Daily

daily@lists.cert.at

1 participants
3209 discussions

Tageszusammenfassung - Freitag 9-11-2012
by Daily end-of-shift report 09 Nov '12

09 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-11-2012 18:00 − Freitag 09-11-2012 18:00 Handler: Stephan Richter Co-Handler: Matthias Fraidl *** PixSteal-A Trojan Steals Images, Uploads to Iraqi FTP Server *** --------------------------------------------- "A new Trojan has been identified that has the capability of stealing images from infected computers, setting the stage for anything from identity theft to blackmail. PixSteal-A also pilfers . dmp, or Windows memory dump files that contain data on system crashes and sends all stolen data to a remote FTP server in Iraq, according to Sophos. This isnt the first malware to target non text-based files...." --------------------------------------------- http://threatpost.com/en_us/blogs/pixsteal-trojan-steals-images-uploads-ira… *** Microsoft Security Bulletin Advance Notification for November 2012 *** --------------------------------------------- "This is an advance notification of security bulletins that Microsoft is intending to release on November 13, 2012. This bulletin advance notification will be replaced with the November bulletin summary on November 13, 2012. For more information about the bulletin advance notification service, see Microsoft Security Bulletin Advance Notification...." --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms12-nov *** QRishing Study: Curiosity Is the Largest Motivating Factor for Scanning QR Codes *** --------------------------------------------- "Researchers from the Carnegie Mellon Universitys CyLab have released the results of a study QRishing: The Susceptibility of Smartphone Users to QR Code Phishing Attacks which focuses on phishing attacks that rely on QR (Quick Response) codes. QRishing is a term utilized for phishing attacks initiated via the scanning of QR codes. Such attacks are not new, but in the past period researchers have started examining them because theyre becoming more and more common...." --------------------------------------------- http://news.softpedia.com/news/QRishing-Study-Curiosity-is-the-Largest-Moti… *** Windows 8, Surface slabs ALREADY need critical security patch *** --------------------------------------------- Mega vulns affect ALL Windows kit from XP onward Microsoft will release critical updates for Windows 8 and other software on Novembers Patch Tuesday next week. The upgrades will arrive within weeks of the Win 8 launch at the end of last month. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/09/nov_patch_t… *** IT-Business - Cisco warnt: "Cyberkriminelle nur einen Mausklick entfernt" *** --------------------------------------------- Internetumfrage ortet große Mängel in Österreichs Unternehmen --------------------------------------------- http://derstandard.at/1350260880632/Cisco-warnt-Cyberkriminelle-nur-einen-M… *** Siemens software targeted by Stuxnet still full of holes *** --------------------------------------------- Software made by Siemens and targeted by the Stuxnet malware is still full of other dangerous vulnerabilities, according to Russian researchers whose presentation at the Defcon security conference earlier this year was cancelled following a request from the company. --------------------------------------------- https://www.computerworld.com/s/article/9233378/Siemens_software_targeted_b… *** Kreditkarte mit Display und Tastatur *** --------------------------------------------- Mastercard hat eine neue Kreditkarte vorgestellt, die mit einem monochromen LCD-Display und numerischen Tasten ausgestattet ist. Sie bietet laut dem Unternehmen neben den normalen Funktionen einer Kreditkarte auch die Möglichkeit, Einmal-Passworte zur Authentifizierung zu generieren. --------------------------------------------- http://www.heise.de/security/meldung/Kreditkarte-mit-Display-und-Tastatur-1… *** Facebook Chat Can Be Used to Launch DOS Attacks, Expert Finds *** --------------------------------------------- Security researcher Chris C. Russo claims to have discovered a way to use Facebook's chat module to launch denial-of-service (DOS) attack against any user, even if they're not friends with the attacker. --------------------------------------------- http://news.softpedia.com/news/Facebook-Chat-Can-Be-Used-to-Launch-DOS-Atta…

1 0

Tageszusammenfassung - Donnerstag 8-11-2012
by Daily end-of-shift report 08 Nov '12

08 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 07-11-2012 18:00 − Donnerstag 08-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** New Backdoor DDoS Malware Co-Existing on Gh0stRAT-Infected Machines *** --------------------------------------------- "Gh0st RAT has a new roommate. A new backdoor called ADDNEW has been discovered on machines infected with the Gh0st remote access Trojan, adding new distributed denial of service attack capabilities, as well as a feature that targets passwords and credentials stored on the Firefox browser. Gh0st RAT is a notorious piece of malware having been used in the Aurora attacks on Google, Adobe and other large manufacturers and technology companies...." --------------------------------------------- http://threatpost.com/en_us/blogs/new-backdoor-ddos-malware-co-existing-gh0… *** Experts Warn of Zero-Day Exploit for Adobe Reader *** --------------------------------------------- Software vendor Adobe says it is investigating claims that instructions for exploiting a previously unknown critical security hole in the latest versions of its widely-used PDF Reader software are being sold in the cybercriminal underground.The finding comes from malware analysts at Moscow-based forensics firm Group-IB, who say theyve discovered that a new exploit capable of compromising the security of computers running Adobe X and XI (Adobe Reader 10 and 11) is being sold in the underground --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Kr8ZV2vC2Fc/ *** Malware Forum Logs from Control Systems, Part Deux *** --------------------------------------------- "Last September, I did a guest blog post titled Online-Malware-Support-Shows-Infected-ICS-Computers, where I searched for HiJackThis posts containing automation software. Basically, there are forums available to users that had been infected with viruses. These users can run a set of programs, including HijackThis, DDS, OTS, and others, to pull information from the system...." --------------------------------------------- http://www.digitalbond.com/2012/11/07/malware-forum-logs-from-control-syste… *** Innenministerium plant IT-Sicherheitsgesetz *** --------------------------------------------- Die IT-Beauftragte der Bundesregierung, Cornelia Rogall-Grothe, hat eine neue Security-Initiative umrissen. Mit einem IT-Sicherheitsgesetz sollten einschlägige Mindeststandards für Betreiber kritischer Infrastrukturen etwa in den Bereichen Energie, Informations- und Kommunikationstechnologien oder der Wasserversorgung verankert werden, erklärte die Staatssekretärin auf einem Symposium in Washington. Sie würden mit dem Vorhaben zudem dazu verpflichtet, "erhebliche IT-Sicherheitsvorfälle" zu melden. --------------------------------------------- http://www.heise.de/security/meldung/Innenministerium-plant-IT-Sicherheitsg… *** Apple patcht Quicktime für Windows *** --------------------------------------------- Apple hat die Windows-Ausgabe seines Multimedia-Abspielsystems Quicktime auf Version 7.7.3 aktualisiert. Die neue Ausgabe behebt zahlreiche kritische Sicherheitslücken. --------------------------------------------- http://www.heise.de/security/meldung/Apple-patcht-Quicktime-fuer-Windows-17… *** [TYPO3-announce] Announcing TYPO3 CMS 4.5.21, 4.6.14 and 4.7.6 *** --------------------------------------------- the TYPO3 Community has just released TYPO3 CMS versions 4.5.21, 4.6.14 and 4.7.6 which are now ready for you to download. All versions are maintenance releases and contain bug fixes and security fixes. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… *** E-Mail-Sicherheit: Hilfe gegen DKIM-Schwäche *** --------------------------------------------- Lange und wechselnde Schlüssel mit Verfallsdatum sowie der nötige Nachdruck beim E-Mail-Provider helfen laut der Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) gegen die kürzlich bekannt gewordene Lücke bei DKIM, der Authentizitäts-Sicherung von E-Mail-Absendern. --------------------------------------------- http://www.heise.de/security/meldung/E-Mail-Sicherheit-Hilfe-gegen-DKIM-Sch… *** Sicherheitslücke im TOR-Client *** --------------------------------------------- Wie Code-Experte Andrey Karpov bei einer Analyse des TOR-Quellcodes herausfand, verwendet die Anonymisierungssoftware eine Funktion namens memset() zum Löschen von Cache-Daten, welche nicht von allen Compilern unterstützt wird. Das kann unter Umständen dazu führen, dass der TOR-Client vertrauliche Daten wie etwa Passwörter im Speicher zurück lässt, wenn er beendet wird. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-im-TOR-Client-174652…

1 0

Tageszusammenfassung - Mittwoch 7-11-2012
by Daily end-of-shift report 07 Nov '12

07 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 06-11-2012 18:00 − Mittwoch 07-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Nachfolger für RFC-Ignorant.Org in Sicht *** --------------------------------------------- Der Datenbestand der im Oktober außer Betrieb gegangenen Anti-Spam-Blacklist RFC-Ignorant.Org wird unter RFC-Ignorant.de bei einem neuen Hoster weitergepflegt. --------------------------------------------- http://www.heise.de/security/meldung/Nachfolger-fuer-RFC-Ignorant-Org-in-Si… *** Epic FAIL: Anonymous didnt hack PayPal, managed to frighten Oz hippies *** --------------------------------------------- #OpNov5 pyrotechnics disappear in puff of smoke The smoke has cleared from Anonymouss Bonfire Night hacking spree with a denial from PayPal that it had been hacked. The payments-processing firm appeared to have been highest profile target of the hacking spree, but apparently this was an error caused by the tweeting and retweeting of an erroneous post by a cyber security blogger. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2012/11/06/anon_opnov5… *** Adobe Ships Election Day Security Update for Flash *** --------------------------------------------- Adobe has released a critical security update for its Flash Player and Adobe AIR software that fixes at least seven dangerous vulnerabilities in these products. Updates are available for Windows, Mac, Linux and Android systems. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/czXcgBruHcM/ *** Volunteering falls short on threat information sharing *** --------------------------------------------- "Critical infrastructure security apparently has its own version of Dont Ask, Dont Tell, despite calls in the public and private sector for better information sharing. And this one goes both ways. The private sector is not telling the government about its vulnerabilities, and government is also keeping threat and vulnerability information from the private sector...." --------------------------------------------- http://www.csoonline.com/article/720881/volunteering-falls-short-on-threat-… *** [remote] - EMC Networker Format String *** --------------------------------------------- EMC Networker Format String --------------------------------------------- http://www.exploit-db.com/exploits/22525 *** Cisco Security Advisory: Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability *** --------------------------------------------- Cisco Secure Access Control System TACACS+ Authentication Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Security Advisory: Cisco Nexus 1000V Series Switch Software Release 4.2(1)SV1(5.2) Virtual Security Gateway Bypass Issue *** --------------------------------------------- Cisco Nexus 1000V Series Switch Software Release 4.2(1)SV1(5.2) Virtual Security Gateway Bypass Issue http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-… ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 6-11-2012
by Daily end-of-shift report 06 Nov '12

06 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 05-11-2012 18:00 − Dienstag 06-11-2012 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Vuln: Oracle MySQL Server CVE-2012-3163 Remote MySQL Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3163 Remote MySQL Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56036 *** Vuln: Oracle MySQL Server CVE-2012-3173 Remote MySQL Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3173 Remote MySQL Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56041 *** Vuln: Oracle MySQL Server CVE-2012-3158 Remote Security Vulnerability *** --------------------------------------------- Oracle MySQL Server CVE-2012-3158 Remote Security Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56017 *** European Smart Grid Cyber and SCADA Security *** --------------------------------------------- "Event Name : European Smart Grid Cyber and SCADA SecurityEvent Date : March 11-12, 2013Location : London, United KingdomWebsite : www. smi-online. co. uk/2013cybergrids2...." --------------------------------------------- http://www.ecoseed.org/more/events/15779-european-smart-grid-cyber-and-scad… *** [dos] - Adobe Reader 11.0.0 Stack Overflow Crash PoC *** --------------------------------------------- Adobe Reader 11.0.0 Stack Overflow Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22464 *** Possible Fake-AV Ads from Doubleclick Servers, (Mon, Nov 5th) *** --------------------------------------------- Reader James ran into a Fake AV ad delivered by Double click. It is not clear if this is the result of a compromise of double click, or a paid ad that slipped through doubleclicks content review process. James started out at a local new paper web site, that like many others features ads served by double click. Luckily, James used a proxy tool (Fiddler) to record the session. Here are some of the excerpts (slightly anonymized and spaces inserted to avoid accidental clicks): GET [...] --------------------------------------------- http://isc.sans.edu/diary.html?storyid=14455&rss *** Vuln: Multiple Symantec Products CAB Files Handling Memory Corruption Vulnerability *** --------------------------------------------- Multiple Symantec Products CAB Files Handling Memory Corruption Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/56399 *** Apache Tomcat 6.x / 7.x Denial Of Service *** --------------------------------------------- Topic: Apache Tomcat 6.x / 7.x Denial Of Service Risk: Medium Text:CVE-2012-2733 Apache Tomcat Denial of Service Severity: Important Vendor: The Apache Software Foundation Versions Affe... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/zhdqQvlbO2c/WLB-20… *** Apache Tomcat 5.x / 6.x / 7.x DIGEST Authentication Weaknesses *** --------------------------------------------- Topic: Apache Tomcat 5.x / 6.x / 7.x DIGEST Authentication Weaknesses Risk: Medium Text:CVE-2012-3439 Apache Tomcat DIGEST authentication weaknesses Severity: Moderate Vendor: The Apache Software Foundation ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Suq__thlFNM/WLB-20… *** Java - Sicherheitsexperte schließt Java-Lücke auf eigene Faust *** --------------------------------------------- Oracle vertröstet auf Patchday im Februar --------------------------------------------- http://text.derstandard.at/1350259245198/Sicherheitsexperte-schliesst-Java-… *** Bugtraq: multiple critical vulnerabilities in sophos products *** --------------------------------------------- multiple critical vulnerabilities in sophos products --------------------------------------------- http://www.securityfocus.com/archive/1/524641 *** Bugtraq: Wisecracker 1.0 - A high performance distributed cryptanalysis framework *** --------------------------------------------- Wisecracker 1.0 - A high performance distributed cryptanalysis framework --------------------------------------------- http://www.securityfocus.com/archive/1/524640 *** [dos] - Internet Explorer 9 Memory Corruption Crash PoC *** --------------------------------------------- Internet Explorer 9 Memory Corruption Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22401 *** Bugtraq: [security bulletin] HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure *** --------------------------------------------- [security bulletin] HPSBHF02699 SSRT100592 rev.2 - HP ProLiant SL Advanced Power Manager (SL-APM), Remote User Validation Failure... --------------------------------------------- http://www.securityfocus.com/archive/1/524644

1 0

Tageszusammenfassung - Montag 5-11-2012
by Daily end-of-shift report 05 Nov '12

05 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Freitag 02-11-2012 18:00 − Montag 05-11-2012 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** Studie: Informationen trotz SSL-Verschlüsselung nicht sicher *** --------------------------------------------- Mit einer seit Jahren bekannten Angriffstechnik kann man die SSL-Verschlüsselung im Browser austricksen. Wie eine Untersuchung zeigt, setzt kaum jemand den ebenfalls bekannten Schutzmechanismus ein. Auch unterstützen diesen nicht alle aktuellen Browser. --------------------------------------------- http://www.heise.de/security/meldung/Studie-Informationen-trotz-SSL-Verschl… *** VUPEN Researchers Say They Have Zero-Day Windows 8 Exploit *** --------------------------------------------- "Controversial bug hunters and exploit sellers VUPEN claimed to have cracked the low-level security enhancements featured in Windows 8, Microsofts latest operating system. VUPEN CEO and head of research Chaouki Bekrar sent out a pair of ominous Tweets yesterday claiming to have developed the first zero-day exploit for Windows 8 and Internet Explorer 10, both released Oct. 26. Bekrar hints the exploit is a sandbox bypass for IE10 with ASLR, DEP and anti-ROP mitigations enabled...." --------------------------------------------- http://threatpost.com/en_us/blogs/vupen-researchers-say-they-have-zero-day-… *** Deep Inside a DNS Amplification DDoS Attack *** --------------------------------------------- "A few weeks ago I wrote about DNS Amplification Attacks. These attacks are some of the largest, as measured by the number of Gigabits per second (Gbps), that we see directed toward our network. For the last three weeks, one persistent attacker has been sending at least 20Gbps twenty-four hours a day as an attack against one of our customers...." --------------------------------------------- http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack *** How Georgia doxed a Russian hacker (and why it matters) *** --------------------------------------------- "On October 24, the country of Georgia took an unusual step: it posted to the Web a 27-page writeup (PDF), in English, on how it has been under assault from a hacker allegedly based in Russia. The paper included details of the malware used, how it spread, and how it was controlled. Even more unusually, the Georgians released pictures of the alleged hackertaken with his own webcam after the Georgians hacked the hacker with the help of the FBI and others...." --------------------------------------------- http://arstechnica.com/tech-policy/2012/11/how-georgia-doxed-a-russian-hack… *** Firefox gets strict about enforcement of HTTPS protection *** --------------------------------------------- "Developers of Mozillas Firefox browser are experimenting with a new security feature that connects to a specified set of websites only when presented with a cryptographic certificate validating the connection is secure. A beta version of the open-source browser contains a list of sites known to deploy the HTTP Strict Transport Security mechanism that requires a browser to use the secure sockets layer or transport layer security protocols when communicating. HSTS is designed to provide an... --------------------------------------------- http://arstechnica.com/security/2012/11/firefox-gets-strict-about-enforceme… *** Android Modding for the Security Practitioner *** --------------------------------------------- "After getting involved in the Android rooting scene, I observed that there is a disconnect between the community interested in "modding" (modifying) their devices and those looking at Android from a security practitioners perspective. In this talk, I will provide technical details on many key concepts in the modding world, including rooting, locked/unlocked bootloaders, S-ON/S-OFF, fastboot, ROM flashing, and various other techniques. Well look at real examples of... --------------------------------------------- http://www.securitytube.net/video/6080 *** Anonymous ransomware - but who is hiding behind this malwares mask? *** --------------------------------------------- "Heres an interesting twist of the Reveton/FBI/police ransomware that has been plaguing internet users lately. In this example, the malware that locks you out of your data, and demands 100 be paid via Ukash to gain access back to your files, claims to be from the Anonymous hacktivist group. Of course, just as when ransomware victims see demands from cash on their computer seemingly coming from the police, they should be equally dubious about whether this particular attack originated from... --------------------------------------------- http://nakedsecurity.sophos.com/2012/11/02/anonymous-ransomware/ *** Shopping The Russian Cybercrime Underground *** --------------------------------------------- "If you werent already convinced that the Russian cybercrime underground is now a vast, sophisticated, high-volume market, consider this: there are at least 20 different types of services offered in Russian-speaking forums for just about anyone who wants to make a buck off of cybercrime, everything from crime-friendly VPN and security software-checking services to plain old off-the-shelf exploits, according to a new report...." --------------------------------------------- http://www.darkreading.com/threat-intelligence/167901121/security/vulnerabi… *** In Pictures: 20 notorious worms, viruses and botnets *** --------------------------------------------- "The earliest worms and viruses were created for geeky fun and did little harm - oh, how times have changed. Here are 20 worms, viruses and botnets that show the evolution of malware, from Creeper to Flame. CreeperThe first real computer virus, Creeper was released "in lab" in 1971 by an employee of a company working on building ARPANET, the Internets ancestor, according to Guillaume Lovet, Senior Director, FortiGuard Labs...." --------------------------------------------- http://www.computerworld.com.au/slideshow/440948/pictures_20_notorious_worm… *** Searching for Silver Bullets In SCADA and ICS Environments *** --------------------------------------------- "With Halloween past us, theres an excess of sugar in our blood, and remnant imaginings of monsters under the bed. So perhaps thats why when the topic of silver bullet security recently came up, my mind immediately went to Werewolves. The term was used, as it often is, in a discussion about Application Whitelistingthe industrial automation industrys rightful poster child for endpoint security...." --------------------------------------------- http://www.securityweek.com/searching-silver-bullets-scada-and-ics-environm… *** Vuln: Ubercart SecureTrading Payment Method Drupal Module Security Bypass Vulnerability *** --------------------------------------------- Ubercart SecureTrading Payment Method Drupal Module Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/54395 *** ZPanel <= 10.0.1 CSRF, XSS, SQLi, Password Reset *** --------------------------------------------- Topic: ZPanel --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/cET4kw8gtsc/WLB-20… *** Anonymous am Werk? Symantec, ImageShack, Paypal und VMWare gehackt *** --------------------------------------------- Eine Hackergruppe will zum zweiten Mal den Bilder-Upload-Dienst ImageShack gehackt haben und auch das Sicherheits-Unternehmen Symantec soll ihnen zum Opfer gefallen sein. Der Schaden bei ImageShack soll sich auf die Preisgabe aller vorhandenen, auch als privat eingestuften, Bilder belaufen. Von Symantec sollen nun unter anderem alle Mitarbeiter-E-Mailadressen öffentlich sein. Außerdem haben die Hacker eine Lücke für die OpenSource-Software ZPanel veröffentlicht. Obendrein stellt Anonymous den Kernel von... --------------------------------------------- http://www.heise.de/security/meldung/Anonymous-am-Werk-Symantec-ImageShack-… *** Bugtraq: Vulnerable MSVC++ 2008 runtime libraries distributed with and installed by eM client *** --------------------------------------------- Vulnerable MSVC++ 2008 runtime libraries distributed with and installed by eM client --------------------------------------------- http://www.securityfocus.com/archive/1/524621 *** New Blackhole Targets Mobile Banking Services *** --------------------------------------------- "According to a report published by antivirus software developer AVG, there is a significant growth in malicious software and malicious ads with hidden malware behind images posed on social media. The report revealed details about the newly released 2. 0 version of Blackhole Exploit Toolkit that targets mobile banking services...." --------------------------------------------- http://www.technologybanker.com/security-risk-management/new-blackhole-targ…

1 0

Tageszusammenfassung - Freitag 2-11-2012
by Daily end-of-shift report 02 Nov '12

02 Nov '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 31-10-2012 18:10 − Freitag 02-11-2012 18:10 Handler: Robert Waldner Co-Handler: Otmar Lendl *** Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities *** --------------------------------------------- Topic: Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities Risk: Low Text:Advisory: Joomla 2.5.6 Multiple Cross-site scripting vulnerabilities Advisory ID: SSCHADV2012-014 Author: Stefan Schurtz ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/kE0J4Z10zwA/WLB-20… *** [webapps] - Wordpress bbpress Plugin Multiple Vulnerabilities *** --------------------------------------------- Wordpress bbpress Plugin Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/22396 *** How to Fight New Gozi Banking Trojan - Crimeware Exploits Basic Authentication Used in U.S. *** --------------------------------------------- "Fighting the new Trojan aimed at U.S. banks will require multiple measures, says RSA researcher Mor Ahuvia. Gozi Prinimalka is different, and institutions have to be mindful of its characteristics. Ahuvia, a cybercrime communications specialist for RSA FraudAction, says a new Trojan identified by RSA in early October will pose one of the greatest fraud threats U.S. banking institutions have ever seen...." --------------------------------------------- http://www.bankinfosecurity.com/how-to-fight-new-gozi-banking-trojan-a-5256… *** Bugtraq: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Web Conferencing *** --------------------------------------------- Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified MeetingPlace Web Conferencing --------------------------------------------- http://www.securityfocus.com/archive/1/524565 *** New Hacker Weapon Surfaces *** --------------------------------------------- "A High Orbit Ion Cannon (HOIC) could just broaden the possibilities for attackers of all skill sets. The High Orbit Ion Cannon is a dangerous free-to-download, open-source program that can turn any user of any skill level into a powerful hacker, at least in terms of one form of attack, a distributed denial-of-service (DDoS). It is extremely easy to use...." --------------------------------------------- http://www.isssource.com/new-hacker-weapon-surfaces/ *** Costs of tools and activities in the Russian cybercriminal underground *** --------------------------------------------- "A new Trend Micro research paper describes a broad offering of tools and activities that can be bought and sold on underground forum shopping sites. It examines the prices charged for various types of services, while also providing examples of information shared among cybercriminals. In examining two dozen basic and fundamental tools and technologies that cybercriminals create and use to enhance their business, researchers also assess the top-ten ranked malicious activities and --------------------------------------------- http://www.net-security.org/secworld.php?id=13884 *** One year after DigiNotar breach, Fox-IT details extent of compromise *** --------------------------------------------- "The 2011 security breach at Dutch certificate authority (CA) DigiNotar resulted in an extensive compromise and was facilitated in part by shortcomings in the companys network segmentation and firewall configuration, according to Fox-IT, the security company contracted by the Dutch government to investigate the incident."The DigiNotar network was divided into 24 different internal network segments," Fox-IT said in its final investigation report, published earlier this week by the --------------------------------------------- http://www.computerworld.com/s/article/9233138/One_year_after_DigiNotar_bre… *** Joe Weiss 2012 ICS Security Conference Highlights *** --------------------------------------------- "The twelfth ICS Security has come and gone, and it sounds from the tone of Joes write-up that whatever progress theres been to date in awareness and/or improved capabilities has been frustratingly slow and incremental. After twelve years, I guess we can call that a trend. Nevertheless, the best parts often seem to involve drama related to actual events in the field...." --------------------------------------------- http://smartgridsecurity.blogspot.nl/2012/11/joe-weiss-2012-ics-security-co… *** Windows 8 exploit combining several 0-days already up for sale *** --------------------------------------------- "Less that a week after Microsoft released is long awaited Windows 8, with new and improved security features, French bug hunters VUPEN Security have announced that they have created an exploit for the new OS version that takes advantage of several zero-day flaws:In the light of this discovery, the tweet that VUPEN CEO and head researcher Chaouki Bekrar posted upon the OSs release seems almost to mock Microsofts efforts. The company, which has become well known in security circles --------------------------------------------- http://www.net-security.org/secworld.php?id=13890

1 0

Tageszusammenfassung - Mittwoch 31-10-2012
by Daily end-of-shift report 31 Oct '12

31 Oct '12

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-10-2012 18:00 − Mittwoch 31-10-2012 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Citrix XenServer 6.0.2 Privilege Escalation *** --------------------------------------------- Topic: Citrix XenServer 6.0.2 Privilege Escalation Risk: Medium Text: ADVISORY = Systems Affected: Citrix XenServer 5.0 through 6.0.2 Severity: High Ca... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/wk0udMQ2Uz4/WLB-20… *** THOMAS: Cyber security for the home *** --------------------------------------------- "When we think about cyber security we usually think about big businesses or government agencies, but securing your computers and information is important in your home, too. Hackers and thieves have a number of reasons to break into your computer, but the most common are to steal the information stored there and to use the resources of your computer to do their bidding. One of the things a hacker wants from your computer is information...." --------------------------------------------- http://www.nctimes.com/news/local/columnists/thomas/thomas-cyber-security-f… *** Trojaner-Schnäppchen mit Windows-8-Unterstützung *** --------------------------------------------- Während einige Antivirenhersteller mit Microsofts neuestem Betriebssystem noch Probleme haben, ist die Cybercrime-Community schon voll auf den Windows-8-Zug aufgesprungen. So wird etwa auf einer bei Google gehosteten Site für 40 Euro ein bereits Windows-8-kompatibles "Remote Administration Tool" namens Xtreme RAT angeboten kostenlose Updates inklusive. --------------------------------------------- http://www.heise.de/security/meldung/Trojaner-Schnaeppchen-mit-Windows-8-Un… *** VM-aware viruses on the rise *** --------------------------------------------- "Viruses targeting virtual machines (VM) are growing in numbers and will soon be the dominant force in the world of cyber crime. Speaking at this weeks SNW Europe conference in Frankfurt, Joe Llewelyn, head of global sales training at Kaspersky Lab, warned of the increase and the trouble they could cause. A lot of the viruses we are now seeing are virtual machine aware, meaning they will work out if they are running on a VM, he said...." --------------------------------------------- http://www.computerweekly.com/news/2240169662/VM-aware-viruses-on-the-rise?… *** Linux: Patch für den Ext4-Bug *** --------------------------------------------- Die Ursache des vor einer Woche aufgefallenen Bugs im Linux-Dateisystem Ext4 ist gefunden. Ext4-Chefentwickler Ted Ts'o hat einen wenige Zeilen langen Patch geschrieben und zur Aufnahme in den Kernel 3.7 bereitgestellt. --------------------------------------------- http://www.heise.de/open/meldung/Patch-fuer-den-Ext4-Bug-1740840.html/from/… *** Kritische Lücken in Plone und Zope *** --------------------------------------------- Die Plone Foundation warnt vor kritischen Sicherheitslücken in ihrem Open-Source-CMS Plone. Auch das Python-basierten Web-Framework Zope ist verwundbar. Betroffen sind jeweils alle Versionen einschließlich der aktuellen. Durch die Schwachstellen kann ein Angreifer schlimmstenfalls die Kontrolle über den Server übernehmen. --------------------------------------------- http://www.heise.de/security/meldung/Kritische-Luecken-in-Plone-und-Zope-17… *** Sicherheitslücke in Yahoos JavaScript-Framework YUI 2 *** --------------------------------------------- In einem Blog-Beitrag weist //www.yahoo.com:Yahoo auf eine Sicherheitslücke in seiner freien JavaScript-Bibliothek YUI 2 hin. Eine nähere Beschreibung des Bugs gibt es nicht, er betrifft zudem nur Anwender, die den Quellcode des Frameworks selbst bereitstellen: In der von Yahoos Content Delivery Network ausgelieferten Version ist er beseitigt. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsluecke-in-Yahoos-JavaScript…

1 0

Tageszusammenfassung - Dienstag 30-10-2012
by Daily end-of-shift report 30 Oct '12

30 Oct '12

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-10-2012 18:00 − Dienstag 30-10-2012 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** ICS-CERT warnt vor Angriffen auf industrielle Steuerungssysteme *** --------------------------------------------- Die Attacken auf industrielle Steuerungssysteme nehmen zu. Das Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) hat dazu eine Warnung herausgegeben, die vom Bundesamt für Sicherheit und Informationstechnik (BSI) unterstützt wird. Spezielle Tools und Suchmaschinen erleichtern auch unerfahrenen Angreifern die Attacken auf Maschinen und Geräte, die Relevanz für die Infrastruktur, wie etwa die Stromnetze, haben. --------------------------------------------- http://www.heise.de/security/meldung/ICS-CERT-warnt-vor-Angriffen-auf-indus… *** Legacy Applications a Threat to Windows 8 Security *** --------------------------------------------- "The security features of Windows 8 are among the more highly touted aspects of the new operating system. However, theyre not worth much if users can bypass them, and thats exactly what Bitdefenders Alex Balan said could happen to users who hang on to pre-Windows 8 applications. Since they run outside the secure interface, theyre more vulnerable...." --------------------------------------------- http://www.technewsworld.com/story/76499.html *** Critical error in CoDeSys runtime of SCADA systems *** --------------------------------------------- "Ron Wightman discovered vulnerability in the CoDeSys runtime during Project Basecamp, where industrial security guards come together. The problem is that according Wightman attackers by security hole in CoDeSys control PLCs can get into the industrial systems and critical infrastructures which it is mounted. An attacker must already have access to the network...." --------------------------------------------- http://www.automatiseringgids.nl/nieuws/2012/44/kritieke-fout-in-codesys-ru… *** Falsche Fährten für Schnüffel-Apps *** --------------------------------------------- Eine modifizierte Version des Android-Betriebssystems füttert Apps, die Daten auslesen, mit extra fehlerhaften Informationen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Falsche-Faehrten-fuer-Schnueffel-App… *** Bugtraq: [security bulletin] HPSBUX02825 SSRT100974 rev.1 - HP-UX Running Java, Remote Indirect Vulnerabilities *** --------------------------------------------- [security bulletin] HPSBUX02825 SSRT100974 rev.1 - HP-UX Running Java, Remote Indirect Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/524541

1 0

Tageszusammenfassung - Montag 29-10-2012
by Daily end-of-shift report 29 Oct '12

29 Oct '12

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-10-2012 18:00 − Montag 29-10-2012 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Realplayer Watchfolders long Filepath Overflow *** --------------------------------------------- Topic: Realplayer Watchfolders long Filepath Overflow Risk: High Text:Realplayer Watchfolders Long Filepath Overflow by Joseph Sheridan Summary Realplayer version 15.0.5.109 is vulnerable to ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/dOv6-0tUVh8/WLB-20… *** Detecting Advanced Persistent Threat with Network Traffic Analysis *** --------------------------------------------- "A high degree of stealthiness over a prolonged duration of operation in order to do a successful cyber attack can be defined as Advanced Persistent Threat. The attack objectives therefore typically extend beyond immediate financial gain, and compromised systems continue to be of service even after key systems have been breached and initial goals reached. Todays successful targeted attacks use a combination of social engineering, malware, and backdoor activities...." --------------------------------------------- http://thehackernews.com/2012/10/detecting-advanced-persistent-threat.html#… *** [dos] - Microsoft Office Publisher 2010 Crash PoC *** --------------------------------------------- Microsoft Office Publisher 2010 Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22310 *** [dos] - Microsoft Windows Help program (WinHlp32.exe) Crash PoC *** --------------------------------------------- Microsoft Windows Help program (WinHlp32.exe) Crash PoC --------------------------------------------- http://www.exploit-db.com/exploits/22303 *** Another systematic SCADA vuln *** --------------------------------------------- "If its Monday, it must be time for a new SCADA vulnerability: this time, arising through the combination of a popular development environment and bad developer habits. Described in full by Digital Bond researcher Reid Wightman here, as many as 261 manufacturers and heaven-knows-how-many deployed systems may have created insecure systems using the software. The software in question is CoDeSys, from German company S3...." --------------------------------------------- http://www.theregister.co.uk/2012/10/28/codesys_vulnerability/ *** Vuln: Drupal Arbitrary PHP Code Execution and Information Disclosure Vulnerabilities *** --------------------------------------------- Drupal Arbitrary PHP Code Execution and Information Disclosure Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/56103 *** Schädling versteckt sich hinter der Maus *** --------------------------------------------- xhtml --------------------------------------------- http://www.heise.de/security/meldung/Schaedling-versteckt-sich-hinter-der-M… *** Bugtraq: [SECURITY] [DSA 2567-1] request-tracker3.8 security update *** --------------------------------------------- [SECURITY] [DSA 2567-1] request-tracker3.8 security update --------------------------------------------- http://www.securityfocus.com/archive/1/524528 *** Steuerungssysteme mit Hintertür *** --------------------------------------------- Die Programmiersoftware CoDeSys des deutschen Herstellers 3 S-Smart Software Solutions kann aus der Ferne ohne Authentifizierung manipuliert werden. Die Software wird für die digitale Steuerung von Maschinen und Anlagen von 261 Geräteherstellern genutzt. Damit verwenden "Tausende von Endanwendern aus dem Maschinen- und Anlagenbau und weiteren Industriezweigen CoDeSys", wie 3 S-Smart auf ihrer Internetseite angibt. Zu den Firmen, die CoDeSys nutzen, gehören unter anderem Unternehmen im Energie-, Militär- und Navigationsbereich. Entdeckt hat die Sicherheitslücke Reid Wightman, Sicherheits-Berater bei digital bond. --------------------------------------------- http://www.heise.de/security/meldung/Steuerungssysteme-mit-Hintertuer-17384…

1 0

Tageszusammenfassung - Donnerstag 25-10-2012
by Daily end-of-shift report 25 Oct '12

25 Oct '12

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-10-2012 18:00 − Donnerstag 25-10-2012 18:00 Handler: Robert Waldner Co-Handler: n/a *** Bugtraq: VUPEN Security Research - Oracle Java Font Processing Glyph Element Memory Corruption Vulnerability *** --------------------------------------------- VUPEN Security Research - Oracle Java Font Processing Glyph Element Memory Corruption Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/524507 *** Bugtraq: VUPEN Security Research - Oracle Java Font Processing "maxPointCount" Heap Overflow Vulnerability *** --------------------------------------------- VUPEN Security Research - Oracle Java Font Processing "maxPointCount" Heap Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/archive/1/524506 *** Bugtraq: [waraxe-2012-SA#094] - Multiple Vulnerabilities in Wordpress GRAND Flash Album Gallery Plugin *** --------------------------------------------- [waraxe-2012-SA#094] - Multiple Vulnerabilities in Wordpress GRAND Flash Album Gallery Plugin --------------------------------------------- http://www.securityfocus.com/archive/1/524509 *** Microsoft Office Word 2010 Stack Exhaustion *** --------------------------------------------- Topic: Microsoft Office Word 2010 Stack Exhaustion Risk: Low Text:Title : Microsoft Office Word 2010 Stack Overflow Version : Microsoft Office professional Plus 2010 Date : 2012... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/nm8w9gqy73w/WLB-20… *** National and International Cyber Security Exercises: Survey, Analysis & Recommendations *** --------------------------------------------- "Cyber exercises are an important tool to assess the preparedness of a community against cyber crises, technology failures and critical information infrastructure incidents. ENISA supports the stakeholders involved in EU cyber exercises. This report aims to support European and international bodies involved in cyber exercises with lessons learned about cyber exercises and recommendations for the future...." --------------------------------------------- http://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-coop… *** Researcher to demonstrate feature-rich malware that works as a browser extension *** --------------------------------------------- "Security researcher Zoltan Balazs has developed a remote-controlled piece of malware that functions as a browser extension and is capable of modifying Web pages, downloading and executing files, hijacking accounts, bypassing two-factor authentication security features enforced by some websites, and much more. Balazs, who works as an IT security consultant for professional services firm Deloitte in Hungary, created the proof-of-concept malware in order to raise awareness about the security --------------------------------------------- http://www.computerworld.com/s/article/9232848/Researcher_to_demonstrate_fe…

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily