Daily

daily@lists.cert.at

1 participants
3211 discussions

Tageszusammenfassung - 03.05.2018
by Daily end-of-shift report 03 May '18

03 May '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-05-2018 18:00 − Donnerstag 03-05-2018 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Notfall-Hotline für von Cybercrime betroffene Unternehmen in Wien ∗∗∗ --------------------------------------------- Anzeigen wegen Cybercrime-Delikten sind im Vorjahr in Österreich um rund 28 Prozent gestiegen. ... Die WK Wien startete deshalb eine Notfall-Hotline für betroffene Unternehmen. --------------------------------------------- http://derstandard.at/2000079106868 ∗∗∗ Threat Roundup for April 20-27 ∗∗∗ --------------------------------------------- Today, Talos is publishing a glimpse into the most prevalent threats weve observed between April 20 and 27. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics, indicators of compromise... --------------------------------------------- http://blog.talosintelligence.com/2018/04 /threat-round-up-0420-0427.html ∗∗∗ Betrug mit gefälschter Microsoft-Warnung ∗∗∗ --------------------------------------------- Mit einer gefälschten Microsoft-Warnung fordern Kriminelle von Konsument/innen, dass sie telefonisch Kontakt mit einem Support-Center aufnehmen. Es teilt ihnen mit, dass ihr Computer mit Schadsoftware befallen sei. Aus diesem Grund sollen sie ein Programm herunterladen und für die Hilfestellung bezahlen. Kommen die Konsument/innen den Aufforderungen nach, verlieren sie Geld und infizieren ihr Endgerät mit Schadsoftware. --------------------------------------------- https://www.watchlist-internet.at/news /betrug-mit-gefaelschter-microsoft-warnung/ ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Releases Security Updates ∗∗∗ --------------------------------------------- Cisco has released updates to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. NCCIC encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates: * WebEx Advanced Recording Format Remote Code Execution Vulnerability cisco-sa-20180502-war * Prime File Upload Servlet Path Traversal and Remote Code Execution Vulnerability cisco-sa-20180502-prime-upload * Secure Access Control System Remote Code Execution Vulnerability cisco-sa-20180502-acs1 * Wireless LAN Controller 802.11 Management Frame Denial-of-Service Vulnerability cisco-sa-20180502-wlc-mfdos * Wireless LAN Controller IP Fragment Reassembly Denial-of-Service Vulnerability cisco-sa-20180502-wlc-ip * Meeting Server Remote Code Execution Vulnerability cisco-sa-20180502-cms-cx * Aironet 1810, 1830, and 1850 Series Access Points Point-to-Point Tunneling Protocol Denial-of-Service Vulnerability cisco-sa-20180502-ap-ptp * Aironet 1800, 2800, and 3800 Series Access Points Secure Shell Privilege Escalation Vulnerability cisco-sa-20180502-aironet-ssh --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2018/05/02 /Cisco-Releases-Security-Updates ∗∗∗ Weitere Spectre-Lücken im Anflug ∗∗∗ --------------------------------------------- Ganze acht neue Sicherheitslücken in Intel-CPUs haben mehrere Forscher-Teams dem Hersteller bereits gemeldet, die aktuell noch geheimgehalten werden. ... Die konkrete Gefahr für Privatleute und Firmen-PCs ist hingegen eher gering, weil es dort in aller Regel andere, einfacher auszunutzende Schwachstellen gibt. Trotzdem sollte man sie ernst nehmen und die anstehenden Spectre-NG-Updates nach deren Erscheinen zügig einspielen. --------------------------------------------- https://heise.de/-4039134 ∗∗∗ Kritische Sicherheitslücke in Oracle Access Manager - Updates verfügbar ∗∗∗ --------------------------------------------- Kritische Sicherheitslücke in Oracle Access Manager - Updates verfügbar 3. Mai 2018 Beschreibung Das IT-Security Consulting Unternehmen SEC-Consult hat eine kritische Sicherheitslücke in der verbreiteten Software Oracle Access Manager (OAM) entdeckt, die in vielen Umgebungen für Single-Sign-On und andere Login-Szenarios verwendet wird. CVE-Nummer: CVE-2018-2879 Auswirkungen Angreifer können sich durch Ausnutzen der Lücke mit beliebigen Accounts (auch --------------------------------------------- http://www.cert.at/warnings/all/20180503.html ∗∗∗ Docker für Windows: Microsoft patcht Go-Bibliothek hcsshim ∗∗∗ --------------------------------------------- Wer Docker zur Containervirtualisierung unter Windows nutzt oder selbst Go-Programme entwickelt, sollte dringend die Aktualität des "Windows Host Compute Service Shim" (hcsshim)-Packages auf seinem System überprüfen. --------------------------------------------- https://heise.de/-4040139 ∗∗∗ SSA-546832 (Last Update: 2018-05-03): Vulnerabilities in Medium Voltage SINAMICS Products ∗∗∗ --------------------------------------------- The latest updates for medium voltage SINAMICS products fix two security vulnerabilities that could allow an attacker to cause a Denial-of-Service condition either via specially crafted PROFINET DCP broadcast packets or by sending specially crafted packets to port 161/udp (SNMP). Precondition for the PROFINET DCP scenario is a direct Layer 2 access to the affected products. PROFIBUS interfaces are not affected. --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-546832.pdf ∗∗∗ SSA-468514 (Last Update: 2018-05-03): Improper Certificate Validation Vulnerability in Siveillance VMS Video Mobile App for Android and iOS ∗∗∗ --------------------------------------------- The latest update for the Siveillance VMS Video mobile app for Android and iOS fixes a security vulnerability that could allow an attacker in a privileged network position to read data from and write data to the encrypted communication channel between the app and a server. Precondition for this scenario is that an attacker is able to intercept the communication channel between the affected app and a server, and is also able to generate a certificate that results for the validation algorithm in --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-468514.pdf ∗∗∗ SSA-457058 (Last Update: 2018-05-03): .NET Security Vulnerability in Siveillance VMS ∗∗∗ --------------------------------------------- Siemens has released software updates for Siveillance VMS which fix a security vulnerability with the .NET Remoting deserialization that could allow elevation of privileges and/or causing a Denial-of-Service, if affected ports are exposed. --------------------------------------------- https://cert-portal.siemens.com/productcert/pdf/ssa-457058.pdf ∗∗∗ HPESBHF03841 rev.1 - Certain HPE Servers with AMD-based Processors, Multiple Vulnerabilities (Fallout/Masterkey) ∗∗∗ --------------------------------------------- Several HPE servers that use AMD processors are vulnerable to security defects (Fallout/Masterkey) which allow local unauthorized elevation of privilege, unauthorized modification of information, unauthorized disclosure of information, and Denial of Service. --------------------------------------------- https://support.hpe.com/hpsc/doc/public /display?docLocale=en_US&docId=emr_na-hpesbhf03841en_us ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, java-1.7.0-openjdk, java-1.8.0-openjdk, librelp, patch, and python-paramiko), Debian (kernel and quassel), Gentoo (chromium, hesiod, and python), openSUSE (corosync, dovecot22, libraw, patch, and squid), Oracle (java-1.7.0-openjdk), Red Hat (go-toolset-7 and go-toolset-7-golang, java-1.7.0-openjdk, and rh-php70-php), and SUSE (corosync and patch). --------------------------------------------- https://lwn.net/Articles/753457/ ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK IBM Rational Software Architect and Rational Software Architect for WebSphere Software. ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015990 ∗∗∗ IBM Security Bulletin: Information Disclosure in WebSphere Application Server (CVE-2017-1743) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22013601 ∗∗∗ IBM Security Bulletin: Jnuary 2017 OpenSSL Vulnerabilities affect Multiple N series Products ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012311 ∗∗∗ IBM Security Bulletin: ISC DHCP vulnerability affects TS4500 Tape Library (CVE-2018-5732) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1012247 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.05.2018
by Daily end-of-shift report 02 May '18

02 May '18

===================== = End-of-Day report = ===================== Timeframe: Montag 30-04-2018 18:00 − Mittwoch 02-05-2018 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Millionen Autos von Volkswagen und Audi können gehackt werden ∗∗∗ --------------------------------------------- Zwei Sicherheitsforscher haben eine Sicherheitslücke entdeckt, die zahlreiche populäre Fahrzeuge betrifft. --------------------------------------------- https://futurezone.at/digital-life/millionen-autos-von-volkswagen-und-audi-… ∗∗∗ Security baseline for Windows 10 “April 2018 Update” (v1803) – FINAL ∗∗∗ --------------------------------------------- Microsoft is pleased to announce the final release of the security configuration baseline settings for Windows 10 “April 2018 Update,” also known as version 1803, “Redstone 4,” or RS4. Download the .. --------------------------------------------- https://blogs.technet.microsoft.com/secguide/2018/04/30/security-baseline-f… ∗∗∗ 7-Zip: From Uninitialized Memory to Remote Code Execution ∗∗∗ --------------------------------------------- After my previous post on the 7-Zip bugs CVE-2017-17969 and CVE-2018-5996, I continued to spend time on analyzing antivirus software. As it happens, I found a new bug that (as the last two bugs) .. --------------------------------------------- https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-e… ∗∗∗ Jetzt absichern! Oracle WebLogic Server im Visier von Angreifern ∗∗∗ --------------------------------------------- Sicherheitsforscher beobachten vermehrt Scans nach verwundbaren WebLogic Servern. Updates stehen bereit – Angreifer sollen den Schutz jedoch umgehen können. --------------------------------------------- https://www.heise.de/meldung/Jetzt-absichern-Oracle-WebLogic-Server-im-Visi… ∗∗∗ Windows 10 1803 ohne Microcode-Updates gegen Spectre V2 ∗∗∗ --------------------------------------------- Die Installation des Windows 10 April 2018 Update verdrängt Microcode-Updates für Intel-Prozessoren aus dem Update KB4090007, die vor der Sicherheitslücke Spectre V2 schützen - man braucht also wieder BIOS-Updates. --------------------------------------------- https://www.heise.de/meldung/Windows-10-1803-ohne-Microcode-Updates-gegen-S… ∗∗∗ Spammer missbrauchen ungefilterte Redirects in Google Maps ∗∗∗ --------------------------------------------- Kriminelle nutzen Googles Online-Kartendienst Maps, um Opfer mittels offener Redirects auf gefährliche Irrwege zu führen. Das Unternehmen weiß um das Problem, scheint aber bislang keinen Handlungsbedarf zu sehen. --------------------------------------------- https://www.heise.de/meldung/Spammer-missbrauchen-ungefilterte-Redirects-in… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (cups-filters, ghostscript, glusterfs, PackageKit, qpdf, and xen), Mageia (anki, libofx, ming, sox, webkit2, and xdg-user-dirs), Oracle (corosync, java-1.7.0-openjdk, and pcs), Red Hat (java-1.7.0-openjdk), Scientific Linux (corosync, firefox, gcc, glibc, golang, java-1.7.0-openjdk, java-1.8.0-openjdk, .. --------------------------------------------- https://lwn.net/Articles/753257/ ===================== = Vulnerabilities = ===================== ∗∗∗ Bugtraq: CA20180501-01: Security Notice for CA Spectrum ∗∗∗ --------------------------------------------- http://www.securityfocus.com/archive/1/541977 ∗∗∗ Vuln: PHP CVE-2018-10547 Incomplete Fix Cross Site Scripting Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/104020 ∗∗∗ Security Advisory - Two Vulnerabilities in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171018-… ∗∗∗ Security Advisory - DoS Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20171201-… ∗∗∗ IBM Security Bulletin: Vulnerabilities in cURL component shipped with IBM Rational ClearCase (CVE-2018-1000005, CVE-2018-1000007) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22014495 ∗∗∗ IBM Security Bulletin: API Connect is affected by an information leakage vulnerability (CVE-2018-1468) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015968 ∗∗∗ IBM SECURITY BULLETIN: Multiple vulnerabilities in IBM Java Runtime affect IBM QRadar SIEM. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015825 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.04.2018
by Daily end-of-shift report 30 Apr '18

30 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-04-2018 18:00 − Montag 30-04-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Issue with BitLocker/DMA setting in Windows 10 “Fall Creators Update” (v1709) ∗∗∗ --------------------------------------------- Update, 27 April 2018: The problem described in this post has been fixed in the April 2018 quality update. Customers that deployed Microsoft’s security baseline for Windows 10 v1709 might have experienced device and component failures. The .. --------------------------------------------- https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlocke… ∗∗∗ FacexWorm Targets Cryptocurrency Trading Platforms, Abuses Facebook Messenger for Propagation ∗∗∗ --------------------------------------------- Our Cyber Safety Solutions team identified a malicious Chrome extension we named FacexWorm, which uses a miscellany of techniques to target cryptocurrency trading platforms accessed on an affected browser and .. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/facexworm-targe… ∗∗∗ Please don’t buy this: smart toys ∗∗∗ --------------------------------------------- Smart toys attempt to offer what a lot of us imagined as kids—a toy that we can not only play with, but one that plays back. Many models offer voice recognition, facial expressions, hundreds of words and phrases, reaction to touch and impact, and even the ability to learn and retain new information. These .. --------------------------------------------- https://blog.malwarebytes.com/security-world/2018/04/please-dont-buy-smart-… ∗∗∗ Bundesheer-Hacker nahmen an Nato-Übung teil ∗∗∗ --------------------------------------------- In Tallinn wurde geprobt, wie Cyberangriffe abgewehrt werden können --------------------------------------------- http://derstandard.at/2000078919316 ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4181 roundcube - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4181 ∗∗∗ DSA-4182 chromium-browser - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4182 ∗∗∗ DSA-4186 gunicorn - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4186 ∗∗∗ DSA-4185 openjdk-8 - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4185 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.04.2018
by Daily end-of-shift report 27 Apr '18

27 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 26-04-2018 18:00 − Freitag 27-04-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ PyRoMine Uses NSA Exploit for Monero Mining and Backdoors ∗∗∗ --------------------------------------------- Not just a miner, the malware also sets up a hidden default account with system administrator privileges, to be used for re-infection and further attacks. --------------------------------------------- http://threatpost.com/pyromine-uses-nsa-exploit-for-monero-mining-and-backd… ∗∗∗ Analysis of a Malicious Blackhat SEO Script ∗∗∗ --------------------------------------------- An enormous number of SEO spam infections are handled by us here at Sucuri. In our most recent hacked website trend report, we analyzed over 34,000+ websites and identified that 44% of all website infection cases were misused for SEO spam campaigns. Once a website has been compromised, attackers often use it to distribute malware, host phishing .. --------------------------------------------- https://blog.sucuri.net/2018/04/analysis-of-a-malicious-blackhat-seo-script… ∗∗∗ GravityRAT malware takes your systems temperature ∗∗∗ --------------------------------------------- The GravityRAT malware, discovered by Cisco Talos researchers, gives some interesting insight .. --------------------------------------------- https://www.virusbulletin.com:443/blog/2018/04/gravityrat-malware-takes-you… ∗∗∗ Phishing für Anspruchsvolle: [A]pache-Kit klont beliebte Online-Shops ∗∗∗ --------------------------------------------- Mitarbeiter des Sicherheitssoftware-Herstellers Check Point haben ein brasilianisches Phishing-Kit unter die Lupe genommen, das zum Abgreifen von Adress- und Kreditkartendaten voll funktionsfähige Marken-Shops imitiert. --------------------------------------------- https://www.heise.de/meldung/Phishing-fuer-Anspruchsvolle-A-pache-Kit-klont… ∗∗∗ Achtung vor Datendiebstahl auf Kleinanzeigenportalen! ∗∗∗ --------------------------------------------- Kleinanzeigenportale bieten eine hervorragende Möglichkeit Altes zu Geld zu machen oder das ein oder andere Schnäppchen abzustauben. Die Marktplätze erfreuen sich daher großer Beliebtheit, doch .. --------------------------------------------- http://www.watchlist-internet.at/index.php?id=71&tx_news_pi1[news]=3065&tx_… ===================== = Vulnerabilities = ===================== ∗∗∗ Delta Electronics PMSoft ∗∗∗ --------------------------------------------- This advisory includes mitigations for multiple stack-based overflow vulnerabilities in Delta Electronics PMSoft, a software development tool. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-116-01 ∗∗∗ WordPress plugin "Open Graph for Facebook, Google+ and Twitter Card Tags" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- The WordPress plugin "Open Graph for Facebook, Google+ and Twitter Card Tags" contains a cross-site scripting vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN08386386/ ∗∗∗ WordPress plugin "WP Google Map Plugin" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- The WordPress plugin "WP Google Map Plugin" contains a cross-site scripting vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN01040170/ ∗∗∗ WordPress plugin "Events Manager" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- The WordPress plugin "Events Manager" contains a cross-site scripting vulnerability. --------------------------------------------- https://jvn.jp/en/jp/JVN85531148/ ∗∗∗ Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones SIP Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.04.2018
by Daily end-of-shift report 26 Apr '18

26 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 25-04-2018 18:00 − Donnerstag 26-04-2018 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Core-i-Prozessoren: Microsoft liefert Spectre-Schutz für Haswell und Broadwell ∗∗∗ --------------------------------------------- Microsoft erweitert die Auslieferung von Spectre-Updates auf Prozessoren der Haswell- und Broadwell-Serien. Das Update ist optional und muss manuell heruntergeladen werden. Viele Nutzer werden von ihren Mainboardherstellern keine Updates mehr bekommen. --------------------------------------------- https://www.golem.de/news/core-i-prozessoren-microsoft-liefert-spectre-schu… ∗∗∗ DDoS attacks in Q1 2018 ∗∗∗ --------------------------------------------- In Q1 2018, we observed a significant increase in both the total number and duration of DDoS attacks against Q4 2017. The new Linux-based botnets Darkai (a Mirai clone) and AESDDoS are largely responsible for this hike. --------------------------------------------- http://securelist.com/ddos-report-in-q1-2018/85373/ ∗∗∗ Mac-Malware will sich per Konfigurationsprofil einnisten ∗∗∗ --------------------------------------------- Eine neue Variante des Schädlings “Crossrider” manipuliert die Einstellungen, um auch eine manuelle Entfernung der Adware durch den Nutzer zu überdauern, warnt eine Sicherheitsfirma. --------------------------------------------- https://heise.de/-4034258 ∗∗∗ Server-Verwaltung: Erpressungstrojaner hat es auf HPE iLo abgesehen ∗∗∗ --------------------------------------------- Aufgrund von Attacken sollten Server-Admins, die auf die Management-Software Integrated Lights-out 4 (iLO 4) von HPE setzen, prüfen, ob ihre Geräte auf dem aktuellen Stand sind und ob der Fernzugriff aktiviert ist. --------------------------------------------- https://heise.de/-4035630 ∗∗∗ "Mılka" statt "Milka": Neue Fake-Gewinnspiele auf Whatsapp im Umlauf ∗∗∗ --------------------------------------------- Betrügerische Nachrichten enthalten täuschend echt wirkende Links --------------------------------------------- http://derstandard.at/2000078631245 ∗∗∗ Achtung vor Datendiebstahl auf Kleinanzeigenportalen! ∗∗∗ --------------------------------------------- Die Marktplätze erfreuen sich daher großer Beliebtheit, doch bei der Nutzung dieser Plattformen ist auch Vorsicht geboten. Kriminelle betreiben hier nämlich systematischen Daten- und Identitätsdiebstahl. Nutzer und Nutzerinnen müssen daher gut darüber nachdenken, welche Daten sie über das Internet an unbekannte Personen preisgeben und sollten keine Fotos diverser Ausweisdokumente versenden. --------------------------------------------- https://www.watchlist-internet.at/news/achtung-vor-datendiebstahl-auf-klein… ===================== = Vulnerabilities = ===================== ∗∗∗ Hyperoptics ZTE-made 1Gbps routers had hyper-hardcoded hyper-root hyper-password ∗∗∗ --------------------------------------------- Firmware updates pushed out to up to 400,000 subscribers A security vulnerability has been found in Brit broadband biz Hyperoptics home routers that exposes tens of thousands of its subscribers to hackers.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/04/26/hyperoptics… ∗∗∗ JSON API - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2018-021 ∗∗∗ --------------------------------------------- This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The module doesn't provide CSRF protection when processing authenticated traffic using cookie-based authentication. This vulnerability is mitigated by the fact that an attacker must be allowed to create or modify entities of a certain type, and a very specific and uncommon CORS configuration that allows all other pre-checks to be skipped. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-021 ∗∗∗ Media - Critical - Remote Code Execution - SA-CONTRIB-2018-020 ∗∗∗ --------------------------------------------- The Media module provides an extensible framework for managing files and multimedia assets, regardless of whether they are hosted on your own site or a third party site. The module contained a vulnerability similar to SA-CORE-2018-004, leading to a possible remote code execution (RCE) attack. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-020 ∗∗∗ PHP: Mehrere Schwachstellen ermöglichen u.a. Denial-of-Service-Angriffe ∗∗∗ --------------------------------------------- Mehrere Schwachstellen ermöglichen einem entfernten, nicht authentisierten Angreifer die Durchführung verschiedener Denial-of-Service (DoS)-Angriffe. Eine dieser Schwachstellen ermöglicht dem Angreifer einen kompletten Denial-of-Service-Zustand zu bewirken. Eine weitere Schwachstelle ermöglicht dem Angreifer einen Cross-Site-Scripting (XSS)-Angriff. Die offiziellen Releases zur Behebung der Schwachstellen sind PHP 7.2.5, 7.1.17, 7.0.30 und vermutlich 5.6.36 (noch nicht verfügbar). Nähere Informationen zu den genannten Schwachstellen und weiteren Bugs finden sich in den zugehörigen ChangeLogs. --------------------------------------------- https://adv-archiv.dfn-cert.de/adv/2018-0789/ ∗∗∗ Kritische Sicherheitslücke in Drupal - aktiv ausgenützt - Updates verfügbar ∗∗∗ --------------------------------------------- In der verbreiteten CMS-Software Drupal ist eine kritische Sicherheitslücke entdeckt worden. Durch Ausnutzung dieses Fehlers kann auf betroffenen Systemen beliebiger Code (mit den Rechten des Webserver-Users) ausgeführt werden. CVE-Nummer: CVE-2018-7602 --------------------------------------------- http://www.cert.at/warnings/all/20180426.html ∗∗∗ IE Zero-Day “double kill” And Its First In-The-Wild Attack Found By 360 ∗∗∗ --------------------------------------------- Recently, 360 Security Center discovered an attack that used IE 0-day vulnerability. After analysis, we found that it is the first APT(Advanced Persistent Threat) campaign that forms its attack with an Office document embedding a newly discovered Internet Explorer 0-day exploit. As soon as anyone opens the malicious document, they get infected and give away control of their computers. --------------------------------------------- https://blog.360totalsecurity.com/en/ie-zero-day-double-kill-first-wild-att… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (drupal7, gcc-4.9-backport, ghostscript, and openslp-dfsg), Fedora (anki, composer, perl, and perl-Module-CoreList), Red Hat (kernel and rh-mysql56-mysql), and SUSE (kernel, kvm, and zsh). --------------------------------------------- https://lwn.net/Articles/752860/ ∗∗∗ IBM Security Bulletin: IBM Campaign Contains Client-side Vulnerability (CVE-2017-1116) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015569 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=nas8N1022561 ∗∗∗ IBM Security Bulletin: BigFix Platform 9.5.x / 9.2.x affected by multiple vulnerabilities (CVE-2018-1471, CVE-2018-1473, CVE-2018-1479, CVE-2018-1475) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015754 ∗∗∗ IBM Security Bulletin: Vulnerability in IBM Java SDK affect eDiscovery Analyzer ∗∗∗ --------------------------------------------- https://www-01.ibm.com/support/docview.wss?uid=swg22014443 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015258 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect eDiscovery Analyzer ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012865 ∗∗∗ IBM Security Bulletin: IBM MQ Appliance is affected by OpenSSH vulnerabilities ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22011165 ∗∗∗ IBM Security Bulletin: Security vulnerability in IBM WebSphere Application Server affects Rational Reporting for Development Intelligence (CVE-2017-1681) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015667 ∗∗∗ IBM Security Bulletin: Security vulnerabilities in IBM WebSphere Application Server affects Rational Insight (CVE-2017-1681) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015668 ∗∗∗ IBM Security Bulletin: Open Source XStream Vulnerabilities Impact on IBM Campaign (CVE-2017-7957) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015573 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.04.2018
by Daily end-of-shift report 25 Apr '18

25 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 24-04-2018 18:00 − Mittwoch 25-04-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ MikroTik Patches Zero-Day Flaw Under Attack in Record Time ∗∗∗ --------------------------------------------- MikroTik has released firmware patches for RouterOS, the operating system that ships with some of its routers. The patches fix a zero-day vulnerability exploited in the wild. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mikrotik-patches-zero-day-fl… ∗∗∗ Austria Cyber Security Challenge 2018 ∗∗∗ --------------------------------------------- Austria Cyber Security Challenge 201825. April 2018Auch heuer wieder gibt es eine Cyber Security Challenge. Wir von CERT.at halten das für eine gute Geschichte und daher auch von uns der Aufruf an Jung und (heuer neu!) Alt, hier mitzumachen.Es folgt der Meldung der Veranstalter:Die Besten Nachwuchs-Hacker Österreichs - und jene die es .. --------------------------------------------- http://www.cert.at/services/blog/20180425145422-2192.html ∗∗∗ BGP leaks and cryptocurrencies ∗∗∗ --------------------------------------------- Over the few last hours, a dozen news stories have broken about how an attacker attempted (and perhaps managed) to steal cryptocurrencies using a BGP leak. --------------------------------------------- https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies/ ∗∗∗ Ving Card: Sicherheitslücke in Millionen Hoteltüren gefunden ∗∗∗ --------------------------------------------- Sicherheitsforschern ist es gelungen, einen Generalschlüssel zu erstellen, mit dem alle Türen eines Hotels geöffnet werden können. Weltweit sollen über eine Million Türen betroffen sein, ein Patch steht beriet. --------------------------------------------- https://www.golem.de/news/ving-card-sicherheitsluecke-in-millionen-hoteltue… ∗∗∗ Separate ransomware attacks hit Ukraine and Canada ∗∗∗ --------------------------------------------- Two widely separated ransomware attacks against the Ukrainian energy ministry and the provincial government of Canadas Prince Edward Island (PEI) have knocked each agencies primary website offline. --------------------------------------------- https://www.scmagazine.com/separate-ransomware-attacks-hit-ukraine-and-cana… ∗∗∗ Steps to Keep Your Site Clean: Updates ∗∗∗ --------------------------------------------- This is the second post of a series about Steps to Keep Your Site Clean. In the first post, we talked about Access Points; here we are going to offer more insight on Updates. Updates Repeatedly we see websites being infected or reinfected when important security updates are not taken seriously. Most software updates are created due to a security breach .. --------------------------------------------- https://blog.sucuri.net/2018/04/steps-to-keep-your-site-clean-updates.html ∗∗∗ Sicherheits- und Bugfix-Updates für iPhone, iPad und Mac ∗∗∗ --------------------------------------------- Apple hat am Dienstagabend iOS 11.3.1 und das Security Update 2018-001 für macOS High Sierra 10.13.4 veröffentlicht, die teils kritische Fehler beheben. Einen neuen Build von Safari 11.1 gibts obendrein. --------------------------------------------- https://www.heise.de/meldung/Sicherheits-und-Bugfix-Updates-fuer-iPhone-iPa… ∗∗∗ Angriffe auf Drupal-Webseiten: Erneut äußerst wichtige Sicherheitsupdates im Anflug ∗∗∗ --------------------------------------------- Admins von Drupal-Webseiten müssen erneut Hand anlegen: Die Entwickler haben Updates angekündigt, um eine kritische Sicherheitslücke zu schließen. --------------------------------------------- https://www.heise.de/meldung/Angriffe-auf-Drupal-Webseiten-Erneut-aeusserst… ∗∗∗ Europol: Weltweit größter Marktplatz für DDoS-Attacken vom Netz genommen ∗∗∗ --------------------------------------------- Europäischen Strafverfolgern ist es in einer koordinierten Aktion gelungen, die Drahtzieher des angeblich größten Onlinemarkts für DDoS-Attacken festzunehmen. Der Marktplatz selbst wurde vom Netz genommen. Infrastruktur fand sich auch in Deutschland. --------------------------------------------- https://www.heise.de/meldung/Europol-Weltweit-groesster-Marktplatz-fuer-DDo… ∗∗∗ Vier von fünf heimischen Online-Shops von Betrug betroffen ∗∗∗ --------------------------------------------- Identitätsdiebstahl und Zahlungsunfähigkeit als häufigste Betrugsform in Österreich --------------------------------------------- http://derstandard.at/2000078615586 ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4179 linux-tools - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4179 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.04.2018
by Daily end-of-shift report 24 Apr '18

24 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Montag 23-04-2018 18:00 − Dienstag 24-04-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Mobilfunk: Was 5G im Bereich Security bringt ∗∗∗ --------------------------------------------- In 5G-Netzwerken werden Sim-Karten für einige Anwendungsbereiche optional, das Roaming wird für Netzbetreiber nachvollziehbarer und sicherer. Außerdem verschwinden die alten Signalisierungsprotokolle. Golem.de hat mit einem Experten über Sicherheitsmaßnahmen im kommenden 5G-Netzwerk gesprochen. --------------------------------------------- https://www.golem.de/news/mobilfunk-was-5g-im-bereich-security-bringt-1804-… ∗∗∗ Atlanta Spent $2.6M to Recover From $52,000 Ransomware Scare ∗∗∗ --------------------------------------------- Whether to pay ransomware is a complicated—and costly—calculation. --------------------------------------------- https://www.wired.com/story/atlanta-spent-26m-recover-from-ransomware-scare ∗∗∗ Veröffentlichter Boot-Exploit knackt alle Nintendo-Switch-Konsolen ∗∗∗ --------------------------------------------- Mehrere Hacker-Gruppen zeigen, wie sie in Nintendos Switch einsteigen und beispielsweise Linux mit offensichtlich vollem Hardwarezugriff auf der Spielkonsole laufen lassen. --------------------------------------------- https://www.heise.de/meldung/Veroeffentlichter-Boot-Exploit-knackt-alle-Nin… ∗∗∗ Fake-Support per Telefon: Microsoft meldet Zunahme von Betrugsfällen ∗∗∗ --------------------------------------------- Offenbar ist es ein lohnendes Geschäft, sich als angeblicher Windows-Support-Mitarbeiter Remote-Zugriff auf fremde Rechner zu verschaffen: Jüngst veröffentlichte Zahlen dokumentieren eine starke Zunahme von "Tech Support Scam" im Jahr 2017. --------------------------------------------- https://www.heise.de/meldung/Fake-Support-per-Telefon-Microsoft-meldet-Zuna… ∗∗∗ Cryptomining Campaign Returns Coal and Not Diamond ∗∗∗ --------------------------------------------- Executive summarySoon after a launch of a new cryptocurrency, Bitvote, in January, Talos discovered a new mining campaign affecting systems in India, Indonesia, Vietnam and several other countries that were tied to Bitvote. Apart from the fact that the attackers have chosen to target the new bitcoin fork in order to gain the early adoption advantage, this .. --------------------------------------------- http://feedproxy.google.com/~r/feedburner/Talos/~3/5RBkUbicJr4/cryptomining… ∗∗∗ Sednit update: Analysis of Zebrocy ∗∗∗ --------------------------------------------- Zebrocy heavily used by the Sednit group over last two years The post Sednit update: Analysis of Zebrocy appeared first on WeLiveSecurity --------------------------------------------- https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy ∗∗∗ Angebliche Sicherheits-App der Erste Bank und Sparkasse ist schädlich! ∗∗∗ --------------------------------------------- Betrüger fälschen eine Erste Bank und Sparkasse-Nachricht und versenden diese massenhaft. In der Nachricht wird behauptet, dass das Bankkonto des/der Empfänger/in eingeschränkt werden musste und zur weiteren Nutzung die Installation einer Sicherheits-App nötig sei. Doch Vorsicht: es handelt sich bei der E-Mail um Phishing und .. --------------------------------------------- https://www.watchlist-internet.at/news/angebliche-sicherheits-app-der-erste… ∗∗∗ Drupal 7 and 8 core critical release on April 25th, 2018 PSA-2018-003 ∗∗∗ --------------------------------------------- There will be a security release of Drupal 7.x, 8.4.x, and 8.5.x on April 25th, 2018 between 16:00 - 18:00 UTC. This PSA is to notify that the Drupal core release is outside of the regular schedule of security releases. For all security updates, the Drupal Security Team urges you to reserve time for core updates at that time because there is some risk .. --------------------------------------------- https://www.drupal.org/psa-2018-003 ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Adaptive Security Appliance Flow Creation Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the CPU to increase upwards of 100 percent utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incorrect handling of an internal software .. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Wireless LAN Controller Default Simple Network Management Protocol Community Strings ∗∗∗ --------------------------------------------- With new installations of Cisco Wireless LAN Controller Software, the installation scripts create default communities for Simple Network Management Protocol (SNMP) Version 2 (SNMPv2) and a default username for SNMP Version 3 (SNMPv3), both allowing for read and write access. As documented in the Cisco Wireless LAN Controller Configuration Best Practices .. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Reflected Cross-Site Scripting in Zyxel Zywall ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/reflected-cross-site-scripti… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.04.2018
by Daily end-of-shift report 23 Apr '18

23 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 20-04-2018 18:00 − Montag 23-04-2018 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Datenleck bei Sicherheitskonferenz ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in der App zur RSA Sicherheitskonferenz ermöglichte es, die Namen von Konferenzteilnehmern auszulesen. --------------------------------------------- https://futurezone.at/digital-life/datenleck-bei-sicherheitskonferenz/40002… ∗∗∗ UMCI: Project Zero veröffentlicht Windows-10-Sicherheitslücke ∗∗∗ --------------------------------------------- Wieder einmal haben sich Google und Microsoft über die Veröffentlichung einer Sicherheitslücke gestritten. Der Fehler in .Net ermöglicht es einem Angreifer, trotz enger Beschränkungen Code unter Windows 10 S oder auf UMCI-Systemen auszuführen. (Project Zero, Google) --------------------------------------------- https://www.golem.de/news/umci-project-zero-veroeffentlicht-windows-10-sich… ∗∗∗ Chinese web giant finds Windows zero-day, stays shtum on specifics ∗∗∗ --------------------------------------------- Quihoo 360 plays the responsible disclosure game Chinese company Quihoo 360 says its found a Windows zero-day in the wild, but because its notified Microsoft, its not telling anyone else how it works. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/04/23/quihoo_360_… ∗∗∗ Monero-Mining RETADUP Worm Goes Polymorphic, Gets an AutoHotKey Variant ∗∗∗ --------------------------------------------- We came across a new version of a cryptocurrency-mining RETADUP worm (detected by Trend Micro as WORM_RETADUP.G) through feedback from our managed detection and response-related monitoring. This new variant is coded in AutoHotKey, an open-source scripting language used in Windows for creating hotkeys (i.e., keyboard shortcuts, macros, software automation). AutoHotKey is relatively similar to the script automation utility AutoIt, from which RETADUP’s earlier variants were based on and used [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/3PgT2t0-HwE/ ∗∗∗ Loading Kernel Shellcode ∗∗∗ --------------------------------------------- In the wake of recent hacking tool dumps, the FLARE team saw a spike in malware samples detonating kernel shellcode. Although most samples can be analyzed statically, the FLARE team sometimes debugs these samples to confirm specific functionality. Debugging can be an efficient way to get around packing or obfuscation and quickly identify the structures, system routines, and processes that a kernel shellcode sample is accessing. This post begins a series centered on kernel software analysis, and [...] --------------------------------------------- http://www.fireeye.com/blog/threat-research/2018/04/loading-kernel-shellcod… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gunicorn, libreoffice, libsdl2-image, ruby1.8, and ruby1.9.1), Fedora (java-1.8.0-openjdk, jgraphx, memcached, nghttp2, perl, perl-Module-CoreList, and roundcubemail), Gentoo (clamav, librelp, mbedtls, quagga, tenshi, and unadf), Mageia (freeplane, libcdio, libtiff, thunderbird, and zsh), openSUSE (cfitsio, chromium, mbedtls, and nextcloud), and Red Hat (chromium-browser, kernel, and rh-perl524-perl). --------------------------------------------- https://lwn.net/Articles/752544/ ∗∗∗ FortiClient insecure VPN credential storage and encryption ∗∗∗ --------------------------------------------- http://fortiguard.com/psirt/FG-IR-17-214 ∗∗∗ IBM Security Bulletin: IBM Content Manager Enterprise Edition Resource Manager is affected by a Remote Code Execution Cross-site Scripting vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/support/docview.wss?uid=swg22014917 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in the IBM Java SDK affect IBM Cloud Application Performance Management Private 8.1.4. and IBM Cloud Application Performance Management ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22015278 ∗∗∗ Multiple Stored XSS Vulnerabilities in WSO2 Carbon and WSO2 Dashboard Server ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/multiple-stored-xss-vulnerab… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.04.2018
by Daily end-of-shift report 20 Apr '18

20 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 19-04-2018 18:00 − Freitag 20-04-2018 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Patschn am Patscherkofel ∗∗∗ --------------------------------------------- Nachdem einige Medien über einen Vorfall berichten, bei dem auch wir involviert waren, will ich hier ein paar Fakten klarstellen: Wir bekommen immer wieder von Researchern - und da ist die "Internetwache" nur einer unter vielen - Hinweise zu konkreten Sicherheitsproblemen im österreichischen Internet. Unsere Rolle hier ist, diese Meldungen (auf Wunsch anonymisiert) an die Betroffenen weiterzuleiten und dort für die entsprechende [...] --------------------------------------------- http://www.cert.at/services/blog/20180420131015-2180.html ∗∗∗ Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training ∗∗∗ --------------------------------------------- Booz Allen survey shows most organizations' answer to the security skills shortage may be unsustainable. --------------------------------------------- https://www.darkreading.com/careers-and-people/firms-more-likely-to-tempt-s… ∗∗∗ First Public Demo of Data Breach via IoT Hack Comes to RSAC ∗∗∗ --------------------------------------------- At RSA Conference, senior researchers will show how relatively unskilled attackers can steal personally identifiable information without coming into contact with endpoint security tools. --------------------------------------------- https://www.darkreading.com/vulnerabilities---threats/first-public-demo-of-… ∗∗∗ Doctor Web: a Trojan on Google Play subscribes users to paid services ∗∗∗ --------------------------------------------- April 16, 2018 Doctor Web virus analysts have detected a Trojan Android.Click.245.origin on Google Play. When ordered by cybercriminals, it loads websites where users are tricked into subscribing to paid content services. In some cases the subscription is executed automatically when users click on a fake "download program" button. Cybercriminals distributed Android.Click.245.origin on behalf of developer Roman Zencov and disguised the Trojan as popular applications. --------------------------------------------- https://news.drweb.com/show/?i=12540&lng=en&c=9 ∗∗∗ Introducing Windows Defender System Guard runtime attestation ∗∗∗ --------------------------------------------- At Microsoft, we want users to be in control of their devices, including knowing the security health of these devices. If important security features should fail, users should be aware. Windows Defender System Guard runtime attestation, a new Windows platform security technology, fills this need. In Windows 10 Fall Creators Update, we reorganized all system [...] --------------------------------------------- https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-win… ∗∗∗ NCSC publishes factsheet on considerations and preconditions for the deployment of TLS interception ∗∗∗ --------------------------------------------- TLS interception makes encrypted connections within the network of an organisation accessible for inspection. The use of this technical measure should be carefully considered in the light of additional risks and should meet a number of important preconditions. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-on… ∗∗∗ Botnet Muhstik is Actively Exploiting Drupal CVE-2018-7600 in a Worm Style ∗∗∗ --------------------------------------------- On March 28, 2018, drupal released a patch for CVE-2018-7600. Drupal is an open-source content management system written in PHP, quite popular in many sites to provide web service. This vulnerability exists in multiple drupal versions, which may be exploited by an attacker to take full control of the target. --------------------------------------------- http://blog.netlab.360.com/botnet-muhstik-is-actively-exploiting-drupal-cve… ∗∗∗ XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing ∗∗∗ --------------------------------------------- We have been detecting a new wave of network attacks since early March, which, for now, are targeting Japan, Korea, China, Taiwan, and Hong Kong. The attacks use Domain Name System (DNS) cache poisoning/DNS spoofing, possibly through infringement techniques such as brute-force or dictionary attacks, to distribute and install malicious Android apps. Trend Micro detects these as ANDROIDOS_XLOADER.HRX. These malware pose as legitimate Facebook or Chrome applications. They are distributed from [...] --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/a9ANfAHCd0c/ ∗∗∗ iPhone-Unlock-Tool GrayKey: Apple streicht Gegenmittel aus iOS 11.3 ∗∗∗ --------------------------------------------- iOS 11.3 sollte es eigentlich schwerer machen, iPhone-Daten über eine Kabelverbindung auszulesen. Die wichtige Sicherheitsfunktion fehlt jedoch in der finalen Fassung, sodass sich Entsperr-Tools wie GrayKey offenbar weiter ungehindert einsetzen lassen. --------------------------------------------- https://www.heise.de/-4027793 ∗∗∗ Android: Google Safe Browsing schützt nun auch WebView in Apps ∗∗∗ --------------------------------------------- Google Safe Browsing schützt Chrome-Nutzer vor schädlichen Webseiten, Malware und Phishing-Attacken. Künftig ist der Schutzmechanismus auch in Android-WebView standardmäßig aktiv. --------------------------------------------- https://www.heise.de/-4028504 ∗∗∗ When BEC scammers specialize ∗∗∗ --------------------------------------------- A group of BEC scammers has been focusing its efforts on the global maritime shipping industry, compromising emails accounts and attempting to trick targets into delivering considerable sums to bank accounts set up by the group. Secureworks researchers have been tracking the group's activities for quite a while and have been warning the targets. They estimate that between June 2017 and January 2018, the scammers attempted to steal a minimum of $3.9 million U.S. dollars [...] --------------------------------------------- https://www.helpnetsecurity.com/2018/04/20/bec-scammers-specialize/ ===================== = Vulnerabilities = ===================== ∗∗∗ Siemens SIMATIC WinCC OA Operator IOS App ∗∗∗ --------------------------------------------- This advisory includes mitigations for a file and directory information exposure vulnerability identified in the Siemens WinCC OA iOS App. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-109-01 ∗∗∗ Cisco Adaptive Security Appliance WebVPN Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Login screen of the Clientless SSL VPN (WebVPN) portal of Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a [...] --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ VMSA-2018-0010 ∗∗∗ --------------------------------------------- Horizon DaaS update addresses a broken authentication issue --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2018-0010.html ∗∗∗ Vulnerability Spotlight: Multiple Issues in Foxit PDF Reader ∗∗∗ --------------------------------------------- Talos is disclosing five vulnerabilities in Foxit PDF Reader. Foxit PDF Reader is a popular free program for viewing, creating, and editing PDF documents. It is commonly used as an alternative to Adobe Acrobat Reader and has a widely used browser plugin available. Update to the current version of Foxit PDF Reader. --------------------------------------------- https://blog.talosintelligence.com/2018/04/multiple-vulns-foxit-pdf-reader.… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libreoffice and mysql-5.5), Fedora (corosync), Oracle (java-1.8.0-openjdk), Red Hat (java-1.8.0-openjdk), Scientific Linux (java-1.8.0-openjdk), and Ubuntu (openssl). --------------------------------------------- https://lwn.net/Articles/752405/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.04.2018
by Daily end-of-shift report 19 Apr '18

19 Apr '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 18-04-2018 18:00 − Donnerstag 19-04-2018 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Data Firm Left Profiles of 48 Million Users on a Publicly Accessible AWS Server ∗∗∗ --------------------------------------------- LocalBlox, a company that scrapes data from public web profiles, has left the details of over 48 million users on a publicly accessible Amazon Web Services (AWS) S3 bucket, according to an UpGuard security researcher who discovered the data on February 28, this year. --------------------------------------------- https://www.bleepingcomputer.com/news/security/data-firm-left-profiles-of-4… ∗∗∗ Relieve Stress Paint Tool: Mal-Malware kopiert Facebook-Zugangsdaten ∗∗∗ --------------------------------------------- Eine Malware tarnt sich mit gefälschten Unicode-Domains und sucht gezielt nach Facebook-Zugangsdaten. Nutzern wird hingegen ein Anti-Stress-Malprogramm versprochen. (Malware, Virus) --------------------------------------------- https://www.golem.de/news/relieve-stress-paint-tool-mal-malware-kopiert-fac… ∗∗∗ Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege ∗∗∗ --------------------------------------------- Previously I presented a technique to exploit arbitrary directory creation vulnerabilities on Windows to give you read access to any file on the system. In the upcoming Spring Creators Update (RS4) the abuse of mount points to link to files as I exploited in the previous blog post has been remediated. This is an example of a long term security benefit from detailing how vulnerabilities might be exploited, giving a developer an incentive to find ways of [...] --------------------------------------------- https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-… ∗∗∗ Trustjacking exploit abuses iTunes feature to spy on iOS devices ∗∗∗ --------------------------------------------- Researchers presenting at RSA 2018 on Wednesday disclosed how attackers can gain persistent remote control over iOS devices by abusing a weakness in iTunes Wi-Fi sync, a feature that allows users to sync up iTunes content and data between Apple devices. --------------------------------------------- https://www.scmagazine.com/trustjacking-exploit-abuses-itunes-feature-to-sp… ∗∗∗ From Baidu to Google's Open Redirects ∗∗∗ --------------------------------------------- Last week, we described how an ongoing massive malware campaign began using Baidu search result links to redirect people to various ad and scam pages. It didn't last long. Soon after the publication of that article, the bad actors changed the links to use compromised third-party sites and a couple of day later they began using Google's goo.gl URL shortening service. This is a snippet from their decoded script: The Redirect Chain If you check Google's own information about that [...] --------------------------------------------- https://blog.sucuri.net/2018/04/from-baidu-to-googles-open-redirects.html ∗∗∗ Surprise! Wireless brain implants are not secure, and can be hijacked to kill you or steal thoughts ∗∗∗ --------------------------------------------- Science-fiction horror trope now a reality in 2018 Scientists in Belgium have tested the security of a wireless brain implant called a neurostimulator – and found that its unprotected signals can be hacked with off-the-shelf equipment. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/04/18/boffins_bre… ∗∗∗ New paper: Powering the distribution of Tesla stealer with PowerShell and VBA macros ∗∗∗ --------------------------------------------- Since their return four years ago, Office macros have been one of the most common ways to spread malware. Today, we publish a research paper which looks in detail at a campaign in which VBA macros are used to execute PowerShell code, which in turn downloads the Tesla information-stealing trojan. --------------------------------------------- https://www.virusbulletin.com:443/blog/2018/04/new-paper-powering-distribut… ∗∗∗ Microsoft veröffentlicht "Windows Defender" als Chrome-Erweiterung ∗∗∗ --------------------------------------------- Microsoft hat seinen Echtzeitschutz als Chrome-Erweiterung veröffentlicht: Die "Windows Defender Browser Protection" verspricht "besseren Schutz" vor betrügerischen Phishing-Seiten und Malware. --------------------------------------------- https://heise.de/-4027458 ∗∗∗ Sicherheitsupdates: Flash-Datei kann Ciscos WebEx Client kompromittieren ∗∗∗ --------------------------------------------- Cisco hat zahlreiches Patches veröffentlicht und schließt mitunter kritische Sicherheitslücken. Zudem geben sie Tipps, wie Admins Netzwerke absichern sollten. --------------------------------------------- https://www.heise.de/-4027370 ∗∗∗ Gefälschte UPC-Phishingmail im Umlauf ∗∗∗ --------------------------------------------- Kriminelle versenden eine gefälschte UPC-Nachricht. Darin erklären sie, dass das E-Mailkonto von Kund/innen gesperrt worden sei. Damit diese es weiterhin nützen können, sollen sie eine externe Website aufrufen und ihre persönlichen Zugangsdaten bekannt geben. Konsument/innen, die der Aufforderung nachkommen, übermitteln ihr UPC-Passwort an Datendiebe. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-upc-phishingmail-im-umla… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2018-003 ∗∗∗ --------------------------------------------- Project: Drupal coreDate: 2018-April-18Security risk: Moderately critical 12∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site ScriptingDescription: CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting (XSS) vulnerability. The vulnerability stemmed from the fact that it was possible to execute XSS inside CKEditor when using the image2 plugin (which Drupal 8 core also uses). --------------------------------------------- https://www.drupal.org/sa-core-2018-003 ∗∗∗ Display Suite - Critical - Cross site scripting (XSS) - SA-CONTRIB-2018-019 ∗∗∗ --------------------------------------------- Project: Display SuiteVersion: 7.x-2.147.x-1.9Date: 2018-April-18Security risk: Critical 17∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site scripting (XSS)Description: Display Suite allows you to take full control over how your content is displayed using a drag and drop interface. The module doesnt sufficiently validate view modes provided dynamically via URLs leading to a reflected cross site scripting (XSS) attack. --------------------------------------------- https://www.drupal.org/sa-contrib-2018-019 ∗∗∗ PMASA-2018-2 ∗∗∗ --------------------------------------------- CSRF vulnerability allowing arbitrary SQL executionAffected VersionsVersion 4.8.0 is affectedCVE ID(https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10188, uCVE-2018-10188) --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2018-2/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (opencv and wireshark), Fedora (corosync and pcs), Oracle (firefox, kernel, libvncserver, and libvorbis), Slackware (gd), SUSE (kernel), and Ubuntu (apache2). --------------------------------------------- https://lwn.net/Articles/752324/ ∗∗∗ Cisco WebEx Connect IM Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco WebEx Clients Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Identity Services Engine Shell Access Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Industrial Ethernet Switches Device Manager Cross-Site Request Forgery Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco ASA Software, FTD Software, and AnyConnect Secure Mobility Client SAML Authentication Session Fixation Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Cisco Adaptive Security Appliance Virtual Private Network SSL Client Certificate Bypass Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in the IBM GSKit component of IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Unix ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015077 ∗∗∗ IBM Security Bulletin: IBM API Connect is affected by an Apache HTTP Server vulnerability (CVE-2014-0226) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015233 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects IBM WebSphere Application Server for IBM Cloud January 2018 CPU ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015289 ∗∗∗ IBM Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affects Liberty for Java for IBM Cloud January 2018 CPU ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015290 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Manager with OpenStack ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=isg3T1027494 ∗∗∗ IBM Security Bulletin: OpenSSL Vulnerability affects IBM Spectrum Protect Snapshot (formerly Tivoli Storage FlashCopy Manager) for Unix (CVE-2017-3737) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013612 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities affect the GSKit component of IBM Tivoli Monitoring ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015424 ∗∗∗ IBM Security Bulletin: IBM MQ and IBM MQ Appliance are vulnerable to a memory leak in pubsub (CVE-2017-1786) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22013023 ∗∗∗ IBM Security Bulletin: Vulnerability affects Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console and Watson Content Analytics ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22011118 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015635 ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities Impact IBM Predictive Insights ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22015539 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily