Daily

daily@lists.cert.at

1 participants
3158 discussions

Tageszusammenfassung - Dienstag 6-09-2016
by Daily end-of-shift report 06 Sep '16

06 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-09-2016 18:00 − Dienstag 06-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Hacker takes down CEO wire transfer scammers, sends their Win 10 creds to the cops *** --------------------------------------------- Whaling attackers fall for poison PDF invoices HITB Florian Lukavsky hacks criminals profiting from out of control multi-billion dollar CEO wire transfer scams and they hate him for it. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/09/06/hacker_hack… *** House of Keys: 9 Months later... 40% Worse *** --------------------------------------------- In November 2015 SEC Consult released the results of our study on hardcoded cryptographic secrets in embedded systems. Its time to summarize what has happened since.To accomplish the mammoth task of informing about 50 different vendors and various ISPs we teamed up with CERT/CC (VU#566724). We would really like to report that our efforts were successful, but as it turns out the number of devices on the web using known private keys for HTTPS server certificates has gone up by 40% in the last... --------------------------------------------- http://blog.sec-consult.com/2016/09/house-of-keys-9-months-later-40-worse.h… *** Too many Cisco ASA boxes still open to an EXTRABACON attack *** --------------------------------------------- Among the Equation Group exploits leaked by the Shadow Brokers, the one named EXTRABACON that targets Cisco ASA devices got the most attention from security researchers and attackers. It has been demonstrated that the original exploit can be easily modified to work on more recent versions of the Cisco ASA SSL VPN appliances, and researchers armed with honeypots noted that exploitation attempts started soon after the leak. You would think that news like this would... --------------------------------------------- https://www.helpnetsecurity.com/2016/09/06/cisco-asa-still-open-extrabacon/ *** Digital Forensics According to the FORZA Model and Diamond Model for Intrusion Analysis *** --------------------------------------------- The Bridge on the River Forza We can teach these barbarians a lesson in Western methods and efficiency that will put them to shame. -Colonel Nicholson (The Bridge on the River Kwai, 1957) Efficiency. Something we look to implement in everything we do, whether that be through the elimination of waste through Six Sigma, or other frameworks and methodologies, efficiency is what we strive for. When performing digital forensics, efficiency and rigor in our approach to ensure no stone left... --------------------------------------------- https://feeds.feedblitz.com/~/192237180/0/alienvault-blogs~Digital-Forensic… *** How False Positives can ruin your day - and how to stop them *** --------------------------------------------- False positives can seriously ruin your day, and can cost enterprises serious money. Highlighted by a recent example, we share some key tips on how to mitigate false alerts. --------------------------------------------- https://www.htbridge.com/blog/how-false-positives-can-ruin-your-day-and-how… *** A week in security (Aug 28 - Sep 03) *** --------------------------------------------- A compilation of notable security news and blog posts from August 28th to September 3rd. This week, we talked about browser-based fingerprinting; what was going on with the Mac app, Transmission; and a tech support scam that banked on an iPad error popping up on Windows systems.Categories: Security world Week in securityTags: recapweekly blog roundup(Read more...) --------------------------------------------- https://blog.malwarebytes.com/security-world/2016/09/a-week-in-security-aug… *** [2016-09-06] Private key for browser-trusted certificate embedded in multiple Aruba Networks / Alcatel-Lucent products *** --------------------------------------------- A browser-trusted certificate including its private key is embedded in the firmware of several Aruba Networks/Alcatel-Lucent products. The certificate is used for providing user access to a captive portal via HTTPS as well as EAP connections for WPA2-Enterprise clients. An attacker can use this vulnerability to impersonate a captive portal or Wi-Fi AP and gain access to sensitive information. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** SSA-630413 (Last Update 2016-09-05): Vulnerabilities in SIPROTEC 4 and SIPROTEC Compact *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413… *** ArcServe UDP - Unquoted Service Path Privilege Escalation *** --------------------------------------------- Topic: ArcServe UDP - Unquoted Service Path Privilege Escalation Risk: High Text:Title: ArcServe UDP - Unquoted Service Path Privilege Escalation CWE Class: CWE-427: Uncontrolled Search Path Element Date: 0... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090024 *** ArcServe UDP - Download Manager/Setup - DLL Hijacking *** --------------------------------------------- Topic: ArcServe UDP - Download Manager/Setup - DLL Hijacking Risk: Medium Text:Title: ArcServe UDP - Download Manager/Setup - DLL Hijacking CWE Class: CWE-427: Uncontrolled Search Path Element Date: 04/09... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090030 *** ArcServe UDP - HTTP Installation MiTM *** --------------------------------------------- Topic: ArcServe UDP - HTTP Installation MiTM Risk: Low Text:Title: ArcServe UDP - MiTM CWE Class: CWE-300: Channel Accessible by Non-Endpoint (Man-in-the-Middle) | CWE-319: Cleartext T... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090029 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in Network Security Services (NSS) affects the IBM FlashSystem model V9000 (CVE-2016-1978) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009104 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Network Security Services (NSS) affect the IBM FlashSystem models 840 and 900 (CVE-2016-1978) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009103 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in Network Security Services (NSS) affects the IBM FlashSystem model V840 (CVE-2016-1978) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009102 --------------------------------------------- *** IBM Security Bulletin: BigInsights is affected by a vulnerability in DB2 (CVE-2014-0919, CVE-2016-0211) *** http://www.ibm.com/support/docview.wss?uid=swg21987604 --------------------------------------------- *** IBM Security Bulletin: IBM Forms Viewer may be affected by an Apache Xerces-C XML Parser library vulnerability (CVE-2016-0729) *** http://www-01.ibm.com/support/docview.wss?uid=swg21988714 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem model V840 (CVE-2016-2107) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009106 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem models 840 and 900 (CVE-2016-2107) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009105 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 5-09-2016
by Daily end-of-shift report 05 Sep '16

