper-rele… *** ENISA's Udo Helmbrecht at EPP Hearing on cybersecurity *** --------------------------------------------- ENISA's Udo Helmbrecht participated at the EPP Hearing on data driven security, which took place today 1st July 2015, at the European Parliament in Brussels. Topics discussed included: Session I: New trends in digital technology developments and cyber threats to security Session II: Fighting crime: use of new technologies and use of data Session III: Cyber Security: ensuring security and safety on state and individual levels --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa2019s-udo-helmbrecht-at-ep… *** How safe is the Windows 10 Wi-Fi sharing feature? *** --------------------------------------------- ... what worries security experts is the fact that it allows users to share access to their password-protected Wi-Fi networks with their Outlook.com contacts, Skype contacts, and Facebook friends. ... While this feature can come very handy, it could also open users to security risks. --------------------------------------------- http://www.net-security.org/secworld.php?id=18584 *** Cisco Security Advisories/Vulnerability Alerts *** --------------------------------------------- Cisco Unified Communications Domain Manager Default Static Privileged Account Credentials http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39611 --------------------------------------------- Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39583 --------------------------------------------- Cisco Digital Content Manager Message Processing Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39556 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 1-07-2015
by Daily end-of-shift report 01 Jul '15

01 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-06-2015 18:00 − Mittwoch 01-07-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** What is Wi-Fi Sense and Why Does It Want Your Facebook Account? *** --------------------------------------------- Wi-Fi Sense is a feature built into Windows 10. You may see a pop-up saying "Wi-Fi Sense needs permission to use your Facebook account." It also works with Outlook.com and Skype contacts. This feature allows you to share Wi-Fi login information - network names and passphrases - with your friends. It's designed to automatically connect Windows 10 devices to shared networks. ... Wi-Fi Sense was originally a Windows Phone 8.1 feature that made the jump to desktop PCs and tablets with Windows 10. --------------------------------------------- http://www.howtogeek.com/219700/what-is-wi-fi-sense-and-why-does-it-want-yo… *** EU-Kompromiss zu Meldepflichten bei Cyberangriffen steht *** --------------------------------------------- Betreiber "wesentlicher" Infrastrukturen und Dienste in der EU müssen bald Cyberangriffe melden, für Digitalplattformen wie soziale Netzwerke sollen abgestufte Regeln gelten. Darauf haben sich EU-Rat und Parlament geeinigt. --------------------------------------------- http://www.heise.de/newsticker/meldung/EU-Kompromiss-zu-Meldepflichten-bei-… *** Apple Patches Dozens of Flaws in iOS 8.4, OS X 10.10.4 *** --------------------------------------------- Apple has released new versions of iOS and OS X, both of which include a significant number of security patches, several for bugs that can lead to remote code execution and other serious issues. Version 8.4 of iOS contains fixes for more than 30 security vulnerabilities, including bugs in the iOS kernel, WebKit, and CoreText. --------------------------------------------- http://threatpost.com/apple-patches-dozens-of-flaws-in-ios-8-4-os-x-10-10-4… *** ZDI-15-275: (0Day) SolarWinds Storage Manager AuthenticationFilter Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-275/ *** TYPO3 CMS 6.2.14 and 7.3.1 released *** --------------------------------------------- We are announcing the release of the following TYPO3 CMS updates: TYPO3 CMS 6.2.14 LTS TYPO3 CMS 7.3.1 Both versions are maintenance releases and contain bug and security fixes. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6214-and-731-released/ *** Apple gets around to fixing those 77 security holes in OS X Yosemite *** --------------------------------------------- Your OS X box can still be owned by, well, just about everything Apple has released a series of security updates to address 77 CVE-listed security vulnerabilities in OS X Yosemite. --------------------------------------------- http://www.theregister.co.uk/2015/06/30/apple_finally_gets_around_to_fixing… *** A third of iThings open to VPN-hijacking, app-wrecking attacks *** --------------------------------------------- Masques off: Researchers detail five ways to wreck Apple stuff A trio of FireEye researchers have reported twin app-demolishing iOS vulnerabilities Apple has partially fixed in its latest update that could wreck core apps such as the App Store and Settings. --------------------------------------------- http://www.theregister.co.uk/2015/07/01/masque_attack_ios_fireeye/ *** June 2015 Android malware review from Doctor Web *** --------------------------------------------- PRINCIPAL TRENDS IN JUNE - Activity of banking Trojans - Emergence of new downloader - Trojans Emergence of new Android ransomware - Growing number of SMS Trojans --------------------------------------------- http://news.drweb.com/show/?i=9511&lng=en&c=9 *** Cisco Vulnerability Alerts *** --------------------------------------------- Cisco Nexus Devices NX-OS Software Command-Line Interpreter Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39569 --------------------------------------------- Cisco Nexus Devices Python Subsystem Local Privilege Escalation Vulnerabilities http://tools.cisco.com/security/center/viewAlert.x?alertId=39571 --------------------------------------------- Cisco Unified MeetingPlace SQL Injection Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39570 --------------------------------------------- Cisco Nexus 7000 Devices Virtual Device Context Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39568 --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961048 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects PowerKVM (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=isg3T1022395 --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961049 --------------------------------------------- IBM Security Bulletin: CICS Transaction Gateway for Multiplatforms http://www.ibm.com/support/docview.wss?uid=swg21903636 --------------------------------------------- IBM Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web version 7.0 software installations and IBM Tivoli Access Manager for e-business (CVE-2015-1920) http://www.ibm.com/support/docview.wss?uid=swg21960450 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in the FreeType library affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960562 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in FreeType library affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958900 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960668 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958903 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Web (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21960456 --------------------------------------------- Vulnerabilities in NTPv4 affect AIX http://www.ibm.com/support/ --------------------------------------------- IBM Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917) http://www.ibm.com/support/docview.wss?uid=swg21883851 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a kexec-tools vulnerability (CVE-2015-0267) http://www.ibm.com/support/docview.wss?uid=isg3T1022407 --------------------------------------------- IBM Security Bulletin: Dual_EC_DRBG vulnerability and RC4 stream cipher vulnerability affect WebSphere Transformation Extender Secure Adapter Collection (CVE-2007-6755, CVE-2015-2808) http://www.ibm.com/support/docview.wss?uid=swg21959577 --------------------------------------------- IBM Security Bulletin: XSS vulnerability in Error dialog which can execute scripts injected into addressability and comments features that affects IBM Case Manager (CVE-2015-1979) http://www.ibm.com/support/docview.wss?uid=swg21959695 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Sterling Connect:Express for UNIX (CVE-2015-4000, CVE-2014-8176, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792) http://www.ibm.com/support/docview.wss?uid=swg21959308 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cognos Command Center (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960508 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects the Enterprise Common Collector component of the IBM Tivoli zEnterprise Monitoring Agent (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960019 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM InfoSphere Optim Performance Manager (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21959591 --------------------------------------------- IBM Security Bulletin: JavaScript evaluation vulnerability in IBM Business Process Manager (CVE-2015-1961) http://www.ibm.com/support/docview.wss?uid=swg21959052 --------------------------------------------- IBM Security Bulletin: IBM Security Identity Manager Virtual Appliance affected by Java vulnerabilities (CVE-2015-0138 CVE-2015-0204 CVE-2015-1914 CVE-2015-2808 ) http://www.ibm.com/support/docview.wss?uid=swg21960515 --------------------------------------------- IBM Security Bulletin: Potential denial of service may affect IBM WebSphere Application Server shipped with IBM Tivoli Network Performance Manager (CVE-2015-1829) http://www.ibm.com/support/docview.wss?uid=swg21960364 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a bind vulnerability (CVE-2015-1349) http://www.ibm.com/support/docview.wss?uid=isg3T1022295 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a qemu vulnerability (CVE-2014-9718) http://www.ibm.com/support/docview.wss?uid=isg3T1022294 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Access Manager for Mobile (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) http://www.ibm.com/support/docview.wss?uid=swg21959597 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Mobile (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21959604 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance v2 API unrestricted path traversal (CVE-2014-9493, CVE-2015-1195) http://www.ibm.com/support/docview.wss?uid=nas8N1020785 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by Apache Qpid security vulnerabilities (CVE-2015-0203, CVE-2015-0223, CVE-2015-0224) http://www.ibm.com/support/docview.wss?uid=nas8N1020787 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959068 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959071 --------------------------------------------- IBM Security Bulletin: XSS Vulnerability in IBM Jazz Foundation affects multiple IBM Rational products based on IBM Jazz technology (CVE-2015-0130) http://www.ibm.com/support/docview.wss?uid=swg21960407 ---------------------------------------------

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily July 2015