Daily

daily@lists.cert.at

1 participants
3158 discussions

Tageszusammenfassung - Mittwoch 27-04-2016
by Daily end-of-shift report 27 Apr '16

27 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-04-2016 18:00 − Mittwoch 27-04-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Nationale Strategie: De Maizière will Wirtschaft besser gegen Cyberspionage schützen *** --------------------------------------------- Manchmal ist es eine komplexer Hackerangriff, manchmal fängt sich der Chef die Schadsoftware auch direkt von der Speisekarte seines Lieblingsrestaurants ein. Vielen Unternehmen fehlt noch das Bewusstsein der Gefahr. Das soll anders werden. --------------------------------------------- http://heise.de/-3189372 *** All About Fraud: How Crooks Get the CVV *** --------------------------------------------- A longtime reader recently asked: "How do online fraudsters get the 3-digit card verification value (CVV or CVV2) code printed on the back of customer cards if merchants are forbidden from storing this information? The answer: Probably by installing a Web-based keylogger at an online merchant so that all data that customers submit to the site is copied and sent to the attackers server. --------------------------------------------- http://krebsonsecurity.com/2016/04/all-about-fraud-how-crooks-get-the-cvv/ *** A Look Inside Cerber Ransomware *** --------------------------------------------- The "Cerber" family of ransomware first appeared in open source reporting in March 2016, with victims readily identified by the ".cerber" extension left on encrypted files. Unlike many other ransomware variants, Cerber is designed to encrypt a victim's file system immediately, without receiving "confirmation" or instructions from a command and control (C2) node. After this malicious encryption is complete, HTML and text files are opened on the infected... --------------------------------------------- https://blog.team-cymru.org/2016/04/a-look-inside-cerber-ransomware/ *** Malvertising On The Pirate Bay Drops Ransomware *** --------------------------------------------- Magnitude EK strikes again, this time on The Pirate Bay, and drops the Cerber Ransomware. Categories: ExploitsTags: cerbermagnitude EKransomwareThe Pirate BayTPB(Read more...) --------------------------------------------- https://blog.malwarebytes.org/threat-analysis/exploits-threat-analysis/2016… *** Next up. A look at Locky Ransomware *** --------------------------------------------- Weve been examining some of the newer - or, at least, most currently prevalent - strains of ransomware. This time we look at Locky. --------------------------------------------- http://www.scmagazine.com/next-up-a-look-at-locky-ransomware/article/492355/ *** 7ev3n ransomware alters name, asks for much lower ransom *** --------------------------------------------- A variant of 7ev3n ransomware has modified its name and begun asking victims for a considerably lower ransom fee than it was seeking just a few months ago. Security researchers originally detected the 7ev3n ransomware back in January of this year. --------------------------------------------- https://www.grahamcluley.com/2016/04/7ev3n-ransomware-alters-asks-lower-ran… *** BSI-Umfrage: Ein Drittel der Unternehmen ist von Erpressungs-Trojanern betroffen *** --------------------------------------------- Den Ergebnissen einer Ransomware-Umfrage des BSI zufolge schützen 60 Prozent der befragten Institutionen aus der deutschen Wirtschaft die Lage als verschärft ein. Auch die Security Bilanz Deutschland vermeldet einen erhöhten Bedrohungsgrad. --------------------------------------------- http://heise.de/-3189776 *** "Ransomware ist mittlerweile die größte Bedrohung" *** --------------------------------------------- Trojaner, die Systeme verschlüsseln, bieten Kriminellen einen einfachen Weg, Geld zu verdienen. Die Opferzahlen steigen und auch Smartphones sind nicht mehr sicher. --------------------------------------------- http://futurezone.at/digital-life/ransomware-ist-mittlerweile-die-groesste-… *** Digging deep for PLATINUM *** --------------------------------------------- There is no shortage of headlines about cybercriminals launching large-scale attacks against organizations. For us, the activity groups that pose the most danger are the ones who selectively target organizations and desire to stay undetected, protect their investment, and maximize their ROI. That's what motivated us - the Windows Defender Advanced Threat Hunting team, known... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platin… *** Boffins believe buggy Binder embiggens Android attack surface *** --------------------------------------------- Punching holes in problematic private APIs Bugs in Androids Binder inter-process communication (IPC) mechanism open up a mass of security bugs, according to University of Michigan boffins Huan Feng and Kang Shin. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/04/27/boffins_bel… *** Memory Forensics *** --------------------------------------------- Introduction This mini-course started with forensic memory basics, in this mini-course, we have explained how you can and what you can find artifacts from memory. As Memory forensics is very vast topic so we have also explained some memory basic such as how memory works what memory architecture and its unit is. Also, what artifacts... --------------------------------------------- http://resources.infosecinstitute.com/memory-forensics/ *** An Introduction to Mac memory forensics, (Tue, Apr 26th) *** --------------------------------------------- Unfortunately when its come to the memory forensics Mac in environment doesnt have the luxury that we have in the Windows environment. The first step of the memory forensics is capturing the memory, while in Windows we have many tools to achieve this, in Mac we have very few options. OSXPmem is the only available option for memory capturing that support El Capitan, https://github.com/google/rekall/releases/download/v1.3.2/osxpmem_2.0.1.zip Now let"> cd osxpmem.app/ "> chown --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20989&rss *** How to Suck at Information Security - A Cheat Sheet *** --------------------------------------------- This cheat sheet presents common information security mistakes, so you can avoid making them. Yeah, the idea is that you should do the opposite of what it says below. To print, use the one-sheet PDF version; you can also edit the Word version for you own needs. --------------------------------------------- https://zeltser.com/suck-at-security-cheat-sheet/ *** [DSA 3558-1] openjdk-7 security update *** --------------------------------------------- CVE ID: CVE-2016-0636 CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 Several vulnerabilities have been discovered in OpenJDK, an implementation of the Oracle Java platform, resulting in breakouts of the Java sandbox, denial of service or information disclosure. --------------------------------------------- https://lists.debian.org/debian-security-announce/2016/msg00134.html *** VTS16-001: NetBackup Remote Access Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been identified in Veritas (formerly Symantec) NetBackup Master/ Media Servers and clients. An attacker, able to successfully access a vulnerable NetBackup host, could potentially execute arbitrary commands or operations resulting in possible unauthorized, privileged access to the targeted system. --------------------------------------------- https://www.veritas.com/content/support/en_US/security/VTS16-001.html *** F5 Security Advisory: glibc calloc vulnerability CVE-2015-5229 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/23/sol23822215.html?… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affect IBM Tivoli Monitoring (CVE-2015-7575) *** http://www.ibm.com/support/docview.wss?uid=swg21976066 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of the IBM SDK, Java Technology Editionaffects IBM Algorithmics Algo Risk Application and Algo One Core ( CVE-2015-4872, CVE-2015-4911, CVE-2015-4893, CVE-2015-4803, *** http://www.ibm.com/support/docview.wss?uid=swg21981349 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Provisioning Manager (CVE-2015-4872) *** http://www.ibm.com/support/docview.wss?uid=swg21981826 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Monitoring (CVE-2015-2601,CVE-2015-4749.CVE-2015-2625,CVE-2015-1931 ) *** http://www.ibm.com/support/docview.wss?uid=swg21976560 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in HTTP Response Splitting affects IBM Algorithmics Algo Risk Application & AlgoOne Core- CVE-2015-2017 *** http://www.ibm.com/support/docview.wss?uid=swg21981532 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 26-04-2016
by Daily end-of-shift report 26 Apr '16

26 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-04-2016 18:00 − Dienstag 26-04-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** "Fourth Sample of ICS Tailored Malware Uncovered and the Potential Impact" *** --------------------------------------------- I looked at the S4 Europe agenda which was sent out this morning by Dale Peterson and saw an interesting bullet: "Rob Caldwell of Mandiant will unveil some ICS malware in the wild that is doing some new and smarter things to attack ICS. We are working with Mandiant to provide a bit more info … Continue reading Fourth Sample of ICS Tailored Malware Uncovered and the Potential Impact... --------------------------------------------- http://ics.sans.org/blog/2016/04/25/fourth-sample-of-ics-tailored-malware-u… *** Juniper patches Logjam, Bar Mitzvah, and various Java vulns *** --------------------------------------------- In Junos Space, nobody can hear you patch | Juniper Networks sysadmins can add Junos Space network management patches to their to-do list. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/04/26/juniper_plu… *** Shopware update fixes RCE bug that affects both shop and target system *** --------------------------------------------- Shopware, an open-source shopping cart system chosen by a number of big European companies to power their online shops, has recently pushed out a critical security update. The update fixes a remote code execution bug that could allow attackers to read files on the target system, create new ones with malicious content, and run arbitrary code on the target system. This is a critical security vulnerability that not only affect the functions of the shop,... --------------------------------------------- https://www.helpnetsecurity.com/2016/04/26/shopware-update-fixes-rce-bug/ *** Sicherheits-Report: Unternehmen setzen selbst simple Schutzmechanismen nicht um *** --------------------------------------------- Forensische Analysen von mehr als 3000 nachweislichen Datenlecks zeigen, dass sich Angreifer wenig Neues einfallen lassen - weil Unternehmensnetze immer noch nicht gegen die ewig gleichen Angriffsmuster geschützt sind. --------------------------------------------- http://heise.de/-3184485 *** Breaking Steam Client Cryptography *** --------------------------------------------- So as to not bury the lede: Older versions of Steam allow an attacker who observes a client connecting to Steam to read sensitive information sent over the network. This allows the attacker to take over the account, bypass SteamGuard, and sometimes view plain-text passwords. But how? --------------------------------------------- https://steamdb.info/blog/breaking-steam-client-cryptography/ *** Malware and non-malware ways for ATM jackpotting. Extended cut *** --------------------------------------------- Millions of people around the world now use ATMs every day to withdraw cash, pay in to their account or make a variety of payments. Unfortunately, ATM manufacturers and their primary customers - banks - don't pay much attention to the security of cash machines. --------------------------------------------- http://securelist.com/analysis/publications/74533/malware-and-non-malware-w… *** Two Tips to Keep Your Phone's Encrypted Messages Encrypted *** --------------------------------------------- WhatsApp and Viber may have turned on "default" end-to-end encryption, but truly securing your messages requires a couple steps of your own. --------------------------------------------- http://www.wired.com/2016/04/tips-for-encrypted-messages/ *** Yeabests[.]cc: A fileless infection using WMI to hijack your Browser *** --------------------------------------------- Windows comes with a tool called the Windows Management Instrumentation, or WMI, that can be used by system administrators to receive information and notifications from Windows. ... Unfortunately, this [..] can also be used by malware developers for more nefarious reasons such as creating fileless infectors. --------------------------------------------- http://www.bleepingcomputer.com/news/security/yeabests-cc-a-fileless-infect… *** ENISA's Executive Director addresses EP ITRE Committee on key points for cybersecurity for the EU *** --------------------------------------------- Following the Commission announcement on the path to digitise the EU industry, ENISA participated at the ITRE meeting on 21st April in an exchange of views on cybersecurity in the EU, and ENISA's role in the implementation of the Digital Single Market. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/enisa2019s-executive-director-a… *** SWIFT banking network warns customers of cyberfraud cases *** --------------------------------------------- SWIFT, the international banking transactions network, has warned customers of "a number" of recent incidents in which criminals sent fraudulent messages through its system.The warning from SWIFT (Society for Worldwide Interbank Financial Telecommunication) suggests that a February attack on the Bangladesh Bank, in which thieves got away with US $81 million, was not an isolated incident.SWIFT is aware of malware that "aims to reduce financial institutions' abilities"... --------------------------------------------- http://www.cio.com/article/3061685/swift-banking-network-warns-customers-of… *** New Decryptor Unlocks CryptXXX Ransomware *** --------------------------------------------- Researchers at Kaspersky Lab today published a decryptor that recovers files encrypted by the CryptXXX ransomware. --------------------------------------------- http://threatpost.com/new-decryptor-unlocks-cryptxxx-ransomware/117668/ *** AKW Gundremmingen: Infektion mit Uralt-Schadsoftware *** --------------------------------------------- Im Atomkraftwerk Gundremmingen wurde mindestens ein Rechner mit Schadsoftware infiziert. Bei genauerer Betrachtung scheint die Situation allerdings weniger dramatisch, als zuerst angenommen. --------------------------------------------- http://heise.de/-3188599 *** Rough Auditing Tool for Security (RATS) 2.3 - Crash PoC *** --------------------------------------------- Topic: Rough Auditing Tool for Security (RATS) 2.3 - Crash PoC Risk: Medium Text:# Exploit Title: RATS 2.3 Crash POC # Date: 25th April 2016 # Exploit Author: David Silveiro # Author Contact: twitter.com/d... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016040155 *** Bugtraq: Trend Micro (Account) - Email Spoofing Web Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538197 *** Bugtraq: VoipNow v4.0.1 - (xajax_handler) Persistent Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538198 *** Bugtraq: Sophos XG Firewall (SF01V) - Persistent Web Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/538199 *** TYPO3 CMS 6.2.22 and 7.6.6 released *** --------------------------------------------- The TYPO3 Community announces the versions 6.2.22 LTS and 7.6.6 LTS of the TYPO3 Enterprise Content Management System. We are announcing the release of the following TYPO3 CMS updates: TYPO3 CMS 6.2.22 LTS TYPO3 CMS 7.6.6 LTS All versions are maintenance releases and contain bug fixes only. --------------------------------------------- https://typo3.org/news/article/typo3-cms-6222-and-766-released/ *** Bugtraq: [security bulletin] HPSBGN03582 rev.1 - HPE Helion CloudSystem using glibc, Remote Code Execution, Denial of Service (DoS) *** --------------------------------------------- http://www.securityfocus.com/archive/1/538194 *** IBM Security Bulletin: IBM Vulnerability in BIND affects AIX (CVE-2015-8704) *** --------------------------------------------- http://www.ibm.com/support/ *** IBM Security Bulletin: IBM Vulnerability in OpenSSL affects AIX (CVE-2016-2842) *** --------------------------------------------- http://www.ibm.com/support/

