=====================
= End-of-Day report =
=====================
Timeframe: Dienstag 02-01-2024 18:00 − Mittwoch 03-01-2024 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ Leaksmas: Auch Cyberkriminelle haben sich zu Weihnachten beschenkt ∗∗∗
---------------------------------------------
Rund um Weihnachten wurden im Darknet mehr als 50 Millionen neue Datensätze aus verschiedenen Quellen veröffentlicht. Der Zeitpunkt war kein Zufall. Cyberkriminelle haben die Weihnachtszeit offenbar genutzt, um sich gegenseitig mit umfangreichen und von verschiedenen Unternehmen und Behörden erbeuteten Datensätzen zu beschenken.
---------------------------------------------
https://www.golem.de/news/leaksmas-auch-cyberkriminelle-haben-sich-zu-weihn…
∗∗∗ Google-Konten in Gefahr: Exploit erlaubt böswilligen Zugriff trotz Passwort-Reset ∗∗∗
---------------------------------------------
Durch eine Schwachstelle in einem OAuth-Endpunkt können sich Cyberkriminelle dauerhaft Zugriff auf das Google-Konto einer Zielperson verschaffen. [..] Eine offizielle Stellungnahme zum Missbrauch des Multilogin-Endpunkts gibt es seitens Google wohl noch nicht. Dass dem Unternehmen das Problem bekannt ist, ist angesichts der Abhilfemaßnahmen aber anzunehmen.
---------------------------------------------
https://www.golem.de/news/google-konten-in-gefahr-exploit-erlaubt-boeswilli…
∗∗∗ Interesting large and small malspam attachments from 2023, (Wed, Jan 3rd) ∗∗∗
---------------------------------------------
At the end of a year, or at the beginning of a new one, I like to go over all malicious attachments that were caught in my e-mail trap over the last 12 months, since this can provide a good overview of long-term malspam trends and may sometimes lead to other interesting discoveries.
---------------------------------------------
https://isc.sans.edu/diary/rss/30524
∗∗∗ Don’t trust links with known domains: BMW affected by redirect vulnerability ∗∗∗
---------------------------------------------
Cybernews researchers have discovered two BMW subdomains that were vulnerable to SAP redirect vulnerability. They were used to access the internal workplace systems for BMW dealers and could have been useful to attackers for spear-phishing campaigns or malware distribution. [..] Cybernews researchers immediately disclosed the vulnerability to BMW, and it was promptly fixed.
---------------------------------------------
https://securityaffairs.com/156843/reports/bmw-affected-by-redirect-vulnera…
∗∗∗ How to Stop a DDoS Attack in 5 Steps ∗∗∗
---------------------------------------------
In this post, we’ll cover some essential fundamentals on how to stop a DDoS attack and prevent them from happening in the future.
---------------------------------------------
https://blog.sucuri.net/2024/01/how-to-stop-a-ddos-attack.html
∗∗∗ Nehmen Sie keine unerwarteten Nachnahme-Sendungen an! ∗∗∗
---------------------------------------------
Aktuell erreichen uns gehäuft Meldungen zu unerwarteten Paketzustellungen, welche bei der Annahme per Nachnahme zu bezahlen sind. Nach einer Übernahme stellt sich häufig heraus, dass der Inhalt wertlos ist, beziehungsweise die Ware nie bestellt wurde. Achtung: Nehmen Sie Nachnahmesendungen nur an, wenn Sie ein entsprechendes Paket erwarten und den Absender kennen. Eine Rückerstattung über die Post ist im Problemfall nämlich nicht mehr möglich!
---------------------------------------------
https://www.watchlist-internet.at/news/nehmen-sie-keine-unerwarteten-nachna…
∗∗∗ Decoding ethical hacking: A comprehensive exploration of white hat practices ∗∗∗
---------------------------------------------
In summation, ethical hacking emerges as a linchpin in fortifying cybersecurity defenses. Adopting a proactive approach, ethical hackers play a pivotal role in identifying vulnerabilities, assessing risks, and ensuring that organizations exhibit resilience in the face of evolving cyber threats.
---------------------------------------------
https://cybersecurity.att.com/blogs/security-essentials/decoding-ethical-ha…
=====================
= Vulnerabilities =
=====================
∗∗∗ Security updates for Wednesday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (kernel), Fedora (slurm), Oracle (kernel and postgresql:15), Red Hat (firefox, gstreamer1-plugins-bad-free, thunderbird, tigervnc, and xorg-x11-server), SUSE (polkit, postfix, putty, w3m, and webkit2gtk3), and Ubuntu (nodejs).
---------------------------------------------
https://lwn.net/Articles/956694/
∗∗∗ WordPress MyCalendar Plugin — Unauthenticated SQL Injection(CVE-2023–6360) ∗∗∗
---------------------------------------------
WordPress Core is the most popular web Content Management System (CMS). This free and open-source CMS written in PHP allows developers to develop web applications quickly by allowing customization through plugins and themes. In this article, we will analyze an unauthenticated sql injection vulnerability found in the MyCalendar plugin.
---------------------------------------------
https://medium.com/tenable-techblog/wordpress-mycalendar-plugin-unauthentic…
∗∗∗ IBM Security Bulletins ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/bulletin/
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily
=====================
= End-of-Day report =
=====================
Timeframe: Freitag 29-12-2023 18:00 − Dienstag 02-01-2024 18:00
Handler: Thomas Pribitzer
Co-Handler: Michael Schlagenhaufer
=====================
= News =
=====================
∗∗∗ CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK ∗∗∗
---------------------------------------------
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign orchestrated by the Russia-linked APT28 group to deploy previously undocumented malware such as OCEANMAP, MASEPIE, and STEELHOOK to harvest sensitive information.
---------------------------------------------
https://thehackernews.com/2023/12/cert-ua-uncovers-new-malware-wave.html
∗∗∗ Neue Lücke in altem E-Mail-Protokoll: SMTP smuggling ∗∗∗
---------------------------------------------
Sicherheitsforscher haben eine Schwäche im Simple Mail Transfer Protocol (SMTP) entdeckt. Sie hebt das Fälschen des Absenders auf ein neues Niveau.
---------------------------------------------
https://www.heise.de/-9584467
∗∗∗ Ransomware: Fehler in Black-Basta-Programmierung ermöglicht Entschlüsselungstool ∗∗∗
---------------------------------------------
Unter bestimmten Bedingungen kann das kostenlose Entschlüsselungstool Black Basta Buster Opfern des Erpressungstrojaners Black Basta helfen.
---------------------------------------------
https://www.heise.de/-9584846
∗∗∗ New DLL Search Order Hijacking Technique Targets WinSxS Folder ∗∗∗
---------------------------------------------
Attackers can abuse a new DLL search order hijacking technique to execute code in applications within the WinSxS folder.
---------------------------------------------
https://www.securityweek.com/new-dll-search-order-hijacking-technique-targe…
∗∗∗ Domain (in)security: the state of DMARC ∗∗∗
---------------------------------------------
This blog discusses the state of DMARC, the role that DMARC plays in email authentication, and why it should be a key component of your email security solution.
---------------------------------------------
https://www.bitsight.com/blog/domain-insecurity-state-dmarc
=====================
= Vulnerabilities =
=====================
∗∗∗ Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise ∗∗∗
---------------------------------------------
In this post I describe the 18 vulnerabilities that I discovered in PandoraFMS Enterprise v7.0NG.767 available at https://pandorafms.com. PandoraFMS is an enterprise scale network monitoring and management application which provides systems administrators with a central ‘hub’ to monitor and manipulate the state of computers (agents) deployed across the network.
---------------------------------------------
https://research.nccgroup.com/2024/01/02/technical-advisory-multiple-vulner…
∗∗∗ Security updates for Monday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (ansible, asterisk, cjson, firefox-esr, kernel, libde265, libreoffice, libspreadsheet-parseexcel-perl, php-guzzlehttp-psr7, thunderbird, tinyxml, and xerces-c), Fedora (podman-tui, proftpd, python-asyncssh, squid, and xerces-c), Mageia (libssh and proftpd), and SUSE (deepin-compressor, gnutls, gstreamer, libreoffice, opera, proftpd, and python-pip).
---------------------------------------------
https://lwn.net/Articles/956521/
∗∗∗ Security updates for Tuesday ∗∗∗
---------------------------------------------
Security updates have been issued by Gentoo (Joblib), Red Hat (firefox and thunderbird), SUSE (gstreamer-plugins-bad, libssh2_org, and webkit2gtk3), and Ubuntu (firefox and thunderbird).
---------------------------------------------
https://lwn.net/Articles/956568/
∗∗∗ Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server. ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7103673
∗∗∗ Multiple vulnerabilities affect IBM Storage Scale Hadoop Connector ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7104389
∗∗∗ IBM Maximo Application Suite uses axios-0.25.0.tgz which is vulnerable to CVE-2023-45857 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7104391
∗∗∗ IBM Maximo Application Suite uses WebSphere Liberty which is vulnerable to CVE-2023-46158, CVE-2023-44483 and CVE-2023-44487 ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7104390
∗∗∗ Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022) ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7104401
∗∗∗ Multiple vulnerabilities in Golang Go affect Cloud Pak System ∗∗∗
---------------------------------------------
https://www.ibm.com/support/pages/node/7037900
--
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily