Daily May 2024

daily@lists.cert.at

1 participants
19 discussions

Tageszusammenfassung - 15.05.2024
by Daily end-of-shift report 15 May '24

15 May '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-05-2024 18:00 − Mittwoch 15-05-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ PoC exploit released for RCE zero-day in D-Link EXO AX4800 routers ∗∗∗ --------------------------------------------- The D-Link EXO AX4800 (DIR-X4860) router is vulnerable to remote unauthenticated command execution that could lead to complete device takeovers by attackers with access to the HNAP port. --------------------------------------------- https://www.bleepingcomputer.com/news/security/poc-exploit-released-for-rce… ∗∗∗ Weitere Schwachstelle entdeckt: Hacker startet erneut Cyberangriff auf Dell ∗∗∗ --------------------------------------------- Die bereits abgegriffenen 49 Millionen Kundendatensätze sind ihm offenbar nicht genug. Menelik greift Dell erneut an. Dieses Mal sind wohl Support-Daten betroffen. --------------------------------------------- https://www.golem.de/news/weitere-schwachstelle-entdeckt-hacker-startet-ern… ∗∗∗ Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain ∗∗∗ --------------------------------------------- One of the most advanced server-side malware campaigns is still growing, with hundreds of thousands of compromised servers, and it has diversified to include credit card and cryptocurrency theft. --------------------------------------------- https://www.welivesecurity.com/en/eset-research/ebury-alive-unseen-400k-lin… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (sssd and tcpdump), Red Hat (.NET 7.0, .NET 8.0, expat, kernel, and kernel-rt), Slackware (mozilla), SUSE (kernel, postgresql15, postgresql16, python-arcomplete, python-Fabric, python-PyGithub, python- antlr4-python3-runtime, python-avro, python-chardet, python-distro, python- docker, python-fakeredis, python-fixedint, pyth, and python3), and Ubuntu (linux-bluefield). --------------------------------------------- https://lwn.net/Articles/973746/ ∗∗∗ ICS Patch Tuesday: Advisories Published by Siemens, Rockwell, Mitsubishi Electric ∗∗∗ --------------------------------------------- Several ICS vendors released advisories on Tuesday to inform customers about vulnerabilities found in their products. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-advisories-published-by-siem… ∗∗∗ Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities ∗∗∗ --------------------------------------------- Intel has published 41 new May 2024 Patch Tuesday advisories covering a total of more than 90 vulnerabilities. [..] The most important flaw, based on its severity rating of ‘critical’ and a CVSS score of 10, is CVE-2024-22476. [..] Intel says this critical vulnerability could allow an unauthenticated attacker to “enable escalation of privilege via remote access”. --------------------------------------------- https://www.securityweek.com/intel-publishes-41-security-advisories-for-ove… ∗∗∗ LibreOffice: Falscher Klick kann zur Ausführung von Schadcode führen ∗∗∗ --------------------------------------------- Eine Sicherheitslücke im quelloffenen LibreOffice ermöglicht Angreifern, Opfern Schadcode unterzujubeln. Die müssen nur einmal klicken. --------------------------------------------- https://heise.de/-9719334 ∗∗∗ VMware Workstation und Fusion: Ausbruch aus Gastsystem möglich ∗∗∗ --------------------------------------------- In VMware Workstation und Fusion klaffen Sicherheitslücken, die beim Pwn2Own-Wettbewerb missbraucht wurden. Sie ermöglichen den Ausbruch aus dem Gastsystem. --------------------------------------------- https://heise.de/-9718624 ∗∗∗ Patchday: Angreifer attackieren Windows und verschaffen sich Systemrechte ∗∗∗ --------------------------------------------- Microsoft hat wichtige Sicherheitsupdates für unter anderem Edge, Dynamics 365 und Windows veröffentlicht. Es gibt bereits Attacken. --------------------------------------------- https://heise.de/-9718608 ∗∗∗ Patchday: Angreifer können Schadcode durch Lücken in Adobe-Software schieben ∗∗∗ --------------------------------------------- Der Softwarehersteller Adobe hat unter anderem Animate, Illustrator und Reader vor möglichen Attacken abgesichert. --------------------------------------------- https://heise.de/-9718639 ∗∗∗ Fortiguard Security Advisories ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt ∗∗∗ Lenovo Security Advisories ∗∗∗ --------------------------------------------- https://support.lenovo.com/at/en/product_security/home ∗∗∗ 30,000 WordPress Sites affected by Arbitrary SQL Execution Vulnerability Patched in Visualizer WordPress Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/05/30000-wordpress-sites-affected-by-ar… ∗∗∗ Bosch: Remote code execution vulnerability has been found over an insecure connection in the Praesensa Logging Application, Praesideo Logging Application and Praesideo PC Call Station ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-106054-bt.html ∗∗∗ B&R: 2024-05-14: Cyber Security Advisory - Insecure Loading of Code in B&R Products ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA24P005_Insecure_Loading_of_Code-c… ∗∗∗ SUBNET PowerSYSTEM Center ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-02 ∗∗∗ F5: K000139592 : libxml2 vulnerability CVE-2023-29469 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000139592 ∗∗∗ ZDI-24-456: NI FlexLogger FLXPROJ File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-456/ ∗∗∗ ZDI-24-455: SolarWinds Access Rights Manager JsonSerializationBinder Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-455/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.05.2024
by Daily end-of-shift report 14 May '24

14 May '24

===================== = End-of-Day report = ===================== Timeframe: Montag 13-05-2024 18:00 − Dienstag 14-05-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ PyPi package backdoors Macs using the Sliver pen-testing suite ∗∗∗ --------------------------------------------- A new package mimicked the popular requests library on the Python Package Index (PyPI) to target macOS devices with the Sliver C2 adversary framework, used for gaining initial access to corporate .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/pypi-package-backdoors-macs-… ∗∗∗ Apple and Google add alerts for unknown Bluetooth trackers to iOS, Android ∗∗∗ --------------------------------------------- On Monday, Apple and Google jointly announced a new privacy feature that warns Android and iOS users when an unknown Bluetooth tracking device travels with .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/apple-and-google-add-alerts-… ∗∗∗ Incident response analyst report 2023 ∗∗∗ --------------------------------------------- The report shares statistics and observations from incident response practice in 2023, analyzes trends and gives cybersecurity recommendations. --------------------------------------------- https://securelist.com/kaspersky-incident-response-report-2023/112504/ ∗∗∗ Apple Patches Everything: macOS, iOS, iPadOS, watchOS, tvOS updated., (Tue, May 14th) ∗∗∗ --------------------------------------------- Apple today released updates for its various operating systems. The updates cover iOS, iPadOS, macOS, watchOS and tvOS. A standalone update for Safari was released for older versions of macOS. One already exploited vulnerability, CVE-2024-23296 is patched for older versions of macOS and iOS. In March, Apple patched this vulnerability for more recent versions of iOS and macOS. --------------------------------------------- https://isc.sans.edu/diary/rss/30916 ∗∗∗ Ongoing Campaign Bombarded Enterprises with Spam Emails and Phone Calls ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered an ongoing social engineering campaign that bombards enterprises with spam emails with the goal of obtaining initial access to their environments for follow-on exploitation. --------------------------------------------- https://thehackernews.com/2024/05/ongoing-campaign-bombarded-enterprises.ht… ∗∗∗ Critical Flaws in Cacti Framework Could Let Attackers Execute Malicious Code ∗∗∗ --------------------------------------------- The maintainers of the Cacti open-source network monitoring and fault management framework have addressed a dozen security flaws, including two critical issues that could lead to the execution of arbitrary code.The most severe of the vulnerabilities are listed below -CVE-2024-25641 (CVSS score: 9.1) - An arbitrary file write vulnerability in the "Package Import" feature that --------------------------------------------- https://thehackernews.com/2024/05/critical-flaws-in-cacti-framework-could.h… ∗∗∗ Log4J shows no sign of fading, spotted in 30% of CVE exploits ∗∗∗ --------------------------------------------- Organizations continue to run insecure protocols across their wide access networks (WAN), making it easier for cybercriminals to move across networks, according to a Cato Networks survey. Enterprises are too trusting within their networks The Cato CTRL SASE Threat Report Q1 2024 provides insight into the security threats and their .. --------------------------------------------- https://www.helpnetsecurity.com/2024/05/14/log4j-wan-insecure-protocols/ ∗∗∗ Google Patches Second Chrome Zero-Day in One Week ∗∗∗ --------------------------------------------- Google has announced patches for another Chrome vulnerability that has been exploited in attacks. This is the second zero-day addressed by the company in one week and the third flaw leveraged in malicious attacks in 2024. The new zero-day, tracked as CVE-2024-4761, has been described as a high-severity out-of-bounds write issue .. --------------------------------------------- https://www.securityweek.com/google-patches-second-chrome-zero-day-in-one-w… ∗∗∗ Falsche Gewinnbenachrichtigungen in echten Gewinnspielen ∗∗∗ --------------------------------------------- An einem Facebook-Gewinnspiel teilgenommen? Vorsicht, Kriminelle nutzen echte Gewinnspiele für Betrugsmaschen. Mit Fake-Profilen kommentieren sie die Kommentare der Teilnehmer:innen und behaupten, sie hätten gewonnen. Mit einem Link locken sie auf eine betrügerische Webseite. Wir zeigen Ihnen, wie Sie sicher an Gewinnspielen teilnehmen! --------------------------------------------- https://www.watchlist-internet.at/news/falsche-gewinnbenachrichtigungen-in-… ∗∗∗ Foxit PDF Reader “Flawed Design” : Hidden Dangers Lurking in Common Tools ∗∗∗ --------------------------------------------- Heightened vulnerability: Check Point Research has identified an unusual pattern of behavior involving PDF exploitation, mainly targeting users of Foxit PDF Reader. This exploit triggers security warnings that could deceive unsuspecting users into executing harmful commands, exploiting human psychology to manipulate users into accidentally providing .. --------------------------------------------- https://blog.checkpoint.com/research/foxit-pdf-reader-flawed-design-hidden-… ∗∗∗ Guidance for organisations considering payment in ransomware incidents ∗∗∗ --------------------------------------------- Advice for organisations experiencing a ransomware attack and the partner organisations supporting them. --------------------------------------------- https://www.ncsc.gov.uk/guidance/organisations-considering-payment-in-ranso… ∗∗∗ Avast Q1/2024 Threat Report ∗∗∗ --------------------------------------------- Nearly 90% of Threats Blocked are Social Engineering, Revealing a Huge Surge of Scams, and Discovery of the Lazarus APT CampaignThe post Avast Q1/2024 Threat Report appeared first on Avast Threat Labs. --------------------------------------------- https://decoded.avast.io/threatresearch/avast-q1-2024-threat-report/ ===================== = Vulnerabilities = ===================== ∗∗∗ TYPO3-CORE-SA-2024-010: Uncontrolled Resource Consumption in ShowImageController ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2024-010 ∗∗∗ TYPO3-CORE-SA-2024-009: Cross-Site Scripting in ShowImageController ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2024-009 ∗∗∗ TYPO3-CORE-SA-2024-008: Cross-Site Scripting in Form Manager Module ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2024-008 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/973667/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.11 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-22/ ∗∗∗ Security Vulnerabilities fixed in Firefox 126 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.05.2024
by Daily end-of-shift report 13 May '24

13 May '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-05-2024 18:00 − Montag 13-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ GoTo Meeting loads Remcos RAT via Rust Shellcode Loader ∗∗∗ --------------------------------------------- Legitimate applications can unwittingly become conduits for malware execution. This is also the case for recent malware loaders which abuse GoTo Meeting, an online meeting software, to deploy Remcos RAT. --------------------------------------------- https://www.gdatasoftware.com/blog/2024/05/37906-gotomeeting-loads-remcos ∗∗∗ API missbraucht: Hacker teilt Details zum Cyberangriff auf Dell ∗∗∗ --------------------------------------------- Ein Cyberkrimineller hat rund 49 Millionen Kundendatensätze von Dell abgegriffen. Möglich gewesen ist ihm dies über eine unzureichend geschützte API eines Partnerportals. --------------------------------------------- https://www.golem.de/news/api-missbraucht-hacker-teilt-details-zum-cyberang… ∗∗∗ FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT ∗∗∗ --------------------------------------------- The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. --------------------------------------------- https://thehackernews.com/2024/05/fin7-hacker-group-leverages-malicious.html ∗∗∗ Vorsicht vor falschen Anrufen von PayPal oder Amazon ∗∗∗ --------------------------------------------- Derzeit werden uns vermehrt Anrufe im Namen von PayPal und Amazon gemeldet. Die Kriminellen geben vor, ein Problem mit Ihrem Konto zu haben und bieten Ihnen telefonische Hilfe an. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-falschen-anrufen-von-pa… ∗∗∗ Leveraging DNS Tunneling for Tracking and Scanning ∗∗∗ --------------------------------------------- We provide a walkthrough of how attackers leverage DNS tunneling for tracking and scanning, an expansion of the way this technique is usually exploited. --------------------------------------------- https://unit42.paloaltonetworks.com/three-dns-tunneling-campaigns/ ∗∗∗ Side-by-Side with HelloJackHunter: Unveiling the Mysteries of WinSxS ∗∗∗ --------------------------------------------- This post explores Windows Side-by-Side (WinSxS) and DLL hijacking, deep-diving some tooling Ive written and some of the fun along the way. --------------------------------------------- https://blog.zsec.uk/hellojackhunter-exploring-winsxs/ ∗∗∗ Not all scams are easy to spot ∗∗∗ --------------------------------------------- Even the most intelligent individuals can fall victim to scams due to coincidental timing and convincing tactics, so staying skeptical, verifying communications and using anti-scam tools is key to reducing the risk. --------------------------------------------- https://www.emsisoft.com/en/blog/45650/not-all-scams-are-easy-to-spot/ ∗∗∗ Europol sperrt eigenes Forum nach erfolgreichem Einbruch ∗∗∗ --------------------------------------------- Die europäische Polizeibehörde hat ihren Dienst "Europol for Experts" vom Netz genommen. Zuvor waren unter anderem Strategiepapiere daraus angeboten worden. --------------------------------------------- https://heise.de/-9715410 ∗∗∗ Ransomware Black Basta zählt nach zwei Jahren weltweit über 500 Opfer ∗∗∗ --------------------------------------------- Das FBI teilt wichtige Fakten im Kampf gegen den Erpressungstrojaner Black Basta. Die Ransomware macht auch vor kritischen Infrastrukturen nicht halt. --------------------------------------------- https://heise.de/-9715674 ===================== = Vulnerabilities = ===================== ∗∗∗ Widely used modems in industrial IoT devices open to SMS attack ∗∗∗ --------------------------------------------- Security flaws in Telit Cinterion cellular modems, widely used in sectors including industrial, healthcare, and telecommunications, could allow remote attackers to execute arbitrary code via SMS. --------------------------------------------- https://www.bleepingcomputer.com/news/security/widely-used-modems-in-indust… ∗∗∗ Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo ∗∗∗ --------------------------------------------- Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control (C2) framework within a PNG image of the projects logo. --------------------------------------------- https://thehackernews.com/2024/05/malicious-python-package-hides-sliver.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (nodejs:18 and shim), Debian (atril and chromium), Fedora (chromium, glib2, gnome-shell, mediawiki, php-wikimedia-cdb, php-wikimedia-utfnormal, stb, and tcpdump), Gentoo (Kubelet, PoDoFo, Rebar3, and thunderbird), Mageia (glibc and libnbd), Oracle (kernel), Red Hat (bind and dhcp and varnish), and SUSE (chromium, cpio, freerdp, giflib, gnutls, opera, python-Pillow, python-Werkzeug, tinyproxy, and tpm2-0-tss). --------------------------------------------- https://lwn.net/Articles/973496/ ∗∗∗ Microsoft fixt DLL-Hijacking-Schwachstelle in Store-App Telemetrie-Wrapper-Installer ∗∗∗ --------------------------------------------- Microsoft hat damit vor einiger Zeit seine Store-Apps mit einem neuen Installer versehen. Dieser enthält einen ausführbaren .NET-Wrapper der Telemetrie und weiteren Code in die App integriert. In der ersten Version wies dieser .NET-Wrapper aber eine DLL-Hijacking-Schwachstelle auf [...] --------------------------------------------- https://www.borncity.com/blog/2024/05/11/microsoft-fixt-dll-hijacking-schwa… ∗∗∗ Self-Signed Zertifikate im SAP® Cloud Connector zugelassen ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/self-signed-zertifika… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.05.2024
by Daily end-of-shift report 10 May '24

10 May '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 08-05-2024 18:00 − Freitag 10-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Datenschutzvorfall: Dell informiert über Abfluss von Kundendaten ∗∗∗ --------------------------------------------- Zu den abgeflossenen Informationen zählen laut Dell Namen, Adressdaten sowie weitere Daten über Bestellungen und darin enthaltene Dell-Hardware. --------------------------------------------- https://www.golem.de/news/datenschutzvorfall-dell-informiert-ueber-abfluss-… ∗∗∗ APT trends report Q1 2024 ∗∗∗ --------------------------------------------- The report features the most significant developments relating to APT groups in Q1 2024, including the new malware campaigns DuneQuixote and Durian, and hacktivist activity. --------------------------------------------- https://securelist.com/apt-trends-report-q1-2024/112473/ ∗∗∗ Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery ∗∗∗ --------------------------------------------- Two recently disclosed security flaws in Ivanti Connect Secure (ICS) devices are being exploited to deploy the infamous Mirai botnet. --------------------------------------------- https://thehackernews.com/2024/05/mirai-botnet-exploits-ivanti-connect.html ∗∗∗ GhostStripe attack haunts self-driving cars by making them ignore road signs ∗∗∗ --------------------------------------------- Six boffins mostly hailing from Singapore-based universities have proven it's possible to attack autonomous vehicles by exploiting the system's reliance on camera-based computer vision and cause it to not recognize road signs. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2024/05/10/baidu_apollo… ∗∗∗ Back to the Hype: An Update on How Cybercriminals Are Using GenAI ∗∗∗ --------------------------------------------- Generative AI continues to be misused and abused by malicious individuals. In this article, we dive into new criminal LLMs, criminal services with ChatGPT-like capabilities, and deepfakes being offered on criminal sites. --------------------------------------------- https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-th… ∗∗∗ Zscaler Investigates Hacking Claims After Data Offered for Sale ∗∗∗ --------------------------------------------- Zscaler says its customer, production and corporate environments are not impacted after a notorious hacker offers to sell access. --------------------------------------------- https://www.securityweek.com/zscaler-investigates-hacking-claims-after-data… ∗∗∗ With nation-state threats in mind, nearly 70 software firms agree to Secure by Design pledge ∗∗∗ --------------------------------------------- The nation’s top cybersecurity agency said 68 of the world’s leading software manufacturers have signed on to a voluntary pledge to design products that have security built in from the beginning. --------------------------------------------- https://therecord.media/secure-by-design-companies-cisa-rsa ∗∗∗ In interview, LockbitSupp says authorities outed the wrong guy ∗∗∗ --------------------------------------------- The leader of the LockBit ransomware gang, who goes by the name LockbItSupp, told Click Here in an interview that international law enforcement has made a mistake. --------------------------------------------- https://therecord.media/lockbitsupp-interview-ransomware-cybercrime-lockbit ∗∗∗ Krypto-Betrüger: Sechs Österreicher festgenommen ∗∗∗ --------------------------------------------- Weil sie einen Online-Handel mit angeblich neuer Kryptowährung aufgezogen und damit Investoren abgezockt haben, wurden nun sechs Österreicher verhaftet. --------------------------------------------- https://heise.de/-9714300 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (ansible-core, avahi, bind, buildah, containernetworking-plugins, edk2, fence-agents, file, freeglut, freerdp, frr, git-lfs, gnutls, golang, grafana, grafana-pcp, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, harfbuzz, httpd, ipa, libjpeg-turbo, libnbd, LibRaw, libreswan, libsndfile, libssh, libtiff, libvirt, libX11, libXpm, mingw components, mingw-glib2, mingw-pixman, mod_http2, mod_jk and mod_proxy_cluster, motif, [...] --------------------------------------------- https://lwn.net/Articles/973071/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (container-tools:4.0, container-tools:rhel8, git-lfs, glibc, libxml2, nodejs:18, and nodejs:20), Debian (dav1d and libpgjava), Fedora (kernel and pypy), Red Hat (glibc and nodejs:16), SUSE (ffmpeg, ffmpeg-4, ghostscript, go1.21, go1.22, less, python-python-jose, python-Werkzeug, and sssd), and Ubuntu (fossil, glib2.0, and libspreadsheet-parsexlsx-perl). --------------------------------------------- https://lwn.net/Articles/973206/ ∗∗∗ Admins müssen selbst handeln: PuTTY-Sicherheitslücke bedroht Citrix Hypervisor ∗∗∗ --------------------------------------------- Um XenCenter für Citrix Hypervisor abzusichern, müssen Admins händisch ein Sicherheitsupdate für das SSH-Tool PuTTY installieren. --------------------------------------------- https://heise.de/-9713898 ∗∗∗ Google Chrome: Exploit für Zero-Day-Lücke gesichtet ∗∗∗ --------------------------------------------- In Googles Webbrowser Chrome klafft eine Sicherheitslücke, für die ein Exploit existiert. Google reagiert mit einem Notfall-Update. --------------------------------------------- https://heise.de/-9714519 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ 2024-05 Reference Advisory: Junos OS and Junos OS Evolved: Multiple CVEs reported in OpenSSH ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-05-Reference-Advisory-Juno… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.05.2024
by Daily end-of-shift report 08 May '24

08 May '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 07-05-2024 18:00 − Mittwoch 08-05-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Der Briefkasten daheim als Einfallstor für Internet-Betrugsmaschen? ∗∗∗ --------------------------------------------- Online-Betrug lauert nicht nur im Internet. Zu Anrufen und SMS, die oft in Online-Betrugsmaschen führen, gesellt sich nun auch der Postkasten des Eigenheims als Einfallstor für Kriminelle hinzu. Sie nutzen die Briefkästen ihrer Opfer beispielsweise, um Sendungen aus Bestellbetrug zu erhalten, Daten und in weiterer Folge Geld zu stehlen oder um betrügerische Handwerksdienste und dazugehörige Websites zu bewerben. --------------------------------------------- https://www.watchlist-internet.at/news/der-briefkasten-daheim-als-einfallst… ∗∗∗ Massive webshop fraud ring steals credit cards from 850,000 people ∗∗∗ --------------------------------------------- A massive network of 75,000 fake online shops called BogusBazaar tricked over 850,000 people in the US and Europe into making purchases, allowing the criminals to steal credit card information and attempt to process an estimated $50 million in fake orders. --------------------------------------------- https://www.bleepingcomputer.com/news/security/massive-webshop-fraud-ring-s… ∗∗∗ Detecting XFinity/Comcast DNS Spoofing, (Mon, May 6th) ∗∗∗ --------------------------------------------- DNS interception, even if well-meaning, does undermine some of the basic "internet trust issues". Even if it is used to block users from malicious sites, it needs to be properly declared to the user, and switches to turn it off will have to function. This could be a particular problem if queries to other DNS filtering services are intercepted. I have yet to test this for Comcast and, for example, OpenDNS. --------------------------------------------- https://isc.sans.edu/diary/rss/30898 ∗∗∗ Analyzing Synology Disks on Linux, (Wed, May 8th) ∗∗∗ --------------------------------------------- Synology NAS solutions are popular devices. They are also used in many organizations. [..] They offer multiple disk management options but rely on many open-source software (like most appliances). [..] Synology NAS run a Linux distribution called DSM. This operating system has plenty of third-party tools but lacks pure forensics tools. In a recent investigation, I had to investigate a NAS that was involved in a ransomware attack. Many files (backups) were deleted. The attacker just deleted some shared folders. --------------------------------------------- https://isc.sans.edu/diary/rss/30904 ∗∗∗ Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version ∗∗∗ --------------------------------------------- A newer version of a malware loader called Hijack Loader has been observed incorporating an updated set of anti-analysis techniques to fly under the radar. --------------------------------------------- https://thehackernews.com/2024/05/hijack-loader-malware-employs-process.html ∗∗∗ New Spectre-Style Pathfinder Attack Targets Intel CPU, Leak Encryption Keys and Data ∗∗∗ --------------------------------------------- Researchers have discovered two novel attack methods targeting high-performance Intel CPUs that could be exploited to stage a key recovery attack against the Advanced Encryption Standard (AES) algorithm. The techniques have been collectively dubbed Pathfinder by a group of academics from the University of California San Diego, Purdue University, UNC Chapel Hill, Georgia Institute of Technology, and Google. [..] Following responsible disclosure in November 2023, Intel, in an advisory released last month, said Pathfinder builds on Spectre v1 attacks and that previously deployed mitigations for Spectre v1 and traditional side-channels mitigate the reported exploits. There is no evidence that it impacts AMD CPUs. --------------------------------------------- https://thehackernews.com/2024/05/new-spectre-style-pathfinder-attack.html ∗∗∗ Ghidra nanoMIPS ISA module ∗∗∗ --------------------------------------------- Here we will demonstrate how to load a MediaTek baseband firmware into Ghidra for analysis with our nanoMIPS ISA