05 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-09-2016 18:00 − Montag 05-09-2016 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** DNS tunneling threat drills into nearly half of networks tested *** --------------------------------------------- InfoBloxs new report showed nearly half of all networks tested to show signs of DNS tunnelling --------------------------------------------- http://www.scmagazine.com/dns-tunneling-threat-drills-into-nearly-half-of-n… *** Android Patch Fixes Nexus 5X Critical Vulnerability *** --------------------------------------------- Google patched an undocumented vulnerability that allowed attackers to bypass Nexus 5X devices lock screen via a forced memory dump that exposed the device owners password. --------------------------------------------- http://threatpost.com/android-patch-fixes-nexus-5x-critical-vulnerability/1… *** Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker to access data from a packet buffer that was previously .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Sundown EK – Stealing Its Way to the Top *** --------------------------------------------- Sundown is one of the newest Exploit Kits on the market these days, and like many up-and-coming exploit kits before it, this means that it is in under constant development. With .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Sundown-EK-%e2%80%93-St… *** Mailman Access Control Flaw in User Options Page Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- Mailman Access Control Flaw in User Options Page Lets Remote Users Conduct Cross-Site Request Forgery Attacks --------------------------------------------- http://www.securitytracker.com/id/1036728 *** ‘Flash Hijacks’ Add New Twist to Muggings *** --------------------------------------------- A frequent crime in Brazil is a scheme in which thieves kidnap people as theyre leaving a bank, and free them only after theyve visited a number of ATMs to withdraw .. --------------------------------------------- http://krebsonsecurity.com/2016/09/flash-hijacks-add-new-twist-to-muggings/ *** Telnet is not dead – at least not on ‘smart’ devices *** --------------------------------------------- Depending on your age, you either might or might not have used Telnet to connect to remote computers in the past. But .. --------------------------------------------- http://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at-least-not-on-smart-d… *** "Wenn Ihre Daten in der Cloud sind, hat sie auch die NSA" *** --------------------------------------------- Der Kryptologe Bart Preneel im futurezone-Interview über Verschlüsselung in der Nach-Snowden-Ära, Hintertüren und Quantenkryptographie. --------------------------------------------- https://futurezone.at/science/wenn-ihre-daten-in-der-cloud-sind-hat-sie-auc… *** Microsoft thought of the children and decided to ban some browsers *** --------------------------------------------- Redmonds Family Settings now block browsers-without-filters by default, but which ones? Microsoft has updated its family filters to block some rival .. --------------------------------------------- www.theregister.co.uk/2016/09/05/microsoft_thought_of_the_children_and_deci… *** Hintergrund: Analysiert: Ransomware meets Info-Stealer - RAA und das diebische Pony, Teil II *** --------------------------------------------- Wie diese Analysiert:-Folge enthüllt, weist die scheinbar perfekte Verschlüsselung des RAA-Trojaners doch Lücken auf. Auch der von RAA gestartete Passwort-Dieb kann sich mit seinen Anti-Debugging-Tricks der Analyse nicht entziehen. --------------------------------------------- http://heise.de/-3303401 *** Fake attacks by insiders to fool companies *** --------------------------------------------- Famous cybercrime groups and hacktivists “brands” may be a smokescreen to cover sophisticated insider attacks. --------------------------------------------- https://www.htbridge.com/blog/fake-attacks-by-insiders-to-fool-companies.ht… *** Security Advisory - Information Leak Vulnerability in Huawei eSpace IAD *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160905-… *** Security Advisory - Multiple Security Vulnerabilities in Huawei HiSuite *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160905-… *** BKA geht mit SOKO Clavis gegen Ransomware vor *** --------------------------------------------- Nachdem sich in den vergangenen Wochen die Fälle häufen, will das Bundeskriminalamt nun gezielt gegen Ransomware vorgehen. Eine SOKO soll die Täter ausfindig machen. --------------------------------------------- https://futurezone.at/netzpolitik/bka-geht-mit-soko-clavis-gegen-ransomware… *** Sophos Windows users face black screens after false positive snafu *** --------------------------------------------- Black is the new BSOD Users of Sophos’s security software were confronted with a black screen on starting up .. --------------------------------------------- www.theregister.co.uk/2016/09/05/sophos_black_screen_snafu/ *** Vuln: Inspircd SSL Certificate Spoofing Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/92737 *** Totgesagte leben länger: Adobe poliert NPAPI-Flash auf Linux auf *** --------------------------------------------- Entgegen so manch einem Meinungsartikel ist Flash noch lange nicht am Ende. Das muss wohl auch Adobe einsehen und frischt nun die veraltete NPAPI-Version unter Linux auf. --------------------------------------------- http://heise.de/-3314084 *** 800.000 Klartext-Passwörter der Pornoseite Brazzers veröffentlicht *** --------------------------------------------- Wieder ist ein großer Hack mit kopierten Nutzerdaten bekannt geworden und wieder scheint der Einbruch in die Server 2012 stattgefunden zu haben. --------------------------------------------- http://heise.de/-3314087 *** Malware Delivered via .pub Files *** --------------------------------------------- While searching for new scenarios to deliver their malwares[1][2], attackers launched a campaignto deliver malicious code embedded in Microsoft Publisher[3] (.pub) files. The .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21443 *** Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems *** --------------------------------------------- The Trend Micro Forward Looking Threat Research team recently obtained samples of a new rootkit family from one of our trusted partners. We are providing a .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-u…

