Daily October 2022

daily@lists.cert.at

1 participants
20 discussions

Tageszusammenfassung - 31.10.2022
by Daily end-of-shift report 31 Oct '22

31 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-10-2022 18:00 − Montag 31-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Jetzt patchen! Es könnten Attacken auf VMware Cloud Foundation bevorstehen ∗∗∗ --------------------------------------------- Für eine kritische Sicherheitslücke in Cloud Foundation von VMware ist Exploit-Code in Umlauf. --------------------------------------------- https://heise.de/-7324777 ∗∗∗ Apple räumt ein: Nur aktuelles macOS stopft alle bekannten Sicherheitslücken ∗∗∗ --------------------------------------------- Apple hat zum ersten Mal bestätigt, dass der Hersteller in früheren macOS-Versionen nicht alle Schwachstellen beseitigt. Dasselbe gilt offensichtlich für iOS. --------------------------------------------- https://heise.de/-7324991 ∗∗∗ Backup-Software von ConnectWise für Ransomware-Attacken anfällig ∗∗∗ --------------------------------------------- Angreifer könnten Systeme mit Recover oder R1Soft Server Backup Manager von ConnectWise attackieren. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-7324856 ∗∗∗ Gefälschtes A1-Mail im Umlauf ∗∗∗ --------------------------------------------- In einem gefälschten E-Mail von A1 behaupten Kriminelle, dass Sie bereits 80% Ihres Postfach-Speicherplatzes aufgebraucht haben. Sie werden aufgefordert, auf einen Link zu klicken, um zusätzlichen Speicherplatz freizuschalten. Klicken Sie nicht auf den Link, Sie landen auf einer manipulierten Login-Seite. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-a1-mail-im-umlauf/ ∗∗∗ 2022 OpenSSL vulnerability ∗∗∗ --------------------------------------------- This repo contains operational information regarding the recently announced vulnerability in OpenSSL 3. [...] Currently no complete overview of vulnerable products is available. Please see https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md for a list of products that are known to be vulnerable. The list is a work in progress. --------------------------------------------- https://github.com/NCSC-NL/OpenSSL-2022 ∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗ --------------------------------------------- Some here may still remember Heartbleed. Heartbleed was a critical OpenSSL vulnerability that surprised many organizations, and patching the issue was a major undertaking. Heartbleed caused OpenSSL and other open-source projects to rethink how they address security issues and communicate with their users. OpenSSL started to pre-announce any security updates about a week ahead of time. This week, OpenSSL announced they would release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability [1]. --------------------------------------------- https://isc.sans.edu/diary/rss/29192 ∗∗∗ APT10: Tracking down LODEINFO 2022, part I ∗∗∗ --------------------------------------------- The first part of this report will provide technical analysis of the new infection methods such as SFX files and DOWNIISSA, a new downloader shellcode used to deploy the LODEINFO backdoor. --------------------------------------------- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/ ∗∗∗ APT10: Tracking down LODEINFO 2022, part II ∗∗∗ --------------------------------------------- In the second part of this report, we discuss improvements made to the LODEINFO backdoor shellcode in 2022. --------------------------------------------- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/ ∗∗∗ NMAP without NMAP - Port Testing and Scanning with PowerShell, (Mon, Oct 31st) ∗∗∗ --------------------------------------------- Ever needed to do a portscan and didn't have nmap installed? I've had this more than once on an internal pentest or more often just on run-rate "is that port open? / is there a host firewall in the way?" testing. --------------------------------------------- https://isc.sans.edu/diary/rss/29202 ∗∗∗ WordPress Vulnerability & Patch Roundup October 2022 ∗∗∗ --------------------------------------------- [...] To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month. --------------------------------------------- https://blog.sucuri.net/2022/10/wordpress-vulnerability-patch-roundup-octob… ∗∗∗ Hardware Trojans Under a Microscope ∗∗∗ --------------------------------------------- While the security industry generally focuses on software cyber attacks, we can’t forget the security impact of lower level hardware flaws, such as those that affect semiconductors. --------------------------------------------- https://ryancor.medium.com/hardware-trojans-under-a-microscope-bf542acbcc29 ∗∗∗ What I learnt from reading 217* Subdomain Takeover bug reports. ∗∗∗ --------------------------------------------- My two prior blogs, What I Learnt From Reading 220 IDOR bug reports, and What I Learnt From Reading 126 Information Disclosure Writeups*, were well received, so I’m continuing the series. I once more scraped ALL 143 SDTO bug reports from hackerone, and 74 detailed write-ups, then went into hiding as I read and took notes on them. I’m here to show you my actionable findings, and show you how to properly hunt for SDTOs. --------------------------------------------- https://medium.com/@nynan/what-i-learnt-from-reading-217-subdomain-takeover… ∗∗∗ Free Micropatches For Bypassing MotW Security Warning with Invalid Signature (0day) ∗∗∗ --------------------------------------------- Nine days ago we issued micropatches for a vulnerability that allows attackers to bypass the warning Windows normally present to users when they try to open a document or executable obtained from an untrusted source (Internet, email, USB key, network drive). That vulnerability, affecting all supported and many legacy Windows versions, still has no official patch from Microsoft so our (free!) patches are the only actual patches in existence as of this writing. On the very same day we issued these micropatches, Will Dormann - who researched said vulnerability - replied to a tweet by another security researcher, Patrick Schläpfer. Patrick works at HP Wolf Security where they analyzed the Magniber Ransomware and wrote a detailed analysis of its working. Will asked Patrick about the ZIP files used in the malware campaign to see if they were exploiting the same vulnerability or employing some other trick to bypass the "Mark of the Web". [...] And so a new 0day - already exploited in the wild - was revealed. --------------------------------------------- https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html ∗∗∗ The Defender’s Guide to the Windows Registry ∗∗∗ --------------------------------------------- Welcome to the Defender’s Guide. This is a series of blog posts designed to give you a ground-up start to defending a specific technology from potential attackers. While a lot of this information may be redundant to a more seasoned information security personnel, even the best of us rely on Google and blog posts to get information. These posts are designed to be a one-stop shop, bringing a lot of that information together. --------------------------------------------- https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-feb… ∗∗∗ Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure ∗∗∗ --------------------------------------------- Learning about the variety of techniques used by banking Trojans can help us detect other activities of financially motivated threat groups. --------------------------------------------- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ ∗∗∗ Follina Exploit Leads to Domain Compromise ∗∗∗ --------------------------------------------- In early June 2022, we observed an intrusion where a threat actor gained initial access by exploiting the CVE-2022-30190 (Follina) vulnerability which triggered a Qbot infection chain. --------------------------------------------- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compro… ∗∗∗ Vulnerabilities in Apache Batik Default Security Controls – SSRF and RCE Through Remote Class Loading ∗∗∗ --------------------------------------------- I stumbled upon the Apache Batik library while researching other Java-based products. It immediately caught my attention, as this library parses Scalable Vector Graphics (SVG) files and transforms them into different raster graphics formats (i.e., PNG, PDF, or JPEG). I was even more encouraged when I looked at the Batik documentation. It was obvious that such a library could be prone to Server-Side Request Forgery (SSRF) issues (e.g., loading of images from remote resources). --------------------------------------------- https://www.thezdi.com/blog/2022/10/28/vulnerabilities-in-apache-batik-defa… ∗∗∗ AgentTesla Being Distributed via VBS ∗∗∗ --------------------------------------------- The ASEC analysis team has recently identified that AgentTesla is being distributed through malicious VBS. The script file has multiple codes that have been obfuscated multiple times. AgentTesla has been found to be distributed last May through a Windows Help file (*.chm), and it seems that its distribution method is continuously changing. --------------------------------------------- https://asec.ahnlab.com/en/40890/ ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- App Connect Professional, IBM Business Automation Manager Open Editions 8.0.1, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Cloud Pak for Business Automation, IBM Cloud Pak for Security, IBM Event Streams, IBM Host Access Transformation Services, IBM MQ Appliance --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client ∗∗∗ --------------------------------------------- Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible. --------------------------------------------- https://spring.io/blog/2022/10/31/cve-2022-31690-privilege-escalation-in-sp… ∗∗∗ CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security ∗∗∗ --------------------------------------------- Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for [CVE-2022-31692](https://tanzu.vmware.com/security/cve-2022-31692) affecting the AuthorizationFilter. Users are encouraged to update as soon as possible. --------------------------------------------- https://spring.io/blog/2022/10/31/cve-2022-31692-authorization-rules-can-be… ∗∗∗ CISA Has Added One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/10/28/cisa-has-added-on… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.10.2022
by Daily end-of-shift report 28 Oct '22

28 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-10-2022 18:00 − Freitag 28-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Windows: Gefährliche, IE-basierende Schwachstellen ∗∗∗ --------------------------------------------- Sicherheitsforscher der Varonis Threat Labs haben zwei Windows-Sicherheitslücken aufgedeckt, die große blinde Flecken für Sicherheits-Software erzeugen und Rechner mittels DoS-Angriffe außer Betrieb setzen können. LogCrusher und OverLog nutzen dabei das Internet Explorer-spezifische Ereignisprotokoll MS-EVEN, das auf allen aktuellen Windows-Betriebssystemen vorhanden ist, unabhängig davon, ob der Browser genutzt wurde oder wird. Während OverLog mittlerweile gefixt ist, hat Microsoft für LogCrusher kürzlich nur einen partiellen Patch herausgegeben: Cyberkriminelle können deshalb immer noch Angriffe durchführen, wenn sie sich einen Administrator-Zugang zum Netzwerk des Opfers verschaffen. --------------------------------------------- https://www.borncity.com/blog/2022/10/28/windows-gefhrliche-ie-basierende-s… ∗∗∗ Neue Website: Apple erleichtert Sicherheitsforschung ∗∗∗ --------------------------------------------- Ein zentrales neues Portal erklärt das Bug–Bounty-Programm und ermöglicht es, schneller und direkter mit dem Security-Team des Konzerns in Kontakt zu kommen. --------------------------------------------- https://heise.de/-7323634 ∗∗∗ macOS 13: Anti-Malware-Tools nach Upgrade zahnlos ∗∗∗ --------------------------------------------- Antivirus-Software und andere Sicherheits-Tools funktionieren durch einen Apple-Bug in macOS Ventura nicht mehr richtig. Das Problem kann behoben werden. --------------------------------------------- https://heise.de/-7322669 ∗∗∗ Vorsicht vor dieser Fake-Raiffeisen Investmentfalle ∗∗∗ --------------------------------------------- Geld verdienen mit Raiffeisen, angeboten werden angeblich Aktien einer der größten Banken Österreichs. Das Versprechen klingt gut, doch es handelt sich um eine gut getarnte Phishing-Seite. Investieren Sie nicht auf lps.snowgross.com, Sie tappen in eine Anlagebetrugsfalle! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-dieser-fake-raiffeisen-… ∗∗∗ One-Time Programs ∗∗∗ --------------------------------------------- One of the things I like to do on this blog is write about new research that has a practical angle. Most of the time (I swear) this involves writing about other folks’ research: it’s not that often that I write about work that comes out of my own lab. Today I’m going make an [...] --------------------------------------------- https://blog.cryptographyengineering.com/2022/10/27/one-time-programs/ ∗∗∗ Apple clarifies security update policy: Only the latest OSes are fully patched ∗∗∗ --------------------------------------------- New document confirms what security researchers have observed for a few years. --------------------------------------------- https://arstechnica.com/?p=1893235 ∗∗∗ Android malware droppers with 130K installs found on Google Play ∗∗∗ --------------------------------------------- A set of Android malware droppers were found infiltrating the Google Play store to install malicious programs by pretending to be app updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/android-malware-droppers-wit… ∗∗∗ Exploit released for critical VMware RCE vulnerability, patch now ∗∗∗ --------------------------------------------- Proof-of-concept exploit code is now available for a pre-authentication remote code execution (RCE) vulnerability allowing attackers to execute arbitrary code remotely with root privileges on unpatched Cloud Foundation and NSX Manager appliances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-critica… ∗∗∗ Researchers Expose Over 80 ShadowPad Malware C2 Servers ∗∗∗ --------------------------------------------- As many as 85 command-and-control (C2) servers have been discovered supported by the ShadowPad malware since September 2021, with infrastructure detected as recently as October 16, 2022. Thats according to VMwares Threat Analysis Unit (TAU), which studied three ShadowPad variants using TCP, UDP, and HTTP(S) protocols for C2 communications. --------------------------------------------- https://thehackernews.com/2022/10/researchers-expose-over-80-shadowpad.html ∗∗∗ Raspberry Robin Operators Selling Cybercriminals Access to Thousands of Endpoints ∗∗∗ --------------------------------------------- The Raspberry Robin worm is becoming an access-as-a-service malware for deploying other payloads, including IcedID, Bumblebee, TrueBot (aka Silence), and Clop ransomware. It is "part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread," the Microsoft Security Threat Intelligence Center (MSTIC) said in a detailed write-up. --------------------------------------------- https://thehackernews.com/2022/10/raspberry-robin-operators-selling.html ∗∗∗ TCP/IP Vulnerability CVE-2022–34718 PoC Restoration and Analysis ∗∗∗ --------------------------------------------- The patch released by Microsoft last month contained a vulnerability in the TCP/IP protocol that allowed for code execution. To ascertain the impact of the vulnerability, Numen’s security research team conducted an in-depth analysis of the vulnerability and restored the PoC through patch comparison. --------------------------------------------- https://medium.com/numen-cyber-labs/analysis-and-summary-of-tcp-ip-protocol… ∗∗∗ Defeating Guloader Anti-Analysis Technique ∗∗∗ --------------------------------------------- Unit 42 is providing a script to deobfuscate a recently discovered Guloader variant that uses anti-analysis techniques, and other samples like it. --------------------------------------------- https://unit42.paloaltonetworks.com/guloader-variant-anti-analysis/ ∗∗∗ Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign ∗∗∗ --------------------------------------------- Group uses novel method of reading commands from legitimate IIS logs. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/cranefly… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates für älteres iOS und iPadOS ∗∗∗ --------------------------------------------- iPadOS 15.7.1 und iOS 15.7.1 stopfen problematische Sicherheitslücken für alle, die nicht auf iPadOS 16 und iOS 16 aktualisieren wollen - oder können. --------------------------------------------- https://heise.de/-7323199 ∗∗∗ Webbrowser: Entwickler schließen hochriskante Sicherheitslücke in Chrome ∗∗∗ --------------------------------------------- Google hat ein Update für den Webbrowser Chrome veröffentlicht. Darin dichten die Programmierer eine Schwachstelle mit hohem Risiko ab. --------------------------------------------- https://heise.de/-7322963 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- CP4D Match 360, IBM Answer Retrieval for Watson Discovery versions 2.8 and earlier, IBM Cloud Pak System, IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data, Db2 Warehouse® on Cloud Pak for Data, IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite, IBM QRadar SIEM, IBM TXSeries for Multiplatforms, IBM Voice Gateway, IBM Watson Assistant for IBM Cloud Pak for Data, IBM® SDK, Java™ Technology Edition, Liberty for Java for IBM Cloud, node.js --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (expat, ruby-sinatra, and thunderbird), Fedora (glances), Mageia (cups, firefox, git, heimdal, http-parser, krb5-appl, minidlna, nginx, and thunderbird), Oracle (389-ds:1.4, device-mapper-multipath, firefox, mysql:8.0, postgresql:12, and thunderbird), SUSE (dbus-1, libconfuse0, libtasn1, openjpeg2, qemu, and thunderbird), and Ubuntu (dbus, linux-azure-fde, and tiff). --------------------------------------------- https://lwn.net/Articles/912873/ ∗∗∗ Corel Coreldraw graphics suite vulnerabilities ∗∗∗ --------------------------------------------- https://secalerts.co/vulnerabilities/corel/coreldraw_graphics_suite ∗∗∗ Case update: DIVD-2022-00020 - Multiple injection vulnerabilities identified within Feathers.js ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2022-00020/ ∗∗∗ Case update: DIVD-2022-00045 - Injection vulnerability found within Socket.io ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2022-00045/ ∗∗∗ [R1] Nessus Version 10.4.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-21 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.10.2022
by Daily end-of-shift report 27 Oct '22

27 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-10-2022 18:00 − Donnerstag 27-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Microsoft fixes Windows vulnerable driver blocklist sync issue ∗∗∗ --------------------------------------------- Microsoft says it addressed an issue preventing the Windows kernel vulnerable driver blocklist from being synced to systems running older Windows versions. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vul… ∗∗∗ Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets ∗∗∗ --------------------------------------------- A new version of the Fodcha DDoS botnet has emerged, featuring ransom demands embedded in packets and new features to evade detection of its infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1… ∗∗∗ How to prevent lateral movement attacks using Microsoft 365 Defender ∗∗∗ --------------------------------------------- Learn how Microsoft 365 Defender can enhance mitigations against lateral movement paths in your environment, stopping attackers from gaining access to privileged and sensitive accounts. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/10/26/how-to-prevent-lat… ∗∗∗ Malware vs Virus: What’s the Difference? ∗∗∗ --------------------------------------------- In today’s article, we’ll be clarifying the difference between viruses and malware while helping to identify the most common types of malware. --------------------------------------------- https://blog.sucuri.net/2022/10/whats-the-difference-malware-virus.html ∗∗∗ New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances ∗∗∗ --------------------------------------------- A new cryptojacking campaign has been uncovered targeting vulnerable Docker and Kubernetes infrastructures as part of opportunistic attacks designed to illicitly mine cryptocurrency. --------------------------------------------- https://thehackernews.com/2022/10/new-cryptojacking-campaign-targeting.html ∗∗∗ Hijacking AUR Packages by Searching for Expired Domains ∗∗∗ --------------------------------------------- The Arch User Repository (AUR) is a software repository for Arch Linux. It differs from the official Arch Linux repositories in that its packages are provided by its users and not officially supported by Arch Linux. --------------------------------------------- https://blog.nietaanraken.nl/posts/aur-packages-expired-domains/ ∗∗∗ Industrial Ransomware Attacks: New Groups Emerge, Manufacturing Pays Highest Ransom ∗∗∗ --------------------------------------------- Industrial organizations continue to be a top target for ransomware attacks, and reports published by cybersecurity companies this week reveal some recent trends. --------------------------------------------- https://www.securityweek.com/industrial-ransomware-attacks-new-groups-emerg… ∗∗∗ Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving ∗∗∗ --------------------------------------------- We examine trends in web threats for the second calendar year quarter of 2022, including how a malicious JavaScript downloader is evolving to evade detection. --------------------------------------------- https://unit42.paloaltonetworks.com/web-threats-malicious-javascript-downlo… ∗∗∗ FormBook Malware Being Distributed as .NET ∗∗∗ --------------------------------------------- FormBook is an info-stealer that aims to steal the user’s web browser login information, keyboard input, clipboard, and screenshots. It targets random individuals, and is usually distributed through spam mails or uploaded to infiltrated websites. --------------------------------------------- https://asec.ahnlab.com/en/40663/ ===================== = Vulnerabilities = ===================== ∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗ --------------------------------------------- This week, OpenSSL announced that they will release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability. The update will only affect OpenSSL 3.0.x, not 1.1.1. Now is the time to figure out where and how you are using OpenSSL 3.0.x. --------------------------------------------- https://isc.sans.edu/diary/rss/29192 ∗∗∗ IBM Security Bulletins 2022-10-26 and 2022-10-25 ∗∗∗ --------------------------------------------- IBM SDK, IBM WebSphere Application Server Liberty, IBM QRadar SIEM, IBM i, IBM Robotic Process Automation, IBM Cloud Transformation Advisor, CloudPak for Watson, Netcool Operations Insight. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Cisco AnyConnect: Alte Sicherheitslücken im Visier von Angreifern ∗∗∗ --------------------------------------------- Allerhöchste Zeit, um alte Lücken in Cisco AnyConnect abzudichten: Cisco warnt vor derzeitigen Cyber-Angriffen auf Schwachstellen aus dem Jahr 2020. --------------------------------------------- https://heise.de/-7320917 ∗∗∗ Sicherheitsupdate ArubaOS: Schadcode-Attacken durch präparierte Anfragen möglich ∗∗∗ --------------------------------------------- Die Entwickler des Netzwerkbetriebssystems ArubaOS haben unter anderem eine kritische Lücke geschlossen. --------------------------------------------- https://heise.de/-7321787 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (tomcat9), Oracle (389-ds-base, device-mapper-multipath, firefox, git-lfs, gnutls, kernel, kernel-container, libksba, pki-core, samba, sqlite, and zlib), Red Hat (device-mapper-multipath, kernel, kpatch-patch, libksba, and thunderbird), Slackware (expat and samba), SUSE (bind, buildah, curl, firefox, golang-github-prometheus-node_exporter, grafana, icinga2, python-paramiko, python-waitress, SUSE Manager Client Tools, telnet, and xen), [...] --------------------------------------------- https://lwn.net/Articles/912495/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (389-ds-base, bind, expat, java-1.8.0-openjdk, java-11-openjdk, libksba, and squid), Debian (chromium, libdatetime-timezone-perl, tzdata, and wordpress), Fedora (dbus, dhcp, dotnet3.1, jhead, samba, and strongswan), Mageia (virtualbox), Oracle (device-mapper-multipath), Scientific Linux (device-mapper-multipath and thunderbird), Slackware (curl), SUSE (container-suseconnect, curl, kernel, libmad, libtasn1, libtirpc, qemu, rubygem-puppet, [...] --------------------------------------------- https://lwn.net/Articles/912688/ ∗∗∗ Windows (Mark of the Web) 0-day per JavaScript für Ransomware-Angriffe genutzt ∗∗∗ --------------------------------------------- Die Tage hatte ich über eine ungefixte 0-day-Schwachstelle, Mark of the Web (MOTOW), in Windows berichtet, für die es einen inoffiziellen Fix gibt. Nun ist mir ein Bericht unter die Augen gekommen, dass eine 0-day-Schwachstelle in diesem Bereich von Cyberkriminellen per JavaScript ausgenutzt werden kann, um Web-Sicherheitswarnungen zu umgehen und Ransomware-Angriffe zu verschleiern. --------------------------------------------- https://www.borncity.com/blog/2022/10/27/exploited-windows-0-day-mark-of-th… ∗∗∗ ZDI-22-1467: (0Day) IronCAD STP File Parsing Uninitialized Pointer Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-22-1467/ ∗∗∗ VMSA-2022-0027 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0027.html ∗∗∗ K11601010: Intel Processor vulnerability CVE-2021-33149 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K11601010 ∗∗∗ Synology-SA-22:20 Samba ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_20 ∗∗∗ Hitachi Energy MicroSCADA X DMS600 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-04 ∗∗∗ Johnson Controls CKS CEVAS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-05 ∗∗∗ Delta Electronics DIAEnergie ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-06 ∗∗∗ AliveCor KardiaMobile ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-22-298-01 ∗∗∗ Haas Controller ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-01 ∗∗∗ HEIDENHAIN Controller TNC on HARTFORD Machine ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-02 ∗∗∗ Rockwell Automation FactoryTalk Alarm and Events Server ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-01 ∗∗∗ SAUTER Controls moduWeb ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-02 ∗∗∗ Rockwell Automation Stratix Devices Containing Cisco IOS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-03 ∗∗∗ Trihedral VTScada ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-04 ∗∗∗ Samba Releases Security Updates ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/10/26/samba-releases-se… ∗∗∗ [R1] Nessus Version 10.3.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-20 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.10.2022
by Daily end-of-shift report 25 Oct '22

25 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Montag 24-10-2022 18:00 − Dienstag 25-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Zero-Day-Fehler im Kernel von iOS und iPadOS wird ausgenutzt ∗∗∗ --------------------------------------------- iOS und iPadOS 16.1 beheben einen schwerwiegenden Kernel-Bug in den Betriebssystemen für iPhone und iPad. Apple hat Berichte über laufende Angriffe. --------------------------------------------- https://heise.de/-7319500 ∗∗∗ Chrome extensions with 1 million installs hijack targets’ browsers ∗∗∗ --------------------------------------------- Researchers at Guardio Labs have discovered a new malvertizing campaign pushing Google Chrome and Microsoft Edge extensions that hijack searches and insert affiliate links into webpages. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chrome-extensions-with-1-mil… ∗∗∗ How the Software Supply Chain Security is Threatened by Hackers ∗∗∗ --------------------------------------------- In many ways, the software supply chain is similar to that of manufactured goods, which we all know has been largely impacted by a global pandemic and shortages of raw materials. However, in the IT world, it is not shortages or pandemics that have been the main obstacles to overcome in recent years, but rather attacks aimed at using them to harm hundreds or even thousands of victims simultaneously. --------------------------------------------- https://thehackernews.com/2022/10/how-software-supply-chain-security-is.html ∗∗∗ Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details about a pair of vulnerabilities in Microsoft Windows, one of which could be exploited to result in a denial-of-service (DoS). --------------------------------------------- https://thehackernews.com/2022/10/researchers-detail-windows-event-log.html ∗∗∗ Chapter 1 - From Gozi to ISFB: The history of a mythical malware family. ∗∗∗ --------------------------------------------- Disclaimer: This article does not contain any IOCs or infrastructure details. Instead, the aim is to explain the whole business dynamic of a long-lasting malware family. This work is based on almost 10 years of research and intel gatherings and tries its best to stick to the truth and the facts observed around ISFB. Hopefully, it will give some insight on how the top cyber crime groups have been working over the years. --------------------------------------------- https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of… ∗∗∗ Stranger Strings: An exploitable flaw in SQLite ∗∗∗ --------------------------------------------- Trail of Bits is publicly disclosing CVE-2022-35737, which affects applications that use the SQLite library API. CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and fixed in release 3.39.2 (released on July 21, 2022). CVE-2022-35737 is exploitable on 64-bit systems, and exploitability depends on how the program is compiled [...] --------------------------------------------- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-libr… ∗∗∗ E-Mail von WhatsApp: Gewinn über 900.600,00 USD ist Fake ∗∗∗ --------------------------------------------- Aktuell kursiert ein E-Mail von WhatsApp, in dem Sie über den Gewinn von 900.600,00 USD informiert werden. Um den Gewinn zu erhalten, müssen Sie Ihre Kontaktdaten an account.whatsapp(a)mail.com senden. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-von-whatsapp-gewinn-ueber-900… ∗∗∗ Windows 10 22H2, Windows 11 22H2: Administrative Vorlagen (.admx); Windows 10 22H2 Security Baseline ∗∗∗ --------------------------------------------- Kleiner Hinweis für Administratoren von Windows-Systemen in Unternehmensumgebungen. Microsoft hat die Security Baseline für das Windows 10 October 2022 Update (Version 22H2) freigegeben. --------------------------------------------- https://www.borncity.com/blog/2022/10/25/windows-10-22h2-windows-11-22h2-ad… ∗∗∗ Rapidly Evolving Magniber Ransomware ∗∗∗ --------------------------------------------- The Magniber ransomware has recently been evolving rapidly. From changing its file extension, injection and to UAC bypassing techniques, the Magniber ransomware has been rapidly changing to bypass the detection of anti-malware software. This article summarizes the evolution of the Magniber ransomware in the last few months based on the analysis that had been previously performed. --------------------------------------------- https://asec.ahnlab.com/en/40422/ ∗∗∗ Analysis on Attack Techniques and Cases Using RDP ∗∗∗ --------------------------------------------- Overview One of the previous ASEC blog posts discussed cases where attackers abused various remote control tools that are originally used for system management purposes to gain control over infected systems. This post will cover cases where RDP (Remote Desktop Protocol), a default service provided by baseline Windows OS, was used. --------------------------------------------- https://asec.ahnlab.com/en/40394/ ===================== = Vulnerabilities = ===================== ∗∗∗ Webkonferenzen: Sicherheitslücke in Zoom ermöglicht Sitzungsübernahme ∗∗∗ --------------------------------------------- Zoom warnt vor einer Sicherheitslücke, durch die Angreifer Opfer etwa auf falsche Server locken und so Sitzungen übernehmen könnten. Updates stehen bereit. --------------------------------------------- https://heise.de/-7319974 ∗∗∗ VMSA-2022-00031 ∗∗∗ --------------------------------------------- VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-00031.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libbluray and wkhtmltopdf), Fedora (firefox, libksba, libmodsecurity, libxml2, qemu, and xmlsec1), Red Hat (389-ds-base, 389-ds:1.4, git-lfs, gnutls, java-1.8.0-ibm, kernel, kernel-rt, kpatch-patch, libksba, mysql:8.0, pki-core, postgresql:12, samba, sqlite, and zlib), Scientific Linux (389-ds-base, libksba, and pki-core), SUSE (bluez, firefox, jdom, kernel, libosip2, libxml2, multipath-tools, and python-Mako), and Ubuntu (barbican, mysql-5.7, mysql-8.0, openvswitch, and pillow). --------------------------------------------- https://lwn.net/Articles/912324/ ∗∗∗ Synology-SA-22:19 Presto File Server ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to write arbitrary files or remote authenticated users to bypass security constraint via a susceptible version of Presto File Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_19 ∗∗∗ Synology-SA-22:18 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to read or write arbitrary files or remote authenticated users to access intranet resources via a susceptible version of Synology DiskStation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_18 ∗∗∗ Node.js: OpenSSL and zlib update assessment, and Node.js Assessment workflow ∗∗∗ --------------------------------------------- https://nodejs.org/en/blog/vulnerability/openssl-and-zlib-vulnerability-ass… ∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosure of information that could aid in further system attacks. (CVD-2022-38710) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is potentially vulnerable to CSV Injection (CVE-2022-22425) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to incorrect permission assignment ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom… ∗∗∗ Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthorized attacker causing integrity impact (CVE-2021-2163) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Delta Electronics InfraSuite Device Master ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-07 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.10.2022
by Daily end-of-shift report 24 Oct '22

24 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-10-2022 18:00 − Montag 24-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Thousands of GitHub repositories deliver fake PoC exploits with malware ∗∗∗ --------------------------------------------- Researchers at the Leiden Institute of Advanced Computer Science found thousands of repositories on GitHub that offer fake proof-of-concept (PoC) exploits for various vulnerabilities, some of them including malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/thousands-of-github-reposito… ∗∗∗ Typosquat campaign mimics 27 brands to push Windows, Android malware ∗∗∗ --------------------------------------------- A massive, malicious campaign is underway using over 200 typosquatting domains that impersonate twenty-seven brands to trick visitors into downloading various Windows and Android malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/typosquat-campaign-mimics-27… ∗∗∗ Kriminalität: Eltern durch Whatsapp-Betrug um Tausende Euro gebracht ∗∗∗ --------------------------------------------- Die Polizei warnt vor Trickbetrügern, die mit einer angeblichen Notlage des Kindes Eltern um ihr Geld bringen. --------------------------------------------- https://www.golem.de/news/kriminalitaet-eltern-durch-whatsapp-betrug-um-tau… ∗∗∗ Securing IoT devices against attacks that target critical infrastructure ∗∗∗ --------------------------------------------- South Staffordshire PLC, a company that supplies water to over one million customers in the United Kingdom, notified its customers in August of being a target of a criminal cyberattack. This incident highlights the sophisticated threats that critical industries face today. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/10/21/securing-iot-devic… ∗∗∗ rtfdumps Find Option, (Sat, Oct 22nd) ∗∗∗ --------------------------------------------- Due to the nature of the RTF language, malicious RTF files can be very obfuscated. To the point that my tool rtfdump.py and Philippe's tool rtfobj don't find embedded objects. --------------------------------------------- https://isc.sans.edu/diary/rss/29174 ∗∗∗ C2 Communications Through outlook.com, (Mon, Oct 24th) ∗∗∗ --------------------------------------------- Most malware implements communication with their C2 server over HTTP(S). Why? Just because it works! But they are multiple ways to implement C2 communications: DNS, P2P, Layer 7 (Twitter), ... Another one that has become less popular with time is SMTP (email communications). I spotted a malicious Python script that exchanges information with its C2 server through emails. --------------------------------------------- https://isc.sans.edu/diary/rss/29180 ∗∗∗ SCuBA M365 Security Baseline Assessment Tool ∗∗∗ --------------------------------------------- Developed by CISA, this assessment tool verifies that an M365 tenant’s configuration conforms to the policies described in the SCuBA Minimum Viable Secure Configuration Baseline documents. --------------------------------------------- https://github.com/cisagov/ScubaGear ∗∗∗ Cisco ISE: Angreifer könnten Kontrolle übernehmen ∗∗∗ --------------------------------------------- Cisco warnt, dass Angreifer Dateien in der Identity Services Engine lesen und löschen könnten. Die Übernahme der Kontrolle über die Geräte könnte möglich sein. --------------------------------------------- https://heise.de/-7317442 ∗∗∗ Gebrauchtwagen-Kauf: Abwicklung über Treuhandunternehmen ist Betrug ∗∗∗ --------------------------------------------- Sie sind gerade auf der Suche nach einem Gebrauchtwagen? Bedenken Sie: Nicht jedes Inserat ist seriös. Auch Kriminelle nutzen gängige Verkaufsplattformen, um betrügerische Lockangebote zu platzieren. Ein betrügerisches Angebot erkennen Sie an der Kommunikation und der Forderung, Geld an ein Treuhandkonto zu überweisen. --------------------------------------------- https://www.watchlist-internet.at/news/gebrauchtwagen-kauf-abwicklung-ueber… ∗∗∗ So funktioniert Domain Shadowing ∗∗∗ --------------------------------------------- Cyberkriminelle nutzen schwer auffindbare Shadow Domains für verschiedene illegale Aktivitäten, einschließlich Phishing und Botnet-Operationen. --------------------------------------------- https://www.zdnet.de/88404347/so-funktioniert-domain-shadowing/ ∗∗∗ AA22-294A: #StopRansomware: Daixin Team ∗∗∗ --------------------------------------------- The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) are releasing this joint CSA to provide information on the “Daixin Team,” a cybercrime group that is actively targeting U.S. businesses, predominantly in the Healthcare and Public Health (HPH) Sector, with ransomware and data extortion operations. --------------------------------------------- https://us-cert.cisa.gov/ncas/alerts/aa22-294a ∗∗∗ Treasure trove. Alive and well point-of-sale malware ∗∗∗ --------------------------------------------- Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals. --------------------------------------------- https://blog.group-ib.com/majikpos_treasurehunter_malware ∗∗∗ Attacking Very Weak RC4-Like Ciphers the Hard Way ∗∗∗ --------------------------------------------- RC4 is a popular encryption algorithm. The way it works is that a “Key Scheduling Algorithm” (KSA) takes your key and generates a 256-byte array, and then a “Pseudo-Random Generation Algorithm” (PRGA) uses that byte array to output an endless stream of bytes (the “key stream”), which look like random noise unless you know what the original byte array was. --------------------------------------------- https://research.checkpoint.com/2022/attacking-very-weak-rc4-like-ciphers-t… ∗∗∗ Uncovering Security Blind Spots in CNC Machines ∗∗∗ --------------------------------------------- Industry 4.0 has given rise to smart factories that have markedly improved machining processes, but it has also opened the doors for cybercriminals looking to abuse networked industrial equipment such as CNC machines. Our research investigates potential cyberthreats to CNC machines and how manufacturers can mitigate the associated risks. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/j/uncovering-security-blind-sp… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-10-21 and 2022-10-22 ∗∗∗ --------------------------------------------- IBM Cloud Pak for Watson, API Connect, IBM Cloud Pak for Multicloud Management, IBM MQ Appliance, IBM Voice Gateway, Infrastructure Automation, IBM Security Identity Manager. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bluez, kernel, and lava), Fedora (ckeditor, drupal7, moby-engine, php-Smarty, and wavpack), Mageia (bind, e2fsprogs, epiphany, freerdp, kernel, kernel-linus, libconfuse, libosip2, ntfs-3g, perl-Image-ExifTool, and poppler), Oracle (firefox, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, kernel, kernel-container, and thunderbird), Scientific Linux (firefox, java-1.8.0-openjdk, and java-11-openjdk), SUSE (bluez, firefox, kernel, libxml2, and Ubuntu (linux-gcp). --------------------------------------------- https://lwn.net/Articles/912178/ ∗∗∗ Missing Authentication in ZKTeco ZEM/ZMM Web Interface ∗∗∗ --------------------------------------------- The ZKTeco time attendance device does not require authentication to use theweb interface, exposing the database of employees and their credentials. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-003/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.10.2022
by Daily end-of-shift report 21 Oct '22

21 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 20-10-2022 18:00 − Freitag 21-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Synology: Kritische Lücken in NAS erlauben Angreifern Ausführen von Schadcode ∗∗∗ --------------------------------------------- Synology warnt vor kritischen Sicherheitslücken in der DSM-Software einiger NAS. Angreifer könnten Schadode ausführen und unbefugt an Informationen gelangen. --------------------------------------------- https://heise.de/-7316623 ∗∗∗ F5 BIG-IP und Nginx: Hersteller stopft teils kritische Sicherheitslücken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in den BIG-IP- und Nginx-Systemen von F5 könnten Angreifern etwa das Ausführen von Schadcode ermöglichen. Updates stehen bereit. --------------------------------------------- https://heise.de/-7316039 ∗∗∗ Gefahren für kritische Infrastrukturen: "Uns fehlt eine Schwachstellenanalyse" ∗∗∗ --------------------------------------------- Prof. Norbert Gebbeken, Gründer und Sprecher des Forschungszentrums RISK, über die Gefahren, die unserer kritischen Infrastruktur drohen – und was man tun kann. --------------------------------------------- https://heise.de/-7315119 ∗∗∗ Your Microsoft Exchange Server Is a Security Liability ∗∗∗ --------------------------------------------- Endless vulnerabilities. Massive hacking campaigns. Slow and technically tough patching. Its time to say goodbye to on-premise Exchange. --------------------------------------------- https://www.wired.com/story/microsoft-exchange-server-vulnerabilities/ ∗∗∗ sczriptzzbn inject pushes malware for NetSupport RAT, (Fri, Oct 21st) ∗∗∗ --------------------------------------------- A campaign nicknamed "sczriptzzbn inject" can be identified by script using a variable named sczriptzzbn injected into files returned from a compromised website. This injected script causes a fake browser update page to appear in the victim's browser. The fake browser update page presents the malware payload for download. More information on the campaign can be found here. In previous weeks, this campaign pushed SolarMarker malware. I ran across one such example on 2022-09-27. This month, we've started seeing a payload for NetSupport RAT from the sczriptzzbn inject. --------------------------------------------- https://isc.sans.edu/diary/rss/29170 ∗∗∗ Archive Sidestepping: Emotet Botnet Pushing Self-Unlocking Password-Protected RAR ∗∗∗ --------------------------------------------- Trustwave SpiderLabs’ spam traps have identified an increase in threats packaged in password-protected archives with about 96% of these being spammed by the Emotet Botnet. In the first half of 2022, we identified password-protected ZIP files as the third most popular archive format used by cybercriminals to conceal malware. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sid… ∗∗∗ Wordfence Evasion Malware Conceals Backdoors ∗∗∗ --------------------------------------------- Malware authors, with some notable exceptions, tend to design their malicious code to hide from sight. The techniques they use help their malware stay on the victim’s website for as long as possible and ensure execution. For example — obfuscation techniques, fake code comments, naming conventions for injections that deploy SEO spam, redirect visitors to malicious third party websites, or steal credit card information from eCommerce stores. --------------------------------------------- https://blog.sucuri.net/2022/10/wordfence-evasion-malware-conceals-backdoor… ∗∗∗ Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware ∗∗∗ --------------------------------------------- A now-patched vulnerability in VMware Workspace ONE Access has been observed being exploited to deliver both cryptocurrency miners and ransomware on affected machines. "The attacker intends to utilize a victims resources as much as possible, not only to install RAR1Ransom for extortion, but also to spread GuardMiner to collect cryptocurrency," Fortinet FortiGuard Labs researcher Cara Lin said in a Thursday report. --------------------------------------------- https://thehackernews.com/2022/10/multiple-campaigns-exploit-vmware.html ∗∗∗ Threat Advisory: Monitoring CVE-2022-42889 “Text4Shell” Exploit Attempts ∗∗∗ --------------------------------------------- On October 17, 2022, the Wordfence Threat Intelligence team began monitoring for activity targeting CVE-2022-42889, or “Text4Shell” on our network of 4 million websites. We started seeing activity targeting this vulnerability on October 18, 2022. Text4Shell is a vulnerability in the Apache Commons Text library versions 1.5 through 1.9 that can be used to achieve [...] --------------------------------------------- https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-… ∗∗∗ CISA Tells Organizations to Patch Linux Kernel Vulnerability Exploited by Malware ∗∗∗ --------------------------------------------- The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a Linux kernel flaw to its Known Exploited Vulnerabilities Catalog and instructed federal agencies to address it within three weeks. --------------------------------------------- https://www.securityweek.com/cisa-tells-organizations-patch-linux-kernel-vu… ∗∗∗ Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool ∗∗∗ --------------------------------------------- Exbyte is the latest tool developed by ransomware attackers to expedite data theft from victims. --------------------------------------------- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bl… ∗∗∗ Attackers Abusing Various Remote Control Tools ∗∗∗ --------------------------------------------- Ordinarily, attackers install malware through various methods such as spear phishing emails with a malicious attachment, malvertising, vulnerabilities, and disguising the malware as normal software and uploading them to websites. The malware that is installed include infostealers which steal information from the infected system, ransomware which encrypts files to demand ransom, and DDoS Bots which are used in DDoS attacks. In addition to these, backdoor and RAT are also major programs used by attackers. --------------------------------------------- https://asec.ahnlab.com/en/40263/ ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-10-20 ∗∗∗ --------------------------------------------- IBM Security Verify Gateway/Bridge, IBM Enterprise Records, IBM Sterling Order Management Netty, IBM WebSphere Application Server, IBM MQ Operator, IBM Sterling Order Management, IBM Enterprise Records, IBM Netezza Host Management. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ SolarWinds Security Advisories 2022-10-19 ∗∗∗ --------------------------------------------- SolarWinds released 4 new Security Advisories (3 high, 1 medium) for SolarWinds Platform 2022.4 RC1. --------------------------------------------- https://www.solarwinds.com/trust-center/security-advisories ∗∗∗ SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server ∗∗∗ --------------------------------------------- The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account.Siemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the mobile server. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-640732.txt ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (poppler), Oracle (firefox and thunderbird), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk, and java-17-openjdk), SUSE (bind, clone-master-clean-up, grafana, libksba, python3, tiff, and v4l2loopback), and Ubuntu (libreoffice). --------------------------------------------- https://lwn.net/Articles/911989/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.10.2022
by Daily end-of-shift report 20 Oct '22

20 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 19-10-2022 18:00 − Donnerstag 20-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Forensic Value of Prefetch, (Thu, Oct 20th) ∗∗∗ --------------------------------------------- When a program executes on a Windows system there are many artifacts that are generated which can assist digital forensic investigations. One of particular note is the Windows Prefetch file. Found in C:\Windows\Prefetch by default, prefetch files (.pf) contain a wealth of information that can prove vital to any investigation. --------------------------------------------- https://isc.sans.edu/diary/rss/29168 ∗∗∗ Fantastic Rootkits: And Where to Find Them (Part 1) ∗∗∗ --------------------------------------------- In this blog series, we will cover the topic of rootkits — how they are built and the basics of kernel driver analysis — specifically on the Windows platform. In this first part, we will focus on some implementation examples of basic rootkit functionality and the basics of kernel driver development, as well as Windows Internals background needed to understand the inner workings of rootkits. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-… ∗∗∗ Microsoft liefert Updates gegen SSL-/TLS-Probleme durch Windows-Updates ∗∗∗ --------------------------------------------- Die aktuellen Windows-Updates für Windows 10, 11 und Server könnten Probleme bei SSL- und TLS-Verschlüsselung verursachen. Teils helfen weitere Patches dagegen. --------------------------------------------- https://heise.de/-7314906 ∗∗∗ New Malicious Clicker found in apps installed by 20M+ users ∗∗∗ --------------------------------------------- Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares masquerading as a useful tool or utility, and automatically crawling ads in the background. Recently the McAfee Mobile Research Team has identified new Clicker malware that sneaked into Google Play. --------------------------------------------- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-… ∗∗∗ Social Engineering dos and don’ts ∗∗∗ --------------------------------------------- It got me thinking, again, about what makes for good social engineering (SE), and what advice would I give my younger self. These are my thoughts. --------------------------------------------- https://www.pentestpartners.com/security-blog/social-engineering-dos-and-do… ∗∗∗ E-Mail-Konto wird migriert: Kriminelle senden betrügerische Mail an Mitarbeiter:innen ∗∗∗ --------------------------------------------- Kriminelle versenden betrügerische E-Mails und geben sich dabei als „Outlook-E-Mail-Administrator“ Ihres Unternehmens aus. Angeblich sollen die E-Mail-Konten aller Mitarbeiter:innen migriert werden. Klicken Sie nicht auf den Link. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-konto-wird-migriert-kriminell… ∗∗∗ Datenleck bei Microsoft, Kundendaten betroffen (Okt. 2022) ∗∗∗ --------------------------------------------- Bei Microsoft hat es ein größeres Datenleck gegeben, bei dem Kundendaten wohl öffentlich zugreifbar waren. Eine Sicherheitsfirma hat einen fehlkonfigurierten Server mit den Daten im Internet gefunden und Microsoft im September informiert. --------------------------------------------- https://www.borncity.com/blog/2022/10/20/datenleck-bei-microsoft-kundendate… ∗∗∗ Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them ∗∗∗ --------------------------------------------- Cisco Talos recently discovered several vulnerabilities in the Abode Systems iota All-In-One Security Kit. This kit includes a main security camera and hub that can alert users of unwanted movement in their homes. It also includes several motion sensors that can be attached to windows and doors. --------------------------------------------- http://blog.talosintelligence.com/2022/10/vuln-spotlight-abode-.html ∗∗∗ LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for Over a Year ∗∗∗ --------------------------------------------- Checkmarx discovered ~200 malicious NPM packages with thousands of installations linked to an attack group called “LofyGang”. --------------------------------------------- https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organiz… ∗∗∗ New Research: We’re Still Terrible at Passwords; Making it Easy for Attackers ∗∗∗ --------------------------------------------- We look at two of the most popular protocols used for remote administration, SSH and RDP, to get a sense of how attackers are taking advantage of weaker password management to gain access to systems. --------------------------------------------- https://www.rapid7.com/blog/post/2022/10/20/new-research-were-still-terribl… ∗∗∗ Black Basta and the Unnoticed Delivery ∗∗∗ --------------------------------------------- As reported by Check Point at the end of H1 2022, 1 out of 40 organizations worldwide were impacted by ransomware attacks, which constitutes a worrying 59% increase over the past year. The ransomware business continues to grow in gargantuan proportions due to the lucrative payments demanded – and often received – by cybercrime gangs. --------------------------------------------- https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/ ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Oracle liefert 370 Sicherheitsupdates im Oktober ∗∗∗ --------------------------------------------- Zum Patchday, Critical Patch Update genannt, liefert Oracle eine lange Liste an Produkten mit Sicherheitslücken. 370 Updates schließen die Schwachstellen. --------------------------------------------- https://heise.de/-7314209 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Red Hat (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, OpenShift Container Platform 4.9.50 bug fix and, and rh-nodejs14-nodejs), SUSE (buildah, clone-master-clean-up, go1.18, go1.19, helm, jasper, libostree, nodejs16, php8, qemu, and xen), and Ubuntu (libxdmcp, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oem-5.14, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-oem-5.17, and perl). --------------------------------------------- https://lwn.net/Articles/911879/ ∗∗∗ Drupal: Search API - Moderately critical - Information Disclosure - SA-CONTRIB-2022-059 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-059 ∗∗∗ Security Bulletin: IBM MQ is affected by an identity spoofing issue in IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-affected-by-an-… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator B2B API vulnerable to multiple issues due to Apache Zookeeper (CVE-2019-0201, CVE-2021-21409) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server April 2022 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Apache log4j security vulnerability as it relates to IBM Maximo Scheduler Optimization – Apache Log4j – [CVE-2021-45105] (affecting v2.16) and [CVE-2021-45046] (affecting v2.15) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-security-vul… ∗∗∗ F5: K24823443: Apache Commons Text vulnerability CVE-2022-42889 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K24823443 ∗∗∗ F5: K27155546: BIND vulnerability CVE-2022-38177 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K27155546 ∗∗∗ F5: K04712583: Linux kernel vulnerability CVE-2021-40490 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04712583 ∗∗∗ F5: K32615023: Linux kernel vulnerability CVE-2022-2588 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K32615023 ∗∗∗ Bentley Systems MicroStation Connect ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-293-01 ∗∗∗ Spring: CVE-2022-31684: Reactor Netty HTTP Server may log request headers ∗∗∗ --------------------------------------------- https://spring.io/blog/2022/10/20/cve-2022-31684-reactor-netty-http-server-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.10.2022
by Daily end-of-shift report 19 Oct '22

19 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 18-10-2022 18:00 − Mittwoch 19-10-2022 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Adobe patcht Illustrator außer der Reihe ∗∗∗ --------------------------------------------- Nach dem großen Patchday letzte Woche legt Adobe nun zwei Updates gegen kritische Lücken im Illustrator nach. --------------------------------------------- https://heise.de/-7314003 ∗∗∗ AMD, Google, Microsoft, Nvidia: Offengelegter Sicherheitsprozessor Caliptra ∗∗∗ --------------------------------------------- Branchenschwergewichte setzen auf RISC-V-Technik für offengelegte Hardware-Security. Sie könnte Black-Box-Umsetzungen wie Microsofts Pluton ersetzen. --------------------------------------------- https://heise.de/-7313272 ∗∗∗ Achtung Betrug: Bewerben Sie sich nicht als „Process Tester“ bei page-rangers.de ∗∗∗ --------------------------------------------- page-rangers.de bietet einen gut bezahlten Minijob als „App-Tester“. Die Arbeit wird von zu Hause aus erledigt und benötigt keine speziellen Anforderungen. Sie erhalten täglich kleine Aufträge, z. B. die Benutzerfreundlichkeit bei der Eröffnung eines Bankkontos zu testen. Doch Vorsicht: Mit diesem Job stehlen Kriminelle Ihre Identität. Mit dem erstellten Bankkonto wird in Ihrem Namen Geld gewaschen! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-betrug-bewerben-sie-sich-nic… ∗∗∗ Defenders beware: A case for post-ransomware investigations ∗∗∗ --------------------------------------------- The Microsoft Detection and Response Team (DART) details a recent ransomware incident in which the attacker used a collection of commodity tools and techniques, such as using living-off-the-land binaries, to launch their malicious code. --------------------------------------------- https://www.microsoft.com/security/blog/2022/10/18/defenders-beware-a-case-… ∗∗∗ Awareness and guidance related to potential Service Fabric Explorer (SFX) v1 web client risk ∗∗∗ --------------------------------------------- Microsoft was recently made aware of a Cross-Site Scripting (XSS) vulnerability (CVE-2022-35829), that under limited circumstances, affects older versions of Service Fabric Explorer (SFX). The current default SFX web client (SFXv2) is not vulnerable to this attack. However, customers can manually switch from the default web client (SFXv2) to an older vulnerable SFX web [...] --------------------------------------------- https://msrc-blog.microsoft.com/2022/10/19/awareness-and-guidance-related-t… ∗∗∗ Are Internet Scanning Services Good or Bad for You?, (Wed, Oct 19th) ∗∗∗ --------------------------------------------- I'm in Luxembourg to attend the first edition of the CTI Summit[1]. There was an interesting keynote performed by Patrice Auffret[2], the founder of Onyphe, about "Ethical Internet Scanning in 2022". They are plenty of online scanners that work 24x7 to build a map of the Internet. They scan the entire IP addresses space and look for interesting devices, vulnerabilities, etc. Big players are Shodan, Onyphe, Censys, ZoomEye, etc. --------------------------------------------- https://isc.sans.edu/diary/rss/29164 ∗∗∗ Fully undetectable Windows backdoor gets detected ∗∗∗ --------------------------------------------- SafeBreach Labs says it has detected a novel fully undetectable (FUD) PowerShell backdoor, which calls into question the accuracy of threat naming. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2022/10/18/fully_undete… ∗∗∗ A New Attack Surface on MS Exchange Part 4 - ProxyRelay! ∗∗∗ --------------------------------------------- Hi, this is a long-time-pending article. We could have published this article earlier (the original bug was reported to MSRC in June 2021 with a 90-days Public Disclosure Policy). However, during communications with MSRC, they explained that since this is an architectural design issue, lots of code changes and testings are expected and required, so they hope to resolve this problem with a one-time CU (Cumulative Update) instead of the regular Patch Tuesday. --------------------------------------------- https://devco.re/blog/2022/10/19/a-new-attack-surface-on-MS-exchange-part-4… ∗∗∗ Warning: "FaceStealer" iOS and Android apps steal your Facebook login ∗∗∗ --------------------------------------------- FaceStealer is back. As a seasoned threat to legitimate app stores, expect it to be gone and then back again. --------------------------------------------- https://www.malwarebytes.com/blog/news/2022/10/warning-facestealer-ios-and-… ∗∗∗ TeamTNT Returns – or Does It? ∗∗∗ --------------------------------------------- Our honeypots caught malicious cryptocurrency miner samples targeting the cloud and containers, and its routines are reminiscent of the routines employed by cybercriminal group TeamTNT, which was said to have quit in November 2021. Our investigation shows that another threat actor group, WatchDog, might be mimicking TeamTNT’s arsenal. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/j/teamtnt-returns-or-does-it.h… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bcel, kernel, node-xmldom, and squid), Mageia (chromium-browser-stable, dhcp, dokuwiki, firefox, golang, python-joblib, sos, and unzip), Oracle (nodejs and nodejs:16), Red Hat (firefox, kernel, kernel-rt, nodejs, nodejs:14, and thunderbird), Scientific Linux (firefox and thunderbird), Slackware (git and mozilla), SUSE (amazon-ssm-agent, caasp-release, cri-o, patchinfo, release-notes-caasp, skuba, enlightenment, libreoffice, netty, nodejs12, nodejs14, [...] --------------------------------------------- https://lwn.net/Articles/911723/ ∗∗∗ Oracle Releases 370 New Security Patches With October 2022 CPU ∗∗∗ --------------------------------------------- Oracle on Tuesday announced the release of 370 patches as part of its quarterly set of security updates. The October 2022 Critical Patch Update (CPU) resolves over 50 critical-severity vulnerabilities. More than 200 of the newly released security patches deal with vulnerabilities that are remotely exploitable without authentication. --------------------------------------------- https://www.securityweek.com/oracle-releases-370-new-security-patches-octob… ∗∗∗ Festo: CPX-CEC-C1 and CPX-CMXX, Missing Authentication for Critical Webpage Function UPDATE A ∗∗∗ --------------------------------------------- UPDATE A (19.10.2022): Added Control block-Set CPX-CEC-C1 and Control block-SETCPX-CMXX to affected products. Unauthenticated access to critical webpage functions (e.g. reboot) may cause a denial of service --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-036/ ∗∗∗ K30425568: Overview of F5 vulnerabilities (October 2022) ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K30425568 ∗∗∗ CVE-2021-3772 Linux Kernel Vulnerability in NetApp DSA E2800 series ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-609377-bt.html ∗∗∗ Multiple Cross Site Scripting vulnerabilities in Bosch VIDEOJET multi 4000 ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-454166-bt.html ∗∗∗ Cisco Identity Services Engine Unauthorized File Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco TelePresence Collaboration Endpoint and RoomOS Software Vulnerabilities ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Meraki MX and Z3 Teleworker Gateway VPN Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: Operations Dashboard is vulnerable to Golang Go vulnerabilities (CVE-2022-27664 and CVE-2022-32190) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-operations-dashboard-is-v… ∗∗∗ Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-qradar-pulse-application-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in Spark affecting IBM QRadar User Behavior Analytics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by vulnerability in Dojo [CVE-2021-23450] ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-manage… ∗∗∗ Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2022-34339, CVE-2021-3712, CVE-2021-3711, CVE-2021-4160, CVE-2021-29425, CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-43138, CVE-2022-24758) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cognos-analytics-has-… ∗∗∗ Security Bulletin: CMIS is affected since it uses Spring Framework, but not vulnerable to [CVE-2022-22965] and [CVE-2022-22963] ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cmis-is-affected-since-it… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator is vulnerable to information disclosure due to JUnit4 (CVE-2020-15250) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2022-23302) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-operations-analytics-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.10.2022
by Daily end-of-shift report 18 Oct '22

18 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Montag 17-10-2022 18:00 − Dienstag 18-10-2022 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ CVE-2022-42889: Keep Calm and Stop Saying "4Shell" ∗∗∗ --------------------------------------------- [...] The vulnerability has been compared to Log4Shell since it is an open-source library-level vulnerability that is likely to impact a wide variety of software applications that use the relevant object. However, initial analysis indicates that this is a bad comparison. The nature of the vulnerability means that unlike Log4Shell, it will be rare that an application uses the vulnerable component of Commons Text to process untrusted, potentially malicious input. In summary, much like with Spring4Shell, there are significant caveats to practical exploitability for CVE-2022-42889. With that said, we still recommend patching any relevant impacted software according to your normal, hair-not-on-fire patch cycle. --------------------------------------------- https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-st… ∗∗∗ Europol: Festgenommene Autodiebe stahlen Fahrzeuge mittels Software ∗∗∗ --------------------------------------------- In Frankreich wurden 31 Mitglieder einer Diebesbande festgenommen, die Autos mit schlüssellosen Zugangssystemen per Software gestohlen haben sollen. --------------------------------------------- https://www.golem.de/news/europol-festgenommene-autodiebe-stahlen-fahrzeuge… ∗∗∗ Sicherheit: Antivirensoftware blockiert Thunderbird-Updates ∗∗∗ --------------------------------------------- Statt für Sicherheit zu sorgen, blockieren Avast und AVG Thunderbird-Updates. Das soll bereits seit dreieinhalb Monaten der Fall sein. --------------------------------------------- https://www.golem.de/news/sicherheit-antivirensoftware-blockiert-thunderbir… ∗∗∗ Fake-Shop Alarm: Vorsicht vor betrügerischen Solar- und Photovoltaik-Shops ∗∗∗ --------------------------------------------- Shops wie elektrox-solar.at und horizon-shot.com täuschen mit professionellem Design und gestohlenen Impressumsdaten. Lassen Sie sich von diesen Fake-Shops nicht in die Falle locken! So erkennen Sie Fake-Solar-Shops online. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shop-alarm-vorsicht-vor-betrueg… ∗∗∗ Das Salz in der Suppe: Salts als unverzichtbare Zutat bei der Passwortspeicherung für Applikationen ∗∗∗ --------------------------------------------- Die Verwendung eines Salt bei der Passwortspeicherung verhindert die Vorberechnung des Hash. Als zusätzliches Geheimnis kann ein Pepper verwendet werden. --------------------------------------------- https://www.syss.de/pentest-blog/das-salz-in-der-suppe-salts-als-unverzicht… ∗∗∗ WordPress 6.0.3 erschienen ∗∗∗ --------------------------------------------- Gerade habe ich die Meldung erhalten, dass ein Wartungsupdate auf WordPress 6.0.3 erschienen ist. Dieses Update schließt einige Sicherheitslücken, die hier beschrieben sind. --------------------------------------------- https://www.borncity.com/blog/2022/10/18/wordpress-6-0-3-erschienen/ ∗∗∗ FLEXlm and Citrix ADM Denial of Service Vulnerability ∗∗∗ --------------------------------------------- On June 27, 2022, Citrix released an advisory for CVE-2022-27511 and CVE-2022-27512, which affect Citrix ADM (Application Delivery Management). Rapid7 investigated these issues to better understand their impact, and found that the patch is not sufficient to prevent exploitation. We also determined that the worst outcome of this vulnerability is a denial of service - the licensing server can be told to shut down (even with the patch). --------------------------------------------- https://www.rapid7.com/blog/post/2022/10/18/flexlm-and-citrix-adm-denial-of… ∗∗∗ Python Obfuscation for Dummies, (Tue, Oct 18th) ∗∗∗ --------------------------------------------- Recently, I found several malicious Python scripts that looked the same. They all contained the same strings at the end: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/29160 ∗∗∗ I’m in your hypervisor, collecting your evidence ∗∗∗ --------------------------------------------- Data acquisition during incident response engagements is always a big exercise, both for us and our clients. It’s rarely smooth sailing, and we usually encounter a hiccup or two. Fox-IT’s approach to enterprise scale incident response for the past few years has been to collect small forensic artefact packages using our internal data collection utility, “acquire”, usually deployed using the clients’ preferred method of software deployment. While this method works fine in most cases, we often encounter scenarios where deploying our software is tricky or downright impossible. --------------------------------------------- https://blog.fox-it.com/2022/10/18/im-in-your-hypervisor-collecting-your-ev… ∗∗∗ Zoom for macOS Contains High-Risk Security Flaw ∗∗∗ --------------------------------------------- Video messaging technology powerhouse Zoom has rolled out a high-priority patch for macOS users alongside a warning that hackers could abuse the software flaw to connect to and control Zoom Apps. --------------------------------------------- https://www.securityweek.com/zoom-macos-contains-high-risk-security-flaw ∗∗∗ Dutch Police obtain 155 decryption keys for Deadbolt ransomware victims ∗∗∗ --------------------------------------------- Police in the Netherlands said they were able to trick the group behind the Deadbolt ransomware to hand over the decryption keys for 155 victims during a police operation announced last week. In a statement, the Dutch National Police said on Friday that they conducted a targeted operation where they effectively paid a ransom in [...] --------------------------------------------- https://therecord.media/dutch-police-obtain-155-decryption-keys-for-deadbol… ∗∗∗ Alchimist: A new attack framework in Chinese for Mac, Linux and Windows ∗∗∗ --------------------------------------------- Cisco Talos discovered a new attack framework including a command and control (C2) tool called "Alchimist" and a new malware "Insekt" with remote administration capabilities. The Alchimist has a web interface in Simplified Chinese with remote administration features. The attack framework is designed to target Windows, Linux and Mac machines. --------------------------------------------- http://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html ∗∗∗ Software Patch Management Policy Best Practices ∗∗∗ --------------------------------------------- Explore the top risk-based patch management policy best practices to mitigate the growing threat of vulnerability exploits in your organization. --------------------------------------------- https://www.trendmicro.com/en_us/ciso/22/j/software-patch-management-policy… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical RCE Vulnerability Discovered in Popular Cobalt Strike Hacking Software ∗∗∗ --------------------------------------------- HelpSystems, the company behind the Cobalt Strike software platform, has released an out-of-band security update to address a remote code execution vulnerability that could allow an attacker to take control of targeted systems. --------------------------------------------- https://thehackernews.com/2022/10/critical-rce-vulnerability-discovered.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glibc and libksba), Fedora (dhcp and kernel), Red Hat (.NET 6.0, .NET Core 3.1, compat-expat1, kpatch-patch, and nodejs:16), Slackware (xorg), SUSE (exiv2, expat, kernel, libreoffice, python, python-numpy, squid, and virtualbox), and Ubuntu (linux-azure and zlib). --------------------------------------------- https://lwn.net/Articles/911562/ ∗∗∗ Advantech R-SeeNet ∗∗∗ --------------------------------------------- Successful exploitation of these vulnerabilities could result in an unauthorized attacker remotely deleting files on the system or allowing remote code execution. --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-291-01 ∗∗∗ Security Bulletin: IBM WebSphere Application Server is vulnerable to SOAPAction spoofing (CVE-2022-38712) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-application… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to denial of service due to XStream (CVE-2021-43859) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Spring Framework (CVE-2021-22060) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable to remove traversal due to Apache Commons IO (CVE-2021-29425) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-qradar-pulse-application-… ∗∗∗ Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-qradar-analy… ∗∗∗ Security Bulletin: Information disclosure vulnerability affect IBM Business Automation Workflow – CVE-2022-35279 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-information-disclosure-vu… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator vulnerable due to Eclipse Jetty ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.10.2022
by Daily end-of-shift report 17 Oct '22

17 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 14-10-2022 18:00 − Montag 17-10-2022 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Prestige: Microsoft findet neue Ransomware in Polen und Ukraine ∗∗∗ --------------------------------------------- Das Sicherheitsteam von Microsoft hat eine komplett neue Ransomware-Kampagne gegen den Logistik- und Transportsektor in der Ukraine und Polen entdeckt. --------------------------------------------- https://www.golem.de/news/prestige-microsoft-findet-neue-ransomware-in-pole… ∗∗∗ Office 365: Microsofts E-Mail-Verschlüsselung ist unsicher ∗∗∗ --------------------------------------------- Die E-Mail-Verschlüsselung von Microsoft 365 setzt auf AES in einem unsicheren Modus. Dadurch können Rückschlüsse auf die Inhalte gezogen werden. --------------------------------------------- https://www.golem.de/news/office-365-microsofts-e-mail-verschluesselung-ist… ∗∗∗ Schwachstelle im Linux-Kernel ermöglicht Codeschmuggel via WLAN ∗∗∗ --------------------------------------------- Ein IT-Sicherheitsforscher hat Schwachstellen im Linux-Kernel gefunden. Angreifer könnten durch manipulierte WLAN-Pakete beliebigen Code einschleusen. --------------------------------------------- https://heise.de/-7309762 ∗∗∗ Support-Ende für VMware ESXi 6.5 und 6.7 - noch viele Alt-Systeme aktiv ∗∗∗ --------------------------------------------- Am 15. Oktober hat VMware den Support für VMware ESXi 6.5 und 6.7 eingestellt. Aktuellen Zahlen zufolge sind noch viele veraltete Systeme im Einsatz. --------------------------------------------- https://heise.de/-7310412 ∗∗∗ Neue Ransomware-Gang „Ransom Cartel“ ∗∗∗ --------------------------------------------- Der IT-Sicherheitsanbieter Palo Alto Networks und dessen Malware-Analyseteam Unit42 haben Erkenntnisse zu „Ransom Cartel“ gewonnen. Es handelt sich um eine Ransomware as a Service (RaaS)-Anbieter, der Mitte Dezember 2021 erstmals aufgetaucht ist. --------------------------------------------- https://www.zdnet.de/88404159/neue-ransomware-gang-ransom-cartel/ ∗∗∗ Microsoft bestätigt: Windows patzt bei der Erkennung gefährlicher Treiber – Blocklisten nicht verteilt ∗∗∗ --------------------------------------------- Eigentlich sollte Windows bekannte, bösartige Treiber beim Laden blockieren, so dass diese keinen Schaden anrichten können. Zumindest hat Microsoft dies seit Jahren behauptet. Nun hat Microsoft unter der Hand zugegeben, dass man dort gepatzt hat. --------------------------------------------- https://www.borncity.com/blog/2022/10/17/microsoft-besttigt-windows-patzt-b… ∗∗∗ Unseriöse Werbung auf Pinterest ∗∗∗ --------------------------------------------- Wie in jedem Sozialen Netzwerk gibt es auch auf Pinterest Werbung. In letzter Zeit vermehrt von unseriösen Online-Shops für Haar-Styling-Geräte und Shaping-Hosen. Die Produkte von zevoon.de, valurabeauty.de oder lusto.de wirken zwar vielversprechend, erfahrungsgemäß werden Sie aber enttäuscht und erhalten minderwertigen Schrott aus China. Wir zeigen Ihnen, bei welchen Shops Sie lieber nicht bestellen sollten. --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-werbung-auf-pinterest/ ∗∗∗ New PHP information-stealing malware targets Facebook accounts ∗∗∗ --------------------------------------------- Threat analysts have spotted a new Ducktail campaign using a new infostealer variant and novel TTPs (tactics, techniques, and procedures), while the Facebook users it targets are no longer limited to holders of business accounts. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-php-information-stealing… ∗∗∗ Black Basta Ransomware Hackers Infiltrates Networks via Qakbot to Deploy Brute Ratel C4 ∗∗∗ --------------------------------------------- The threat actors behind the Black Basta ransomware family have been observed using the Qakbot trojan to deploy the Brute Ratel C4 framework as a second-stage payload in recent attacks. The development marks the first time the nascent adversary simulation software is being delivered via a Qakbot infection, cybersecurity firm Trend Micro said in a technical analysis released last week. --------------------------------------------- https://thehackernews.com/2022/10/black-basta-ransomware-hackers.html ∗∗∗ Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis ∗∗∗ --------------------------------------------- On September 2, 2022, Zscaler Threatlabz captured an in-the-wild 0-day exploit in the Windows Common Log File System Driver (CLFS.sys) and reported this discovery to Microsoft. In the September Tuesday patch, Microsoft fixed this vulnerability that was identified as CVE-2022-37969, which is a Windows Common Log File System Driver elevation of privilege vulnerability. An attacker who successfully exploits this vulnerability may gain SYSTEM privileges. --------------------------------------------- https://www.zscaler.com/blogs/security-research/technical-analysis-windows-… ∗∗∗ Free Micropatches For Bypassing "Mark of the Web" on Unzipped Files (0day) ∗∗∗ --------------------------------------------- In May, security researcher Will Dormann found a vulnerability in Windows that allows an attacker to prevent Windows from setting the "Mark of the Web" flag on files extracted from a ZIP archive, even if the ZIP archive came from an untrusted source such as Internet, email, or a USB key. Mark of the Web (MOTW) is an important security mechanism in Windows: Windows will show a security warning before launching an executable file with MOTW; --------------------------------------------- https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-mark-of.html ∗∗∗ New Black Lotus UEFI Rootkit Provides APT-Level Capabilities to Cybercriminals ∗∗∗ --------------------------------------------- A threat actor is promoting on underground criminal forums a vendor-independent UEFI rootkit that can disable security software and controls, cybersecurity veteran Scott Scheferman warns. --------------------------------------------- https://www.securityweek.com/new-black-lotus-uefi-rootkit-provides-apt-leve… ∗∗∗ Detecting Emerging Network Threats From Newly Observed Domains ∗∗∗ --------------------------------------------- We discuss how to discover potential threats among newly observed domains at the time they begin to carry attack traffic. --------------------------------------------- https://unit42.paloaltonetworks.com/malicious-newly-observed-domains/ ∗∗∗ CISA Releases RedEye: Red Team Campaign Visualization and Reporting Tool ∗∗∗ --------------------------------------------- CISA has released RedEye, an interactive open-source analytic tool to visualize and report Red Team command and control activities. RedEye allows an operator to quickly assess complex data, evaluate mitigation strategies, and enable effective decision making. --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/10/14/cisa-releases-red… ∗∗∗ Stories from the SOC: Feeling so foolish – SocGholish drive by compromise ∗∗∗ --------------------------------------------- SocGholish, also known as FakeUpdate, is a JavaScript framework leveraged in social engineering drive by compromises that has been a thorn in cybersecurity professionals’ and organizations’ sides for at least 5 years now. Upon visiting a compromised website, users are redirected to a page for a browser update and a zip archive file containing a malicious JavaScript file is downloaded and unfortunately often opened and executed by the fooled end user. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/stories-from-the-so… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-10-14 ∗∗∗ --------------------------------------------- IBM InfoSphere Information Server, IBM Sterling B2B Integrator, IBM Sterling Connect:Direct for HP NonStop, IBM Sterling File Gateway --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ MiniDVBLinux 5.4 Multiple Vulnerabilities ∗∗∗ --------------------------------------------- Arbitrary File Read Vulnerability, Remote Root Command Execution Vulnerability, Remote Root Command Injection Vulnerability, Unauthenticated Stream Disclosure Vulnerability, Change Root Password PoC, Simple VideoDiskRecorder Protocol SVDRP (svdrpsend.sh) Exploit, Config Download Exploit --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ ∗∗∗ CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults ∗∗∗ --------------------------------------------- Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with [...] --------------------------------------------- https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (kernel, linux-hardened, linux-lts, and linux-zen), Debian (python-django), Fedora (apptainer, kernel, python3.6, and vim), Gentoo (assimp, deluge, libvirt, libxml2, openssl, rust, tcpreplay, virglrenderer, and wireshark), Slackware (zlib), SUSE (chromium, python3, qemu, roundcubemail, and seamonkey), and Ubuntu (linux-aws-5.4 and linux-ibm). --------------------------------------------- https://lwn.net/Articles/911461/ ∗∗∗ WAGO: Multiple products - Loss of MAC-Address-Filtering after reboot ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-042/ ∗∗∗ WAGO: Multiple Vulnerabilities in Controller with WAGO I/O-Pro / CODESYS 2.3 Runtime ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-040/ ∗∗∗ TRUMPF TruTops prone to improper access control ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2022-023/ ∗∗∗ Gitea: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1742 ∗∗∗ Linux Kernel: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1741 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily October 2022