module. --------------------------------------------- https://research.nccgroup.com/2024/05/07/ghidra-nanomips-isa-module/ ∗∗∗ Vorsicht vor gefälschten Online-Banking-Seiten auf Bing, Google & Co ∗∗∗ --------------------------------------------- Kriminelle schalten Anzeigen in Suchmaschinen (vor allem BING) und locken so Opfer auf gefälschte Online-Banking-Seiten. Vorsicht: Wenn Sie hier Ihre Daten eingeben, können hohe Beträge von Ihrem Konto abgebucht werden! Vergewissern Sie sich immer, dass Sie auf der echten Login-Seite Ihrer Bank sind! --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-online-banking-suchmasc… ∗∗∗ RemcosRAT Distributed Using Steganography ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) has recently identified RemcosRAT being distributed using the steganography technique. Attacks begin with a Word document using the template injection technique, after which an RTF that exploits a vulnerability in the equation editor (EQNEDT32.EXE) is downloaded and executed. --------------------------------------------- https://asec.ahnlab.com/en/65111/ ===================== = Vulnerabilities = ===================== ∗∗∗ F5: K000139404: Quarterly Security Notification (May 2024) ∗∗∗ --------------------------------------------- F5 has released 13 security advisories (7x high, 6x medium) and 3 security exposures. --------------------------------------------- https://my.f5.com/manage/s/article/K000139404 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glib2.0 and php7.3), Gentoo (Commons-BeanUtils, Epiphany, glibc, MariaDB, Node.js, NVIDIA Drivers, qtsvg, rsync, U-Boot tools, and ytnef), Oracle (kernel), Red Hat (git-lfs and kernel), SUSE (flatpak, less, python311, rpm, and sssd), and Ubuntu (libde265, libvirt, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-oem-6.5, and nghttp2). --------------------------------------------- https://lwn.net/Articles/972861/ ∗∗∗ WordPress: Cross-Site-Scripting-Schwachstelle in älteren Cores; und WordPress 6.5.3 verfügbar ∗∗∗ --------------------------------------------- Ich hoffe, ihr seid auf der aktuellen WordPress-Version, denn in älteren WordPress-Versionen gibt es eine Cross-Site-Scripting-Schwachstelle [..] und wer LightSpeed Cache als Plugin nutzt, sollte dringend updaten. --------------------------------------------- https://www.borncity.com/blog/2024/05/07/wordpress-cross-site-scripting-sch… ∗∗∗ VMware Avi Load Balancer: Rechteausweitung zu root möglich ∗∗∗ --------------------------------------------- Im Load Balancer VMware Avi können Angreifer ihre Rechte erhöhen oder unbefugt auf Informationen zugreifen. Updates korrigieren das. --------------------------------------------- https://heise.de/-9711733 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.05.2024
by Daily end-of-shift report 07 May '24

07 May '24

===================== = End-of-Day report = ===================== Timeframe: Montag 06-05-2024 18:00 − Dienstag 07-05-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New Case Study: The Malicious Comment ∗∗∗ --------------------------------------------- How safe is your comments section? Discover how a seemingly innocent thank you comment on a product page concealed a malicious vulnerability, underscoring the necessity of robust security measures. --------------------------------------------- https://thehackernews.com/2024/05/new-case-study-malicious-comment.html ∗∗∗ Ransomware evolves from mere extortion to psychological attacks ∗∗∗ --------------------------------------------- RSAC Ransomware infections and extortion attacks have become "a psychological attack against the victim organization," as criminals use increasingly personal and aggressive tactics to force victims to pay up. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2024/05/07/ransomware_e… ∗∗∗ Betrug am Telefon: Kriminelle täuschen hohe Abbuchungen vor ∗∗∗ --------------------------------------------- Vorsicht, wenn Ihnen jemand am Telefon erklärt, dass es „versteckte Abbuchungen“ von Ihrem Bankkonto gibt. Hierbei handelt es sich um eine Betrugsmasche. Um glaubwürdig zu wirken, nennen die Kriminellen persönliche Daten von Ihnen. Diese wurden aber im Zuge einer Phishing-Falle gesammelt. Legen Sie auf! --------------------------------------------- https://www.watchlist-internet.at/news/betrug-am-telefon-kriminelle-taeusch… ∗∗∗ Ein Kopf (Administrator) der LockBit-Gruppe enttarnt? ∗∗∗ --------------------------------------------- Der "Kopf" und gleichzeitig Administrator der Ransomware-Gruppe LockBit ist laut Mitteilung der Strafverfolger identifiziert. --------------------------------------------- https://www.borncity.com/blog/2024/05/07/ein-kopf-administrator-der-lockbit… ===================== = Vulnerabilities = ===================== ∗∗∗ TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak ∗∗∗ --------------------------------------------- Recently, we identified a novel network technique that bypasses VPN encapsulation. An attacker can use this technique to force a target user’s traffic off their VPN tunnel using built-in features of DHCP (Dynamic Host Configuration Protocol). --------------------------------------------- https://www.leviathansecurity.com/blog/tunnelvision ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kernel), Gentoo (libjpeg-turbo, xar, and Xpdf), Red Hat (bind, dhcp and glibc), and SUSE (bouncycastle, curl, flatpak, less, and xen). --------------------------------------------- https://lwn.net/Articles/972679/ ∗∗∗ Android-Patchday: Angreifer können Rechte im System ausweiten ∗∗∗ --------------------------------------------- Google schließt am Android-Patchday mehrere Lücken, durch die Angreifer ihre Rechte ausweiten können. --------------------------------------------- https://heise.de/-9710075 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ PTC Codebeamer ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-01 ∗∗∗ SUBNET Substation Server ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-128-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.05.2024
by Daily end-of-shift report 06 May '24

06 May '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 03-05-2024 18:00 − Montag 06-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Vorsicht vor gefälschten RTR-Briefen ∗∗∗ --------------------------------------------- Kriminelle geben sich in einem Brief als Rundfunk und Telekom Regulierungs-GmbH (RTR) aus. Im Schreiben steht, dass für den Anschluss an Mobilfunknetze und die Wartung von Basisstationen ein Entgelt von € 8,90 zu bezahlen sei. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-rtr-briefe… ∗∗∗ Microsoft: Sicherheit oberste Priorität in Produkten, Diensten und intern ∗∗∗ --------------------------------------------- In einem internen Memo und einem Blogpost stellt Microsoft Security bei allen Entwicklungen an erste Stelle. Das gilt für Produkte wie Services. [..] Charlie Bell zufolge will sich sein Unternehmen strikt an die Vorgaben des CSRB halten. --------------------------------------------- https://heise.de/-9708577 ∗∗∗ Breaking down Microsoft’s pivot to placing cybersecurity as a top priority ∗∗∗ --------------------------------------------- Recently, Microsoft had quite frankly a kicking from the US Department of Homeland Security over their security practices in a Cyber Safety Review Board report. I’ve tried to keep as quiet as possible about this one for various reasons (and I was not involved in the CSRB report, even anonymously) — although long time followers will know I’ve been often critical of Microsoft’s security posture. The CSRB report is well worth a read — they did a great job. [..] As always, the proof is in the pudding, not the vendor blog. I think these changes will take a few years to start to work through, and fully expect a few more clanger breaches in the mean time. And that’s annoying but okay, because hard work is hard. --------------------------------------------- https://doublepulsar.com/breaking-down-microsofts-pivot-to-placing-cybersec… ∗∗∗ Critical Tinyproxy Flaw Opens Over 50,000 Hosts to Remote Code Execution ∗∗∗ --------------------------------------------- More than 50% of the 90,310 hosts have been found exposing a Tinyproxy service on the internet thats vulnerable to a critical unpatched security flaw in the HTTP/HTTPS proxy tool. The issue, tracked as CVE-2023-49606, carries a CVSS score of 9.8 out of a maximum of 10, per Cisco Talos, which described it as a use-after-free bug impacting versions 1.10.0 and 1.11.1, which is the latest version. --------------------------------------------- https://thehackernews.com/2024/05/critical-tinyproxy-flaw-opens-over.html ∗∗∗ Lockbits seized site comes alive to tease new police announcements ∗∗∗ --------------------------------------------- The NCA, FBI, and Europol have revived a seized LockBit ransomware data leak site to hint at new information being revealed by law enforcement this Tuesday. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lockbits-seized-site-comes-a… ∗∗∗ Why Your VPN May Not Be As Secure As It Claims ∗∗∗ --------------------------------------------- Virtual private networking (VPN) companies market their services as a way to prevent anyone from snooping on your Internet usage. But new research suggests this is a dangerous assumption when connecting to a VPN via an untrusted network, because attackers on the same network could force a targets traffic off of the protection provided by their VPN without triggering any alerts to the user. --------------------------------------------- https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it… ∗∗∗ Financial cyberthreats in 2023 ∗∗∗ --------------------------------------------- In this report, we share our insights into the 2023 trends and statistics on financial threats, such as phishing, PC and mobile banking malware. --------------------------------------------- https://securelist.com/financial-threat-report-2023/112526/ ∗∗∗ HijackLoader Updates ∗∗∗ --------------------------------------------- HijackLoader (a.k.a. IDAT Loader) is a malware loader initially spotted in 2023 that is capable of using a variety of modules for code injection and execution. It uses a modular architecture, a feature that most loaders do not have – which we discussed in a previous HijackLoader blog. ThreatLabz researchers recently analyzed a new HijackLoader sample that has updated evasion techniques. --------------------------------------------- https://www.zscaler.com/blogs/security-research/hijackloader-updates ∗∗∗ New Goldoon Botnet Targeting D-Link Devices by Exploiting 9-Year-Old Flaw ∗∗∗ --------------------------------------------- By WaqasA new botnet called Goldoon targets D-Link routers and NAS devices putting them at risk of DDoS attacks and more. Learn how weak credentials leave you vulnerable and how to secure your network. pen_sparkThis is a post from HackRead.com Read the original post: New Goldoon Botnet Targeting D-Link Devices by Exploiting 9-Year-Old Flaw --------------------------------------------- https://www.hackread.com/goldoon-botnet-targeting-d-link-devices/ ∗∗∗ End-to-end encryption may be the bane of cops, but they cant close that Pandoras Box ∗∗∗ --------------------------------------------- Police can complain all they like about strong end-to-end encryption making their jobs harder, but it doesn't matter because the technology is here and won't go away. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2024/05/05/e2ee_police/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (glibc, intel-microcode, less, libkf5ksieve, and ruby3.1), Fedora (chromium, gdcm, httpd, and stalld), Gentoo (Apache Commons BCEL, borgmatic, Dalli, firefox, HTMLDOC, ImageMagick, MediaInfo, MediaInfoLib, MIT krb5, MPlayer, mujs, Pillow, Python, PyPy3, QtWebEngine, Setuptools, strongSwan, and systemd), Oracle (grub2 and shim), Red Hat (git-lfs, kpatch-patch, unbound, and varnish), and SUSE (avahi, grafana and mybatis, java-11-openjdk, java-17-openjdk, skopeo, SUSE Manager Client Tools, SUSE Manager Salt Bundle, and SUSE Manager Server 4.3). --------------------------------------------- https://lwn.net/Articles/972571/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.05.2024
by Daily end-of-shift report 03 May '24

03 May '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 02-05-2024 18:00 − Freitag 03-05-2024 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Microsoft rolls out passkey auth for personal Microsoft accounts ∗∗∗ --------------------------------------------- Microsoft announced that Windows users can now log into their Microsoft consumer accounts using a passkey, allowing users to authenticate using password-less methods such as Windows Hello, FIDO2 security keys, biometric data (facial scans or fingerprints), or device PINs. [..] Microsoft had already added passkey support to Windows for logging into websites and applications, but with the additional support for Microsoft accounts, consumers can now easily log in without entering a password. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-out-passkey… ∗∗∗ Scans Probing for LB-Link and Vinga WR-AC1200 routers CVE-2023-24796, (Thu, May 2nd) ∗∗∗ --------------------------------------------- Before diving into the vulnerability, a bit about the affected devices. LB-Link, the make of the devices affected by this vulnerability, produces various wireless equipment that is sometimes sold under different brands and labels. This will make it difficult to identify affected devices. These devices are often low-cost "no name" solutions or, in some cases, may even be embedded, which makes it even more difficult to find firmware updates. [..] And yes, the vulnerability evolves around the "user=admin" cookie and a command injection in the password parameter. This is too stupid to waste any more time on, but it is common enough to just give up and call it a day. --------------------------------------------- https://isc.sans.edu/diary/rss/30890 ∗∗∗ Mal.Metrica Redirects Users to Scam Sites ∗∗∗ --------------------------------------------- One of our analysts recently identified a new Mal.Metrica redirect scam on compromised websites, but one that requires a little bit of effort on the part of the victim. It’s another lesson for web users to be careful what they click on, and to be wary of anything suspicious that pops up in their browser — even if it’s coming from a website that they would otherwise trust. --------------------------------------------- https://blog.sucuri.net/2024/05/mal-metrica-redirects-users-to-scam-sites.h… ∗∗∗ Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications ∗∗∗ --------------------------------------------- Since January 2022, multiple nation-state-aligned hacking groups have been observed using Microsoft Graph API for C&C. This includes threat actors tracked as APT28, REF2924, Red Stinger, Flea, APT29, and OilRig. --------------------------------------------- https://thehackernews.com/2024/05/hackers-increasingly-abusing-microsoft.ht… ∗∗∗ Europol op shutters 12 scam call centers and cuffs 21 suspected fraudsters ∗∗∗ --------------------------------------------- A Europol-led operation dubbed “Pandora” has shut down a dozen phone scam centers, and arrested 21 suspects. [..] Beginning in December 2023, German investigators deployed more than 100 officers to trace the scam calls back to the source - call centers run by crooks - and then monitored them. That effort resulted in the interception of more than 1.3 million "nefarious conversations." Baden-Württemberg State Criminal Police officers had to set up a call center of their own so that they could contact potential victims, warning more than 80 percent of them. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2024/05/03/operation_pa… ∗∗∗ These Dangerous Scammers Don’t Even Bother to Hide Their Crimes ∗∗∗ --------------------------------------------- “Yahoo Boy” cybercriminals are openly running dozens of scams across Facebook, WhatsApp, Telegram, TikTok, YouTube, and more. [..] While the Yahoo Boys have been active for years, all the experts spoken to for this piece say they should be treated more seriously by social media companies and law enforcement. --------------------------------------------- https://www.wired.com/story/yahoo-boys-scammers-facebook-telegram-tiktok-yo… ∗∗∗ Adding insult to injury: crypto recovery scams ∗∗∗ --------------------------------------------- Once your crypto has been stolen, it is extremely difficult to get back – be wary of fake promises to retrieve your funds and learn how to avoid becoming a victim twice over. --------------------------------------------- https://www.welivesecurity.com/en/scams/crypto-recovery-scams-insult-injury/ ∗∗∗ CVE-2024-2887: A Pwn2Own Winning Bug in Google Chrome ∗∗∗ --------------------------------------------- In this guest blog from Master of Pwn winner Manfred Paul, he details CVE-2024-2887 – a type confusion bug that occurs in both Google Chrome and Microsoft Edge (Chromium). He used this bug as a part of his winning exploit that led to code execution in the renderer of both browsers. This bug was quickly patched by both Google and Microsoft. Manfred has graciously provided this detailed write-up of the vulnerability and how he exploited it at the contest. --------------------------------------------- https://www.thezdi.com/blog/2024/5/2/cve-2024-2887-a-pwn2own-winning-bug-in… ∗∗∗ CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities ∗∗∗ --------------------------------------------- This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/05/02/cisa-and-fbi-release-sec… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (chromium, grub2, httpd, kernel, libcoap, matrix-synapse, python-pip, and rust-pythonize), Red Hat (kernel and libxml2), SUSE (kernel), and Ubuntu (eglibc, glibc and php7.4, php8.1, php8.2). --------------------------------------------- https://lwn.net/Articles/972351/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.05.2024
by Daily end-of-shift report 02 May '24

02 May '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-04-2024 18:00 − Donnerstag 02-05-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ CVD - Notizen zur Pressekonferenz ∗∗∗ --------------------------------------------- Ich wurde eingeladen, heute bei einer Pressekonferenz von Epicenter.works am Podium zu sitzen. Es ging um einen Fall, bei dem es im Zuge einer klassischen verantwortungsvollen Offenlegung einer Schwachstelle (Responsible Disclosure, bzw Coordinated Vulnerability Disclosure [CVD]) zu einer Anzeige gekommen ist. Nachzulesen ist der Fall auf der Epicenter Webseite. Ich will hier kurz meine Notizen / Speaking Notes zusammenfassen. --------------------------------------------- https://cert.at/de/blog/2024/4/cvd-policy ∗∗∗ CISA warnt: MS Smartscreen- und Gitlab-Sicherheitslücke werden angegriffen ∗∗∗ --------------------------------------------- Die US-Cybersicherheitsbehörde CISA hat Angriffe auf eine Lücke im Microsoft Smartscreen und auf eine Gitlab-Schwachstelle gesichtet. --------------------------------------------- https://heise.de/-9705715 ∗∗∗ Digitale Signatur: Datenleak bei Dropbox Sign ∗∗∗ --------------------------------------------- Unbekannte Angreifer konnten auf Kundendaten des digitalen Signaturservices Dropbox Sign zugreifen. Andere Dropbox-Produkte sollen nicht betroffen sein. --------------------------------------------- https://heise.de/-9705355 ∗∗∗ Windows 10/11/Server 2022: Kein Fix für den Installationsfehler 0x80070643 beim WinRE-Update mehr ∗∗∗ --------------------------------------------- Seit Januar 2024 kämpfen Nutzer von Windows 10 und Windows 11 (sowie Windows Server 2022) mit dem Versuch Microsofts, ein Update der WinRE-Umgebung zu installieren. Im Januar 2024 ließen zahlreiche Nutzer im Umfeld des Patchday beim Versuch, das Update KB5034441 zu installieren, in den Installationsfehler 0x80070643. Trotz mehrerer Versuche zur Nachbesserung in den Folgemonaten ist es Microsoft nicht gelungen, den Installationsfehler zu beseitigen. Nun kommt das Eingeständnis, dass es keinen automatischen Fix für das Update gibt – es ist Handarbeit angesagt. --------------------------------------------- https://www.borncity.com/blog/2024/05/02/windows-10-11-kein-fix-fr-den-inst… ∗∗∗ “Dirty stream” attack: Discovering and mitigating a common vulnerability pattern in Android apps ∗∗∗ --------------------------------------------- Microsoft discovered a vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s internal data storage directory, which could lead to arbitrary code execution and token theft, among other impacts. We have shared our findings with Google’s Android Application Security Research team, as well as the developers of apps found vulnerable to this issue. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2024/05/01/dirty-stream-attac… ∗∗∗ Another Day, Another NAS: Attacks against Zyxel NAS326 devices CVE-2023-4473, CVE-2023-4474, (Tue, Apr 30th) ∗∗∗ --------------------------------------------- Yesterday, I talked about attacks against a relatively recent D-Link NAS vulnerability. Today, scanning my honeypot logs, I found an odd URL that I didn't recognize. The vulnerability is a bit older but turns out to be targeting yet another NAS. [..] Based on our logs, only one IP address exploits the vulnerability: %%ip: 89.190.156.248%%. --------------------------------------------- https://isc.sans.edu/diary/rss/30884 ∗∗∗ Android Malware Wpeeper Uses Compromised WordPress Sites to Hide C2 Servers ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a previously undocumented malware targeting Android devices that uses compromised WordPress sites as relays for its actual command-and-control (C2) servers for detection evasion. The malware, codenamed Wpeeper, is an ELF binary that leverages the HTTPS protocol to secure its C2 communications. [..] The ELF binary is embedded within a repackaged application that purports to be the UPtodown App Store app for Android (package name "com.uptodown"), with the APK file acting as a delivery vehicle for the backdoor in a manner that evades detection. --------------------------------------------- https://thehackernews.com/2024/05/android-malware-wpeeper-uses.html ∗∗∗ New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials ∗∗∗ --------------------------------------------- A new malware called Cuttlefish is targeting small office and home office (SOHO) routers with the goal of stealthily monitoring all traffic through the devices and gather authentication data from HTTP GET and POST requests. [..] Cuttlefish has been active since at least July 27, 2023, with the latest campaign running from October 2023 through April 2024 and predominantly infecting 600 unique IP addresses associated with two Turkish telecom providers. --------------------------------------------- https://thehackernews.com/2024/05/new-cuttlefish-malware-hijacks-router.html ∗∗∗ Autodesk: Important Security Update for Autodesk Drive ∗∗∗ --------------------------------------------- In March, Autodesk was made aware of an incident where an external user published documents to Autodesk Drive containing links to a phishing web site. Our Cyber Threat Management & Response Team immediately responded to this incident, and the malicious files are no longer being hosted on Autodesk Drive. No customers have reported being impacted by this incident. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-autodesk-dr… ∗∗∗ Analysis of TargetCompany’s Attacks Against MS-SQL Servers (Mallox, BlueSky Ransomware) ∗∗∗ --------------------------------------------- While monitoring attacks targeting MS-SQL servers, AhnLab SEcurity intelligence Center (ASEC) recently identified cases of the TargetCompany ransomware group installing the Mallox ransomware. The TargetCompany ransomware group primarily targets improperly managed MS-SQL servers to install the Mallox ransomware. While these attacks have been ongoing for several years, here we will outline the correlation between the newly identified malware and previous attack cases involving the distribution of the Tor2Mine CoinMiner and BlueSky ransomware. --------------------------------------------- https://asec.ahnlab.com/en/64921/ ∗∗∗ CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity ∗∗∗ --------------------------------------------- This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who seek to compromise industrial control systems (ICS) and small-scale operational technology (OT) systems in North American and European critical infrastructure sectors, including Water and Wastewater Systems, Dams, Energy, and Food and Agriculture Sectors. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/05/01/cisa-and-partners-releas… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücken in ArubaOS - Updates verfügbar ∗∗∗ --------------------------------------------- In ArubaOS, dem Betriebssystem vieler Geräte von HPE Aruba Networks, existieren mehrere kritische Sicherheitslücken. Diese ermöglichen unter anderem die Ausführung von beliebigem Code und Denial-of-Service (DoS) Angriffe. CVE-Nummern: CVE-2024-26304, CVE-2024-26305, CVE-2024-33511, CVE-2024-33512, CVE-2024-33513, CVE-2024-33514, CVE-2024-33515, CVE-2024-33516, CVE-2024-33517, CVE-2024-33518 CVSSv3 Scores: bis zu 9.8 (kritisch) --------------------------------------------- https://cert.at/de/warnungen/2024/5/kritische-sicherheitslucken-in-arubaos-… ∗∗∗ CISCO Talos: Vulnerability Roundup ∗∗∗ --------------------------------------------- Peplink Smart Reader, Silicon Labs Gecko Platform, open-source library for DICOM files, Grassroots DICOM library and Foxit PDF Reader. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-roundup-may-1-2024/ ∗∗∗ Sonicwall: GMS ECM multiple vulnerabilities ∗∗∗ --------------------------------------------- CVE-2024-29010 - GMS ECM Policy XML External Entity Processing Information Disclosure Vulnerability. CVE-2024-29011 - GMS ECM Hard-Coded Credential Authentication Bypass Vulnerability. --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0007 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and distro-info-data), Fedora (et, php-tcpdf, python-aiohttp, python-openapi-core, thunderbird, tpm2-tools, and tpm2-tss), Red Hat (nodejs:16 and podman), and Ubuntu (firefox). --------------------------------------------- https://lwn.net/Articles/972186/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (nghttp2 and qtbase-opensource-src), Mageia (cjson, freerdp, guava, krb5, libarchive, and mediawiki), Oracle (container-tools:4.0 and container-tools:ol8), Red Hat (bind, buildah, container-tools:3.0, container-tools:rhel8, expat, gnutls, golang, grafana, kernel, kernel-rt, libreswan, libvirt, linux-firmware, mod_http2, pcp, pcs, podman, python-jwcrypto, rhc-worker-script, shadow-utils, skopeo, sssd, tigervnc, unbound, and yajl), SUSE (kernel and python311), and Ubuntu (gerbv and node-json5). --------------------------------------------- https://lwn.net/Articles/972029/ ∗∗∗ Critical Vulnerabilities in Judge0 Lead to Sandbox Escape, Host Takeover ∗∗∗ --------------------------------------------- Three vulnerabilities in the Judge0 open source service could allow attackers to escape the sandbox and obtain root privileges on the host. --------------------------------------------- https://www.securityweek.com/critical-vulnerabilities-in-judge0-lead-to-san… ∗∗∗ Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ F5: K000139430 : Linux kernel vulnerability CVE-2024-1086 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000139430 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (April 22, 2024 to April 28, 2024) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/05/wordfence-intelligence-weekly-wordpr… ∗∗∗ ZDI-24-419: (Pwn2Own) Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-419/ ∗∗∗ ZDI-24-418: (Pwn2Own) Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-418/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ CyberPower PowerPanel ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 ∗∗∗ Delta Electronics DIAEnergie ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily May 2024