Daily August 2016

daily@lists.cert.at

1 participants
22 discussions

Tageszusammenfassung - Mittwoch 17-08-2016
by Daily end-of-shift report 17 Aug '16

17 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-08-2016 18:00 − Mittwoch 17-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** SQL Injection Vulnerability in Ninja Forms *** --------------------------------------------- As part of our regular research audits for our Sucuri Firewall, we discovered an SQL Injection vulnerability affecting the Ninja Forms plugin for WordPress, currently installed on 600,000+ websites. --------------------------------------------- https://blog.sucuri.net/2016/08/sql-injection-vulnerability-ninja-forms.html *** PMASA-2016-38 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2016-38/ *** PMASA-2016-34 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2016-34/ *** PMASA-2016-39 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2016-39/ *** PMASA-2016-43 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2016-43/ *** PMASA-2016-54 *** --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2016-54/ *** PGP admins: Kill short keys now, or Alice will become Chuck *** --------------------------------------------- Someones impersonating the likes of Linus Torvalds with attacks via keyservers The issue of short .. --------------------------------------------- www.theregister.co.uk/2016/08/17/pgp_admins_kill_short_keys_now_or_alice_wi… *** Snowden: NSA-Leak von Hackern ist "russische Botschaft" an USA *** --------------------------------------------- Der NSA-Whistleblower insinuiert, dass russische Hacker damit die Reaktion auf den Einbruch bei den Demokraten abmildern wollen --------------------------------------------- http://derstandard.at/2000042924155 *** Wartungsarbeiten Donnerstag, 18. 8. 2016, nachmittags *** --------------------------------------------- Am Donnerstag, 18. August 2016, nachmittags, müssen wir dringende Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies wird zu kurzen Ausfällen der extern erreichbaren Services (zB Email, Webserver, Mailinglisten) führen - es gehen dabei keine Daten (zb Emails) verloren, die .. --------------------------------------------- http://www.cert.at/services/blog/20160817111811-1777.html *** VxWorks: Execute My Packets *** --------------------------------------------- Earlier this year we reported 3 vulnerabilities in VxWorks to Wind River. Each of these vulnerabilities can be exploited by anonymous remote attackers on the same .. --------------------------------------------- https://blog.exodusintel.com/2016/08/09/vxworks-execute-my-packets/ *** Sicherheitsbedenken: Provider und Aktivisten vereint gegen Router-Lockdown *** --------------------------------------------- Auch in Österreich soll Routerfirmware künftig reguliert werden. Aktivisten und ISPs kritisieren die geplanten Regelungen. Diese gingen davon aus, dass es keine Sicherheitslücken bei Routern geben würde. --------------------------------------------- http://www.golem.de/news/sicherheitsbedenken-provider-und-aktivisten-verein… *** New wave of targeted attacks focus on industrial organizations *** --------------------------------------------- Kaspersky Lab researchers discovered a new wave of targeted attacks against the industrial and engineering sectors in 30 countries around the world. Dubbed Operation .. --------------------------------------------- https://www.helpnetsecurity.com/2016/08/17/operation-ghoul/

1 0

Tageszusammenfassung - Dienstag 16-08-2016
by Daily end-of-shift report 16 Aug '16

16 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-08-2016 18:00 − Dienstag 16-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Hacker veröffentlichte weitere Unterlagen der US-Demokraten *** --------------------------------------------- Darunter persönliche Handynummern und E-Mail-Adressen von fast 200 Parlamentariern --------------------------------------------- http://derstandard.at/2000042820320 *** Olympia: Hacker-Angriff auf Doping-Informantin Stepanowa *** --------------------------------------------- http://derstandard.at/2000042830707 *** CVE-2016-5696 and its effects on Tor *** --------------------------------------------- tl;dr: This vulnerability is quite serious, but it doesn't effect the Tor network any more than it effects the rest of the internet. In particular, the Tor-specific attacks mentioned in the paper will not work as described. --------------------------------------------- https://blog.patternsinthevoid.net/cve-2016-5696-and-its-effects-on-tor.html *** Forensik-Tool: Forscher stellen Inhalte von Whatsapp und Signal wieder her *** --------------------------------------------- Mit Hilfe einer App sollen Strafverfolgungsbehörden Inhalte von Messenger-Apps .. --------------------------------------------- http://www.golem.de/news/forensik-tool-forscher-stellen-inhalte-von-whatsap… *** Pokemon Go-Ransomware verschlüsselt, erpresst und schnüffelt *** --------------------------------------------- Hinter einer gefakten Version des Smartphone-Spiels PokemonGo für PCs steckt ein Erpressungs-Trojaner, der es auf Daten von Nutzern abgesehen hat. --------------------------------------------- http://heise.de/-3294543 *** Nutzer bringt Windows-Betrüger dazu, Ransomware zu installieren *** --------------------------------------------- User dreht den Spiess um und sorgt für Abschreckung bei Support-Fakern --------------------------------------------- http://derstandard.at/2000042856802 *** Verschlüsselung: Mails zu Veracrypt-Audit verschwinden spurlos *** --------------------------------------------- Ein Audit soll prüfen, ob der Truecrypt-Nachfolger Veracrypt Sicherheitslücken hat. Die Macher der Initiative berichten, dass der Versuch sabotiert werde - E-Mails würden unauffindbar verschwinden. --------------------------------------------- http://www.golem.de/news/geplanter-audit-mails-zu-veracrypt-audit-verschwin… *** Exploit kit shakedown: RIG EK grabs Neutrino EK campaigns *** --------------------------------------------- Something unusual happened in the exploit kit ecosystem. Two well-known malware distribution campaigns switched from Neutrino EK to RIG EK. A temporary .. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/exploits-threat-analysis/2016… *** Hacker behaupten, Spionagetools der NSA gestohlen zu haben *** --------------------------------------------- Sicherheitsforscher gehen von einer Echtheit des Leaks aus, Hacker kündigen "Versteigerung" an --------------------------------------------- http://derstandard.at/2000042884275 *** BlackBerry stopft auch die vierte Quadrooter-Schwachstelle *** --------------------------------------------- Drei der auf der BlackHat USA bekannt gewordenen Schwachstellen waren bereits mit dem monatlichen Sicherheitsupdate repariert. Die vierte schliesst BlackBerry nun mit einem Hotfix. --------------------------------------------- http://heise.de/-3295312 *** The Shadow Brokers: Lifting the Shadows of the NSA's Equation Group? *** --------------------------------------------- This week a hacker group going by the name The Shadow Brokers has surfaced and appears to be auctioning off computer exploits it claims are stolen from the Equation .. --------------------------------------------- https://www.riskbasedsecurity.com/2016/08/the-shadow-brokers-lifting-the-sh… *** Shade: not by encryption alone *** --------------------------------------------- Malefactors continue to expand the features of ransomware as they try to extract maximum benefit from the compromise of infected computers. We recently found an interesting example of such an 'upgrade': a new logic in the latest .. --------------------------------------------- https://securelist.com/blog/research/75645/shade-not-by-encryption-alone/ *** Bewerbungen verbreiten Schadsoftware *** --------------------------------------------- Mit vermeintlichen Bewerbungsschreiben treten Kriminelle an Firmen heran und ersuchen die .. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/bewerbungen-verbreiten-scha… *** Secunia Research: Mit schlechten Statistiken zum falschen Sicherheitseindruck *** --------------------------------------------- Secunia Research schaute sich an, wie gut Anwender ihre Systeme pflegen. Die gute Nachricht: Windows wird in der Regel aktualisiert. Die schlechte: Bei .. --------------------------------------------- http://www.golem.de/news/secunia-research-mit-schlechten-statistiken-zum-fa… *** Microsoft stellt Patchsystem für ältere Windows-Versionen um *** --------------------------------------------- In Zukunft sollen Patch-Pakete einmal im Monat erscheinen und auch ältere Fixes enthalten --------------------------------------------- http://derstandard.at/2000042906045 *** Detection and Prevention of DNS Anomalies *** --------------------------------------------- Malware and Botnets have been a threat to systems and networks for several years. The usual methods of detecting a virus with a local virus scanner or their spreading with intrusion detection system (IDS) will not mitigate the .. --------------------------------------------- http://resources.infosecinstitute.com/detection-prevention-dns-anomalies/ *** P@55w0rd5 - Blessing or curse? *** --------------------------------------------- By now, everybody has passwords for something, just like keys to different doors. The more doors you have to unlock, the bigger your keychain is going to be. This in turn .. --------------------------------------------- https://blog.gdatasoftware.com/2016/28917-p-55w0rd5-blessing-or-curse *** Das Schnurren einer Festplatte verrät Geheimnisse *** --------------------------------------------- Indem Sicherheitsforscher die Geräusche der Zugriffe auf eine Festplatte auswerten, lesen sie Daten von einem Computer aus, auf den sie keinen direkten Zugriff haben. --------------------------------------------- http://heise.de/-3295965 *** Cerber ransomware earns $2.3mil with 0.3% response rate *** --------------------------------------------- The fast-growing Cerber ransomware earned nearly $200,000 in July despite a payment rate of just 0.3 percent as a result of its affiliate distribution model, according to a new report by Check Point and IntSights Cyber .. --------------------------------------------- http://www.cio.com/article/3108368/cyber-attacks-espionage/cerber-ransomwar… *** Microsoft Authenticator: Zweiwege-Authentifizierungs-App kommt für Android und iOS *** --------------------------------------------- Microsoft hat seine neue Autorisierungs-App Authenticator auch für Android und iOS veröffentlicht. Damit können Nutzer Anmeldungen auf einem PC zusätzlich absichern. Praktischerweise können mehrere Konten verwendet werden, auch von Diensten, die Microsoft nicht selbst anbietet. --------------------------------------------- http://www.golem.de/news/microsoft-authenticator-zweiwege-authentifizierung… *** CEO Fraud: Deutscher Autozulieferer Leoni um Millionensumme betrogen *** --------------------------------------------- Der deutsche Autozulieferer Leoni ist Opfer eines millionenschweren Betrugs geworden. Die bisher unbekannten Täter .. --------------------------------------------- http://derstandard.at/2000042922341-406

1 0

Tageszusammenfassung - Freitag 12-08-2016
by Daily end-of-shift report 12 Aug '16

12 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-08-2016 18:00 − Freitag 12-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** An ATM hack and a PIN-pad hack show chip cards aren't impervious to fraud *** --------------------------------------------- The good news? Hacks are limited for now. The bad news? Hackers will get better. --------------------------------------------- http://arstechnica.com/security/2016/08/an-atm-hack-and-a-pin-pad-hack-show… *** Four free tools for handling Amazon Web Services security incident response *** --------------------------------------------- Responding to security incidents that involve deployments within Amazon Web Services is a lot different from responding to incidents that happen on corporate-owned gear, and two researchers have come up with free tools to make that process easier.Obtaining forensic evidence is different, primarily because security pros can't obtain physical access to the machines on which their AWS instances are running.+More on Network World: Black Hat: 9 free security tools for defense... --------------------------------------------- http://www.cio.com/article/3106302/security/four-free-tools-for-handling-am… *** Looking for the insider: Forensic Artifacts on iOS Messaging App, (Thu, Aug 11th) *** --------------------------------------------- Most of the times we care about and focus on external threats, looking for actors that may attack us via phishing emails, vulnerable web services, misconfigured network devices, etc. However, sometimes the threat may come from the inside. In fact, it is not so uncommon to have disloyal/disgruntled employees exfiltrating information from the company (e.g. Intellectual Property to competitors, confidential information to the press, etc.). In such situations, a full forensics analysis of the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21363&rss *** Decrypting Chimera ransomware *** --------------------------------------------- We take a technical look at validating the leaked Chimera ransomware keys as well as if we can decrypt files with these keys. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2016/08/decrypting-chimera-ransomw… *** Ransomware Decryption Tools *** --------------------------------------------- IMPORTANT! Before downloading and starting the solution, read the how-to guide. Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files. --------------------------------------------- https://www.nomoreransom.org/decryption-tools.html *** Analyzing and Cleaning Hijacked Google SEO Spam Results *** --------------------------------------------- Blackhat SEO spam comes in many forms, and one of the most nefarious is hijacked search results. This happens when search engines crawl and display unwanted content in the title and description of infected web pages. The negative impact to the infected website cannot be understated. This harms the website's reputation with visitors and will... --------------------------------------------- https://blog.sucuri.net/2016/08/cleaning-hijacked-google-seo-spam-results.h… *** Microsofts compromised Secure Boot implementation *** --------------------------------------------- Theres been a bunch of coverage of this attack on Microsofts Secure Boot implementation, a lot of which has been somewhat confused or misleading. Heres my understanding of the situation.Windows RT devices were shipped without the ability to disable Secure Boot. Secure Boot is the root of trust for Microsofts User Mode Code Integrity (UMCI) feature, which is what restricts Windows RT devices to running applications signed by Microsoft. This restriction is somewhat inconvenient for developers, so... --------------------------------------------- http://mjg59.dreamwidth.org/44223.html *** Security-Fixes für Ruby on Rails verfügbar *** --------------------------------------------- Die Updates verhindern Cross-Site-Scritping-Attacken über html_safe in den Hauptversionen 3, 4 und 5 sowie die Möglichkeit, Queries in Rails 4.2.x zu manipulieren. --------------------------------------------- http://heise.de/-3293426 *** This is strictly a violation of the TCP specification *** --------------------------------------------- I was asked to debug another weird issue on our network. Apparently every now and then a connection going through CloudFlare would time out with 522 HTTP error. 522 error on CloudFlare indicates a connection issue between our edge server and the... --------------------------------------------- https://blog.cloudflare.com/this-is-strictly-a-violation-of-the-tcp-specifi… *** Finding and Enumerating Processes within Memory: Memory and Volatility *** --------------------------------------------- In this article series, we will learn about how processes reside in memory and various ways to find and enumerate them. I will be using Volatility plugins to find processes in memory. Once we know how to find processes within memory, in Part 2 we will see how to enumerate through them. Note: The scope... --------------------------------------------- http://resources.infosecinstitute.com/finding-and-enumerating-processes-wit… *** VU#301735: ZModo ZP-NE14-S DVR and ZP-IBH-13W cameras contain hard-coded credentials *** --------------------------------------------- Vulnerability Note VU#301735 ZModo ZP-NE14-S DVR and ZP-IBH-13W cameras contain hard-coded credentials Original Release date: 12 Aug 2016 | Last revised: 12 Aug 2016 Overview The ZModo ZP-NE14-S DVR and ZP-IBH-13W cameras contain hard-coded credentials and run telnet by default. Description CWE-798: Use of Hard-coded Credentials - CVE-2016-5081According to the reporter, the Zmodo ZP-NE14-S DVR and ZP-IBH-13W cameras contain undocumented credentials for accessing the device via telnet. --------------------------------------------- http://www.kb.cert.org/vuls/id/301735 *** HPSBHF03440 rev.1 - HPE iLO 3 using JQuery, Remote Cross-Site Scripting (XSS) *** --------------------------------------------- A potential security vulnerability in JQuery was addressed by HPE Integrated Lights-Out 3. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05232730 *** HPSBGN03630 rev.2 - HP Operations Manager for Unix, Solaris, and Linux using Apache Commons Collections (ACC), Remote Code Execution *** --------------------------------------------- A vulnerability in Apache Commons Collections (ACC) for handling Java object deserialization was addressed in the AdminUI of HP Operations Manager for Unix, Solaris and Linux. The vulnerability could be exploited remotely to allow remote code execution. --------------------------------------------- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr… *** IDM 4.5 SOAP Driver Version 4.0.0.4 *** --------------------------------------------- Abstract: Patch update for the Novell Identity Manager SOAP driver. The patch will take the driver version to 4.0.0.4. You must have IDM 4.0.2 or later to use this driver. Document ID: 5251690Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:IDM45_SOAP_4004.zip (161.66 kB)Products:Identity Manager 4.5Superceded Patches:IDM 4.5 SOAP Driver Version 4.0.0.3 --------------------------------------------- https://download.novell.com/Download?buildid=95cHErCKIOQ~ *** F5 Security Advisory: libssh2 vulnerability CVE-2016-0787 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/21/sol21531693.html?… *** F5 Security Advisory: TMM vulnerability CVE-2016-5023 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/19/sol19784568.html?… *** VU#332115: D-Link routers contain buffer overflow vulnerability *** --------------------------------------------- Vulnerability Note VU#332115 D-Link routers contain buffer overflow vulnerability Original Release date: 11 Aug 2016 | Last revised: 11 Aug 2016 Overview D-Link DIR routers contain a stack-based buffer overflow vulnerability, which may allow a remote attack to execute arbitrary code. Description CWE-121: Stack-based Buffer Overflow - CVE-2016-5681A stack-based buffer overflow occurs in the function within the cgibin binary which validates the session cookie.This function is used by a service... --------------------------------------------- http://www.kb.cert.org/vuls/id/332115 *** Rockwell Automation MicroLogix 1400 SNMP Credentials Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a privileged simple network management protocol vulnerability in Rockwell Automation's MicroLogix 1400 programmable logic controllers. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01 *** DSA-3646 postgresql-9.4 - security update *** --------------------------------------------- Several vulnerabilities have been found in PostgreSQL-9.4, a SQLdatabase system. --------------------------------------------- https://www.debian.org/security/2016/dsa-3646 *** FortiVoice 5.0 Filter Bypass & Persistent Web Vulnerabilities *** --------------------------------------------- A vulnerablity in FortiVoice 5.0 web-application could allow malicious script being injected in the affected module; this potentially enables XSS attacks. --------------------------------------------- http://fortiguard.com/advisory/fortivoice-5-0-filter-bypass-persistent-web-… *** Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms ARP Request Handling Denial of Service Vulnerability *** --------------------------------------------- A vulnerability exists in Cisco Access Point (AP) platforms when processing Address Resolution Protocol (ARP) packets that could allow an unauthenticated, adjacent attacker to inject crafted entries into the ARP table and eventually cause a reload of the affected device.The vulnerability is due to improper processing of illegal ARP packets. An attacker could exploit this vulnerability by sending crafted ARP packets to be processed by an affected device. An exploit could allow the attacker to... --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in OpenSSL *** http://www.ibm.com/support/docview.wss?uid=swg21987903 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2109, CVE-2016-2176). *** http://www-01.ibm.com/support/docview.wss?uid=swg21988350 --------------------------------------------- *** IBM Security Bulletin: Multiple security vulnerabilities have been identified in WebSphere Application Server and bundling products shipped with IBM Cloud Orchestrator (CVE-2016-3426, CVE-2016-3427) *** http://www-01.ibm.com/support/docview.wss?uid=swg2C1000178 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager for Mobile is affected by vulnerabilities in OpenSSH (CVE-2016-3115, CVE-2016-1908) *** http://www.ibm.com/support/docview.wss?uid=swg21987636 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager for Web is affected by vulnerabilities in OpenSSH (CVE-2016-3115, CVE-2016-1908) *** http://www.ibm.com/support/docview.wss?uid=swg21987638 --------------------------------------------- *** IBM Security Bulletin: IBM Netezza SQL Extensions is vulnerable to an OpenSource PCRE Vulnerability (CVE-2016-1283, CVE-2016-3191) *** http://www-01.ibm.com/support/docview.wss?uid=swg21985982 --------------------------------------------- Next End-of-Shift report: 2016-08-16

1 0

Tageszusammenfassung - Donnerstag 11-08-2016
by Daily end-of-shift report 11 Aug '16

11 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-08-2016 18:00 − Donnerstag 11-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Sicherheitsforscher kapern HTTP-Verbindungen von Linux *** --------------------------------------------- Eine Schwachstelle im Linux-Kernel gefährdet TCP-Verbindungen. Unter bestimmten Voraussetzungen konnten sich Sicherheitsforscher in Verbindungen einklinken und diese etwa lahmlegen und sogar manipulieren. --------------------------------------------- http://heise.de/-3292257 *** Bing.VC Hijacks Browsers Using Legitimate Applications *** --------------------------------------------- Browser hijackers are a type of malware that modifies a web browser's settings without the user's permission. Generally a browser hijacker injects unwanted advertising into the browser. It replaces the home page or search page with its own. It also steals cookies and can install a keylogger to fetch other sensitive information. McAfee Labs has recently... --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/bing-vc-hijacks-browser-using-legitima… *** Profiling SSL Clients with tshark, (Wed, Aug 10th) *** --------------------------------------------- Cisco recently published a paper showing how malicious SSL traffic sometimes uses very specific SSL options. Once you know what set of SSL options to look for, you will then be able to identify individual pieces of malware without having to decrypt the SSL traffic. (and before anybody complains: SSL does include TLS. I am just old fashioned that way) I wanted to see how well this applies to HTTPS traffic hitting the ISC website. I collected about 100 MB of traffic, which covered client hello... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21361&rss *** Python-based TLS tester tool *** --------------------------------------------- We at Oulu University Secure Programming Group, OUSPG for short, have been developing a neat little gadget called TryTLS. It is a systematic tester tool that checks the safety of TLS libraries. We think we have something of value here, as certificate handling is a very complex and overlooked issue. The tool and info on how to get started can be found here: https://github.com/ouspg/trytls We would really value your input if you could think of some good backends, tests or other resources that... --------------------------------------------- http://www.reddit.com/r/netsec/comments/4x1z36/pythonbased_tls_tester_tool/ *** Linux Trojan Mines For Cryptocurrency Using Misconfigured Redis Servers *** --------------------------------------------- An anonymous reader writes: In another installment of "Linux has malware too," security researchers have discovered a new trojan that targets Linux servers running Redis, where the trojan installs a cryptocurrency miner. The odd fact about this trojan is that it includes a wormable feature that allows it to spread on its own. The trojan, named Linux.Lady, will look for Redis servers that dont have an admin account password, access the database, and then download itself on the new... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/WKFxUVtVPG0/linux-trojan-mi… *** CRIME, TIME, BREACH and HEIST: A brief history of compression oracle attacks on HTTPS *** --------------------------------------------- The HEIST vulnerability was presented at Black Hat USA 2016 by Mathy Vanhoef and Tom Van Goethem. In this presentation, new techniques were presented that enhanced previously presented padding oracle attacks on HTTPS, making them more practical. In a padding oracle attack, the attacker has partial control of part of a message that contains secret information, and is compressed, then encrypted before being sent over the network. An example of this is a web page... --------------------------------------------- https://www.helpnetsecurity.com/2016/08/11/compression-oracle-attacks-https/ *** Volkswagen-Hack: Mit dem Arduino 100 Millionen Autos öffnen *** --------------------------------------------- Mit einem Arduino und Hardware im Wert von 40 US-Dollar lassen sich fast alle Modelle der VW-Gruppe aus den vergangenen 15 Jahren öffnen - sagen Sicherheitsforscher. Das Unternehmen hat die Lücke eingeräumt. 14 weitere Autohersteller sind betroffen. --------------------------------------------- http://www.golem.de/news/hack-mit-dem-arduino-100-millionen-autos-oeffnen-1… *** Road Warriors: Beware of "Video Jacking" *** --------------------------------------------- A little-known feature of many modern smartphones is their ability to duplicate video on the devices screen so that it also shows up on a much larger display -- like a TV. However, new research shows that this feature may quietly expose users to a simple and cheap new form of digital eavesdropping. Dubbed "video jacking" by its masterminds, the attack uses custom electronics hidden inside what appears to be a USB charging station. As soon as you connect a vulnerable phone to the... --------------------------------------------- http://krebsonsecurity.com/2016/08/road-warriors-beware-of-video-jacking/ *** EyeLock nano NXT 3.5 Remote Root Exploit *** --------------------------------------------- EyeLocks nano NXT firmware latest version 3.5 (released 25.07.2016) suffers from multiple unauthenticated command injection vulnerabilities. The issue lies within the rpc.php script located in the /scripts directory and can be triggered when user supplied input is not correctly sanitized while updating the local time for the device and/or get info from remote time server. The vulnerable script has two REQUEST parameters timeserver and localtime that are called within a shell_exec() function for... --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5357.php *** EyeLock nano NXT 3.5 Local File Disclosure Vulnerability *** --------------------------------------------- nano NXT suffers from a file disclosure vulnerability when input passed thru the path parameter to logdownload.php script is not properly verified before being used to read files. This can be exploited to disclose contents of files from local resources. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5356.php *** EyeLock Myris 3.3.2 SDK Service Unquoted Service Path Privilege Escalation *** --------------------------------------------- The application suffers from an unquoted search path issue impacting the service MyrisService for Windows deployed as part of Myris solution. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application... --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5355.php *** Bugtraq: [CORE-2016-0006] - SAP CAR Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539180 *** SSA-378531 (Last Update 2016-08-11): Vulnerabilities in SIMATIC WinCC, PCS 7 and WinCC Runtime Professional *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-378531… *** Security Advisory: BIG-IP file validation vulnerability CVE-2015-8022 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/12/sol12401251.html?… *** Security Advisory: BIG-IP IPsec IKE peer listener vulnerability CVE-2016-5736 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/10/sol10133477.html?… *** Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the driver processing functions of Cisco IOS XR Software for Cisco ASR 9001 Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a memory leak on the route processor (RP) of an affected device, which could cause the device to drop all control-plane protocols and lead to a denial of service condition (DoS) on a targeted system.The vulnerability is due to improper handling of crafted, fragmented packets that --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IP Phone 8800 Series Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web application of the Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to perform a stored, cross-site scripting (XSS) attack.The vulnerability is due to insufficient sanitization of parameter values. An attacker could exploit this vulnerability by storing malicious code on a device and waiting for a user to access a web page that triggers execution of the code. An exploit could allow the attacker to execute arbitrary script code in the context of --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Connected Streaming Analytics Unauthorized Access Vulnerability *** --------------------------------------------- A vulnerability in the administrative web interface of Cisco Connected Streaming Analytics could allow an authenticated, remote attacker to obtain sensitive information.The vulnerability is due to the inclusion of sensitive information in a server response when certain pages of the administrative web interface are accessed. An authenticated attacker who can view the affected configuration page of an affected system could obtain a service password used for event and report notification. This --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Redirect HTTP traffic vulnerability may affect IBM HTTP Server (CVE-2016-5387) *** http://www-01.ibm.com/support/docview.wss?uid=swg21988019 --------------------------------------------- *** IBM Security Bulletin: IBM API Connect server credentials used for a specific restricted scenario may have been exposed (CVE-2016-3012) *** http://www-01.ibm.com/support/docview.wss?uid=swg21988212 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Common Reporting (TCR) 2016Q2 Security Updater : IBM Tivoli Common Reporting is affected by multiple vulnerabilities *** http://www-01.ibm.com/support/docview.wss?uid=swg21986669 --------------------------------------------- *** IBM Security Bulletin: Security Bulletin: IBM Connections Security Refresh for CVE-2016-0310 *** http://www.ibm.com/support/docview.wss?uid=swg21988338 --------------------------------------------- *** IBM Security Bulletin: IBM Connections Security Refresh for CVE-2016-0305, CVE-2016-0307,CVE-2016-0308 *** http://www.ibm.com/support/docview.wss?uid=swg21986770 --------------------------------------------- *** IBM Security Bulletin: Flexara InstallShield vulnerability affects IBM Mobile Connect (CVE-2016-2542) *** http://www.ibm.com/support/docview.wss?uid=swg21986258 --------------------------------------------- *** IBM Security Bulletin: IBM Active Content Filtering Vunerability impacts IBM Docs (CVE-2016-0243 ) *** http://www.ibm.com/support/docview.wss?uid=swg21986626 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 10-08-2016
by Daily end-of-shift report 10 Aug '16

10 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-08-2016 18:00 − Mittwoch 10-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fixing an Internet Security Threat *** --------------------------------------------- A weakness in the Transmission Control Protocol (TCP) of all Linux operating systems since late 2012 enables attackers to hijack users' Internet communications completely remotely, researchers said. --------------------------------------------- http://www.isssource.com/fixing-an-internet-security-threat/ *** August 2016 security update release *** --------------------------------------------- Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month's security updates and advisories can be found in the Security TechNet Library. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2016/08/09/august-2016-security-up… *** Microsoft Patch Tuesday, August 2016, (Tue, Aug 9th) *** --------------------------------------------- Today, Microsoft released a total of 9 security bulletins. 5 of the bulletins are rated critical, the rest are rated important. You can find our usual summary here: https://isc.sans.edu/mspatchdays.html?viewday=2016-08-09(or via the API in various parsable formats) Some of the highlights: MS16-095/096: The usual Internet Explorer and Edge patches. Microsoft addresses nine vulnerabilities for Internet Explorer, and 8 for Edge. Note that there is a lot of overlap. Kind of makes you wonder how... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21357&rss *** MSRT August 2016 release adds Neobar detection *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the August 2016 release of the Microsoft Malicious Software Removal Tool (MSRT) includes detections for BrowserModifier: Win32/Neobar, unwanted software, and Win32/Rovnix, a trojan malware family. This blog discusses BrowserModifier:Win32/Neobar and its inclusion in MSRT supports our unwanted software family detections in Windows Defender, along... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/08/09/msrt-august-2016-releas… *** Kardinalfehler: Microsoft setzt aus Versehen Secure Boot Schachmatt *** --------------------------------------------- Durch eine vergessene Debug-Funktion hat Microsoft jedem Administrator die Möglichkeit gegeben, Secure Boot auch aus der Ferne abzuschalten. Damit aber nicht genug der Peinlichkeiten: Zwei Versuche, die Lücke zu stopfen, scheiterten bereits. --------------------------------------------- http://heise.de/-3291946 *** Google Chrome will beat Flash to death with a shovel: Why... wont... you... just... die! *** --------------------------------------------- Adobe plugin completely snubbed for HTML5 By the end of the year, Google Chrome will block virtually all Flash content and make whatevers left click-to-play by default. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/08/09/google_chro… *** Factsheet Use virtualisation wisely *** --------------------------------------------- Virtualisation of ICT services ensures more efficient and flexible use of hardware. This factsheet is about specific risks that arise when you use virtual servers to outsource ICT services. Your virtual server has an unknown number of virtual neighbours on the host. By using the newly discovered Flip Feng Shui attack method, an attacker can penetrate a virtual neighbour or have it install malware. To date, an attacker could only eavesdrop on the activity of virtual neighbours. The success... --------------------------------------------- https://www.ncsc.nl/english/current-topics/factsheets/factsheet-use-virtual… *** Research team presents Flip Feng Shui attack method at Usenix Security Symposium 2016 *** --------------------------------------------- Researchers of the Vrije Universiteit Amsterdam and the Katholieke Universteit Leuven discovered a new attack method, known as Flip Feng Shui. This is the first attack method that enables an attacker to change the contents of the memory of another virtual server. In this way, he can directly attack the virtual server. Previously discovered attack methods, so-called side channels, aim to eavesdrop on a virtual server on the same host, and gain access to confidential information. On August the --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/researchteam-presents-flip-… *** Verschlüsselung: Microsofts Edge und Internet Explorer 11 werfen RC4 über Bord *** --------------------------------------------- Ab sofort öffnen die Webbrowser Edge und Internet Explorer 11 keine Webseiten mehr, die auf das RC4-Verschlüsselungsverfahren setzen. Das dafür nötige Update verteilt Microsoft aktuell. --------------------------------------------- http://heise.de/-3291361 *** Verflixte Primzahlen: Eine subtile Hintertür im Diffie-Hellman-Schlüsselaustausch *** --------------------------------------------- Benutzt der Diffie-Hellman-Schlüsselaustausch an der richtigen Stelle die falschen Primzahlen, kann ein Angreifer unter Umständen an die geheimen Schlüssel kommen. Das würde ihm erlauben etwa SSL-Verbindungen aufzubrechen. --------------------------------------------- http://heise.de/-3289764 *** Determining the real economic impact of cyber-incidents: A mission (almost) impossible *** --------------------------------------------- Today ENISA publishes a systematic review of studies on the economic impact of cyber-security incidents on critical information infrastructures (CII). --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/determining-the-real-economic-i… *** IDG Contributor Network: Reach em and teach em--educating developers on application security *** --------------------------------------------- How are developers supposed to build security throughout the development lifecycle if they are not taught security at any stage of their education? Vulnerabilities exist because products made by developers who have close to no knowledge of security are hitting the market. Rather than accept the idea that software will never be 100 percent secure, academia and industry leaders can be more proactive and teach developers how to think about application security.In a white paper, "App-Sec... --------------------------------------------- http://www.csoonline.com/article/3105503/application-development/reach-em-a… *** Security Advisory - A Security Vulnerability of Using Insecure Random Numbers to Generate Self-signed Certificates in Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160810-… *** Security Advisory - Buffer Overflow Vulnerability in Huawei USG Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160810-… *** IBM Security Bulletin: XXE and XmlBomb vulnerability in FileNet Workplace (CVE-2016-3055) *** --------------------------------------------- FileNet Workplace is susceptible to the XXE and XmlBomb vulnerability. CVE(s): CVE-2016-3055 Affected product(s) and affected version(s): FileNet Workplace 4.0.2 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: http://www.ibm.com/support/docview.wss?uid=swg21987128X-Force Database:... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21987128 *** IBM Security Bulletin: IBM Forms Experience Builder vulnerable to CSRF when configured with non default settings (CVE-2016-2884) *** --------------------------------------------- A cross-site request forgery attack is possible when configured with non default settings, caused by improper validation of user-supplied input. CVE(s): CVE-2016-2884 Affected product(s) and affected version(s): IBM Forms Experience Builder 8.5 IBM Forms Experience Builder 8.5.1 IBM Forms Experience Builder 8.6.x Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin:... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21987252 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2016-3426) *** --------------------------------------------- There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 7 and Version 8. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Rational Service Tester is only affected by one of these vulnerabilities. CVE(s): CVE-2016-3426 Affected product(s) and affected version(s): Rational Service Tester versions 8.3, 8.5, 8.6,... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21988456 *** IBM Security Bulletin: A security vulnerability in IBM Java Runtime affects IBM Cognos Planning (CVE-2016-3427) *** --------------------------------------------- There are multiple vulnerabilities in IBM Runtime Environment Java Version 6 that is used by IBM Cognos Planning. These issues were disclosed as part of the IBM Java SDK updates in April 2016. CVE(s): CVE-2016-3427 Affected product(s) and affected version(s): IBM Cognos Planning 10.1 IBM Cognos Planning 10.1.1 Refer to the following reference URLs for... --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21975745

1 0

Tageszusammenfassung - Dienstag 9-08-2016
by Daily end-of-shift report 09 Aug '16

09 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-08-2016 18:00 − Dienstag 09-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** "Cat-Loving" Mobile Ransomware Operates With Control Panel *** --------------------------------------------- Recently the McAfee Labs Mobile Malware Research team found a sample of ransomware for Android with botnet capabilities and a web-based control panel service. The malware is running on compromised legitimate servers. The payload of this malware can encrypt a victim's files, steal SMS messages, and block access to the device. In this variant the... --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/cat-loving-mobile-ransomware-operates-… *** Researcher warns of flaws in Samsung Pay tokenization and mag stripe features *** --------------------------------------------- A researcher claims to have found vulnerabilities in Samsung Pays tokenization mechanism and its magnetic secure transmission (MST) technology that could allow hackers to steal users tokens and make fraudulent purchases. --------------------------------------------- http://www.scmagazine.com/researcher-warns-of-flaws-in-samsung-pay-tokeniza… *** Samsung Calls Reports of Samsung Pay Security Flaw "Inaccurate" *** --------------------------------------------- Researcher finds a way to make fraudulent transactions via Samsung Pay, but Samsung denies any issues --------------------------------------------- http://news.softpedia.com/news/samsung-calls-reports-of-samsung-pay-securit… *** Anonymes Dokument: Angriffe auf den FreeBSD-Update-Prozess *** --------------------------------------------- Ein anonymes Dokument beschreibt detailliert Sicherheitslücken im FreeBSD-Update-System. Betroffen sind Portsnap, Libarchive und Bspatch. Fixes gibt es bislang nur für wenige der Bugs. Möglicherweise existieren ähnliche Angriffe auch auf Linux-Systemen. --------------------------------------------- http://www.golem.de/news/anonymes-dokument-angriffe-auf-den-freebsd-update-… *** Sicherheit: Hacker knacken 12 von 16 Smartlocks *** --------------------------------------------- Zwei Hacker haben drei Viertel der von ihnen untersuchten Bluetooth-Smartlocks knacken können - mit stellenweise haarsträubend einfachen Mitteln. Die Reaktion der Hersteller zeugt nicht von großem Interesse, an den Problemen etwas ändern zu wollen. --------------------------------------------- http://www.golem.de/news/sicherheit-hacker-knacken-12-von-16-smartlocks-160… *** DFRWS EU/IMF 2017 *** --------------------------------------------- DFRWS EU 2017 will be held in Überlingen, Lake Constance, Germany. This year brings together two premier research conferences in Europe, the DFRWS digital forensics conference (DFRWS EU 2017) and the International Conference on IT Security Incident Management & IT Forensics (IMF 2017). Established in 2001, DFRWS has become the premier digital forensics conference, dedicated to solving real world challenges, and pushing the envelope of what is currently possible in digital forensics. --------------------------------------------- http://www.dfrws.org/conferences/dfrws-eu-2017 *** Unechte PayLife-Nachricht: Ihre Kreditkarte wird vorläufig eingeschränkt *** --------------------------------------------- In einer E-Mail behaupten Kriminelle, dass PayLife-Kund/innen ihre persönlichen Daten bestätigen müssen. Tun sie das nicht, müssen sie angeblich 89,95 Euro bezahlen. Empfänger/innen, die der Aufforderung nachkommen, übermitteln sensible Kreditkarteninformationen an Verbrecher/innen. --------------------------------------------- https://www.watchlist-internet.at/phishing/unechte-paylife-nachricht-ihre-k… *** Windows 10 Anniversary Update is infested with bugs *** --------------------------------------------- Last month, I warned readers that Microsofts Windows 10 Anniversary Update would likely be somewhat buggy and suggested consumers should wait awhile before installing it. Unfortunately, my advice proved valid.Windows 10 Anniversary Update infestationThere are widespread reports of significant bugs in the update, and theyre causing systems to freeze, browsers to misbehave, and peripherals - including Xbox One controllers - to malfunction. Two major antivirus companies also warn that... --------------------------------------------- http://www.cio.com/article/3104774/windows-security/windows-10-anniversary-… *** QuadRooter vulnerability: 5 things to know about this Android security scare *** --------------------------------------------- Once again, its Android security scare season. This morning news broke of the latest collection of vulnerabilities, discovered by security firm Check Point and grouped together under the catchy monicker "QuadRooter." As usual, most of the reporting has focused on worst-case scenarios and a shockingly huge number of potentially vulnerable devices - in this case, an estimated 900 million. Were going to break down exactly whats going on, and just how vulnerable youre likely to be. --------------------------------------------- http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android… *** IPv6 router bug: Juniper spins out hotfix to thwart DDoS attacks *** --------------------------------------------- Vulnerability common to devices routing IPv6; Cisco offered partial fix in July. --------------------------------------------- http://arstechnica.com/security/2016/08/ipv6-router-bug-juniper-cisco-ddos-… *** Security Bulletin Posted for Adobe Experience Manager (APSB16-27) *** --------------------------------------------- Adobe has published a Security Bulletin for Adobe Experience Manager(APSB16-27). Adobe recommends users apply the relevant hotfix to their product installation using the instructions referenced in the security bulletin. Adobe is not planning to issue a security update for Flash Player this... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1385 *** Cisco IOS and IOS XE Software Crafted Network Time Protocol Packets Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the processing of Network Time Protocol (NTP) packets by Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause an interface wedge and an eventual denial of service (DoS) condition on the affected device.The vulnerability is due to insufficient checks on clearing the invalid NTP packets from the interface queue. An attacker could exploit this vulnerability by sending a number of crafted NTP packets to be processed by an affected device. An exploit... --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Foxit Reader Multiple Flaws Let Remote Users Obtain Potentially Sensitive Information, Deny Service, and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1036558 *** Vuln: OpenSSH CVE-2016-6515 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/92212 *** Bugtraq: ESA-2016-070: RSA Authentication Manager Prime SelfService Insecure Direct Object Reference Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539157 *** Bugtraq: [CVE-2016-6600/1/2/3]: Multiple vulnerabilities (RCE, file download, etc) in WebNMS Framework 5.2 / 5.2 SP1 *** --------------------------------------------- http://www.securityfocus.com/archive/1/539159 *** Trend Micro Control Manager (TMCM) Multiple Vulnerabilities *** --------------------------------------------- https://esupport.trendmicro.com/solution/en-US/1114749.aspx *** Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) Multiple Vulnerabilities *** --------------------------------------------- https://esupport.trendmicro.com/solution/en-US/1114746.aspx *** Trend Micro Smart Protection Server (Standalone) Multiple Vulnerabilities *** --------------------------------------------- https://esupport.trendmicro.com/solution/en-US/1114913.aspx *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: AppScan Source vulnerable to denial of service caused by an XML External Entity (CVE-2016-3033) *** http://www.ibm.com/support/docview.wss?uid=swg21987326 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring Buffer Overflow (CVE-2016-2946 ) *** http://www.ibm.com/support/docview.wss?uid=swg21984578 --------------------------------------------- *** IBM Security Bulletin: Lotus Protector for Mail Security affected by Cross Site Scripting (CVE-2016-2991) *** http://www-01.ibm.com/support/docview.wss?uid=swg21985280 --------------------------------------------- *** IBM Security Bulletin:Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729 CVE-2016-4463) *** http://www.ibm.com/support/docview.wss?uid=swg21987267 --------------------------------------------- *** IBM Security Bulletin: OpenStack vulnerabilities affect IBM Cloud Manager with Openstack (CVE-2015-7548, CVE-2015-8749 CVE-2015-1850) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024106 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 8-08-2016
by Daily end-of-shift report 08 Aug '16

08 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-08-2016 18:00 − Montag 08-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** F5 Security Advisory: glibc vulnerability CVE-2016-3706 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/06/sol06493172.html?… *** Smoke Loader - downloader with a smokescreen still alive *** --------------------------------------------- This time we will have a look at another payload from recent RIG EK campaign. It is Smoke Loader (also known as Dofoil), a bot created several years ago. One of its early versions was advertised on the black marker in 2011.Categories: Malware Threat analysisTags: DofoildownloaderRIG EKsmoke loader(Read more...) --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-download… *** Docker Unspecified Flaw Lets Remote Authenticated Users Deny Service on the Target Swarm Cluster *** --------------------------------------------- http://www.securitytracker.com/id/1036548 *** Apple iOS Memory Corruption Error in IOMobileFrameBuffer Lets Applications Gain Elevated Privileges on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036546 *** FortiAnalyzer & FortiManager - Client Side Cross Site Scripting Web Vulnerability *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016080052 *** This PC monitor hack can manipulate pixels for malicious effect *** --------------------------------------------- Don't believe everything you see. It turns out even your computer monitor can be hacked.On Friday, researchers at DEF CON presented a way to manipulate the tiny pixels found on a computer display.Ang Cui and Jatin Kataria of Red Balloon Security were curious how Dell monitors worked and ended up reverse-engineering one.They picked apart a Dell U2410 monitor and found that the display controller inside can be used to change and log the pixels across the screen.During their DEF CON... --------------------------------------------- http://www.cio.com/article/3104974/this-pc-monitor-hack-can-manipulate-pixe… *** Angriff auf Geldautomaten mit Fernsteuerung *** --------------------------------------------- Ein Sicherheitsforscher hat auf der Blackhat-Konferenz demonstriert, wie sich trotz PIN-Absicherung Bargeld von fremden Konten ziehen lässt. Angeblich lässt sich dabei auch an modernen Geldautomaten die PIN abgreifen, ohne Spuren zu hinterlassen. --------------------------------------------- http://heise.de/-3289469 *** Externe Festplatten mit Verschlüsselung knackbar *** --------------------------------------------- Viele USB-Festplatten mit Vollverschlüsselung und PIN-Tastatur lassen sich vermutlich entschlüsseln, wenn man die Firmware des USB-SATA-Bridge-Chips austauscht. --------------------------------------------- http://heise.de/-3289530 *** Video surveillance recorders RIDDLED with 0-days *** --------------------------------------------- Kit from NUUO, Netgear has face-palm grade stoopid There are multiple Web interface vulnerabilities in a network video recorder under Netgears ReadyNAS brand and various devices by video recording company NUUO. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/08/07/nuuo_netgea… *** Strider: Cyberespionage group turns eye of Sauron on targets *** --------------------------------------------- Low-profile group uses Remsec malware to spy on targets in Russia, China, and Europe. Twitter Card Style: summary_large_image A previously unknown group called Strider has been conducting cyberespionage-style attacks against selected targets in Russia, China, Sweden, and Belgium. The group uses an advanced piece of malware known as Remsec (Backdoor.Remsec) to conduct its attacks.read more --------------------------------------------- http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-ey… *** Week in review: Black Hat USA 2016 coverage, QRLJacking, exposed SAP systems *** --------------------------------------------- Here's an overview of some of last week's most interesting news and articles: Black Hat USA 2016 Want to learn the news from Black Hat USA 2016? Get is all from our dedicated coverage page. QRLJacking: A new attack vector for hijacking online accounts We all know that scanning random QR codes is a risky proposition, but a newly detailed social engineering attack vector dubbed QRLJacking adds another risk layer to their use. 36000 SAP... --------------------------------------------- https://www.helpnetsecurity.com/2016/08/08/week-review-black-hat-usa-2016-c… *** Bugtraq: vBulletin <= 5.2.2 Preauth Server Side Request Forgery (SSRF) *** --------------------------------------------- http://www.securityfocus.com/archive/1/539149 *** VMware product updates address multiple important security issues *** --------------------------------------------- VMware product updates address a DLL hijacking issue in Windows-based VMware Tools and an HTTP Header injection issue in vCenter Server and ESXi. Relevant Products: VMware vCenter Server VMware vSphere Hypervisor (ESXi) VMware Workstation Pro VMware Workstation Player VMware Fusion VMware Tools --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0010.html *** Remote Butler attack: APT groups' dream come true *** --------------------------------------------- Microsoft security researchers have come up with an extension of the "Evil Maid" attack that allows attackers to bypass local Windows authentication to defeat full disk encryption: "Remote Butler". Demonstrated at Black Hat USA 2016 by researchers Tal Be'ery and Chaim Hoch, the Remote Butler attack has one crucial improvement over Evil Maid: it can be effected by attackers who do not have physical access to the target Windows computer that has, at one time,... --------------------------------------------- https://www.helpnetsecurity.com/2016/08/08/remote-butler-attack/ *** IBM Security Bulletin: Multiple vulnerabilities may affect IBM WebSphere Real Time *** --------------------------------------------- Java SE issues disclosed in the Oracle July 2016 Critical Patch Update CVE(s): CVE-2016-3598, CVE-2016-3511, CVE-2016-3485 Affected product(s) and affected version(s): These vulnerabilities affect IBM WebSphere Real Time Version 3 Service Refresh 9 Fix Pack 40 and earlier releases Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=swg21987762X-Force Database:... --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg21987762 *** IBM Security Bulletin: Multiple vulnerabilities may affect IBM SDK, Java Technology Edition *** --------------------------------------------- Java SE issues disclosed in the Oracle July 2016 Critical Patch Update CVE(s): CVE-2016-3610, CVE-2016-3598, CVE-2016-3606, CVE-2016-3587, CVE-2016-3511, CVE-2016-3550, CVE-2016-3485 Affected product(s) and affected version(s): These vulnerabilities affect IBM SDK, Java Technology Edition, Version 6 Service Refresh 16 Fix Pack 26 and earlier releases These vulnerabilities affect IBM SDK, Java Technology Edition, Version 6R1 Service... --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg21986642 *** IBM Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548, CVE-2015-8749 CVE-2015-1850) *** --------------------------------------------- IBM SmartClound Entry is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information CVE(s): CVE-2015-8749, CVE-2015-7548, CVE-2015-1850 Affected product(s) and affected version(s): IBM SmartCloud Entry 3.2 through Appliance fix pack 21 IBM SmartCloud Entry 3.1 through Appliance fix pack 21 Refer to the... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1023865 *** VU#735416: UltraVNC repeater does not restrict IP addresses or ports by default *** --------------------------------------------- Vulnerability Note VU#735416 UltraVNC repeater does not restrict IP addresses or ports by default Original Release date: 08 Aug 2016 | Last revised: 08 Aug 2016 Overview UltraVNC repeater versions prior to ultravnc_repeater_1300 do not restrict usage by IP address by default and cannot restrict by ports, which may be leveraged to induce connections to arbitrary hosts using any port. Description CWE-16: Configuration - CVE-2016-5673UltraVNC repeater acts as a proxy to route remote desktop VNC... --------------------------------------------- http://www.kb.cert.org/vuls/id/735416 *** Neuer auftretender Verschlüsselungs-Trojaner (Ransomware) machen Daten unwiederbringlich unbrauchbar *** --------------------------------------------- [...] Die derzeit auftretenden Varianten der Ransomware benennen sich Vegclass(a)aol.com, Salazar-Slytherin10(a)yahoo.com, usw., der eigentliche Schadcode dürfte dabei jedoch auf die aus Russland stammende Ransomware "Troldesh" zurück zu führen sein. --------------------------------------------- http://www.bmi.gv.at/cms/bmi/_news/bmi.aspx?id=524B7A526E703148456D553D&pag… *** Malware mit Barcodes und Excel in abgeschottete Netze einschleusen *** --------------------------------------------- Ein Hacker bringt Malware auf einem Umweg in Netzwerke, bei denen weder USB noch optische Laufwerke oder Netzwerktransfers funktionieren. Er verwandelt die Software in 2D-Barcodes, die er dann mit Excel wieder in ausführbaren Code verwandelt. --------------------------------------------- http://heise.de/-3290119 *** Qualcomm-powered Android devices plagued by four rooting flaws *** --------------------------------------------- Hundreds of millions of Android devices based on Qualcomm chipsets are likely exposed to at least one of four critical vulnerabilities that allow non-privileged apps to take them over.The four flaws were presented by security researcher Adam Donenfeld from Check Point Software Technologies on Sunday at the DEF CON security conference in Las Vegas. They were reported to Qualcomm between February and April, and the chipset maker has since released fixes for the vulnerabilities after classifying... --------------------------------------------- http://www.cio.com/article/3104896/qualcomm-powered-android-devices-plagued… *** Data Breach At Oracle's MICROS Point-of-Sale Division *** --------------------------------------------- A Russian organized cybercrime group known for hacking into banks and retailers appears to have breached more than 700 computer systems at software giant Oracle Corp., KrebsOnSecurity has learned. More alarmingly, the attackers appear to have compromised a customer support portal for companies using Oracles MICROS point-of-sale credit card payment systems. --------------------------------------------- http://krebsonsecurity.com/?p=35752

1 0

Tageszusammenfassung - Freitag 5-08-2016
by Daily end-of-shift report 05 Aug '16

05 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 04-08-2016 18:00 − Freitag 05-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** iPhone: Nach Diebstahl auf gezieltes Phishing achten *** --------------------------------------------- Diebe setzen auf nachgestellte Apple-Anschreiben, um Beklaute zur Eingabe der Zugangsdaten zu bewegen. Damit können sie die Aktivierungssperre aufheben und das gestohlene iPhone voll funktionsfähig verkaufen. --------------------------------------------- http://heise.de/-3288554 *** Microsoft Bounty Programs Expansion – Microsoft Edge Remote Code Execution (RCE) Bounty *** --------------------------------------------- I’m very happy to announce another addition to the Microsoft Bounty Programs. Microsoft will be hosting a .. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2016/08/04/microsoft-bounty-progra… *** Pwnie Awards 2016: Die Oscars der Security-Szene gehen an … *** --------------------------------------------- Die süßen goldenen Pwnies gingen unter anderem an Tavis Ormandy, Charlie Miller, Juniper und Western Digital. Nicht .. --------------------------------------------- http://heise.de/-3288420 *** To Obfuscate, or not to Obfuscate *** --------------------------------------------- Introduction Malwares goal is to bypass computer defenses, infect a target, and often remain on the system as long as possible. A variety of techniques are used to accomplish .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/To-Obfuscate,-or-not-to… *** Apple will Hackern 200.000 Dollar für Bug-Entdeckung zahlen *** --------------------------------------------- Während Microsoft, Google und Co schon länger Bug Bounty-Programme betreiben, hielt sich Apple bislang zurück --------------------------------------------- http://derstandard.at/2000042391260 *** Cyber Grand Challenge: IT-Security könnte sich radikal ändern *** --------------------------------------------- Wenn Computer völlig autonom Sicherheitslücken suchen, finden und dann entweder stopfen oder ausnutzen, bleibt .. --------------------------------------------- http://heise.de/-3288820 *** WPAD: 20 Jahre altes Protokoll bringt Millionen Nutzer in Gefahr *** --------------------------------------------- Das Protokoll WPAD dient zum automatischen Konfigurieren von Proxies und stellt eine lange bekannte .. --------------------------------------------- http://heise.de/-3288801 *** Odd Packet: Any ideas where this comes from?, (Fri, Aug 5th) *** --------------------------------------------- Out reader submitted to us severalodd packets. Of course, I cant resist to figure out what is exactly going on here: The packets appearto include a lengthy pre-ample, but I .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21343 *** Frequent Password Changes is a Bad Security Idea *** --------------------------------------------- Ive been saying for years that its bad security advice, that it encourages poor passwords. Lorrie Cranor, now the FTCs chief technologist, agrees:By studying the data, the researchers identified common techniques .. --------------------------------------------- https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html *** Nach Bitcoin-Hack: Bitfinex-Diebe wollen jetzt spenden *** --------------------------------------------- Nachdem Angreifer bei Bitfinex Bitcoin im Wert von rund 72 Millionen US-Dollar entwendet haben, wollen sie offenbar einen Teil davon spenden. Insgesamt 1.000 Bitcoin .. --------------------------------------------- http://www.golem.de/news/nach-bitcoin-hack-bitfinex-diebe-wollen-jetzt-spen…

1 0

Tageszusammenfassung - Donnerstag 4-08-2016
by Daily end-of-shift report 04 Aug '16

04 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-08-2016 18:00 − Donnerstag 04-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability *** --------------------------------------------- A vulnerability in the administrative web interface of Cisco TelePresence Video Communication Server Expressway could allow an authenticated, remote attacker to execute arbitrary commands on the affected system.The .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco RV180 VPN and RV180W Wireless-N Multifunction VPN Routers Remote Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco RV180 VPN Router and Cisco RV180W Wireless-N Multifunction VPN Router could allow an authenticated, remote .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco RV110W, RV130W, and RV215W Routers Command Shell Injection Vulnerability *** --------------------------------------------- A vulnerability in the command-line interface (CLI) command parser of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Administration Views - Critical - Access bypass - SA-CONTRIB-2016-041 *** --------------------------------------------- https://www.drupal.org/node/2778501 *** Snitches get stitches: Little Snitch bugs were a blessing for malware *** --------------------------------------------- Now-patched kernel-level flaw in OS X app firewall will be revealed this week DEF CON Vulnerabilities in popular OS X security tool Little Snitch potentially granted malicious applications extra powers, undermining the protection offered by the software. --------------------------------------------- www.theregister.co.uk/2016/08/03/mac_firewall_littlesnitch/ *** A look into Neutrino EK’s jQueryGate *** --------------------------------------------- In the cybercrime landscape, Exploit Kits (EKs) are the tools of choice to infect endpoints by exploiting software vulnerabilities. However, a critical component EKs .. --------------------------------------------- https://blog.malwarebytes.com/threat-analysis/exploits-threat-analysis/2016… *** [20160802] - Core - XSS Vulnerability *** --------------------------------------------- https://developer.joomla.org/security-centre/653-20160802-core-xss-vulnerab… *** [20160801] - Core - ACL Violation *** --------------------------------------------- https://developer.joomla.org/security-centre/652-20160801-core-core-acl-vio… *** [20160803] - Core - CSRF *** --------------------------------------------- https://developer.joomla.org/security-centre/654-20160803-core-csrf.html *** XML External Entity Injection Opens Door to Attacks, Theft *** --------------------------------------------- XML is a popular language for web developers, partially due to its software and hardware independence. Recently, however, XML security is under threat from XML external .. --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/xml-external-entity-injection-opens-do… *** A Plugin’s Expired Domain Poses a Security Threat to Websites *** --------------------------------------------- Do you keep all your website software (including all third-party themes, plugins and components) up-to-date? You should! We always recommend this to our .. --------------------------------------------- https://blog.sucuri.net/2016/08/plugin-expired-domain-security-threat.html *** DSA-3639 wordpress - security update *** --------------------------------------------- https://www.debian.org/security/2016/dsa-3639 *** Activity Log <= 2.3.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8584 *** HEIST: Timing- und Kompressionsangriff auf TLS *** --------------------------------------------- Durch die geschickte Kombination eines Timing-Angriffs in Javascript und der bereits bekannten BREACH-Attacke ist es möglich, Geheimnisse in TLS-Verbindungen zu entschlüsseln. Anders als früher ist dafür kein Man-in-the-Middle-Angriff nötig. --------------------------------------------- http://www.golem.de/news/heist-timing-und-kompressionsangriff-auf-tls-1608-… *** Activity Log <= 2.3.2 - Cross-Site Scripting (XSS) in page *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8585 *** Phishing-Studie: Neugier siegt über Sicherheitsbedenken *** --------------------------------------------- Allen Warnungen und Sicherheitsvorkehrungen zum Trotz: Nutzer lassen sich sehr leicht auf eine Webseite locken, wenn die Phishing-Mail verführerisch genug klingt. Das sollte Auswirkungen auf die Sicherheitsarchitektur haben, fordern Forscher. --------------------------------------------- http://www.golem.de/news/phishing-studie-neugier-siegt-ueber-sicherheitsbed… *** Social Engineering: Jeder zweite fällt auf USB-Sticks und Facebook-Nachrichten rein *** --------------------------------------------- Würden Sie einen gerade gefundenen USB-Stick anschließen? Würden Sie auf den Link in einer Facebook-Nachricht einer Ihnen unbekannten Person klicken? Laut zwei Studien beantworten dies viele mit nein – tun es aber trotzdem. --------------------------------------------- http://heise.de/-3287818 *** DSA-3640 firefox-esr - security update *** --------------------------------------------- https://www.debian.org/security/2016/dsa-3640 *** DSA-3638 curl - security update *** ---------------------------------------------- https://www.debian.org/security/2016/dsa-3638

1 0

Tageszusammenfassung - Mittwoch 3-08-2016
by Daily end-of-shift report 03 Aug '16

03 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-08-2016 18:00 − Mittwoch 03-08-2016 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** MICROSOFT LIVE ACCOUNT CREDENTIALS LEAKING FROM WINDOWS 8 AND ABOVE *** --------------------------------------------- Discovered in 1997 by Aaron Spangler and never fixed, the WinNT/Win95 Automatic Authentication Vulnerability (IE Bug #4) is certainly an excellent vintage. In Windows 8 and 10, the same bug has now been found to potentially leak the user's Microsoft Live account login and (hashed) password information, which is also used to access OneDrive, Outlook, Office, Mobile, Bing, Xbox Live, MSN and Skype (if used with a Microsoft account). --------------------------------------------- https://hackaday.com/2016/08/02/microsoft-live-account-credentials-leaking-… *** Internet-Telefonie: Datenschützer raten zu Perfect Forward Secrecy *** --------------------------------------------- Die Internationale Arbeitsgruppe zum Datenschutz in der Telekommunikation empfiehlt den Einsatz von sicherer Verschlüsselung bei Apps für VoIP oder Chats. Anbieter sollten möglichst wenig personenbezogene Informationen speichern. --------------------------------------------- http://heise.de/-3285356 *** SAP ASE file creation vulnerability (CVE-2016-6196) *** --------------------------------------------- Recently SAP released a patch for an Adaptive Server Enterprise vulnerability that allows legitimate database users to create files on disk where the server process can write to. This is useful when doing a chained database attack - first create... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/SAP-ASE-file-creation-v… *** The Dark Side of Certificate Transparency, (Wed, Aug 3rd) *** --------------------------------------------- I am a big fan of the idea behind Certificate Transparency [1]. The real problem with SSL (and TLS... it really doesnt matter for this discussion) is not the weak ciphers or subtle issues with algorithms (yes, you should still fix it), but the certificate authority trust model. It has been too easy in the past to obtain a fraudulent certificate [2]. There was little accountability when it came to certificate authorities issuing test certificates, or just messing up, and validating the wrong... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21329&rss *** Windows 10 Anniversary Update fordert signierte Treiber schärfer ein *** --------------------------------------------- Seit der 64-Bit-Version von Windows Vista verlangt Microsoft digital signierte Treiber für PC-Komponenten; die jüngste Windows-10-Version 1607 (Redstone) schraubt die Anforderungen höher. --------------------------------------------- http://heise.de/-3285419 *** Unsichere SMS-Authentifizierung: Telegram-Accounts in Iran offenbar gehackt *** --------------------------------------------- Der Messengerdienst Telegram gilt vielen als sichere Alternative zu Whatsapp. Doch es ist durchaus möglich, Sicherheitsvorkehrungen auszuhebeln und an Accounts zu gelangen. --------------------------------------------- http://www.golem.de/news/unsichere-sms-authentifizierung-telegram-accounts-… *** FossHub kompromittiert: Software-Installer mit Malware infiziert *** --------------------------------------------- Die Download-Plattform FossHub ist gehackt worden. Die Hacker haben die Installer von verbreiteten Open-Source-Programmen mit Malware infiziert die den Bootloader überschreibt. --------------------------------------------- http://heise.de/-3286347 *** A brief introduction to Forensic Readiness *** --------------------------------------------- Introduction As defined in the RFC 2350 (Expectations for Computer Security Incident Response), the security incident is any adverse event which compromises some aspect of computer or network security. The definition of an incident may vary between organizations but generally is related to the compromise of confidentiality (i.e. document theft), integrity (i.e. alteration of the... --------------------------------------------- http://resources.infosecinstitute.com/a-brief-introduction-to-forensic-read… *** Finding and Enumerating Processes within Memory-Part 1 *** --------------------------------------------- In this article series, we will learn about how processes reside in memory and various ways to find and enumerate them. I will be using Volatility plugins to find processes in memory. Once we know how to find processes within memory, in Part 2 we will see how to enumerate through them. Note: The scope... --------------------------------------------- http://resources.infosecinstitute.com/finding-and-enumerating-processes-wit… *** Social Engineering: Wie man anderen mit Schokolade das Passwort entlocken kann *** --------------------------------------------- Wissenschafter belegen erschreckend leichtfertigen Umgang mit vertraulichen Daten --------------------------------------------- http://derstandard.at/2000042272093-406 *** Four high-profile vulnerabilities in HTTP/2 revealed *** --------------------------------------------- Imperva released a new report at Black Hat USA 2016, which documents four high-profile vulnerabilities researchers at the Imperva Defense Center found in HTTP/2, the new version of the HTTP protocol that serves as one of the main building blocks of the Worldwide Web. HTTP/2 introduces new mechanisms that effectively increase the attack surface of business critical web infrastructure which then becomes vulnerable to new types of attacks. Imperva researchers took an in-depth look at... --------------------------------------------- https://www.helpnetsecurity.com/2016/08/03/vulnerable-http2/ *** Stealing payment card data and PINs from POS systems is dead easy *** --------------------------------------------- Many of the large payment card breaches that hit retail and hospitality businesses in recent years were the result of attackers infecting point-of-sale systems with memory-scraping malware. But there are easier ways to steal this sort of data, due to a lack of authentication and encryption between card readers and the POS payment applications.POS systems are specialized computers. They typically run Windows and have peripherals like keyboards, touch screens, barcode scanners and card readers... --------------------------------------------- http://www.cio.com/article/3102922/stealing-payment-card-data-and-pins-from… *** Nagios Core Access Control Flaw Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036513 *** Moxa SoftCMS SQL Injection Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a SQL injection vulnerability in Moxas SoftCMS. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-215-01 *** Siemens SINEMA Server Privilege Escalation Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a privilege escalation vulnerability in the Siemens SINEMA Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-215-02

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily August 2016