Daily

daily@lists.cert.at

1 participants
3209 discussions

Tageszusammenfassung - Freitag 11-01-2013
by Daily end-of-shift report 11 Jan '13

11 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-01-2013 18:00 − Freitag 11-01-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** European Cybercrime Centre opens for business *** --------------------------------------------- "The European Cybercrime Centre (EC3) will officially start operating on 11 January with a mission to protect European citizens and businesses from cybercrime. "Cybercriminals are smart and quick in using new technologies for criminal purposes; the EC3 will help us become even smarter and quicker to help prevent and fight their crimes" said European Commissioner for Home Affairs Cecilia Malmstrm at the launch of the EC3 project ahead of the official opening of the centre at... --------------------------------------------- http://www.h-online.com/security/news/item/European-Cybercrime-Centre-opens… *** Bugtraq: DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit *** --------------------------------------------- DefenseCode Security Advisory (UPCOMING): Cisco Linksys Remote Preauth 0day Root Exploit --------------------------------------------- http://www.securityfocus.com/archive/1/525269 *** Bugtraq: Detailed examples of two vulnerabilities in whitelisting software: SE46 (Cryptzone) and Application Control (McAfee) *** --------------------------------------------- Detailed examples of two vulnerabilities in whitelisting software: SE46 (Cryptzone) and Application Control (McAfee) --------------------------------------------- http://www.securityfocus.com/archive/1/525268 *** What Else runs Telnets? Or, Pentesters Love Video Conferencing Units Too!, (Thu, Jan 10th) *** --------------------------------------------- As a side note to todays iSeries / Mainframe story, and a follow-up to one I wrote last year (https://isc.sans.edu/diary/12103), another thing Im seeing is more and more on telnets (tcp port 992 - https://isc.sans.edu/port.html?port=992) is voice gateway and videoconferencing unit problems. Specifically, when scanning for port tcp/992, you will likely run across more videoconferencing systems than mainframes. Theyll often show up with less fingerprinting than the SNA platforms we discussed,... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14902&rss *** HPSBMU02838 SSRT100789 rev.1 - HP Serviceguard on Linux, Remote Denial of Service (DoS) *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03621178 *** TYPO3-EXT-SA-2013-001: Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: news, onetimeaccount, phpunit, div2007, t3mootools, t3jquery, oneclicklogin --------------------------------------------- https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-… *** .NET-Update beeinträchtigt Windows Server 2012 *** --------------------------------------------- Ein seit Dienstag ausgeliefertes Update für die .NET-Laufzeitumgebung 4.5 führt unter Windows Server 2012 zu Problemen mit dem Failover Cluster Manager. Microsoft hat das Problem bereits bestätigt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/276e67d9/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Donnerstag 10-01-2013
by Daily end-of-shift report 10 Jan '13

10 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-01-2013 18:00 − Donnerstag 10-01-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: GE Proficy HMI/SCADA CIMPLICITY Denial of Service Vulnerability *** --------------------------------------------- GE Proficy HMI/SCADA CIMPLICITY Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57188 *** Police Arrest Alleged ZeuS Botmaster “bx1″ *** --------------------------------------------- A man arrested in Thailand this week on charges of stealing millions from online bank accounts fits the profile of a miscreant nicknamed "bx1," a hacker fingered by Microsoft as a major operator of botnets powered by the ZeuS banking trojan. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/D_NUNHSTfy8/ *** Zero-Day Java Exploit Debuts in Crimeware *** --------------------------------------------- The hackers who maintain Blackhole and Nuclear Pack – competing crimeware products that are made to be stitched into hacked sites and use browser flaws to foist malware — say they’ve added a brand new exploit that attacks a previously unknown and currently unpatched security hole in Java. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/x8J2sRZ5128/ *** Vuln: Microsoft .NET Framework CVE-2013-0004 Remote Privilege Escalation Vulnerability *** --------------------------------------------- Microsoft .NET Framework CVE-2013-0004 Remote Privilege Escalation Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57113 *** Web Application Vulnerability Statistics of 2012 *** --------------------------------------------- "With years of experience and valuable insights from our cloud based application security testing, we thought of conducting a study to discover the prevailing website vulnerability trends. The study is based on our original research on more than 5000 tests covering 300+ customers distributed globally. How was the study conducted?..." --------------------------------------------- http://www.ivizsecurity.com/blog/penetration-testing/web-application-vulner… *** Exploit für Ruby on Rails im Umlauf *** --------------------------------------------- Die Sicherheitslücke in Ruby-On-Rails erweist sich als akut gefährlich; erste Exploits sind im Umlauf und Berichte über gekaperte Web-Server laufen ein. Administratoren sollten dringend handeln. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2763d32a/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 9-01-2013
by Daily end-of-shift report 09 Jan '13

09 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-01-2013 18:00 − Mittwoch 09-01-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Serious Password Reset Hole In Accellion Secure FTP *** --------------------------------------------- chicksdaddy writes "A security researcher who was looking for vulnerabilities in Facebooks platform instead stumbled on a much larger hole that could affect scores of firms who rely on a secure file transfer platform from Accellion. Writing on his blog on Monday, Israeli researcher Nir Goldshlager said he discovered the password reset vulnerability while analyzing a Accellion deployment that is used, internally, by Facebook employees. Goldshlager used public knowledge of the Accellion... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/BpSzZxCpN3k/story01.htm *** Microsoft Updates for Multiple Vulnerabilities *** --------------------------------------------- The Microsoft Security Bulletin Summary for January 2013 describes multiple vulnerabilities in Microsoft software. Microsoft has released updates to address the vulnerabilities. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-jan *** Adobe Security Bulletins Posted *** --------------------------------------------- Today, we released the following Security Bulletins: APSB13-01 Security updates available for Adobe Flash Player APSB13-02 Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant Security Bulletin(s) for details. This posting is provided "AS IS" with no warranties and confers no rights. --------------------------------------------- http://blogs.adobe.com/psirt/2013/01/adobe-security-bulletins-posted-4.html *** Experts Identify, Analyze Botnet Used to Launch DDOS Attacks Against US Banks *** --------------------------------------------- "Researchers have been constantly analyzing the distributed denial-of-service (DDOS) attacks launched by Izz ad-Din al-Qassam Cyber Fighters against United States financial institutions but, up until now, little was known about the resources used by the hacktivists. Incapsula, a cloud-based security and acceleration service provider, has uncovered some interesting details about the cyberattacks and the botnet that powers them after noticing that the website of a new customer was... --------------------------------------------- http://news.softpedia.com/news/Experts-Identify-Analyze-Botnet-Used-to-Laun… *** Mobile Browser Security: Problem Exists Between Device and Chair *** --------------------------------------------- "Last month, a Georgia Tech study found that mobile browsers frequently left even expert users insufficient information to judge if a site was potentially dangerous, because of user interface limitations. The item that is most problematic is how SSL information is displayed. Compared to desktops, mobile browsers have far more limited ways to show if a site is using SSL...." --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mobile-browser-s… *** Kritische Lücken in Firefox, Thunderbird und SeaMonkey geschlossen *** --------------------------------------------- Mit den jüngsten Updates haben die Entwickler zahlreiche Schwachstellen in den Mozilla-Programmen beseitigt. Man sollte daher sicherstellen, dass man jeweils die aktuelle Version nutzt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2758df0f/l/0L0Sheise0Bde0Cmel… *** First confirmed hard victim of Ruby on Rails Zero-Day Dutch DigiD Government Service. All services *** --------------------------------------------- "After having alerted on a new SQL Injection Vulnerability in Ruby on rails on 3 january, Bricade alerted on a second, even more serious, Zero Day on 8 January. The Dutch Government DigiD Service reported today 9th of January on their website that the DigiD service was not available today. See https://www...." --------------------------------------------- http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-1… *** Aktuelle Foxit-Reader-Version führt Schadcode aus *** --------------------------------------------- In Browser-Plug-in des PDF-Anzeigeprogramms klafft eine hochkritische Sicherheitslücke, weshalb man es umgehend abschalten sollte. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/275a0b01/l/0L0Sheise0Bde0Cmel… *** Cisco Security Advisory: Cisco Prime LAN Management Solution Command Execution Vulnerability *** --------------------------------------------- Advisory ID: cisco-sa-20130109-lms --------------------------------------------- Cisco Prime LAN Management Solution (LMS) Virtual Appliance contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Dienstag 8-01-2013
by Daily end-of-shift report 08 Jan '13

08 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-01-2013 18:00 − Dienstag 08-01-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Bugtraq: Chrome for Android - Cookie theft from Chrome by malicious Android app *** --------------------------------------------- Chrome for Android - Cookie theft from Chrome by malicious Android app --------------------------------------------- http://www.securityfocus.com/archive/1/525222 *** Bugtraq: Chrome for Android - Android APIs exposed to JavaScript *** --------------------------------------------- Chrome for Android - Android APIs exposed to JavaScript --------------------------------------------- http://www.securityfocus.com/archive/1/525220 *** Foxit Reader <= 5.4.4.1128 npFoxitReaderPlugin.dll Stack Buffer Overflow *** --------------------------------------------- Topic: Foxit Reader --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/mNx5SSGJYF4/WLB-20… *** Drupal 6.x->7.18 getimagesize() <= Multiple Vulnerabilities *** --------------------------------------------- Topic: Drupal 6.x->7.18 getimagesize() --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2AwbWS10dFQ/WLB-20… *** Bugtraq: Facebook for Android - Information Diclosure Vulnerability *** --------------------------------------------- Facebook for Android - Information Diclosure Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525223 *** Symantec plays down PGP hole *** --------------------------------------------- "Symantec has quenched fears about a vulnerability in its PGP technology. According to a Pastebin statement, the pgpwded. sys kernel driver distributed with Symantec PGP Desktop contains an arbitrary memory overwrite vulnerability in the handling of IOCTL 0x80022058...." --------------------------------------------- http://news.hitb.org/content/symantec-plays-down-pgp-hole *** ‘Value of a Hacked PC’ Graphic Goes Global *** --------------------------------------------- The Value of a Hacked PC graphic, which I published on this blog a few months ago to explain bad guy uses for your PC, is getting a makeover. I’m honored to say that the SANS Institute, a security training group, has taken the idea and run with it as an educational tool, and is in [...] --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/ehmnqBEd8q0/ *** Abgeschottetes Android für Unternehmen *** --------------------------------------------- Eine speziell angepasste Version des Mobilbetriebssystems überwacht, was der User mit seinem Gerät tun kann – basierend auf der jeweiligen Nutzungssituation. --------------------------------------------- http://www.heise.de/meldung/Abgeschottetes-Android-fuer-Unternehmen-1767696… *** Vuln: OpenIPMI ipmievd Daemon PID Files Insecure File Permissions Vulnerability *** --------------------------------------------- OpenIPMI ipmievd Daemon PID Files Insecure File Permissions Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/51036 *** Vuln: PostgreSQL Multiple Privilege Escalation and Denial of Service Vulnerabilities *** --------------------------------------------- PostgreSQL Multiple Privilege Escalation and Denial of Service Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/27163 *** ENISA Names Drive-By Exploits as Biggest Emerging Threat of 2012 *** --------------------------------------------- "The European Network and Information Security Agency (ENISA) has released its Cyber Threat Landscape analysis of 2012. The study, based on over 120 threat reports, highlights the top threats and their trends. According to the report, drive-by exploits malicious code injects used to exploit web browser vulnerabilities are the number one threat...." --------------------------------------------- http://news.softpedia.com/news/ENISA-Names-Drive-By-Exploits-as-Biggest-Eme… *** [webapps] - Advantech WebAccess HMI/SCADA Software Persistence XSS Vulnerability *** --------------------------------------------- Advantech WebAccess HMI/SCADA Software Persistence XSS Vulnerability --------------------------------------------- http://www.exploit-db.com/exploits/23968 *** Wichtiges Sicherheitsupdate für MoinMoin-Wiki *** --------------------------------------------- Das Update auf Version 1.9.6 behebt unter anderem eine kritische Schwachstelle, die bereit aktiv von Cyber-Kriminellen ausgenutzt wird. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274e0d0f/l/0L0Sheise0Bde0Cmel… *** Payment Card Fraud in the European Union *** --------------------------------------------- "The criminal market of payment card fraud (PCF) within the European Union (EU) is dominated by well structured and globally active organised crime groups (OCGs). Criminal networks have managed to affect non-cash payments in the EU to the extent that protection measures are very expensive and need to be implemented on a global level. Consequently, the use of payment cards can be inconvenient and no longer fully secure for EU cardholders...." --------------------------------------------- https://www.europol.europa.eu/sites/default/files/publications/1public_full… *** Angriffe auf ungepatchte ColdFusion-Lücken *** --------------------------------------------- Adobe warnt davor, dass Cyber-Kriminelle durch bislang nicht geschlossene Sicherheitslöcher in ColdFusion-Server einsteigen. Ein passender Patch ist frühestens in einer Woche fertig. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274f87d4/l/0L0Sheise0Bde0Cmel… *** Bugtraq: ESA-2013-001: EMC NetWorker Buffer Overflow vulnerability *** --------------------------------------------- ESA-2013-001: EMC NetWorker Buffer Overflow vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/525229 *** [webapps] - WordPress Plugin Google Document Embedder Arbitrary File Disclosure *** --------------------------------------------- WordPress Plugin Google Document Embedder Arbitrary File Disclosure --------------------------------------------- http://www.exploit-db.com/exploits/23970 *** Kritische Schwachstellen in Asterisk *** --------------------------------------------- Digium hat einige kritische Schwachstellen in der quelloffenen Telefonanlagen-Software Asterisk geschlossen, durch die ein Angreifer Code in den Server einschleusen kann. Bei den Lücken handelt es sich um Pufferüberläufe auf dem Stack, die über die Protokolle HTTP, SIP und XMPP ausgenutzt werden können. Nur bei XMPP ist hierzu eine aktive Sitzung nötig. --------------------------------------------- http://www.heise.de/meldung/Kritische-Schwachstellen-in-Asterisk-1779526.ht…

1 0

Tageszusammenfassung - Montag 7-01-2013
by Daily end-of-shift report 07 Jan '13

07 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-01-2013 18:00 − Montag 07-01-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Patch for IE Zero Day Wont Be Among Microsoft Security Updates Next Week *** --------------------------------------------- "Microsoft plans to release a pair of critical bulletins on Tuesday for its first round of 2013 monthly security updates, but still has no announcement regarding a patch for the zero day vulnerability and exploit in Internet Explorer reported over the Christmas holiday. Users are urged to apply a Fix It released Dec. 31 for the vulnerability in IE 6, 7 and 8 that was at the heart of an attack on the Council on Foreign Relations website as well as that of energy manufacturer Capstone... --------------------------------------------- http://threatpost.com/en_us/blogs/patch-ie-zero-day-wont-be-among-microsoft… *** Dutch Government Aims to Shape Ethical Hackers Disclosure Practices *** --------------------------------------------- "The Dutch governments cyber security center has published guidelines that it hopes will encourage ethical hackers to disclose security vulnerabilities in a responsible way."Persons who report an IT vulnerability have an important social responsibility," the Dutch ministry of Security and Justice said on Thursday, announcing guidelines for ethical hacking that were published by the countrys National Cyber Security Center (NCSC). White-hat hackers and security researchers play an... --------------------------------------------- http://www.cio.com/article/725400/Dutch_Government_Aims_to_Shape_Ethical_Ha… *** FreePBX 2.7.0.3 & Elastix 2.3.0 SQL injection *** --------------------------------------------- Topic: FreePBX 2.7.0.3 & Elastix 2.3.0 SQL injection Risk: Medium Text:# Exploit Title: SQL injection in FreePBX 2.7.0.3 / Elastix 2.3.0 # Google Dork: N/A # Date: 05/01/2013 # Exploit Author: S... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/DfqeYKHkuXM/WLB-20… *** pfSense 2.0.1 XSS & CSRF & Command Execution *** --------------------------------------------- Topic: pfSense 2.0.1 XSS & CSRF & Command Execution Risk: High Text: # # Exploit Title: pfSense 2.0.1 XSS & CSRF Remote root Access # Date: 04/01/2013 # Author: Yann CAM ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/1o3q8BIwTZs/WLB-20… *** MyBB Profile Wii Friend Code 1.0 Cross Site Scripting and SQL Injection *** --------------------------------------------- Topic: MyBB Profile Wii Friend Code 1.0 Cross Site Scripting and SQL Injection Risk: Medium Text:# Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS # Dork: intitle:"Profile of" intext:"Wii Friend Code" inurl:... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/lZtyzTcL-Tc/WLB-20… *** BSI release Draft Cyber Security standard - PAS 555\ *** --------------------------------------------- "This PAS specifies a framework for the governance and management of cyber security risk. The requirements of this PAS define the overall outcomes of effective cyber security, and include technical, physical, cultural and behavioural measures alongside effective leadership and governance. While there are many standards and guidelines available that can help tackle cyber security risk, they tend to define good practice as to how elements of effective cyber security might be... --------------------------------------------- http://drafts.bsigroup.com/Home/Details/49890 *** Adobe ColdFusion Security Advisory, (Sat, Jan 5th) *** --------------------------------------------- Adobe released a security advisory which identifies three vulnerabilities (CVE-2013-0625, CVE-2013-0629, CVE-2013-0631) affecting ColdFusion for Windows, Macintosh and Unix. They have received reports that these vulnerabilities are actively being exploited. Adobe is currently planning to release a fix for January 15, 2013. Additional information and mitigations options available here. [1] http://www.adobe.com/support/security/advisories/apsa13-01.html ----------- Guy Bruneau IPSS Inc. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14827&rss *** Neuer Exploit für Lücke im Internet Explorer *** --------------------------------------------- Einer Sicherheitsfirma gelang es nach eigenen Angaben, Microsofts provisorischen Patch für die kritische IE-Lücke auszutricksen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2738e1e8/l/0L0Sheise0Bde0Cmel… *** Malware targets Java HTTP servers *** --------------------------------------------- "A malware that strikes at Java HTTP servers and allows attackers to gain control on underlying systems has been spotted by security researchers of anti-virus vendor Trend Micro Inc. Using a password cracking tool, cybercriminals are able to login and gain manager/administrative rights allowing the deployment of Web application archive (WAR) file packages with the backdoor to the server, according to a post last Thursday on the Trend Labs. & Once done, the backdoor can now browse, --------------------------------------------- http://www.itworldcanada.com/news/malware-targets-java-http-servers/146535 *** Symantec links latest Microsoft zero-day with skilled hacker gang *** --------------------------------------------- "Symantec is crediting a hacker group with an impressive track record as responsible for finding the latest as yet unpatched vulnerability in older versions of Microsofts Internet Explorer browser. A gang Symantec calls the Elderwood group appears to have found the latest zero-day vulnerability in IE, which can allow a malicious website to automatically infect a persons computer.[ Security expert Roger A. Grimes offers a guided tour of the latest threats and explains what you can do to... --------------------------------------------- http://www.infoworld.com/d/security/symantec-links-latest-microsoft-zero-da… *** Crimeware Author Funds Exploit Buying Spree *** --------------------------------------------- "The author of Blackhole, an exploit kit that booby-traps hacked Web sites to serve malware, has done so well for himself renting his creation to miscreants that the software has emerged as perhaps the most notorious and ubiquitous crimeware product in the Underweb. Recently, however, the author has begun buying up custom exploits to bundle into a far more closely-held and expensive exploit pack, one that appears to be fueling a wave of increasingly destructive online extortion schemes. An... --------------------------------------------- http://krebsonsecurity.com/2013/01/crimeware-author-funds-exploit-buying-sp… *** Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability *** --------------------------------------------- Topic: Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability Risk: Low Text: ## # # Exploit Title : Wordpress NextGEN Gallery plugin Cross-Site Scripting Vulnerability # # Author : IrI... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/ESFCnSJbmkU/WLB-20… *** Wordpress wilderness SQL injection *** --------------------------------------------- Topic: Wordpress wilderness SQL injection Risk: Medium Text:# Exploit Title: Wordpress wilderness SQL injection # Google Dork: inurl:/wp-content/themes/wilderness/gallery.php # Date: 20... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/6WtYRSMSzoI/WLB-20… *** Vuln: CUPS CVE-2012-5519 Local Privilege Escalation Vulnerability *** --------------------------------------------- CUPS CVE-2012-5519 Local Privilege Escalation Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56494 *** Sicherheit - Ubisofts Spieleplattform Uplay gehackt *** --------------------------------------------- Spielehersteller arbeitet bereits an Lösung und ruft zu besseren Passwörtern auf --------------------------------------------- http://derstandard.at/1356426935498/Ubisofts-Spieleplattform-Uplay-gehackt *** Google, Yahoo, Microsoft und Amazon anfällig für Clickjacking *** --------------------------------------------- Ein Sicherheitsforscher demonstriert an populären Webseiten wie Amazon, Google, Yahoo und Microsoft Live, dass viele Webseiten immer noch schlecht gegen Clickjacking geschützt sind. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/274546ad/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Freitag 4-01-2013
by Daily end-of-shift report 04 Jan '13

04 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-01-2013 18:00 − Freitag 04-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Apache Malware Installs Zeus *** --------------------------------------------- "The worlds most widely used web server, Apache, is a conduit to inject malicious content into web pages served by an infected Linux server, without the knowledge of the website owner. Those are the results of an analysis of a malicious Apache module, detected by ESET. They called the malware Linux/Chapro.A. Although the malware can serve practically any type of content, in this specific case it installs a variant of Win32/Zbot, malware designed to steal information from online banking --------------------------------------------- http://www.isssource.com/apache-malware-installs-zeus/ *** Bugtraq: Aastra IP Telephone encrypted .tuz configuration file leakage *** --------------------------------------------- Aastra IP Telephone encrypted .tuz configuration file leakage --------------------------------------------- http://www.securityfocus.com/archive/1/525190 *** Browser vendors rush to block fake google.com site cert *** --------------------------------------------- Turkish authoritys goof could compromise data Google and other browser vendors have taken steps to block an unauthorized digital certificate for the " *.google.com" domain that fraudsters could have used to impersonate the search giants online services. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/turkish_fak… *** Holey code, Batman! Microsoft to patch 12 vulns on Tuesday *** --------------------------------------------- Christmas zero-day flaw not included Microsoft has issued its pre Patch Tuesday report, saying it will issue seven patches fixing 12 code flaws next week but it wont provide a permanent fix for the exploit discovered during the recent holidays that is already being used in the wild. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/04/microsoft_p… *** Canadian Government Acknowledges Security Breach *** --------------------------------------------- "An employee of Human Resources and Skills Development Canada (HRSDC) recently misplaced an unencrypted USB drive containing sensitive data on approximately 5,000 Canadian citizens."The lost data, which was reported to the HRSDC on Nov. 17, included names, Social Insurance Numbers (similar to Social Security numbers) and other information criminals could use to defraud victims," writes TechNewsDailys Ben Weitzenkorn."The department, which handles a variety of files including --------------------------------------------- http://www.esecurityplanet.com/network-security/canadian-government-acknowl… *** Nicht zimperlich - DDoS-Attacken, gestohlene Daten: Harte Bandagen bei Lieferservices *** --------------------------------------------- Strafbefehle gegen sieben Führungskräfte von Lieferheld wegen entwendeter Datenbank eines Konkurrenten --------------------------------------------- http://derstandard.at/1356426716898/DDoS-Attacken-gestohlene-Daten-Harte-Ba… *** Over 18,000 PayPal Phishing Websites Identified in December 2012 *** --------------------------------------------- "Phishing websites, ones created by cybercriminals to harvest sensitive information from unsuspecting users, have become highly problematic lately. Because theyre so effective, crooks have launched a considerable number of sites that replicate popular companies. For instance, according to a study performed by Trend Micro for December 2012, a total of 18,947 phishing websites have been found to replicate PayPal...." --------------------------------------------- http://news.softpedia.com/news/Over-18-000-PayPal-Phishing-Websites-Identif… *** Major global Facebook Botnet taken down *** --------------------------------------------- "A fraud ring worth around 525 million has been taken out of action by the joint efforts of Facebooks own security team and local police forces in the UK, Peru, the US and a number of other countries. The gang managed to steal the massive sum from Facebook users by secretly planting spyware on victims computers that would steal credit and bank card details. Along with financial details, personal information with worth on the black market was also lifted...." --------------------------------------------- http://www.journalism.co.uk/press-releases/major-global-facebook-botnet-tak…

1 0

Tageszusammenfassung - Donnerstag 3-01-2013
by Daily end-of-shift report 03 Jan '13

03 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-01-2013 18:00 − Donnerstag 03-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** BSI warnt vor Sicherheitslücke im VLC Media Player *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik rät Nutzern der populären quelloffenen Videoabspielsoftware, auf die aktuelle Version 2.0.5 umzusteigen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27218c1d/l/0L0Sheise0Bde0Cmel… *** Energy Manufacturer Also Victimized by IE Zero Day in Watering Hole Attack *** --------------------------------------------- "This weeks watering hole attack exploiting a zero-day vulnerability in Internet Explorer was not limited to the influential Council on Foreign Relations site. A Metasploit contributor said an energy manufacturers website has been serving malware related to the attack since September. Researcher Eric Romang said that Capstone Turbine Corp., which builds power generation equipment for utilities, has been infected with malware exploiting CVE 2012-4969 for four months and the latest IE --------------------------------------------- http://threatpost.com/en_us/blogs/energy-manufacturer-also-victimized-ie-ze… *** 6 Big cyber security predictions for 2013 *** --------------------------------------------- "If there is any weakness in security, you can guarantee the criminals will try to exploit it. And if a cyber criminal discovers a weakness in one community, it wont be long before that isolated crime turns into a trend. The commercialization of malware is rapidly becoming a well-organized and highly lucrative business...." --------------------------------------------- http://venturebeat.com/2013/01/02/6-big-cyber-security-predictions-for-2013/ *** Malware SNEAK dons cunning disguise, opens creaky back door to servers *** --------------------------------------------- Java-based exploit targets web-hosting servers A malicious backdoor designed to infect web servers poses a severe threat, Trend Micro warns. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/01/03/web_server_… *** A New Way of Detecting Cybersecurity Attacks *** --------------------------------------------- "Rajeev Bhargava is an acknowledged pioneer in the networking and software industry, and CEO of Toronto-based Decision Zone Inc. His career spans more than 30 years within the engineering and IT industry, and he has been closely associated with many of its major developments. Rajeev has advised many of North Americas largest organizations within the telecom, financial, high tech, military, retail, aerospace and government industries. He is the inventor of an anomaly detection solution used --------------------------------------------- http://www.digitalcommunities.com/articles/A-New-Way-of-Detecting-Cyber-Sec… *** Lücke in Ruby on Rails erlaubt SQL-Injections *** --------------------------------------------- Alle aktuellen Versionen des Fameworks Ruby on Rails sind von einer Sicherheitslücke betroffen, die das Einschleusen von beliebigem SQL-Code ermöglicht. Nutzer sollten ihre Software möglichst schnell aktualisieren. --------------------------------------------- http://www.heise.de/meldung/Luecke-in-Ruby-on-Rails-erlaubt-SQL-Injections-… *** Virenverseuchte Dia-Scanner bei Tchibo verkauft *** --------------------------------------------- Der Kaffeeröster Tchibo hat in der Vorweihnachtszeit des vergangenen Jahres einen virenverseuchten Dia-Scanner verkauft. Das Gerät wurde ab dem 11. Dezember 2012 für 60 Euro über die Filialen und den Tchibo-Onlineshop angeboten. --------------------------------------------- http://www.heise.de/meldung/Virenverseuchte-Dia-Scanner-bei-Tchibo-verkauft… *** Invasion of the Botnets *** --------------------------------------------- "Millions and millions of PCs have been silently infiltrated with bot malware, creating massive bot armies, poised to steal and inflict maximum damage when triggered by their Bot Commander. There are several botnets each comprising millions of compromised PCs, such as Zeus, Conficker, Mariposa, ZeroAccess and BredoLab, waiting for the next command from their Bot Commander, so that they can spring into action and obediently carry out their strike orders like a well-disciplined and --------------------------------------------- http://dwaterson.com/2013/01/02/invasion-of-the-botnets/ *** Cloud security to be most disruptive technology of 2013 *** --------------------------------------------- "The Security for Business Innovation Council, comprised of IT security professionals from 19 companies worldwide, called cloud computing the main disruptive force for 2013. In its report, "Information Security Shake-Up," the group said it was evident many organizations are preparing to move more business processes to the cloud. This year, it will even be "mission-critical apps and regulated data" consigned to the cloud...." --------------------------------------------- http://www.networkworld.com/news/2013/010313-cloud-security-265437.html *** Facebook-Lücke erlaubte unbemerkte Webcam-Aufnahmen *** --------------------------------------------- Rund vier Monate nachdem zwei Sicherheitsforscher eine Schwachstelle in Facebooks Video-Upload-Funktion meldeten, soll de Lücke geschlossen worden sein. Die Entdecker sind überrascht über die Höhe der von Facebook gezahlten Belohnung. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2729d37e/l/0L0Sheise0Bde0Cmel…

1 0

Tageszusammenfassung - Mittwoch 2-01-2013
by Daily end-of-shift report 02 Jan '13

02 Jan '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-12-2012 18:00 − Mittwoch 02-01-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Microsoft Warns of New Gaming Malware *** --------------------------------------------- "According to a recent report by Marianne Mallen of the Microsoft Malware Protection Center (MMPC), Microsoft researchers recently came across three new Trojans that specifically target Korean gamers."According to the ... MMPC, whoever is responsible for these pieces of malware is attempting to pilfer user login credentials, credit card information that is used to pay for in-game money and assorted upgrades, Korean ID numbers (a sort of Korean-variety Social Security number often --------------------------------------------- http://www.esecurityplanet.com/malware/microsoft-warns-of-new-gaming-malwar… *** Microsoft - Windows XP wird zum Sicherheitsrisiko *** --------------------------------------------- Die Zeitschrift ct warnt: "Ab 2014 kann man einen XP-Rechner nur noch in völliger Isolation betreiben" --------------------------------------------- http://text.derstandard.at/1356426331198/Windows-XP-wird-zum-Sicherheitsris… *** 29C3 - erfolgreicher Angriff auf verschlüsselnde Festplatten *** --------------------------------------------- Auch bei automatisch verschlüsselnden Festplatten (Self-Encrypting Drives, SED) können Angreifer die Daten mit wenigen Handgriffen auslesen: Der Informatiker Tilo Müller demonstrierte am Freitag auf dem 29. Hacker-Kongress des Chaos Computer Clubs (29C3) in Hamburg, wie sich die Hardware-Verschlüsselung von Desktop-Computern oder Laptops angreifen lässt. --------------------------------------------- http://www.heise.de/meldung/29C3-erfolgreicher-Angriff-auf-verschluesselnde… *** Windows 8 Will Be Harder to Hack - Security Expert *** --------------------------------------------- "Windows 8 has already been attacked by hackers who wanted to activate the operating system at no cost, but theres no doubt its one of the most secure Windows iterations released so far. And Microsoft uses this argument to promote Windows 8 with every single occasion, while security companies across the globe confirm that its harder to attack the new OS. McAfee said in its 2013 predictions report that Windows 8 may become hackers next big target, but Rapid7 CISO and Metasploit founder HD... --------------------------------------------- http://news.softpedia.com/news/Windows-8-Will-Be-Harder-to-Hack-Security-Ex… *** Bugtraq: GnuPG 1.4.12 and lower - memory access errors and keyring database corruption *** --------------------------------------------- GnuPG 1.4.12 and lower - memory access errors and keyring database corruption --------------------------------------------- http://www.securityfocus.com/archive/1/525167 *** Worst email scams of 2012 *** --------------------------------------------- "The scammers have continued to flood us with dodgy emails this year. Here are some of the worst ones weve spotted. Identity fraud and theft continues to be a big issue in the UK...." --------------------------------------------- http://www.lovemoney.com/news/scams-and-rip-offs/scams/18904/worst-email-sc… *** Provisorischer Fix für kritische Lücke im Internet Explorer *** --------------------------------------------- Im Internet Explorer bis einschließlich Version 8 klafft eine kritische Sicherheitslücke. Microsoft hat nun ein Fix-It-Tool herausgegeben, mit dem sich Nutzer der betroffenen IE-Versionen schützen können, bis ein Patch fertig ist. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/27194e91/l/0L0Sheise0Bde0Cmel… *** Piraterie - Gecrackte Apps: Neue Dienste kapern iOS auch ohne Jailbreak *** --------------------------------------------- Nachfolger von Installous könnten wesentlich mehr User erreichen --------------------------------------------- http://derstandard.at/1356426557392/Gecrackte-Apps-Neue-Dienste-kapern-iOS-…

1 0

Tageszusammenfassung - Freitag 28-12-2012
by Daily end-of-shift report 28 Dec '12

28 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-12-2012 18:00 − Freitag 28-12-2012 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** ICS-CERT Closes-out Two Alerts *** --------------------------------------------- "Today the folks at DHS ICS-CERT published two advisories for different systems that were based upon uncoordinated disclosures reported earlier by ICS-CERT. Actually ICS-CERT only notes that one is based upon an earlier alert, but records show that both were. The affected systems are from RuggecCom and Carlo Gavazzi Automation...." --------------------------------------------- http://chemical-facility-security-news.blogspot.nl/2012/12/ics-cert-closes-… *** RealPlayer RealMedia File Handling Buffer Overflow *** --------------------------------------------- Topic: RealPlayer RealMedia File Handling Buffer Overflow Risk: High Text:## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/bi_N1sR5TgU/WLB-20… *** Joomla bch and Content Shell Upload *** --------------------------------------------- Topic: Joomla bch and Content Shell Upload Risk: High Text: [ Joomla com_content Shell Upload Vulnerability] [x] Author : Agd_Scorp [x] Home : www.turkguvenligi.info ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vUggqlfFDmw/WLB-20… *** Vuln: Real Networks RealPlayer Multiple Security Vulnerabilities *** --------------------------------------------- Real Networks RealPlayer Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56956 Next End-of-Shift report on 2013-01-02

1 0

Tageszusammenfassung - Donnerstag 27-12-2012
by Daily end-of-shift report 27 Dec '12

27 Dec '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-12-2012 18:00 − Donnerstag 27-12-2012 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Vuln: Honeywell HMIWeb Browser ActiveX Control Remote Buffer Overflow Vulnerability *** --------------------------------------------- Honeywell HMIWeb Browser ActiveX Control Remote Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/55465 *** Java 7 update offers more security options *** --------------------------------------------- "A recent Java 7 update (Update 10) has added more security options that will appeal to security conscious users and businesses. A new option under the Java control panel, for example, allows users to disable Java applications from running inside their browsers by clearing the "enable Java content in the browser" checkbox. The plethora of security attacks that exploit flaws in the Java platform means that disallowing Java from browsers has long been recommended by security... --------------------------------------------- http://www.fiercecio.com/techwatch/story/java-7-update-offers-more-security… *** India Developing Its Own Secure Operating System *** --------------------------------------------- "According to The Times of India, 150 engineers from all across the country have already been working on the project for over one year and a half, but it will take another three before the operating systems can be rolled out. The director general of the DRDO has explained that India needs its own operating system to strengthen cyber security. He has emphasized that the current operating systems used in India, regardless whether theyre Windows or Linux-based, contain numerous security... --------------------------------------------- http://news.softpedia.com/news/India-Developing-Its-Own-Secure-Operating-Sy… *** Vuln: WordPress Multiple CMSMasters Themes upload.php Arbitrary File Upload Vulnerability *** --------------------------------------------- WordPress Multiple CMSMasters Themes upload.php Arbitrary File Upload Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56988 *** Hook Analyser Malware Tool 2.2 *** --------------------------------------------- "Hook Analyser is a hook tool which can be potentially helpful in reversing applications and analysing malware. It can hook to an API in a process and search for a pattern in memory or dump the buffer. Changes: The UI and modules of the project have been re-written...." --------------------------------------------- http://packetstormsecurity.org/files/119087 *** PHP-CGI Argument Injection Remote Code Execution *** --------------------------------------------- Topic: PHP-CGI Argument Injection Remote Code Execution Risk: High Text:#!/usr/bin/python import requests import sys print """ CVE-2012-1823 PHP-CGI Arguement Injection Remote Code Execution T... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/HMIGwX9uCpo/WLB-20… *** [remote] - IBM Lotus Notes Client URL Handler Command Injection *** --------------------------------------------- IBM Lotus Notes Client URL Handler Command Injection --------------------------------------------- http://www.exploit-db.com/exploits/23650 *** [remote] - Microsoft SQL Server Database Link Crawling Command Execution *** --------------------------------------------- Microsoft SQL Server Database Link Crawling Command Execution --------------------------------------------- http://www.exploit-db.com/exploits/23649 *** NVidia Display Driver Service (nvvsvc.exe) Exploit *** --------------------------------------------- Topic: NVidia Display Driver Service (nvvsvc.exe) Exploit Risk: High Text:/* NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE = (@... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/RWnidJO9giU/WLB-20…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily