Daily

daily@lists.cert.at

1 participants
3211 discussions

Tageszusammenfassung - 06.02.2018
by Daily end-of-shift report 06 Feb '18

06 Feb '18

===================== = End-of-Day report = ===================== Timeframe: Montag 05-02-2018 18:00 − Dienstag 06-02-2018 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl ===================== = News = ===================== ∗∗∗ Research papers and Youtube videos from BlueHat Israel 2018 ∗∗∗ --------------------------------------------- http://www.bluehatil.com/abstracts.html ∗∗∗ European Cyber Security Month ECSM 2017 deployment report ∗∗∗ --------------------------------------------- ENISA is today pleased to publish the ‘European Cyber Security Month deployment report’, a summary of the activities carried out throughout ECSM 2017 by the Agency and participating Member States. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/european-cyber-security-month-e… ∗∗∗ Strong cybersecurity culture as efficient firewall for organisations ∗∗∗ --------------------------------------------- ENISA’s Cybersecurity Culture in Organisations report is based on a multi-disciplinary research, conducted to better understand the dynamics of how cybersecurity culture can be developed and shaped within organisations. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/strong-cybersecurity-culture-as… ∗∗∗ Krypto-Miner schlich über Download-Verzeichnis MacUpdate auf Macs ∗∗∗ --------------------------------------------- Mac-Nutzer, die beliebte Software wie etwa den Browser Firefox über MacUpdate heruntergeladen haben, handelten sich dadurch unter Umständen Malware ein. --------------------------------------------- https://www.heise.de/meldung/Krypto-Miner-schlich-ueber-Download-Verzeichni… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates available for Adobe Flash Player (APSB18-03) ∗∗∗ --------------------------------------------- https://blogs.adobe.com/psirt/?p=1522 ∗∗∗ IBM Security Bulletin: IBM Content Navigator is affected by a common separated value (CSV) vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012674 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM JRE affect IBM Tivoli Composite Application Manager for Transactions (Multiple CVEs) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013271 ∗∗∗ February 2018 ∗∗∗ --------------------------------------------- https://source.android.com/security/bulletin/2018-02-01.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.02.2018
by Daily end-of-shift report 05 Feb '18

05 Feb '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-02-2018 18:00 − Montag 05-02-2018 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Safer Internet Day ∗∗∗ --------------------------------------------- February 6, 2018, is Safer Internet Day (SID), a worldwide event aimed at promoting the safe and positive use of digital technology for all users, especially children and teens. --------------------------------------------- https://www.us-cert.gov/ncas/current-activity/2018/02/05/Safer-Internet-Day ===================== = Vulnerabilities = ===================== ∗∗∗ New Western Digital My Cloud Bugs Give Local Attackers Root on NAS Devices ∗∗∗ --------------------------------------------- Two new WD My Cloud vulnerabilities have been identified, adding to last month’s bevy of security bugs. --------------------------------------------- http://threatpost.com/new-western-digital-my-cloud-bugs-give-local-attacker… ∗∗∗ NetIQ Privileged Account Manager 3.1 Patch Update 3 (3.1.0.3) ∗∗∗ --------------------------------------------- NetIQ Privileged Account Manager 3.1 Patch Update 3 (3.1.0.3). The purpose of the patch is to provide an upgrade of OpenSSL for eliminating potential security vulnerabilities and a few software fixes. --------------------------------------------- https://download.novell.com/Download?buildid=MtsbTyzebZw~ ∗∗∗ Cisco IOS and IOS XE Software EnergyWise Denial of Service Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the EnergyWise module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ DFN-CERT-2018-0235/">Django: Eine Schwachstelle ermöglicht das Ausspähen von Informationen ∗∗∗ --------------------------------------------- Eine Schwachstelle in Django ermöglicht einem entfernten, nicht authentisierten Angreifer Informationen zu berechtigten Benutzern auszuspähen. Der Hersteller hat Django 2.0.2 und 1.11.10 als Security Releases veröffentlicht und stellt Patches für den Master Branch und die Releases Branches 2.0 und 1.11 zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2018-0235/ ∗∗∗ DFN-CERT-2018-0234/">7-Zip: Eine Schwachstelle ermöglicht u.a. die Ausführung beliebigen Programmcodes ∗∗∗ --------------------------------------------- Ein entfernter, nicht authentisierter Angreifer kann eine Schwachstelle ausnutzen, um einen Denial-of-Service (DoS)-Angriff durchzuführen (Out-of-bounds Write) oder möglicherweise mit Hilfe eines präparierten ZIP-Archivs beliebigen Programmcode zur Ausführung bringen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2018-0234/ ∗∗∗ Update: Kritische Sicherheitslücke in Cisco ASA Software - Patches verfügbar ∗∗∗ --------------------------------------------- Update: 5. Februar 2018 Cisco hat bekanntgegeben, dass im Zuge interner Untersuchungen noch weitere Lücken gefunden wurden, sowie dass die bisher veröffentlichten gefixten Versionen Fehler enthalten. --------------------------------------------- http://www.cert.at/warnings/all/20180130.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (dokuwiki and p7zip), Fedora (kernel, pdns, rsync, and webkitgtk4), openSUSE (chromium and translate-toolkit), Red Hat (jboss-ec2-eap and Red Hat Satellite 6), Slackware (php), and SUSE (bind and firefox). --------------------------------------------- https://lwn.net/Articles/746568/rss ∗∗∗ IBM Security Bulletin: API Connect is affected by a cross-site scripting vulnerability CVE-2018-1382 ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013054 ∗∗∗ IBM Security Bulletin: API Connect Developer Portal is affected by authenticated user access to sensitive information vulnerability (CVE-2017-1785) ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013061 ∗∗∗ IBM Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server in IBM Cloud ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22013153 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SmartCloud Entry ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=isg3T1026841 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SmartCloud Entry ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1025910 ∗∗∗ IBM Security Bulletin: October 2016 Java Platform Standard Edition Vulnerabilities in Multiple N Series Products ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1011818 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.02.2018
by Daily end-of-shift report 02 Feb '18

02 Feb '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-02-2018 18:00 − Freitag 02-02-2018 18:00 Handler: Alexander Riepl Co-Handler: Nina Bieringer ===================== = News = ===================== ∗∗∗ Crypto Miners May Be the 'New Payload of Choice' for Attackers ∗∗∗ --------------------------------------------- Crypto mining botnets provide a stealthy way to generate big bucks, without the downsides of ransomware. --------------------------------------------- http://threatpost.com/crypto-miners-may-be-the-new-payload-of-choice-for-at… ∗∗∗ Simple but Effective Malicious XLS Sheet, (Fri, Feb 2nd) ∗∗∗ --------------------------------------------- Here is another quick analysis of a malicious Excel sheet found while hunting. The malicious document was delivered through a classic phishing attempt from Janes 360[1], a website operated by HIS Markit[2]. Here is a copy of the mail body. --------------------------------------------- https://isc.sans.edu/diary/rss/23305 ∗∗∗ Multiple Vulnerabilities in WD MyCloud ∗∗∗ --------------------------------------------- While performing security research on personal storage I found some vulnerabilities in the WD (Western Digital) MyCloud device. Trustwave reported them to WD back in 2017 and now that patches are available we can discuss the technical details. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Multiple-Vulnerabilitie… ∗∗∗ There is no evidence in-the-wild malware is using Meltdown or Spectre ∗∗∗ --------------------------------------------- Reports of malware using the Meltdown or Spectre attacks are likely based on proof-of-concept code rather than files written for a malicious purpose. --------------------------------------------- https://www.virusbulletin.com:443/blog/2018/02/there-no-evidence-wild-malwa… ∗∗∗ Service-Router von Cisco können sich an IPv6-Paketen verschlucken ∗∗∗ --------------------------------------------- Ein Sicherheitsupdate schließt eine DoS-Schwachstelle in Cisco ASR 9000. --------------------------------------------- https://www.heise.de/security/meldung/Service-Router-von-Cisco-koennen-sich… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (systemd and thunderbird), Debian (squid and squid3), Fedora (firefox), Mageia (java-1.8.0-openjdk and sox), openSUSE (ecryptfs-utils and libXfont), Oracle (systemd and thunderbird), Scientific Linux (thunderbird), and Ubuntu (dovecot and w3m). --------------------------------------------- https://lwn.net/Articles/746326/rss ===================== = Vulnerabilities = ===================== ∗∗∗ "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches noch nicht verfügbar ∗∗∗ --------------------------------------------- "Zero-Day" Sicherheitslücke in Adobe Flash Player - aktiv ausgenützt - Patches noch nicht verfügbar 1. Februar 2018 Beschreibung Adobe hat bekanntgegeben, dass es aktuell eine kritische Sicherheitslücke in Adobe Flash Player gibt, die auch bereits aktiv ausgenützt wird. CVE-Nummer: CVE-2018-4878 Es ist noch keine entsprechend gefixte Version verfügbar - Adobe hat eine solche für nächste Woche (beginnend mit 5. Februar 2018) in Aussicht --------------------------------------------- http://www.cert.at/warnings/all/20180201.html ∗∗∗ IBM Security Bulletin: IBM StoredIQ for Legal has released Interim Fix 2.0.3.3-IBM-SIQ4L-IF001 in response to the vulnerabilities known as Spectre and Meltdown. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012719 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in Kernel, libvirt and qemu-kvm affect IBM Netezza Host Management ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012641 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.02.2018
by Daily end-of-shift report 01 Feb '18

01 Feb '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 31-01-2018 18:00 − Donnerstag 01-02-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ DDG: A Mining Botnet Aiming at Database Servers ∗∗∗ --------------------------------------------- Starting 2017-10-25, we noticed there was a large scale ongoing scan targeting the OrientDB databases. Further analysis found that this is a long-running botnet whose main .. --------------------------------------------- http://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-server-en/ ∗∗∗ Adaptive Phishing Kit ∗∗∗ --------------------------------------------- Phishing kits are everywhere! If your server is compromised today, they are chances that it will be used to mine cryptocurrency, to deliver malware payloads or to host a phishing kit. Phishing remains a common attack scenario to collect valid credentials and impersonate the user account or, in larger attacks, it is one of the first steps to .. --------------------------------------------- https://isc.sans.edu/diary/rss/23299 ∗∗∗ Internet of Dildos – a long way to a vibrant future ∗∗∗ --------------------------------------------- Schwachstellen in Sexspielzeugen sind nicht nur aus technischer Sicht sehr interessant, sondern vor allem datenschutzrechtlich. Mehrere „Smart Sex“ Spielzeuge der Marke Vibratissimo und die dazugehörige Cloud Plattform waren von schwerwiegenden Schwachstellen betroffenen. --------------------------------------------- https://www.sec-consult.com/blog/2018/02/internet-of-dildos-a-long-way-to-a… ∗∗∗ Meltdown/Specter-based Malware Coming Soon to Devices Near You, Are You Ready? ∗∗∗ --------------------------------------------- It has been few weeks since the details of the Spectre, and Meltdown processor vulnerabilities came out in public and researchers have discovered more than 130 malware samples trying to exploit these chip flaws. Spectre and Meltdown are security .. --------------------------------------------- https://thehackernews.com/2018/02/meltdown-spectre-malware-hacking.html ∗∗∗ Malicious Chrome Extensions Found in Chrome Web Store, Form Droidclub Botnet ∗∗∗ --------------------------------------------- The Trend Micro Cyber Safety Solutions team has discovered a new botnet delivered via Chrome extensions that affects more than half a million users. (The malicious extension is detected as BREX_DCBOT.A.) This botnet was used to inject ads and cryptocurrency mining code into websites the victim would visit. We have dubbed this particular .. --------------------------------------------- https://blog.trendmicro.com/trendlabs-security-intelligence/malicious-chrom… ∗∗∗ "Ändere dein Passwort"-Tag: Lass es doch einfach bleiben! ∗∗∗ --------------------------------------------- Am 1. Februar ist "Ändere dein Passwort"-Tag. Aber ist es wirklich sinnvoll, Passwörter regelmäßig zu ändern? Und wie wählt man überhaupt gute Passwörter, die Hackerangriffen standhalten? --------------------------------------------- https://www.heise.de/meldung/Aendere-dein-Passwort-Tag-Lass-es-doch-einfach… ∗∗∗ Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions ∗∗∗ --------------------------------------------- The threat landscape is constantly changing; over the last few years malware threat vectors, methods and payloads have rapidly evolved. Recently, as cryptocurrency values have exploded, mining .. --------------------------------------------- http://blog.talosintelligence.com/2018/01/malicious-xmr-mining.html ∗∗∗ Chrome’s Plan to Distrust Symantec Certificates ∗∗∗ --------------------------------------------- Posted by Devon O’Brien, Ryan Sleevi, Andrew Whalley, Chrome SecurityThis post is a broader announcement of plans already finalized on the blink-dev mailing list.Update, 1/31/18: Post was updated to further clarify 13 month validity limitationsAt the end of July, the Chrome team and the PKI community converged upon a plan to reduce, and .. --------------------------------------------- https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.h… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4103 chromium-browser - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4103 ∗∗∗ Multiple critical vulnerabilities in Whole Vibratissimo Smart Sex Toy product range ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/multiple-critical-vulnerabil… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.01.2018
by Daily end-of-shift report 31 Jan '18

31 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-01-2018 18:00 − Mittwoch 31-01-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Microsoft Drops the Hammer on Coercive Registry Cleaners & System Optimizers ∗∗∗ --------------------------------------------- Starting March 1st 2018, Windows Defender and other Microsoft products will begin to remove programs that display coercive behavior. This includes registry cleaners and system optimizers that offer free scans, display alarming messages, and then require the user to purchase it.before fixing anything. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-drops-the-hammer-… ∗∗∗ Google hat 2017 mehr als 700.000 bösartige Apps aus Google Play verbannt ∗∗∗ --------------------------------------------- In einem Jahresbericht führt Google aus, wie sicher der eigene Android-App-Store Google Play doch ist. Aufgrund einiger Vorfälle wirkt die Argumentation stellenweise jedoch nicht ganz glaubwürdig. --------------------------------------------- https://www.heise.de/meldung/Google-hat-2017-mehr-als-700-000-boesartige-Ap… ∗∗∗ Kritische Sicherheitslücke in Mozilla Firefox - Patch verfügbar ∗∗∗ --------------------------------------------- Mozilla hat einen Out-of-Band Patch für eine kritische Sicherheitslücke im Webbrowser Firefox veröffentlicht. Auswirkungen Durch Ausnützen dieser Lücke kann ein Angreifer beliebigen Code auf betroffenen Systemen, mit den Rechten des angemeldeten Benutzers, ausführen. Dazu reicht es, den Browser zum Anzeigen einer entsprechend präparierten Webseite .. --------------------------------------------- http://www.cert.at/warnings/all/20180131.html ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4102 thunderbird - security update ∗∗∗ --------------------------------------------- https://www.debian.org/security/2018/dsa-4102 ∗∗∗ PHOENIX CONTACT mGuard ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-030-01 ∗∗∗ Siemens TeleControl Server Basic ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-030-02 ∗∗∗ WordPress plugin "WP Retina 2x" vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- http://jvn.jp/en/jp/JVN30636823/ ∗∗∗ Multiple Vulnerabilities in Sprecher Automation SPRECON-E-C, PU-2433 ∗∗∗ --------------------------------------------- https://www.sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.01.2018
by Daily end-of-shift report 30 Jan '18

30 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Montag 29-01-2018 18:00 − Dienstag 30-01-2018 18:00 Handler: Alexander Riepl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ IBM-Studie: Viele Nutzer halten biometrische Anmeldung für sicher ∗∗∗ --------------------------------------------- Gerade junge Leute wollen sich heutzutage keine Passwörter mehr merken: Eine IBM-Studie untersucht Vorlieben von Nutzern aller Altersgruppen. Teilnehmer ab 55 Jahren hingegen merken sich viele verschiedene Passwörter auf einmal - auch ohne Passwort-Manager. --------------------------------------------- https://www.golem.de/news/ibm-studie-viele-nutzer-halten-biometrische-anmel… ∗∗∗ Scammers become the scammed: Ransomware payments diverted with Tor proxy trickery ∗∗∗ --------------------------------------------- Of course this does nothing for victims encrypted files Cybercriminals are using Tor proxies to divert ransomware payments to their own Bitcoin wallets. --------------------------------------------- theregister.com/feed/www.theregister.co.uk/2018/01/30/ransomware_diversions/ ∗∗∗ Chrome Extension Malware Has Evolved ∗∗∗ --------------------------------------------- While helpful and creative, Chrome extensions have also become a new playground for hackers intent on stealing your data. --------------------------------------------- https://www.wired.com/story/chrome-extension-malware ∗∗∗ ENISA organises cyber-exercise to boost CSIRT cooperation ∗∗∗ --------------------------------------------- On 30 January 2018, the EU Cybersecurity Agency ENISA organised ‘Cyber SOPEx’, the first cooperation exercise of the CSIRTs Network. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/enisa-organises-cyber-exercise-… ∗∗∗ E-Mail-Betrug: Vorarlberger Firma zahlt 150.000 Euro ∗∗∗ --------------------------------------------- Mitarbeiterin überwies knapp 150.000 Euro ins Ausland – 83.000 Euro konnten zurückgeholt werden --------------------------------------------- http://derstandard.at/2000073288109 ∗∗∗ "spotzi" und "bier1": Cybasar-Leak zeigt die unsicheren Passwörter der Österreicher ∗∗∗ --------------------------------------------- Viele Kennwörter offenbaren fahrlässigen Umgang mit eigenen Informationen im Netz – auch von Behördenmitarbeitern --------------------------------------------- http://derstandard.at/2000073316365 ∗∗∗ 2017 in Snort Signatures. ∗∗∗ --------------------------------------------- This post was written by Martin Lee and Vanja Svajcer.2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact .. --------------------------------------------- http://blog.talosintelligence.com/2018/01/2017-in-snort-signatures.html ∗∗∗ Kritische Sicherheitslücke in Cisco ASA Software - Patches verfügbar ∗∗∗ --------------------------------------------- Cisco hat ein Advisory zu einer kritischen Sicherheitslücke in Cisco ASA Software veröffentlicht. Die Lücke befindet sich im Code, der für das "webvpn"-Feature zuständig .. --------------------------------------------- http://www.cert.at/warnings/all/20180130.html ===================== = Vulnerabilities = ===================== ∗∗∗ [20180103] - Core - XSS vulnerability in Uri class ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/721-20180103-core-xss-vulnerab… ∗∗∗ [20180102] - Core - XSS vulnerability in com_fields ∗∗∗ --------------------------------------------- https://developer.joomla.org/security-centre/720-20180102-core-xss-vulnerab… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.01.2018
by Daily end-of-shift report 29 Jan '18

29 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Freitag 26-01-2018 18:00 − Montag 29-01-2018 18:00 Handler: Alexander Riepl Co-Handler: Nina Bieringer ===================== = News = ===================== ∗∗∗ Cyberattacken auf niederländische Banken: Netbanking weg ∗∗∗ --------------------------------------------- Die drei größten Banken der Niederlande hatten am Wochenende mit Cyberangriffen zu kämpfen. Teilweise fiel auch das Online-Banking aus. --------------------------------------------- https://futurezone.at/digital-life/cyberattacken-auf-niederlaendische-banke… ∗∗∗ Coincheck: Kryptowährung im Wert von 429 Millionen Euro gestohlen ∗∗∗ --------------------------------------------- Für das Unternehmen Coincheck war es ein schwarzer Freitag: Eine große Menge der Kryptowährung NEM wurde gestohlen. Der Kurs sank dadurch um elf Prozent. Auch Bitcoin und Etherium waren davon betroffen. Der Angriff ist für einige ein Anlass zur Kritik an Japans Regulierung des Kryptohandels. --------------------------------------------- https://www.golem.de/news/coincheck-kryptowaehrung-im-wert-von-429-milliard… ∗∗∗ Security: Lenovo gesteht Sicherheitslücken im Fingerprint Manager ein ∗∗∗ --------------------------------------------- Die Software Fingerprint Manager Pro speichert biometrische Daten auf dem Gerät. Allerdings sagt selbst Lenovo, dass das unsicher sei und rät daher zu einem Update. Windows-10-Geräte sind davon jedoch nicht betroffen. --------------------------------------------- https://www.golem.de/news/security-lenovo-gesteht-sicherheitsluecken-im-fin… ∗∗∗ Meltdown & Spectre: Windows-Update deaktiviert Schutz gegen Spectre V2 ∗∗∗ --------------------------------------------- Ein aktuelles Windows-Update schaltet den Schutz gegen Spectre Variant 2 ab, um Instabilitäten des Systems vorzubeugen. --------------------------------------------- https://www.heise.de/newsticker/meldung/Meltdown-Spectre-Windows-Update-dea… ∗∗∗ First 'Jackpotting' Attacks Hit U.S. ATMs ∗∗∗ --------------------------------------------- ATM "jackpotting" - a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand - has long been a threat for banks in Europe and Asia, yet these attacks somehow have eluded U.S. ATM operators. But all that changed this week after the U.S. Secret Service quietly began warning financial institutions that jackpotting attacks have now been spotted targeting cash machines here in the United [...] --------------------------------------------- https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/ ∗∗∗ Cybasar.at gehackt: 70.000 österreichische Log-ins im Netz aufgetaucht ∗∗∗ --------------------------------------------- Hunderte E-Mails und Passwörter von offiziellen Stellen enthalten – Daten stammen von Gebrauchtwagenplattform Cybasar --------------------------------------------- http://derstandard.at/2000073253135 ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4099 ffmpeg - security update ∗∗∗ --------------------------------------------- Several vulnerabilities have been discovered in the FFmpeg multimediaframework, which could result in denial of service or potentially theexecution of arbitrary code if malformed files/streams are processed. --------------------------------------------- https://www.debian.org/security/2018/dsa-4099 ∗∗∗ DSA-4101 wireshark - security update ∗∗∗ --------------------------------------------- It was discovered that wireshark, a network protocol analyzer, containedseveral vulnerabilities in the dissectors/file parsers for IxVeriWave,WCP, JSON, XML, NTP, XMPP and GDB, which could result in denial ofservice or the execution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2018/dsa-4101 ∗∗∗ DFN-CERT-2018-0020 ∗∗∗ --------------------------------------------- Auf diesem Wege noch einmal der Hinweis, dass wir unsere Security Advisories zu #Spectre und #Meltdown (DFN-CERT-2018-0020) sowie Spectre 2 (DFN-CERT-2018-0019) beinahe täglich aktualisieren. Bleiben Sie via @DFNCERT_ADV auf dem neuesten Stand. --------------------------------------------- https://twitter.com/DFNCERT/status/956906148388536321 ∗∗∗ DFN-CERT-2018-0196: VMware AirWatch Console (AWC): Eine Schwachstelle ermöglicht einen Cross-Site-Request-Forgery-Angriff ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2018-0196/ ∗∗∗ Security Advisory - Buffer Overflow Vulnerability in the Bluetooth Module of Some Huawei Mobile Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180129-… ∗∗∗ IBM Security Bulletin: IBM has released AIX and VIOS iFixes in response to the vulnerabilities known as Spectre and Meltdown ∗∗∗ --------------------------------------------- http://aix.software.ibm.com/aix/efixes/security/spectre_meltdown_advisory.a… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security SiteProtector System ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012707 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.01.2018
by Daily end-of-shift report 26 Jan '18

26 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-01-2018 18:00 − Freitag 26-01-2018 18:00 Handler: Alexander Riepl Co-Handler: Nina Bieringer ===================== = News = ===================== ∗∗∗ Virenscanner: ClamAV hat zahlreiche Schwachstellen ∗∗∗ --------------------------------------------- Nutzer von ClamAV sollten so schnell wie möglich auf die aktuelle Version der Software wechseln. Denn Sicherheitslücken ermöglichen Angreifern, zum Beispiel mit einem zugeschickten PDF Code auf dem Rechner der Nutzer auszuführen. --------------------------------------------- https://www.golem.de/news/virenscanner-clamav-hat-zahlreiche-schwachstellen… ∗∗∗ Niederländische Geheimdienste hackten russische Hacker ∗∗∗ --------------------------------------------- Russisches Eindringen in digitale Systeme der US-Regierung festgestellt – Hackergruppe "Cozy Beer" jahrelang observiert --------------------------------------------- http://derstandard.at/2000073070848 ∗∗∗ London wirft Moskau Ausspähen strategischer Infrastruktur vor ∗∗∗ --------------------------------------------- Verteidigungsminister Williamson: Totales Chaos mit abertausenden Toten möglich --------------------------------------------- http://derstandard.at/2000073086515 ===================== = Vulnerabilities = ===================== ∗∗∗ Nari PCS-9611 ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-025-01 ∗∗∗ Siemens Desigo PXC ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-025-02 ∗∗∗ Philips IntelliSpace Cardiovascular System Vulnerability ∗∗∗ --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-18-025-01 ∗∗∗ IBM Security Bulletin: IBM Content Navigator is affected by an XML External Entity Injection (XXE) vulnerability ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012595 ∗∗∗ Linux RPM vulnerability CVE-2017-7501 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K03710547 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.01.2018
by Daily end-of-shift report 25 Jan '18

25 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-01-2018 18:00 − Donnerstag 25-01-2018 18:00 Handler: Alexander Riepl Co-Handler: Nina Bieringer ===================== = News = ===================== ∗∗∗ Maersk Reinstalled 45,000 PCs and 4,000 Servers to Recover From NotPetya Attack ∗∗∗ --------------------------------------------- The worlds largest container shipping company â€”A.P. MÃ¸ller-Maerskâ€” said it recovered from the NotPetya ransomware incident by reinstalling over 4,000 servers, 45,000 PCs, and 2500 applications over the course of ten days in late June and early July 2017. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/maersk-reinstalled-45-000-pc… ∗∗∗ BSI-Richtlinie: Der streng geheime Streit über die Routersicherheit ∗∗∗ --------------------------------------------- Das BSI will in den kommenden Monaten eine Technische Richtlinie für Heimrouter herausgeben. Vor allem die Kabelnetzbetreiber halten nichts davon, für möglichst viel Sicherheit bei den Geräten zu sorgen. Der CCC spricht von "Lobbying-Sabotage". --------------------------------------------- https://www.golem.de/news/bsi-richtlinie-der-streng-geheime-streit-ueber-di… ∗∗∗ Windows 10: Microsoft will aufzeigen, was an Gerätedaten gesammelt wird ∗∗∗ --------------------------------------------- Sprachdaten, Positionsdaten und Browserverlauf: Nutzer sollen künftig einen besseren Überblick über gesammelte Daten in Windows 10 bekommen. Dazu stellt Microsoft ein Dashboard für Microsoft-Accounts und einen Diagnostic Viewer für Geräteinformation zur Verfügung. (Microsoft, Datenschutz) --------------------------------------------- https://www.golem.de/news/windows-10-microsoft-will-aufzeigen-was-an-geraet… ∗∗∗ Cloudflare[.]solutions Keylogger Returns on New Domains ∗∗∗ --------------------------------------------- A few months ago, we covered two injections related to the “cloudflare.solutions” malware: a CoinHive cryptominer hidden within fake Google Analytics and jQuery, and the WordPress keylogger from Cloudflare[.]solutions. This malware was originally identified by one of our analysts in April 2017 and has since evolved and spread to new domains. Keylogger Spreads to New Domains A few days after our keylogger post was released on Dec 8th, 2017, the Cloudflare[.]solutions domain was taken [...] --------------------------------------------- https://blog.sucuri.net/2018/01/cloudflare-solutions-keylogger-returns-on-n… ∗∗∗ libcurl has had auth leak bug since the first commit we recorded ∗∗∗ --------------------------------------------- Fixed in 7.58.0 If you use libcurl, the command line tool and library for transferring data with URLs, get ready to patch. The tool has a pair of problems, one of which is an authentication leak.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2018/01/25/curl_carrie… ∗∗∗ Healthcare CERTs highlight the need for security guidance for specific sectors ∗∗∗ --------------------------------------------- A new computer emergency response team has been launched in the Netherlands to provide guidance specifically tailored to the healthcare sector. Martijn Grooten welcomes the development. Read more --------------------------------------------- https://www.virusbulletin.com:443/blog/2018/01/healthcare-certs-show-need-s… ∗∗∗ Announcing turndown of the deprecated Google Safe Browsing APIs ∗∗∗ --------------------------------------------- Posted by Alex Wozniak, Software Engineer, Safe Browsing TeamIn May 2016, we introduced the latest version of the Google Safe Browsing API (v4). Since this launch, thousands of developers around the world have adopted the API to protect over 3 billion devices from unsafe web resources.Coupled with that announcement was the deprecation of legacy Safe Browsing APIs, v2 and v3. Today we are announcing an official turn-down date of October 1st, 2018, for these APIs. All v2 and v3 clients must [...] --------------------------------------------- https://security.googleblog.com/2018/01/announcing-turndown-of-deprecated.h… ===================== = Vulnerabilities = ===================== ∗∗∗ DSA-4096 firefox-esr - security update ∗∗∗ --------------------------------------------- Several security issues have been found in the Mozilla Firefox webbrowser: Multiple memory safety errors, use-after-frees, integeroverflows and other implementation errors may lead to the execution ofarbitrary code, denial of service or URL spoofing. --------------------------------------------- https://www.debian.org/security/2018/dsa-4096 ∗∗∗ Vulnerability Spotlight: Multiple Unpatched Vulnerabilities in Blender Identified ∗∗∗ --------------------------------------------- Update 1/25/18: Blender has released version 2.79a to address these issues Technology has evolved in incredible ways that has helped people to create and visualize media like never before. Today, people can use tools such as Blender to visualize, model, and animate 3D content, especially since its free and open-source software. However, this also make it an attractive target for adversaries to audit and find vulnerabilities. Given the user base of Blender, exploiting these vulnerabilities to [...] --------------------------------------------- http://blog.talosintelligence.com/2018/01/unpatched-blender-vulns.html ∗∗∗ DFN-CERT-2018-0177: Google Chrome, Chromium: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes ∗∗∗ --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2018-0177/ ∗∗∗ IBM Security Bulletin: PowerKVM has released fixes in response to the vulnerabilities known as Spectre and Meltdown. ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026853 ∗∗∗ IBM Security Bulletin: Vulnerabilities in postgresql affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026733 ∗∗∗ IBM Security Bulletin: Vulnerabilities in PHP affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026732 ∗∗∗ IBM Security Bulletin: A vulnerability in Apache Portable Runtime affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026735 ∗∗∗ IBM Security Bulletin: A vulnerability in procmail affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026736 ∗∗∗ IBM Security Bulletin: A vulnerability in curl affects PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026734 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012767 ∗∗∗ IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1026731 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (ITNCM) ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22007398 ∗∗∗ IBM Security Bulletin: Rational DOORS is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012789 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.01.2018
by Daily end-of-shift report 24 Jan '18

24 Jan '18

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-01-2018 18:00 − Mittwoch 24-01-2018 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Skype, Signal, Slack, other apps inherit Electron vuln ∗∗∗ --------------------------------------------- If youve built a Windows application on Electron, check to see if its subject to a just-announced remote code execution vulnerability. ... Slack users should update to version 3.0.3 or better, and the latest version of Skype for Windows is protected --------------------------------------------- https://www.theregister.co.uk/2018/01/24/skype_signal_slack_nherit_electron… ∗∗∗ [papers] Hardcore SAP Penetration Testing ∗∗∗ --------------------------------------------- http://www.exploit-db.com/docs/english/43859-hardcore-sap-penetration-testi… ∗∗∗ 14 flaws found that could take over industrial control systems ∗∗∗ --------------------------------------------- Licence management systems used in industrial control systems are plagued with vulnerabilities - contain 14 flaws could enable hackers to take control of systems and carry out DoS attacks --------------------------------------------- https://www.scmagazineuk.com/news/14-flaws-found-that-could-take-over-indus… ===================== = Vulnerabilities = ===================== ∗∗∗ Advantech WebAccess/SCADA ∗∗∗ --------------------------------------------- This advisory contains mitigation details for path traversal and SQL injection vulnerabilities in Advantech’s WebAccess/SCADA software platform. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-18-023-01 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (smarty3), Fedora (bind, bind-dyndb-ldap, dnsperf, glibc, kernel, libtasn1, libvpx, mariadb, python-bottle, ruby, and sox), Red Hat (rh-eclipse46-jackson-databind), SUSE (kernel), and Ubuntu (kernel, linux, linux-aws, linux-euclid, linux-hwe, linux-azure, linux-gcp, linux-oem, linux-lts-trusty, linux-lts-xenial, linux-aws, and rsync). --------------------------------------------- https://lwn.net/Articles/745165/rss ∗∗∗ Apple Updates Everything, Again, (Tue, Jan 23rd) ∗∗∗ --------------------------------------------- https://isc.sans.edu/diary/rss/23269 ∗∗∗ Vuln: GIMP CVE-2017-17786 Heap Buffer Overflow Vulnerability ∗∗∗ --------------------------------------------- http://www.securityfocus.com/bid/102765 ∗∗∗ Security Advisory - Memory Leak Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20180124-… ∗∗∗ Security Advisory - Two Vulnerabilities in MGCP Protocol of Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180124-… ∗∗∗ Security Advisory - Integer Overflow Vulnerability on Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180124-… ∗∗∗ Security Advisory - DoS Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180124-… ∗∗∗ Security Advisory - CPU Vulnerabilities Meltdown and Spectre ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20180106-… ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012739 ∗∗∗ IBM Security Bulletin: Cross-site scripting vulnerability in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012712 ∗∗∗ IBM Security Bulletin: Content Collector for Email is affected by vulnerability due to information disclosure in MyFaces for WebSphere Application Server ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012737 ∗∗∗ IBM Security Bulletin: Content Collector for Email is affected by vulnerability due to information disclosure in Apache MyFaces ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012735 ∗∗∗ IBM Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos TM1 ∗∗∗ --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg22012623 ∗∗∗ IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Insight. ∗∗∗ --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg22012627 ∗∗∗ SSA-824231 (Last Update 2018-01-24): Unauthenticated Firmware Upload Vulnerability in Desigo PXC ∗∗∗ --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-824231… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily