Daily September 2017

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - 29.09.2017
by Daily end-of-shift report 29 Sep '17

29 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 28-09-2017 18:00 − Freitag 29-09-2017 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Macs Not Receiving EFI Firmware Security Updates as Expected ∗∗∗ --------------------------------------------- Researchers at Duo Security are expected today at Ekoparty to reveal data and a paper that shows Mac users are not receiving EFI firmware updates at expected. --------------------------------------------- http://threatpost.com/macs-not-receiving-efi-firmware-security-updates-as-e… ∗∗∗ ICANN Postpones Scheduled DNS Crypto Key Rollover ∗∗∗ --------------------------------------------- ICANN, the overseer of the Internet’s namespace, announced this week that it was postponing a scheduled change to the cryptographic key that protects the Domain Name System. --------------------------------------------- http://threatpost.com/icann-postpones-scheduled-dns-crypto-key-rollover/128… ∗∗∗ Fake Plugins, Fake Security ∗∗∗ --------------------------------------------- Update: The plugin name is fake and has nothing to do with well-known WP-SpamShield plugin in the official WordPress plugin repository. WordPress users are becoming increasingly more aware of security threats and as a result they are taking more actions to secure their websites (e.g. by installing security plugins). While this is a good thing, there are always black hats trying to take an advantage of new opportunities to compromise websites. --------------------------------------------- https://blog.sucuri.net/2017/09/fake-plugins-fake-security.html ∗∗∗ WiNX: The Ultra-Portable Wireless Attacking Platform ∗∗∗ --------------------------------------------- When you are performing penetration tests for your customers, you need to build your personal arsenal. Tools, pieces of hardware and software are collected here and there depending on your engagements to increase your toolbox. To perform Wireless intrusion tests, I’m a big fan of the WiFi Pineapple. I’ve one for [...] --------------------------------------------- https://blog.rootshell.be/2017/09/28/winx-ultra-portable-wireless-attacking… ∗∗∗ Anonymisierung: Sicherheitsupdates für Tor Browser und Tails ∗∗∗ --------------------------------------------- Der Tor Browser setzt nun auf eine abgesicherte Version von Firefox ESR. In Tails haben die Entwickler diverse Sicherheitslücken, darunter BlueBorne, geschlossen und raten zu einer zügigen Aktualisierung. --------------------------------------------- https://heise.de/-3847033 ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-3985 chromium-browser - security update ∗∗∗ --------------------------------------------- Several vulnerabilities have been discovered in the chromium web browser. --------------------------------------------- https://www.debian.org/security/2017/dsa-3985 ∗∗∗ DSA-3985 chromium-browser - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2017/dsa-3985 ∗∗∗ DFN-CERT-2017-1713: OpenVPN: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1713/ ∗∗∗ IBM Security Bulletin: IBM WebSphere Commerce has a vulnerability in Marketing ESpots that could cause a denial of service (CVE-2017-1569) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008547 ∗∗∗ IBM Security Bulletin: eDiscovery Manager is affected by an Open Source Apache POI Vulnerability ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22005630 ∗∗∗ IBM Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, Business Process Manager, IBM Tivoli Monitoring shipped with IBM Cloud Orchestrator (CVE-2017-1194) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg2C1000343 ∗∗∗ IBM Security Bulletin: A security vulnerability has been identified in IBM Cloud Orchestrator (CVE-2017-1159) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg2C1000328 ∗∗∗ IBM Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Cloud Orchestrator and Cloud Orchestrator Enterprise (CVE-2016-8919) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg2C1000322 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.09.2017
by Daily end-of-shift report 28 Sep '17

28 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 27-09-2017 18:00 − Donnerstag 28-09-2017 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Threat Landscape for Industrial Automation Systems in H1 2017 ∗∗∗ --------------------------------------------- Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team (Kaspersky Lab ICS CERT) publishes the results of its research on the threat landscape for industrial automation systems for the first six months of 2017. --------------------------------------------- http://securelist.com/threat-landscape-for-industrial-automation-systems-in… ∗∗∗ Incident Response Database ∗∗∗ --------------------------------------------- Incidents often require us to rapidly identify which incident response team is responsible for a particular network, corporation or country. FIRST is developing an automated method to access information on Computer Security Incident Response Teams (CSIRT) and other types of incident handling organizations. --------------------------------------------- https://www.first.org/global/irt-database ∗∗∗ Illusion Gap – Antivirus Bypass Part 1 ∗∗∗ --------------------------------------------- Imagine a situation where you double-click a file and Windows loads that file, but your Antivirus scans another file or even scans nothing at all. Sounds weird, right? Depends on who you ask; [...] --------------------------------------------- https://www.cyberark.com/threat-research-blog/illusion-gap-antivirus-bypass… ===================== = Vulnerabilities = ===================== ∗∗∗ DFN-CERT-2017-1706: Cisco IOS, Cisco IOS XE: Mehrere Schwachstellen ermöglichen u.a. das Erlangen von Administratorrechten ∗∗∗ --------------------------------------------- Mehrere Schwachstellen in Cisco IOS und IOS XE, ermöglichen einem entfernten, nicht authentisierten Angreifer das Umgehen von Sicherheitsvorkehrungen, was in einem Fall dazu führen kann, dass der Angreifer die vollständige Kontrolle über ein System erlangen kann, das Ausspähen von Informationen sowie die Durchführung verschiedener Denial-of-Service (DoS)-Angriffe. Ein entfernter, einfach authentisierter Angreifer kann [...] --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1706/ ∗∗∗ ZDI-17-829: Trend Micro OfficeScan tmwfp Memory Corruption Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-17-829/ ∗∗∗ ZDI-17-828: Trend Micro OfficeScan tmwfp Memory Corruption Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-17-828/ ∗∗∗ IBM Security Bulletin: Smart Cloud Entry is affected by ISC BIND vulnerabilities ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=isg3T1025663 ∗∗∗ IBM Security Bulletin: Open Source GNU glibc Vulnerabilities which is used by IBM OS Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-1000366) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008527 ∗∗∗ IBM Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1010641 ∗∗∗ IBM Security Bulletin: Open Source Samba Samba Vulnerabilities which is used by IBM OS Images for RedHat Linux in IBM PureApplication Systems (CVE-2017-7494) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007631 ∗∗∗ IBM Security Bulletin: Cross-site Scripting vulnerabilities affect Rational Engineering Lifecycle Manager ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008785 ∗∗∗ IBM Security Bulletin: IBM Insights Foundation for Energy has vulnerabilites to SQL injection and cross-site scripting ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22009039 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Integration Designer ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008391 ∗∗∗ IBM Security Bulletin: Vulnerability CVE-2017-3511 in IBM Java SDK affects IBM Process Designer used in IBM Business Process Manager ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008324 ∗∗∗ IBM Security Bulletin: IBM WebSphere Cast Iron Solution is affected by an OpenSSL vulnerability (CVE-2017-3731) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008918 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Planning Analytics Local ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008584 ∗∗∗ SSA-856721 (Last Update 2017-09-28): Vulnerability in Ruggedcom Discovery Protocol (RCDP) of Industrial Communication Devices ∗∗∗ --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856721… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.09.2017
by Daily end-of-shift report 27 Sep '17

27 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Dienstag 26-09-2017 18:00 − Mittwoch 27-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Another Banking Trojan Adds Support for NSAs EternalBlue Exploit ∗∗∗ --------------------------------------------- A third banking trojan has added support for EternalBlue, an exploit supposedly created by the NSA, leaked online by the Shadow Brokers, and the main driving force behind the WannaCry and NotPetya ransomware outbreaks. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/another-banking-trojan-adds-… ∗∗∗ Broadcom Wireless: Google veröffentlicht Exploit für iPhone 7 ∗∗∗ --------------------------------------------- Google hat einen Exploit für erneute Probleme in Broadcom-WLAN-Chips veröffentlicht. Betroffen von dem Fehler sind das iPhone 7, aber auch Android-Geräte. Für Apple ist das eine gute Botschaft. --------------------------------------------- https://www.golem.de/news/broadcom-wireless-google-veroeffentlicht-exploit-… ∗∗∗ Nach Hack: Viele Deloitte-Systeme im Internet auffindbar ∗∗∗ --------------------------------------------- Angebliche Zugangsdaten für Deloitte-Systeme sind aufgetaucht, wo sie nicht sein sollten: bei Github und auf Google Plus. Außerdem haben Sicherheitsforscher zahlreiche Systeme des Unternehmens im Netz gefunden - mit offenen Ports für SMB und RDP. --------------------------------------------- https://www.golem.de/news/nach-hack-viele-deloitte-systeme-im-internet-auff… ∗∗∗ Security baseline for Windows 10 "Fall Creators Update" (v1709) – DRAFT ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Windows 10 "Fall Creators Update," also known as version 1709, "Redstone 3," or RS3. Please evaluate this proposed baseline and send us your feedback via blog comments below. --------------------------------------------- https://blogs.technet.microsoft.com/secguide/2017/09/27/security-baseline-f… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-3984 git - security update ∗∗∗ --------------------------------------------- joernchen discovered that the git-cvsserver subcommand of Git, adistributed version control system, suffers from a shell commandinjection vulnerability due to unsafe use of the Perl backtickoperator. The git-cvsserver subcommand is reachable from thegit-shell subcommand even if CVS support has not been configured(however, the git-cvs package needs to be installed). --------------------------------------------- https://www.debian.org/security/2017/dsa-3984 ∗∗∗ Authentication Bypass Vulnerability in the Management Interface of Citrix NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition Appliances ∗∗∗ --------------------------------------------- A vulnerability has been identified in the management interface of the Citrix NetScaler SD-WAN/CloudBridge 4000, 4100, 5000 and 5100 WAN Optimization Edition appliances. This vulnerability, if exploited, could allow an attacker with access to the management interface of the appliance’s NetScaler ADC instance to gain administrative access to the instance. --------------------------------------------- https://support.citrix.com/article/CTX228091 ∗∗∗ SAP Enterprise Portal and Clients Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2017090219 ∗∗∗ ZDI-17-812: (0Day) EMC Data Protection Advisor ScheduledReportResource Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-17-812/ ∗∗∗ iOS 11.0.1 Security Update ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT208143 ∗∗∗ IBM Security Bulletin: API Connect Portal is affected by multiple Drupal vulnerabilities ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008902 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cloud Manager ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1025664 ∗∗∗ HPESBMU03753 rev.1 - HPE System Management Homepage, Multiple Remote Vulnerabilities ∗∗∗ --------------------------------------------- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=e… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.09.2017
by Daily end-of-shift report 26 Sep '17

26 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Montag 25-09-2017 18:00 − Dienstag 26-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sicherheitslücke in Google für Datendiebstahl genutzt ∗∗∗ --------------------------------------------- Eine spezielle Technik um Webseiten auf mobilen Geräten schneller zu laden, wird von Cyberkriminellen missbraucht, um investigative Journalisten auszuspionieren. --------------------------------------------- https://futurezone.at/digital-life/sicherheitsluecke-in-google-fuer-datendi… ∗∗∗ MacOS High Sierra: MacOS-Keychain kann per App ausgelesen werden ∗∗∗ --------------------------------------------- Der Sicherheitsforscher Patrick Wardle hat demonstriert, dass Apples Keychain unter MacOS mit einer App komplett ausgelesen werden kann. Diese muss aber zunächst an Apples Gatekeeper vorbei. --------------------------------------------- https://www.golem.de/news/macos-high-sierra-macos-keychain-kann-per-app-aus… ∗∗∗ "Preparing for Cyber Security Incidents" ∗∗∗ --------------------------------------------- Talk with any incident responder and youll learn that there are a few less glamorous parts of the job. Writing the final report and preparation in advance to an incident are probably top contenders. In this article I want to focus on preparation and explain to [...] --------------------------------------------- http://ics.sans.org/blog/2017/09/26/preparing-for-cyber-security-incidents ∗∗∗ An Elaborate ATM Threat Crops Up: Network-based ATM Malware Attacks ∗∗∗ --------------------------------------------- Infecting automated teller machines (ATMs) with malware is nothing new. It’s concerning, yes. But new? Not really. We’ve been seeing physical attacks against ATMs since 2009. By physical, we mean opening the target machine’s casing, accessing the motherboard and connecting USB drives or CD-ROMs in order to infect the operating system. Once infected, the ATM is at the attackers’ mercy, which normally means that they are able to empty the money cassettes and walk away with [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/GLIB-nW2ilE/ ∗∗∗ Achtung vor neuer Betrugsmasche: Betrüger ergaunern telefonisch Bitcoin Ladebons ∗∗∗ --------------------------------------------- Das Bundeskriminalamt (BK) warnt vor einem bekannten, aber neu adaptierten Betrugsphänomen, bei dem Inhaber und Angestellte von Trafiken, Tankstellen und Postpartnerstellen via Telefon von Betrügern aufgefordert werden, die Codes der Bitcoin Ladebons bekannt zu geben. Die Polizei informiert. --------------------------------------------- http://www.bmi.gv.at/cms/bk/_news/start.aspx?id=47476E2B724F38597A506B3D&pa… ∗∗∗ Source: Deloitte Breach Affected All Company Email, Admin Accounts ∗∗∗ --------------------------------------------- Deloitte, one of the worlds "big four" accounting firms, has acknowledged a breach of its internal email systems, British news outlet The Guardian revealed today. Deloitte has sought to downplay the incident, saying it impacted "very few" clients. But according to a source close to the investigation, the breach dates back to at least the fall of 2016, and involves the compromise of all administrator accounts at the company as well as Deloittes entire internal email system. --------------------------------------------- https://krebsonsecurity.com/2017/09/source-deloitte-breach-affected-all-com… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Security Updates ∗∗∗ --------------------------------------------- macOS Server 5.4: https://support.apple.com/kb/HT208102 iTunes 12.7 for Windows: https://support.apple.com/kb/HT208141 iTunes 12.7: https://support.apple.com/kb/HT208140 macOS High Sierra 10.13: https://support.apple.com/kb/HT208144 iCloud for Windows 7.0: https://support.apple.com/kb/HT208142 --------------------------------------------- ∗∗∗ Solarwinds LEM Insecure Update Process ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2017090206 ∗∗∗ FLIR Systems FLIR Thermal Camera - Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ ∗∗∗ IBM Security Bulletin: Vulnerability in system log on IBM DataPower Gateways WebGUI console (CVE-2017-1591) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008815 ∗∗∗ IBM Security Bulletin: Path Traversal Vulnerability in IBM WebSphere Portal (CVE-2017-1577) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008586 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Web Experience Factory ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007912 ∗∗∗ IBM Security Bulletin: Vulnerability in Node.js affects IBM DataPower Gateways (CVE-2017-11499) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008629 ∗∗∗ IBM Security Bulletin: RMI Dispatcher port used by Security Identity Adapters is not authenticated by default ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007375 ∗∗∗ IBM Security Bulletin: Security Identity Adapter attribute input is not protected against command injection ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007377 ∗∗∗ IBM Security Bulletin: Vulnerability in XDR affects IBM DataPower Gateways (CVE-2017-8804) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008628 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.09.2017
by Daily end-of-shift report 25 Sep '17

25 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Freitag 22-09-2017 18:00 − Montag 25-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Securing The Supply Chain Is As Important As Securing The Front Door ∗∗∗ --------------------------------------------- Today most organisations rely on a number of suppliers for providing services to their customers. Supply chain plays a key role within an organisation allowing them to innovate, create new products or services, increase their profitability and compete with other organisations. To be able to do so, organisations need to allow suppliers to connect to their systems/applications and also allow exchange of sensitive information with their suppliers and partners. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/securing-the-supply-ch… ∗∗∗ 7% of All Amazon S3 Servers Are Exposed, Explaining Recent Surge of Data Leaks ∗∗∗ --------------------------------------------- During the past year, there has been a surge in data breach reporting regarding Amazon S3 servers left accessible online, and which were exposing private information from all sorts of companies and their customers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/7-percent-of-all-amazon-s3-s… ∗∗∗ Krypto-Trojaner RedBoot infiziert MBR und zerstört Dateien ∗∗∗ --------------------------------------------- Eine neue Ransomware treibt ihr Unwesen im Master Boot Record von Windows-PCs. Darüber hinaus verschlüsselt sie auch Dateien – ohne jedoch einen Weg zur Entschüsselung zu bieten. --------------------------------------------- https://heise.de/-3840923 ∗∗∗ CCleaner-Malware: Avast veröffentlicht weitere Analyse-Ergebnisse ∗∗∗ --------------------------------------------- In einem neuen Blogeintrag nennt Avast weitere Details zum Schadcode in CCleaner 5.33.6162. Dazu zählen konkrete Angriffsziele und Infektionszahlen sowie weitere Details zu möglichen Herkunftsländern der Täter. --------------------------------------------- https://heise.de/-3840809 ∗∗∗ Gefälschte Apple-Nachricht: Subscription Confirmation ∗∗∗ --------------------------------------------- Kriminelle versenden eine gefälschte Apple-Nachricht. Darin behaupten sie, dass Empfänger/innen eine teure Anwendung gekauft haben. Sollte das nicht der Fall sein, können sie die Bestellung auf einer Website stornieren. Apple-Kund/innen, die den angeblichen Einkauf rückgängig machen wollen, übermitteln ihre Kreditkartendaten an Betrüger/innen. --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschte-apple-nachricht-subs… ∗∗∗ A Historical Perspective on IT & OT Convergence ∗∗∗ --------------------------------------------- Hello IIoT World readers, and thanks for engaging with my column. Over the course of the next few months, I plan to write on a number of topics that are, individually, highly relevant to the IIoT Security realm. Perhaps more importantly, many of these topics can be viewed as being all inter-related in a way that describes some of the things Continue ReadingThe post A Historical Perspective on IT & OT Convergence appeared first on Create a culture of innovation with IIoT World!. --------------------------------------------- http://iiot-world.com/cybersecurity/a-historical-perspective-on-it-ot-conve… ∗∗∗ The Ethics of Running a Data Breach Search Service ∗∗∗ --------------------------------------------- No matter how much anyone tries to sugar coat it, a service like Have I been pwned (HIBP) which deals with billions of records hacked out of other peoples systems is always going to sit in a grey area. There are degrees, of course; at one end of the spectrum [...] --------------------------------------------- https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/ ===================== = Advisories = ===================== ∗∗∗ Authentication Bypass Vulnerability in Citrix NetScaler ADC and NetScaler Gateway Management Interface ∗∗∗ --------------------------------------------- A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway that, if exploited, could allow an attacker with access to the NetScaler management interface to gain administrative access to the appliance. --------------------------------------------- https://support.citrix.com/article/CTX227928 ∗∗∗ IBM Security Bulletin: privilege escalation in IBM Business Process Manager (BPM) – CVE-2017-1539 ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007451 ∗∗∗ IBM Security Bulletin: Cross-Site Scripting vulnerability affects IBM Business Process Manager Process Center Console (CVE-2017-1531) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007354 ∗∗∗ IBM Security Bulletin: Cross-Site Scripting vulnerability affects IBM Business Process Manager Process Admin Console (CVE-2017-1530) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007351 ∗∗∗ IBM Security Bulletin: XML External Entity (XXE) injection vulnerability affects IBM Business Process Manager (CVE-2017-1527) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007346 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) – CVE-2017-1425 ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22006265 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Workload Scheduler ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21996096 ∗∗∗ Alert for CVE-2017-9805 ∗∗∗ --------------------------------------------- http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-388… ∗∗∗ Apache ActiveMQ vulnerability CVE-2016-6810 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K55444705 ∗∗∗ HPESBNS03775 rev.1 - HPE NonStop Samba, Remote Disclosure of Information, Authentication Bypass, Unauthorized Elevation of Privilege ∗∗∗ --------------------------------------------- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=e… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.09.2017
by Daily end-of-shift report 22 Sep '17

22 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 21-09-2017 18:00 − Freitag 22-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ CLKSCREW Attack Can Hack Modern Chipsets via Their Power Management Features ∗∗∗ --------------------------------------------- A team of three scientists from Columbia University has discovered that by attacking the combo of hardware and software management utilities embedded with modern chipsets, threat actors can take over systems via an attack surface found in almost all modern electronic devices. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/clkscrew-attack-can-hack-mod… ∗∗∗ Ecommerce Security: Fake Jquery Used as CC Scraper ∗∗∗ --------------------------------------------- In the last few months, we noticed an increase in attacks targeting ecommerce platforms aiming to steal credit card information. We saw a similar rise last year after the summer ended, and believe that trend will continue now that the holiday season is quickly approaching. Most of these attacks are based on intercepting the communication between the online store and the payment gateway (the checkout process) in order to send valuable information to the attacker. --------------------------------------------- https://blog.sucuri.net/2017/09/fake-jquery-used-cc-scraper-ecommerce.html ∗∗∗ How I hacked hundreds of companies through their helpdesk ∗∗∗ --------------------------------------------- Months ago I discovered a flaw hackers can use to access a companys internal communications. The flaw only takes a couple of clicks to potentially access intranets, social media accounts such as Twitter, and most commonly Yammer and Slack teams. --------------------------------------------- https://medium.freecodecamp.org/how-i-hacked-hundreds-of-companies-through-… ∗∗∗ Passwords to Over a Half Million Car Tracking Devices Leaked Online ∗∗∗ --------------------------------------------- We’ve seen a lot of data breaches this year: some big, some small, some that are dangerous, and some that are just embarrassing. But if we were to name one as the creepiest data breach of 2017, this leak of logins for car tracking devices might take the cake. --------------------------------------------- https://gizmodo.com/passwords-to-access-over-a-half-million-car-tracking-de… ∗∗∗ Tips for Reverse-Engineering Malicious Code ∗∗∗ --------------------------------------------- This cheat sheet outlines tips for reversing malicious Windows executables via static and dynamic code analysis with the help of a debugger and a disassembler. --------------------------------------------- https://zeltser.com/reverse-engineering-malicious-code-tips/ ∗∗∗ Hack the Hacker – Fuzzing Mimikatz On Windows With WinAFL & Heatmaps (0day) ∗∗∗ --------------------------------------------- In this blogpost, I want to explain two topics from a theoretical and practical point of view: How to fuzz windows binaries with source code available (this part is for developers) and How to deal with big input files (aka heatmap fuzzing) and crash analysis (for security consultants; more technical) --------------------------------------------- https://www.sec-consult.com/en/blog/2017/09/hack-the-hacker-fuzzing-mimikat… ===================== = Advisories = ===================== ∗∗∗ Schneider Electric InduSoft Web Studio, InTouch Machine Edition ∗∗∗ --------------------------------------------- This advisory contains mitigation details for a missing authentication for critical function vulnerability in Schneider Electrics InduSoft Web Studio and InTouch Machine Edition. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-264-01 ∗∗∗ Ctek, Inc. SkyRouter ∗∗∗ --------------------------------------------- This advisory contains mitigation details for an improper authentication vulnerability in the Ctek, Inc. SkyRouter. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-264-02 ∗∗∗ Digium Asterisk GUI ∗∗∗ --------------------------------------------- This advisory contains mitigation details for an OS command injection vulnerability in Digiums Asterisk GUI. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-264-03 ∗∗∗ iniNet Solutions GmbH SCADA Webserver ∗∗∗ --------------------------------------------- This advisory contains mitigation details for an improper authentication vulnerability in iniNet Solutions GmbH’s SCADA Webserver. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-264-04 ∗∗∗ Saia Burgess Controls PCD Controllers ∗∗∗ --------------------------------------------- This advisory contains mitigation details for an information exposure vulnerability in Saia Burgess Controls PCD Controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-234-05 ∗∗∗ DFN-CERT-2017-1682: Perl: Zwei Schwachstellen ermöglichen Denial-of-Service-Angriffe und das Ausspähen von Informationen ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1682/ ∗∗∗ Security Advisory - Information Leakage Vulnerability on OceanStor ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-… ∗∗∗ Security Notice - Statement on App Lock Bypass Vulnerability in Huawei EMUI ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2017/huawei-sn-20170922-01-… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Fabric Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5099638 ∗∗∗ IBM Security Bulletin: API Connect is affected by a vulnerability by which an authenticated user could generate an API token ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008588 ∗∗∗ IBM Security Bulletin: API Connect is affected by a Cross Frame Scripting vulnerability CVE-2017-1551 ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008372 ∗∗∗ IBM Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007168 ∗∗∗ IBM Security Bulletin: HTML injection vulnerability in IBM Business Process Manager (BPM) – CVE-2017-1424 ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22005112 ∗∗∗ IBM Security Bulletin: Security Identity Adapter data traffic to/from server is not encrypted by default ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007381 ∗∗∗ IBM Security Bulletin: Potential information leakage during process app export in IBM Business Process Manager (CVE-2017-1346) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22004654 ∗∗∗ IBM Security Bulletin: Cross-Site Scripting vulnerability in Business Space Help affects IBM Business Process Manager (BPM) and WebSphere Process Server (WPS) – CVE-2013-0464 ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22005596 ∗∗∗ EMC M&R Watch4net for SAS Solution Packs WebService Gateway Directory Traversal Flaw Lets Remote Authenticated Users Access and Modify Data and JMX Protocol Flaw Lets Remote Users Deny Service ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1039418 ∗∗∗ EMC ViPR SRM WebService Gateway Directory Traversal Flaw Lets Remote Authenticated Users Access and Modify Data and JMX Protocol Flaw Lets Remote Users Deny Service ∗∗∗ --------------------------------------------- http://www.securitytracker.com/id/1039417 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.09.2017
by Daily end-of-shift report 21 Sep '17

21 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 20-09-2017 18:00 − Donnerstag 21-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Transportverschlüsselung zwischen Mailservern ∗∗∗ --------------------------------------------- Empfehlungen zur Konfiguration mit Beispielen für Postfix und exim --------------------------------------------- https://www.dfn-cert.de/aktuell/smtp-transportverschluesselung.html ∗∗∗ Optimierungsprogramm: Ccleaner-Malware sollte wohl Techkonzerne ausspionieren ∗∗∗ --------------------------------------------- Cisco widerspricht Avast: Die zweite Stufe der mit Ccleaner verteilten Malware sei sehr wohl aktiviert worden. Angeblich sollen die Macher der Kampagne es auf Betriebsgeheimnisse großer Techfirmen abgesehen haben. --------------------------------------------- https://www.golem.de/news/optimierungsprogramm-ccleaner-malware-sollte-wohl… ∗∗∗ FedEX: TNT verliert durch NotPetya 300 Millionen US-Dollar ∗∗∗ --------------------------------------------- Angriffe auf die IT-Infrastruktur sind teuer: Nach Maersk hat auch das Logistikunternehmen TNT einen erheblichen Verlust durch NotPetya bekannt gegeben. Die Reparatur aller Systeme soll bis Ende September abgeschlossen werden. --------------------------------------------- https://www.golem.de/news/fedex-tnt-verliert-durch-notpetya-300-millionen-u… ∗∗∗ Deep-Learning PassGAN Tool Improve Password Guessing ∗∗∗ --------------------------------------------- A deep-learning network known as a GAN has been applied to passwords, and a tool called PassGAN significantly improves the ability to guess user passwords over tools such as Hashcat or John the Ripper. --------------------------------------------- http://threatpost.com/deep-learning-passgan-tool-improve-password-guessing/… ∗∗∗ Introducing Burplay, A Burp Extension for Detecting Privilege Escalations ∗∗∗ --------------------------------------------- The seventh entry on the most recent OWASP Top 10 release (from 2013, due to the 2017 release candidate being rejected!) is "Missing Function Level Access Control", which is essentially what leads to Privilege Escalation issues. This common vulnerability related... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Introducing-Burplay,-A-… ∗∗∗ New FinFisher surveillance campaigns: Are internet providers involved? ∗∗∗ --------------------------------------------- New surveillance campaigns utilizing FinFisher, infamous spyware known also as FinSpy and sold to governments and their agencies worldwide, are in the wild. Besides featuring technical improvements, some of these variants have been using a cunning, previously-unseen infection vector with strong indicators of major internet service provider (ISP) involvement. --------------------------------------------- https://www.welivesecurity.com/2017/09/21/new-finfisher-surveillance-campai… ∗∗∗ Intel Management Engine gehackt ∗∗∗ --------------------------------------------- Sicherheitsexperten zeigten, wie sie eine Sicherheitslücke in Intels ME-Firmware nutzen, um unsignierten Code auszuführen. Die ME hat im Prinzip unbeschränkten Zugriff auf die Hardware des Systems, kann aber von Virenscannern nicht überwacht werden. --------------------------------------------- https://heise.de/-3837239 ∗∗∗ Verschlüsselung: Gpg4win 3.0 hält sich dezent im Hintergrund ∗∗∗ --------------------------------------------- Die Windows-Softwaresammlung Gpg4win verwendet Version 2.2 der freien Krypto-Engine GnuPG und sorgt dafür, dass Outlook mit dem OpenPGP/MIME-Standard umgehen kann. --------------------------------------------- https://heise.de/-3837176 ===================== = Advisories = ===================== ∗∗∗ Samba Releases Security Updates ∗∗∗ --------------------------------------------- Original release date: September 20, 2017 The Samba Team has released security updates to address several vulnerabilities in Samba. An attacker could exploit any of these vulnerabilities to obtain access to potentially sensitive information.US-CERT encourages users and administrators to review the Samba Security Announcements for CVE-2017-12150, CVE-2017-12151, and CVE-2017-12163 and apply the necessary updates, or refer to their Linux or Unix-based OS vendors for appropriate patches. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2017/09/20/Samba-Releases-Sec… ∗∗∗ Page Access - Unsupported - SA-CONTRIB-2017-75 ∗∗∗ --------------------------------------------- https://www.drupal.org/node/2910306 ∗∗∗ Skype Status - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-076 ∗∗∗ --------------------------------------------- https://www.drupal.org/node/2910308 ∗∗∗ Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072 ∗∗∗ --------------------------------------------- https://www.drupal.org/node/2907118 ∗∗∗ Security Update for tvOS 11 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT208113 ∗∗∗ Security Update for watchOS 4 ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT208115 ∗∗∗ Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Wide Area Application Services HTTP Application Optimization Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco UCS Central Software Command Line Interface Restricted Shell Break Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Small Business Managed Switches Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco FindIT DLL Preloading Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Email Security Appliance Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Customer Voice Portal Operations Console Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Intelligence Center Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Unified Intelligence Center User Interface Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletin: Vulnerability in the Linux Kernel affects IBM Integrated Management Module II (IMM2) for System x, Flex and BladeCenter Systems (CVE-2017-6214) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/home/docdisplay?lndocid=migr-5099637 ∗∗∗ IBM Security Bulletin: IBM MQ termination of a client application causes denial of service (CVE-2017-1235) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22005415 ∗∗∗ IBM Security Bulletin: Open Source OpenSSL, GNUTls, RHEL CVE-2016-8610 'SSL-Death-Alert' affects IBM Cisco switches and directors. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=ssg1S1010572 ∗∗∗ IBM Security Bulletin: Multiple Java Vulnerabilities affect DB2 Text Search Stand Alone Accessories Suite ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007190 ∗∗∗ OpenJDK vulnerabilities CVE-2015-2601, CVE-2015-2621, CVE-2015-2632, CVE-2015-4748, and CVE-2015-4749 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K84947349 ∗∗∗ HPESBHF03705 rev.2 - HPE Integrated Lights-Out 4 and Moonshot Remote Console Administrator (iLO 4 and MRCA) Remote Disclosure of Information ∗∗∗ --------------------------------------------- https://h20565.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=e… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.09.2017
by Daily end-of-shift report 20 Sep '17

20 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Dienstag 19-09-2017 18:00 − Mittwoch 20-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ iTerm2 Leaks Everything You Hover in Your Terminal via DNS Requests ∗∗∗ --------------------------------------------- iTerm2, a popular Mac application that comes as a replacement for Apples official Terminal app, just received a security fix minutes ago for a severe security issue that leaked terminal content via DNS requests. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/iterm2-leaks-everything-you-… ∗∗∗ New tool: mac-robber.py, (Tue, Sep 19th) ∗∗∗ --------------------------------------------- On a recent forensic investigation where we couldn't take the Linux system down to image the disks, I was forced to do live response. Fortunately, I was able to get a memory image, but I also wanted a filesystem timeline. I first went to my old friend fls from The SleuthKit (TSK), but for some reason, it failed. So, I tried mac-robber (also from TSK) and it, too, failed. Not one to give up easily, I decided to write my own version of mac-robber in Python. Like the TSK mac-robber, [...] --------------------------------------------- https://isc.sans.edu/diary/rss/22844 ===================== = Advisories = ===================== ∗∗∗ PHOENIX CONTACT mGuard Device Manager ∗∗∗ --------------------------------------------- This advisory contains mitigation details for improper access control vulnerabilities within PHOENIX CONTACTs mGuard Device Manager associated with Oracle Java SE. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-262-01 ∗∗∗ WordPress 4.8.2 Security and Maintenance Release ∗∗∗ --------------------------------------------- WordPress 4.8.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance… ∗∗∗ Apple Security Updates ∗∗∗ --------------------------------------------- iOS 11: https://support.apple.com/en-us/HT208112 Safari 11: https://support.apple.com/en-us/HT208116 Xcode 9: https://support.apple.com/en-us/HT208103 --------------------------------------------- ∗∗∗ DFN-CERT-2017-1665: Apache Foundation Tomcat: Zwei Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1665/ ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei CPE Devices ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-… ∗∗∗ Security Advisory - Information Exposure Vulnerability in Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-… ∗∗∗ Security Advisory - FRP Bypass Vulnerability in Huawei Smart Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-… ∗∗∗ Security Advisory - Information Exposure Vulnerability on FusionSphere OpenStack ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170920-… ∗∗∗ F5 TMM vulnerability CVE-2017-6147 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K43945001 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.09.2017
by Daily end-of-shift report 19 Sep '17

19 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Montag 18-09-2017 18:00 − Dienstag 19-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Avast Clarifies Details Surrounding CCleaner Malware Incident ∗∗∗ --------------------------------------------- Avast published earlier today a post-mortem of the CCleaner malware incident, in the hopes to clarify some of the details surrounding the event that many of its users found troubling. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/avast-clarifies-details-surr… ∗∗∗ Apples FaceID ∗∗∗ --------------------------------------------- This is a good interview with Apples SVP of Software Engineering about FaceID. Honestly, I dont know what to think. I am confident that Apple is not collecting a photo database, but not optimistic that it cant be hacked with fake faces. I dislike the fact that the police can point the phone at someone and have it automatically unlock. So this is important: I also quizzed Federighi about the exact way you "quick disabled" Face ID in tricky scenarios -- like being stopped by police, or [...] --------------------------------------------- https://www.schneier.com/blog/archives/2017/09/apples_faceid.html ∗∗∗ Old Themes, Abandoned Scripts and Pitfalls of Cleaning Serialized Data ∗∗∗ --------------------------------------------- Over the summer we’ve seen waves of WordPress database infections that use vulnerabilities in tagDiv’s Newspaper/Newsmag themes or InterconnectIT Search and Replace scripts (searchreplacedb2.php). The injections range from ad scripts coming from established ad networks like shorte.st to new domains created specifically for those attacks. Typical injected scripts look like this: [...] --------------------------------------------- https://blog.sucuri.net/2017/09/old-themes-abandoned-scripts-pitfalls-clean… ∗∗∗ Someone checked and, yup, you can still hijack Gmail, Bitcoin wallets etc via dirty SS7 tricks ∗∗∗ --------------------------------------------- Two-factor authentication by SMS? More like SOS Once again, its been demonstrated that vulnerabilities in cellphone networks can be exploited to intercept one-time two-factor authentication tokens in text messages. --------------------------------------------- https://www.theregister.co.uk/2017/09/18/ss7_vuln_bitcoin_wallet_hack_risk/ ∗∗∗ Open Hadoop Service Scanning Project ∗∗∗ --------------------------------------------- If you are looking at this page, then more than likely, you noticed a scan coming from this server across your network and/or poking at the Hadoop Namenode or Datanode web service. The Shadowserver Foundation is currently undertaking a project to search for publicly accessible devices that have one or both of these hadoop services service running. The goal of this project is to identify openly accessible systems that have these services running and report them back to the network owners for [...] --------------------------------------------- https://hadoopscan.shadowserver.org/ ∗∗∗ Call for Papers IT-SECX 2017 - "Future incident response" ∗∗∗ --------------------------------------------- Die IT-SECX ist eine Security-Konferenz mit Vorträgen und Workshops. [...] Das Motto der heurigen IT-SECX ist "Future incident response" mit dem Ziel aktuelle gezielte Angriffe, Malwarekampagnen und Gegenmaßnahmen zu diskutieren. Mit diesem Fokus sind Einreichungen für Vorträge zu folgenden Themen erwünscht: [...] --------------------------------------------- https://itsecx.fhstp.ac.at/call-for-papers/ ∗∗∗ Gefährdeter Datenschutz: Firefox löscht lokale Datenbanken nicht ∗∗∗ --------------------------------------------- Der Firefox-Browser bringt ein großes Datenschutzproblem mit sich. Nur umständlich lässt sich die Firefox-Chronik von Nutzern löschen. Webseiten können mühelos auf zuvor im Browser gespeicherte Daten zugreifen. --------------------------------------------- https://heise.de/-3835084 ∗∗∗ PC-Wahl: CCC demonstriert erneut einen Angriff und bietet Open-Source-Hilfe ∗∗∗ --------------------------------------------- Mit einem demonstrativen Hack macht der CCC auf ein erneutes Sicherheitsproblem der bereits mehrfach nachgebesserten Wahl-Software aufmerksam. Eine Open-Source-Spende soll PC-Wahl jetzt zu einer sicheren Update-Funktion verhelfen. --------------------------------------------- https://heise.de/-3835282 ∗∗∗ Unternehmen im Visier von Cyber-Kriminellen ∗∗∗ --------------------------------------------- Mit gefälschten Zahlungsanweisungen versuchen Kriminelle, von Unternehmen hohe Geldsummen zu stehlen. Ihre Nachrichten richten sich direkt an die Buchhaltung und geben vor, dass sie von der Geschäftsführung stammen. Mitarbeiter/innen, die auf den sogenannten CEO-Betrug hereinfallen, verursachen hohe Verluste. Wir zeigen Ihnen, wie Sie Ihr Unternehmen vor diesem Betrug schützen. --------------------------------------------- https://www.watchlist-internet.at/sonstiges/unternehmen-im-visier-von-cyber… ===================== = Advisories = ===================== ∗∗∗ [20170901] - Core - Information Disclosure ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Low Versions: 3.7.0 through 3.7.5 Exploit type: Information Disclosure Reported Date: 2017-August-4 Fixed Date: 2017-September-19 CVE Number: CVE-2017-14595 Description A logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archived state. Affected Installs Joomla! CMS versions 3.7.0 through 3.7.5 Solution Upgrade to version 3.8.0 --------------------------------------------- https://developer.joomla.org/security-centre/710-20170901-core-information-… ∗∗∗ [20170902] - Core - LDAP Information Disclosure ∗∗∗ --------------------------------------------- Project: Joomla! SubProject: CMS Severity: Medium Versions: 1.5.0 through 3.7.5 Exploit type: Information Disclosure Reported Date: 2017-July-27 Fixed Date: 2017-September-19 CVE Number: CVE-2017-14596 Description Inadequate escaping in the LDAP authentication plugin can result into a disclosure of username and password. Affected Installs Joomla! CMS versions 1.5.0 through 3.7.5 Solution Upgrade to version 3.8.0 --------------------------------------------- https://developer.joomla.org/security-centre/711-20170902-core-ldap-informa… ∗∗∗ Security Advisory 2017-04: Security Update for all OTRS Versions ∗∗∗ --------------------------------------------- September 18, 2017 — Please read carefully and check if the version of your OTRS system is affected by this vulnerability. Please send information regarding vulnerabilities in OTRS to: security(a)otrs.org --------------------------------------------- https://www.otrs.com/security-advisory-2017-04-security-update-otrs-version… ∗∗∗ DSA-3978 gdk-pixbuf - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2017/dsa-3978 ∗∗∗ DSA-3977 newsbeuter - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2017/dsa-3977 ∗∗∗ DFN-CERT-2017-1643: Moodle: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1643/ ∗∗∗ Security Advisory - Multiple Vulnerabilities in MTK Platform ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170919-… ∗∗∗ IBM Security Bulletin: API Connect Portal is affected by multiple Drupal vulnerabilities ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008323 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect API Connect ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008382 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational Synergy ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22008122 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center (CVE-2017-1382) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007663 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center (CVE-2017-1380) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22007665 ∗∗∗ Expat vulnerability CVE-2016-0718 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K52320548 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.09.2017
by Daily end-of-shift report 18 Sep '17

18 Sep '17

===================== = End-of-Day report = ===================== Timeframe: Freitag 15-09-2017 18:00 − Montag 18-09-2017 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Machine Learning Myths ∗∗∗ --------------------------------------------- “Machine learning” is the new “it” buzzword in security. As a result, it’s being thrown around fairly loosely on vendor websites and in marketing materials. Not only is that unfortunate for anyone looking to get a straight answer on how machine learning can help their company stay more secure, it is also fostering a general sense of confusion around what the term actually means. To help clear things up, let’s take a closer look at six of the most common [...] --------------------------------------------- https://feeds.feedblitz.com/~/459728214/0/alienvault-blogs~Machine-Learning… ∗∗∗ Optionsbleed: Apache-Webserver blutet ∗∗∗ --------------------------------------------- Beim Apache-Webserver lassen sich in bestimmten Konfigurationen Speicherfragmente durch einen Angreifer auslesen. Besonders kritisch ist diese Lücke in Shared-Hosting-Umgebungen. --------------------------------------------- https://www.golem.de/news/optionsbleed-apache-webserver-blutet-1709-130105-… ∗∗∗ CCleaner: Avast verteilt Malware mit Optimierungsprogramm ∗∗∗ --------------------------------------------- So hatten sich Nutzer die Optimierung des PCs sicher nicht vorgestellt: Eine Version von CCleaner wurde für rund einen Monat mit Malware ausgeliefert. --------------------------------------------- https://www.golem.de/news/ccleaner-avast-verteilt-malware-mit-optimierungsp… ∗∗∗ An (un)documented Word feature abused by attackers ∗∗∗ --------------------------------------------- A little while back we were investigating the malicious activities of the Freakyshelly targeted attack and came across spear phishing emails that had some interesting documents attached to them. They were in OLE2 format and contained no macros, exploits or any other active content. --------------------------------------------- http://securelist.com/an-undocumented-word-feature-abused-by-attackers/8189… ∗∗∗ Malicious Backdoors: Fake Images and Strrev Functions ∗∗∗ --------------------------------------------- When a website is compromised, attackers frequently leave behind a backdoor – according to our research around 70% of all website hacks include a backdoor. These backdoors are not designed to attack a website or destroy data, instead they allow an attacker to re-enter a targeted website with little to no authentication, providing them with unauthorized access to the system. Backdoors can be planted anywhere within a site, file system, or database. --------------------------------------------- https://blog.sucuri.net/2017/09/malicious-backdoors-fake-images-strrev-func… ∗∗∗ Achtung: Aktuelle Spam-Mails fälschen Absender von Mitarbeitern ∗∗∗ --------------------------------------------- Akute Gefahr geht von einer Schädlingswelle aus, die per E-Mail anrollt. Durch eine clevere Wahl der Absender könnten auch versierte Anwender verleitet werden, dem darin enthaltenen Link zu folgen. Er führt zu bislang weitgehend unerkannter Malware. --------------------------------------------- https://heise.de/-3834782 ∗∗∗ Keine Sicherheits-App der Erste Bank installieren ∗∗∗ --------------------------------------------- In einer gefälschten Erste Bank-Nachricht fordern Kriminelle Kund/innen dazu auf, dass sie eine Sicherheits-App für ihr mobiles Endgerät installieren. Das sei angeblich notwendig, damit diese weiterhin ihren OnlineBanking-Zugang nützen können. In Wahrheit ist die Sicherheits-App Schadsoftware. Sie ermöglicht es Unbekannten, auf die Konten ihrer Opfer zuzugreifen. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/keine-sicherheits-app-der-e… ∗∗∗ People cant read (Equifax edition) ∗∗∗ --------------------------------------------- One of these days Im going to write a guide for journalists reporting on the cyber. One of the items Id stress is that they often fail to read the text of what is being said, but instead read some sort of subtext that wasnt explicitly said. This is valid sometimes -- as the subtext is what the writer intended all along, even if they didnt explicitly write it. Other times, though the imagined subtext is not what the writer intended at all. A good example is the recent Equifax breach. --------------------------------------------- http://blog.erratasec.com/2017/09/people-cant-read-equifax-edition.html ===================== = Advisories = ===================== ∗∗∗ DSA-3974 tomcat8 - security update ∗∗∗ --------------------------------------------- Two issues were discovered in the Tomcat servlet and JSP engine. --------------------------------------------- https://www.debian.org/security/2017/dsa-3974 ∗∗∗ DSA-3975 emacs25 - security update ∗∗∗ --------------------------------------------- Charles A. Roelli discovered that Emacs is vulnerable to arbitrary codeexecution when rendering text/enriched MIME data (e.g. when usingEmacs-based mail clients). --------------------------------------------- https://www.debian.org/security/2017/dsa-3975 ∗∗∗ DSA-3976 freexl - security update ∗∗∗ --------------------------------------------- Marcin Icewall Noga of Cisco Talos discovered two vulnerabilities infreexl, a library to read Microsoft Excel spreadsheets, which mightresult in denial of service or the execution of arbitrary code if amalformed Excel file is opened. --------------------------------------------- https://www.debian.org/security/2017/dsa-3976 ∗∗∗ ZDI-17-811: EMC Data Protection Advisor Application Service Static Credentials Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- This vulnerability allows remote attackers to escalate privileges on vulnerable installations of EMC Data Protection Advisor. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-17-811/ ∗∗∗ Magento 2.0.16 and 2.1.9 Security Update ∗∗∗ --------------------------------------------- Magento Commerce and Open Source 2.1.9 and 2.0.16 contain multiple security enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities. --------------------------------------------- https://magento.com/security/patches/magento-2016-and-219-security-update ∗∗∗ SUPEE-10266 ∗∗∗ --------------------------------------------- SUPEE-10266, Magento Commerce 1.14.3.6 and Open Source 1.9.3.6 contain multiple security enhancements that help close cross-site request forgery (CSRF), unauthorized data leak, and authenticated Admin user remote code execution vulnerabilities. --------------------------------------------- https://magento.com/security/patches/supee-10266 ∗∗∗ BlackBerry response to impact of the vulnerabilities known as BlueBorne on BlackBerry products ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Vuln: Moodle CVE-2017-12157 Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/100848 ∗∗∗ Apache Struts 2 Remote Code Execution Vulnerability Affecting Multiple Cisco Products: September 2017 ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Multiple Vulnerabilities in Apache Struts 2 Affecting Cisco Products: September 2017 ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Meeting Server TURN Server Unauthorized Access and Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ DFN-CERT-2017-1634: ChakraCore: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-1634/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Emptoris Strategic Supply Management and IBM Emptoris Services Procurement products. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008401 ∗∗∗ IBM Security Bulletin: A vulnerability in XStream affects IBM InfoSphere Information Governance components ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22004784 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2017-3511, CVE-2017-10115, CVE-2017-10116) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006034 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2017-1194) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006028 ∗∗∗ IBM Security Bulletin: Sweet32 vulnerability affects IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2016-2183) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006040 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects Tivoli Storage Productivity Center (CVE-2017-1137) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006029 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Spectrum Control and Tivoli Storage Productivity Center (CVE-2017-1121) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006027 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008182 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities may affect IBM® WebSphere Real Time ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22006696 ∗∗∗ IBM Security Bulletin: Potential security vulnerability in selected fixpacks of WebSphere Application Server affects IBM Emptoris Strategic Supply Management suite of products and IBM Emptoris Services Procurement (CVE-2017-1501) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22008410 ∗∗∗ OpenJDK vulnerabilities CVE-2015-2621, CVE-2015-2632, CVE-2015-4748, and CVE-2015-4749 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K84947349 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily September 2017