1 0

Tageszusammenfassung - Freitag 2-09-2016
by Daily end-of-shift report 02 Sep '16

02 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 01-09-2016 18:00 − Freitag 02-09-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Chrome 53 Fixes Address Spoofing Vulnerability, 32 Other Bugs *** --------------------------------------------- http://threatpost.com/chrome-53-fixes-address-spoofing-vulnerability-32-oth… *** Insecure Redis Instances at Core of Attacks Against Linux Servers *** --------------------------------------------- Attackers are targeting insecure Redis instances, exposed to the internet, to access Linux servers and delete web files and folders in exchange for ransom. --------------------------------------------- http://threatpost.com/insecure-redis-instances-at-core-of-attacks-against-l… *** Security Update 2016-001 El Capitan and Security Update 2016-005 Yosemite *** --------------------------------------------- https://support.apple.com/kb/HT207130 *** Safari 9.1.3 *** --------------------------------------------- https://support.apple.com/kb/HT207131 *** IoT Home Router Botnet Leveraged in Large DDoS Attack *** --------------------------------------------- We have been monitoring a large-scale Layer 7 HTTPS flood attack (i.e., application level DDoS) against a customer over the past few weeks. It is being distributed .. --------------------------------------------- https://blog.sucuri.net/2016/09/iot-home-router-botnet-leveraged-in-large-d… *** Wenn die Physik zur Sicherheitslücke wird *** --------------------------------------------- Bei der Sicherheitskonferenz Usenix haben Hacker neue Möglichkeiten demonstriert, Systeme mit Angriffen auf die Hardware zu manipulieren. --------------------------------------------- https://futurezone.at/science/wenn-die-physik-zur-sicherheitsluecke-wird/21… *** DSA-3658 libidn - security update *** --------------------------------------------- Hanno Boeck discovered multiple vulnerabilities in libidn, the GNUlibrary for Internationalized Domain Names (IDNs), allowing a remoteattacker to cause a denial of service against an application using thelibidn library (application crash). --------------------------------------------- https://www.debian.org/security/2016/dsa-3658 *** Mutmaßlicher Angreifer auf Web-Infrastruktur des Linux Kernels festgenommen *** --------------------------------------------- In den USA ist ein Hacker festgenommen worden, der für Angriffe auf die Linux Foundation und die Webseite kernel.org verantwortlich sein soll. Dabei handelt es sich wohl um den einschlägig bekannten Angriff von 2011. --------------------------------------------- http://heise.de/-3312595 *** Over 40 million usernames, passwords from 2012 breach of Last.fm surface *** --------------------------------------------- While Last.fm informed users in 2012, passwords were easily cracked. --------------------------------------------- http://arstechnica.com/security/2016/09/over-40-million-usernames-passwords…

1 0

Tageszusammenfassung - Donnerstag 1-09-2016
by Daily end-of-shift report 01 Sep '16

01 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 31-08-2016 18:00 − Donnerstag 01-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** There are really only two effectively distinct settings for the UAC slider *** --------------------------------------------- Theres a control panel that lets you specify how often you want to be prompted by UAC. You can set any of four levels: ... Although it looks like there are four settings, in a theoretical sense, there really are only two settings. --------------------------------------------- https://blogs.msdn.microsoft.com/oldnewthing/20160816-00/?p=94105 *** Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050 *** --------------------------------------------- https://www.drupal.org/node/2793115 *** So much for counter-phishing training: Half of people click anything sent to them *** --------------------------------------------- Even people who claimed to be aware of risks clicked out of curiosity. --------------------------------------------- http://arstechnica.com/security/2016/08/researchers-demonstrate-half-of-peo… *** New Version of Cerber Ransomware Distributed via Malvertising *** --------------------------------------------- Crber has become one of the most notorious and popular ransomware families to date. It now has a new variant that, while superficially similar to earlier variants, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/new-version-cerb… *** MMD-0056-2016 - Linux/Mirai, how an old ELF malcode is recycled.. *** --------------------------------------------- Background From August 4th 2016 several sysadmin friends were starting to upload this malware files to our dropbox. The samples warent easy to retrieve, so there are good ones and also some broken ones, I listed in this post for the good ones. This threat is made by the ELF trojan backdoor, the .. --------------------------------------------- http://blog.malwaremustdie.org/2016/08/mmd-0056-2016-linuxmirai-just.html *** Maxmind.com (Ab)used As Anti-Analysis Technique *** --------------------------------------------- A long time ago I wrote a diary[1] about malware samples which use online geolocalization services. Such services are used to target only specific victims. If the malware detects that it is executed from a specific area, it just stops. This .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21435 *** Breaching a CA – Blind Cross-site Scripting (BXSS) in the GeoTrust SSL Operations Panel Using XSS Hunter *** --------------------------------------------- This is a continuation of a series of blog posts which will cover blind cross-site scripting (XSS) and its impact on the internal systems which suffer from it. Previously, .. --------------------------------------------- https://thehackerblog.com/breaching-a-ca-blind-cross-site-scripting-bxss-in… *** Spotify: Einfach mal Passwörter ändern *** --------------------------------------------- Schon wieder neue Passwörter: Einige Kunden von Spotify sollen sie als Vorsichtsmaßnahme ändern, der Hintergrund bleibt vage. Auch nach welchen Kriterien die Kunden ausgewählt wurden, ist nicht bekannt. --------------------------------------------- http://www.golem.de/news/spotify-einfach-mal-passwoerter-aendern-1609-12301… *** Bundeskriminalamt warnt vor Erpressungs-Trojaner in falschen Bewerbungsmails *** --------------------------------------------- Computer wird verschlüsselt und Lösegeld gefordert --------------------------------------------- http://derstandard.at/2000043687916 *** Unix: OpenBSD 6.0 erzwingt W^X für das Basissystem *** --------------------------------------------- Das OpenBSD-Projekt sichert sein Basissystem ab, indem der genutzte Speicher entweder beschreibbar oder ausführbar (W^X) ist. Zudem verzichtet das Team auf VAX- und Linux-Support, hat aber die ARMv7-Unterstützung erweitert. --------------------------------------------- http://www.golem.de/news/unix-openbsd-6-0-erzwingt-w-x-fuer-das-basissystem… *** Darknet: Festnahme nach Drogenrazzia bei Chemical-Love-Kunden *** --------------------------------------------- Bei einer bundesweiten Razzia konnten Ermittler größere Mengen Drogen sicherstellen, die die Verdächtigen zuvor im Darknet gekauft haben sollen. Die Beschuldigten sollen als Händler tätig gewesen sein. --------------------------------------------- http://www.golem.de/news/darknet-festnahme-nach-drogenrazzia-bei-chemical-l… *** Retefe-Trojaner in gefälschten Rechnungen *** --------------------------------------------- In E-Mailpostfachen finden sich Nachrichten mit dem Betreff „Ihre Zahlung 631 EUR“, „167 EUR Bestellung“, „33 EUR Zahlung“ oder „81 EUR Rechnung“. Sie stammen angeblich von der .. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/retefe-trojaner-in…

1 0

Tageszusammenfassung - Mittwoch 31-08-2016
by Daily end-of-shift report 31 Aug '16

31 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-08-2016 18:00 − Mittwoch 31-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Bulletin Posted for ColdFusion (APSB16-30) *** --------------------------------------------- Adobe has published a Security Bulletin (APSB16-30) announcing the availability of hotfixes for ColdFusion versions 11 and 10. These hotfixes resolve a critical vulnerability .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1395 *** Inside the Demise of the Angler Exploit Kit *** --------------------------------------------- Researchers at Kaspersky Lab today confirmed that the cybercriminals behind the Lurk Trojan were also responsible for the development and distribution of .. --------------------------------------------- http://threatpost.com/inside-the-demise-of-the-angler-exploit-kit/120222/ *** BASHLITE Family Of Malware Infects 1 Million IoT Devices *** --------------------------------------------- Over 1 million consumer web-connected video cameras and DVRs have have become the slaves to botnet herders that use the devices for DDoS and phishing attacks. --------------------------------------------- http://threatpost.com/bashlite-family-of-malware-infects-1-million-iot-devi… *** Ask Sucuri: How Modern Web Phishing Works *** --------------------------------------------- Most of us have experienced some kind of phishing attempt in our online lives, and we have seen phishing grow in complexity. Usually, we notice that the login pages are .. --------------------------------------------- https://blog.sucuri.net/2016/08/modern-web-phishing-works.html *** Ursnif: Deep Technical Dive *** --------------------------------------------- While attack tools around the world are stealthy and stay under the radar, we at Seculert examine many different malicious tools. This is done in order to stay at least one step ahead of the attackers, and improve our advanced analytics technology to detect their artistic evasive techniques. --------------------------------------------- http://www.seculert.com/blogs/ursnif-deep-technical-dive *** Das Ziel seien Banken: DDoS‑Erpresser fordern “nur” 1 Bitcoin und drohen Verschlüsselung an *** --------------------------------------------- Die aktuelle Gruppe nennt sich „HACKER TEAM – Armada Collective“. Die Kriminellen haben laut Link11 mehreren .. --------------------------------------------- http://www.it-finanzmagazin.de/ernstzunehmende-ddos-erpresser-fordern-nur-1… *** Adobe stopft ColdFusion-Lücken vor dem Patchday *** --------------------------------------------- Gut zwei Wochen vor dem regulären Patchday der Firma schließt Adobe zwei Lücken im Web-Application-Server ColdFusion. Das deutet darauf hin, dass Admins die Patches schnell einspielen sollten. --------------------------------------------- http://heise.de/-3309658 *** Blockchain-Technologie: Ein Drittel aller Bitcoin-Börsen wurde gehackt *** --------------------------------------------- Wie sicher sind Bitcoin bei Online-Börsen? Nicht besonders, wenn man einer aktuellen Studie Glauben schenkt. Demnach .. --------------------------------------------- http://www.golem.de/news/blockchain-technologie-ein-drittel-aller-bitcoin-b… *** [2016-08-31] Manipulation of pre-boot authentication in CryptWare CryptoPro Secure Disk for Bitlocker *** --------------------------------------------- CryptoPro Secure Disk for Bitlocker contains multiple vulnerabilities which can be used by an attacker to manipulate the PBA (pre-boot authentication). This allows .. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** DSA-3657 libarchive - security update *** --------------------------------------------- Hanno Boeck and Marcin Noga discovered multiple vulnerabilities inlibarchive; processing malformed archives may result in denial ofservice or the execution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2016/dsa-3657 *** Dropbox-Hack: Seit 2012 rund 68 Millionen Passwörter im Netz *** --------------------------------------------- Datenbank konnte offenbar wegen LinkedIn-Hack gestohlen werden, wo Dropbox-Mitarbeiter gleiches Passwort nutzte --------------------------------------------- http://derstandard.at/2000043625840 *** Swift spricht von weiteren Hackerattacken auf Banken *** --------------------------------------------- http://derstandard.at/2000043626250 *** BitTorrent-Client Transmission brachte erneut Malware auf Macs *** --------------------------------------------- Zum zweiten Mal konnten sich Nutzer durch den Download der populären BitTorrent-App Malware auf ihrem Mac .. --------------------------------------------- http://heise.de/-3310446 *** Sicherheitslücken in Defibrillatoren: Investmentfirma spekulierte mit Hersteller-Börsenkurs *** --------------------------------------------- Ein schwerer Vorwurf: Eine Sicherheitsfirma soll ein potenziell lebensbedrohliche Sicherheitslücken aufgebauscht und an eine Investmentfirma verraten haben, um dann an der Börse Geld zu scheffeln. --------------------------------------------- http://heise.de/-3309906 *** Zertifizierungsstelle: Wosign stellt unberechtigtes Zertifikat für Github aus *** --------------------------------------------- Eine ganze Reihe von Vorfällen bringt die Zertifizierungsstelle Wosign in Erklärungsnot. Verschiedene Sicherheitslücken ermöglichten die unberechtigte Ausstellung von .. --------------------------------------------- http://www.golem.de/news/zertifizierungsstelle-wosign-stellt-unberechtigtes…

1 0

Tageszusammenfassung - Dienstag 30-08-2016
by Daily end-of-shift report 30 Aug '16

