Daily October 2019

daily@lists.cert.at

1 participants
23 discussions

Tageszusammenfassung - 17.10.2019
by Daily end-of-shift report 17 Oct '19

17 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 16-10-2019 18:00 − Donnerstag 17-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ 10 Steps for Ransomware Protection ∗∗∗ --------------------------------------------- Here are things you can do right now to shore up your defenses and help your recovery when you get hit. --------------------------------------------- https://threatpost.com/10-steps-ransomware-protection/149259/ ∗∗∗ Betrüger übernehmen alte E-Mail-Adressen ∗∗∗ --------------------------------------------- Das Bundeskriminalamt (BKA) warnt vor missbräuchlicher Verwendung alter E-Mail-Adressen. Betrüger würden sich länger nicht genutzte E-Mail-Adressen aneignen, um damit Zugang zu persönlichen Nutzerkonten zu erlangen, so das BKA. Gaming Accounts und Nutzerkonten in Sozialen Medien seien besonders betroffen. --------------------------------------------- https://help.orf.at/stories/2993027/ ∗∗∗ l+f: Leise rieselt der Crypto-Miner ∗∗∗ --------------------------------------------- Forscher entdecken Crypto-Miner und Backdoors, die sich in WAV-Dateien verstecken. --------------------------------------------- https://heise.de/-4558856 ∗∗∗ Cisco fixes serious flaws in enterprise-grade Catalyst and Aironet access points ∗∗∗ --------------------------------------------- Cisco has released another batch of security updates, the most critical of which fixes a vulnerability that could allow unauthenticated, remote attackers to gain access to vulnerable Cisco Aironet wireless access points. Cisco Aironet APs are enterprise-grade access points used for branch offices, campuses, organizations of all sizes, enterprise and carrier-operator Wi-Fi deployments, and so on. --------------------------------------------- https://www.helpnetsecurity.com/2019/10/17/cisco-aironet-vulnerabilities/ ∗∗∗ KRACK‑Sicherheitslücke in Alexa Smart Home Geräten ∗∗∗ --------------------------------------------- Das ESET Smart Home Research Team entdeckte KRACK-Sicherheitslücken in einigen Amazon Echo- und Kindle-Geräten. --------------------------------------------- https://www.welivesecurity.com/deutsch/2019/10/17/krack-sicherheitsluecke-a… ∗∗∗ Werbung für betrügerische Elektriker auf Google ∗∗∗ --------------------------------------------- Wenn zu Hause der Strom ausfällt, verschafft oft nur eine Fachkraft Abhilfe. Die Suche über Google am Smartphone liegt dabei natürlich nahe. Doch Vorsicht: Die Gefahr, über die Anzeigen auf unseriöse Angebote zu stoßen, ist hoch! Opfer landen beispielsweise auf elektriker-mg.at, elektriker-dienst.at oder elektriker.24std.expert, wo die großen Versprechen in schlechter Arbeit zu horrenden Preisen münden. --------------------------------------------- https://www.watchlist-internet.at/news/werbung-fuer-betruegerische-elektrik… ===================== = Vulnerabilities = ===================== ∗∗∗ Dangerous Kubernetes Bugs Allow Authentication Bypass, DoS ∗∗∗ --------------------------------------------- The flaws in the container technology, CVE-2019-16276 and CVE-2019-11253, are simple to exploit. --------------------------------------------- https://threatpost.com/kubernetes-bugs-authentication-bypass-dos/149265/ ∗∗∗ Security updates available in Foxit Reader 9.7, Foxit PhantomPDF 9.7 and Foxit PhantomPDF Mac 3.4 ∗∗∗ --------------------------------------------- Foxit has released Foxit Reader 9.7 and Foxit PhantomPDF 9.7, which addresses potential security and stability issues. Foxit has released Foxit PhantomPDF Mac 3.4, which addresses potential security and stability issues. --------------------------------------------- https://www.foxitsoftware.com/support/security-bulletins.php ∗∗∗ VMSA-2019-0017 ∗∗∗ --------------------------------------------- VMware ESXi, Workstation, Fusion, VMRC and Horizon Client updates address use-after-free and denial of service vulnerabilities. (CVE-2019-5527, CVE-2019-5535) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0017.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (sudo), Debian (libsdl1.2 and libsdl2), Mageia (e2fsprogs, kernel, libpcap and tcpdump, nmap, and sudo), openSUSE (GraphicsMagick and sudo), Oracle (java-1.8.0-openjdk, java-11-openjdk, jss, and kernel), Red Hat (java-1.8.0-openjdk and java-11-openjdk), Scientific Linux (jss), SUSE (gcc7 and libreoffice), and Ubuntu (leading to a double-free, libsdl1.2, and tiff). --------------------------------------------- https://lwn.net/Articles/802537/ ∗∗∗ D-LINK Router: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/2019/10/warn… ∗∗∗ CyberArk Password Vault 10.6 Authentication Bypass ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2019100114 ∗∗∗ Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-074 ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/publicationListing.x ∗∗∗ Vim/Neovim vulnerability CVE-2019-12735 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_mediu… ∗∗∗ Internet Systems Consortium BIND: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0924 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.10.2019
by Daily end-of-shift report 16 Oct '19

16 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 15-10-2019 18:00 − Mittwoch 16-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Docker Containers Riddled with Graboid Crypto-Worm ∗∗∗ --------------------------------------------- A worm with a randomized propagation method is spreading via the popular container technology. --------------------------------------------- https://threatpost.com/docker-containers-graboid-crypto-worm/149235/ ∗∗∗ Security Monitoring: At Network or Host Level?, (Wed, Oct 16th) ∗∗∗ --------------------------------------------- Today, to reach a decent security maturity, the keyword remains "visibility". There is nothing more frustrating than being blind about what's happening on a network or starting an investigation without any data (logs, events) to process. The question is: how to efficiently keep an eye on what's happening on your network? There are three key locations to collect data: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/25420 ∗∗∗ Messing with Azorult Part 1: Malware Breakdown ∗∗∗ --------------------------------------------- In this blog series, we dive into an information stealing Trojan called Azorult that we analysed during a recent Digital Forensics and Incident Response (DFIR) investigation. During our analysis, we also take a look at the bot’s control panel and its vulnerability. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/messing-wit… ∗∗∗ Patchday bei Adobe: 64 Lücken im Reader ∗∗∗ --------------------------------------------- Außerdem gibt es auch Updates für den Experience Manager, Experience Manager Forms und den Adobe Download Manager. --------------------------------------------- https://heise.de/-4557403 ∗∗∗ Schadsoftware in vermeintlichen Banking-Apps aus unbekannter Quelle! ∗∗∗ --------------------------------------------- Immer wieder versenden Kriminelle massenhaft E-Mails im Design diverser Banken. Sie beziehen sich darin gehäuft auf die sogenannte PSD2-Richtlinie, die zu diversen Änderungen beim Online-Banking geführt hat und verlangen die Bestätigung persönlicher Daten oder die Installation einer App aus unbekannter Quelle. Nur so ließe sich die Sperre Ihres Kontos verhindern. Es dürfen keine Daten bekanntgegeben und die Apps nicht installiert werden. Es handelt sich um [...] --------------------------------------------- https://www.watchlist-internet.at/news/schadsoftware-in-vermeintlichen-bank… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Patch Update: Oracle veröffentlicht 219 Sicherheitspatches ∗∗∗ --------------------------------------------- Es gibt abgesicherte Versionen von unter anderem Fusion Middleware und NoSQL Database, in denen Oracle kritische Sicherheitslücken geschlossen hat. --------------------------------------------- https://heise.de/-4557788 ∗∗∗ VMSA-2019-0016 ∗∗∗ --------------------------------------------- VMware Cloud Foundation and VMware Harbor Container Registry for PCF address broken access control vulnerability (CVE-2019-16919) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2019-0016.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (apache2 and unbound), Fedora (opendmarc, runc, and sudo), openSUSE (epiphany, GraphicsMagick, and libopenmpt), Oracle (kernel and sudo), Red Hat (java-1.8.0-openjdk, jss, kernel, kernel-rt, and kpatch-patch), SUSE (crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer, libpcap, sudo, [...] --------------------------------------------- https://lwn.net/Articles/802451/ ∗∗∗ Linux kernel vulnerability CVE-2019-13233 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13331647?utm_source=f5support&utm_mediu… ∗∗∗ HPESBHF03960 rev.1 - HPE Lights Out 100 (LO100) Remote Management for ProLiant G1 - G6 servers, Remote Denial of Service ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… ∗∗∗ Red Hat JBoss Enterprise Application Platform: Schwachstelle gefährdet Verfügbarkeit und Integrität ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0905 ∗∗∗ Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0913 ∗∗∗ Publish SBA-ADV-20190913-04: WordPress Plugin - All in One SEO Pack -… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/478f4828ddc618f6bdb9530640… ∗∗∗ Publish SBA-ADV-20190913-03: WordPress Plugin - Events Manager - Stor… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/eb0047b9fb067ec171007b14df… ∗∗∗ Publish SBA-ADV-20190913-02: WordPress Plugin - Broken Link Checker -… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/3e79665a02f0cd2e7666e7738e… ∗∗∗ Publish SBA-ADV-20190913-01: WordPress Plugin - EU Cookie Law (GDPR) … ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/51b3d30fc0d9e69a760203b32d… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.10.2019
by Daily end-of-shift report 15 Oct '19

15 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 14-10-2019 18:00 − Dienstag 15-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Cyberangriffe: Attribution ist wie ein Indizienprozess ∗∗∗ --------------------------------------------- Russland hat den Bundestag gehackt! China wollte die Bayer AG ausspionieren! Bei großen Hackerangriffen ist oft der Fingerzeig auf den mutmaßlichen Täter nicht weit. Knallharte Beweise dafür gibt es selten, Hinweise sind aber kaum zu vermeiden. --------------------------------------------- https://www.golem.de/news/cyberangriffe-attribution-ist-wie-ein-indizienpro… ∗∗∗ Update now! Windows users targeted by iTunes Software Updater zero-day ∗∗∗ --------------------------------------------- The flaw is a rare ‘unquoted path class’ described as "so thoroughly documented that you would expect programmers to be well aware..." But thats not the case. --------------------------------------------- https://nakedsecurity.sophos.com/2019/10/15/update-now-windows-users-target… ∗∗∗ Top 10 Website Hardening Tips ∗∗∗ --------------------------------------------- Website hardening means adding layers of protection to reduce the risk of website attacks, a process known as “defense in depth.” Here are our top 10 virtual hardening principles: [...] --------------------------------------------- https://blog.sucuri.net/2019/10/top-10-website-hardening-tips.html ∗∗∗ Threat Actor Profile: TA407, the Silent Librarian ∗∗∗ --------------------------------------------- [...] Since our blog post, colleagues at Secureworks have provided further details on one actor we highlighted, tracked by Proofpoint as TA407, also known as Silent Librarian, Cobalt Dickens, and Mabna Institute. In this blog, we provide additional insight into the actor and their evolving TTPs in ongoing, academia-focused campaigns. --------------------------------------------- https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta40… ∗∗∗ Europol: Ransomware remains top threat in IOCTA report ∗∗∗ --------------------------------------------- The European Union Agency for Law Enforcement Cooperation, or Europol, just released its annual Internet Organized Crime Threat Assessment (IOCTA) report. We highlight their key findings and remind readers how to better protect themselves. --------------------------------------------- https://blog.malwarebytes.com/awareness/2019/10/europol-ransomware-remains-… ∗∗∗ Researchers Find New Backdoor Used by Winnti Hackers ∗∗∗ --------------------------------------------- ESET security researchers were able to identify a new backdoor associated with the threat actor known as the Winnti Group. --------------------------------------------- https://www.securityweek.com/researchers-find-new-backdoor-used-winnti-hack… ∗∗∗ SMS von „InfoSMS“ führt in Abo-Falle ∗∗∗ --------------------------------------------- Aktuell sind vermehrt betrügerische SMS vom Absender „InfoSMS“ im Umlauf. In der SMS heißt es, dass der Besitzer der Handynummer gesucht wird. Für nähere Informationen werden Sie aufgefordert, einem Link zu folgen. Sie landen dann auf einer gefälschten Media Markt Seite, wo ein angeblicher Gewinn auf Sie wartet. Sie werden Ihren Gewinn jedoch nie erhalten, es handelt sich um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/sms-von-infosms-fuehrt-in-abo-falle/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Experience Manager (APSB19-48), Adobe Acrobat and Reader (APSB19-49), Adobe Experience Manager Forms (APSB19-50) and Adobe Download Manager (APSB19-51). Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. This posting is provided “AS IS” with no warranties and confers no rights. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1795 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (sudo and xtrlock), openSUSE (sudo), Red Hat (Single Sign-On), Slackware (sudo), SUSE (binutils, dhcp, ffmpeg, kernel, kubernetes-salt, sudo, and tcpdump), and Ubuntu (sudo). --------------------------------------------- https://lwn.net/Articles/802328/ ∗∗∗ PHOENIX CONTACT Security Advisory for Automation Worx Software Suite ∗∗∗ --------------------------------------------- Phoenix Contact Automationworx Suite: *.bcp-file Memory Corruption Remote Code Execution Vulnerability and *.mwt-file Out-OfBounds Read Remote Code Execution Vulnerability --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-016 ∗∗∗ sudo: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0902 ∗∗∗ WordPress: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K19-0903 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM Java Runtime affect IBM Cloud Private ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: IBM MQ Appliance is affected by kernel vulnerabilities (CVE-2019-11479, CVE-2019-11478 and CVE-2019-11477) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-mq-appliance-is-a… ∗∗∗ IBM Security Bulletin: IBM Security Guardium Big Data Intelligence is affected by a Using Components with Known Vulnerabilities vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-security-guardium… ∗∗∗ IBM Security Bulletin: Vulnerability CVE-2019-4031 affects IBM Workload Scheduler ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-vulnerability-cve-201… ∗∗∗ TYPO3-EXT-SA-2019-018: Remote Code Execution in extension "freeCap CAPTCHA" (sr_freecap) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-018/ ∗∗∗ TYPO3-EXT-SA-2019-017: Multiple vulnerabilities in extension "SLUB: Event Registration" (slub_events) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-017/ ∗∗∗ TYPO3-EXT-SA-2019-016: Information Disclosure in extension "Direct Mail" (direct_mail) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-016/ ∗∗∗ TYPO3-EXT-SA-2019-015: SQL Injection in extension "URL redirect" (url_redirect) ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-ext-sa-2019-015/ ∗∗∗ Linux kernel vulnerability CVE-2019-16714 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K48351130?utm_source=f5support&utm_mediu… ∗∗∗ OpenLDAP vulnerability CVE-2019-13565 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K98008862?utm_source=f5support&utm_mediu… ∗∗∗ HPESBHF03933 rev.6 - HPE Products using certain Intel Processors, Microarchitectural Data Sampling (MDS) Side Channel Vulnerabilities, Local Disclosure of Information ∗∗∗ --------------------------------------------- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_n… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.10.2019
by Daily end-of-shift report 14 Oct '19

14 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 11-10-2019 18:00 − Montag 14-10-2019 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ The Week in Ransomware - October 11th 2019 - Decryptors Released! ∗∗∗ --------------------------------------------- We had some interesting news this week, such as the HildaCrypt ransomware releasing their keys, RobbinHood Ransomware bragging about their past exploits, a Muhstik Ransomware victim hacking back and stealing the decryption keys, and a Nemty decryptor being released. --------------------------------------------- https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-octob… ∗∗∗ Sodinokibi Ransomware: Following the Affiliate Money Trail ∗∗∗ --------------------------------------------- After a Sodinokibi ransomware affiliate posted partial transaction IDs for ransomware payments, researchers were able to use that information to follow the money trail for affiliates and in some cases, how they spend their illicit earnings. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-follow… ∗∗∗ Simjacker: SIM-Karten in 29 Ländern anfällig für SMS-Angriff ∗∗∗ --------------------------------------------- Mit einer präparierten SMS können Daten aus dem Mobiltelefon ausgelesen werden. Die Sicherheitsfirma Adaptive Mobile hat den Simjacker genannten Angriff entdeckt und die betroffenen Staaten veröffentlicht. Demnach nutzte in drei Ländern eine Überwachungsfirma die Lücke aktiv aus. --------------------------------------------- https://www.golem.de/news/simjacker-sim-karten-in-29-laendern-anfaellig-fue… ∗∗∗ Pass the AppleJeus ∗∗∗ --------------------------------------------- A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine its infection vector, method of persistence, capabilities, and more! --------------------------------------------- https://objective-see.com/blog/blog_0x49.html ∗∗∗ Another successful edition of the European Cyber Security Challenge concluded in Romania ∗∗∗ --------------------------------------------- The sixth edition of the European Cyber Security Challenge (ECSC), organised from 9 to 11 October in Bucharest at the Palace of the Parliament, the heaviest building and the second-largest building in the world, has concluded. Team Romania - followed by Italy and Austria - has proven successful in completing the most advanced and complex cybersecurity challenges and is thereby the proud winner of ECSC2019. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/another-successful-edition-of-t… ∗∗∗ Most SSL certificate misissuance caused by software bugs and rule misinterpretations ∗∗∗ --------------------------------------------- Academic study analyzed 379 incidents of incorrectly-issued SSL certificates from a total of 1,300+ known cases. --------------------------------------------- https://www.zdnet.com/article/most-ssl-certificate-misissuance-caused-by-so… ===================== = Vulnerabilities = ===================== ∗∗∗ Upcoming Security Updates for Adobe Acrobat and Reader (APSB19-49) ∗∗∗ --------------------------------------------- A prenotification security advisory (APSB19-49) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, October 15, 2019. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well as the Adobe PSIRT Blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1793 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium, sdl, and unbound), Debian (clamav, libdatetime-timezone-perl, openssl, tcpdump, and tzdata), Fedora (cutter-re, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-parent, libapreq2, ming, opendmarc, radare2, and thunderbird), openSUSE (chromium), Oracle (kernel), and SUSE (axis, jakarta-commons-fileupload, kernel, sles12sp3-docker-image, sles12sp4-image, system-user-root, and webkit2gtk3). --------------------------------------------- https://lwn.net/Articles/802268/ ∗∗∗ Critical Flaw in Sophos Cyberoam Appliances Allows Remote Code Execution ∗∗∗ --------------------------------------------- A critical vulnerability patched recently by Sophos in its Cyberoam firewall appliances allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges. --------------------------------------------- https://www.securityweek.com/critical-flaw-sophos-cyberoam-appliances-allow… ∗∗∗ Swift 5.1.1 for Ubuntu ∗∗∗ --------------------------------------------- https://support.apple.com/kb/HT210647 ∗∗∗ Reflected XSS vulnerability in OpenProject (CVE-2019-17092) ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/reflected-xss-vulnerability-in-o… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 11.10.2019
by Daily end-of-shift report 11 Oct '19

11 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 10-10-2019 18:00 − Freitag 11-10-2019 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Remote-Angriffe und Denial-of-Service: Schwachstellen in Juniper-Netzwerktechnik ∗∗∗ --------------------------------------------- Juniper-Geräte der Serien SRX, NFX, QFX, PTX, ACX, MX, und EX sowie das Betriebssystem JUNOS weisen Schwachstellen auf die umgehend gepatcht werden sollten. --------------------------------------------- https://heise.de/-4553168 ∗∗∗ Researchers released a free decryptor for the Nemty Ransomware ∗∗∗ --------------------------------------------- Good news for the victims of the Nemty Ransomware, security researchers have released a free decryptor that could be used to recover files. --------------------------------------------- https://securityaffairs.co/wordpress/92386/malware/nemty-ransomware-decrypt… ∗∗∗ Examining the Ryuk Ransomware ∗∗∗ --------------------------------------------- Ryuk ransomware had a disturbingly successful debut, being used to hit at least three organizations in its first two months of activity for more than $640,000 in ransom. Several attacks followed, where the attackers demanded even greater amounts of ransom. The attackers were able to demand and receive high ransoms because of a unique trait in the Ryuk code: the ability to identify and encrypt network drives and resources, as well as delete shadow copies on the endpoint. --------------------------------------------- https://www.zscaler.com/blogs/research/examining-ryuk-ransomware ∗∗∗ Staying Hidden on the Endpoint: Evading Detection with Shellcode ∗∗∗ --------------------------------------------- True red team assessments require a secondary objective of avoiding detection. Part of the glory of a successful red team assessment is not getting detected by anything or anyone on the system. As modern Endpoint Detection and Response (EDR) products have matured over the years, the red teams must follow suit. This blog post will provide some insights into how the FireEye Mandiant Red Team crafts payloads to bypass modern EDR products and get full command and control (C2) on their [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-e… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (lucene-solr and ruby-openid), Fedora (krb5 and SDL2), openSUSE (kernel and libopenmpt), and Ubuntu (python2.7, python3.4). --------------------------------------------- https://lwn.net/Articles/802086/ ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager and Case Foundation security vulnerability in Process Orchestration Web Service logging ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-filenet-content-m… ∗∗∗ IBM Security Bulletin: IBM FileNet Content Manager and Case Foundation are affected by Publicly disclosed vulnerability in Java July 2019 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-filenet-content-m… ∗∗∗ Linux kernel vulnerability CVE-2017-18551 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K48073202?utm_source=f5support&utm_mediu… ∗∗∗ Apache Tomcat vulnerability CVE-2019-0221 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K13184144?utm_source=f5support&utm_mediu… ∗∗∗ ImageMagick vulnerability CVE-2019-13136 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03512441?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.10.2019
by Daily end-of-shift report 10 Oct '19

10 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 09-10-2019 18:00 − Donnerstag 10-10-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ HP Touchpoint Analytics LPE Vulnerability Affects Most HP PCs ∗∗∗ --------------------------------------------- HP patched a vulnerability discovered in the HP Touchpoint Analytics software installed by default on most of its Windows laptops and desktops, a flaw allowing attackers to escalate privileges and execute arbitrary code using SYSTEM privileges. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hp-touchpoint-analytics-lpe-… ∗∗∗ Gamers Warned of High-Severity Intel, Nvidia Flaws ∗∗∗ --------------------------------------------- The Intel NUC and Nvidia Shield both are vulnerable to high-severity flaws, Intel and Nvidia warned in dual advisories. --------------------------------------------- https://threatpost.com/gamers-high-severity-intel-nvidia-flaws/149034/ ∗∗∗ Apple iTunes Bug Actively Exploited in BitPaymer/iEncrypt Campaign ∗∗∗ --------------------------------------------- Attackers exploit an “unquoted path” flaw in the Bonjour updater in iTunes for Windows to deliver ransomware attacks. --------------------------------------------- https://threatpost.com/apple-itunes-bug-bitpaymer-iencrypt/149075/ ∗∗∗ Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques ∗∗∗ --------------------------------------------- During several recent incident response engagements, FireEye Mandiant investigators uncovered new tools in FIN7’s malware arsenal and kept pace as the global criminal operators attempted new evasion techniques. In this blog, we reveal two of FIN7’s new tools that we have called BOOSTWRITE and RDFSNIFFER. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-… ∗∗∗ Security Descriptor Auditing Methodology: Investigating Event Log Security ∗∗∗ --------------------------------------------- Upon gaining access to a system, what level of access is granted to an attacker who has yet to elevate their privileges? --------------------------------------------- https://posts.specterops.io/security-descriptor-auditing-methodology-invest… ===================== = Vulnerabilities = ===================== ∗∗∗ Juniper Networks Releases Security Updates ∗∗∗ --------------------------------------------- Juniper Networks has released security updates to address multiple vulnerabilities in various Juniper products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/10/juniper-networks-r… ∗∗∗ Sicherheitsupdates: Intel sichert NUC-PCs und Serverwartungstool ab ∗∗∗ --------------------------------------------- Angreifer könnten sich auf NUCs und auf Intel-Servern höhere Rechte aneignen. Eine Lücke bleibt jedoch ungepatcht. --------------------------------------------- https://heise.de/-4550829 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (clamav, libtomcrypt, and rsyslog), Fedora (suricata), SUSE (libopenmpt and python-requests), and Ubuntu (libsoup2.4 and octavia). --------------------------------------------- https://lwn.net/Articles/801974/ ∗∗∗ ZDI-19-866: NETGEAR AC1200 mini_httpd Poison Null Byte Authentication Bypass Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-19-866/ ∗∗∗ Maxlength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2019-073 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ OpenSSL vulnerability CVE-2019-1563 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K97324400?utm_source=f5support&utm_mediu… ∗∗∗ OpenSSL vulnerability CVE-2019-1547 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K73422160?utm_source=f5support&utm_mediu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.10.2019
by Daily end-of-shift report 09 Oct '19

09 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Dienstag 08-10-2019 18:00 − Mittwoch 09-10-2019 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ New Microsoft NTLM Flaws May Allow Full Domain Compromise ∗∗∗ --------------------------------------------- Two security vulnerabilities in Microsofts NTLM authentication protocol allow attackers to bypass the MIC (Message Integrity Code) protection and downgrade NTLM security features leading to full domain compromise of a network. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-microsoft-ntlm-flaws-may… ∗∗∗ Doctor Web’s overview of malware detected on mobile devices in September 2019 ∗∗∗ --------------------------------------------- October 9, 2019 In September, Android users were threatened by various malware, many of which was distributed via Google Play. Those were the Android.DownLoader downloaders, the Android.Banker and Android.HiddenAds banking and adware trojans, as well as other threats. Doctor Web experts have also discovered several new versions of potentially dangerous applications, designed to spy on users, including Program.Panspy.1.origin, Program.RealtimeSpy.1.origin, and Program.MonitorMinor. --------------------------------------------- https://news.drweb.com/show/?i=13446&lng=en&c=9 ∗∗∗ Twitter: iOS-Apps verwenden altes Twitterkit mit Sicherheitslücke ∗∗∗ --------------------------------------------- Das Fraunhofer SIT hat eine Sicherheitslücke im eingestellten Twitterkit entdeckt, die nicht mehr geschlossen werden soll. Über diese kann ein Man-in-the-Middle-Angriff durchgeführt werden. Einige iOS-Apps verwenden die Software noch, um auf Tweets zuzugreifen oder einen Login mit Twitter anzubieten. --------------------------------------------- https://www.golem.de/news/twitter-ios-apps-verwenden-altes-twitterkit-mit-s… ∗∗∗ Vermeintliche Kündigung führt zu teurem Vertrag ∗∗∗ --------------------------------------------- Unternehmen aufgepasst: Unseriöse Firmen kontaktieren Unternehmen und behaupten, dass ein bereits laufender Vertrag zu einem Branchenbucheintrag nun gekündigt werden könne. Dazu müsse lediglich ein Fax unterzeichnet und retourniert werden. Wer das tut, kündigt nicht, sondern schließt einen teuren Vertrag ab. Unternehmen müssen den Betrag nicht bezahlen! --------------------------------------------- https://www.watchlist-internet.at/news/vermeintliche-kuendigung-fuehrt-zu-t… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Microsoft sichert Windows und Browser gegen Angriffe ab ∗∗∗ --------------------------------------------- Microsoft hat Windows-Patches veröffentlicht, unter anderem aber auch einige gefährliche Angriffsmöglichkeiten auf Edge und Internet Explorer beseitigt. --------------------------------------------- https://heise.de/-4549555 ∗∗∗ Forensoftware vBulletin: Weitere Sicherheits-Patches veröffentlicht ∗∗∗ --------------------------------------------- Auf Patch-Level 1 folgte zügig Patch-Level 2 für die Foren-Software. Angesichts jüngst erfolgter Angriffe auf vBulletin-Foren sollte man zügig updaten. --------------------------------------------- https://heise.de/-4549270 ∗∗∗ SMA Solar Technology AG Sunny WebBox ∗∗∗ --------------------------------------------- This advisory includes mitigations for a cross-site request forgery vulnerability reported in the SMA Solar Technology AG Sunny WebBox communications hub. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-281-01 ∗∗∗ GE Mark VIe Controller ∗∗∗ --------------------------------------------- This advisory includes mitigations for improper authorization and use of hard-coded credentials vulnerabilities reported in GE’s Mark VIe controller. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsa-19-281-02 ∗∗∗ Vulnerability Spotlight: Multiple remote code execution bugs in NitroPDF ∗∗∗ --------------------------------------------- Cisco Talos recently discovered multiple remote code execution vulnerabilities in NitroPDF. Nitro PDF allows users to save, read, sign and edit PDF files on their machines. --------------------------------------------- https://blog.talosintelligence.com/2019/10/vuln-spotlight-Nitro-PDF-RCE-bug… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium), openSUSE (rust and sqlite3), SUSE (dnsmasq, firefox, and kubernetes, patchinfo), and Ubuntu (python2.7, python3.5, python3.6, python3.7). --------------------------------------------- https://lwn.net/Articles/801838/ ∗∗∗ Critical Security Issue identified in iTerm2 as part of Mozilla Open Source Audit ∗∗∗ --------------------------------------------- A security audit funded by the Mozilla Open Source Support Program (MOSS) has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2. --------------------------------------------- https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-aud… ∗∗∗ VU#719689: Multiple vulnerabilities found in the Cobham EXPLORER 710 satcom terminal ∗∗∗ --------------------------------------------- https://kb.cert.org/vuls/id/719689 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SPSS Modeler (CVE-2019-4473,CVE-2019-11771) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: IBM Maximo Anywhere does not have device root detection. (CVE-2019-4265) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-maximo-anywhere-d… ∗∗∗ ImageMagick vulnerability CVE-2019-13135 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K20336394 ∗∗∗ Beckhoff TwinCAT Denial-of-Service in Profinet driver ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2019-019 ∗∗∗ CVE-2019-TBD - Citrix Application Delivery Management (ADM) Console Security Update ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX261735 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.10.2019
by Daily end-of-shift report 08 Oct '19

08 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Montag 07-10-2019 18:00 − Dienstag 08-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ D-Link Home Routers Open to Remote Takeover Will Remain Unpatched ∗∗∗ --------------------------------------------- CVE-2019-16920 allows remote unauthenticated attackers to execute code on a target device. --------------------------------------------- https://threatpost.com/d-link-home-routers-unpatched/148941/ ∗∗∗ Kriminelle versenden gefälschte Apple Rechnung ∗∗∗ --------------------------------------------- Kriminelle fälschen App Store Rechnungen und senden diese wahllos an zahlreiche E-Mail-Adressen. Angeblich wurden Spiele im Wert von rund 80 Euro per Kreditkarte gekauft. Für die Stornierung und Rückerstattung des Betrages haben besorgte EmpfängerInnen die Möglichkeit, einem Link zu folgen. Ignorieren Sie diese Rechnung und klicken Sie nicht auf den Link, denn dieser führt zu einer Phishing-Seite. Im schlimmsten Fall wird Ihr Computer mit Schadsoftware infiziert. --------------------------------------------- https://www.watchlist-internet.at/news/kriminelle-versenden-gefaelschte-app… ∗∗∗ Zero-day published for old Joomla CMS versions ∗∗∗ --------------------------------------------- Proof-of-concept code available online; trivial to exploit. --------------------------------------------- https://www.zdnet.com/article/zero-day-published-for-old-joomla-cms-version… ===================== = Vulnerabilities = ===================== ∗∗∗ Apple Releases Security Updates ∗∗∗ --------------------------------------------- Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/08/apple-releases-sec… ∗∗∗ Patchday: Google schließt zahlreiche kritische Android-Lücken ∗∗∗ --------------------------------------------- Zum Oktober-Patchday hat Google unter anderem die kürzlich von Project Zero veröffentlichte kritische Sicherheitslücke in Pixel 1 und 2 beseitigt. --------------------------------------------- https://heise.de/-4548538 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (openjpeg2, openssh, and xen), openSUSE (dovecot23, jasper, libseccomp, lxc, putty, and singularity), Red Hat (bind, kernel, polkit, python, and wget), and Ubuntu (unbound). --------------------------------------------- https://lwn.net/Articles/801692/ ∗∗∗ SAP Security Patch Day – October 2019 ∗∗∗ --------------------------------------------- [...] On 8th of October 2019, SAP Security Patch Day saw the release of 7 Security Notes. There is 1 update to previously released Patch Day [...] --------------------------------------------- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=528123050 ∗∗∗ All In One WP Security & Firewall <= 4.4.1 - Open Redirect & Hidden Login Page Exposure ∗∗∗ --------------------------------------------- https://wpvulndb.com/vulnerabilities/9898 ∗∗∗ SSA-608355: Processor Vulnerabilities Affecting SIMATIC WinAC RTX (F) 2010 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-608355.txt ∗∗∗ SSA-878278: Denial-of-Service Vulnerability in SIMATIC WinAC RTX (F) 2010 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-878278.txt ∗∗∗ SSA-984700: Password Storage Vulnerability in SIMATIC IT UADM ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-984700.txt ∗∗∗ SSA-473245: Denial-of-Service Vulnerability in Profinet Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-473245.txt ∗∗∗ SSA-349422: Denial-of-Service in Industrial Real-Time (IRT) Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-349422.txt ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloud ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-vulnerabilit… ∗∗∗ IBM Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where the local attacker can obtain root privilege by injecting parameters into setuid files (CVE-2019-4558) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-a-vulnerability-has-b… ∗∗∗ IBM Security Bulletin: IBM Maximo Asset Management is vulnerable to Information Disclosure (CVE-2019-4512) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-maximo-asset-mana… ∗∗∗ Bash vulnerability CVE-2012-6711 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K05122252 ∗∗∗ Linux kernel vulnerability CVE-2019-15505 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K28222050 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.10.2019
by Daily end-of-shift report 07 Oct '19

07 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Freitag 04-10-2019 18:00 − Montag 07-10-2019 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Betrügerische Mahnungen von Streaming-Seiten ignorieren! ∗∗∗ --------------------------------------------- Auf der Suche nach den neuesten Hollywood-Blockbustern im Internet stolpern zahlreiche KonsumentInnen über kinox.su. Beim Versuch, kostenlos Filme anzusehen, werden sie auf Websites wie streamovo.de, streamado.de, streamamy.de oder streamjuju.de weitergeleitet. Achtung: Die gratis Anmeldung auf diesen Websites führt nicht zu unbegrenztem Filmgenuss, sondern zu Rechnungen und Mahnungen über 395,88 Euro. Es besteht kein Grund zur Zahlung! --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-mahnungen-von-streami… ∗∗∗ visNetwork for Network Data, (Sun, Oct 6th) ∗∗∗ --------------------------------------------- DFIR Redefined Part 3 - Deeper Functionality for Investigators with R series continued --------------------------------------------- https://isc.sans.edu/diary/rss/25390 ∗∗∗ Factsheet DNS monitoring will get harder ∗∗∗ --------------------------------------------- New DNS transport protocols make it harder to monitor or modify DNS requests. This is beneficial on today’s untrusted networks. At the same time the shift may render your organisation’s security controls ineffective, expose internal naming or break connectivity. These negative side effects are hard to mitigate at a network level and require mitigation at DNS infrastructure and individual devices. --------------------------------------------- https://english.ncsc.nl/publications/factsheets/2019/oktober/2/factsheet-dn… ∗∗∗ NISTs Zero Trust Taxonomy Introduces Components, Threats and Migration Routes ∗∗∗ --------------------------------------------- NIST has published a draft Zero Trust Architecture (ZTA) special publication (SP.800.207). The purpose is to develop a technology-neutral lexicon of the logical components of a zero trust strategy, and to define ZTA, describe possible deployment scenarios, and highlight threats. --------------------------------------------- https://www.securityweek.com/nists-zero-trust-taxonomy-introduces-component… ∗∗∗ A year after patch, Drupalgeddon2 is still being employed in cybercriminal attacks ∗∗∗ --------------------------------------------- The remote code execution bug is being used in attacks against high-profile websites. --------------------------------------------- https://www.zdnet.com/article/old-drupalgeddon2-rce-is-still-being-employed… ∗∗∗ White-hat hacks Muhstik ransomware gang and releases decryption keys ∗∗∗ --------------------------------------------- Annoyed victim hacks back ransomware gang and releases all their decryption keys, along with a free decrypter. --------------------------------------------- https://www.zdnet.com/article/white-hat-hacks-muhstik-ransomware-gang-and-r… ===================== = Vulnerabilities = ===================== ∗∗∗ Vulnerabilities exploited in VPN products used worldwide ∗∗∗ --------------------------------------------- The NCSC is investigating the exploitation, by Advanced Persistent Threat (APT) actors, of known vulnerabilities affecting Virtual Private Network (VPN) products from vendors Pulse secure, Palo Alto and Fortinet. --------------------------------------------- https://www.ncsc.gov.uk/news/alert-vpn-vulnerabilities ∗∗∗ Großer Lausch-Anruf: Signal für Android nimmt selbsttätig Anrufe an ∗∗∗ --------------------------------------------- Eine Lücke im Messenger Signal führt unter Android dazu, dass Nutzer belauscht werden könnten. Die App nimmt Sprachanrufe ohne Nutzerinteraktion entgegen. --------------------------------------------- https://heise.de/-4546500 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jackson-databind, libapreq2, libreoffice, novnc, phpbb3, and ruby-mini-magick), Fedora (mbedtls and mosquitto), Mageia (xpdf), openSUSE (bind, firefox, nginx, openssl-1_0_0, php7, python-numpy, and thunderbird), Oracle (kernel), SUSE (ansible1, ardana-ansible, ardana-cluster, ardana-db, ardana-extensions-nsx, ardana-glance, ardana-input-model, ardana-installer-ui, ardana-manila, ardana-monasca, ardana-neutron, ardana-nova, ardana-octavia, [...] --------------------------------------------- https://lwn.net/Articles/801469/ ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Rational® Quality Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-multiple-security-vul… ∗∗∗ IBM Security Bulletin: IBM QRadar Network Security is affected by an openssh vulnerability (CVE-2018-15473) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-qradar-network-se… ∗∗∗ IBM Security Bulletin: IBM QRadar Network Security is affected by openssl vulnerabilities (CVE-2019-1559, CVE-2018-0734) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-qradar-network-se… ∗∗∗ IBM Security Bulletin: IBM QRadar Network Security is affected by Linux kernel vulnerabilities (CVE-2019-11479, CVE-2019-11478, CVE-2019-11477) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-qradar-network-se… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 04.10.2019
by Daily end-of-shift report 04 Oct '19

04 Oct '19

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 03-10-2019 18:00 − Freitag 04-10-2019 18:00 Handler: Stephan Richter Co-Handler: Olaf Schwarz ===================== = News = ===================== ∗∗∗ Lost Files Data Wiper Poses as a Windows Security Scanner ∗∗∗ --------------------------------------------- A Windows Security Scanner that states it encrypted your files is being distributed by spam, but whether by bug or design, it instead corrupts binary data in a victims files. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lost-files-data-wiper-poses-… ∗∗∗ Linux-Kernel: Android-Bug wird von NSO Group angegriffen ∗∗∗ --------------------------------------------- Googles Project Zero berichtet über einen Bug im Linux-Kernel, mit dem sich Android-Telefone angreifen lassen. Laut Google wird offenbar ein Exploit für den Bug bereits aktiv ausgenutzt. Pikant: Gefunden wurde der Bug bereits 2017 - von Google selbst. --------------------------------------------- https://www.golem.de/news/linux-kernel-android-bug-wird-von-nso-group-angeg… ∗∗∗ Investigating the security of Lime scooters ∗∗∗ --------------------------------------------- I've been looking at the security of the Lime escooters. These caught my attention because:(1) There's a whole bunch of them outside my building, and(2) I can see them via Bluetooth from my sofa which, given that I'm extremely lazy, made them more attractive targets than something that would actually require me to leave my home. --------------------------------------------- https://mjg59.dreamwidth.org/53024.html ∗∗∗ Down the Malware Rabbit Hole – Part 1 ∗∗∗ --------------------------------------------- It’s common for malware to be encoded to hide itself—or its true intentions—but have you ever given thought to what lengths attackers will go to hide their malicious code? In our first post in this series, we’ll describe how bad actors hide their malicious code and the steps taken to reveal its true form. --------------------------------------------- https://blog.sucuri.net/2019/10/down-the-malware-rabbit-hole-part-1.html ∗∗∗ COMpfun successor Reductor infects files on the fly to compromise TLS traffic ∗∗∗ --------------------------------------------- In April 2019, we discovered new malware that compromises encrypted web communications in an impressive way. Analysis of the malware allowed us to confirm that the operators have some control over the target’s network channel and could replace legitimate installers with infected ones on the fly. --------------------------------------------- https://securelist.com/compfun-successor-reductor/93633/ ∗∗∗ Antimalware Scan Interface Detection Optics Analysis Methodology: Identification and Analysis of AMSI for WMI ∗∗∗ --------------------------------------------- AMSI offers a fantastic interface for endpoint security vendors to gain insight into in-memory buffers from components that choose have their content scanned. --------------------------------------------- https://posts.specterops.io/antimalware-scan-interface-detection-optics-ana… ∗∗∗ macOS systems abused in DDoS attacks ∗∗∗ --------------------------------------------- Up to 40,000 macOS systems expose a particular port online that can be abused for pretty big DDoS attacks. --------------------------------------------- https://www.zdnet.com/article/macos-systems-abused-in-ddos-attacks/ ===================== = Vulnerabilities = ===================== ∗∗∗ Interpeak IPnet TCP/IP Stack (Update A) ∗∗∗ --------------------------------------------- This updated medical advisory is a follow-up to the original advisory titled ICSMA-19-274-01 Interpeak IPnet TCP/IP Stack that was published October 1, 2019, on the ICS webpage on us-cert.gov. --------------------------------------------- https://www.us-cert.gov/ics/advisories/icsma-19-274-01 ∗∗∗ Microsoft Re-Releases Security Updates ∗∗∗ --------------------------------------------- Microsoft has re-released security updates to address a vulnerability in Microsoft software. A remote attacker could exploit this vulnerability to take control of an affected system. Updates are now available automatically via Windows Update or Windows Server Update Services. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2019/10/03/microsoft-re-relea… ∗∗∗ FreeType vulnerability CVE-2015-9290 ∗∗∗ --------------------------------------------- In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict ... --------------------------------------------- https://support.f5.com/csp/article/K38315305 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (exim, ruby, ruby-rdoc, ruby2.5, and systemd), Debian (openconnect), Mageia (thunderbird), openSUSE (lxc and mosquitto), Oracle (kernel and patch), Scientific Linux (patch), SUSE (firefox, java-1_7_0-ibm, and sqlite3), and Ubuntu (clamav). --------------------------------------------- https://lwn.net/Articles/801318/ ∗∗∗ Security Advisory 2019-13: Security Update for OTRS Framework ∗∗∗ --------------------------------------------- https://community.otrs.com/security-advisory-2019-13-security-update-for-ot… ∗∗∗ IBM Security Bulletin: Linux Kernel as used by IBM QRadar SIEM is vulnerable to Denial of Service(CVE-2019-11477, CVE-2019-11478, CVE-2019-11479) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-linux-kernel-as-used-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2019