1 0

Tageszusammenfassung - Montag 25-04-2016
by Daily end-of-shift report 25 Apr '16

25 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-04-2016 18:00 − Montag 25-04-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Angler Exploit Kit, Bedep, and CryptXXX, (Sat, Apr 23rd) *** --------------------------------------------- Introduction On Friday 2016-04-15, Proofpoint researchers spotted CryptXXX [1], a new type of ransomware from the actors behind Reveton. CryptXXX is currently spread through Bedep infections sent by the Angler exploit kit (EK). So far, Ive only seen Bedep send CryptXXX after Angler EK traffic caused by the pseudo-Darkleech campaign." /> CryptXXX infections have their own distinct look." /> Bedep recently improved its evasion capabilities [3]. Its being sent by one of the most... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20981&rss *** Highlights from the 2016 HPE Annual Cyber Threat Report, (Mon, Apr 25th) *** --------------------------------------------- HP released their annual report for 2016 that covers a broad range of information (96 pages) in various sectors and industries. The report is divided in 7 themes, those that appear the most interesting to me are Theme #5: The industry didnt learn anything about patching in 2015 and Theme #7: The monetization of malware. Theme #5 According to this report, the bug that was the most exploited in 2014 was still the most exploited last year which is now over five years old. CVE-2010-2568 where a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20985&rss *** Top 10 web hacking techniques of 2015 *** --------------------------------------------- Now in its tenth year, the Top 10 List of Web Hacking Techniques takes a step back from the implications of an attack to understand how they happen. The list is chosen by the security research community, coordinated by WhiteHat Security. After receiving 39 submissions detailing hacking techniques discovered in 2015, the following hacks were voted into the top 10 spaces: FREAK (Factoring Attack on RSA-Export Keys) LogJam Web Timing Attacks Made Practical Evading All... --------------------------------------------- https://www.helpnetsecurity.com/2016/04/25/top-10-web-hacking-techniques-20… *** Kritische Lücken: HP Data Protector verzichtet auf Authentifikation *** --------------------------------------------- Angreifer können den HP Data Protector über verschiedene Schwachstellen in den Mangel nehmen und Code auf Computer schieben. Sicherheits-Updates unterbinden das. --------------------------------------------- http://heise.de/-3183095 *** Snap: Ubuntus neue Pakete sind auf dem Desktop nicht sicherer *** --------------------------------------------- Die Ubuntu-Macher Canonical behaupten, mit dem neuen Paketformat Snap werden installierte Apps sicherer. Für Desktop-Anwender stimmt das allerdings nicht. --------------------------------------------- http://heise.de/-3183128 *** RDP Replay Code Release *** --------------------------------------------- We took a more in depth look to see what information could be extracted from a PCAP of this [RDP] activity, and this led to a tool being created to replay the RDP session as the attacker would have seen it. We have made this tool available after being asked by a number of our blog readers. This tool requires the private key for decrypting, which can usually be recovered with cooperation from the client. --------------------------------------------- http://www.contextis.com/resources/blog/rdp-replay-code-release/ *** Apple ID und iCloud: Gezieltes Phishing mit Textnachricht *** --------------------------------------------- Betrüger versuchen derzeit per SMS, Nutzer auf eine gefälschte Apple-ID-Anmeldeseite zu locken, um persönliche Daten in Erfahrung zu bringen. Die Mitteilung ist persönlich adressiert. --------------------------------------------- http://heise.de/-3183878 *** A Newer Variant of RawPOS in Depth *** --------------------------------------------- RawPOS - A History RawPOS (also sometimes referred to as Rdasrv from the original service install name) is a Windows based malware family that targets payment card data. It has been around at least since 2011, if not much earlier. Despite it being very well known and the functions it performs easy to understand, RawPOS continues to prove extremely effective in perpetuating long-term and devastating card breaches to this day. Similar to its cousin, BlackPOS, this malware targets industries... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/a-newer-variant-of-raw… *** Empty DDoS Threats: Meet the Armada Collective *** --------------------------------------------- [...] Our conclusion was a bit of a surprise: weve been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack. In fact, because the extortion emails reuse Bitcoin addresses, theres no way the Armada Collective can tell who has paid and who has not. In spite of that, the cybercrooks have collected hundreds of thousands of dollars in extortion payments. [...] --------------------------------------------- https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ *** GozNym banking malware spotted now in Europe *** --------------------------------------------- IBMs X-Force reported today the actors behind the hybrid GozNym banking trojan that stole $4 million from U.S. banks in March have released a new configuration that is targeting European banks. --------------------------------------------- http://www.scmagazine.com/goznym-banking-malware-spotted-now-in-europe/arti… *** Angriff auf Zentralbank: Billigrouter und Malware führen zu Millionenverlust *** --------------------------------------------- Man sollte meinen, dass die Zentralbank eines Landes über eine Firewall verfügt. In Bangladesch war das offenbar nicht der Fall. So konnten Angreifer mit spezialisierter Malware fast 1 Milliarde US-Dollar überweisen - und scheiterten dann an einem Fehler. --------------------------------------------- http://www.golem.de/news/angriff-auf-zentralbank-billigrouter-und-malware-f… *** Manipulierte PNG-Datei schießt iOS- und Mac-Apps ab *** --------------------------------------------- Das Öffnen einer präparierten Bilddatei bringt Apps in iOS wie OS X zum Absturz, darunter den iOS-Homescreen. Die iMessage-App öffnet sich dadurch unter Umständen nicht mehr. --------------------------------------------- http://heise.de/-3184062 *** Exploit kit targets Android devices, delivers ransomware *** --------------------------------------------- Ransomware hitting mobile devices is not nearly as widespread as that which targets computers, but Blue Coat researchers have discovered something even less unusual: mobile ransomware delivered via exploit kit. The ransomware in question calls itself Cyber.Police (the researchers have dubbed it Dogspectus), and does not encrypt users' files, just blocks the infected Android device. It purports to be part of an action by the (nonexistent) "American national security agency"... --------------------------------------------- https://www.helpnetsecurity.com/2016/04/25/exploit-kit-targets-android-devi… *** VU#229047: Allround Automations PL/SQL Developer v11 performs updates over HTTP *** --------------------------------------------- Vulnerability Note VU#229047 Allround Automations PL/SQL Developer v11 performs updates over HTTP Original Release date: 25 Apr 2016 | Last revised: 25 Apr 2016 Overview Allround Automations PL/SQL Developer version 11 checks for updates over HTTP and does not verify updates before executing commands, which may allow an attacker to execute arbitrary code. Description CWE-345: Insufficient Verification of Data Authenticity - CVE-2016-2346 According to the researcher, Allround Automations... --------------------------------------------- http://www.kb.cert.org/vuls/id/229047 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in git affect PowerKVM (CVE-2016-2315, CVE-2016-2324) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023527 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in NetworkManager affect PowerKVM (CVE-2015-0272,CVE-2015-2924) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023498 --------------------------------------------- *** IBM Security Bulletin: A Security Vulnerability was fixed in IBM Security Privileged Identity Manager (CVE-2016-0357) *** http://www.ibm.com/support/docview.wss?uid=swg21981720 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in libssh2 affects PowerKVM (CVE-2016-0787) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023482 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in ISC Bind affect PowerKVM (CVE-2016-1285, CVE-2016-1286) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023483 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in nss-util affects PowerKVM (CVE-2016-1950) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023484 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in strongSwan affects PowerKVM (CVE-2015-8023) *** http://www.ibm.com/support/docview.wss?uid=isg3T1023447 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects Sterling Connect:Enterprise for UNIX (CVE-2016-0800). *** http://www.ibm.com/support/docview.wss?uid=swg21980890 --------------------------------------------- *** IBM Security Bulletin: Information disclosure through unauthenticated SOAP request message. (CVE-2016-0299) *** http://www.ibm.com/support/docview.wss?uid=swg21981155 --------------------------------------------- *** IBM Security Bulletin: ClassLoader Manipulation with Apache Struts affecting IBM WebSphere Portal (CVE-2014-0114) *** http://www.ibm.com/support/docview.wss?uid=swg21680194 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in libssh2 affects SAN Volume Controller and Storwize Family (CVE-2015-1782) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005710 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM SAN Volume Controller and Storwize Family (CVE-2016-0475) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005709 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM WebSphere MQ (CVE-2016-0475, CVE-2015-7575, CVE-2016-0448) *** http://www.ibm.com/support/docview.wss?uid=swg21976896 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Control Center (CVE-2015-5254) *** http://www.ibm.com/support/docview.wss?uid=swg21981352 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM WebSphere MQ (CVE-2015-4872) *** http://www.ibm.com/support/docview.wss?uid=swg21981838 --------------------------------------------- *** IBM Security Bulletin: Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem model V840 (CVE-2015-3194) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005657 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem models 840 and 900 (CVE-2015-3194) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005656 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSL affects the IBM FlashSystem model V840 (CVE-2015-3194) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005657 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 22-04-2016
by Daily end-of-shift report 22 Apr '16

22 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-04-2016 18:00 − Freitag 22-04-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Patches Denial-of-Service Flaws Across Three Products *** --------------------------------------------- Cisco released software updates to address five separate denial of service vulnerabilities, all which the company considers either high or critical severity, across its product line this week. --------------------------------------------- http://threatpost.com/cisco-patches-denial-of-service-flaws-across-three-pr… *** New version of TeslaCrypt ups ante for ransomware *** --------------------------------------------- Two updates in TeslaCrypt illustrate that ransomware is not only spreading wider, but is also evolving with new capabilities. --------------------------------------------- http://www.scmagazine.com/new-version-of-teslacrypt-ups-ante-for-ransomware… *** Cybercrime as a business rampant, new study *** --------------------------------------------- Attacks are getting fiercer and attackers more sophisticated and organized, according to the "2016 Trustwave Global Security Report," released this week. --------------------------------------------- http://www.scmagazine.com/cybercrime-as-a-business-rampant-new-study/articl… *** South Korea no 1 origin point for DDoS attacks *** --------------------------------------------- According to a new report by Imperva, South Korea serves as the most prolific point of origin for global DDoS attacks. --------------------------------------------- http://www.scmagazine.com/south-korea-no-1-origin-point-for-ddos-attacks/ar… *** SpyEye duo behind bank-account-emptying malware banged up *** --------------------------------------------- Billion-dollar Russian Trojan team in the tank for quarter of a century in the US A two-man team responsible for spreading the SpyEye malware that caused more than a billion dollars in financial hardship is now starting extended .. --------------------------------------------- www.theregister.co.uk/2016/04/21/us_jails_spyeye_malware_duo/ *** DSA-3554 xen - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in the Xen hypervisor. TheCommon Vulnerabilities and Exposures project identifies the followingproblems: --------------------------------------------- https://www.debian.org/security/2016/dsa-3554 *** Core Windows Utility Can Be Used to Bypass AppLocker *** --------------------------------------------- A researcher has discovered that Windows' Regsvr32 can be used to download and run JavaScript and VBScript remotely from the Internet, bypassing AppLocker's whitelisting protections. --------------------------------------------- http://threatpost.com/core-windows-utility-can-be-used-to-bypass-applocker/… *** TeslaCrypt: New versions and delivery methods, no decryption tool *** --------------------------------------------- TeslaCrypt ransomware was first spotted and analyzed in early 2015, and soon enough researchers created a decryption tool for it. The malware has since reached versions 4.0 and 4.1 but, unfortunately, there is currently no way to decrypt the .. --------------------------------------------- https://www.helpnetsecurity.com/2016/04/22/teslacrypt-new-versions-no-decry… *** Your credentials at risk with Lansweeper 5 *** --------------------------------------------- As a penetration testers, we rarely have to find 'zero day' vulnerabilities or perform 'bug hunting' in order to compromise Windows Active Directory Domains. However, in one of these rare cases while performing an internal penetration test for a client, we had to do so. Lansweeper is .. --------------------------------------------- http://blog.gosecure.ca/2016/04/21/your-credentials-at-risk-with-lansweeper… *** Red Hat Product Security Risk Report: 2015 *** --------------------------------------------- This report takes a look at the state of security risk for Red Hat products for calendar year 2015. We look at key metrics, specific vulnerabilities, and the most common ways users of Red Hat products were affected by security issues. --------------------------------------------- https://access.redhat.com/blogs/766093/posts/2262281 *** Hacking Nagios: The Importance of System Hardening *** --------------------------------------------- System hardening is important. Keeping systems in a hardened state is equally important. Good hardening should not only including keeping all the patches up-to-date, but also disabling all unnecessary services. The services that are necessary, must to be configured securely. All of this is .. --------------------------------------------- https://blog.anitian.com/hacking-nagios/ *** Hackerangriff: Drucker an deutschen Unis spuckten Nazi-Botschaften aus *** --------------------------------------------- Angriff auf vernetzte Kopierer und Drucker offenbar aus den USA - Sicherheitsleck behoben --------------------------------------------- http://derstandard.at/2000035504034 *** [2016-04-22] Insecure credential storage in my devolo Android app *** --------------------------------------------- The Android app of devolo Home Control suffers from insecure credential storage. Attackers can be able to recover sensitive information from stolen/lost devices. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** [2016-04-22] Multiple vulnerabilities in Digitalstrom Konfigurator *** --------------------------------------------- Multiple design and implementation flaws within the smart home system Digitalstrom enable an attacker to control arbitrary devices connected to the system and execute JavaScript code in the users browser. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** SEC Consult Study on Smart Home Security in Germany - a first silver lining on the horizon of IoT? *** --------------------------------------------- http://blog.sec-consult.com/2016/04/smart-home-security.html *** 1 Million Menschen nutzen Facebook über Tor *** --------------------------------------------- Lohnt es sich, einen eigenen Tor-Hidden-Service anzubieten? Facebook schreibt jetzt, dass die Zahl der aktiven Tor-Nutzer sich seit dem letzten Sommer verdoppelt hat. --------------------------------------------- http://www.golem.de/news/privatsphaere-1-million-menschen-nutzen-facebook-u… *** Snap: Ubuntus neues Paketformat ist unter X11 unsicher *** --------------------------------------------- Das neue Snap-Paketformat von Ubuntu soll nicht nur Installationen und Updates vereinfachen, sondern auch Anwendungen besser absichern. Unter X11 sei letzteres aber ein falsches Versprechen, sagt Sicherheitsforscher Matthew Garrett. überraschend ist das nicht. --------------------------------------------- http://www.golem.de/news/snap-ubuntus-neues-paketformat-ist-unter-x11-unsic… *** Why Hackers Love Your LinkedIn Profile *** --------------------------------------------- An employee opens an attachment from someone who claims to be a colleague in a different department. The attachment turns out to be malicious. The company network? Breached. If you follow the constant news about data breaches, you read this stuff all the .. --------------------------------------------- http://safeandsavvy.f-secure.com/2016/04/22/why-hackers-love-your-linkedin-… *** Nuclear Exploit-Kit bombardiert hunderttausende Rechner mit Locky *** --------------------------------------------- Ransomware wird im großen Stil über Exploit-Kits verteilt. Sicherheitsforschern ist es jetzt gelungen, ins Backend einer solchen Schadcode-Schleuder einzudringen und Statistiken über die Verbreitung der Trojaner zu sammeln. --------------------------------------------- http://heise.de/-3181696 *** JSA10727 - 2016-04 Security Bulletin: Junos Space: Multiple privilege escalation vulnerabilities in Junos Space (CVE-2016-1265) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10727

1 0

Tageszusammenfassung - Donnerstag 21-04-2016
by Daily end-of-shift report 21 Apr '16

21 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-04-2016 18:00 − Donnerstag 21-04-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Angebliche Paket-Verständigung von der "Post" kann Ihre Daten durch Verschlüsselung unbrauchbar machen *** --------------------------------------------- Modus Operandi Kaum ist die Bedrohung durch angebliche E-Mails von DHL im Abklingen, erreicht uns eine neue Welle von E-Mails mit gefährlichem Inhalt. Nunmehr gibt die Mail vor von der "Post" zu stammen und informiert über eine nicht erfolgreich durchgeführte Zustellung. Die weitere Vorgehensweise bleibt dabei gleich; der Empfänger wird aufgefordert den Versandschein über einen Link in der Mail herunter zu laden. --------------------------------------------- http://www.bmi.gv.at/cms/BK/betrug/files/Cryptolocker_Ransomware_Post.pdf *** Decoding Pseudo-Darkleech (#1), (Thu, Apr 21st) *** --------------------------------------------- Im currently going through a phase of WordPress dPression. Either my users are exceptionally adept at finding hacked and subverted WordPress sites, or there are just so many of these sites out there. This weeks particular fun seems to be happening on restaurant web sites. Inevitably, when checking out the origin of some crud, I discover a dPressing installation that shows signs of being owned since months. The subverted sites currently lead to Angler Exploit Kit (Angler EK), and are using... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20969&rss *** SpyEye botnet kit developer sentenced to long jail term *** --------------------------------------------- Aleksandr Andreevich Panin, the Russian developer of the SpyEye botnet creation kit, and an associate were on Wednesday sentenced to prison terms by a court in Atlanta, Georgia, for their role in developing and distributing malware that is said to have caused millions of dollars in losses to the financial sector.Panin, who set out to develop SpyEye as a successor to the Zeus malware that affected financial institutions since 2009, was sentenced by the court to nine and half years in prison,... --------------------------------------------- http://www.cio.com/article/3059554/spyeye-botnet-kit-developer-sentenced-to… *** Looking Into a Cyber-Attack Facilitator in the Netherlands *** --------------------------------------------- A small webhosting provider with servers in the Netherlands and Romania has been a hotbed of targeted attacks and advanced persistent threats (APT) since early 2015. Starting from May 2015 till today we counted over 100 serious APT incidents that originated from servers of this small provider. Pawn Storm used the servers for at least 80 high profile attacks against various governments in the US, Europe, Asia, and the Middle East. Formally the Virtual Private Server (VPS) hosting company is... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/MKFUpCeHi9s/ *** FBI warns farming industry about equipment hacks, data breaches *** --------------------------------------------- As Internet-connected equipment is increasingly used in many industry sectors, alerts like the latest one issued by the FBI to US farmers will likely become a regular occurrence. While precision agriculture technology (a.k.a. smart farming) reduces farming costs and increases crop yields, farmers need to be aware of and understand the associated cyber risks to their data and ensure that companies entrusted to manage their data, including digital management tool and application developers... --------------------------------------------- https://www.helpnetsecurity.com/2016/04/21/farming-cyber-risks/ *** Lab - Cryptographic Algorithms *** --------------------------------------------- For this lab we'll be using GPG, OpenSSL to demonstrate symmetric and asymmetric encryption/decryption and MD5, SHA1 to demonstrate hash functions. Virtual Machine Needed: Kali Before starting the lab here are some definitions: In all symmetric crypto algorithms (also called Secret Key encryption) a secret key is used for both encrypt plaintext and decrypt the... --------------------------------------------- http://resources.infosecinstitute.com/lab-cryptographic-algorithms/ *** Fremdenfeindliche Ausdrucke: "Hackerangriff" auf Universitätsdrucker *** --------------------------------------------- Hackerangriff oder doch nur eine falsche Druckerkonfiguration: In verschiedenen Universitäten in Deutschland sind in den Druckern Dokumente mit fremdenfeindlichem Hintergrund gefunden worden. --------------------------------------------- http://www.golem.de/news/fremdenfeindliche-ausdrucke-hackerangriff-auf-univ… *** Security update available for the Adobe Analytics AppMeasurement for Flash Library *** --------------------------------------------- A Security Bulletin (APSB16-13) has been published regarding a security update for the Adobe Analytics AppMeasurement for Flash Library. This update resolves an important vulnerability in the AppMeasurement for Flash library that could be abused to conduct DOM-based cross-site scripting attacks... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1341 *** DFN-CERT-2016-0655: Squid: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-0655/ *** [R2] Nessus < 6.6 Fixes Two Vulnerabilities *** --------------------------------------------- http://www.tenable.com/security/tns-2016-08 *** Moxa NPort Device Vulnerabilities (Update A) *** --------------------------------------------- This alert update is a follow-up to the original NCCIC/ICS-CERT Alert titled ICS-ALERT-16-099-01 Moxa NPort Device Vulnerabilities that was published April 8, 2016, on the ICS-CERT web page. ICS-CERT is aware of a public report of vulnerabilities affecting multiple models of the Moxa NPort device. ICS-CERT has notified Moxa of the report, and Moxa has validated all five of the reported vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-16-099-01 *** Hyper-V - vmswitch.sys VmsMpCommonPvtHandleMulticastOids Guest to Host Kernel-Pool Overflow *** --------------------------------------------- Topic: Hyper-V - vmswitch.sys VmsMpCommonPvtHandleMulticastOids Guest to Host Kernel-Pool Overflow Risk: High Text:/* This function is reachable by sending a RNDIS Set request with OID 0x01010209 (OID_802_3_MULTICAST_LIST) from the Guest to... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016040133 *** Avast SandBox Escape via IOCTL Requests *** --------------------------------------------- Topic: Avast SandBox Escape via IOCTL Requests Risk: Medium Text:* CVE: CVE-2016-4025 * Vendor: Avast * Reported by: Kyriakos Economou * Date of Release: 19/04/2016 * Affected Products: Mu... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016040134 *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Wireless LAN Controller Management Interface Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Wireless LAN Controller Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Adaptive Security Appliance Software DHCPv6 Relay Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Wireless LAN Controller HTTP Parsing Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Multiple Cisco Products libSRTP Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in OpenSSL affects IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2016-0800) *** http://www.ibm.com/support/docview.wss?uid=swg21980721 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in libcURL affects IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2015-3237) *** http://www.ibm.com/support/docview.wss?uid=swg21980719 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2015-3197, CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21980716 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2015-3194, CVE-2015-3195, CVE-2015-3196) *** http://www.ibm.com/support/docview.wss?uid=swg21980714 --------------------------------------------- *** IBM Security Bulletin: Current Releases of IBM® SDK for Node.js™ are affected by CVE-2015-8851 *** http://www.ibm.com/support/docview.wss?uid=swg21981528 --------------------------------------------- *** IBM Security Bulletin: IBM Spectrum Scale, with the Spectrum Scale GUI installed, is affected by a security vulnerability (CVE-2016-0361) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005742 --------------------------------------------- *** Drupal Security Advisories for Third-Party Modules *** --------------------------------------------- *** EPSA Crop - Image Cropping - Critical -XSS - SA-CONTRIB-2016-024 - Unsupported *** https://www.drupal.org/node/2710247 --------------------------------------------- *** Organic groups - Moderately Critical - Access bypass - DRUPAL-SA-CONTRIB-2016-023 *** https://www.drupal.org/node/2710115 --------------------------------------------- *** Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022 *** https://www.drupal.org/node/2710063 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 20-04-2016
by Daily end-of-shift report 20 Apr '16

20 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-04-2016 18:00 − Mittwoch 20-04-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Oracle critical updates released, (Wed, Apr 20th) *** --------------------------------------------- Oracle has released their critical updates list. Looking through it there is a very wide range of products, including java that require a fix. Oracle strongly recommends that customers remain on actively-supported versions and apply Critical Patch Update fixes without delay. There are quite a few remotely exploitable, no auth required issues that are addressed by these patches. You may want to peruse the list to see if some of your products are affected. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20965&rss *** Java: Neue JDK-Versionen bringen strengere Sicherheitsvorgaben *** --------------------------------------------- Die Updates JDK 8u91 und 8u92 adressieren erneut vor allem das Thema Security: Unter anderem gilt der MD5-Algorithmus nun als unsicher, und die JVM bekommt Einstellungen zur Behandlung von Speicherüberlauffehlern. --------------------------------------------- http://heise.de/-3178164 *** Hacking and manipulating traffic sensors *** --------------------------------------------- With the advent of the Internet of Things, we're lucky to have researchers looking into these devices and pointing out the need for securing them better. One of these researchers is Kaspersky Lab's Denis Legezo, who took it upon himself to map the traffic sensors in Moscow and see whether they could be tampered with. The answer to that question is yes, they can be manipulated, and consequently lead to poor traffic management and annoyance... --------------------------------------------- https://www.helpnetsecurity.com/2016/04/20/hacking-manipulating-traffic-sen… *** PoS Malware Steals Credit Card Numbers via DNS Requests *** --------------------------------------------- A new version of the NewPosThings PoS malware is using a clever technique to extract data from infected PoS terminals that almost no security solution monitors for malware activity. --------------------------------------------- http://news.softpedia.com/news/pos-malware-steals-credit-card-numbers-via-d… *** Using a Braun Shaver to Bypass XSS Audit and WAF *** --------------------------------------------- TL;DR: Sometimes you just need to spend a couple of months to exploit a XSS with a hygiene product. --------------------------------------------- https://blog.bugcrowd.com/guest-blog-using-a-braun-shaver-to-bypass-xss-aud… *** Encryption everywhere? *** --------------------------------------------- This article discusses opportunistic encryption (OE), ways to set up systems so that they will automatically encrypt whenever they can rather than just whenever the user requests it. Many types of encryption require a choice by the user - encrypt with PGP rather than sending email in the clear, log into a remote system with... --------------------------------------------- http://resources.infosecinstitute.com/encryption-everywhere/ *** Towards Generic Ransomware Detection *** --------------------------------------------- Im not claiming these ideas are novel, nor unbeatable. My goal is simply to raise awareness about alternate means to help stymie the ransomware epidemic. Plus, attempting to write a tool that could generically protect my computer against OS X ransomware, seemed like a fun challenge! Finally, both this research and tool are version 1.0, meaning, likely room for improvement - so feedback is welcome :) --------------------------------------------- https://objective-see.com/blog/blog_0x0F.html *** DRAM bitflipping exploits that hijack computers just got easier *** --------------------------------------------- Approach relies on already installed code, including widely used glibc library. --------------------------------------------- http://arstechnica.com/security/2016/04/dram-bitflipping-exploits-that-hija… *** Panama Papers - How Hackers Breached the Mossack Fonseca Firm *** --------------------------------------------- Introduction The Panama Papers are a huge trove of high confidential documents stolen from the computer systems of the Panamanian law firm Mossack Fonseca that was leaked online during recently. It is considered the largest data leaks ever, the entire archive contains more than 11.5 Million files including 2.6 Terabytes of data related the activities of offshore... --------------------------------------------- http://resources.infosecinstitute.com/panama-papers-how-hackers-breached-th… *** Kippo and dshield , (Tue, Apr 19th) *** --------------------------------------------- In this diary I will talk about how to configure kippo honeypot and how to submit your kippos log to SANS Dshield --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20963&rss *** Security Update for Microsoft Graphics Component (3148522) Version: 2.0 *** --------------------------------------------- V2.0 (April 19, 2016): To comprehensively address CVE-2016-0145, Microsoft re-released security update 3144432 for affected editions of Microsoft Live Meeting 2007 Console. Customers running Microsoft Live Meeting 2007 Console should install the update to be fully protected from the vulnerability. See Microsoft Knowledge Base Article 3144432 for more information. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS16-039 *** Bugtraq: ESA-2016-039: EMC ViPR SRM Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/538133 *** Cisco IOS and Cisco IOS XE ntp Subsystem Unauthorized Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** F5 Security Advisory: glibc vulnerability CVE-2015-8779 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/39/sol39250133.html?… *** VMSA-2016-0002.1 *** --------------------------------------------- VMware product updates address a critical glibc security vulnerability --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2016-0002.html *** VMSA-2015-0009.2 *** --------------------------------------------- VMware product updates address a critical deserialization vulnerability --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0009.html

1 0

Tageszusammenfassung - Dienstag 19-04-2016
by Daily end-of-shift report 19 Apr '16

19 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-04-2016 18:00 − Dienstag 19-04-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Touch ID: 90 Prozent der iPhone-Nutzer setzen jetzt auf Code-Sperre *** --------------------------------------------- Seit der Einführung des Fingerabdruckscanners hat sich laut Apple der Anteil der Nutzer verdoppelt, die ihr iPhone mit einem Gerätecode schützen und damit die Daten verschlüsseln. --------------------------------------------- http://heise.de/-3177095 *** JavaScript-toting spam emails: What should you know and how to avoid them? *** --------------------------------------------- We have recently observed that spam campaigns are now using JavaScript attachments aside from Office files. The purpose of the code is straightforward. It downloads and runs other malware. Some of the JavaScript downloaders .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/04/18/javascript-toting-spam-… *** Google Alerts, Direct Webmaster Communication Get Bugs Fixed Quickly *** --------------------------------------------- Google determined that Safe Browsing warnings correlate with quicker remediation times, though not as quick as direct contact with webmasters who have registered with Google Search Console. --------------------------------------------- http://threatpost.com/google-alerts-direct-webmaster-communication-get-bugs… *** Magnitude EK Activity At Its Highest Via AdsTerra Malvertising *** --------------------------------------------- The Magnitude exploit kit is maximizing its leads via a large and uninterrupted malvertising campaign.Categories: ExploitsTags: adsterramagnitude EKmalvertisingterraclicks(Read more...) --------------------------------------------- https://blog.malwarebytes.org/threat-analysis/exploits-threat-analysis/2016… *** iPrint Appliance 2.0 Patch 1 *** --------------------------------------------- Abstract: Patch 1 for the iPrint Appliance 2.0 includes bug fixes.Document ID: 5240661Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:iPrint-2.0.0.530.HP.zip (594.99 MB)Products:iPrint Appliance 2Superceded Patches:iPrint Appliance 2.0 FTF --------------------------------------------- https://download.novell.com/Download?buildid=W46YTfqEGiQ~ *** Symantec Messaging Gateway Multiple Security Issues *** --------------------------------------------- Revisions None Severity Severity (CVSS version 2 and CVSS Version 3) CVSS2 Base Score .. --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Python-Based PWOBot Targets European Organizations *** --------------------------------------------- We have discovered a malware family named 'PWOBot' that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwob… *** Zahlen, bitte! Täglich 390.000 neue Schadprogramme *** --------------------------------------------- Momentan hat man das Gefühl, in jedem Mail-Anhang und hinter jedem Link versteckt sich irgendeine Malware. Antiviren-Hersteller und Test-Labore verstärken diesen Eindruck noch durch irrwitzig hohe Zahlen neuer Schadprogramme. --------------------------------------------- http://heise.de/-3177141 *** 2015 über 550 Millionen Datensätze von Sicherheitslecks betroffen *** --------------------------------------------- Anzahl bekannt gewordener Zero-Day-Lücken mehr als verdoppelt – Entwickler werden schneller beim Ausmerzen --------------------------------------------- http://derstandard.at/2000035195204 *** How-To Disable Windows Script Host *** --------------------------------------------- Numerous spam campaigns are pushing various crypto-ransomware families (and backdoors) via .zip file attachments. And such .zip files typically contain a JScript (.js/.jse) file that, if clicked, will be run via Windows Script Host. Do yourself a favor and edit your Windows Registry .. --------------------------------------------- https://labsblog.f-secure.com/2016/04/19/how-to-disable-windows-script-host/ *** Exploit kit writers turn away from Java, go all-in on Adobe Flash *** --------------------------------------------- 312% increase in Flash vulns over 2014, says study Exploit kit writers are no longer fussed about Java vulnerabilities, focusing their attention almost entirely on Adobe Flash. --------------------------------------------- www.theregister.co.uk/2016/04/19/exploit_kit_writers_love_flash/ *** Homeland Security: Open Source dient der inneren Sicherheit *** --------------------------------------------- Die Offenlegung von Code habe Vorteile bei der "Cybersicherheit" und werde helfen, die Nation vor Gefahren zu schützen, meint der Technikchef der zuständigen US-Behörde. Außerdem könnten Bürger die Behörde dank Open Source besser überwachen, glauben Entwickler. --------------------------------------------- http://www.golem.de/news/homeland-security-open-source-dient-der-inneren-si… *** Tools *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer. The following vulnerabilities have been addressed: ... --------------------------------------------- http://support.citrix.com/article/CTX209443 *** Perfides PayPal-Phishing mit angeblicher Eventim-Rechnung *** --------------------------------------------- Eine überdurchschnittlich gut gemachte Phishing-Mail soll PayPal-Kunden in die Datenfalle locken. Die Absender haben sogar beim Header getrickst. --------------------------------------------- http://heise.de/-3177745

1 0

Tageszusammenfassung - Montag 18-04-2016
by Daily end-of-shift report 18 Apr '16

18 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-04-2016 18:00 − Montag 18-04-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bugtraq: [SECURITY] [DSA 3550-1] openssh security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/538099 *** Out-of-date apps put 3 million servers at risk of crypto ransomware infections *** --------------------------------------------- 1,600 schools, governments, and aviation companies already backdoored. --------------------------------------------- http://arstechnica.com/security/2016/04/3-million-servers-are-sitting-ducks… *** Chrome extensions will soon have to tell you what data they collect *** --------------------------------------------- Google is about to make it harder for Chrome extensions to collect your browsing data without letting you know about it, according to a new policy announced Friday.Starting in mid-July, developers releasing Chrome extensions .. --------------------------------------------- http://www.cio.com/article/3057259/chrome-extensions-will-soon-have-to-tell… *** How to Write Phishing Templates That Work *** --------------------------------------------- Phish Me Once Phishing isn't hard. Despite all the frightening news reports about ransomware and millions of stolen dollars and identities, people still happily click .. --------------------------------------------- http://resources.infosecinstitute.com/how-to-write-phishing-templates-that-… *** ZDI-16-244: Hewlett Packard Enterprise Vertica validateAdminConfig Remote Command Injection Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Vertica. Authentication is not required to exploit this vulnerability. --------------------------------------------- www.zerodayinitiative.com/advisories/ZDI-16-244/ *** ZDI-16-243: Google Chrome Pdfium JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows an attacker to leak sensitive information on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-243/ *** Splunk Enterprise Multiple Flaws Let Remote Users Bypass Security and Deny Service and Remote Authenticated Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1035578 *** 'Blackhole' Exploit Kit Author Gets 7 Years *** --------------------------------------------- A Moscow court this week convicted and sentenced seven hackers for breaking into countless online bank accounts -- including "Paunch," the nickname used by the author of the infamous "Blackhole" exploit kit. Once an extremely .. --------------------------------------------- http://krebsonsecurity.com/2016/04/blackhole-exploit-kit-author-gets-8-year… *** DSA-3551 fuseiso - security update *** --------------------------------------------- It was discovered that fuseiso, a user-space implementation of theISO 9660 file system based on FUSE, contains several vulnerabilities. --------------------------------------------- https://www.debian.org/security/2016/dsa-3551 *** leenk.me <= 2.5.0 - XSS and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8457 *** DSA-3552 tomcat7 - security update *** --------------------------------------------- Multiple security vulnerabilities have been discovered in the Tomcatservlet and JSP engine, which may result in information disclosure,the bypass of CSRF protections and bypass of the SecurityManager. --------------------------------------------- https://www.debian.org/security/2016/dsa-3552 *** FAQ WD <= 1.0.14 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8455 *** e-search <= 1.0 - Unauthenticated Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8458 *** Hacking Team hacker explains how he did it *** --------------------------------------------- Some nine moths ago, a hacker that calls himself Phineas Fisher managed to breach the systems and networks of Hacking Team, the (in)famous Italian company that provides offensive intrusion and surveillance software to .. --------------------------------------------- https://www.helpnetsecurity.com/2016/04/18/hacking-team-hacker-explains/ *** Abhörsicherheit: Web.de sichert Mail-Transport zusätzlich per DANE ab *** --------------------------------------------- Der Schritt ist bedeutsam, weil Web.de nicht nur einer der großen deutschen Freemail-Dienste ist, sondern, weil der Mutterkonzern United Internet auch zur Initiative "E-Mail made in Germany" gehört – um die es zuletzt freilich still geworden ist. --------------------------------------------- http://heise.de/-3175333 *** Remote code execution, git, and OS X *** --------------------------------------------- Sometimes I think about all of those pictures which show a bunch of people in startups. They have their office space, which might be big, or it might be small, but they tend to have Macs. Lots of Macs. A lot of them also use git to .. --------------------------------------------- https://rachelbythebay.com/w/2016/04/17/unprotected/ *** Oracle Critical Patch Update Pre-Release Announcement - April 2016 *** --------------------------------------------- This Critical Patch Update Pre-Release Announcement provides advance information about the Oracle Critical Patch Update for April 2016, which will be released on Tuesday, April 19, 2016. While this Pre-Release Announcement is as accurate .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2016-2881694.html *** Idiot millennials are saving credit card PINs on their mobile phones *** --------------------------------------------- Cleartext passwords are bad, kids, mmmkay? More than one in five 18-24 year olds (21 per cent) store PINs for credit or debit cards on their smartphones, tablets or laptops, according to research conducted by Equifax in conjunction with Gorkana. --------------------------------------------- www.theregister.co.uk/2016/04/18/storing_passwords_smartphone_bad_mkay/ *** Implementation of a Virtual IDS Device in Passive Mode *** --------------------------------------------- The arrival of server, desktop and network virtualization has brought along enormous flexibility in configuration options and a huge drop in installation and operating costs of IT networks. Due .. --------------------------------------------- http://resources.infosecinstitute.com/implementation-of-a-virtual-ids-devic… *** Academic network Janet clobbered with DDoS attacks - again *** --------------------------------------------- Funny how it always gets targeted at the end of term... Blightys government-funded educational network Janet has once again been hit by a cyber attack, with a fresh .. --------------------------------------------- www.theregister.co.uk/2016/04/18/janet_clobbered_with_ddos_attacks_again/ *** Oberösterreichische Firma bei Traktorenkauf auf Internetbetrüger reingefallen *** --------------------------------------------- 40.000 Euro Schaden - Homepage von englischem Anbieter "gefakt" --------------------------------------------- http://derstandard.at/2000035121122

1 0

Tageszusammenfassung - Freitag 15-04-2016
by Daily end-of-shift report 15 Apr '16

15 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-04-2016 18:00 − Freitag 15-04-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Computing System Platform Emulator Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified Computing System Platform Emulator Filename Argument Handling Buffer Overflow Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vorgebliches Flash-Update installiert unerwünschte Mac-Programme *** --------------------------------------------- Erneut ist ein als Flash-Aktualisierung getarnter Installer im Umlauf, der ungewollte OS-X-Programme einspielt. Ein Entwickler-Zertifikat stellt die Schutzfunktion Gatekeeper ruhig. --------------------------------------------- http://heise.de/-3174793 *** Bedep has raised its game vs Bot Zombies *** --------------------------------------------- http://malware.dontneedcoffee.com/2016/04/bedepantiVM.html *** Xen hugetlbfs Support Lets Local Users on a Guest System Cause Denial of Service Conditions on the Guest System *** --------------------------------------------- http://www.securitytracker.com/id/1035569 *** Banking Trojans Nymaim, Gozi Merge to Steal $4M *** --------------------------------------------- 'Double-headed beast' Trojan, GozNym, drains $4 million from banks in past two weeks. --------------------------------------------- http://threatpost.com/banking-trojans-nymaim-gozi-merge-to-steal-4m/117412/ *** Ransomware authors use the bitcoin blockchain to deliver encryption keys *** --------------------------------------------- Ransomware authors are using the bitcoin blockchain, which serves as the cryptocurrencys public transaction ledger, to deliver decryption keys to victims.The technique, which removes the burden of maintaining a reliable website-based .. --------------------------------------------- http://www.cio.com/article/3056604/ransomware-authors-use-the-bitcoin-block… *** VMSA-2016-0004 *** --------------------------------------------- VMware product updates address a critical security issue in the VMware Client Integration Plugin --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2016-0004.html *** HTTP Public Key Pinning: How to do it right, (Thu, Apr 14th) *** --------------------------------------------- [Thanks to Felix aka @nexusnode for inspiring this post. Also, see his blog post [1] for more details] One of the underutilizedsecurity measures I mentioned recently was HTTP Public Key Pinning, or HPKP. First again, what is HPKP: HPKP adds a special header to the HTTP response. This header lists hashes .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20943 *** Researchers Crack Microsoft and Google's Shortened URLs to Spy on People *** --------------------------------------------- They were even able to identify a young woman whod sought Google Maps directions to a Planned Parenthood clinic. --------------------------------------------- http://www.wired.com/2016/04/researchers-cracked-microsoft-googles-shortene… *** Russia sends exploit kit author to the GULAG for seven years *** --------------------------------------------- ♫ Mothers, dont let your babies grow up to be hackers ♫ The author of the infamous "Blackhole" exploit kit has been sentenced to seven years in a Russian penal colony, local media report. --------------------------------------------- www.theregister.co.uk/2016/04/15/blackhole_paunch_sentence/ *** OGH: Unternehmer bei "Phishing"-Attacke vom Konto selbst schuld *** --------------------------------------------- http://derstandard.at/2000034923248-406 *** AJAX Random Post <= 2.00 - Unauthenticated Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8450 *** HDW WordPress Video Gallery <= 1.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8449 *** Blackberry: Kanadische Polizei besitzt seit 2010 Zentralschlüssel *** --------------------------------------------- Wurde genutzt um über die Jahre Millionen BBM-Nachrichten mitzulesen --------------------------------------------- http://derstandard.at/2000034940341 *** Sierra Wireless ACEmanager Information Exposure Vulnerability *** --------------------------------------------- This advisory contains mitigation details for an exposure of sensitive information vulnerability in the Sierra Wireless ACEmanager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-105-01 *** Accuenergy Acuvim II Series AXM-NET Module Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for authentication bypass vulnerabilities in Accuenergy's Acuvim II Series AXM-NET module. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-105-02 *** QuickTime unter Windows deinstallieren - JETZT! *** --------------------------------------------- Da zwei kritische Lücken in QuickTime für Windows klaffen und Apple die Anwendung nicht mehr unterstützt, .. --------------------------------------------- http://heise.de/-3175518

1 0

Tageszusammenfassung - Donnerstag 14-04-2016
by Daily end-of-shift report 14 Apr '16

14 Apr '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-04-2016 18:00 − Donnerstag 14-04-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Unified Computing System Central Software Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** JSA10733 - 2016-04 Security Bulletin: ScreenOS: Multiple Vulnerabilities in OpenSSL *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10733&actp=RSS *** JSA10747 - 2016-04 Security Bulletin: QFX Series: PFE panic while processing VXLAN packets (CVE-2016-1274) *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10747&actp=RSS *** JSA10735 - 2016-04 Security Bulletin: CTP Series: Multiple vulnerabilities in CTP Series *** --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10735&actp=RSS *** Cisco Catalyst Switches Network Mobility Services Protocol Port Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Juniper bleeding data and money: slaps Band-Aids all over Junos OS and warns markets *** --------------------------------------------- Security fixes for privilege escalation, DoS, TLS spoofing and more Junipers code reviewers have been hard at work, and have shipped a bunch of security bug-fixes. --------------------------------------------- www.theregister.co.uk/2016/04/14/juniper_drops_a_bunch_of_junos_os_security… *** Hackers hacking hackers to knacker white hat cracker trackers *** --------------------------------------------- These Russians speak really good Farsi and other signs thieves lack honour ACSC2016 Malware writers are selling each other out to white hats and hacking through each others infrastructure to frame rivals, Shadowservers Richard Perlotto says. --------------------------------------------- www.theregister.co.uk/2016/04/14/there_is_no_honour_among_thieves/ *** Entschlüsselungs-Tool verfügbar? Webseite identifiziert Erpressungs-Trojaner *** --------------------------------------------- Opfer von Verschlüsselungs-Trojanern können auf der Webseite ID Ransomware den Schädling identifizieren und unter anderem Infos zur Möglichkeit einer kostenlosen Entschlüsselung abrufen. --------------------------------------------- http://heise.de/-3173463 *** "Der Bundestrojaner ist staatliche Schadsoftware" *** --------------------------------------------- Für den IT-Experten Rene Pfeiffer ist die staatliche Spionagesoftware kein taugliches Mittel zur .. --------------------------------------------- http://derstandard.at/2000034779830 *** Hacker bringt "Flappy Bird" auf die E-Zigarette *** --------------------------------------------- Ist mit kleinem OLED-Bildschirm ausgestattet - Firmware zum Download gestellt --------------------------------------------- http://derstandard.at/2000034841151 *** Boost - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-021 *** --------------------------------------------- This module provides static page caching for Drupal enabling a very significant performance and scalability boost for sites that receive mostly anonymous traffic.The module doesnt prevent form cache from leaking between anonymous users which .. --------------------------------------------- https://www.drupal.org/node/2705765 *** Features - Less Critical - Denial of Service (DoS) - SA-CONTRIB-2016-020 *** --------------------------------------------- This module enables you to organize and export configuration data.The module doesnt sufficiently protect the admin/structure/features/cleanup path with a token. If an attacker can trick an admin with the .. --------------------------------------------- https://www.drupal.org/node/2705637 *** Badlock: A Lateral Concern *** --------------------------------------------- Yesterday, what seems like the entire InfoSec industry was underwhelmed when Badlock was finally disclosed and, apparently, didn't live up to its billing. While we agree that the month-long buildup to the disclosure, and flashy logo were unnecessary, we'd like to explain why we think this vulnerability will end up providing malicious actors with a .. --------------------------------------------- https://labsblog.f-secure.com/2016/04/14/badlock-a-lateral-concern/ *** Snort Lab: Custom SCADA Protocol IDS Signatures *** --------------------------------------------- In this lab, you are going to learn how to create custom Snort signatures for the Modbus/TCP protocol. First, let's take some time to examine the Modbus TCP Target system. Start the Modbus TCP PLC Target VM. This target simulates .. --------------------------------------------- http://resources.infosecinstitute.com/snort-lab-custom-scada-protocol-ids-s… *** East European Criminal Fastflux Infrastructure *** --------------------------------------------- Fast flux networks allow miscreants to make their network more resistant against takedowns. By updating and changing the A records of a domain rapidly, there is a constant changing list of IPs hosting the domain involved, .. --------------------------------------------- https://blog.team-cymru.org/2016/04/east-european-criminal-fastflux-infrast… *** USB: Digitale Signaturen schützen vor bösartigen oder schlechten Geräten *** --------------------------------------------- USB-Geräte mit Typ-C-Anschluss sollen sich künftig mit kryptografischen Zertifikaten ausweisen, um Malware-Angriffe und Probleme durch inkompatible Netzteile zu vermeiden. --------------------------------------------- http://heise.de/-3173701

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily