Daily

daily@lists.cert.at

3157 discussions

Tageszusammenfassung - 04.11.2022
by Daily end-of-shift report 04 Nov '22

04 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 03-11-2022 18:00 − Freitag 04-11-2022 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ WLAN-Sicherheitslücke: Für Spezialdrohnen sind Wände wie Glas ∗∗∗ --------------------------------------------- Kanadische Forscher haben eine Funktion entdeckt, die es Angreifern ermöglicht, durch Wände zu sehen - trotz Passwortschutz. --------------------------------------------- https://www.golem.de/news/wlan-sicherheitsluecke-fuer-eine-spezialdrohne-si… ∗∗∗ A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain ∗∗∗ --------------------------------------------- Note: The three vulnerabilities discussed in this blog were all fixed in Samsung’s March 2021 release. They were fixed as CVE-2021-25337, CVE-2021-25369, CVE-2021-25370. To ensure your Samsung device is up-to-date under settings you can check that your device is running SMR Mar-2021 or later. As defenders, in-the-wild exploit samples give us important insight into what attackers are really doing. We get the “ground truth” data about the vulnerabilities and exploit techniques they’re using, which then informs our further research and guidance to security teams on what could have the biggest impact or return on investment. To do this, we need to know that the vulnerabilities and exploit samples were found in-the-wild. --------------------------------------------- https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-sa… ∗∗∗ What Is Cross-Origin Resource Sharing (CORS)? ∗∗∗ --------------------------------------------- Thanks to the rapid growth of JavaScript frameworks like Angular, React, and Vue, Cross-Origin Resource Sharing (CORS) has become a popular word in the developer’s vocabulary — and for good reason. It’s common practice for modern web applications to load resources from multiple domains. But accessing these website resources from different origins requires a thorough understanding of CORS. In this post, we’ll take a look at what CORS is and why proper implementation is an important component of building secure websites and applications. We’ll also examine some common examples of how to use CORS, dive into preflight requests, and discuss how to protect your website against attacks. --------------------------------------------- https://blog.sucuri.net/2022/11/what-is-cross-origin-resource-sharing-cors.… ∗∗∗ Multi-factor auth fatigue is real – and its why you may be in the headlines next ∗∗∗ --------------------------------------------- Overwhelmed by waves of push notifications, worn-down users inadvertently let the bad guys in Analysis The September cyberattack on ride-hailing service Uber began when a criminal bought the stolen credentials of a company contractor on the dark web. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2022/11/03/mfa_fatigue_… ∗∗∗ Inside the V1 Raccoon Stealer’s Den ∗∗∗ --------------------------------------------- Team Cymru’s S2 Research Team has blogged previously on the initial Raccoon stealer command and control methodology (Raccoon Stealer - An Insight into Victim “Gates”), which utilized “gate” IP addresses to proxy victim traffic / data to static threat actor-controlled infrastructure. Since the publication of our previous blog, the following timeline of events has occurred: [...] --------------------------------------------- https://www.team-cymru.com/post/inside-the-v1-raccoon-stealer-s-den ∗∗∗ Cisco-Sicherheitsupdates: Angreifer könnten durch Lücken in Netzwerke eindringen ∗∗∗ --------------------------------------------- Die Softwareentwickler von Cisco haben unter anderem in Identity Services Engine und Email Security Appliance Schwachstellen geschlossen. --------------------------------------------- https://heise.de/-7329978 ∗∗∗ UK-Cybersicherheitsbehörde startet landesweites Schwachstellen-Scanning ∗∗∗ --------------------------------------------- Die IT-Sicherheitsbehörde des Vereinigten Königreichs startet einen Schwachstellen-Scanner-Dienst. Der untersucht alle Systeme des Landes auf Sicherheitslücken. --------------------------------------------- https://heise.de/-7330532 ∗∗∗ Apple Rolls Out Xcode Update Patching Git Vulnerabilities ∗∗∗ --------------------------------------------- Apple this week announced a security update for the Xcode macOS development environment, to resolve three Git vulnerabilities, including one leading to arbitrary code execution. --------------------------------------------- https://www.securityweek.com/apple-rolls-out-xcode-update-patching-git-vuln… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-11-03 ∗∗∗ --------------------------------------------- IBM App Connect Enterprise Certified Container, IBM InfoSphere Information server, IBM Operations Analytics - Log Analysis, IBM Security Verify Governance, IBM WebSphere Application Server Liberty --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Patchday: Big-Data-Spezialist Splunk dichtet zwölf Schwachstellen ab ∗∗∗ --------------------------------------------- Der Big-Data-Experte Splunk aktualisiert die gleichnamige Software Splunk Enterprise und Cloud. Nach den Updates klaffen darin zwölf Schwachstellen weniger. --------------------------------------------- https://heise.de/-7329933 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pypy3), Fedora (drupal7, git, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and php), Oracle (kernel, lua, openssl, pcs, php-pear, pki-core, python3.9, and zlib), Red Hat (kernel, kernel-rt, kpatch-patch, lua, openssl-container, pcs, php-pear, pki-core, python3.9, and zlib), Scientific Linux (kernel, pcs, and php-pear), SUSE (EternalTerminal, hsqldb, ntfs-3g_ntfsprogs, privoxy, rubygem-actionview-4_2, sqlite3, and xorg-x11-server), and Ubuntu [...] --------------------------------------------- https://lwn.net/Articles/913771/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (clickhouse, distro-info-data, and ntfs-3g), Fedora (firefox), Oracle (kernel), Slackware (mozilla), and SUSE (python-Flask-Security-Too). --------------------------------------------- https://lwn.net/Articles/913849/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0010 ∗∗∗ --------------------------------------------- Several vulnerabilities were discovered in WebKitGTK and WPE WebKit. CVE-2022-32888 Versions affected: WebKitGTK and WPE WebKit before 2.38.0. Credit to P1umer (@p1umer). Impact: Processing maliciously crafted web content may lead toarbitrary code execution. --------------------------------------------- https://webkitgtk.org/security/WSA-2022-0010.html ∗∗∗ CVE Report Published for Spring Tools ∗∗∗ --------------------------------------------- We have released STS 4.16.1 for Eclipse and Spring VSCode extensions 1.40.0 to address the following CVE report: - CVE-2022-31691: Remote Code Execution via YAML editors in STS4 extensions for Eclipse and VSCode Please review the information in the CVE report and upgrade immediately. --------------------------------------------- https://spring.io/blog/2022/11/03/cve-report-published-for-spring-tools -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.11.2022
by Daily end-of-shift report 03 Nov '22

03 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 02-11-2022 18:00 − Donnerstag 03-11-2022 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Emotet botnet starts blasting malware again after 5 month break ∗∗∗ --------------------------------------------- The Emotet malware operation is again spamming malicious emails after almost a five-month "vacation" that saw little activity from the notorious cybercrime operation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/emotet-botnet-starts-blastin… ∗∗∗ Hundreds of U.S. news sites push malware in supply-chain attack ∗∗∗ --------------------------------------------- The compromised infrastructure of an undisclosed media company is being used by threat actors to deploy the SocGholish JavaScript malware framework (also known as FakeUpdates) on the websites of hundreds of newspapers across the U.S. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hundreds-of-us-news-sites-pu… ∗∗∗ Was tun, wenn ich Opfer von Cybercrime geworden bin? ∗∗∗ --------------------------------------------- Die Online-Identität kann schnell gestohlen werden, wenn jemand seine Daten auf unseriösen Websites eingibt. Dann kann es zu weiteren Konsequenzen kommen. --------------------------------------------- https://futurezone.at/digital-life/cybercrime-identitaetsdiebstahl-phishing… ∗∗∗ The OpenSSL security update story – how can you tell what needs fixing? ∗∗∗ --------------------------------------------- How to Hack! Finding OpenSSL library files and accurately identifying their version numbers... --------------------------------------------- https://nakedsecurity.sophos.com/2022/11/03/the-openssl-security-update-sto… ∗∗∗ P2P Botnets: Review - Status - Continuous Monitoring ∗∗∗ --------------------------------------------- P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets. --------------------------------------------- https://blog.netlab.360.com/p2p-botnets-review-status-continuous-monitoring/ ∗∗∗ Breakpoints in Burp, (Wed, Nov 2nd) ∗∗∗ --------------------------------------------- No, this is not a story about the Canadian Thanksgiving long weekend, it's about web application testing. I recently had a web application to assess, and I used Burp Suite Pro as part of that project. --------------------------------------------- https://isc.sans.edu/diary/rss/29214 ∗∗∗ Hackers Using Rogue Versions of KeePass and SolarWinds Software to Distribute RomCom RAT ∗∗∗ --------------------------------------------- The operators of RomCom RAT are continuing to evolve their campaigns with rogue versions of software such as SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro. --------------------------------------------- https://thehackernews.com/2022/11/hackers-using-rogue-versions-of-keepass.h… ∗∗∗ Researchers discover security loophole allowing attackers to use Wi-Fi to see through walls ∗∗∗ --------------------------------------------- The Wi-Peep exploits a loophole the researchers call polite Wi-Fi. Even if a network is password protected, smart devices will automatically respond to contact attempts from any device within range. The Wi-Peep sends several messages to a device as it flies and then measures the response time on each, enabling it to identify the devices location to within a meter. --------------------------------------------- https://techxplore.com/news/2022-11-loophole-wi-fi-walls.html ∗∗∗ Passwörter: 64 Prozent der User verwenden Kennwörter mehrmals ∗∗∗ --------------------------------------------- Eine Umfrage unter 3750 Angestellten auch aus deutschen Organisationen fördert bedenkliche Passwortnutzung zutage. Und das trotz besseren Wissens. --------------------------------------------- https://heise.de/-7328871 ∗∗∗ BSI-Lagebericht 2022: Gefährdungslage im Cyber-Raum hoch wie nie ∗∗∗ --------------------------------------------- Im Berichtszeitraum hat sich die bereits zuvor angespannte Lage weiter zugespitzt. Grund dafür sind anhaltende Aktivitäten im Bereich der Cyber-Kriminalität, Cyber-Angriffe im Kontext des russischen Angriffs auf die Ukraine und eine unzureichende Produktqualität von IT- und Software-Produkten. --------------------------------------------- https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse202… ∗∗∗ A new crop of malicious modules found on PyPI ∗∗∗ --------------------------------------------- Phylum has posted anarticle with a detailed look at a set of malicious packages discoveredby an automated system they have developed. Similar to this attacker’s previous attempts, this particular attack starts by copying existing popular libraries and simply injecting a malicious __import__ statement into an otherwise healthy codebase. --------------------------------------------- https://lwn.net/Articles/913555/ ∗∗∗ Vorsicht vor Scam-Versuchen auf Telegram ∗∗∗ --------------------------------------------- Eine Nachricht auf Telegram erreicht Sie aus heiterem Himmel: Jemand, den Sie nicht kennen bietet Ihnen eine lukrative Investment-Möglichkeit an, oder sogar eine große Summe Geld. Vorsicht, bei diesen Nachrichten handelt es sich um Betrugsversuche! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-scam-versuchen-auf-tele… ∗∗∗ Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild ∗∗∗ --------------------------------------------- We present new techniques that leverage active probing and network fingerprint technology to help you detect Cobalt Strike’s Team Servers. --------------------------------------------- https://unit42.paloaltonetworks.com/cobalt-strike-team-server/ ∗∗∗ ASEC Weekly Malware Statistics (October 24th, 2022 – October 30th, 2022) ∗∗∗ --------------------------------------------- This post will list weekly statistics collected from October 24th, 2022 (Monday) to October 30th (Sunday). --------------------------------------------- https://asec.ahnlab.com/en/41139/ ===================== = Vulnerabilities = ===================== ∗∗∗ Awareness and guidance related to OpenSSL 3.0 – 3.0.6 risk (CVE-2022-3786 and CVE-2202-3602) ∗∗∗ --------------------------------------------- Microsoft is aware and actively addressing the impact associated with the recent OpenSSL vulnerabilities announced on October 25th 2022, fixed in version 3.0.7. As part of our standard processes, we are rolling out fixes for impacted services. --------------------------------------------- https://msrc-blog.microsoft.com/2022/11/02/microsoft-guidance-related-to-op… ∗∗∗ IBM Security Bulletins 2022-11-02 ∗∗∗ --------------------------------------------- Content Collector for Email in Content Search Services container, IBM Business Automation Workflow, IBM Business Process Manager (BPM), IBM InfoSphere DataStage, IBM MQ, IBM Operations Analytics - Log Analysis, IBM SPSS Modeler, IBM Security SOAR, Platform Navigator and Automation Assets in IBM Cloud Pak for Integration --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Schwachstellenscanner Nessus: Updates schließen mehrere Sicherheitslücken ∗∗∗ --------------------------------------------- Der Netzwerk-Schwachstellenscanner Nessus behebt mit neuen Versionen mehrere Schwachstellen in Drittherstellerkomponenten. Admins sollten sie installieren. --------------------------------------------- https://heise.de/-7328440 ∗∗∗ Patchday Fortinet: FortiSIEM speichert Log-in-Daten unverschlüsselt ∗∗∗ --------------------------------------------- Es gibt wichtige Updates für Sicherheitsprodukte von Fortinet. Darunter etwa FortiADC und FortiOS. Keine Lücke gilt als kritisch. --------------------------------------------- https://heise.de/-7328476 ∗∗∗ (Non-US) DIR-1935 : Rev. Ax : F/W v1.03b02 :: Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://supportannouncement.us.dlink.com/announcement/publication.aspx?name… ∗∗∗ Splunk Patches 9 High-Severity Vulnerabilities in Enterprise Product ∗∗∗ --------------------------------------------- https://www.securityweek.com/splunk-patches-9-high-severity-vulnerabilities… ∗∗∗ ETIC Telecom Remote Access Server (RAS) ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-307-01 ∗∗∗ Nokia ASIK AirScale System Module ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-307-02 ∗∗∗ Delta Industrial Automation DIALink ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-307-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.11.2022
by Daily end-of-shift report 02 Nov '22

02 Nov '22

===================== = End-of-Day report = ===================== Timeframe: Montag 31-10-2022 18:00 − Mittwoch 02-11-2022 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sicherheitslücken: OpenSSL korrigiert Fehler im Zertifikatsparser ∗∗∗ --------------------------------------------- Zwei Buffer Overflows bei der Verarbeitung von Punycode können OpenSSL zum Absturz bringen - und möglicherweise Codeausführung ermöglichen. --------------------------------------------- https://www.golem.de/news/sicherheitsluecken-openssl-korrigiert-fehler-im-z… ∗∗∗ Lenovo kündigt gegen Schadcode-Attacken abgesicherte BIOS-Versionen an ∗∗∗ --------------------------------------------- Der Computer-Hersteller Lenovo will mehrere BIOS-Lücken in verschiedenen Laptop-Modellen schließen. Einige Updates sind aber erst für Anfang 2023 angekündigt. --------------------------------------------- https://heise.de/-7327115 ∗∗∗ Eine Million Downloads: Bösartige Android-Apps leiten auf Phishing-Seiten ∗∗∗ --------------------------------------------- Ein App-Entwickler fällt wiederholt auf, verseuchte Apps in Google Play anzubieten. Die derzeitig problematischen Apps kommen auf über eine Million Downloads. --------------------------------------------- https://heise.de/-7327239 ∗∗∗ Ausweiskopien mit Wasserzeichen versehen ∗∗∗ --------------------------------------------- Zahlreiche Betrugsmaschen zielen auf eine Kopie Ihres Ausweises ab. Damit können Kriminelle sich bei anderen Betrugsmaschen als Sie ausgeben, in Ihrem Namen Verträge abschließen oder andere Straftaten begehen. Versenden Sie Ausweiskopien daher nur, wenn es unbedingt notwendig ist. Gibt es keine andere Möglichkeit, sollten Sie die Ausweiskopie mit einem Wasserzeichen versehen. Wir zeigen Ihnen, wie Sie unkompliziert ein Wasserzeichen erstellen. --------------------------------------------- https://www.watchlist-internet.at/news/ausweiskopien-mit-wasserzeichen-vers… ∗∗∗ Raspberry Robin Wurm transportiert Malware ∗∗∗ --------------------------------------------- Laut den Sicherheitsforschern von Microsoft verbreitet die bisher vor allem auf USB-Laufwerken bekannte Malware Raspberry Robin jetzt auch die Ransomware Clop. --------------------------------------------- https://www.zdnet.de/88404569/raspberry-robin-wurm-transportiert-malware/ ∗∗∗ Windows PowerShell-Backdoor entdeckt; gibt sich als Teil des Windows Update-Prozesses aus ∗∗∗ --------------------------------------------- Sicherheitsforscher von SafeBreach sind kürzlich auf eine bisher unbekannte PowerShell-Backdoor in Windows gestoßen. Diese verwendet ein bösasartiges Word-Dokument, um die PowerShell-Scripte einzuschleusen. Die Backdoor kann Active Directory-Benutzer und Remote-Desktops auflisten und soll vermutlich zu einem späteren Zeitpunkt zur Ausbreitung in [...] --------------------------------------------- https://www.borncity.com/blog/2022/11/01/windows-powershell-backdoor-als-te… ∗∗∗ Gregor Samsa: Exploiting Javas XML Signature Verification ∗∗∗ --------------------------------------------- Earlier this year, I discovered a surprising attack surface hidden deep inside Java’s standard library: A custom JIT compiler processing untrusted XSLT programs, exposed to remote attackers during XML signature verification. This post discusses CVE-2022-34169, an integer truncation bug in this JIT compiler resulting in arbitrary code execution in many Java-based web applications and identity providers that support the SAML single-sign-on standard. --------------------------------------------- https://googleprojectzero.blogspot.com/2022/11/gregor-samsa-exploiting-java… ∗∗∗ Server-side attacks, C&C in public clouds and other MDR cases we observed ∗∗∗ --------------------------------------------- This report describes several interesting incidents observed by the Kaspersky Managed Detection and Response (MDR) team. We hope that it helps you to stay up to date on the modern threat landscape and to be better prepared for attacks. --------------------------------------------- https://securelist.com/server-side-attacks-cc-in-public-clouds-mdr-cases/10… ∗∗∗ SHA-3 code execution bug patched in PHP – check your version! ∗∗∗ --------------------------------------------- As everyone waits for news of a bug in OpenSSL, heres a reminder that other cryptographic code in your life may also need patching! --------------------------------------------- https://nakedsecurity.sophos.com/2022/11/01/sha-3-code-execution-bug-patche… ∗∗∗ Ransomware: Not enough victims are reporting attacks, and thats a problem for everyone ∗∗∗ --------------------------------------------- The true impact of ransomware is unclear because some victims arent disclosing that theyve been attacked. --------------------------------------------- https://www.zdnet.com/article/ransomware-not-enough-victims-are-reporting-a… ∗∗∗ A technical analysis of Pegasus for Android – Part 3 ∗∗∗ --------------------------------------------- Pegasus is a spyware developed by the NSO group that was repeatedly analyzed by Amnesty International and CitizenLab. In this article, we dissect the Android version that was initially analyzed by Lookout in this paper, and we recommend reading it along with this post. During our research about Pegasus for Android, we’ve found out that vendors wrongly attributed [...] --------------------------------------------- https://cybergeeks.tech/a-technical-analysis-of-pegasus-for-android-part-3/ ===================== = Vulnerabilities = ===================== ∗∗∗ Microsoft Mitigates Vulnerability in Jupyter Notebooks for Azure Cosmos DB ∗∗∗ --------------------------------------------- Microsoft recently fixed an authentication bypass vulnerability in Jupyter Notebooks for Azure Cosmos DB (currently in preview) reported by Orca Security. Customers not using Jupyter Notebooks (99.8% of Azure Cosmos DB customers do NOT use Jupyter notebooks) were not susceptible to this vulnerability. The bug was introduced on August 12th and fully patched worldwide [...] --------------------------------------------- https://msrc-blog.microsoft.com/2022/11/01/microsoft-mitigates-vulnerabilit… ∗∗∗ Multiple Vulnerabilities Reported in Checkmk IT Infrastructure Monitoring Software ∗∗∗ --------------------------------------------- Multiple vulnerabilities have been disclosed in Checkmk IT Infrastructure monitoring software that could be chained together by an unauthenticated, remote attacker to fully take over affected servers. --------------------------------------------- https://thehackernews.com/2022/11/multiple-vulnerabilities-reported-in.html ∗∗∗ Xcode 14.1 ∗∗∗ --------------------------------------------- This document describes the security content of Xcode 14.1. --------------------------------------------- https://support.apple.com/kb/HT213496 ∗∗∗ Cisco Security Advisories 2022-11-02 ∗∗∗ --------------------------------------------- Security Impact Rating: 4x High, 7x Medium --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first… ∗∗∗ Vulnerabilities in OpenSSL Affecting Cisco Products: November 2022 ∗∗∗ --------------------------------------------- On November 1, 2022, the OpenSSL Project announced the following vulnerabilities: CVE-2022-3602 - X.509 Email Address 4-byte Buffer Overflow CVE-2022-3786 - X.509 Email Address Variable Length Buffer Overflow For a description of these vulnerabilities, see OpenSSL Security Advisory [Nov 1 2022]. This advisory will be updated as additional information becomes available. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- AIX, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Cloud Object Storage Systems, IBM Cloud Pak for Integration, IBM Cloud Pak for Security, IBM DataPower Gateway, IBM Elastic Storage System, IBM Event Streams, IBM FlashSystem, IBM FlashSystem models FS900 and V9000, IBM InfoSphere Information Server, IBM MQ, IBM QRadar SIEM, IBM SAN Volume Controller, IBM Security Guardium, IBM Security Verify Access, IBM Spectrum Virtualize, IBM Storwize, IBM Voice Gateway, IBM WebSphere Application Server, IBM WebSphere Application Server used by IBM Master Data Management, Platform Navigator and Automation Assets in IBM Cloud Pak for Integration, Power System, Zlib for IBM i --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ An Update on the OpenSSL vulnerability CVE-2022-3602 ∗∗∗ --------------------------------------------- November 1, 2022: IBM is responding to the reported buffer overflow vulnerability that the OpenSSL open-source community disclosed for OpenSSL versions 3.0.0 – 3.0.6. We are taking action as an enterprise, and for IBM products and services that may potentially be impacted, as we do for all vulnerabilities rated High. --------------------------------------------- https://www.ibm.com/blogs/psirt/ibm-preparing-to-respond-to-the-upcoming-op… ∗∗∗ FortiGuard PSIRT Advisories 2022-11-01 ∗∗∗ --------------------------------------------- AV Engine, FortiADC, FortiClient (MAC), FortiDeceptor, FortiEDR CollectorWindows, FortiMail, FortiManager/FortiAnalyzer, FortiOS, FortiSIEM, FortiSOAR, FortiTester --------------------------------------------- https://fortiguard.fortinet.com/psirt ∗∗∗ Xen Security Advisories 2022-11-01 ∗∗∗ --------------------------------------------- Xen released 10 Security Advisories. --------------------------------------------- https://xenbits.xen.org/xsa/ ∗∗∗ Bitdefender: Löschen von Registry-Keys durch Sicherheitslücke möglich ∗∗∗ --------------------------------------------- Eine Sicherheitslücke in den Virenscannern von Bitdefender ermöglicht Angreifern, Registry-Schlüssel zu löschen. Bitdefender verteilt Aktualisierungen dagegen. --------------------------------------------- https://heise.de/-7327061 ∗∗∗ Kritische Sicherheitslücke in IT-Managementsoftware von Hitachi geschlossen ∗∗∗ --------------------------------------------- Admins sollten die aktuellen Versionen von Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer und Hitachi Ops Center Viewpoint installieren. --------------------------------------------- https://heise.de/-7327825 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (batik, chromium, expat, libxml2, ncurses, openvswitch, pysha3, python-django, thunderbird, and tomcat9), Fedora (cacti, cacti-spine, curl, mbedtls, mingw-expat, and xen), Gentoo (apptainer, bind, chromium, exif, freerdp, gdal, gitea, hiredis, jackson-databind, jhead, libgcrypt, libksba, libtirpc, lighttpd, net-snmp, nicotine+, open-vm-tools, openexr, rpm, schroot, shadow, sofia-sip, tiff, and xorg-server), Mageia (libreoffice), Oracle (expat), Red [...] --------------------------------------------- https://lwn.net/Articles/913261/ ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python3.7), Gentoo (android-tools, expat, firefox, libjxl, libxml2, pjproject, sqlite, thunderbird, and zlib), Oracle (compat-expat1), Slackware (php8 and vim), SUSE (kernel, libtasn1, podman, and pyenv), and Ubuntu (libtasn1-6). --------------------------------------------- https://lwn.net/Articles/913352/ ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ffmpeg and linux-5.10), Fedora (libksba, openssl, and php), Gentoo (openssl), Mageia (curl, gdk-pixbuf2.0, libksba, nbd, php, and virglrenderer), Red Hat (kernel, kernel-rt, libksba, and openssl), SUSE (gnome-desktop, hdf5, hsqldb, kernel, nodejs10, openssl-3, php7, podofo, python-Flask-Security, python-lxml, and xorg-x11-server), and Ubuntu (backport-iwlwifi-dkms, firefox, ntfs-3g, and openssl). --------------------------------------------- https://lwn.net/Articles/913504/ ∗∗∗ Nov 3 2022 Security Releases ∗∗∗ --------------------------------------------- The Node.js project will release new versions of the 14.x, 16.x, 18.x, 19.xreleases lines on or shortly after Thursday, November 3, 2022 in order to address: One medium severity issues. Two high severity issues that affect OpenSSL as per secadv/20221101.txt These security releases are driven by the OpenSSL security release as announced in OpenSSL November Security Release as well as an additional vulnerability that affects all supported release lines. --------------------------------------------- https://nodejs.org/en/blog/vulnerability/november-2022-security-releases ∗∗∗ Chromium: CVE-2022-3723 Type Confusion in V8 ∗∗∗ --------------------------------------------- This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information. Google is aware of reports that an exploit for CVE-2022-3723 exists in the wild. --------------------------------------------- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-3723 ∗∗∗ Multiple vulnerabilities in the web interfaces of Kyocera Document Solutions MFPs and printers ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN46345126/ ∗∗∗ Security Advisory - Path Traversal Vulnerability in a Huawei Childrens Watch ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2022/huawei-sa-20221102-… ∗∗∗ K44454157: Expat vulnerability CVE-2022-40674 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K44454157 ∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2022-42316, CVE-2022-42317 & CVE-2022-42318 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX472851/citrix-hypervisor-security-bul… ∗∗∗ [R1] Nessus Agent Version 10.2.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-22 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.10.2022
by Daily end-of-shift report 31 Oct '22

31 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 28-10-2022 18:00 − Montag 31-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Jetzt patchen! Es könnten Attacken auf VMware Cloud Foundation bevorstehen ∗∗∗ --------------------------------------------- Für eine kritische Sicherheitslücke in Cloud Foundation von VMware ist Exploit-Code in Umlauf. --------------------------------------------- https://heise.de/-7324777 ∗∗∗ Apple räumt ein: Nur aktuelles macOS stopft alle bekannten Sicherheitslücken ∗∗∗ --------------------------------------------- Apple hat zum ersten Mal bestätigt, dass der Hersteller in früheren macOS-Versionen nicht alle Schwachstellen beseitigt. Dasselbe gilt offensichtlich für iOS. --------------------------------------------- https://heise.de/-7324991 ∗∗∗ Backup-Software von ConnectWise für Ransomware-Attacken anfällig ∗∗∗ --------------------------------------------- Angreifer könnten Systeme mit Recover oder R1Soft Server Backup Manager von ConnectWise attackieren. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://heise.de/-7324856 ∗∗∗ Gefälschtes A1-Mail im Umlauf ∗∗∗ --------------------------------------------- In einem gefälschten E-Mail von A1 behaupten Kriminelle, dass Sie bereits 80% Ihres Postfach-Speicherplatzes aufgebraucht haben. Sie werden aufgefordert, auf einen Link zu klicken, um zusätzlichen Speicherplatz freizuschalten. Klicken Sie nicht auf den Link, Sie landen auf einer manipulierten Login-Seite. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-a1-mail-im-umlauf/ ∗∗∗ 2022 OpenSSL vulnerability ∗∗∗ --------------------------------------------- This repo contains operational information regarding the recently announced vulnerability in OpenSSL 3. [...] Currently no complete overview of vulnerable products is available. Please see https://github.com/NCSC-NL/OpenSSL-2022/blob/main/software/README.md for a list of products that are known to be vulnerable. The list is a work in progress. --------------------------------------------- https://github.com/NCSC-NL/OpenSSL-2022 ∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗ --------------------------------------------- Some here may still remember Heartbleed. Heartbleed was a critical OpenSSL vulnerability that surprised many organizations, and patching the issue was a major undertaking. Heartbleed caused OpenSSL and other open-source projects to rethink how they address security issues and communicate with their users. OpenSSL started to pre-announce any security updates about a week ahead of time. This week, OpenSSL announced they would release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability [1]. --------------------------------------------- https://isc.sans.edu/diary/rss/29192 ∗∗∗ APT10: Tracking down LODEINFO 2022, part I ∗∗∗ --------------------------------------------- The first part of this report will provide technical analysis of the new infection methods such as SFX files and DOWNIISSA, a new downloader shellcode used to deploy the LODEINFO backdoor. --------------------------------------------- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/ ∗∗∗ APT10: Tracking down LODEINFO 2022, part II ∗∗∗ --------------------------------------------- In the second part of this report, we discuss improvements made to the LODEINFO backdoor shellcode in 2022. --------------------------------------------- https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/ ∗∗∗ NMAP without NMAP - Port Testing and Scanning with PowerShell, (Mon, Oct 31st) ∗∗∗ --------------------------------------------- Ever needed to do a portscan and didn't have nmap installed? I've had this more than once on an internal pentest or more often just on run-rate "is that port open? / is there a host firewall in the way?" testing. --------------------------------------------- https://isc.sans.edu/diary/rss/29202 ∗∗∗ WordPress Vulnerability & Patch Roundup October 2022 ∗∗∗ --------------------------------------------- [...] To help educate website owners on emerging threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month. --------------------------------------------- https://blog.sucuri.net/2022/10/wordpress-vulnerability-patch-roundup-octob… ∗∗∗ Hardware Trojans Under a Microscope ∗∗∗ --------------------------------------------- While the security industry generally focuses on software cyber attacks, we can’t forget the security impact of lower level hardware flaws, such as those that affect semiconductors. --------------------------------------------- https://ryancor.medium.com/hardware-trojans-under-a-microscope-bf542acbcc29 ∗∗∗ What I learnt from reading 217* Subdomain Takeover bug reports. ∗∗∗ --------------------------------------------- My two prior blogs, What I Learnt From Reading 220 IDOR bug reports, and What I Learnt From Reading 126 Information Disclosure Writeups*, were well received, so I’m continuing the series. I once more scraped ALL 143 SDTO bug reports from hackerone, and 74 detailed write-ups, then went into hiding as I read and took notes on them. I’m here to show you my actionable findings, and show you how to properly hunt for SDTOs. --------------------------------------------- https://medium.com/@nynan/what-i-learnt-from-reading-217-subdomain-takeover… ∗∗∗ Free Micropatches For Bypassing MotW Security Warning with Invalid Signature (0day) ∗∗∗ --------------------------------------------- Nine days ago we issued micropatches for a vulnerability that allows attackers to bypass the warning Windows normally present to users when they try to open a document or executable obtained from an untrusted source (Internet, email, USB key, network drive). That vulnerability, affecting all supported and many legacy Windows versions, still has no official patch from Microsoft so our (free!) patches are the only actual patches in existence as of this writing. On the very same day we issued these micropatches, Will Dormann - who researched said vulnerability - replied to a tweet by another security researcher, Patrick Schläpfer. Patrick works at HP Wolf Security where they analyzed the Magniber Ransomware and wrote a detailed analysis of its working. Will asked Patrick about the ZIP files used in the malware campaign to see if they were exploiting the same vulnerability or employing some other trick to bypass the "Mark of the Web". [...] And so a new 0day - already exploited in the wild - was revealed. --------------------------------------------- https://blog.0patch.com/2022/10/free-micropatches-for-bypassing-motw.html ∗∗∗ The Defender’s Guide to the Windows Registry ∗∗∗ --------------------------------------------- Welcome to the Defender’s Guide. This is a series of blog posts designed to give you a ground-up start to defending a specific technology from potential attackers. While a lot of this information may be redundant to a more seasoned information security personnel, even the best of us rely on Google and blog posts to get information. These posts are designed to be a one-stop shop, bringing a lot of that information together. --------------------------------------------- https://posts.specterops.io/the-defenders-guide-to-the-windows-registry-feb… ∗∗∗ Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure ∗∗∗ --------------------------------------------- Learning about the variety of techniques used by banking Trojans can help us detect other activities of financially motivated threat groups. --------------------------------------------- https://unit42.paloaltonetworks.com/banking-trojan-techniques/ ∗∗∗ Follina Exploit Leads to Domain Compromise ∗∗∗ --------------------------------------------- In early June 2022, we observed an intrusion where a threat actor gained initial access by exploiting the CVE-2022-30190 (Follina) vulnerability which triggered a Qbot infection chain. --------------------------------------------- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compro… ∗∗∗ Vulnerabilities in Apache Batik Default Security Controls – SSRF and RCE Through Remote Class Loading ∗∗∗ --------------------------------------------- I stumbled upon the Apache Batik library while researching other Java-based products. It immediately caught my attention, as this library parses Scalable Vector Graphics (SVG) files and transforms them into different raster graphics formats (i.e., PNG, PDF, or JPEG). I was even more encouraged when I looked at the Batik documentation. It was obvious that such a library could be prone to Server-Side Request Forgery (SSRF) issues (e.g., loading of images from remote resources). --------------------------------------------- https://www.thezdi.com/blog/2022/10/28/vulnerabilities-in-apache-batik-defa… ∗∗∗ AgentTesla Being Distributed via VBS ∗∗∗ --------------------------------------------- The ASEC analysis team has recently identified that AgentTesla is being distributed through malicious VBS. The script file has multiple codes that have been obfuscated multiple times. AgentTesla has been found to be distributed last May through a Windows Help file (*.chm), and it seems that its distribution method is continuously changing. --------------------------------------------- https://asec.ahnlab.com/en/40890/ ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- App Connect Professional, IBM Business Automation Manager Open Editions 8.0.1, IBM CICS TX Advanced, IBM CICS TX Standard, IBM Cloud Pak for Business Automation, IBM Cloud Pak for Security, IBM Event Streams, IBM Host Access Transformation Services, IBM MQ Appliance --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client ∗∗∗ --------------------------------------------- Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible. --------------------------------------------- https://spring.io/blog/2022/10/31/cve-2022-31690-privilege-escalation-in-sp… ∗∗∗ CVE-2022-31692: Authorization rules can be bypassed via forward or include in Spring Security ∗∗∗ --------------------------------------------- Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for [CVE-2022-31692](https://tanzu.vmware.com/security/cve-2022-31692) affecting the AuthorizationFilter. Users are encouraged to update as soon as possible. --------------------------------------------- https://spring.io/blog/2022/10/31/cve-2022-31692-authorization-rules-can-be… ∗∗∗ CISA Has Added One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/10/28/cisa-has-added-on… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.10.2022
by Daily end-of-shift report 28 Oct '22

28 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 27-10-2022 18:00 − Freitag 28-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Windows: Gefährliche, IE-basierende Schwachstellen ∗∗∗ --------------------------------------------- Sicherheitsforscher der Varonis Threat Labs haben zwei Windows-Sicherheitslücken aufgedeckt, die große blinde Flecken für Sicherheits-Software erzeugen und Rechner mittels DoS-Angriffe außer Betrieb setzen können. LogCrusher und OverLog nutzen dabei das Internet Explorer-spezifische Ereignisprotokoll MS-EVEN, das auf allen aktuellen Windows-Betriebssystemen vorhanden ist, unabhängig davon, ob der Browser genutzt wurde oder wird. Während OverLog mittlerweile gefixt ist, hat Microsoft für LogCrusher kürzlich nur einen partiellen Patch herausgegeben: Cyberkriminelle können deshalb immer noch Angriffe durchführen, wenn sie sich einen Administrator-Zugang zum Netzwerk des Opfers verschaffen. --------------------------------------------- https://www.borncity.com/blog/2022/10/28/windows-gefhrliche-ie-basierende-s… ∗∗∗ Neue Website: Apple erleichtert Sicherheitsforschung ∗∗∗ --------------------------------------------- Ein zentrales neues Portal erklärt das Bug–Bounty-Programm und ermöglicht es, schneller und direkter mit dem Security-Team des Konzerns in Kontakt zu kommen. --------------------------------------------- https://heise.de/-7323634 ∗∗∗ macOS 13: Anti-Malware-Tools nach Upgrade zahnlos ∗∗∗ --------------------------------------------- Antivirus-Software und andere Sicherheits-Tools funktionieren durch einen Apple-Bug in macOS Ventura nicht mehr richtig. Das Problem kann behoben werden. --------------------------------------------- https://heise.de/-7322669 ∗∗∗ Vorsicht vor dieser Fake-Raiffeisen Investmentfalle ∗∗∗ --------------------------------------------- Geld verdienen mit Raiffeisen, angeboten werden angeblich Aktien einer der größten Banken Österreichs. Das Versprechen klingt gut, doch es handelt sich um eine gut getarnte Phishing-Seite. Investieren Sie nicht auf lps.snowgross.com, Sie tappen in eine Anlagebetrugsfalle! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-dieser-fake-raiffeisen-… ∗∗∗ One-Time Programs ∗∗∗ --------------------------------------------- One of the things I like to do on this blog is write about new research that has a practical angle. Most of the time (I swear) this involves writing about other folks’ research: it’s not that often that I write about work that comes out of my own lab. Today I’m going make an [...] --------------------------------------------- https://blog.cryptographyengineering.com/2022/10/27/one-time-programs/ ∗∗∗ Apple clarifies security update policy: Only the latest OSes are fully patched ∗∗∗ --------------------------------------------- New document confirms what security researchers have observed for a few years. --------------------------------------------- https://arstechnica.com/?p=1893235 ∗∗∗ Android malware droppers with 130K installs found on Google Play ∗∗∗ --------------------------------------------- A set of Android malware droppers were found infiltrating the Google Play store to install malicious programs by pretending to be app updates. --------------------------------------------- https://www.bleepingcomputer.com/news/security/android-malware-droppers-wit… ∗∗∗ Exploit released for critical VMware RCE vulnerability, patch now ∗∗∗ --------------------------------------------- Proof-of-concept exploit code is now available for a pre-authentication remote code execution (RCE) vulnerability allowing attackers to execute arbitrary code remotely with root privileges on unpatched Cloud Foundation and NSX Manager appliances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-critica… ∗∗∗ Researchers Expose Over 80 ShadowPad Malware C2 Servers ∗∗∗ --------------------------------------------- As many as 85 command-and-control (C2) servers have been discovered supported by the ShadowPad malware since September 2021, with infrastructure detected as recently as October 16, 2022. Thats according to VMwares Threat Analysis Unit (TAU), which studied three ShadowPad variants using TCP, UDP, and HTTP(S) protocols for C2 communications. --------------------------------------------- https://thehackernews.com/2022/10/researchers-expose-over-80-shadowpad.html ∗∗∗ Raspberry Robin Operators Selling Cybercriminals Access to Thousands of Endpoints ∗∗∗ --------------------------------------------- The Raspberry Robin worm is becoming an access-as-a-service malware for deploying other payloads, including IcedID, Bumblebee, TrueBot (aka Silence), and Clop ransomware. It is "part of a complex and interconnected malware ecosystem, with links to other malware families and alternate infection methods beyond its original USB drive spread," the Microsoft Security Threat Intelligence Center (MSTIC) said in a detailed write-up. --------------------------------------------- https://thehackernews.com/2022/10/raspberry-robin-operators-selling.html ∗∗∗ TCP/IP Vulnerability CVE-2022–34718 PoC Restoration and Analysis ∗∗∗ --------------------------------------------- The patch released by Microsoft last month contained a vulnerability in the TCP/IP protocol that allowed for code execution. To ascertain the impact of the vulnerability, Numen’s security research team conducted an in-depth analysis of the vulnerability and restored the PoC through patch comparison. --------------------------------------------- https://medium.com/numen-cyber-labs/analysis-and-summary-of-tcp-ip-protocol… ∗∗∗ Defeating Guloader Anti-Analysis Technique ∗∗∗ --------------------------------------------- Unit 42 is providing a script to deobfuscate a recently discovered Guloader variant that uses anti-analysis techniques, and other samples like it. --------------------------------------------- https://unit42.paloaltonetworks.com/guloader-variant-anti-analysis/ ∗∗∗ Cranefly: Threat Actor Uses Previously Unseen Techniques and Tools in Stealthy Campaign ∗∗∗ --------------------------------------------- Group uses novel method of reading commands from legitimate IIS logs. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/cranefly… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates für älteres iOS und iPadOS ∗∗∗ --------------------------------------------- iPadOS 15.7.1 und iOS 15.7.1 stopfen problematische Sicherheitslücken für alle, die nicht auf iPadOS 16 und iOS 16 aktualisieren wollen - oder können. --------------------------------------------- https://heise.de/-7323199 ∗∗∗ Webbrowser: Entwickler schließen hochriskante Sicherheitslücke in Chrome ∗∗∗ --------------------------------------------- Google hat ein Update für den Webbrowser Chrome veröffentlicht. Darin dichten die Programmierer eine Schwachstelle mit hohem Risiko ab. --------------------------------------------- https://heise.de/-7322963 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- CP4D Match 360, IBM Answer Retrieval for Watson Discovery versions 2.8 and earlier, IBM Cloud Pak System, IBM Db2 On Openshift, IBM Db2® on Cloud Pak for Data, Db2 Warehouse® on Cloud Pak for Data, IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite, IBM QRadar SIEM, IBM TXSeries for Multiplatforms, IBM Voice Gateway, IBM Watson Assistant for IBM Cloud Pak for Data, IBM® SDK, Java™ Technology Edition, Liberty for Java for IBM Cloud, node.js --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (expat, ruby-sinatra, and thunderbird), Fedora (glances), Mageia (cups, firefox, git, heimdal, http-parser, krb5-appl, minidlna, nginx, and thunderbird), Oracle (389-ds:1.4, device-mapper-multipath, firefox, mysql:8.0, postgresql:12, and thunderbird), SUSE (dbus-1, libconfuse0, libtasn1, openjpeg2, qemu, and thunderbird), and Ubuntu (dbus, linux-azure-fde, and tiff). --------------------------------------------- https://lwn.net/Articles/912873/ ∗∗∗ Corel Coreldraw graphics suite vulnerabilities ∗∗∗ --------------------------------------------- https://secalerts.co/vulnerabilities/corel/coreldraw_graphics_suite ∗∗∗ Case update: DIVD-2022-00020 - Multiple injection vulnerabilities identified within Feathers.js ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2022-00020/ ∗∗∗ Case update: DIVD-2022-00045 - Injection vulnerability found within Socket.io ∗∗∗ --------------------------------------------- https://csirt.divd.nl/cases/DIVD-2022-00045/ ∗∗∗ [R1] Nessus Version 10.4.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-21 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.10.2022
by Daily end-of-shift report 27 Oct '22

27 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Dienstag 25-10-2022 18:00 − Donnerstag 27-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Microsoft fixes Windows vulnerable driver blocklist sync issue ∗∗∗ --------------------------------------------- Microsoft says it addressed an issue preventing the Windows kernel vulnerable driver blocklist from being synced to systems running older Windows versions. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-vul… ∗∗∗ Fodcha DDoS botnet reaches 1Tbps in power, injects ransoms in packets ∗∗∗ --------------------------------------------- A new version of the Fodcha DDoS botnet has emerged, featuring ransom demands embedded in packets and new features to evade detection of its infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fodcha-ddos-botnet-reaches-1… ∗∗∗ How to prevent lateral movement attacks using Microsoft 365 Defender ∗∗∗ --------------------------------------------- Learn how Microsoft 365 Defender can enhance mitigations against lateral movement paths in your environment, stopping attackers from gaining access to privileged and sensitive accounts. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/10/26/how-to-prevent-lat… ∗∗∗ Malware vs Virus: What’s the Difference? ∗∗∗ --------------------------------------------- In today’s article, we’ll be clarifying the difference between viruses and malware while helping to identify the most common types of malware. --------------------------------------------- https://blog.sucuri.net/2022/10/whats-the-difference-malware-virus.html ∗∗∗ New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes Instances ∗∗∗ --------------------------------------------- A new cryptojacking campaign has been uncovered targeting vulnerable Docker and Kubernetes infrastructures as part of opportunistic attacks designed to illicitly mine cryptocurrency. --------------------------------------------- https://thehackernews.com/2022/10/new-cryptojacking-campaign-targeting.html ∗∗∗ Hijacking AUR Packages by Searching for Expired Domains ∗∗∗ --------------------------------------------- The Arch User Repository (AUR) is a software repository for Arch Linux. It differs from the official Arch Linux repositories in that its packages are provided by its users and not officially supported by Arch Linux. --------------------------------------------- https://blog.nietaanraken.nl/posts/aur-packages-expired-domains/ ∗∗∗ Industrial Ransomware Attacks: New Groups Emerge, Manufacturing Pays Highest Ransom ∗∗∗ --------------------------------------------- Industrial organizations continue to be a top target for ransomware attacks, and reports published by cybersecurity companies this week reveal some recent trends. --------------------------------------------- https://www.securityweek.com/industrial-ransomware-attacks-new-groups-emerg… ∗∗∗ Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving ∗∗∗ --------------------------------------------- We examine trends in web threats for the second calendar year quarter of 2022, including how a malicious JavaScript downloader is evolving to evade detection. --------------------------------------------- https://unit42.paloaltonetworks.com/web-threats-malicious-javascript-downlo… ∗∗∗ FormBook Malware Being Distributed as .NET ∗∗∗ --------------------------------------------- FormBook is an info-stealer that aims to steal the user’s web browser login information, keyboard input, clipboard, and screenshots. It targets random individuals, and is usually distributed through spam mails or uploaded to infiltrated websites. --------------------------------------------- https://asec.ahnlab.com/en/40663/ ===================== = Vulnerabilities = ===================== ∗∗∗ Upcoming Critical OpenSSL Vulnerability: What will be Affected?, (Thu, Oct 27th) ∗∗∗ --------------------------------------------- This week, OpenSSL announced that they will release OpenSSL 3.0.7 this coming Tuesday. It will fix a critical vulnerability. The update will only affect OpenSSL 3.0.x, not 1.1.1. Now is the time to figure out where and how you are using OpenSSL 3.0.x. --------------------------------------------- https://isc.sans.edu/diary/rss/29192 ∗∗∗ IBM Security Bulletins 2022-10-26 and 2022-10-25 ∗∗∗ --------------------------------------------- IBM SDK, IBM WebSphere Application Server Liberty, IBM QRadar SIEM, IBM i, IBM Robotic Process Automation, IBM Cloud Transformation Advisor, CloudPak for Watson, Netcool Operations Insight. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Cisco AnyConnect: Alte Sicherheitslücken im Visier von Angreifern ∗∗∗ --------------------------------------------- Allerhöchste Zeit, um alte Lücken in Cisco AnyConnect abzudichten: Cisco warnt vor derzeitigen Cyber-Angriffen auf Schwachstellen aus dem Jahr 2020. --------------------------------------------- https://heise.de/-7320917 ∗∗∗ Sicherheitsupdate ArubaOS: Schadcode-Attacken durch präparierte Anfragen möglich ∗∗∗ --------------------------------------------- Die Entwickler des Netzwerkbetriebssystems ArubaOS haben unter anderem eine kritische Lücke geschlossen. --------------------------------------------- https://heise.de/-7321787 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (tomcat9), Oracle (389-ds-base, device-mapper-multipath, firefox, git-lfs, gnutls, kernel, kernel-container, libksba, pki-core, samba, sqlite, and zlib), Red Hat (device-mapper-multipath, kernel, kpatch-patch, libksba, and thunderbird), Slackware (expat and samba), SUSE (bind, buildah, curl, firefox, golang-github-prometheus-node_exporter, grafana, icinga2, python-paramiko, python-waitress, SUSE Manager Client Tools, telnet, and xen), [...] --------------------------------------------- https://lwn.net/Articles/912495/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (389-ds-base, bind, expat, java-1.8.0-openjdk, java-11-openjdk, libksba, and squid), Debian (chromium, libdatetime-timezone-perl, tzdata, and wordpress), Fedora (dbus, dhcp, dotnet3.1, jhead, samba, and strongswan), Mageia (virtualbox), Oracle (device-mapper-multipath), Scientific Linux (device-mapper-multipath and thunderbird), Slackware (curl), SUSE (container-suseconnect, curl, kernel, libmad, libtasn1, libtirpc, qemu, rubygem-puppet, [...] --------------------------------------------- https://lwn.net/Articles/912688/ ∗∗∗ Windows (Mark of the Web) 0-day per JavaScript für Ransomware-Angriffe genutzt ∗∗∗ --------------------------------------------- Die Tage hatte ich über eine ungefixte 0-day-Schwachstelle, Mark of the Web (MOTOW), in Windows berichtet, für die es einen inoffiziellen Fix gibt. Nun ist mir ein Bericht unter die Augen gekommen, dass eine 0-day-Schwachstelle in diesem Bereich von Cyberkriminellen per JavaScript ausgenutzt werden kann, um Web-Sicherheitswarnungen zu umgehen und Ransomware-Angriffe zu verschleiern. --------------------------------------------- https://www.borncity.com/blog/2022/10/27/exploited-windows-0-day-mark-of-th… ∗∗∗ ZDI-22-1467: (0Day) IronCAD STP File Parsing Uninitialized Pointer Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-22-1467/ ∗∗∗ VMSA-2022-0027 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-0027.html ∗∗∗ K11601010: Intel Processor vulnerability CVE-2021-33149 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K11601010 ∗∗∗ Synology-SA-22:20 Samba ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_20 ∗∗∗ Hitachi Energy MicroSCADA X DMS600 ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-04 ∗∗∗ Johnson Controls CKS CEVAS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-05 ∗∗∗ Delta Electronics DIAEnergie ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-06 ∗∗∗ AliveCor KardiaMobile ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsma-22-298-01 ∗∗∗ Haas Controller ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-01 ∗∗∗ HEIDENHAIN Controller TNC on HARTFORD Machine ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-02 ∗∗∗ Rockwell Automation FactoryTalk Alarm and Events Server ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-01 ∗∗∗ SAUTER Controls moduWeb ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-02 ∗∗∗ Rockwell Automation Stratix Devices Containing Cisco IOS ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-03 ∗∗∗ Trihedral VTScada ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-300-04 ∗∗∗ Samba Releases Security Updates ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ncas/current-activity/2022/10/26/samba-releases-se… ∗∗∗ [R1] Nessus Version 10.3.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2022-20 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.10.2022
by Daily end-of-shift report 25 Oct '22

25 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Montag 24-10-2022 18:00 − Dienstag 25-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Zero-Day-Fehler im Kernel von iOS und iPadOS wird ausgenutzt ∗∗∗ --------------------------------------------- iOS und iPadOS 16.1 beheben einen schwerwiegenden Kernel-Bug in den Betriebssystemen für iPhone und iPad. Apple hat Berichte über laufende Angriffe. --------------------------------------------- https://heise.de/-7319500 ∗∗∗ Chrome extensions with 1 million installs hijack targets’ browsers ∗∗∗ --------------------------------------------- Researchers at Guardio Labs have discovered a new malvertizing campaign pushing Google Chrome and Microsoft Edge extensions that hijack searches and insert affiliate links into webpages. --------------------------------------------- https://www.bleepingcomputer.com/news/security/chrome-extensions-with-1-mil… ∗∗∗ How the Software Supply Chain Security is Threatened by Hackers ∗∗∗ --------------------------------------------- In many ways, the software supply chain is similar to that of manufactured goods, which we all know has been largely impacted by a global pandemic and shortages of raw materials. However, in the IT world, it is not shortages or pandemics that have been the main obstacles to overcome in recent years, but rather attacks aimed at using them to harm hundreds or even thousands of victims simultaneously. --------------------------------------------- https://thehackernews.com/2022/10/how-software-supply-chain-security-is.html ∗∗∗ Researchers Detail Windows Event Log Vulnerabilities: LogCrusher and OverLog ∗∗∗ --------------------------------------------- Cybersecurity researchers have disclosed details about a pair of vulnerabilities in Microsoft Windows, one of which could be exploited to result in a denial-of-service (DoS). --------------------------------------------- https://thehackernews.com/2022/10/researchers-detail-windows-event-log.html ∗∗∗ Chapter 1 - From Gozi to ISFB: The history of a mythical malware family. ∗∗∗ --------------------------------------------- Disclaimer: This article does not contain any IOCs or infrastructure details. Instead, the aim is to explain the whole business dynamic of a long-lasting malware family. This work is based on almost 10 years of research and intel gatherings and tries its best to stick to the truth and the facts observed around ISFB. Hopefully, it will give some insight on how the top cyber crime groups have been working over the years. --------------------------------------------- https://medium.com/csis-techblog/chapter-1-from-gozi-to-isfb-the-history-of… ∗∗∗ Stranger Strings: An exploitable flaw in SQLite ∗∗∗ --------------------------------------------- Trail of Bits is publicly disclosing CVE-2022-35737, which affects applications that use the SQLite library API. CVE-2022-35737 was introduced in SQLite version 1.0.12 (released on October 17, 2000) and fixed in release 3.39.2 (released on July 21, 2022). CVE-2022-35737 is exploitable on 64-bit systems, and exploitability depends on how the program is compiled [...] --------------------------------------------- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-libr… ∗∗∗ E-Mail von WhatsApp: Gewinn über 900.600,00 USD ist Fake ∗∗∗ --------------------------------------------- Aktuell kursiert ein E-Mail von WhatsApp, in dem Sie über den Gewinn von 900.600,00 USD informiert werden. Um den Gewinn zu erhalten, müssen Sie Ihre Kontaktdaten an account.whatsapp(a)mail.com senden. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-von-whatsapp-gewinn-ueber-900… ∗∗∗ Windows 10 22H2, Windows 11 22H2: Administrative Vorlagen (.admx); Windows 10 22H2 Security Baseline ∗∗∗ --------------------------------------------- Kleiner Hinweis für Administratoren von Windows-Systemen in Unternehmensumgebungen. Microsoft hat die Security Baseline für das Windows 10 October 2022 Update (Version 22H2) freigegeben. --------------------------------------------- https://www.borncity.com/blog/2022/10/25/windows-10-22h2-windows-11-22h2-ad… ∗∗∗ Rapidly Evolving Magniber Ransomware ∗∗∗ --------------------------------------------- The Magniber ransomware has recently been evolving rapidly. From changing its file extension, injection and to UAC bypassing techniques, the Magniber ransomware has been rapidly changing to bypass the detection of anti-malware software. This article summarizes the evolution of the Magniber ransomware in the last few months based on the analysis that had been previously performed. --------------------------------------------- https://asec.ahnlab.com/en/40422/ ∗∗∗ Analysis on Attack Techniques and Cases Using RDP ∗∗∗ --------------------------------------------- Overview One of the previous ASEC blog posts discussed cases where attackers abused various remote control tools that are originally used for system management purposes to gain control over infected systems. This post will cover cases where RDP (Remote Desktop Protocol), a default service provided by baseline Windows OS, was used. --------------------------------------------- https://asec.ahnlab.com/en/40394/ ===================== = Vulnerabilities = ===================== ∗∗∗ Webkonferenzen: Sicherheitslücke in Zoom ermöglicht Sitzungsübernahme ∗∗∗ --------------------------------------------- Zoom warnt vor einer Sicherheitslücke, durch die Angreifer Opfer etwa auf falsche Server locken und so Sitzungen übernehmen könnten. Updates stehen bereit. --------------------------------------------- https://heise.de/-7319974 ∗∗∗ VMSA-2022-00031 ∗∗∗ --------------------------------------------- VMware Cloud Foundation contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2022-00031.html ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libbluray and wkhtmltopdf), Fedora (firefox, libksba, libmodsecurity, libxml2, qemu, and xmlsec1), Red Hat (389-ds-base, 389-ds:1.4, git-lfs, gnutls, java-1.8.0-ibm, kernel, kernel-rt, kpatch-patch, libksba, mysql:8.0, pki-core, postgresql:12, samba, sqlite, and zlib), Scientific Linux (389-ds-base, libksba, and pki-core), SUSE (bluez, firefox, jdom, kernel, libosip2, libxml2, multipath-tools, and python-Mako), and Ubuntu (barbican, mysql-5.7, mysql-8.0, openvswitch, and pillow). --------------------------------------------- https://lwn.net/Articles/912324/ ∗∗∗ Synology-SA-22:19 Presto File Server ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to write arbitrary files or remote authenticated users to bypass security constraint via a susceptible version of Presto File Server. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_19 ∗∗∗ Synology-SA-22:18 DSM ∗∗∗ --------------------------------------------- Multiple vulnerabilities allow remote attackers to read or write arbitrary files or remote authenticated users to access intranet resources via a susceptible version of Synology DiskStation Manager (DSM). --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_22_18 ∗∗∗ Node.js: OpenSSL and zlib update assessment, and Node.js Assessment workflow ∗∗∗ --------------------------------------------- https://nodejs.org/en/blog/vulnerability/openssl-and-zlib-vulnerability-ass… ∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to disclosure of information that could aid in further system attacks. (CVD-2022-38710) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is potentially vulnerable to CSV Injection (CVE-2022-22425) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM Robotic Process Automation is vulnerable to incorrect permission assignment ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-robotic-process-autom… ∗∗∗ Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to unauthorized attacker causing integrity impact (CVE-2021-2163) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-java-sdk-and-ibm-java… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Delta Electronics InfraSuite Device Master ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-298-07 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.10.2022
by Daily end-of-shift report 24 Oct '22

24 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Freitag 21-10-2022 18:00 − Montag 24-10-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Thousands of GitHub repositories deliver fake PoC exploits with malware ∗∗∗ --------------------------------------------- Researchers at the Leiden Institute of Advanced Computer Science found thousands of repositories on GitHub that offer fake proof-of-concept (PoC) exploits for various vulnerabilities, some of them including malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/thousands-of-github-reposito… ∗∗∗ Typosquat campaign mimics 27 brands to push Windows, Android malware ∗∗∗ --------------------------------------------- A massive, malicious campaign is underway using over 200 typosquatting domains that impersonate twenty-seven brands to trick visitors into downloading various Windows and Android malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/typosquat-campaign-mimics-27… ∗∗∗ Kriminalität: Eltern durch Whatsapp-Betrug um Tausende Euro gebracht ∗∗∗ --------------------------------------------- Die Polizei warnt vor Trickbetrügern, die mit einer angeblichen Notlage des Kindes Eltern um ihr Geld bringen. --------------------------------------------- https://www.golem.de/news/kriminalitaet-eltern-durch-whatsapp-betrug-um-tau… ∗∗∗ Securing IoT devices against attacks that target critical infrastructure ∗∗∗ --------------------------------------------- South Staffordshire PLC, a company that supplies water to over one million customers in the United Kingdom, notified its customers in August of being a target of a criminal cyberattack. This incident highlights the sophisticated threats that critical industries face today. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2022/10/21/securing-iot-devic… ∗∗∗ rtfdumps Find Option, (Sat, Oct 22nd) ∗∗∗ --------------------------------------------- Due to the nature of the RTF language, malicious RTF files can be very obfuscated. To the point that my tool rtfdump.py and Philippe's tool rtfobj don't find embedded objects. --------------------------------------------- https://isc.sans.edu/diary/rss/29174 ∗∗∗ C2 Communications Through outlook.com, (Mon, Oct 24th) ∗∗∗ --------------------------------------------- Most malware implements communication with their C2 server over HTTP(S). Why? Just because it works! But they are multiple ways to implement C2 communications: DNS, P2P, Layer 7 (Twitter), ... Another one that has become less popular with time is SMTP (email communications). I spotted a malicious Python script that exchanges information with its C2 server through emails. --------------------------------------------- https://isc.sans.edu/diary/rss/29180 ∗∗∗ SCuBA M365 Security Baseline Assessment Tool ∗∗∗ --------------------------------------------- Developed by CISA, this assessment tool verifies that an M365 tenant’s configuration conforms to the policies described in the SCuBA Minimum Viable Secure Configuration Baseline documents. --------------------------------------------- https://github.com/cisagov/ScubaGear ∗∗∗ Cisco ISE: Angreifer könnten Kontrolle übernehmen ∗∗∗ --------------------------------------------- Cisco warnt, dass Angreifer Dateien in der Identity Services Engine lesen und löschen könnten. Die Übernahme der Kontrolle über die Geräte könnte möglich sein. --------------------------------------------- https://heise.de/-7317442 ∗∗∗ Gebrauchtwagen-Kauf: Abwicklung über Treuhandunternehmen ist Betrug ∗∗∗ --------------------------------------------- Sie sind gerade auf der Suche nach einem Gebrauchtwagen? Bedenken Sie: Nicht jedes Inserat ist seriös. Auch Kriminelle nutzen gängige Verkaufsplattformen, um betrügerische Lockangebote zu platzieren. Ein betrügerisches Angebot erkennen Sie an der Kommunikation und der Forderung, Geld an ein Treuhandkonto zu überweisen. --------------------------------------------- https://www.watchlist-internet.at/news/gebrauchtwagen-kauf-abwicklung-ueber… ∗∗∗ So funktioniert Domain Shadowing ∗∗∗ --------------------------------------------- Cyberkriminelle nutzen schwer auffindbare Shadow Domains für verschiedene illegale Aktivitäten, einschließlich Phishing und Botnet-Operationen. --------------------------------------------- https://www.zdnet.de/88404347/so-funktioniert-domain-shadowing/ ∗∗∗ AA22-294A: #StopRansomware: Daixin Team ∗∗∗ --------------------------------------------- The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) are releasing this joint CSA to provide information on the “Daixin Team,” a cybercrime group that is actively targeting U.S. businesses, predominantly in the Healthcare and Public Health (HPH) Sector, with ransomware and data extortion operations. --------------------------------------------- https://us-cert.cisa.gov/ncas/alerts/aa22-294a ∗∗∗ Treasure trove. Alive and well point-of-sale malware ∗∗∗ --------------------------------------------- Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals. --------------------------------------------- https://blog.group-ib.com/majikpos_treasurehunter_malware ∗∗∗ Attacking Very Weak RC4-Like Ciphers the Hard Way ∗∗∗ --------------------------------------------- RC4 is a popular encryption algorithm. The way it works is that a “Key Scheduling Algorithm” (KSA) takes your key and generates a 256-byte array, and then a “Pseudo-Random Generation Algorithm” (PRGA) uses that byte array to output an endless stream of bytes (the “key stream”), which look like random noise unless you know what the original byte array was. --------------------------------------------- https://research.checkpoint.com/2022/attacking-very-weak-rc4-like-ciphers-t… ∗∗∗ Uncovering Security Blind Spots in CNC Machines ∗∗∗ --------------------------------------------- Industry 4.0 has given rise to smart factories that have markedly improved machining processes, but it has also opened the doors for cybercriminals looking to abuse networked industrial equipment such as CNC machines. Our research investigates potential cyberthreats to CNC machines and how manufacturers can mitigate the associated risks. --------------------------------------------- https://www.trendmicro.com/en_us/research/22/j/uncovering-security-blind-sp… ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-10-21 and 2022-10-22 ∗∗∗ --------------------------------------------- IBM Cloud Pak for Watson, API Connect, IBM Cloud Pak for Multicloud Management, IBM MQ Appliance, IBM Voice Gateway, Infrastructure Automation, IBM Security Identity Manager. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bluez, kernel, and lava), Fedora (ckeditor, drupal7, moby-engine, php-Smarty, and wavpack), Mageia (bind, e2fsprogs, epiphany, freerdp, kernel, kernel-linus, libconfuse, libosip2, ntfs-3g, perl-Image-ExifTool, and poppler), Oracle (firefox, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, kernel, kernel-container, and thunderbird), Scientific Linux (firefox, java-1.8.0-openjdk, and java-11-openjdk), SUSE (bluez, firefox, kernel, libxml2, and Ubuntu (linux-gcp). --------------------------------------------- https://lwn.net/Articles/912178/ ∗∗∗ Missing Authentication in ZKTeco ZEM/ZMM Web Interface ∗∗∗ --------------------------------------------- The ZKTeco time attendance device does not require authentication to use theweb interface, exposing the database of employees and their credentials. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-003/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.10.2022
by Daily end-of-shift report 21 Oct '22

21 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 20-10-2022 18:00 − Freitag 21-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Synology: Kritische Lücken in NAS erlauben Angreifern Ausführen von Schadcode ∗∗∗ --------------------------------------------- Synology warnt vor kritischen Sicherheitslücken in der DSM-Software einiger NAS. Angreifer könnten Schadode ausführen und unbefugt an Informationen gelangen. --------------------------------------------- https://heise.de/-7316623 ∗∗∗ F5 BIG-IP und Nginx: Hersteller stopft teils kritische Sicherheitslücken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in den BIG-IP- und Nginx-Systemen von F5 könnten Angreifern etwa das Ausführen von Schadcode ermöglichen. Updates stehen bereit. --------------------------------------------- https://heise.de/-7316039 ∗∗∗ Gefahren für kritische Infrastrukturen: "Uns fehlt eine Schwachstellenanalyse" ∗∗∗ --------------------------------------------- Prof. Norbert Gebbeken, Gründer und Sprecher des Forschungszentrums RISK, über die Gefahren, die unserer kritischen Infrastruktur drohen – und was man tun kann. --------------------------------------------- https://heise.de/-7315119 ∗∗∗ Your Microsoft Exchange Server Is a Security Liability ∗∗∗ --------------------------------------------- Endless vulnerabilities. Massive hacking campaigns. Slow and technically tough patching. Its time to say goodbye to on-premise Exchange. --------------------------------------------- https://www.wired.com/story/microsoft-exchange-server-vulnerabilities/ ∗∗∗ sczriptzzbn inject pushes malware for NetSupport RAT, (Fri, Oct 21st) ∗∗∗ --------------------------------------------- A campaign nicknamed "sczriptzzbn inject" can be identified by script using a variable named sczriptzzbn injected into files returned from a compromised website. This injected script causes a fake browser update page to appear in the victim's browser. The fake browser update page presents the malware payload for download. More information on the campaign can be found here. In previous weeks, this campaign pushed SolarMarker malware. I ran across one such example on 2022-09-27. This month, we've started seeing a payload for NetSupport RAT from the sczriptzzbn inject. --------------------------------------------- https://isc.sans.edu/diary/rss/29170 ∗∗∗ Archive Sidestepping: Emotet Botnet Pushing Self-Unlocking Password-Protected RAR ∗∗∗ --------------------------------------------- Trustwave SpiderLabs’ spam traps have identified an increase in threats packaged in password-protected archives with about 96% of these being spammed by the Emotet Botnet. In the first half of 2022, we identified password-protected ZIP files as the third most popular archive format used by cybercriminals to conceal malware. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sid… ∗∗∗ Wordfence Evasion Malware Conceals Backdoors ∗∗∗ --------------------------------------------- Malware authors, with some notable exceptions, tend to design their malicious code to hide from sight. The techniques they use help their malware stay on the victim’s website for as long as possible and ensure execution. For example — obfuscation techniques, fake code comments, naming conventions for injections that deploy SEO spam, redirect visitors to malicious third party websites, or steal credit card information from eCommerce stores. --------------------------------------------- https://blog.sucuri.net/2022/10/wordfence-evasion-malware-conceals-backdoor… ∗∗∗ Multiple Campaigns Exploit VMware Vulnerability to Deploy Crypto Miners and Ransomware ∗∗∗ --------------------------------------------- A now-patched vulnerability in VMware Workspace ONE Access has been observed being exploited to deliver both cryptocurrency miners and ransomware on affected machines. "The attacker intends to utilize a victims resources as much as possible, not only to install RAR1Ransom for extortion, but also to spread GuardMiner to collect cryptocurrency," Fortinet FortiGuard Labs researcher Cara Lin said in a Thursday report. --------------------------------------------- https://thehackernews.com/2022/10/multiple-campaigns-exploit-vmware.html ∗∗∗ Threat Advisory: Monitoring CVE-2022-42889 “Text4Shell” Exploit Attempts ∗∗∗ --------------------------------------------- On October 17, 2022, the Wordfence Threat Intelligence team began monitoring for activity targeting CVE-2022-42889, or “Text4Shell” on our network of 4 million websites. We started seeing activity targeting this vulnerability on October 18, 2022. Text4Shell is a vulnerability in the Apache Commons Text library versions 1.5 through 1.9 that can be used to achieve [...] --------------------------------------------- https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-… ∗∗∗ CISA Tells Organizations to Patch Linux Kernel Vulnerability Exploited by Malware ∗∗∗ --------------------------------------------- The US Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a Linux kernel flaw to its Known Exploited Vulnerabilities Catalog and instructed federal agencies to address it within three weeks. --------------------------------------------- https://www.securityweek.com/cisa-tells-organizations-patch-linux-kernel-vu… ∗∗∗ Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool ∗∗∗ --------------------------------------------- Exbyte is the latest tool developed by ransomware attackers to expedite data theft from victims. --------------------------------------------- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bl… ∗∗∗ Attackers Abusing Various Remote Control Tools ∗∗∗ --------------------------------------------- Ordinarily, attackers install malware through various methods such as spear phishing emails with a malicious attachment, malvertising, vulnerabilities, and disguising the malware as normal software and uploading them to websites. The malware that is installed include infostealers which steal information from the infected system, ransomware which encrypts files to demand ransom, and DDoS Bots which are used in DDoS attacks. In addition to these, backdoor and RAT are also major programs used by attackers. --------------------------------------------- https://asec.ahnlab.com/en/40263/ ===================== = Vulnerabilities = ===================== ∗∗∗ IBM Security Bulletins 2022-10-20 ∗∗∗ --------------------------------------------- IBM Security Verify Gateway/Bridge, IBM Enterprise Records, IBM Sterling Order Management Netty, IBM WebSphere Application Server, IBM MQ Operator, IBM Sterling Order Management, IBM Enterprise Records, IBM Netezza Host Management. --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ SolarWinds Security Advisories 2022-10-19 ∗∗∗ --------------------------------------------- SolarWinds released 4 new Security Advisories (3 high, 1 medium) for SolarWinds Platform 2022.4 RC1. --------------------------------------------- https://www.solarwinds.com/trust-center/security-advisories ∗∗∗ SSA-640732 V1.0: Authentication Bypass Vulnerability in Siveillance Video Mobile Server ∗∗∗ --------------------------------------------- The mobile server component of Siveillance Video 2022 R2 contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to access the application without a valid account.Siemens has released a hotfix for Siveillance Video 2022 R2 and recommends to apply the hotfix on all installations of the mobile server. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-640732.txt ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (poppler), Oracle (firefox and thunderbird), Red Hat (firefox, java-1.8.0-openjdk, java-11-openjdk, and java-17-openjdk), SUSE (bind, clone-master-clean-up, grafana, libksba, python3, tiff, and v4l2loopback), and Ubuntu (libreoffice). --------------------------------------------- https://lwn.net/Articles/911989/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.10.2022
by Daily end-of-shift report 20 Oct '22

20 Oct '22

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 19-10-2022 18:00 − Donnerstag 20-10-2022 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Forensic Value of Prefetch, (Thu, Oct 20th) ∗∗∗ --------------------------------------------- When a program executes on a Windows system there are many artifacts that are generated which can assist digital forensic investigations. One of particular note is the Windows Prefetch file. Found in C:\Windows\Prefetch by default, prefetch files (.pf) contain a wealth of information that can prove vital to any investigation. --------------------------------------------- https://isc.sans.edu/diary/rss/29168 ∗∗∗ Fantastic Rootkits: And Where to Find Them (Part 1) ∗∗∗ --------------------------------------------- In this blog series, we will cover the topic of rootkits — how they are built and the basics of kernel driver analysis — specifically on the Windows platform. In this first part, we will focus on some implementation examples of basic rootkit functionality and the basics of kernel driver development, as well as Windows Internals background needed to understand the inner workings of rootkits. --------------------------------------------- https://www.cyberark.com/resources/threat-research-blog/fantastic-rootkits-… ∗∗∗ Microsoft liefert Updates gegen SSL-/TLS-Probleme durch Windows-Updates ∗∗∗ --------------------------------------------- Die aktuellen Windows-Updates für Windows 10, 11 und Server könnten Probleme bei SSL- und TLS-Verschlüsselung verursachen. Teils helfen weitere Patches dagegen. --------------------------------------------- https://heise.de/-7314906 ∗∗∗ New Malicious Clicker found in apps installed by 20M+ users ∗∗∗ --------------------------------------------- Cybercriminals are always after illegal advertising revenue. As we have previously reported, we have seen many mobile malwares masquerading as a useful tool or utility, and automatically crawling ads in the background. Recently the McAfee Mobile Research Team has identified new Clicker malware that sneaked into Google Play. --------------------------------------------- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/new-malicious-clicker-… ∗∗∗ Social Engineering dos and don’ts ∗∗∗ --------------------------------------------- It got me thinking, again, about what makes for good social engineering (SE), and what advice would I give my younger self. These are my thoughts. --------------------------------------------- https://www.pentestpartners.com/security-blog/social-engineering-dos-and-do… ∗∗∗ E-Mail-Konto wird migriert: Kriminelle senden betrügerische Mail an Mitarbeiter:innen ∗∗∗ --------------------------------------------- Kriminelle versenden betrügerische E-Mails und geben sich dabei als „Outlook-E-Mail-Administrator“ Ihres Unternehmens aus. Angeblich sollen die E-Mail-Konten aller Mitarbeiter:innen migriert werden. Klicken Sie nicht auf den Link. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-konto-wird-migriert-kriminell… ∗∗∗ Datenleck bei Microsoft, Kundendaten betroffen (Okt. 2022) ∗∗∗ --------------------------------------------- Bei Microsoft hat es ein größeres Datenleck gegeben, bei dem Kundendaten wohl öffentlich zugreifbar waren. Eine Sicherheitsfirma hat einen fehlkonfigurierten Server mit den Daten im Internet gefunden und Microsoft im September informiert. --------------------------------------------- https://www.borncity.com/blog/2022/10/20/datenleck-bei-microsoft-kundendate… ∗∗∗ Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them ∗∗∗ --------------------------------------------- Cisco Talos recently discovered several vulnerabilities in the Abode Systems iota All-In-One Security Kit. This kit includes a main security camera and hub that can alert users of unwanted movement in their homes. It also includes several motion sensors that can be attached to windows and doors. --------------------------------------------- http://blog.talosintelligence.com/2022/10/vuln-spotlight-abode-.html ∗∗∗ LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for Over a Year ∗∗∗ --------------------------------------------- Checkmarx discovered ~200 malicious NPM packages with thousands of installations linked to an attack group called “LofyGang”. --------------------------------------------- https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organiz… ∗∗∗ New Research: We’re Still Terrible at Passwords; Making it Easy for Attackers ∗∗∗ --------------------------------------------- We look at two of the most popular protocols used for remote administration, SSH and RDP, to get a sense of how attackers are taking advantage of weaker password management to gain access to systems. --------------------------------------------- https://www.rapid7.com/blog/post/2022/10/20/new-research-were-still-terribl… ∗∗∗ Black Basta and the Unnoticed Delivery ∗∗∗ --------------------------------------------- As reported by Check Point at the end of H1 2022, 1 out of 40 organizations worldwide were impacted by ransomware attacks, which constitutes a worrying 59% increase over the past year. The ransomware business continues to grow in gargantuan proportions due to the lucrative payments demanded – and often received – by cybercrime gangs. --------------------------------------------- https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/ ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Oracle liefert 370 Sicherheitsupdates im Oktober ∗∗∗ --------------------------------------------- Zum Patchday, Critical Patch Update genannt, liefert Oracle eine lange Liste an Produkten mit Sicherheitslücken. 370 Updates schließen die Schwachstellen. --------------------------------------------- https://heise.de/-7314209 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr), Red Hat (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, OpenShift Container Platform 4.9.50 bug fix and, and rh-nodejs14-nodejs), SUSE (buildah, clone-master-clean-up, go1.18, go1.19, helm, jasper, libostree, nodejs16, php8, qemu, and xen), and Ubuntu (libxdmcp, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oem-5.14, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gke, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-oem-5.17, and perl). --------------------------------------------- https://lwn.net/Articles/911879/ ∗∗∗ Drupal: Search API - Moderately critical - Information Disclosure - SA-CONTRIB-2022-059 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2022-059 ∗∗∗ Security Bulletin: IBM MQ is affected by an identity spoofing issue in IBM WebSphere Application Server Liberty (CVE-2022-22475) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-affected-by-an-… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to multiple vulnerabilities due to IBM Java ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-connectdirec… ∗∗∗ Security Bulletin: IBM Sterling B2B Integrator B2B API vulnerable to multiple issues due to Apache Zookeeper (CVE-2019-0201, CVE-2021-21409) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-sterling-b2b-integrat… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM WebSphere Application Server April 2022 CPU that is bundled with IBM WebSphere Application Server Patterns ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Apache log4j security vulnerability as it relates to IBM Maximo Scheduler Optimization – Apache Log4j – [CVE-2021-45105] (affecting v2.16) and [CVE-2021-45046] (affecting v2.15) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-log4j-security-vul… ∗∗∗ F5: K24823443: Apache Commons Text vulnerability CVE-2022-42889 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K24823443 ∗∗∗ F5: K27155546: BIND vulnerability CVE-2022-38177 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K27155546 ∗∗∗ F5: K04712583: Linux kernel vulnerability CVE-2021-40490 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K04712583 ∗∗∗ F5: K32615023: Linux kernel vulnerability CVE-2022-2588 ∗∗∗ --------------------------------------------- https://support.f5.com/csp/article/K32615023 ∗∗∗ Bentley Systems MicroStation Connect ∗∗∗ --------------------------------------------- https://us-cert.cisa.gov/ics/advisories/icsa-22-293-01 ∗∗∗ Spring: CVE-2022-31684: Reactor Netty HTTP Server may log request headers ∗∗∗ --------------------------------------------- https://spring.io/blog/2022/10/20/cve-2022-31684-reactor-netty-http-server-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily