Daily August 2024

daily@lists.cert.at

1 participants
21 discussions

Tageszusammenfassung - 30.08.2024
by Daily end-of-shift report 30 Aug '24

30 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-08-2024 18:00 − Freitag 30-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Fake Palo Alto GlobalProtect used as lure to backdoor enterprises ∗∗∗ --------------------------------------------- Threat actors target Middle Eastern organizations with malware disguised as the legitimate Palo Alto GlobalProtect Tool that can steal data and execute remote PowerShell commands to infiltrate internal networks further. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-palo-alto-globalprotect… ∗∗∗ FBI: RansomHub ransomware breached 210 victims since February ∗∗∗ --------------------------------------------- Since surfacing in February 2024, RansomHub ransomware affiliates have breached over 200 victims from a wide range of critical U.S. infrastructure sectors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fbi-ransomhub-ransomware-bre… ∗∗∗ Russische Hacker nutzen die gleichen Lücken wie Staatstrojaner ∗∗∗ --------------------------------------------- Immer wieder warnen Experten davor, dass auch Kriminelle jene Schlupflöcher nutzen können, über die auch Regierungen Verdächtige überwachen. --------------------------------------------- https://futurezone.at/netzpolitik/russische-hacker-staatstrojaner-messenger… ∗∗∗ Studie: 78 Prozent aller Ransomware-Opfer zahlen offenbar Lösegeld ∗∗∗ --------------------------------------------- Viele betroffene Unternehmen zahlen wohl sogar mehrfach. Auch vier- oder mehr Lösegeldzahlungen sind keine Seltenheit - vor allem nicht in Deutschland. --------------------------------------------- https://www.golem.de/news/studie-78-prozent-aller-ransomware-opfer-zahlen-o… ∗∗∗ Feds claim sinister sysadmin locked up thousands of Windows workstations, demanded ransom ∗∗∗ --------------------------------------------- Sordid search history evidence in case that could see him spend 35 years for extortion and wire fraud A former infrastructure engineer who allegedly locked IT department colleagues out of their employers systems, then threatened to shut down servers unless paid a ransom, has been arrested and charged after an FBI investigation. --------------------------------------------- https://www.theregister.com/2024/08/29/vm_engineer_extortion_allegations/ ∗∗∗ How to enhance the security of your social media accounts ∗∗∗ --------------------------------------------- TL;DR Strong passwords: Use a password manager. Multi-factor authentication (MFA): MFA requires multiple forms of identification, adding an extra layer of security. This makes it harder for unauthorised users to .. --------------------------------------------- https://www.pentestpartners.com/security-blog/how-to-enhance-the-security-o… ∗∗∗ TLD Tracker: Exploring Newly Released Top-Level Domains ∗∗∗ --------------------------------------------- Unit 42 researchers use a novel graph-based pipeline to detect misuse of 19 new TLDs for phishing, chatbots and more in several case studies. --------------------------------------------- https://unit42.paloaltonetworks.com/tracking-newly-released-top-level-domai… ∗∗∗ Malicious North Korean packages appear again in open source code repository ∗∗∗ --------------------------------------------- North Korean hackers continue to exploit the widely used npm code repository, publishing malicious packages intended to infect software developers’ devices with malware, according to recent research. --------------------------------------------- https://therecord.media/npm-javascript-repository-north-korean-malware ∗∗∗ TR-88 - Motivation, procedure and rational for leaked credential notifications ∗∗∗ --------------------------------------------- In today’s digital landscape, protecting user data is essential for every organization. When public data leaks expose customer credentials, it is critical to respond promptly to mitigate risks. This document outlines why CIRCL .. --------------------------------------------- https://www.circl.lu/pub/tr-88 ∗∗∗ Silent Intrusions: Godzilla Fileless Backdoors Targeting Atlassian Confluence ∗∗∗ --------------------------------------------- Trend Micro discovered that old Atlassian Confluence versions that were affected by CVE-2023-22527 are being exploited using a new in-memory fileless backdoor. --------------------------------------------- https://www.trendmicro.com/en_us/research/24/h/godzilla-fileless-backdoors.… ∗∗∗ Gaps in Skills, Knowledge, and Technology Pave the Way for Breaches ∗∗∗ --------------------------------------------- The stakes continue growing higher for organizations when it comes to cybersecurity incidents, with the fallout of such incidents becoming more costly and complex. According to the Fortinet 2024 Cybersecurity Skills Gap Report, the overwhelming majority (87%) of those surveyed said they experienced one or .. --------------------------------------------- https://www.fortinet.com/blog/industry-trends/gaps-in-skills-knowledge-tech… ∗∗∗ Ransomware Roundup - Underground ∗∗∗ --------------------------------------------- The Underground ransomware has victimized companies in various industries since July 2023. It encrypts files without changing the original file extension. --------------------------------------------- https://www.fortinet.com/blog/threat-research/ransomware-roundup-underground ∗∗∗ Nach Cyberangriff: Solaranbieter "Qcells" informiert Kunden über Datenleck ∗∗∗ --------------------------------------------- Wieder gibt es ein Datenleck in der Solarbranche. Kunden von Qcell werden darum informiert. --------------------------------------------- https://heise.de/-9852641 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by AlmaLinux (libvpx, postgresql, postgresql:12, postgresql:13, postgresql:15, and python39:3.9 and python39-devel:3.9), Debian (chromium and ghostscript), Fedora (python3.13), and SUSE (chromium and podman). --------------------------------------------- https://lwn.net/Articles/987836/ ∗∗∗ DSA-5761-1 chromium - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2024/msg00174.html ∗∗∗ IPCOM vulnerable to information disclosure ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN29238389/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.08.2024
by Daily end-of-shift report 29 Aug '24

29 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-08-2024 18:00 − Donnerstag 29-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Unpatchable 0-day in surveillance cam is being exploited to install Mirai ∗∗∗ --------------------------------------------- Vulnerability is easy to exploit and allows attackers to remotely execute commands. --------------------------------------------- https://arstechnica.com/?p=2046043 ∗∗∗ Iranian hackers work with ransomware gangs to extort breached orgs ∗∗∗ --------------------------------------------- An Iran-based hacking group known as Pioneer Kitten is breaching defense, education, finance, and healthcare organizations across the United States and working with affiliates of several ransomware operations to extort the victims. --------------------------------------------- https://www.bleepingcomputer.com/news/security/iranian-hackers-work-with-ra… ∗∗∗ Endlich: Maßnahme gegen Anrufe mit gefälschten Nummern tritt in Kraft ∗∗∗ --------------------------------------------- Dass die eigene Handynummer für Spamanrufe genutzt wird, soll ab dem 1. September nicht mehr möglich sein. --------------------------------------------- https://futurezone.at/netzpolitik/rtr-veordnung-massnahme-nummer-gefaelscht… ∗∗∗ Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations ∗∗∗ --------------------------------------------- Between April and July 2024, Microsoft observed Iranian state-sponsored threat actor Peach Sandstorm deploying a new custom multi-stage backdoor, which we named Tickler. Tickler has been used in attacks against targets in the satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the .. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2024/08/28/peach-sandstorm-de… ∗∗∗ Cybercrime and Sabotage Cost German Firms $300 Billion In Past Year ∗∗∗ --------------------------------------------- According to a new survey from Bitkom, cybercrime and other acts of sabotage have cost German companies around $298 billion in the past year, up 29% on the year before. Reuters reports: Bitkom surveyed around 1,000 companies from all sectors and found that 90% expect more cyberattacks in the next 12 months, with the remaining 10% expecting the same level of .. --------------------------------------------- https://it.slashdot.org/story/24/08/28/211228/cybercrime-and-sabotage-cost-… ∗∗∗ 12 Best Practices to Secure Your WordPress Login Page ∗∗∗ --------------------------------------------- WordPress powers a significant portion of websites on the internet. With this popularity comes the need for strict security measures, especially for the login page. These entry points are prime targets for hackers and malicious actors. By implementing proper security practices outlined in this guide, you can maintain a secure WordPress login and .. --------------------------------------------- https://blog.sucuri.net/2024/08/12-best-practices-to-secure-your-wordpress-… ∗∗∗ Microsoft hosts a security summit but no press, public allowed ∗∗∗ --------------------------------------------- CrowdStrike, other vendors, friendly govt reps .. but not anyone who would tell you what happened op-ed Microsoft will host a security summit next month with CrowdStrike and other "key" endpoint security partners joining the fun - and during which the CrowdStrike-induced outage that borked millions of Windows machines will undoubtedly be a top-line agenda item. --------------------------------------------- https://www.theregister.com/2024/08/28/microsoft_closed_security_summit/ ∗∗∗ Censys Finds Hundreds of Exposed Servers as Volt Typhoon APT Targets Service Providers ∗∗∗ --------------------------------------------- Amidst Volt Typhoon zero-day exploitation, Censys finds hundreds of exposed servers presenting ripe attack surface for attackers. --------------------------------------------- https://www.securityweek.com/censys-finds-hundreds-of-exposed-servers-as-vo… ∗∗∗ Telegram als Betrugsfalle ∗∗∗ --------------------------------------------- Der Kurznachrichtendienst Telegram ist spätestens seit der Verhaftung des Erfinders Pawel Durow in Paris in aller Munde. Telegram beschäftigt uns bei der Watchlist Internet aber schon viel länger. Kaum woanders gelingt es Kriminellen besser, Opfer in ihre Fallen zu locken. Insbesondere Investitionsbetrug, Schneeballsysteme und betrügerische Jobangebote sorgen teils für horrende Schadenssummen. Konsequenzen gibt es auf Telegram für die Kriminellen bisher keine. --------------------------------------------- https://www.watchlist-internet.at/news/telegram-als-betrugsfalle/ ∗∗∗ $2.5 million reward offered for hacker linked to notorious Angler Exploit Kit ∗∗∗ --------------------------------------------- Who doesnt fancy earning US $2.5 million? Thats the reward thats on offer from US authorities for information leading to the arrest and/or conviction of the man who allegedly was a key figure behind the development and distribution of the notorious Angler Exploit Kit. Read more in my article on the Tripwire State of Security blog. --------------------------------------------- https://www.tripwire.com/state-of-security/25-million-reward-offered-cyber-… ∗∗∗ Cisco: BlackByte ransomware gang only posting 20% to 30% of successful attacks ∗∗∗ --------------------------------------------- The BlackByte ransomware gang is only posting a fraction of its successful attacks on its leak site this year, according to researchers from Cisco. --------------------------------------------- https://therecord.media/blackbyte-ransomware-group-posting-fraction-of-leaks ∗∗∗ State-backed attackers and commercial surveillance vendors repeatedly use the same exploits ∗∗∗ --------------------------------------------- We’re sharing an update on suspected state-backed attacker APT29 and the use of exploits identical to those used by Intellexa and NSO. --------------------------------------------- https://blog.google/threat-analysis-group/state-backed-attackers-and-commer… ∗∗∗ The Big TIBER Encyclopedia ∗∗∗ --------------------------------------------- An analysis of current TIBER implementations ahead of DORA’s TLPT requirements Introduction TIBER (Threat Intelligence-Based Ethical Red Teaming) is a framework introduced by the European Central Bank (ECB) in 2018 as a response to the increasing number of cyber threats faced by financial institutions. The framework provides a .. --------------------------------------------- https://blog.nviso.eu/2024/08/29/the-big-tiber-encyclopedia/ ∗∗∗ The vulnerabilities we uncovered by fuzzing µC/OS protocol stacks ∗∗∗ --------------------------------------------- Fuzzing has long been one of our favorite ways to search for security issues or vulnerabilities in software, but when it comes to fuzzing popular systems used in ICS environments, it traditionally involved a custom hardware setup to fuzz the code in its native environment. --------------------------------------------- https://blog.talosintelligence.com/fuzzing-uc-os-protocol-stacks/ ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Family August 2024 First Round Security Update Advisory ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/82727/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.08.2024
by Daily end-of-shift report 28 Aug '24

28 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 27-08-2024 18:00 − Mittwoch 28-08-2024 18:00 Handler: Alexander Riepl Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ ISPs infiltriert: Zero Day seit Monaten ausgenutzt ∗∗∗ --------------------------------------------- Eine Sicherheitslücke der Netzwerksoftware Versa Director (CVE-2024-39717) wird stärker ausgenutzt als zunächst bekannt. Bei mindestens drei Internet Service Providern (ISP) in den USA und einem außerhalb des Landes haben sich Angreifer eingenistet, um Kundenlogins und Passwörter im Klartext abzufangen, bevor sie gehasht und beim ISP gespeichert werden. [..] Der Angriff schlägt fehl, wenn die Versa-Patches installiert wurden oder wenn Port 4566 von Kundenroutern aus nicht erreichbar ist. Für Letzteres empfiehlt Versa bereits seit Jahren passende Firewall-Einstellungen und Systemhärtungen. --------------------------------------------- https://heise.de/-9849553 ∗∗∗ ADAC warnt: Die meisten Keyless-Systeme weiterhin leicht zu knacken ∗∗∗ --------------------------------------------- Der ADAC hat rund 700 Fahrzeuge mit Keyless-Schließsystem getestet. Mehr als 90 Prozent davon lassen sich per Relay-Angriff aus der Ferne öffnen und starten. --------------------------------------------- https://www.golem.de/news/adac-warnt-die-meisten-keyless-systeme-weiterhin-… ∗∗∗ Windows Downdate: Tool zum Öffnen alter Windows-Lücken veröffentlicht ∗∗∗ --------------------------------------------- Mit Windows Downdate können Windows-Komponenten wie DLLs, Treiber oder der NT-Kernel unbemerkt auf anfällige Versionen zurückgestuft werden. Das Tool ist nun öffentlich. --------------------------------------------- https://www.golem.de/news/windows-downdate-tool-zum-oeffnen-alter-windows-l… ∗∗∗ Betrügerische Abmahnung im Namen von Pornhub ∗∗∗ --------------------------------------------- „Letzte Mahnung vor Klageerhebung“ lautet der Betreff einer beunruhigenden E-Mail. Die Kanzlei Frommer Legal verschickt derzeit wahllos E-Mails, in denen behauptet wird, man habe urheberrechtlich geschützte Inhalte von Pornhub.com gestreamt. --------------------------------------------- https://www.watchlist-internet.at/news/abmahnung-pornhub/ ∗∗∗ Intels Software Guard Extensions broken? Dont panic ∗∗∗ --------------------------------------------- Today's news that Intel's Software Guard Extensions (SGX) security system is open to abuse may be overstated. [..] However, Intel has pointed out that not only would an attacker need physical access to a machine to make this work, but that string of issues would have to have been left unfixed. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2024/08/27/intel_root_k… ∗∗∗ New QR Code Phishing Campaign Exploits Microsoft Sway to Steal Credentials ∗∗∗ --------------------------------------------- Cybersecurity researchers are calling attention to a new QR code phishing (aka quishing) campaign that leverages Microsoft Sway infrastructure to host fake pages, once again highlighting the abuse of legitimate cloud offerings for malicious purposes. --------------------------------------------- https://thehackernews.com/2024/08/new-qr-code-phishing-campaign-exploits.ht… ∗∗∗ New LummaC2 Malware Variant Uses PowerShell, Obfuscation to Steal Data ∗∗∗ --------------------------------------------- Ontinue has discovered a new LummaC2 malware variant with increased activity, using PowerShell for initial infection and employing obfuscation and process injection to steal sensitive data. --------------------------------------------- https://hackread.com/lummac2-malware-variant-powershell-obfuscation-steal-d… ∗∗∗ Old devices, new dangers: The risks of unsupported IoT tech ∗∗∗ --------------------------------------------- Outdated devices can be easy targets, so by keeping them disconnected from the internet or discontinuing their use, you can feel safe and secure from any cyber harm through them. --------------------------------------------- https://www.welivesecurity.com/en/internet-of-things/old-devices-new-danger… ∗∗∗ CVE-2024-37079: VMware vCenter Server Integer Underflow Code Execution Vulnerability ∗∗∗ --------------------------------------------- A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted DCERPC packet to the target server. Successfully exploiting this vulnerability could lead to a heap buffer overflow, which could result in the execution of arbitrary code in the context of the vulnerable service. [..] This vulnerability was patched by the vendor in June. At the time of the patch release, there was a fair amount of attention paid to this vulnerability. However, to date, there have been no attacks detected in the wild. --------------------------------------------- https://www.thezdi.com/blog/2024/8/27/cve-2024-37079-vmware-vcenter-server-… ∗∗∗ BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks ∗∗∗ --------------------------------------------- In recent investigations, Talos Incident Response has observed the BlackByte ransomware group using techniques that depart from their established tradecraft. --------------------------------------------- https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecra… ∗∗∗ Deep Analysis of Snake Keylogger’s New Variant ∗∗∗ --------------------------------------------- We performed a deep analysis on the campaign and discovered that it delivers a new variant of Snake Keylogger. --------------------------------------------- https://feeds.fortinet.com/~/903638177/0/fortinet/blogs~Deep-Analysis-of-Sn… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (calibre, dotnet8.0, dovecot, webkit2gtk4.0, and webkitgtk), Oracle (nodejs:20), Red Hat (bind, bind and bind-dyndb-ldap, postgresql:16, and squid), Slackware (kcron and plasma), SUSE (keepalived and webkit2gtk3), and Ubuntu (drupal7). --------------------------------------------- https://lwn.net/Articles/987519/ ∗∗∗ DSA-5759-1 python3.11 - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2024/msg00172.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.08.2024
by Daily end-of-shift report 27 Aug '24

27 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Montag 26-08-2024 18:00 − Dienstag 27-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hackers infect ISPs with malware that steals customers’ credentials ∗∗∗ --------------------------------------------- Zero-day that was exploited since June to infect ISPs finally gets fixed. --------------------------------------------- https://arstechnica.com/?p=2045401 ∗∗∗ Google tags a tenth Chrome zero-day as exploited this year ∗∗∗ --------------------------------------------- Today, Google revealed that it patched the tenth zero-day exploited in the wild in 2024 by attackers or security researchers during hacking contests. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-tags-a-tenth-chrome-z… ∗∗∗ Exposed and Encrypted: Inside a Mallox Ransomware Attack ∗∗∗ --------------------------------------------- Recently, a client enlisted the support of Trustwave to investigate an unauthorized access incident within its internal cloud-based environment, leading to the deployment of Mallox ransomware by threat actors to its server. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/exposed-and… ∗∗∗ Microsoft mistake blows up admins inboxes with fake malware alerts ∗∗∗ --------------------------------------------- Legitimate emails misclassified in software snafu Updated Many administrators have had a trying Monday after getting spammed out with false malware reports by Microsoft. --------------------------------------------- https://www.theregister.com/2024/08/26/microsoft_365_email_malware/ ∗∗∗ ThreatLabz Discovers 117 Vulnerabilities in Microsoft 365 Apps Via the SketchUp 3D Library - Part 2 ∗∗∗ --------------------------------------------- In Part 1 of this series, we’ve demonstrated how ThreatLabz reverse engineered the SketchUp 3D library in Microsoft 365 as well as the SKP file format. Furthermore, we developed two effective fuzzing harnesses.Microsoft published CVE-2023-28285 and CVE-2023-29344 (in April and May of 2023, respectively) to address the vulnerabilities .. --------------------------------------------- https://www.zscaler.com/blogs/security-research/threatlabz-discovers-117-vu… ∗∗∗ A malicious Pidgin plugin ∗∗∗ --------------------------------------------- The developers of the Pidgin chat program have announced that a malicious plugin had been listed on its third-party plugins list for over one month. This plugin included a key logger and could capture screenshots. It went unnoticed at the time that the plugin was not providing any source code and was only providing binaries for download. Going forward, we will be .. --------------------------------------------- https://lwn.net/Articles/987320/ ∗∗∗ WordPress GiveWP POP to RCE (CVE-2024-5932) ∗∗∗ --------------------------------------------- A few days ago, Wordfence published a blog post about a PHP Object Injection vulnerability affecting the popular WordPress Plugin GiveWP in all versions <= 3.14.1. Since the blog post contains only information about (a part) of the POP chain used, I decided to take a look and build a fully functional Remote Code Execution exploit. This post describes .. --------------------------------------------- https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-59… ∗∗∗ 7777 Botnet – Insights into a Multi-Target Botnet ∗∗∗ --------------------------------------------- Our latest research, a collaboration between Bitsight TRACE & the security researcher Gi7w0rm, has uncovered additional details & information about the 7777 Botnet. --------------------------------------------- https://www.bitsight.com/blog/7777-botnet-insights-multi-target-botnet ∗∗∗ NFC-Malware leert Bankkonten ∗∗∗ --------------------------------------------- Phishing und Malware kombiniert ein Angreifer, um Geldautomaten Bankkarten vorzuspielen und per NFC Geld abzuheben. Beobachtet wurde das in Tschechien. --------------------------------------------- https://heise.de/-9848256 ===================== = Vulnerabilities = ===================== ∗∗∗ Moodle: Remote Code Execution via Calculated Questions ∗∗∗ --------------------------------------------- Attackers with the permission to create or modify questions in Moodle courses are able to craft malicious inputs for calculated questions, which can be abused to execute arbitrary commands on the underlying system. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-009/ ∗∗∗ ZDI-24-1182: Linux Kernel Netfilter Conntrack Type Confusion Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-1182/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- https://lwn.net/Articles/987393/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.08.2024
by Daily end-of-shift report 26 Aug '24

26 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 23-08-2024 18:00 − Montag 26-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Stealthy sedexp Linux malware evaded detection for two years ∗∗∗ --------------------------------------------- A stealthy Linux malware named sedexp has been evading detection since 2022 by using a persistence technique not yet included in the MITRE ATT&CK framework. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stealthy-sedexp-linux-malwar… ∗∗∗ BSI: Prüfung der Sicherheit von Huawei bleibt ein Staatsgeheimnis ∗∗∗ --------------------------------------------- Da die Sicherheitsinteressen Deutschlands berührt sind, legt das BSI die technische Prüfung von Huawei nicht offen. Immerhin hat Golem.de erreicht, dass die Einstufung überprüft wurde. --------------------------------------------- https://www.golem.de/news/bsi-pruefung-der-sicherheit-von-huawei-bleibt-ein… ∗∗∗ DSGVO-Verstoß: Uber soll 290 Millionen Euro Geldstrafe zahlen ∗∗∗ --------------------------------------------- Dem beliebten Fahrdienst wird vorgeworfen, mehr als zwei Jahre lang sensible Fahrerdaten bei unzureichendem Schutz in die USA übermittelt zu haben. --------------------------------------------- https://www.golem.de/news/datenuebertragung-in-die-usa-uber-soll-290-millio… ∗∗∗ From Highly Obfuscated Batch File to XWorm and Redline, (Mon, Aug 26th) ∗∗∗ --------------------------------------------- If you follow my diaries, you probably already know that one of my favorite topics around malware is obfuscation. I&#;x26;#;39;m often impressed by the crazy techniques attackers use to .. --------------------------------------------- https://isc.sans.edu/diary/From+Highly+Obfuscated+Batch+File+to+XWorm+and+R… ∗∗∗ SonicWall Issues Critical Patch for Firewall Vulnerability Allowing Unauthorized Access ∗∗∗ --------------------------------------------- SonicWall has released security updates to address a critical flaw impacting its firewalls that, if successfully exploited, could grant malicious actors unauthorized access to the devices. The vulnerability, tracked as .. --------------------------------------------- https://thehackernews.com/2024/08/sonicwall-issues-critical-patch-for.html ∗∗∗ Cisco calls for United Nations to revisit cyber-crime convention ∗∗∗ --------------------------------------------- Echoes human rights groups concerns that it could suppress free speech and more Networking giant Cisco has suggested the United Nations first-ever convention against cyber-crime is dangerously flawed and should be revised before being put to a formal vote. --------------------------------------------- https://www.theregister.com/2024/08/22/cisco_criticizes_un_cybercrime_conve… ∗∗∗ Post-Quantum Cryptography: Standards and Progress ∗∗∗ --------------------------------------------- The National Institute of Standards and Technology (NIST) just released three finalized standards for post-quantum cryptography (PQC) covering public key encapsulation and two forms of digital signatures. In progress since 2016, this achievement represents a major milestone towards standards development that will keep information on the Internet secure and confidential for many years to come. --------------------------------------------- http://security.googleblog.com/2024/08/post-quantum-cryptography-standards.… ∗∗∗ Meta blockiert Whatsapp-Konten nach Hackerangriffen ∗∗∗ --------------------------------------------- Hierbei wurde die iranische Hackergruppe APT42 ins Visier genommen --------------------------------------------- https://www.derstandard.at/story/3000000233708/meta-blockiert-whatsapp-kont… ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog for Versa Networks Director ∗∗∗ --------------------------------------------- CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of .. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/08/23/cisa-adds-one-known-expl… ∗∗∗ PEAKLIGHT: Decoding the Stealthy Memory-Only Malware ∗∗∗ --------------------------------------------- Mandiant identified a new memory-only dropper using a complex, multi-stage infection process. This memory-only dropper decrypts and executes a PowerShell-based downloader. This PowerShell-based downloader is being tracked as PEAKLIGHT. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding… ===================== = Vulnerabilities = ===================== ∗∗∗ Stable Channel Update for Desktop ∗∗∗ --------------------------------------------- http://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desk… ∗∗∗ WPS Office Security Update Advisory ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/82637/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.08.2024
by Daily end-of-shift report 23 Aug '24

23 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 22-08-2024 18:00 − Freitag 23-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Qilin ransomware now steals credentials from Chrome browsers ∗∗∗ --------------------------------------------- The Qilin ransomware group has been using a new tactic and deploys a custom stealer to steal account credentials stored in Google Chrome browser. --------------------------------------------- https://www.bleepingcomputer.com/news/security/qilin-ransomware-now-steals-… ∗∗∗ Hackers are exploiting critical bug in LiteSpeed Cache plugin ∗∗∗ --------------------------------------------- Hackers have already started to exploit the critical severity vulnerability that affects LiteSpeed Cache, a WordPress plugin used for accelerating response times, a day after technical details become public. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-criti… ∗∗∗ Warnung vor Ebola-Infektion: Uni löst mit Phishing-Test unnötige Panik aus ∗∗∗ --------------------------------------------- Studenten und Mitarbeiter der UCSC haben per E-Mail eine falsche Warnung vor einer Ebola-Infektion auf dem Campus erhalten. Der CISO der Uni entschuldigt sich. --------------------------------------------- https://www.golem.de/news/warnung-vor-ebola-infektion-phishing-test-an-eine… ∗∗∗ Mäh- und Saugroboter: Ecovacs will Spionagelücken nun doch angehen ∗∗∗ --------------------------------------------- Mehrere Mäh- und Saugroboter von Ecovacs lassen sich von Angreifern übernehmen. Erst wollte der Hersteller gar nicht patchen, doch nun kommt die Kehrtwende. --------------------------------------------- https://www.golem.de/news/hersteller-lenkt-ein-ecovacs-arbeitet-nun-doch-an… ∗∗∗ WordPress Websites Used to Distribute ClearFake Trojan Malware ∗∗∗ --------------------------------------------- Unfortunately, scams are all over the place, and anybody who has surfed the web should know this. We’ve all gotten phishing emails, or redirected to questionable websites at some point or another. Being on your guard is an important posture to take online, and part of that is knowing how to identify threats, scams, or places you shouldn’t visit .. --------------------------------------------- https://blog.sucuri.net/2024/08/wordpress-websites-used-to-distribute-clear… ∗∗∗ Chinese Hackers Exploit Zero-Day Cisco Switch Flaw to Gain System Control ∗∗∗ --------------------------------------------- Details have emerged about a China-nexus threat groups exploitation of a recently disclosed, now-patched security flaw in Cisco switches as a zero-day to seize control of the appliances and evade detection.The activity, attributed to Velvet Ant, was .. --------------------------------------------- https://thehackernews.com/2024/08/chinese-hackers-exploit-zero-day-cisco.ht… ∗∗∗ Halliburton probes an issue disrupting business ops ∗∗∗ --------------------------------------------- What could the problem be? Reportedly, a cyberattack American oil giant Halliburton is investigating an "issue," reportedly a cyberattack, that has disrupted some business operations and global networks. --------------------------------------------- https://www.theregister.com/2024/08/22/halliburton_investigates_incident_am… ∗∗∗ Bling Libra’s Tactical Evolution: The Threat Actor Group Behind ShinyHunters Ransomware ∗∗∗ --------------------------------------------- We analyze a recent incident by Bling Libra, the group behind ShinyHunters ransomware as they shift from data theft to extortion, exploiting AWS credentials. --------------------------------------------- https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/ ∗∗∗ CrowdStrike Outage Timeline and Analysis ∗∗∗ --------------------------------------------- Bitsights analysis of the CrowdStrike outage and timeline mysteries. --------------------------------------------- https://www.bitsight.com/blog/crowdstrike-outage-timeline-and-analysis ∗∗∗ A Global Treaty to Fight Cybercrime—Without Combating Mercenary Spyware: Article by Kate Robertson in Lawfare ∗∗∗ --------------------------------------------- In an article for Lawfare, the Citizen Labs senior research associate Kate Robertson analyzes how, in its current form, the draft treaty is poised "to become a vehicle for complicity in the global mercenary spy trade." --------------------------------------------- https://citizenlab.ca/2024/08/a-global-treaty-to-fight-cybercrime-without-c… ===================== = Vulnerabilities = ===================== ∗∗∗ SonicOS Improper Access Control Vulnerability ∗∗∗ --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.08.2024
by Daily end-of-shift report 22 Aug '24

22 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-08-2024 18:00 − Donnerstag 22-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Google fixes ninth Chrome zero-day exploited in attacks this year ∗∗∗ --------------------------------------------- Today, Google released a new Chrome emergency security update to patch a zero-day vulnerability, the ninth one tagged as exploited this year. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-fixes-tenth-actively-… ∗∗∗ U.S. charges Karakurt extortion gang’s “cold case” negotiator ∗∗∗ --------------------------------------------- A member of the Russian Karakurt ransomware group has been charged in the U.S. for money laundering, wire fraud, and extortion crimes. --------------------------------------------- https://www.bleepingcomputer.com/news/legal/us-charges-karakurt-extortion-g… ∗∗∗ Löschpflicht und Sicherheitslücken: Bußgelder wegen Datenschutzverstößen häufen sich ∗∗∗ --------------------------------------------- In Hamburg wurden bereits jetzt mehr Bußgeldverfahren wegen Datenschutzverstößen abgeschlossen als im Kalenderjahr 2023. Die Strafen sind mitunter hoch. --------------------------------------------- https://www.golem.de/news/loeschpflicht-und-sicherheitsluecken-bussgelder-w… ∗∗∗ Memory corruption vulnerabilities in Suricata and FreeRDP ∗∗∗ --------------------------------------------- While pentesting KasperskyOS-based Thin Client and IoT Secure Gateway, we found several vulnerabilities in the Suricata and FreeRDP open-source projects. We shared details on these vulnerabilities with the community along with our fuzzer. --------------------------------------------- https://securelist.com/suricata-freerdp-memory-corruption/113489/ ∗∗∗ Windows Security best practices for integrating and managing security tools ∗∗∗ --------------------------------------------- We examine the recent CrowdStrike outage and provide a technical overview of the root cause. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2024/07/27/windows-security-b… ∗∗∗ Understanding the ‘Morphology’ of Ransomware: A Deeper Dive ∗∗∗ --------------------------------------------- Ransomware isnt just about malware. Its about brands, trust, and the shifting allegiances of cybercriminals. --------------------------------------------- https://www.securityweek.com/understanding-the-morphology-of-ransomware-a-d… ∗∗∗ Recall: Microsofts umstrittenes "Überwachungs"-Feature kommt zurück ∗∗∗ --------------------------------------------- Nach heftigen Sicherheitsbedenken will das Unternehmen bei der neuen KI-Funktion nachgebessert haben --------------------------------------------- https://www.derstandard.at/story/3000000233374/recall-microsofts-umstritten… ∗∗∗ BLUUID: Firewallas, Diabetics, And… Bluetooth ∗∗∗ --------------------------------------------- Dive into the fascinating and overlooked realm of Bluetooth Low Energy (BTLE) security in GreyNoise Labs latest blog post. Learn techniques for remote device identification, uncover vulnerabilities, and explore the broader implications for IoT and healthcare. --------------------------------------------- https://www.greynoise.io/blog/bluuid-firewallas-diabetics-and-bluetooth ∗∗∗ PEAKLIGHT: Decoding the Stealthy Memory-Only Malware ∗∗∗ --------------------------------------------- Mandiant identified a new memory-only dropper using a complex, multi-stage infection process. This memory-only dropper decrypts and executes a PowerShell-based downloader. This PowerShell-based downloader is being tracked as PEAKLIGHT.OverviewMandiant Managed Defense identified a memory-only dropper and downloader delivering .. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding… ∗∗∗ Angreifer können Ciscos VoIP-System Unified Communications Manager lahmlegen ∗∗∗ --------------------------------------------- Aufgrund von Sicherheitslücken sind Attacken auf mehrere Cisco-Produkte möglich. Updates sind verfügbar. --------------------------------------------- https://heise.de/-9843447 ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Unified Communications Manager Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Unified Communications Manager Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Atlassian Jira August 2024 Security Update Advisory ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/82562/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.08.2024
by Daily end-of-shift report 21 Aug '24

21 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-08-2024 18:00 − Mittwoch 21-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ CrowdStrike unhappy with “shady commentary” from competitors after outage ∗∗∗ --------------------------------------------- Botched update leads to claims that competitors are "ambulance chasing." --------------------------------------------- https://arstechnica.com/?p=2044431 ∗∗∗ GitHub Enterprise Server vulnerable to critical auth bypass flaw ∗∗∗ --------------------------------------------- A critical vulnerability affecting multiple versions of GitHub Enterprise Server could be exploited to bypass authentication and enable an attacker to gain administrator privileges on the machine. --------------------------------------------- https://www.bleepingcomputer.com/news/security/github-enterprise-server-vul… ∗∗∗ Großer Chipkonzern: Cyberangriff stört Produktion von Microchip Technology ∗∗∗ --------------------------------------------- Die Produktionskapazitäten des Chipherstellers sind derzeit eingeschränkt. Ursache ist eine Cyberattacke, deren Ausmaß aktuell untersucht wird. --------------------------------------------- https://www.golem.de/news/grosser-chipkonzern-cyberangriff-stoert-produktio… ∗∗∗ Sicherheitsprobleme: Lastenrad-Skandal weitet sich aus ∗∗∗ --------------------------------------------- Niederländische Verbraucherschützer untersuchen weitere Lastenradhersteller, weil dort ebenfalls gravierende Mängel aufgetreten sind. --------------------------------------------- https://www.golem.de/news/sicherheitsprobleme-lastenrad-skandal-weitet-sich… ∗∗∗ Plane tracker FlightAware admits user passwords, SSNs exposed for years ∗∗∗ --------------------------------------------- Notification omits a number of key details Popular flight-tracking app FlightAware has admitted that it was exposing a bunch of users data for more than three years. --------------------------------------------- https://www.theregister.com/2024/08/20/flightaware_data_exposure/ ∗∗∗ An AWS Configuration Issue Could Expose Thousands of Web Apps ∗∗∗ --------------------------------------------- Amazon has updated its instructions for how customers should more securely implement AWSs traffic-routing service known as Application Load Balancer, but its not clear everyone will get the memo. --------------------------------------------- https://www.wired.com/story/aws-application-load-balancer-implementation-co… ∗∗∗ Teach a Man to Phish ∗∗∗ --------------------------------------------- I decided to give away all of my phishing secrets for free. I realized at some point that I have been giving away phishing secrets for years, but only to select individuals, and only one at a time. That method of knowledge dissemination is terribly inefficient! So here it is, I’ve written it down for you instead. --------------------------------------------- https://posts.specterops.io/teach-a-man-to-phish-43528846e382 ∗∗∗ CISA Adds Four Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/08/21/cisa-adds-four-known-exp… ∗∗∗ CPU-Sicherheitsleck Sinkclose: Firmware-Update auch für AMDs Ryzen 3000 ∗∗∗ --------------------------------------------- Die CPU-Sicherheitslücke "Sinkclose" ermöglicht Angreifern das Einschleusen von Schadcode. Für ältere CPUs waren erst keine Updates geplant. --------------------------------------------- https://heise.de/-9842780 ===================== = Vulnerabilities = ===================== ∗∗∗ Unauthenticated information leak in Bosch IP cameras ∗∗∗ --------------------------------------------- BOSCH-SA-659648: A vulnerability was discovered in internal testing of Bosch IP cameras of families CPP13 and CPP14, that allows an unauthenticated attacker to retrieve video analytics event data. No video data is leaked through this vulnerability. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-659648.html ∗∗∗ DSA-5752-1 dovecot - security update ∗∗∗ --------------------------------------------- https://lists.debian.org/debian-security-announce/2024/msg00165.html ∗∗∗ [20240803] - Core - XSS in HTML Mail Templates ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/944-20240803-core-xss-in-h… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.08.2024
by Daily end-of-shift report 20 Aug '24

20 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Montag 19-08-2024 18:00 − Dienstag 20-08-2024 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows driver zero-day exploited by Lazarus hackers to install rootkit ∗∗∗ --------------------------------------------- The notorious North Korean Lazarus hacking group exploited a zero-day flaw in the Windows AFD.sys driver to elevate privileges and install the FUDModule rootkit on targeted systems. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/windows-driver-zero-day-exp… ∗∗∗ Solaranlagen und die Cloud: Entwickler befürchtet Kollaps europäischer Stromnetze ∗∗∗ --------------------------------------------- Moderne Solaranlagen sind häufig mit Clouddiensten der Hersteller verbunden. Ein Entwickler sieht darin eine große Gefahr für unsere Energieversorgung. --------------------------------------------- https://www.golem.de/news/solaranlagen-und-die-cloud-entwickler-befuerchtet… ∗∗∗ Approach to mainframe penetration testing on z/OS ∗∗∗ --------------------------------------------- We explain how mainframes work, potential attack vectors, and what to focus on when pentesting such systems. --------------------------------------------- https://securelist.com/zos-mainframe-pentesting/113427/ ∗∗∗ Hacking Wireless Bicycle Shifters ∗∗∗ --------------------------------------------- This is yet another insecure Internet-of-things story, this one about wireless gear shifters for bicycles. These gear shifters are used in big-money professional bicycle races like the Tour de France, which provides an incentive to actually .. --------------------------------------------- https://www.schneier.com/blog/archives/2024/08/hacking-wireless-bicycle-shi… ∗∗∗ Ransomware Victims Paid $460 Million in First Half of 2024 ∗∗∗ --------------------------------------------- Ransomware payments in H1 2024 totaled nearly $460 million and $1.58 billion have been stolen in cryptocurrency heists. --------------------------------------------- https://www.securityweek.com/ransomware-victims-paid-460-million-in-first-h… ∗∗∗ Critical Flaw in Donation Plugin Exposed 100,000 WordPress Sites to Takeover ∗∗∗ --------------------------------------------- A critical vulnerability in the GiveWP WordPress plugin could be exploited for remote code execution and arbitrary file deletion. --------------------------------------------- https://www.securityweek.com/critical-flaw-in-donation-plugin-exposed-10000… ∗∗∗ Navigating the Uncharted: A Framework for Attack Path Discovery ∗∗∗ --------------------------------------------- This is the second post in a series on Identity-Driven Offensive Tradecraft, which is also the focus of the new course we will launch in October. In the previous post, I asked, “How does one discover and abuse new attack paths?” To start answering .. --------------------------------------------- https://posts.specterops.io/navigating-the-uncharted-a-framework-for-attack… ∗∗∗ Selling Ransomware Breaches: 4 Trends Spotted on the RAMP Forum ∗∗∗ --------------------------------------------- The sale and purchase of unauthorized access to compromised enterprise networks has become a linchpin for cybercriminal operations, particularly in facilitating ransomware attacks. --------------------------------------------- https://www.rapid7.com/blog/post/2024/08/20/selling-ransomware-breaches-4-t… ∗∗∗ Challenges in Automating and Scaling Remote Vulnerability Detection ∗∗∗ --------------------------------------------- We cover investments that Bitsight is making to greatly scale out our vulnerability coverage in record time through automation. --------------------------------------------- https://www.bitsight.com/blog/challenges-automating-and-scaling-remote-vuln… ∗∗∗ Österreichs Innenminister will Messenger ausspionieren ∗∗∗ --------------------------------------------- Österreichs Geheimdienste sollen mehr Befugnisse erhalten, Malware einschleusen und WLAN-Catcher nutzen dürfen. Das beantragt die Regierungspartei ÖVP. --------------------------------------------- https://heise.de/-9840256 ∗∗∗ Softwareentwicklung: Schadcode-Attacken auf Jenkins-Server beobachtet ∗∗∗ --------------------------------------------- Derzeit nutzen Angreifer eine kritische Lücke im Software-System Jenkins aus. Davon sind auch Instanzen in Deutschland bedroht. --------------------------------------------- https://heise.de/-9840463 ===================== = Vulnerabilities = ===================== ∗∗∗ SolarWinds Product Security Update Advisory (CVE-2024-28986) ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/82529/ ∗∗∗ Intel Family Security Update Advisory ∗∗∗ --------------------------------------------- https://asec.ahnlab.com/en/82531/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.08.2024
by Daily end-of-shift report 19 Aug '24

19 Aug '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-08-2024 18:00 − Montag 19-08-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Nachbetrachtung: Windows und die TCP-IP-Schwachstelle CVE-2024-38063 ∗∗∗ --------------------------------------------- Zum 13. August 2024 wurde die 0-day-Schwachstelle CVE-2024-38063 in Windows bekannt. Es handelt sich um eine Remote-Code-Execution-Schwachstelle in der TCP/IP-Implementierung von Windows steckt. Angreifer können über IPv6-Pakete einen Host kompromittieren und dort Code ausführen. Weben der Bewertung mit dem CVEv3 Score 9.8 (critical, "Exploitation More Likely") empfiehlt Redmond Administratoren momentan IPv6 zu deaktivieren, hat aber auch Sicherheitsupdates für Windows bereitgestellt. Hier sollten Administratoren also reagieren. --------------------------------------------- https://www.borncity.com/blog/2024/08/16/nachbetrachtung-windows-und-die-tc… ∗∗∗ Technical Analysis: CVE-2024-38021 ∗∗∗ --------------------------------------------- Recently, Morphisec researchers discovered a vulnerability in Microsoft Outlook that can lead to remote code execution (RCE). This vulnerability, identified as CVE-2024-38021, highlights a significant security flaw within the Microsoft Outlook application, potentially allowing attackers to execute arbitrary code without requiring prior authentication. --------------------------------------------- https://blog.morphisec.com/technical-analysis-cve-2024-38021 ∗∗∗ New Mad Liberator gang uses fake Windows update screen to hide data theft ∗∗∗ --------------------------------------------- A new data extortion group tracked as Mad Liberator is targeting AnyDesk users and runs a fake Microsoft Windows update screen to distract while exfiltrating data from the target device. [..] It is unclear how the threat actor selects its targets but one theory, although yet to be proven, is that Mad Liberator tries potential addresses (AnyDesk connection IDs) until someone accepts the connection request. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-mad-liberator-gang-uses-… ∗∗∗ Chrome will redact credit cards, passwords when you share Android screen ∗∗∗ --------------------------------------------- While the flag doesn't work at the moment, it is supposed to hide sensitive form fields present on the page by redacting the entire screen. It's unclear when the feature will be rolled out to everyone in Chrome for Android, but you'll be able to try the feature in Chrome Canary in the next few weeks. --------------------------------------------- https://www.bleepingcomputer.com/news/google/chrome-will-redact-credit-card… ∗∗∗ AMD knickt ein: Ryzen 3000 erhält nun doch Patch gegen Sinkclose-Lücke ∗∗∗ --------------------------------------------- Ursprünglich wollte AMD Ryzen-3000-CPUs nicht gegen die Sinkclose-Lücke patchen. Nach reichlich Unmut in der Community folgt nun die Kehrtwende. --------------------------------------------- https://www.golem.de/news/amd-knickt-ein-ryzen-3000-erhaelt-nun-doch-patch-… ∗∗∗ Verbesserung der Netzwerksicherheit: Überwachung der Client-Kommunikation mit Velociraptor ∗∗∗ --------------------------------------------- SEC Defence, die Managed Incident Response-Einheit von SEC Consult, hat eine Reihe von Velociraptor-Artefakten entwickelt, die es ermöglichen, die aktuelle Netzwerkkommunikation auf registrierten Clients zu überwachen und bei bestimmten Verbindungen zu alarmieren, z. B. zu bekannten bösartigen IP-Adressen oder Verbindungen, die von bekannten bösartigen Prozessen erstellt wurden. --------------------------------------------- https://sec-consult.com/de/blog/detail/verbesserung-der-netzwerksicherheit-… ∗∗∗ Xeon Sender Tool Exploits Cloud APIs for Large-Scale SMS Phishing Attacks ∗∗∗ --------------------------------------------- Malicious actors are using a cloud attack tool named Xeon Sender to conduct SMS phishing and spam campaigns on a large scale by abusing legitimate services."Attackers can use Xeon to send messages through multiple software-as-a-service (SaaS) providers using valid credentials for the service providers," SentinelOne security researcher Alex Delamotte said in a report shared with The Hacker News. --------------------------------------------- https://thehackernews.com/2024/08/xeon-sender-tool-exploits-cloud-apis.html ∗∗∗ Microsoft Azure: Ab 15. Oktober 2024 MFA für Administratoren verpflichtend, aber "Aufschub" möglich ∗∗∗ --------------------------------------------- Microsoft hat gerade im M365 Admin-Nachrichten-Center bekannt gegeben, dass man bei Azure ab dem 15.10.2024 die Authentifizierung der Administratoren über MFA verlangt. Redmond gewährt aber Administratoren die Möglichkeit, diese Verpflichtung um insgesamt 5 Monate zu verschieben. --------------------------------------------- https://www.borncity.com/blog/2024/08/17/microsoft-azure-ab-15-oktober-2024… ∗∗∗ Unmasking Styx Stealer: How a Hacker’s Slip Led to an Intelligence Treasure Trove ∗∗∗ --------------------------------------------- The case of Styx Stealer is a compelling example of how even sophisticated cybercriminal operations can slip up due to basic security oversights. The creator of Styx Stealer revealed his personal details, including Telegram accounts, emails, and contacts, by debugging the stealer on his own computer with a Telegram bot token provided by a customer involved in the Agent Tesla campaign. This critical OpSec failure not only compromised his anonymity but also provided valuable intelligence about other cybercriminals, including the originator of the Agent Tesla campaign. --------------------------------------------- https://research.checkpoint.com/2024/unmasking-styx-stealer-how-a-hackers-s… ∗∗∗ "WireServing" Up Credentials: Escalating Privileges in Azure Kubernetes Services ∗∗∗ --------------------------------------------- Mandiant disclosed this vulnerability to Microsoft via the MSRC vulnerability disclosure program, and Microsoft has fixed the underlying issue. [..] Adopting a process to create restrictive NetworkPolicies that allow access only to required services prevents this entire attack class. Privilege escalation via an undocumented service is prevented when the service cannot be accessed at all. --------------------------------------------- https://cloud.google.com/blog/topics/threat-intelligence/escalating-privile… ∗∗∗ Bericht: Pixel-Handys mit heimlicher, aber inaktiver Fernwartung ausgeliefert ∗∗∗ --------------------------------------------- Pixel-Smartphones wurden auf Wunsch Verizons mit Fernwartungssoftware ausgeliefert. Wenn aktiviert, kann sie unsicheren Code nachladen. --------------------------------------------- https://heise.de/-9836726 ∗∗∗ Jetzt patchen! Schadcode-Attacken auf Solarwinds Web Help Desk beobachtet ∗∗∗ --------------------------------------------- Angreifer nutzen derzeit eine kritische Schwachstelle Solarwinds Web Help Desk aus. Ein Sicherheitspatch ist verfügbar, kann aber mitunter für Probleme sorgen. --------------------------------------------- https://heise.de/-9838566 ∗∗∗ SIM-Swapping bleibt in Deutschland Randphänomen ∗∗∗ --------------------------------------------- Zahlreiche Medien warnen vor Schäden durch SIM-Swapping. Die Betrugsmasche bleibt in Deutschland jedoch selten. --------------------------------------------- https://heise.de/-9839531 ===================== = Vulnerabilities = ===================== ∗∗∗ Mehrere Sicherheitsschwachstellen in IDOL2 (uciIDOL) ∗∗∗ --------------------------------------------- Fünf schwerwiegende Sicherheitsschwachstellen wurden in der Zeiterfassungssoftware IDOL2 (uciIDOL) identifiziert. Sie ermöglichen es, die verschlüsselte Kommunikation zwischen Client und Server vollständig zu kompromittieren. Außerdem erlauben sie Remote Code Execution sowohl auf Client- als auch auf Serverseite. --------------------------------------------- https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-idol-… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-asyncssh), Fedora (bind, bind-dyndb-ldap, httpd, and tor), SUSE (cosign, cpio, curl, expat, java-11-openjdk, ncurses, netty, netty-tcnative, opera, python-Django, python-Pillow, shadow, sudo, and wpa_supplicant), and Ubuntu (firefox). --------------------------------------------- https://lwn.net/Articles/986225/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2024-0004 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2024-0004.html ∗∗∗ F5: K000140732: BIND vulnerability CVE-2024-1737 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000140732 ∗∗∗ Kubernetes: CVE-2024-7646 ∗∗∗ --------------------------------------------- https://github.com/kubernetes/kubernetes/issues/126744 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily August 2024