30 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-08-2016 18:00 − Dienstag 30-08-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Browser-based fingerprinting: implications and mitigations *** --------------------------------------------- This post covers the information disclosure bugs in Internet Explorer and Edge that we sometimes refer to as fingerprinting. We review past .. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/exploits/2016/08/browser-based-fin… *** Double-click me not: Malicious proxy settings in OLE Embedded Script *** --------------------------------------------- Attackers have been using social engineering to avoid the increasing costs of exploitation due to the significant hardening and exploit mitigations investments in .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/08/29/double-click-me-not-mal… *** Hintergrund: Analysiert: Ransomware meets Info-Stealer - RAA und das diebische Pony *** --------------------------------------------- Im Rahmen unserer Analysiert:-Serie geht es diesmal einem Erpressungs-Trojaner an den Code: Olivia von Westernhagen untersucht den in JavaScript realisierte RAA-Trojaner, der gleich auch noch eine Passwort-Klau-Malware im Gepäck hat. --------------------------------------------- http://heise.de/-3303113 *** Skurriles Motiv für Cyberangriff auf Präsidenten-Website in Sri Lanka *** --------------------------------------------- 17 Jahre alter Angreifer forderte Verschiebung der Abiturprüfungen --------------------------------------------- http://derstandard.at/2000043545769 *** Linux-Paketmanager: RPM-Entwicklung verläuft chaotisch *** --------------------------------------------- Unser Autor hat versucht, potenzielle Sicherheitslücken im Paketmanager RPM zu melden, der von Red Hat, Suse und weiteren Linux-Distributionen genutzt wird. Doch das war gar .. --------------------------------------------- http://www.golem.de/news/linux-paketmanager-rpm-entwicklung-verlaeuft-chaot… *** The Hunt for Lurk *** --------------------------------------------- In June, 2016, the Russian police arrested the alleged members of the criminal group known as Lurk. The police suspected Lurk of stealing nearly three billion rubles. The story of Lurk gives some idea of the amount of work that has to be done to obtain enough evidence to arrest and prosecute suspects. --------------------------------------------- http://securelist.com/analysis/publications/75944/the-hunt-for-lurk/ *** Ripper: Geldautomaten-Malware gibt bis zu 40 Scheine aus *** --------------------------------------------- Sicherheitsforscher haben eine Schadsoftware entdeckt, die Geldautomaten gleich dreier Hersteller infizieren soll. Vieles deutet daraufhin, dass Kriminelle mit Hilfe der Malware in Thailand Geld im Wert von mehr als 300.000 Euro entwenden konnten. --------------------------------------------- http://www.golem.de/news/ripper-geldautomaten-malware-gibt-bis-zu-40-schein… *** Linux servers hit with FairWare ransomware – or is it just a scam? *** --------------------------------------------- Users posting on Bleeping Computer’s forums have alerted the world to a new threat targeting Linux server admins: the FairWare ransomware. Whether the ransomware actually .. --------------------------------------------- https://www.helpnetsecurity.com/2016/08/30/linux-fairware-ransomware/ *** Sicherheit implantierbarer Medizintechnik: Herzschrittmacher von St. Jude Medical sollen hackbar sein *** --------------------------------------------- Streit mit harten Bandagen: Der US-amerikanische Medizingerätehersteller St. Jude Medical zofft sich mit dem Sicherheitsspezialisten MedSec und der Investmentfirma Muddy Waters Capital über die Sicherheit von lebenswichtigen Geräten. --------------------------------------------- http://heise.de/-3307510 *** 71,000 Minecraft World Map accounts leaked online after hack *** --------------------------------------------- Dumped creds have been exposed since January Some 71,000 user accounts and IP addresses have been leaked from Minecraft fan website Minecraft World Map. --------------------------------------------- www.theregister.co.uk/2016/08/30/71000_minecraft_world_map_accounts_leak/

1 0

Tageszusammenfassung - Montag 29-08-2016
by Daily end-of-shift report 29 Aug '16

29 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-08-2016 18:00 − Montag 29-08-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** VMSA-2016-0007.2 *** --------------------------------------------- VMware NSX and vCNS product updates address a critical information disclosure vulnerability --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0007.html *** Another Day - Another Ransomware Sample *** --------------------------------------------- Catching ransomware is pretty easy these days. I setup a procmail filter that will extract all e-mails with compressed JavaScript attachments. Whatever is .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21413 *** QNAP QTS Bugs Let Remote Users Conduct Cross-Site Scripting Attacks, Overwrite Arbitrary Files, and Inject Commands *** --------------------------------------------- http://www.securitytracker.com/id/1036699 *** Tips for Securing SSL Renegotiation *** --------------------------------------------- A number of Internet connections require SSL renegotiation, a Secure Sockets Layer/Transport .. --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/tips-securing-ssl-renegotiation/ *** Amazon: Gehackte Händlerkonten locken mit Schnäppchen *** --------------------------------------------- Bei besonders günstigen Artikeln im Amazon Marketplace versuchen die vermeintlichen Händler die Kaufabwicklung außerhalb des Shops vorzunehmen. --------------------------------------------- http://futurezone.at/digital-life/amazon-gehackte-haendlerkonten-locken-mit… *** Dropbox setzt Passwörter aus dem Jahr 2012 und davor zurück *** --------------------------------------------- Der Cloud-Speicher-Dienst fordert aktuell einige Nutzer dazu auf, ihr Dropbox-Kennwort zurückzusetzen und neu zu vergeben. Hintergrund ist ein Datenleck aus dem Jahr 2012. --------------------------------------------- http://heise.de/-3306240 *** Cybercriminals Select Insiders To Attack Telecom Providers *** --------------------------------------------- An anonymous reader quotes a report from Help Net Security: Cybercriminals are using insiders to gain access to telecommunications networks and subscriber data, according to Kaspersky Lab. In addition, these .. --------------------------------------------- https://tech.slashdot.org/story/16/08/27/0739204/cybercriminals-select-insi… *** Opera warns Opera Sync users of possible security breach *** --------------------------------------------- The Norwegian company warned the users that the Opera Sync service of a possible security breach that might have exposed their data. On Friday, Opera, published .. --------------------------------------------- http://securityaffairs.co/wordpress/50690/data-breach/opera-sync-security-b… *** Observatory: Mozilla bietet Sicherheitscheck für Websites *** --------------------------------------------- Wie sicher ist die eigene Internetseite? Der Test mit einem neuen Tool von Browserhersteller Mozilla könnte für viele Betreiber ernüchternd sein. --------------------------------------------- http://www.golem.de/news/observatory-mozilla-bietet-sicherheitscheck-fuer-w… *** Ransomware: Trojaner Fantom gaukelt kritisches Windows-Update vor *** --------------------------------------------- Ein Windows-Update wiegt die Nutzer in Sicherheit, haben sich die Hersteller des Erpressungstrojaners Fantom wohl gedacht. In diesem Fall ist jedoch besondere Vorsicht geboten. --------------------------------------------- http://www.golem.de/news/ransomware-trojaner-fantom-gaukelt-kritisches-wind… *** Exploits: Treiber der Android-Hersteller verursachen Kernel-Lücken *** --------------------------------------------- Die Zahl der Angriffe auf den Linux-Kernel in Android wächst sehr stark. Der mit Abstand größte Teil der bekannten Sicherheitslücken findet sich dabei in den Gerätetreibern der Hersteller, die mit der Kernel-Pflege offenbar überfordert sind. --------------------------------------------- http://www.golem.de/news/exploits-treiber-der-android-hersteller-verursache… *** Wartungsarbeiten Donnerstag, 1. 9. 2016, nachmittags *** --------------------------------------------- Am Donnerstag, 1. September 2016, werden wir ab etwa 13h notwendige Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies wird zu keinen Ausfällen der extern .. --------------------------------------------- http://www.cert.at/services/blog/20160829150342-1783.html *** l+f: Passwort-Safe mit Löchern *** --------------------------------------------- Googles Security Crack Tavis Ormandy nimmt sich nach der Anitviren-Software jetzt Passwort-Safes zur Brust -- mit ähnlich erschreckenden Resultaten. --------------------------------------------- http://heise.de/-3306993 *** ZDI-16-497: Apple OS X AppleHDA Buffer Overflow Privilege Escalation Vulnerability *** --------------------------------------------- This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Apple OS X. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-497/

1 0

Tageszusammenfassung - Freitag 26-08-2016
by Daily end-of-shift report 26 Aug '16

26 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-08-2016 18:00 − Freitag 26-08-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** OpenSSL schützt vor Sweet32-Attacke und tanzt ChaCha20 *** --------------------------------------------- Version 1.1.0 mistet alte, unsichere Krypto-Verfahren aus und unterstützt dafür modernere wie ChaCha20. Das Update stoppt zudem die Sweet32-Attacke auf SSL/TLS und OpenVPN. --------------------------------------------- http://heise.de/-3305647 *** Hintergrund: Die iOS-Spyware Pegasus - eine Bestandsaufnahme *** --------------------------------------------- Die Spionage-Software Pegasus erschüttert die iPhone-Welt. Wie kann ich mich schützen? Liegt das iOS-Sicherheitskonzept in Schutt und Asche? Ist das das Ende? Eine Analyse der bekannten Fakten schafft Klarheit. --------------------------------------------- http://heise.de/-3305780 *** What's The Deal With Machine Learning? *** --------------------------------------------- We've recently received quite a few questions regarding the use of machine learning techniques in cyber security. I figured it was time for a blog post. Interestingly, while I was writing this post, we got asked even more questions, so the timing couldn't be better. It seems that there are quite a few companies out... --------------------------------------------- https://labsblog.f-secure.com/2016/08/26/whats-the-deal-with-machine-learni… *** Floating Domains - Taking Over 20K DigitalOcean Domains via a Lax Domain Import System *** --------------------------------------------- DigitalOcean is a cloud service provider similar to Amazon Web Services or Google Cloud. They offer cloud DNS hosting as one of their product lines - a nice guide on how to set up your domain to use their DNS can be found here. Take a moment to read it over and see if you can spot any potential issues with their domain name set up process. --------------------------------------------- https://thehackerblog.com/floating-domains-taking-over-20k-digitalocean-dom… *** 5 security practices hackers say make their lives harder *** --------------------------------------------- Whether they identify as white hats, black hats or something in-between, a majority of hackers agree that no password is safe from them - or the government for that matter. Regardless of where they sit with respect to the law, hackers mostly agree that five key security measures can make it a lot harder to penetrate enterprise networks.At the Black Hat USA 2016 conference in Las Vegas earlier this month, Thycotic, a specialist in privileged account management (PAM) solutions, surveyed... --------------------------------------------- http://www.cio.com/article/3112740/security/5-security-practices-hackers-sa… *** iOS 9.3.5 *** --------------------------------------------- This document describes the security content of iOS 9.3.5. --------------------------------------------- https://support.apple.com/en-us/HT207107 *** F-Secure Policy Manager 12.00.67239 - Remote code execution by authenticated user *** --------------------------------------------- The F-Secure Policy Manager client relies on Spring remoting to communicate with the server. Spring remoting uses Java serialization as transfer protocol. Spring internal mechanisms first deserialize before validating the deserialization class is authorized. That behavior leads to remote command execution if we are able to send objects present in the classpath that execute code when they are deserialized. --------------------------------------------- https://remoteawesomethoughts.blogspot.com/2016/08/f-secure-policy-manager-… *** PowerDNS Recursor 4.0.2 - Released August 26th 2016 *** --------------------------------------------- This release fixes a regression in 4.x where CNAME records for DNSSEC signed domains were not sorted before the final answers, leading to some clients (notably some versions of Chrome) not being able to extract the required answer from the packet. [...] Further fixes and changes can be found below:... --------------------------------------------- https://doc.powerdns.com/md/changelog/ *** VU#305607: Accellion Kiteworks contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#305607 Accellion Kiteworks contains multiple vulnerabilities Original Release date: 26 Aug 2016 | Last revised: 26 Aug 2016 Overview The Accellion Kiteworks appliance prior to version kw2016.03.00 contains multiple vulnerabilities. Description CWE-276: Incorrect Default Permissions - CVE-2016-5662 The `/opt/bin/cli` script has setuid permissions by default, allowing an authenticated KiteWorks users to escalate privileges of commands to root. In practice, the user would... --------------------------------------------- http://www.kb.cert.org/vuls/id/305607 *** AlienVault USM/OSSIM 5.2 conf/reload.php DOM-based XSS *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016080229 *** FreePBX 13.0.35 Remote command execution *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016080231 *** Apple libc incomplete fix of Security Update for OS X El Capitan 10.11.2 *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016080232 *** OpenBSD SMTP Processing Bug in rfc2822_parser_init() May Let Remote Users Bypass Security Restrictions on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036691 *** DFN-CERT-2016-1391: OpenSSL: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsvorkehrungen und Ausspähen von Informationen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1391/ *** OpenVPN Blowfish Cipher Block Collision Weakness Lets Remote Users Decrypt Data in Certain Cases *** --------------------------------------------- http://www.securitytracker.com/id/1036695 *** DSA-3651 rails - security update *** --------------------------------------------- Andrew Carpenter of Critical Juncture discovered a cross-site scriptingvulnerability affecting Action View in rails, a web applicationframework written in Ruby. Text declared as HTML safe will not havequotes escaped when used as attribute values in tag helpers. --------------------------------------------- https://www.debian.org/security/2016/dsa-3651 *** DSA-3654 quagga - security update *** --------------------------------------------- Two vulnerabilities were discovered in quagga, a BGP/OSPF/RIP routingdaemon. --------------------------------------------- https://www.debian.org/security/2016/dsa-3654 *** DSA-3653 flex - security update *** --------------------------------------------- Alexander Sulfrian discovered a buffer overflow in theyy_get_next_buffer() function generated by Flex, which may result indenial of service and potentially the execution of code if operating ondata from untrusted sources. --------------------------------------------- https://www.debian.org/security/2016/dsa-3653 *** DSA-3652 imagemagick - security update *** --------------------------------------------- This updates fixes many vulnerabilities in imagemagick: Various memoryhandling problems and cases of missing or incomplete input sanitisingmay result in denial of service or the execution of arbitrary code ifmalformed TIFF, WPG, RLE, RAW, PSD, Sun, PICT, VIFF, HDR, Meta, Quantum,PDB, DDS, DCM, EXIF, RGF or BMP files are processed. --------------------------------------------- https://www.debian.org/security/2016/dsa-3652

1 0

Tageszusammenfassung - Donnerstag 25-08-2016
by Daily end-of-shift report 25 Aug '16

25 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-08-2016 18:00 − Donnerstag 25-08-2016 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Cisco AnyConnect Secure Mobility Client Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Financial Transaction Manager for ACH Services, Check Services, Corporate Payment Services (CVE-2016-5920, CVE-2016-1181, CVE-2016-1182, CVE-2016-3060) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21989060 *** IBM Security Bulletin: IBM Tivoli Storage Manager FastBack Demo package on the Web Potential DLL Loading Code Execution Vulnerability (CVE-2016-5934 ) *** --------------------------------------------- IBM Tivoli Storage Manager FastBack Demo package on the Web contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute .. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21988908 *** IBM Security Bulletin: IBM Security Access Manager for Mobile is affected by vulnerabilities in OpenSSL *** --------------------------------------------- Vulnerabilities have been identified in OpenSSL. IBM Security Access Manager for Mobile uses OpenSSL and is affected by these vulnerabilities. CVE(s): CVE-2016-0799, CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, .. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21988189 *** Hacked Email: Why Cyber Criminals Want to Get Into Your Inbox *** --------------------------------------------- “I don’t care about getting hacked, there’s nothing valuable in my email” If I got a nickel .. --------------------------------------------- https://heimdalsecurity.com/blog/hacked-email-why-cyber-criminals-want-inbo… *** Example of Targeted Attack Through a Proxy PAC File, (Wed, Aug 24th) *** --------------------------------------------- Yesterday, I discovered a nice example of targeted attack against a Brazilian bank. It started with an email sample like this: This message was sent to a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21405 *** Bugtraq: WebKitGTK+ Security Advisory WSA-2016-0005 *** --------------------------------------------- http://www.securityfocus.com/archive/1/539295 *** [2016-08-25] Multiple vulnerabilities in Micro Focus (Novell) GroupWise *** --------------------------------------------- Micro Focus (Novell) GroupWise 2014 (up to R2 SP1) contains vulnerabilities that allow an attacker to take over user sessions by sending the victim a crafted email, take over administrator accounts or potentially compromise the system (heap based buffer overflow). --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** SWEET32: Kurze Verschlüsselungsblöcke sorgen für Kollisionen *** --------------------------------------------- Ein neuer Angriff auf TLS- und VPN-Verbindungen betrifft alte Verschlüsselungsalgorithmen wie Triple-DES und Blowfish, die Daten in 64-Bit-Blöcken verschlüsseln. Der Angriff erfordert das Belauschen vieler Gigabytes an Daten und dürfte damit nur selten praktikabel sein. --------------------------------------------- http://www.golem.de/news/sweet32-kurze-verschluesselungsbloecke-sorgen-fuer… *** Cisco liefert Sicherheits-Patches für NSA-Exploit ExtraBacon aus *** --------------------------------------------- Admins müssen Firewalls mit der Adaptive-Security-Appliance-Software (ASA) nun nicht mehr mittels eines Workarounds absichern: Cisco stopft die Schwachstelle mit abgesicherten Versionen. --------------------------------------------- http://heise.de/-3304688 *** Falsche Bank Austria-Mail: „Zahlungsbestätigung Monatsbeitrag“ *** --------------------------------------------- Internet-Nutzer/innen erhalten eine angebliche Benachrichtigung der Bank Austria. In dieser heißt es, dass der Newsletter und ein Gewinnspiel monatlich EUR 39,99- kosten. Den Gebrauch des Services sollen Kund/innen auf einer Website bestätigen. Empfänger/innen der E-Mail dürfen das nicht tun, denn andernfalls übermitteln sie Zugangsdaten an Kriminelle. --------------------------------------------- https://www.watchlist-internet.at/phishing/falsche-bank-austria-mail-zahlun… *** Security Advisory - Resource Management Vulnerability in Huawei Servers *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… *** Stolen devices to blame for many breaches in the financial services sector *** --------------------------------------------- Bitglass performed an analysis of all breaches in the financial services sector since 2006, with data aggregated from public databases and government mandated disclosures. They found that leaks nearly doubled between .. --------------------------------------------- https://www.helpnetsecurity.com/2016/08/25/breaches-financial-services-sect… *** Falsche Verbund-Rechnung verbreitet Schadsoftware *** --------------------------------------------- Im E-Mailpostfach findet sich eine Rechnung des Stromanbieters Verbund. Kund/innen können die Zahlungaufforderung auf der Website „verbund-bill.com“ ansehen. Das dürfen Empfänger/innen nicht tun, denn andernfalls installieren sie Schadsoftware auf ihrem Computer. Diese macht den PC unbrauchbar. Kriminelle fordern Bitcoins, um das zu ändern. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/falsche-verbund-re… *** BMI warnt: Erst Taschendiebstahl von iPhone, dann Phishing *** --------------------------------------------- Es werden vermehrt iPhones in Österreich gestohlen. Mit einer Masche wird danach die Fernsperre außer Kraft gesetzt. --------------------------------------------- http://futurezone.at/digital-life/bmi-warnt-erst-taschendiebstahl-von-iphon… *** How the Consumer Product Safety Commission is (Inadvertently) Behind the Internet’s Largest DDoS Attacks *** --------------------------------------------- The mission of the United States Governments Consumer Product Safety Commission (CPSC) is to protect consumers from injury by products. Its ironic then that the CPSC .. --------------------------------------------- https://blog.cloudflare.com/how-the-consumer-product-safety-commission-is-i…

1 0

Tageszusammenfassung - Mittwoch 24-08-2016
by Daily end-of-shift report 24 Aug '16

24 Aug '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-08-2016 18:00 − Mittwoch 24-08-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** The SWEET32 Issue, CVE-2016-2183 *** --------------------------------------------- Today, Karthik Bhargavan and Gaetan Leurent from Inria have unveiled a new attack on Triple-DES, SWEET32, Birthday attacks on 64-bit block ciphers in TLS and OpenVPN. It has been assigned CVE-2016-2183. This post gives a bit of background and describes what OpenSSL is doing. For more details, see their website. --------------------------------------------- https://www.openssl.org/blog/blog/2016/08/24/sweet32/ *** "Wildfire" Ransomware Extinguished by Tool From NoMoreRansom; Unlock Files for Free *** --------------------------------------------- Intel Security and Kaspersky Lab, partners in the project NoMoreRansom, are pleased to announce today the availability of a decryption tool for victims of the Wildfire variant of ransomware. This tool is available following successful collaboration with the Dutch police and the European Cybercrime Centre. This strong public-private partnership has led to the seizure of... --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/wildfire-ransomware-extinguished-tool-… *** BSI veröffentlicht Update zu den Top 10 Bedrohungen für Industrial Control Systems *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik (BSI) beobachtet die Bedrohungslage für Industrial Control Systems deshalb kontinuierlich. Die schwerwiegendsten Gefahren sowie passende Gegenmaßnahmen fasst das BSI seit 2012 im Dokument "Industrial Control System Security - Top 10 Bedrohungen und Gegenmaßnahmen" zusammen. Für das Jahr 2016 hat das Bundesamt nun ein Update des Papiers herausgegeben. --------------------------------------------- https://www.allianz-fuer-cybersicherheit.de/ACS/DE/_/infos/20160823_Update_… *** NSA-Exploit ExtraBacon soll deutlich mehr Cisco-Firewalls bedrohen *** --------------------------------------------- Untersuchungen von Sicherheitsforschern legen nahe, dass auch neuere Version der Cisco Adaptive Security Appliance (ASA) angreifbar sind. --------------------------------------------- http://heise.de/-3303629 *** Privilege Escalation on Linux with Live examples *** --------------------------------------------- Introduction One of the most important phase during penetration testing or vulnerability assessment is Privilege Escalation. During that step, hackers and security researchers attempt to find out a way (exploit, bug, misconfiguration) to escalate between the system accounts. Of course, vertical privilege escalation is the ultimate goal. For many security researchers, this is a fascinating... --------------------------------------------- http://resources.infosecinstitute.com/privilege-escalation-linux-live-examp… *** Forscher sehen Löcher in Apples iOS-Sandbox *** --------------------------------------------- Die iOS-Sandbox weist Wissenschaftlern zufolge "bedenkliche Sicherheitslücken" auf, die Apps den eigentlich verwehrten Zugriff auf Nutzerdaten ermöglichen - und Eingriff ins System. Apple will die Schwachstellen offenbar mit iOS 10 schließen. --------------------------------------------- http://heise.de/-3304068 *** VMSA-2016-0013 *** --------------------------------------------- VMware Identity Manager and vRealize Automation updates address multiple security issues --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0013.html *** Moxa OnCell Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for several vulnerabilities in Moxa's OnCell products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-236-01 *** Huawei Security Advisories *** --------------------------------------------- *** Security Advisory - IPv6 Neighbor Discovery Crafted Packet Denial of Service Vulnerability *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - Weak Encryption Algorithm Vulnerability in Huawei Servers *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - XXE Vulnerability in the E9000 *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - Uncontrolled Format String Vulnerability on Multiple Products *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - Two Command Injection Vulnerabilities in Huawei UMA *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… --------------------------------------------- *** Security Advisory - Information Leak Vulnerability in Huawei FusionSphere Product *** http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160824-… ---------------------------------------------

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily