- Daily - CERT.at

Tageszusammenfassung - Dienstag 8-09-2015
by Daily end-of-shift report 08 Sep '15

08 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-09-2015 18:00 − Dienstag 08-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The state of Ransomware in 2015 *** --------------------------------------------- Ransomware has been a threat for quite some years, although the ransomware as its currently known, encrypting files, has only been around a few years. This change started with the initial 2013 CryptoLocker infections authored by the .. --------------------------------------------- http://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/ *** Adult Player: Porno-App erpresst Android-Nutzer mit Selfies *** --------------------------------------------- Die Porno-App Adult Player schießt ein Selbstporträt des Nutzers, sperrt das Smartphone und fordert zur Zahlung von 500 US-Dollar auf. Nutzer können sich mit einfachen Mitteln schützen. --------------------------------------------- http://www.golem.de/news/adult-player-porno-app-erpresst-android-nutzer-mit… *** Sofacy Recycles Carberp and Metasploit Code *** --------------------------------------------- The Sofacy Group (also known as Pawn Storm or APT28) is well known for deploying zero-day exploits in their APT campaigns. For example, two recent zero-days used by the Sofacy Group were exploiting vulnerabilities in Microsoft .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasp… *** Unauthenticated Path Disclosure *** --------------------------------------------- It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation. --------------------------------------------- http://www.typo3.org/news/article/unauthenticated-path-disclosure/ *** Jeep-Hack: Fiat Chrysler ruft weitere Modelle zurück *** --------------------------------------------- Aufgrund einer Sicherheitslücke im Infotainmentsystem ruft Fiat Chrysler in den USA 7810 SUV-Modelle zurück. Davon sollen sich rund die Hälfte noch bei Händlern befinden, die das Update vor dem Verkauf einspielen können. Nach Bekanntwerden .. --------------------------------------------- http://heise.de/-2807879 *** Ashley Madison, Why Do Our Honeypots Have Accounts On Your Website? *** --------------------------------------------- She is 33 years old, from Los Angeles, 6 feet tall, sexy, aggressive, and a 'woman who knows what she wants', according to her profile. She is intriguing. However, her intrigue doesn't end .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ashley-madison-w… *** Cyber Security - Getting the Message *** --------------------------------------------- There is a concept in the health and safety industry known as 'sign blindness'. This occurs when safety notices become so numerous, or so familiar, that the human brain simply filters .. --------------------------------------------- https://blog.team-cymru.org/2015/09/cyber-security-getting-the-message/ *** FireEye untersucht Root-Lücken in Sicherheits-Appliances *** --------------------------------------------- Sicherheitsforscher hatten schwerwiegende Lücken in den Appliances der Firma entdeckt. Ihre Hinweise blieben nach eigenen Angaben 18 Monate lang unbeantwortet. FireEye sagt, man wisse erst seit Montag von den Lücken. --------------------------------------------- http://heise.de/-2807930 *** iOS 8.4.1 Kernel Vulnerabilities in AppleHDQGasGaugeControl *** --------------------------------------------- When auditing iOS kernel executable, we found that the code quality of com.apple.driver.AppleHDQGasGaugeControl is very bad. In this blog, we will disclose 3 vulnerabilities in this kernel extension on the latest public iOS (version 8.4.1). More .. --------------------------------------------- http://blog.pangu.io/ios-8-4-1-kernel-vulns/ *** WhatsApp 'MaliciousCard' Vulnerabilities Allowed Attackers to Compromise Hundreds of Millions of WhatsApp Users *** --------------------------------------------- WhatsApp Web is a web-based extension of the WhatsApp application on your phone. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. --------------------------------------------- http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilitie… *** Security Update Available for Adobe Shockwave Player (APSB15-22) *** --------------------------------------------- A security bulletin (APSB15-22) has been published regarding a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1268

1 0

Tageszusammenfassung - Montag 7-09-2015
by Daily end-of-shift report 07 Sep '15

07 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-09-2015 18:00 − Montag 07-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Custom packer defeats multiple automation systems *** --------------------------------------------- Combination of anti-automation, anti-VM and anti-reverse engineering to make researchers lives harder.Ever since the number of new malware samples became so large we could no longer list them in Virus Bulletin magazine, security researchers .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_04.xml *** Neutrino exploit used to inject Teslascrypt into sites using outdated CMS tools *** --------------------------------------------- Heimdal Security reported an increase in malicious scripts infecting legitimate websites that then redirect the victim to the Neurtino exploit kit server that could potentially impact more than 400 million web users. --------------------------------------------- http://www.scmagazine.com/outdated-websites-deliver-teslacrypt-via-neutrino… *** Firefox-Sicherheitslücken: Angreifer hatte Zugriff auf Mozilla-Bugtracker *** --------------------------------------------- Ein priviligierter Account für den Mozilla-Bugtracker ist unter der Kontrolle eines Angreifers gewesen. Dadurch gelang es diesem, Informationen über noch nicht behobene Sicherheitslücken in Firefox zu erhalten. --------------------------------------------- http://www.golem.de/news/firefox-sicherheitsluecken-angreifer-hatte-zugriff… *** Extorting money from Ashley Madison customers is actually pretty easy *** --------------------------------------------- 1.05 bitcoins, or $243, is a low enough price to avoid further embarrassment. In the wake of the recent Ashley Madison e-mail dump, some customers have gotten demand e-mails like .. --------------------------------------------- http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madison… *** Baby-Monitore sind leicht zu hacken *** --------------------------------------------- Wie ein Sicherheitsforscher herausfand, sind acht von neun Babyfons mit Internet-Verbindung relativ einfach als Spionage-Kameras einsetzbar. --------------------------------------------- http://futurezone.at/digital-life/baby-monitore-sind-leicht-zu-hacken/151.0… *** Auto-Hacking: Kritik an Sicherheitsupdates per Post *** --------------------------------------------- Wie stopft man kritische Sicherheitslücken in der Software von Autos? Nach Ansicht eines Sicherheitsexperten ist der von Fiat Chrysler gewählte Weg eine Einladung an Hacker. --------------------------------------------- http://www.golem.de/news/auto-hacking-kritik-an-sicherheitsupdates-per-post… *** Files on Seagate wireless disks can be poisoned, purloined *** --------------------------------------------- Download everything, seed with malware, move on to next sucker CERT.org has reported Seagate wireless hard drives include 'undocumented Telnet services' accessible with a hard-coded password and allowing unrestricted file .. --------------------------------------------- www.theregister.co.uk/2015/09/07/files_on_seagate_wireless_disks_can_be_poi… *** CryptDB: Angriff auf verschlüsselte Datenbanken *** --------------------------------------------- Ein Team von Microsoft-Wissenschaftlern hat einen Angriff auf die verschlüsselte Datenbank-Software CryptDB vorgestellt. Als Demonstrationsobjekt nutzte es US-Gesundheitsdatenbanken. Ein ehemaliger Entwickler kritisiert den Angriff jedoch als unrealistisch. --------------------------------------------- http://www.golem.de/news/cryptdb-angriff-auf-verschluesselte-datenbanken-15… *** Arrests Tied to Citadel, Dridex Malware *** --------------------------------------------- Authorities in Europe have arrested alleged key players behind the development and deployment of ultra-sophisticated banking malware, including Citadel and Dridex. The arrests involved a Russian national and a Moldovan man, both of whom were traveling .. --------------------------------------------- http://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/ *** Crypto-trouble in Poison Ivys C2 protocol *** --------------------------------------------- During the course of some research regarding the security of RAT C2 protocols and infrastructure i came across a stack buffer overflow disclosed in 2011 (OSVDB-83774) affecting the C2 server component of the Poison Ivy RAT. Poison Ivy (PIVY) is a golden oldie RAT probably everyone in infosec circles is familiar .. --------------------------------------------- https://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploit… *** Ghost Got Secrets - Ghostbins Guts Part 1 *** --------------------------------------------- Privacy and anonymity are critical tools for maintaining freedom in our growingly-digital world. Even so, privacy and anonymity are commonly used by individuals performing malicious activities. These two sides of the same coin are what .. --------------------------------------------- http://l.avala.mp/blog/ghost-got-secrets-ghostbins-guts-part-1/

1 0

Tageszusammenfassung - Freitag 4-09-2015
by Daily end-of-shift report 04 Sep '15

04 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-09-2015 18:00 − Freitag 04-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** More Adult Themed Android Ransomware *** --------------------------------------------- During the course of our daily malware hunt, we came across a new mobile ransomware variant that leverages pornography to lure victims into downloading and installing it. Wed previously .. --------------------------------------------- http://research.zscaler.com/2015/09/more-adult-themed-android-ransomware.ht… *** Analyzing Popular Layer 7 Application DDoS Attacks *** --------------------------------------------- Distributed Denial of Service (DDoS) attacks have been a major concern for website owners for a while. All types of sites, from small to big, have been taken down and kept offline because of them. Even over-provisioned servers can be .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-popular-layer-7-application-ddos-… *** Cogent DataHub Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-01 *** Schneider Electric Modicon PLC Vulnerabilities *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-224-02 Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities that was published August 12, 2015, to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in the Schneider Electric Modicon PLC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 *** Moxa Industrial Managed Switch Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Moxa EDS-405A/EDS-408A series managed Ethernet switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03 *** SMA Solar Technology AG Sunny WebBox Hard-coded Account Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a hard-coded account vulnerability in the SMA Solar Technology AG Sunny WebBox product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02 *** APPLE-SA-2015-09-03-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 18.0.0.232. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Sep/msg00000.ht… *** Google, Mozilla, Microsoft to Sever RC4 Support in Early 2016 *** --------------------------------------------- Google and Mozilla today announced they've settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. --------------------------------------------- http://threatpost.com/google-mozilla-microsoft-to-sever-rc4-support-in-earl… *** How to Kick-Out the Bad Guy? *** --------------------------------------------- A quick blog post about an issue I faced this morning. While drinking my morning coffee and reviewing what happened during the last night in my logs, I detected that one of my website (leakedin.com) was entirely mirrored by a guy from Brazil. I'm not against sharing information but in this case, it was consuming bandwidth and server resources for nothing. I was time to .. --------------------------------------------- https://blog.rootshell.be/2015/09/04/kick-bad-guy/ *** CVE-2014-7216: A Journey Through Yahoo's Bug Bounty Program *** --------------------------------------------- I have published another security advisory about a vulnerability, which I have 'recently' reported to Yahoo! via their Bug-Bounty program hosted by HackerOne. So this blog post is about the technical details of the CVE-2014-7216 (which is not very thrilling), but more about my experience with Yahoo's Bug Bounty program. --------------------------------------------- https://www.rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-… *** LinkedIn Sockpuppets Are Targeting Security Researchers *** --------------------------------------------- Multiple LinkedIn accounts recently targeted numerous security specialists in an attempt to map their social graphs. Several of our researchers received these LinkedIn invitations themselves and Daavid from our Threat Intelligence team decided to investigate. Here's an example of one so-called 'recruiter' account. --------------------------------------------- https://labsblog.f-secure.com/2015/09/03/linkedin-sockpuppets-targeting-sec… *** Office Malware: AGB gegen Spammer *** --------------------------------------------- Ein russischer Entwickler möchte nicht, dass seine Office Malware MWI von Spammern verwendet wird. Doch seine allgemeinen Geschäftsbedingungen zeigen nur begrenzt Wirkung. Ein kurioser Blick in den Malware-Markt. --------------------------------------------- http://www.golem.de/news/office-malware-agb-gegen-spammer-1509-116130.html *** Sleepy Puppy: Netflix-Tool jagt XXS-Lücken *** --------------------------------------------- Sicherheitsforscher können mit Sleepy Puppy tief in Netzwerken graben und an verschiedenen Stellen Schwachstellen für Cross-Site-Scripting ausfindig machen. --------------------------------------------- http://heise.de/-2805316 *** Nach Erpressungsversuch: Webhoster 1blu tauscht tausende SSL-Zertifikate *** --------------------------------------------- Vor zwei Monaten Erfuhr die Hosting-Firma, dass sich ein Angreifer weitreichenden Zugriff auf Kundendaten verschaffen konnte. Jetzt stellt sich heraus, dass offenbar auch die SSL-Zertifikate der Kunden betroffen sind. --------------------------------------------- http://heise.de/-2803573

1 0

Tageszusammenfassung - Donnerstag 3-09-2015
by Daily end-of-shift report 03 Sep '15

03 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-09-2015 18:00 − Donnerstag 03-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Neuer Banking-Trojaner taucht auch in Österreich auf *** --------------------------------------------- IBM-Forscher haben mit "Shifu" einen neuen Trojaner identifiziert, der es auf Banken aus Deutschland, Japan und Österreich abgesehen hat. --------------------------------------------- http://futurezone.at/digital-life/neuer-banking-trojaner-taucht-auch-in-oes… *** New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe *** --------------------------------------------- New variants of the notorious Carbanak Trojan has surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers at Kaspersky Lab earlier this year revealed the... --------------------------------------------- http://threatpost.com/new-versions-of-carbanak-banking-malware-seen-hitting… *** Cross-Site-Scripting: Netflix stellt Tool zum Auffinden von Sicherheitslücken vor *** --------------------------------------------- Der Streamingdienst Netflix erstellt nicht nur aufwendige Eigenproduktionen, sondern entwickelt auch Sicherheitstools. Jetzt hat das Unternehmen ein Werkzeug zum Auffinden von Schwächen von Cross-Site-Scripting vorgestellt. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-netflix-stellt-tool-zum-auffi… *** New Android Ransomware Communicates over XMPP *** --------------------------------------------- A new strain of Android ransomware disguised as a video player app uses an instant messaging protocol called XMPP to receive commands and communicate with the command and control server. --------------------------------------------- http://threatpost.com/new-android-ransomware-communicates-over-xmpp/114530 *** CVE-2015-5722: Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c *** --------------------------------------------- Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bi… *** CVE-2015-5986: An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c *** --------------------------------------------- An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-tri… *** Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Symantec Ghost Explorer Utility Tool Out-of-Bounds Array Indexing *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** EMC Atmos XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033456 *** Bugtraq: [SYSS-2015-016] Avaya one-X Agent - Hard-coded Cryptographic Key *** --------------------------------------------- http://www.securityfocus.com/archive/1/536386 *** Bugtraq: Checkmarx CxQL Sandbox bypass (CVE-2014-8778) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536387 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java Runtime affect Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21965348 *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM Security Proventia Network Enterprise Scanner (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3216) *** http://www.ibm.com/support/docview.wss?uid=swg21965845 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Controller (CVE-2015-1793) *** http://www.ibm.com/support/docview.wss?uid=swg21965725 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Security Network Controller (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21964035 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Connect:Direct Browser User Interface *** http://www.ibm.com/support/docview.wss?uid=swg21965448 *** IBM Security Bulletin: Multiple Security Issues in IBM Media Server Due to OpenSSL Issues *** http://www.ibm.com/support/docview.wss?uid=swg21963783 *** IBM Security Bulletin: Multiple security vulnerabilities have been identified in IBM Security Identity Manager Virtual Appliance (CVE-2015-1788 and CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964241 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Flex System Power Compute Node Firmware (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022656 *** ZDI-15-418: (0Day) Borland AccuRev Reprise License Server edit_lf_process Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Ejh3XZSEdr0/ *** ZDI-15-417: (0Day) Borland AccuRev Reprise License Server edit_lf_get_data Command lf Parameter Path Traversal Read Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/hC9GLRY4Jiw/ *** ZDI-15-416: (0Day) Borland AccuRev Reprise License Server service_setup_doit Command Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/BQougUpI_Ys/ *** ZDI-15-415: (0Day) Borland AccuRev Reprise License Management Server Path Traversal Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/WM0upaoUI1c/ *** ZDI-15-414: (0Day) Borland AccuRev Reprise License Server activate_doit Command actserver Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Nr36Je9oEJU/ *** ZDI-15-413: (0Day) Borland AccuRev Reprise License Server diagnostics_doit Command outputfile Parameter File Overwrite Denial of Service Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/fhh7V-Xsyjc/ *** ZDI-15-412: (0Day) Borland AccuRev Reprise License Server activate_doit Command akey Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/q60XWhjbHKo/ *** ZDI-15-411: (0Day) Borland AccuRev SaveContentServiceImpl Servlet Path Traversal Remote File Read And Deletion Vulnerabilities *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/oMSmmw2PaFA/

1 0

Tageszusammenfassung - Mittwoch 2-09-2015
by Daily end-of-shift report 02 Sep '15

02 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-09-2015 18:00 − Mittwoch 02-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Demystifying File and Folder Permissions *** --------------------------------------------- If you have poked around a server before you have probably encountered file permissions. In fact, all computer file systems offer permissions based on the same core ideas. The file permissions in Linux, Mac, and Windows computers are very similar to the file and folder permissions in Apache, Nginx, and IIS servers. You can right-clickRead More The post Demystifying File and Folder Permissions appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/09/demystifying-file-and-folder-permissions.ht… *** Whats the situation this week for Neutrino and Angler EK?, (Wed, Sep 2nd) *** --------------------------------------------- Introduction Last month in mid-August 2015, an actor using Angler exploit kit (EK) switched to Neutrino EK [1]. A few days later, we found that actor using Angler again [2]. This week, were back to seeingNeutrino EK from the same actor. Neutrino EK from this actor is sending TeslaCrypt 2.0 as the payload. We also saw another actor use Angler EK to pushBedep during the same timeframe. Todays diary looks at two infection chains from Tuesday 2015-09-01, one for Angler EK and another for Neutrino. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20101&rss *** Verschlüsselung: Microsoft, Google und Mozilla schalten RC4 2016 ab *** --------------------------------------------- Es ist ein überfälliger Schritt: Microsoft, Google und Mozilla haben angekündigt, den unsicheren Verschlüsselungsalgorithmus RC4 ab 2016 in ihren Produkten endgültig nicht mehr zu verwenden. Ein konkretes Datum nennt bislang jedoch nur Mozilla. --------------------------------------------- http://www.golem.de/news/verschluesselung-microsoft-google-und-mozilla-scha… *** Per Web und USB-Stick: Smart-TVs vielfältig angreifbar *** --------------------------------------------- Mit vergleichsweise simplen Methoden haben Sicherheitsforscher App-Nutzerdaten von Medienabspielern und Smart TVs ausgelesen. Dabei konnten sie auch die Kamera aktivieren und bis auf die Root-Ebene vordringen. --------------------------------------------- http://heise.de/-2797227 *** Router-Lücken: Belkin N600 DB macht es den Hackern einfach *** --------------------------------------------- Die Beschreibung der Lücken in Belkins Heimrouter liest sich wie ein Handbuch mit Negativbeispielen der Firmware-Programmierung. Angreifer können die Nutzer des Routers unter anderem auf beliebige Webseiten umleiten. Abhilfe gibt es nicht. --------------------------------------------- http://heise.de/-2800853 *** IBM: CoreBot malware - simple but dangerous info stealer *** --------------------------------------------- IBMs X-Force research team has uncovered a new piece of data-swiping malware whose modular design allows it to be quickly altered and made even more dangerous. --------------------------------------------- http://www.scmagazine.com/x-force-team-uncovers-data-swiping-malware/articl… *** Factoring RSA Keys With TLS Perfect Forward Secrecy *** --------------------------------------------- What is being disclosed today? Back in 1996, Arjen Lenstra described an attack against an optimization (called the Chinese Remainder Theorem optimization, or RSA-CRT for short). If a fault happened during the computation of a signature (using the RSA-CRT optimization),... --------------------------------------------- https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perf… *** Adware-Installer erschleicht Zugriff auf den Mac-Schlüsselbund *** --------------------------------------------- Ein neuer Adware-Installer nutzt nach Angabe von Sicherheitsforschern einen simplen Trick, um sich ohne weiteres Zutun des Nutzers Zugang zum Schlüsselbund von OS X einzuräumen. --------------------------------------------- http://heise.de/-2802238 *** Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40748 *** VU#903500: Seagate 36C wireless hard-drive contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#903500 Seagate 36C wireless hard-drive contains multiple vulnerabilities Original Release date: 01 Sep 2015 | Last revised: 01 Sep 2015 Overview The Seagate 36C wireless hard-drive contains multiple vulnerabilities. Description CWE-798: Use of Hard-coded Credentials - CVE-2015-2874 The Seagate 36C wireless hard-drive provides undocumented Telnet services accessible by using the default credentials of root as username and the default password.CWE-425: Direct Request --------------------------------------------- http://www.kb.cert.org/vuls/id/903500 *** ZDI-15-408: Hewlett-Packard LoadRunner Controller Scenario File Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability could allow attackers to execute arbitrary code on vulnerable installations of HP LoadRunner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-408/ *** Siemens RUGGEDCOM ROS IP Forwarding Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an IP forwarding vulnerability in older versions of Siemens RUGGEDCOM ROS. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-244-01 *** Edimax BR6228nS/BR6228nC - Multiple vulnerabilities *** --------------------------------------------- Topic: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Risk: Medium Text:# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities # Date: 01.09.15 # Vendor: edimax.com # Firmware version: 1.22 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090013 *** Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23269]: Cross-Site Request Forgery in Cerb *** --------------------------------------------- Product: Cerb v7.0.3Vulnerability Type: Cross-Site Request Forgery [CWE-352]Risk level: Medium Creater: Webgroup Media LLCAdvisory Publication: August 12, 2015 [without technical details]Public Disclosure: September 2, 2015 CVE Reference: CVE-2015-6545 CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) Vulnerability Details: High-Tech Bridge Security Research Lab discovered CSRF vulnerability in Cerb platform, which can be exploited to perform Cross-Site Request Forgery attacks against --------------------------------------------- https://www.htbridge.com/advisory/HTB23269 *** DFN-CERT-2015-1353: Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1353/ *** Bugtraq: ESA-2015-137: EMC Atmos XML External Entity Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536377 *** SiS Windows VGA Display Manager Multiple Privilege Escalation *** --------------------------------------------- Topic: SiS Windows VGA Display Manager Multiple Privilege Escalation Risk: Medium Text:KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege Escalation Title: SiS Windows VGA Display Manager Mult... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090019 *** XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation *** --------------------------------------------- Topic: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Risk: Medium Text:KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Title: XGI Windows VGA Display Manag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090018 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2015-2613) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005343 *** IBM Security Bulletin: HTTP Request smuggling vulnerability may affect IBM HTTP Server (CVE-2015-3183) *** http://www.ibm.com/support/docview.wss?uid=swg21963361 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience *** http://www.ibm.com/support/docview.wss?uid=swg21960713 *** IBM Security Bulletin: IBM WebSphere MQ 7.0.1 potential denial of service (CVE-2015-2013) *** http://www.ibm.com/support/docview.wss?uid=swg21962479 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects TS3100/TS3200 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005368&myns=s034&m… *** IBM Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain information due to the autocomplete feature on password input fields (CVE-2015-1933) *** http://www.ibm.com/support/docview.wss?uid=swg21965080 *** IBM Security Bulletin: Default Password Requirements are weak on new installations of IBM Maximo Asset Management (CVE-2015-1934) *** http://www.ibm.com/support/docview.wss?uid=swg21964855 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098599

1 0

Tageszusammenfassung - Dienstag 1-09-2015
by Daily end-of-shift report 01 Sep '15

01 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 31-08-2015 18:00 − Dienstag 01-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How the SIEM Solution Can Help in Achieving PCI-DSS *** --------------------------------------------- We all know that PCI-DSS is one of the toughest compliances/certifications to hold, but organizations that seek to be PCI-DSS compliant can greatly benefit if they incorporate a SIEM solution around the Card Holder Data Environment (CDE). In this article, we will learn how the SIEM solution can be leveraged to satisfy a majority of... --------------------------------------------- http://resources.infosecinstitute.com/how-the-siem-solution-can-help-in-ach… *** Microsoft accused of adding spy features to Windows 7, 8 *** --------------------------------------------- The privacy impact of Windows telemetry features continues to be scrutinized. --------------------------------------------- http://arstechnica.com/information-technology/2015/08/microsoft-accused-of-… *** ORX Locker, the new Darknet Ransomware-as-a-service platform *** --------------------------------------------- Security experts at Sensecy have uncovered ORX-Locker, a Darknet Ransomware-as-a-service platform that could allow everyone to become a cyber criminal. It is becoming even easier to become a cyber-criminal thanks to the model of sale known as malware-as-a-service that offers off-the-shelf malware for rent or sale. Recently malware authors started to offer also Ransomware-as-a-Service (RaaS), in... --------------------------------------------- http://securityaffairs.co/wordpress/39753/cyber-crime/orx-locker-raas.html 3430 *** l+f: Simuliertes Firmennetz als Spielwiese für Hacker *** --------------------------------------------- Im simulierten Netzwerk des Penetration Test Lab kann man virtuellen Systemen mit echten Pentesting-Tools auf den Zahn fühlen. --------------------------------------------- http://heise.de/-2795897 *** Android: Mehr Smartphones mit vorinstallierter Malware *** --------------------------------------------- Zwischenhändler sollen immer mehr Modelle aus dem Android-Lager vor dem Verkauf manipulieren, indem sie beliebte Apps mit Malware-Komponenten ausstatten und auf den Geräten installieren. --------------------------------------------- http://heise.de/-2794608 *** MassVet finds unknown malicious apps in app stores in 10 Sec *** --------------------------------------------- A group of researchers have developed a method dubbed Mass Vetting (MassVet) to find unknown malicious apps in app stores in 10 Seconds. A group of University researchers has created a new method for detecting malicious apps running on an Android devices called MassVet. MassVet doesn't use the old method of signatures scanning, instead it compares... --------------------------------------------- http://securityaffairs.co/wordpress/39762/malware/massvet-android-scan.html *** iOS-Trojaner ermöglichte Einkauf im App Store mit gehackten Accounts *** --------------------------------------------- Palo Alto Networks hat Details zu der letzte Woche entdeckten Hintertür in mehreren in China verteilten Jailbreak-Apps und Tweaks genannt. Demnach arbeitet die Malware äußerst trickreich. Gestohlen wurden 225.000 iCloud-Accounts. --------------------------------------------- http://heise.de/-2795857 *** Tired of memorizing passwords? A Turing Award winner came up with this algorithmic trick *** --------------------------------------------- Passwords are a bane of life on the Internet, but one Turing Award winner has an algorithmic approach that he thinks can make them not only easier to manage but also more secure.The average user has some 20 passwords today, and in general the easier they are to remember, the less secure they are. When passwords are used across multiple websites, they become even weaker.Manuel Blum, a professor of computer science at Carnegie Mellon University who won the Turing Award in 1995, has been working... --------------------------------------------- http://www.csoonline.com/article/2978170/data-protection/tired-of-memorizin… *** What Can you Learn from Metadata? *** --------------------------------------------- An Australian reporter for the ABC, Will Ockenden published a bunch of his metadata, and asked people to derive various elements of his life. They did pretty well, even though they were amateurs, which should give you some idea what professionals can do.... --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/what_can_you_le.html *** Cisco AsyncOS for Cisco Email Security Appliance and Cisco Web Security Appliance Cluster Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39785 *** Cisco ASR 1000 Series Aggregation Services Routers Data-Plane Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40708 *** DSA-3346 drupal7 - security update *** --------------------------------------------- Several vulnerabilities were discovered in Drupal, a content managementframework: --------------------------------------------- https://www.debian.org/security/2015/dsa-3346 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_gb *** Bugtraq: [security bulletin] HPSBMU03401 rev.1 - HP Operations Manager for UNIX and Linux, Remote Unauthorized Modification, Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536363 *** Bugtraq: [security bulletin] HPSBGN03403 rev.1 - HP Virtualization Performance Viewer, Remote Unauthorized Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536364 *** DFN-CERT-2015-1329: MediaWiki: Mehrere Schwachstellen ermöglichen u.a. einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1329/ *** Security Advisory: Apache HTTP server vulnerability CVE-2008-0455 *** --------------------------------------------- (SOL17201) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/200/sol17201.htm… *** USN-2727-1: GnuTLS vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2727-11st September, 2015gnutls28 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04SummaryGnuTLS could be made to crash or run programs if it processed a speciallycrafted certificate.Software description gnutls28 - GNU TLS library DetailsIt was discovered that GnuTLS incorrectly handled parsing CRL distributionpoints. A remote attacker could possibly use this issue to cause a denialof service, or execute arbitrary --------------------------------------------- http://www.ubuntu.com/usn/usn-2727-1/ *** USN-2726-1: Expat vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2726-131st August, 2015expat vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryExpat could be made to crash or run programs as your login if it opened aspecially crafted file.Software description expat - XML parsing C library DetailsIt was discovered that Expat incorrectly handled malformed XML data. If auser or application linked against Expat were tricked into opening acrafted --------------------------------------------- http://www.ubuntu.com/usn/usn-2726-1/ *** VU#361684: Router devices do not implement sufficient UPnP authentication and security *** --------------------------------------------- Vulnerability Note VU#361684 Router devices do not implement sufficient UPnP authentication and security Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Home routers implementing the UPnP protocol do not sufficiently randomize UUIDs in UPnP control URLs, or implement other UPnP security measures. Description The UPnP protocol allows automatic device discovery and interaction with devices on a network. The UPnP protocol was originally designed with the threat model of --------------------------------------------- http://www.kb.cert.org/vuls/id/361684 *** VU#201168: Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#201168 Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Belkin N600 DB Wireless Dual Band N+ router, model F9K1102 v2 with firmware version 2.10.17 and possibly earlier, contains multiple vulnerabilities. Description CWE-330: Use of Insufficiently Random Values - CVE-2015-5987DNS queries originating from the Belkin N600, such as those to resolve the names of firmware --------------------------------------------- http://www.kb.cert.org/vuls/id/201168

1 0

Tageszusammenfassung - Montag 31-08-2015
by Daily end-of-shift report 31 Aug '15

31 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-08-2015 18:00 − Montag 31-08-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** OWASP veröffentlicht Handbuch zum Schutz gegen automatisierte Angriffe *** --------------------------------------------- Als Hilfe für das Absichern von Webanwendungen hat die Non-Profit-Organisation OWASP ein Handbuch für Entwickler herausgebracht, das bislang wenig beachtete Angriffe beschreibt. --------------------------------------------- http://heise.de/-2794167 *** Spionage-Trojaner Regin: Symantec entdeckt 49 weitere Module *** --------------------------------------------- Das Sicherheitsunternehmen Symantec hatte Ende des vergangenen Jahres die Ausspähungssoftware "Regin" entdeckt. Nun warten die Experten mit neuen Einzelheiten auf. --------------------------------------------- http://heise.de/-2794176 *** Linux Foundation releases PARANOID internal infosec guide *** --------------------------------------------- Workstation security tips for system administrators. Linux Foundation project director Konstantin Ryabitsev has publicly-released the penguinistas internal hardening requirements to help sysadmins and other paranoid tech bods and system administrators secure their workstations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/31/harden_like… *** Detecting file changes on Microsoft systems with FCIV, (Mon, Aug 31st) *** --------------------------------------------- Microsoft releases often interesting tools to help system administrators and incident handlers to investigate suspicious activities on Windows systems. In 2012, they released a free tool called FCIV(File Checksum Integrity Verifier)(1). It is a stand alone executable which does not require any DLL or other resources. Just launch it from any location.Its goal is to browse a file system or some directories recursively and to generate MD5/SHA1 hashes of all the files found. The results are saved in a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20091&rss *** Schwachstellen in Kontrollsoftware von Kraftwerken und Raffinerien *** --------------------------------------------- Siemens und Schneider Electric haben eine Reihe von Lücken in SCADA-Systemen geschlossen. Zum Teil kommt die betroffene Software auch in deutschen Kraftwerken zum Einsatz. --------------------------------------------- http://heise.de/-2794724 *** Security: Standardpasswörter bei Heimroutern entdeckt *** --------------------------------------------- Mindestens fünf Router diverser Hersteller haben leicht zu erratene Standardpasswörter für den administrativen Zugang. Mit ihnen lassen sich die Geräte aus der Ferne manipulieren. --------------------------------------------- http://www.golem.de/news/security-standardpasswoerter-bei-heimroutern-entde… *** Contributor Conference: Owncloud führt Programm für Bug-Bounties ein *** --------------------------------------------- Hacker können nun auch mit der Sicherheitsprüfung von Owncloud Geld verdienen. Die Prämien können sich allerdings noch nicht mit denen von großen Unternehmen wie Google oder Microsoft messen. --------------------------------------------- http://www.golem.de/news/contributor-conference-owncloud-fuehrt-programm-fu… *** Whos afraid of shadow IT? *** --------------------------------------------- One of the biggest disruptions in the IT world is the quantity and quality of SaaS tools. From email and storage, to phone systems and infrastructure, it has never been easier to use top of the range ... --------------------------------------------- http://www.net-security.org/article.php?id=2373 *** KeyRaider Malware Steals Certificates, Keys and Account Data From Jailbroken iPhones *** --------------------------------------------- Researchers have discovered a new strain of iOS malware dubbed KeyRaider that targets jailbroken devices and has the ability to steal certificates, private keys, and Apple account information. The malware already has claimed the private Apple account data of more than 225,000 victims. The KeyRaider malware was discovered by researchers at Palo Alto Networks, who... --------------------------------------------- http://threatpost.com/keyraider-malware-steals-certificates-keys-and-accoun… *** SSD Advisory - AppLock Multiple Vulnerabilities *** --------------------------------------------- The following report describes three ( 3 ) different vulnerabilities found in the AppLock, an Android application, with over 10 Millions of downloads, used to secure pictures, videos and application with a PIN code. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2558 *** DRDoS, UDP-Based protocols and BitTorrent *** --------------------------------------------- On July 1st, 2015, the security team at BitTorrent received a report [1] from Florian Adamsky about Distributed Reflective Denial of Service (DRDoS) vulnerabilities affecting several BitTorrent products making use of UDP-based [2] protocols. uTorrent, BitTorrent and BitTorrent Sync use the Micro Transport Protocol (µTP) [3] implementation in libuTP [4] as the preferred transport backend running on top of UDP. While these vulnerabilities have been described before in other alerts [5] in... --------------------------------------------- http://engineering.bittorrent.com/2015/08/27/drdos-udp-based-protocols-and-… *** Patch für Schwachstelle in Hewlett Packard lt4112 LTE/HSPA+ Gobi 4G Module (Remote Execution of Arbitrary Code) *** --------------------------------------------- Hewlett Packard hat ein Security Bulletin zu einer Sicherheitslücke im HP lt4112 LTE/HSPA+ Gobi 4G Module veröffentlicht. Die Schwachstelle erlaubt einem entfernten Angreifer das Ausführen beliebigen Codes. Ein Firmware-Update, welches das Problem behebt, ist verfügbar. CVE-Nummern: CVE-2015-5367, CVE-2015-5367 CVSS2 Base Score: 6.9... --------------------------------------------- http://www.cert.at/services/blog/20150831172201-1588.html *** TA15-240A: Controlling Outbound DNS Access *** --------------------------------------------- Original release date: August 28, 2015 Systems Affected Networked systems Overview US-CERT has observed an increase in Domain Name System (DNS) traffic from client systems within internal networks to publically hosted DNS servers. Direct client access to Internet DNS servers, rather than controlled access through enterprise DNS servers, can expose an organization to unnecessary security risks and system inefficiencies. This Alert provides recommendations for improving security related to... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-240A *** NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 4.1.1.1-9 *** --------------------------------------------- Abstract: NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 build (version 4.1.1.1-9). This file contains updates for services contained in the NetIQ Access Manager 4.1 product and requires 4.1 SP1 to be installed as a minimum. NetIQ recommends that all customers running Access Manager 4.1 release code apply this patch. The purpose of the patch is to provide a bundle of fixes for security issues that have surfaced since NetIQ Access Manager 4.1 SP1 was released. These fixes include updates to... --------------------------------------------- https://download.novell.com/Download?buildid=ceIVdhBEV2o~ *** Edimax PS-1206MF Web Admin Auth Bypass *** --------------------------------------------- Topic: Edimax PS-1206MF Web Admin Auth Bypass Risk: High Text:# Title: Edimax PS-1206MF - Web Admin Auth Bypass # Date: 30.08.15 # Vendor: edimax.com # Firmware version: 4.8.25 # Author... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080183 *** HPSBMU03416 rev.1 - HP Data Protector, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Data Protector. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04776510 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Potential Information Disclosure vulnerability could expose user personal data in WebSphere Commerce (CVE-2015-4980) *** http://www.ibm.com/support/docview.wss?uid=swg21965013 *** IBM Security Bulletin: Java CVE-2015-2590 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020888 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Direct for HP NonStop (CVE-2015-1792, CVE-2015-1789, CVE-2015-1790) *** http://www.ibm.com/support/docview.wss?uid=swg21963603 *** IBM Security Bulletin: Apache Tomcat Vulnerability in Algo Audit and Compliance (CVE-2014-0230 ) *** http://www.ibm.com/support/docview.wss?uid=swg21963664 *** IBM Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005258 *** IBM Security Bulletin: Vulnerability in Rational DOORS Next Generation and Rational Requirements Composer with potential for Cross Site Scripting attack (CVE-2015-1917) *** http://www.ibm.com/support/docview.wss?uid=swg21713610 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Storwize V7000 Unified (CVE-2013-7423) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005316 *** Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Flex System Manger (FSM) (CVE-2013-2877, CVE-2014-0191, CVE-2014-3660) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098592 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) (Multiple CVEs) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098591 *** WordPress Responsive Thumbnail Slider 1.0 Shell Upload *** --------------------------------------------- Topic: WordPress Responsive Thumbnail Slider 1.0 Shell Upload Risk: High Text:<!-- # Exploit Title: Wordpress Responsive Thumbnail Slider Arbitrary File Upload # Date: 2015/8/29 # Exploit Author: Arash ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080170

1 0

Tageszusammenfassung - Freitag 28-08-2015
by Daily end-of-shift report 28 Aug '15

28 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-08-2015 18:00 − Freitag 28-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Update: Hotfix Available for ColdFusion (APSB15-21) *** --------------------------------------------- A Security Bulletin (APSB15-21) has been published regarding a hotfix for ColdFusion. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1262 *** DSA-3344 php5 - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3344 *** Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Identity Services Engine (ISE) guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40691 *** BitTorrent kills bug that turns networks into a website-slaying weapon *** --------------------------------------------- Reflective technique would let attacker amplify traffic and flood targets BitTorrent has fixed a flaw in its technology that quietly turns file-sharing networks into weapons .. --------------------------------------------- www.theregister.co.uk/2015/08/28/bittorrent_blasts_bug/ *** Google makes it official: Chrome will freeze Flash ads on sight from Sept 1 *** --------------------------------------------- Browser to make most stuff click-to-play by default Google is making good on its promise to strangle Adobe Flashs ability to .. --------------------------------------------- www.theregister.co.uk/2015/08/28/google_says_flash_ads_out_september/ *** BSI warnt vor Risiko bei Intels Fernwartungstechnik AMT *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik rät dazu, die Konfiguration von Notebooks und Desktop-PCs mit Intels Active Management Technology zu prüfen: Bei manchen .. --------------------------------------------- http://heise.de/-2792791 *** Business Email Scams: A Growing Threat *** --------------------------------------------- Business Email Scams: is that email from the CEO asking for a wire transfer the real deal? Learn to spot .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/business-email-scams-… *** Moxa SoftCMS Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for buffer overflow vulnerabilities in the Moxa SoftCMS software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-01 *** Siemens SIMATIC S7-1200 CSRF Vulnerability *** --------------------------------------------- This advisory provides mitigation details for Cross-Site Request Forgery vulnerability in the SIMATIC S7 1200 CPUs. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-02 *** Innominate mGuard VPN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a denial-of-service vulnerability in the Innominate mGuard device --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03 *** This PUP Alerts You of a Zombie Invasion *** --------------------------------------------- Apps are constantly created to address certain needs. The more helpful an app claims to be, especially in times of crisis, the more users would likely take interest in .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/draft-this-pup-alerts… *** Fake EFF site serving espionage malware was likely active for 3+ weeks *** --------------------------------------------- A spear-phishing campaign some researchers say is linked to the Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware .. --------------------------------------------- http://arstechnica.com/security/2015/08/fake-eff-site-serving-espionage-mal…

1 0

Tageszusammenfassung - Donnerstag 27-08-2015
by Daily end-of-shift report 27 Aug '15

27 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-08-2015 18:00 − Donnerstag 27-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Not a GAMe maKER *** --------------------------------------------- Raul Alvarez performs low-level analysis of information-stealing trojan.The Gamker information-stealing trojan (also known as Shiz) has been around for a few years. It made the news back in 2013 when it was found to target SAP .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_26.xml *** Patched Ins0mnia Vulnerability Keeps Malicious iOS Apps Hidden *** --------------------------------------------- Apple's monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a .. --------------------------------------------- http://threatpost.com/patched-ins0mnia-vulnerability-keeps-malicious-ios-ap… *** Concerns new Tor weakness is being exploited prompt dark market shutdown *** --------------------------------------------- A dark market website that relies on the Tor privacy network to keep its operators anonymous is temporarily shutting down amid concerns attackers are exploiting a newly reported weakness .. --------------------------------------------- http://arstechnica.com/security/2015/08/concerns-new-tor-weakness-is-being-… *** Cisco ACE 4710 Application Control Engine CLI Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40666 *** PDF + maldoc1 = maldoc2 *** --------------------------------------------- I received another example of a PDF file that contains a malicious MS Office document. Sample (MD5 0c044fd59cc6ccc28a48937bc69cc0c4). This time I want to focus on the analysis of such a sample. First we run pdfid to identify the sample. It contains .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20079 *** Taking root *** --------------------------------------------- We analyzed the statistics we had collected from May to August 2015 and identified three main Trojan families that use root privileges on the device to achieve their goals. --------------------------------------------- http://securelist.com/blog/mobile/71981/taking-root/ *** Throwback Thursday: Safe Hex in the 21st Century *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 2000, when we were already being warned that virus scanners were no longer enough.How many times have we heard commentators claim that anti-virus is dead? After all, in the current .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_27.xml *** Phisher greifen iranische Aktivisten an, umgehen Googles Multifaktor-Anmeldung *** --------------------------------------------- Eine Serie von Phishing-Angriffen hat es anscheinend auf iranische Aktivisten und Dissidenten abgesehen. Auch eine hochrangige Mitarbeiterin der EFF wurde angegriffen. --------------------------------------------- http://heise.de/-2792580 *** Important Notice Regarding Public Availability of Stable Patches *** --------------------------------------------- Grsecurity has existed for over 14 years now. During this time it has been the premier solution for hardening Linux against security exploits and served as a role model for many mainstream commercial applications elsewhere. All modern OSes took our lead and implemented to varying degrees a number of security .. --------------------------------------------- https://grsecurity.net/announce.php *** Angler Exploit Kit Strikes on MSN.com via Malvertising Campaign *** --------------------------------------------- The same actors behind the recent Yahoo and Azure malvertising attacks went after MSN.com this time. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/08/angler-exploit-kit-str…

1 0

Tageszusammenfassung - Mittwoch 26-08-2015
by Daily end-of-shift report 26 Aug '15

26 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-08-2015 18:00 − Mittwoch 26-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows 10^H^H Symbolic Link Mitigations *** --------------------------------------------- For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mi… *** VB2015 preview: advanced persistent threats *** --------------------------------------------- There was a time when analyses of malware and viruses at the Virus Bulletin conference used the number of infections as a measure of the harm done. And while there are still many talks on what is now referred to as opportunistic malware, targeted .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_25.xml *** Dropbox Phishing via Compromised Wordpress Site, (Tue, Aug 25th) *** --------------------------------------------- I got a couple of emails today notifying me of a Compulsory Email Account Update for my Dropbox account. The e-mails do overall mimic the Dropbox look and feel, and use dropbox(a)smtp.com .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20073 *** Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40620 *** FunWebProducts UserAgent Bloating Traffic *** --------------------------------------------- Every once in a while we get a case that makes us dig deep to find answers. We have spoken before about the trouble with forensics and reasons why websites get hacked. Sometimes though, the answer is not clear and we can only gather clues to make .. --------------------------------------------- https://blog.sucuri.net/2015/08/funwebproducts-useragent-bloating-traffic.h… *** Actor that tried Neutrino exploit kit now back to Angler *** --------------------------------------------- Last week, we saw the group behind a significant amount of Angler exploit kit (EK) switch to Neutrino EK. We didnt know if the change was permanent, and I also noted that criminal groups using EKs have quickly changed tactics .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20075 *** l+f: https-fuer-Fortgeschrittene *** --------------------------------------------- Googles Chrome und die Open-Source-Basis Chromium laden eine Reihe von Web-Seiten immer via gesichertem HTTPS - darunter auch viele deutsche. --------------------------------------------- http://heise.de/-2790788 *** Endress+Hauser HART Device DTM Vulnerability *** --------------------------------------------- Alexander Bolshev and Svetlana Cherkasova of Digital Security have identified an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library used in Endress+Hauser HART Device DTM. CodeWrights GmbH has addressed the vulnerability with a new library, which Endress+Hauser has begun to integrate. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-237-01 *** Dynamic DNS and You Part 2: Identifying the Threat *** --------------------------------------------- Greetings! You all really seemed to like my last post on Dynamic DNS, so Ive been invited to come back and talk more about it. In part 1 , we discussed the uses of Dynamic DNS, as well as the various providers of the service and how it all .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-and-you-pa… *** Netflix Is Dumping Anti-Virus, Presages Death Of An Industry *** --------------------------------------------- For years, nails have been hammering down on the coffin of anti-virus. But none have really put the beast to bed. An industry founded in the 1980s, a time when John McAfee was known as a pioneer rather than a tequila-downing rascal, .. --------------------------------------------- http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-… *** CryptoGirl on StageFright: A Detailed Explanation *** --------------------------------------------- Detecting the PoCs published by Zimperium is not difficult: you can fingerprint the PoCs, for example. Detecting variants of the PoCs, i.e., MP4s that use one of the discovered vulnerabilities, is far more difficult. Ill explain why in a .. --------------------------------------------- http://blog.fortinet.com/post/cryptogirl-on-stagefright-a-detailed-explanat…

1 0

Tageszusammenfassung - Dienstag 25-08-2015
by Daily end-of-shift report 25 Aug '15

25 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-08-2015 18:00 − Dienstag 25-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Signed Dridex Campaign *** --------------------------------------------- Malware authors use various means to make their malware look similar to legitimate software. One such approach involves signing a malware sample with a digital certificate. Recently we saw Dridex malware authors using this technique while .. --------------------------------------------- http://research.zscaler.com/2015/08/signed-dridex-campaign.htm *** AlienSpy RAT Resurfaces as JSocket *** --------------------------------------------- The dismantled AlientSpy remote access Trojan, the same malware found on the phone of dead Argentine prosecutor Alberto Nisman, has resurfaced with new crypto and a new name. --------------------------------------------- http://threatpost.com/alienspy-rat-resurfaces-as-jsocket/114385 *** Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40652 *** RTF Exploit Installs Italian RAT: uWarrior *** --------------------------------------------- Unit 42 researchers have observed a new Remote Access Tool (RAT) constructed by an unknown actor of Italian origin. This RAT, referred to as uWarrior because of embedded PDB strings, has been previously described .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/rtf-exploit-installs-ita… *** Multiple vulnerabilities in Hewlett-Packard KeyView IDOL *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-405 http://www.zerodayinitiative.com/advisories/ZDI-15-404 http://www.zerodayinitiative.com/advisories/ZDI-15-403 http://www.zerodayinitiative.com/advisories/ZDI-15-402 http://www.zerodayinitiative.com/advisories/ZDI-15-401 http://www.zerodayinitiative.com/advisories/ZDI-15-400 http://www.zerodayinitiative.com/advisories/ZDI-15-399 http://www.zerodayinitiative.com/advisories/ZDI-15-398 http://www.zerodayinitiative.com/advisories/ZDI-15-397 *** Ask Sucuri: How Did My WordPress Website Get Hacked? *** --------------------------------------------- With the proliferation of Infrastructure and Platform as a Service providers, it is no surprise that a majority of today's websites are hosting in the proverbial cloud. This is great because it allows organizations and individuals alike to quickly deploy their websites, with relatively little overhead .. --------------------------------------------- https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get… *** What I learned from cracking 4000 Ashley Madison passwords *** --------------------------------------------- When the Ashley Madison database first got dumped, there was an interesting contingent of researchers talking about how pointless it would be to crack the passwords, .. --------------------------------------------- http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4000.html *** Browsefox variant High Stairs *** --------------------------------------------- https://blog.malwarebytes.org/security-threat/2015/08/browsefox-variant-hig… *** Datenschutz: Ashley Madison wusste von gravierenden Sicherheitsmängeln *** --------------------------------------------- Einige Wochen vor dem Angriff des Impact Teams warnten interne Sicherheitsexperten vor gravierenden Mängeln in der Infrastruktur der Webseite. --------------------------------------------- http://www.golem.de/news/datenschutz-ashley-madison-wusste-von-gravierenden… *** Ashley Madison: Gehackte Seitensprung-Site hackte eigene Konkurrenz *** --------------------------------------------- Die Dating-Webseite, die vor kurzem Opfer eines Hacker-Angriffs und Datenleck wurde, hat vor einigen Jahren selbst eine Konkurrenzplattform angegriffen. Dabei soll der Technikchef von Ashley Madison die Datenbank der Konkurrenz kopiert haben. --------------------------------------------- http://heise.de/-2790189 *** Are Data Breaches Getting Larger? *** --------------------------------------------- This research says that data breaches are not getting larger over time. "Hype and Heavy Tails: A Closer Look at Data Breaches," by Benjamin Edwards, Steven Hofmeyr, and Stephanie Forrest: Abstract: Recent widely publicized data breaches have .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/are_data_breach.html *** You are the weakest link - goodbye! *** --------------------------------------------- On my first visit to Team Cymru's HQ in Lake Mary, Florida, I found myself reading the wall hangings and looking at the pictures depicting specific times in history. Many of them depicting the inspiring words of leaders such as Churchill. It lead me to think about the many lessons that can we learn from .. --------------------------------------------- https://blog.team-cymru.org/2015/08/you-are-the-weakest-link-goodbye/ *** Github Mitigates DDoS Attack *** --------------------------------------------- Github said it turned back a distributed denial of service attack; it's unknown whether this attack is related to a similar attack this March. --------------------------------------------- http://threatpost.com/github-mitigates-ddos-attack/114403 *** Gehackter Samsung-Kühlschrank verrät Gmail-Anmeldedaten *** --------------------------------------------- Auf der Hackerkonferenz DEFCON wurde eine Methode präsentiert, mit der ein Kühlschrank-Modell von Samsung dazu gebracht werden kann, Gmail-Log-ins zu verraten. --------------------------------------------- http://futurezone.at/digital-life/gehackter-samsung-kuehlschrank-verraet-gm… *** Certifi-Gate: Missbräuchliche App im Google Play Store entdeckt *** --------------------------------------------- Sicherheitsforscher präsentierten vor wenigen Wochen eine Schwachstelle, die Fernverwaltungs-Software wie Teamviewer betrifft. Im Nachgang fanden die Forscher eine App in Googles Play Store, die genau diese Schwäche ausnutzt. --------------------------------------------- http://heise.de/-2790706

1 0

Tageszusammenfassung - Montag 24-08-2015
by Daily end-of-shift report 24 Aug '15

24 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-08-2015 18:00 − Montag 24-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Extortionists Target Ashley Madison Users *** --------------------------------------------- People who cheat on their partners are always open to extortion by the parties involved. But when the personal details of millions of cheaters gets posted online for anyone to download - as is the case with the recent hack of infidelity hookup .. --------------------------------------------- http://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-user… *** Exploring a 'Malwarebytes Anti-Malware for Windows 10 - website' *** --------------------------------------------- Here at Malwarebytes, we offer support for a wide variety of Windows Operating Systems - from XP right up to Windows 10. The latter OS is the starting point for this blog post, with a website located .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/exploring-an-mbam-for… *** One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation *** --------------------------------------------- This is the final part #4 of the 'One font vulnerability to rule them all' blog post series. In the previous posts, we introduced the 'blend' PostScript operator vulnerability and successfully used it to first exploit Adobe Reader, and later escape .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Cisco Wireless LAN Controller IPv6 IAPP WIPS Report Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40586 *** BSI: Richtlinie für sicheren Mail-Transport zeigt bereits Wirkung *** --------------------------------------------- Mit dem Erscheinen der Richtlinie wird leichter verständlich, weshalb Web.de und GMX nicht nur die PGP-Verschlüsselung für Mails eingeführt haben, sondern überraschend auch auf die Sicherheitstechniken DNSSEC und DANE setzen. --------------------------------------------- http://heise.de/-2788316 *** MMD-0039-2015 - ChinaZ made new malware: ELF Linux/BillGates.Lite *** --------------------------------------------- There are tweets I posted which is related to this topic, Our team spotted the sample a week ago. And this post is the promised details, I am sorry for the delay for limited resource that we have since for a week I focused to help .. --------------------------------------------- http://blog.malwaremustdie.org/2015/08/mmd-0039-2015-chinaz-made-new-malwar… *** Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8159 *** Sending Windows Event Logs to Logstash *** --------------------------------------------- This topic is not brand new, there exists plenty of solutions to forward Windows event logs to Logstash (OSSEC, Snare or NXlog amongst many others). They perform a decent job to collect events on running systems .. --------------------------------------------- https://blog.rootshell.be/2015/08/24/sending-windows-event-logs-to-logstash/ *** Mass FTP Crawling *** --------------------------------------------- The combination of interesting files one can find on public FTP servers plus the technical expertise required to make a decent search engine motivated me to write Findex and ultimately this article. --------------------------------------------- http://findex.cedsys.nl/research/mass-ftp-crawling/ *** Bundestags-IT nach Reparatur wieder online *** --------------------------------------------- Das IT-System des Deutschen Bundestags ist nach mehrtägigen Reparaturarbeiten am Montag wieder hochgefahren worden. Nach Behebung der Folgen eines Hackerangriffs ging das System wieder ans Netz, wie eine Parlamentssprecherin bestätigte. Die Abgeordneten und Mitarbeiter wurden demnach per Lautsprecher am Montagvormittag über den Neustart des Systems informiert. --------------------------------------------- http://derstandard.at/2000021189218 *** Compromising a honeypot network through the Kippo password when logstash exec is used *** --------------------------------------------- We have been playing with Honeypots lately (shoutout to Theo and Sebastian for adding their honeypots to the network), collecting and visualizing the data from the honeypots is done .. --------------------------------------------- https://forsec.nl/2015/08/compromising-a-honeypot-network-through-the-kippo… *** Exploiting the Mercury Browser for Android *** --------------------------------------------- The Mercury Browser for Android suffers from an insecure Intent URI scheme implementation and a path traversal vulnerability within a custom web server used to support its WiFi Transfer feature. Chaining these vulnerabilities together can allow a .. --------------------------------------------- http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/ *** Username Enumeration against OpenSSH/SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM versions prior to 1.2.1 which allows attackers to conduct username enumeration and denial of service attacks. The purpose of this post is to provide more technical details around this vulnerability. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag…

1 0

Tageszusammenfassung - Freitag 21-08-2015
by Daily end-of-shift report 21 Aug '15

21 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 20-08-2015 18:00 − Freitag 21-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Top 3 biggest mistakes enterprises make in application security *** --------------------------------------------- Enterprise information security encompasses a broad set of disciplines and technologies, but at the highest level it can be broken down into three main categories: network security, endpoint security ... --------------------------------------------- http://www.net-security.org/article.php?id=2362 *** Apple Patches QuickTime Crash and Code Execution Flaws *** --------------------------------------------- Apple pushed out a new version of QuickTime that patched nine vulnerabilities, including a handful of denial of service and code execution bugs. --------------------------------------------- http://threatpost.com/apple-patches-quicktime-crash-and-code-execution-flaw… *** Security Awareness for Managers: Protecting Yourself and Your Company *** --------------------------------------------- Nowadays, security awareness training (SAT) is a top priority for organizations of any sizes. Thanks to SAT, management and employees can understand IT governance issues and control solutions as well as recognize concerns, understand their relevance and respond accordingly. Many companies invest heavily in cybersecurity education programs for employees to learn how to protect their... --------------------------------------------- http://resources.infosecinstitute.com/security-awareness-for-managers-prote… *** WordPress Compromises Behind Spike in Neutrino EK Traffic *** --------------------------------------------- A rash of compromised WordPress websites is behind this week's surge in Neutrino Exploit Kit traffic --------------------------------------------- http://threatpost.com/wordpress-compromises-behind-spike-in-neutrino-ek-tra… *** National Cyber Security Strategies: the latest news *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/national-cyber-security-strateg… *** APPLE-SA-2015-08-20-1 QuickTime 7.7.8 *** --------------------------------------------- APPLE-SA-2015-08-20-1 QuickTime 7.7.8QuickTime 7.7.8 is now available and addresses the following:QuickTimeAvailable for: Windows 7 and Windows VistaImpact: Processing a maliciously crafted file may lead to anunexpected application termination or arbitrary code execution [...] --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Aug/msg00004.ht… *** ZDI-15-395: Foxit Reader GIF Conversion Heap Corruption Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-395/ *** ZDI-15-396: ManageEngine Service Desk File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine ServiceDesk. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-396/ *** Splunk Input Validation Flaw in Splunk Web Lets Remote Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1033339 *** Bugtraq: ESA-2015-132: EMC Documentum D2 Fail Open Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536278 *** Bugtraq: [oCERT-2015-009] VLC arbitrary pointer dereference *** --------------------------------------------- http://www.securityfocus.com/archive/1/536287

1 0

Tageszusammenfassung - Donnerstag 20-08-2015
by Daily end-of-shift report 20 Aug '15

20 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 19-08-2015 18:00 − Donnerstag 20-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Inside the Unpatched OS X Vulnerabilities *** --------------------------------------------- Italian researcher Luca Todesco explains how exploiting two vulnerabilities in OS X gain enable root access for a hacker. He wont, however, say why he went public with details and exploit code before Apple patched. --------------------------------------------- http://threatpost.com/inside-the-unpatched-os-x-vulnerabilities/114344 *** Three bypasses and a fix for one of Flashs Vector. mitigations *** --------------------------------------------- Posted by Chris Evans, Cookie MonsterWith the release of Flash 18.0.0.209, two mitigations were introduced to combat abuse of Vector corruptions -- we covered these in a previous blog post. Flash 18.0.0.232 has just been released and it includes a change to the way one of the mitigations is implemented, to address Project Zero bug 482.This blog post notes some ways to bypass the way Adobe implemented the Vector. length checking mitigation. They are already fixed. It's not uncommon for new... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/three-bypasses-and-fix-for-on… *** AdBlocker Plus exploit puts OSX users at risk *** --------------------------------------------- A visit to the Apple store will give any consumer a false sense of security, you will be told that by buying a Mac you are safe from threats and malware. I have... --------------------------------------------- http://www.webroot.com/blog/2015/08/19/adblocker-plus-puts-osx-at-risk/ *** Evaluating the security of open source software *** --------------------------------------------- The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation, is developing a new free Badge Program, seeking input from the open source community on the criteria to be used to ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18786 *** A light-weight forensic analysis of the AshleyMadison Hack *** --------------------------------------------- So Ashley Madison(AM) got hacked, it was first announced about a month ago and the attackers claimed theyd drop the full monty of user data if the AM website did not cease operations. The AM parent company Avid Life Media(ALM) did not cease business operations for the site and true to their word; the attackers seemed of have leaked everything they promised on August 18th 2015 including:... --------------------------------------------- http://blog.includesecurity.com/2015/08/forensic-analysis-of-the-AshleyMadi… *** Popular Tools for Brute-force Attacks *** --------------------------------------------- The brute-force attack is still one of the most popular password cracking methods. Nevertheless, it is not just for password cracking. Brute-force attacks can also be used to discover hidden pages and content in a web application. This attack is basically "a hit and try" until you succeed. This attack sometimes takes longer, but its... --------------------------------------------- http://resources.infosecinstitute.com/popular-tools-for-brute-force-attacks/ *** Web.de und GMX führen PGP-Verschlüsselung für Mail ein *** --------------------------------------------- Sehr einfach zu bedienen, aber dennoch sicher soll die PGP-Erweiterung der Mail-Dienste von Web.de und GMX sein, die sich per Web-Oberfläche und Mobil-Apps nutzen lässt. --------------------------------------------- http://heise.de/-2786133 *** Yet another Android security flaw: This time EVERYTHING is affected *** --------------------------------------------- Multitasking security flap places entire user base at risk of neer-do-well activity Security researchers have discovered yet another source of security flaws in Android. This time the problem affects the mobile operating systems multitasking functionality rather than the handling of multimedia messages, the crux of a cyber of recent vulnerabilities* including the infamous Stagefright flaw. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/20/android_mul… *** [R1] Apache Vulnerabilities Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-11 *** Cisco Aggregation Services Router ASR 5000 and ASR 5500 OSPF Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40585 *** VU#276148: Dedicated Micros DVR products use plaintext protocols and require no password by default *** --------------------------------------------- Vulnerability Note VU#276148 Dedicated Micros DVR products use plaintext protocols and require no password by default Original Release date: 20 Aug 2015 | Last revised: 20 Aug 2015 Overview Dedicated Micros DVR products, including the DV-IP Express, SD Advanced, SD, EcoSense, and DS2, by default use plaintext protocols and require no password. Description CWE-311: Missing Encryption of Sensitive DataDedicated Micros DVR products by default use HTTP, telnet, and FTP rather than secure --------------------------------------------- http://www.kb.cert.org/vuls/id/276148 *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2015-003Project: Drupal core Version: 6.x, 7.xDate: 2015-August-19Security risk: 18/25 ( Critical) AC:Complex/A:User/CI:All/II:All/E:Proof/TD:AllVulnerability: Cross Site Scripting, Access bypass, SQL Injection, Open Redirect, Multiple vulnerabilitiesThis security advisory fixes multiple vulnerabilities. See below for a list.Cross-site Scripting - Ajax system - Drupal 7A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by --------------------------------------------- https://www.drupal.org/SA-CORE-2015-003

1 0

Tageszusammenfassung - Mittwoch 19-08-2015
by Daily end-of-shift report 19 Aug '15

19 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 18-08-2015 18:00 − Mittwoch 19-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** SANS Incident Response Survey 2015 Infographic *** --------------------------------------------- So, you have a security policy, a blue team tasked with protecting your organization and an incident response plan. What happens when the inevitable occurs - you are attacked? SANS just released their 2015 Incident Response survey, summarizing results from 507 survey respondents who shared the top attack types they are seeing, and what is (and it not) working today in terms of incident response. The good news: malware, data breaches and Advanced Persistent Threats (APT's) were all... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/sans-incident-response… *** Who should be responsible for IT security? *** --------------------------------------------- Hot potato, or hot job? Typically, when a cybersecurity problem arises, it's the IT department that gets it in the neck. Ostensibly, that makes sense. After all, if someone is in your network mining your database for corporate secrets, it's hardly the office manager or the accounts receivable department's lookout, right? --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/responsibil… *** Kehrtwende bei Mail-Sicherheit: Web.de und GMX führen DANE ein *** --------------------------------------------- Mit seinen beiden Diensten gehört United Internet zu den Gründern der Initiative "E-Mail made in Germany", die ein eigenes Verfahren für die Absicherung des Mail-Transports einsetzt. Dennoch soll nun die moderne DANE-Technik hinzukommen. --------------------------------------------- http://heise.de/-2782473 *** Später lesen: Schwerwiegende Backend-Lücken in Pocket nachgewiesen *** --------------------------------------------- Ohne viel Aufwand hat ein Sicherheitsforscher auf die Backend-Infrastruktur von Pocket zugreifen können. Die Fehler sind zwar inzwischen behoben, dem Streit um die Aufnahme der App zum späteren Lesen in den Firefox-Browser könnte dies aber neuen Anschub geben. --------------------------------------------- http://www.golem.de/news/spaeter-lesen-schwerwiegende-backend-luecken-in-po… *** Outsourcing critical infrastructure (such as DNS), (Wed, Aug 19th) *** --------------------------------------------- Migrating everything to cloud or various online services is becoming increasingly popular in last couple of years (and will probably not stop). However, leaving our most valuable jewels with someone else makes a lot of security people (me included) nervous. During some of the latest external penetration tests I noticed an increasing trend of companies moving some of their services to various cloud solutions or to their providers.target.com. IN ANSWER SECTION: target.com. 1365 IN NS --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20057&rss *** IE Bug Exploited In Wild After Microsoft Releases Out-Of-Band Patch *** --------------------------------------------- Remote code execution vulnerability in Internet Explorer versions 7 through 11 being used to drop PlugX RAT. --------------------------------------------- http://www.darkreading.com/attacks-breaches/ie-bug-exploited-in-wild-after-… *** MS15-093 - Critical: Security Update for Internet Explorer (3088903) - Version: 1.0 *** --------------------------------------------- This security update resolves a vulnerability in Internet Explorer. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-093 *** Security Hotfix Available for LiveCycle Data Services (APSB15-20) *** --------------------------------------------- A Security Bulletin (APSB15-20) has been published regarding a hotfix for LiveCycle DS. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided in the "Solution" section of the Security Bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1259 *** Fortinet FortiGate/FortiOS MAC Authentication Flaw Lets Remote Users Modify Data on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033256 *** Security Notice - Statement on "Fingerprints on Mobile Devices: Abusing and Leaking" at the Black Hat Conference *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DSA-3337 gdk-pixbuf - security update *** --------------------------------------------- Gustavo Grieco discovered a heap overflow in the processing of BMP imageswhich may result in the execution of arbitrary code if a malformed imageis opened. --------------------------------------------- https://www.debian.org/security/2015/dsa-3337 *** Security Advisory: ICMP packet processing vulnerability CVE-2015-5058 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17047.htm… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty Profile affect WebSphere Appliance Management Center *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21963684 *** IBM Security Bulletin: Websphere Message Broker and IBM Integration Bus are affected by access control vulnerability (CVE-2015-2018) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21961734 *** Security Bulletin: Vulnerabilities in SSLv3 and GNU C library (glibc) affect multiple products shipped with Intelligent Cluster (CVE-2014-3566, CVE-2015-0235) *** --------------------------------------------- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098516 *** Cisco TelePresence Video Communication Server Expressway Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40522 *** Cisco Unified Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40555 *** Cisco TelePresence Video Communication Server Expressway Arbitrary File Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40518 *** Multiple Cisco Finesse Cross-Site Scripting Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40436

1 0

Tageszusammenfassung - Dienstag 18-08-2015
by Daily end-of-shift report 18 Aug '15

18 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 17-08-2015 18:00 − Dienstag 18-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Attacking ECMAScript Engines with Redefinition *** --------------------------------------------- Posted by Natalie Silvanovich = function () { return n; }ECMAScript has a property where almost all functions and variables can be dynamically redefined. This can lead to vulnerabilities in situations where native code assumes a function or variable behaves a certain way when accessed or does not have certain side effects when it can in fact be redefined. Project Zero has discovered 24 vulnerabilities involving ECMAScript redefinition in Adobe Flash in the past few months and similar issues... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/attacking-ecmascript-engines-… *** Tool Tip: Kansa Stafford released, PowerShell for DFIR, (Mon, Aug 17th) *** --------------------------------------------- In his most recent post, Guy asked Are You a Hunter?. Heres one way to become one. Dave Hull has just published the Stafford release of his exemplary PowerShell DFIR tool, Kansa. For the uninitiated, Kansa is amodular incident response framework in Powershell.(PS v3 or higher preferred)that uses Powershell Remoting to run user contributed modules across hosts in an enterprise to collect data for use during incident response, breach hunts, or for building an environmental baseline. Per Daves... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20049&rss *** Risky Schneider Electric SCADA Vulnerabilities Remain Unpatched *** --------------------------------------------- Vulnerabilities in Schneider Electric SCADA gear remain unpatched close to two weeks after they were disclosed during DEF CON. --------------------------------------------- http://threatpost.com/risky-schneider-electric-scada-vulnerabilities-remain… *** Ransomware goes OPEN SOURCE in the name of education *** --------------------------------------------- Won't somebody think of the script kiddies? Turkish security bod Utku Sen has published what appears to be the first open source ransomware that anyone to download and spread. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/18/ransomware_… *** How Not to Start an Encryption Company *** --------------------------------------------- Probably the quickest way for a security company to prompt an overwhelmingly hostile response from the security research community is to claim that its products and services are "unbreakable" by hackers. The second-fastest way to achieve that outcome is to have that statement come from an encryption company CEO who served several years in federal prison for running a $210 million Ponzi scheme. Heres the story of a company that managed to accomplish both at the same time and is now... --------------------------------------------- http://krebsonsecurity.com/2015/08/how-not-to-start-an-encryption-company/ *** Sicherheitsrisiko Mainframe: Großrechner aus dem Internet erreichbar *** --------------------------------------------- Ein Sicherheitsforscher warnt, dass Mainframes zu einem leichten Angriffsziel werden könnten. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicherheitsrisiko-Mainframe-Grossrec… *** 1&1, GMX und Web.de: Millionen E-Mail-Postfächer waren angreifbar *** --------------------------------------------- Bei den E-Mail-Anbietern 1&1, Gmx und Web.de klaffte bis vor wenigen Tagen eine Sicherheitslücke, über die Angreifer unter bestimmten Umständen Zugriff auf fremde Konten bekommen konnten. --------------------------------------------- http://heise.de/-2782618 *** When You Can't ARPSpoof *** --------------------------------------------- There are times during a penetration test when you are having difficulty gaining the credentials you want from a host that has already been compromised. You have successfully socially engineered a system administrator or other user with privileges to a web application and you have established a meterpreter shell. You can dump the password hashes... --------------------------------------------- http://resources.infosecinstitute.com/when-you-cant-arpspoof/ *** Reflection DDoS Attacks Abusing RPC Portmapper *** --------------------------------------------- Level 3 Communications has discovered a new type of reflection DDoS attack that takes advantage of RPC Portmapper to overwhelm networking services. --------------------------------------------- http://threatpost.com/reflection-ddos-attacks-abusing-rpc-portmapper/114318 *** SAP Afaria 7 Buffer Overflow *** --------------------------------------------- Topic: SAP Afaria 7 Buffer Overflow Risk: High Text:Application: SAP Afaria 7 Versions Affected: SAP Afaria 7, probably others Vendor URL: http://SAP.com Bugs: Buffer Overflow ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080088 *** DSA-3336 nss - security update *** --------------------------------------------- Several vulnerabilities have been discovered in nss, the Mozilla NetworkSecurity Service library. The Common Vulnerabilities and Exposures projectidentifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3336 *** Bugtraq: EMC Documentum Content Server: arbitrary code execution (incomplete fix in CVE-2015-4532) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536244 *** ZDI-15-393: Foxit Reader TIFF Conversion Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-393/ *** GnuTLS ServerKeyExchange Validation Flaw May Let Remote Users Forge Signatures *** --------------------------------------------- http://www.securitytracker.com/id/1033225 *** DFN-CERT-2015-1277. Linux-Kernel: Mehrere Schwachstellen ermöglichen einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1277/ *** Security Notice - Statement about the Stagefright Security Vulnerability in Android OS Disclosed by Zimperium *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Advisory - DoS Vulnerability in Huawei MBB Product *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM UrbanCode Deploy and IBM UrbanCode Deploy with Patterns *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964039 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM GPFS Native RAID (CVE-2015-2638, CVE-2015-4760, CVE-2015-2619, CVE-2015-2613) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1022565 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational RequisitePro (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21964441 *** Apache ActiveMQ Directory Traversal Flaw Lets Remote Users Upload Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1033315 *** USN-2710-2: OpenSSH regression *** --------------------------------------------- Ubuntu Security Notice USN-2710-218th August, 2015openssh regressionA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryUSN-2710-1 introduced a regression in OpenSSH.Software description openssh - secure shell (SSH) for secure access to remote machines DetailsUSN-2710-1 fixed vulnerabilities in OpenSSH. The upstream fix forCVE-2015-5600 caused a regression resulting in random authenticationfailures in non-default... --------------------------------------------- http://www.ubuntu.com/usn/usn-2710-2/ *** VU#248692: Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#248692 Trend Micro Deep Discovery threat appliance contains multiple vulnerabilities Original Release date: 18 Aug 2015 | Last revised: 18 Aug 2015 Overview Multiple versions of the Trend Micro Deep Discovery threat appliance are vulnerable to cross-site scripting and authentication bypass. Description The Trend Micro Deep Discovery platform "enables you to detect, analyze, and respond to today's stealthy, targeted attacks in real time." It may be... --------------------------------------------- http://www.kb.cert.org/vuls/id/248692 *** Cisco TelePresence Video Communication Server Expressway Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40523

1 0

Tageszusammenfassung - Montag 17-08-2015
by Daily end-of-shift report 17 Aug '15

17 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 14-08-2015 18:00 − Montag 17-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** My browser visited Weather.com and all I got was this lousy malware (Updated) *** --------------------------------------------- New rash of malvertising attacks threatens millions of Web surfers. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/e7WRDtjeLUI/ *** Security: Neuer digitaler Erpressungsdienst aufgetaucht *** --------------------------------------------- Encryptor RaaS nennt sich ein neuer digitaler Erpressungsdienst, der im Tor-Netzwerk aufgetaucht ist. Sein Erschaffer hat offenbar bei Reddit dafür geworben. Angeblich soll es bereits erste Kunden geben. --------------------------------------------- http://www.golem.de/news/security-neuer-digitaler-erpressungsdienst-aufgeta… *** Unsicheres Smart Home: "Nutzer können nichts tun" *** --------------------------------------------- Wiener Sicherheitsforscher warnen davor aufs vernetzte Heim mit Funk-Alarmanlagen oder Türschlösser zu setzen, weil die funkgesteuerten Anlagen viele Risiken mit sich bringen. --------------------------------------------- http://futurezone.at/digital-life/unsicheres-smart-home-nutzer-koennen-nich… *** Five points of failure in recovering from an attack *** --------------------------------------------- An over emphasis on defense is leaving the financial sector exposed to cyber attack. An increase in threat levels has seen the sector bolster defenses by focusing on detection and attack response but ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/28f1ShUbbgo/secworld.php *** MediaServer Takes Another Hit with Latest Android Vulnerability *** --------------------------------------------- The "hits" keep on coming for Android's mediaserver component. We have discovered yet another Android mediaserver vulnerability, which can be exploited to perform attacks involving arbitrary code execution. With this new vulnerability, an attacker would be able to run their code with the same permissions that the mediaserver program already has as part of its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G8BEug87d7k/ *** Google plugs Google Admin app sandbox bypass 0-day *** --------------------------------------------- After having had some trouble with fixing a sandbox bypass vulnerability in the Google Admin Android app, the Google Security team has finally released on Friday an update that plugs the hole. Goog... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/Mf7jUvjZmF0/secworld.php *** Wieder Root-Lücke in OS X Yosemite - inklusive 10.10.5 *** --------------------------------------------- Nachdem das jüngste Update eine Rechteausweitung behoben hatte, ist nun die nächste entdeckt worden. Demonstrationscode für einen Exploit wurde bereits veröffentlicht. --------------------------------------------- http://heise.de/-2780509 *** BitTorrent clients can be made to participate in high-volume DoS attacks *** --------------------------------------------- A group of researchers have discovered a new type of DoS attack that can be pulled off by a single attacker exploiting weaknesses in the BitTorrent protocol family. The weaknesses in the Micro Tran... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/FUSeWaDyIkU/secworld.php *** In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten Dienstag, 18. August 2015 | 17. August 2015 | Am Dienstag, 18. August 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt... --------------------------------------------- http://www.cert.at/services/blog/20150817120322-1581.html *** Windows Platform Binary Table (WPBT) - BIOS PE backdoor *** --------------------------------------------- [...] This feature allows a BIOS to deliver the payload of an executable, which is run in memory, silently, each time a system is booted. The executable code is run under under Session Manager context (i.e. SYSTEM). --------------------------------------------- http://www.securityfocus.com/archive/1/536181/30/0/threaded *** VMSA-2015-0003.10 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** TOTOLink Backdoor Persistence *** --------------------------------------------- Topic: TOTOLink Backdoor Persistence Risk: High Text:Hello, This is an update to: - Backdoor and RCE found in 8 TOTOLINK router models (http://seclists.org/fulldisclosure/20... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080073 *** Bugtraq: BFS-SA-2015-002: OpenSSH PAM Privilege Separation Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536220 *** OSIsoft PI Data Archive Server Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for 56 vulnerabilities that were identified in OSIsoft PI System software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-225-01 *** Cisco Nexus Operating System Address Resolution Protocol Denial of Service Vulnerability *** --------------------------------------------- 40469 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40469 *** Cisco TelePresence Video Communication Server Expressway Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40442 *** Cisco NX-OS Internet Group Management Protocol Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40470 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17115.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-1465 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17124.htm… *** Security Advisory: Apache Commons FileUpload vulnerability CVE-2014-0050 *** https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15189.htm… *** Security Advisory: Linux kernel vulnerability CVE-2015-2042 *** https://support.f5.com:443/kb/en-us/solutions/public/17000/100/sol17118.htm… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in IBM Java SDK affect IBM Notes and Domino *** http://www.ibm.com/support/docview.wss?uid=swg21963812 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational RequisitePro (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960340 *** IBM Security Bulletin: Security Vulnerability in Apache Batik (CVE-2015-0250) *** http://www.ibm.com/support/docview.wss?uid=swg21963994 *** IBM Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerability affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964102 *** IBM Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Content Classification CVE-2015-4760 *** http://www.ibm.com/support/docview.wss?uid=swg21963680 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM DataQuant for Workstation (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963822 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-1931 CVE-2015-2601 CVE-2015-2613 CVE-2015-2625) *** http://www.ibm.com/support/docview.wss?uid=swg21963191 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Websphere Dashboard Framework *** http://www.ibm.com/support/docview.wss?uid=swg21963164 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Runtime Environment Java Technology Edition, Version 5, affects: Lotus Widget Factory. *** http://www.ibm.com/support/docview.wss?uid=swg21963161 *** Bugtraq: ESA-2015-130: EMC Documentum WebTop and WebTop Clients Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536237 *** Bugtraq: ESA-2015-131: EMC Documentum Content Server Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536236 *** Bugtraq: ESA-2015-094: RSA Archer GRC Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536235 *** Bugtraq: ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/536234 *** WP REST API (WP API) <= 1.2.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8152 *** WP OAuth Server <= 3.1.4 - Insecure Pseudorandom Number Generation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8153

1 0

Tageszusammenfassung - Freitag 14-08-2015
by Daily end-of-shift report 14 Aug '15

14 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 13-08-2015 18:00 − Freitag 14-08-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation *** --------------------------------------------- This is part #3 of the "One font vulnerability to rule them all" blog post series. In the previous posts, we introduced the "blend" PostScript operator vulnerability, discussed the Charstring primitives necessary to fully control the stack contents and used them to develop a reliable user-mode Adobe Reader exploit executing arbitrary C++ code embedded in the PDF file:One font vulnerability to rule them all #1: introducing the BLEND vulnerabilityOne font vulnerability to... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Adwind: another payload for botnet-based malspam, (Fri, Aug 14th) *** --------------------------------------------- Introduction Since mid-July 2015, Ive noticed an increase in malicious spam (malspam) caught by my employers spamfilters with java archive (.jar file) attachments. These .jar files are most often identified as Adwind. Adwind is a Java-based remote access tool (RAT) used by malware authors to infect computers with backdoor access. Theres no vulnerability involved. To infect a Windows computer, the user has to execute the malware by double-clicking on the .jar file. Im currently seeing enough... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20041&rss *** Windows 10: Gefährlicher Zertifikats-Wirrwarr *** --------------------------------------------- Windows 10 sammelt fleißig Benutzerdaten und überträgt sie an Microsoft. Ausgerechnet dabei verzichtet das Betriebssystem auf einen ansonsten verwendeten Schutz vor falschen Zertifikaten - sensible Daten könnten so zur leichten Beute werden. --------------------------------------------- http://heise.de/-2776810 *** CaVer: Neue Technik findet Schwachstellen in C++-Code *** --------------------------------------------- US-Wissenschaftler haben ein Verfahren entwickelt, das fehlerhafte Typumwandlungen in C++-Programmen zur Laufzeit identifiziert. Es hat bereits mehrere inzwischen behobene Schwachstellen in der GNU-libstd++ und in Firefox aufgespürt. --------------------------------------------- http://heise.de/-2778993 *** Was tun bei Handy-Verlust? *** --------------------------------------------- Besitzer sollten Sicherheitsvorkehrungen treffen --------------------------------------------- http://derstandard.at/2000020734740 *** Android-Sicherheitslücke: Googles Stagefright-Patch ist fehlerhaft *** --------------------------------------------- Google muss einen der Stagefright-Patches überarbeiten. Der Patch schließt die Sicherheitslücke nicht, und Android-Geräte sind weiterhin angreifbar. Ein korrigierter Patch für die Nexus-Modelle wird diesen Monat aber nicht mehr erscheinen. --------------------------------------------- http://www.golem.de/news/android-sicherheitsluecke-googles-stagefright-patc… *** Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" *** --------------------------------------------- Auslaufendes A-Trust Root-Zertifikat "A-Trust-nQual-03" | 14. August 2015 | In den diversen Certificate Stores (Browser, Windows) ist ein Root-Zertifkat von A-Trust mit Gültigkeit bis 18. August 2015: A-Trust-nQual-03 SHA-1 Fingerprint D3:C0:63:F2:19:ED:07:3E:34:AD:5D:75:0B:32:76:29:FF:D5:9A:F2 | Unseren (limitierten) Recherchen nach gibt es im Certificate Store von Windows noch andere A-Trust Root-Zertifikate (auch mit SHA256, vgl. Microsoft Root Certificate Program). In den Certificate... --------------------------------------------- http://www.cert.at/services/blog/20150814120852-1571.html *** Eurocentric Ransomware Spam in Circulation *** --------------------------------------------- A number of spam runs are gunning for customers of various European businesses. Fake delivery messages and online bills quickly give way to Ransomware...Categories: Fraud/Scam AlertTags: emailmalwarephishransomwarespamtorrentlocker(Read more...) --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/eurocentric-ransomware-spa… *** Lampen, Schlösser, Alarmanlagen hackbar: Wiener fanden Schwachstelle in ZigBee-Standard *** --------------------------------------------- Sicherheitsfirma Cognosec weist auf Sicherheitsprobleme beim "smarten" Zuhause hin --------------------------------------------- http://derstandard.at/2000020752533 *** Why Vulnerability Research Is A Good Thing *** --------------------------------------------- Earlier this week Oracle's CSO released a blog post that talked about why people should stop looking for vulnerabilities in their software products. Needless to say, this did not go down well with the security community - and the post was soon taken down with a statement from the company adding that the post "does not reflect our... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Laorf2GvBCU/ *** Security, Reverse Engineering and EULAs *** --------------------------------------------- Like more than a few others, I experienced the infosec outrage against Mary Ann Davidson, Oracle's Chief Security Officer, before I actually read the now-redacted blog post. After taking the time to read what she actually wrote (still available through Google's web cache), I think there's more discussion to be had than I've seen so far. --------------------------------------------- http://www.tripwire.com/state-of-security/risk-based-security-for-executive… *** Apple Patches Critical OS X DYLD Flaw in Monster Update *** --------------------------------------------- Apple released hordes of patches for OS X, iOS, Safari and iOS Server, including fixes for the DYLD vulnerability disclosed in July. --------------------------------------------- http://threatpost.com/apple-patches-critical-os-x-dyld-flaw-in-monster-upda… *** Apple Security Updates *** --------------------------------------------- *** iOS 8.4.1 *** https://support.apple.com/kb/HT205030 *** OS X Yosemite 10.10.5 and Security Update 2015-006 *** https://support.apple.com/kb/HT205031 *** Safari 8.0.8, Safari 7.1.8, and Safari 6.2.8 *** https://support.apple.com/kb/HT205033 *** OS X Server v4.1.5 *** https://support.apple.com/kb/HT205032 *** Cisco Advisories *** --------------------------------------------- *** Cisco TelePresence Video Communication Server Expressway Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40441 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40444 *** Cisco TelePresence Video Communication Server Expressway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40443 *** ICS-CERT Alerts *** --------------------------------------------- *** Rockwell Automation 1769-L18ER and A LOGIX5318ER Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-01 *** Rockwell Automation 1766-L32 Series Vulnerability *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-225-02 *** KAKO HMI Hard-coded Password *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-01 *** Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-02 *** Prisma Web Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-03 *** Moxa ioLogik E2210 Vulnerabilities *** https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-224-04 *** DFN-CERT-2015-1258: Request Tracker: Eine Schwachstelle ermöglicht einen Cross-Site-Scripting-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1258/

1 0

Tageszusammenfassung - Donnerstag 13-08-2015
by Daily end-of-shift report 13 Aug '15

13 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-08-2015 18:00 − Donnerstag 13-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New SMiShing Campaign Targets T-Mobile Subscribers *** --------------------------------------------- Criminals after online credentials have homed in on T-Mobile users, luring them with a $20 discount in exchange for .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/new-smishing-campaign-targ… *** Android: Und noch eine schwere Sicherheitslücke *** --------------------------------------------- Forscher von IBM haben in Googles mobilem Betriebssystem eine Lücke entdeckt, die über die Hälfte aller Android-Geräte betrifft. Sie erlaubt das Übernehmen privilegierter Prozesse durch einen Angreifer. Google hat die Lücke bereits geschlossen. --------------------------------------------- http://heise.de/-2777648 *** Cisco ASA Unicast Reverse Path Forwarding (uRPF) Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40440 *** Cisco Warns Customers About Attacks Installing Malicious IOS Bootstrap Images *** --------------------------------------------- Cisco is warning enterprise customers about a spike in attacks in which hackers use valid credentials on IOS devices to log in as administrators and then upload malicious ROMMON images to take control of the devices. The ROM Monitor is the .. --------------------------------------------- http://threatpost.com/cisco-warns-customers-about-attacks-installing-malici… *** Cisco TelePresence Video Communication Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40433 *** Volkswagen-Hack nach langer Sperrverfügung veröffentlicht *** --------------------------------------------- Vor einigen Jahren haben Forscher entdeckt, dass sich Motorolas Megamos-Transponder, der in den Autoschlüsseln unter anderem von Volkswagen verwendet wird, angreifen lässt. VW ließ damals gerichtlich untersagen, Detailinformationen über die Lücke zu veröffentlichen. Jetzt ist dies gelungen. --------------------------------------------- http://www.golem.de/news/autoschluessel-volkswagen-hack-nach-langer-sperrve… *** Script injection vulnerability discovered in Salesforce *** --------------------------------------------- Elastica discovered an injection vulnerability in Salesforce which opened the door for attackers to use a trusted Salesforce application as a platform to conduct phishing attacks to steal end-users l... --------------------------------------------- http://www.net-security.org/secworld.php?id=18759 *** Spam and phishing in Q2 2015 *** --------------------------------------------- In Q2 2015, the percentage of spam in email traffic accounted for 53.4%. The USA (14.6%) and Russia (7.8%) remained the biggest sources of spam. China came third with 7.1%. The Anti-Phishing system was triggered 30,807,071 times on computers of Kaspersky Lab users. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/71759/spam-and-phishi… *** Berliner Internet-Provider 1blu Opfer einer Hacker-Attacke *** --------------------------------------------- Bislang unbekannte Angreifer haben sich Zugriff auf das interne System verschafft und erpressen den Berliner Internet-Provider nun. --------------------------------------------- http://futurezone.at/digital-life/berliner-internet-provider-1blu-opfer-ein… *** VoIP Fraud - Brute Force and Ignorance *** --------------------------------------------- The topic of VoIP fraud seems to ebb and flow within the IT-industry press, but struggle to break the surface of mainstream media. Specialist publications report flaws in commonly-used home routers and widespread campaigns against corporate VoIP PBXes while these stories are bypass .. --------------------------------------------- https://blog.team-cymru.org/2015/08/voip-fraud-brute-force-and-ignorance/ *** YARA: Simple and Effective Way of Dissecting Malware *** --------------------------------------------- In this article, we will learn about the YARA tool, which gives a very simple and highly effective way of identifying and classifying malware. We all know that Reverse Engineering is the highly recommended method for performing a complete post-mortem .. --------------------------------------------- http://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-… *** Erster Nexus Patch Day: Google schliesst 21 Sicherheitslücken *** --------------------------------------------- Acht davon "kritisch" - Neben Bugs in Stagefright noch zahlreiche andere Probleme bereinigt --------------------------------------------- http://derstandard.at/2000020697116 *** TOTOLINK Update - How to NOT handle security issues *** --------------------------------------------- This post is an an update to: Backdoor and RCE found in 8 TOTOLINK router models Backdoor credentials found in 4 TOTOLINK router models 4 TOTOLINK router models vulnerable to CSRF and XSS attacks 15 TOTOLINK router models vulnerable to multiple RCEs --------------------------------------------- https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-secu…

1 0

Tageszusammenfassung - Mittwoch 12-08-2015
by Daily end-of-shift report 12 Aug '15

12 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-08-2015 18:00 − Mittwoch 12-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MS15-AUG - Microsoft Security Bulletin Summary for August 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-AUG *** Adobe, MS Push Patches, Oracle Drops Drama *** --------------------------------------------- Adobe today pushed another update to seal nearly three dozen security holes in its Flash Player software. Microsoft also released 14 patch bundles, including a large number of fixes for computers running its new Windows 10 operating system. Not to be left out of Patch Tuesday, Oracles chief security officer lobbed something .. --------------------------------------------- http://krebsonsecurity.com/2015/08/adobe-ms-push-patches-oracle-drops-drama/ *** Defending against CVE-2015-1769: a logical issue exploited via a malicious USB stick *** --------------------------------------------- Today Microsoft released update MS15-085 to address CVE-2015-1769, an important severity security issue in Mount Manager. It affects both client and server versions, from Windows Vista to Windows 10. The goal of this blog post .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-201… *** MSRT August 2015: Vawtrak *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Vawtrak Win32/Critroni Win32/Kasidet Critroni is a ransomware malware family that can lock your files and ask .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/11/msrt-august-2015-vawtrak… *** Emerging ransomware: Troldesh *** --------------------------------------------- Troldesh (detected as variants of Win32/Troldesh) started to show up in the early part of 2015 and became more prevalent in June this year. Overall detections have so far lessened in July - except for a notable spike around the 8th of the month, .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/09/emerging-ransomware-trol… *** OpenSSH 7.0 Released *** --------------------------------------------- An anonymous reader writes: Today the OpenSSH project maintainers announced the release of version 7.0. This release is focusing on deprecating weak and unsafe cryptographic methods, though some of the work wont be complete until 7.1. This release removes support for the following: the legacy SSH v1 protocol, .. --------------------------------------------- http://it.slashdot.org/story/15/08/11/2340247/openssh-70-released *** IoT security is RUBBISH says IoT vendor collective *** --------------------------------------------- Online Trust Alliance calls on gadget vendors to stop acting like clowns A vendor group whose membership includes Microsoft, Symantec, Verisign, ADT and TRUSTe reckons the Internet of Things (IoT) market is being pushed with no regard to either .. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/iot_security_is_rubbish_says_iot_ve… *** KCI-Angriff auf TLS missbraucht Clientzertifikate *** --------------------------------------------- Ein komplexer Angriff nutzt eine trickreiche Kombination aus Clientzertifikaten und einem statischen Diffie-Hellman-Schlüsselaustausch. Der Angriff ist nur in sehr speziellen Situationen relevant, doch es zeigt sich wieder einmal, dass das TLS-Protokoll selbst Sicherheitslücken hat. --------------------------------------------- http://www.golem.de/news/schluesselaustausch-kci-angriff-auf-tls-missbrauch… *** Hacker ermöglichen Börsen-Insidergeschäfte in Millionenhöhe *** --------------------------------------------- Pressemitteilungen beinhalten gelegentlich Informationen, die an der Börse viel Geld wert sind - vor allem, wenn sie vor ihrer Veröffentlichung in die Hände von Tätern gelangen, die damit Insidergeschäfte machen. In den USA wurde ein Verbrecherring zerschlagen, der über 100 Millionen US-Dollar damit verdient haben soll. --------------------------------------------- http://www.golem.de/news/pressemitteilungen-hacker-ermoeglichen-boersen-ins… *** Schneider Electric IMT25 DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a memory corruption vulnerability in Schneider Electric IMT25 DTM component. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01 *** Blacklists miss 90% of malware blogged IP love *** --------------------------------------------- Correlate all the things. Threat intelligence firm RecordedFuture says popular web blacklists are missing thousands of IP addresses linked to malware data theft. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/two_shady_men_walk_into_a_bar_black… *** Security: Lenovos sanktioniertes Rootkit *** --------------------------------------------- Nach einer kompletten Neuinstallation von Windows auf einem Lenovo-Laptop wurde zur Überraschung eines Anwenders plötzlich auch ein Lenovo-Dienst gestartet. Er vermutete eine Art Bios-Rootkit und lag damit offenbar gar nicht so falsch. --------------------------------------------- http://www.golem.de/news/security-lenovos-sanktioniertes-rootkit-1508-11571… *** Windows Service Accounts - Why They're Evil and Why Pentesters Love them! *** --------------------------------------------- Windows Service Accounts have been one of those enterprise neccessary evils - things that you have to have, but nobody ever talks about or considers to be a problem. All too often, these service accounts are in the Domain Admins group, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20029 *** August 2015 Security Update Release Summary *** --------------------------------------------- Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are .. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/08/11/august-2015-security-upd… *** Thunderstrike 2: Mac firmware worm details *** --------------------------------------------- This is the annotated transcript of our DefCon 23 / BlackHat 2015 talk, which presented the full details of Thunderstrike 2, the first firmware worm for Apples Macs that can spread via both software or Thunderbolt hardware accessories and writes .. --------------------------------------------- https://trmm.net/Thunderstrike2_details *** Firefox Under Fire: Anatomy of latest 0-day attack *** --------------------------------------------- On the August 6th, the Mozilla Foundation released a security update for the Firefox web browser that fixes the CVE-2015-4495 vulnerability in Firefox's embedded PDF viewer, PDF.js. This vulnerability allows attackers to bypass the same-origin policy and execute JavaScript remotely that will be .. --------------------------------------------- http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-late… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part II - Supremacy *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in .. --------------------------------------------- http://blog.checkpoint.com/2015/08/11/finding-vulnerabilities-in-core-wordp… *** SSD Advisory - ZendXml Multibyte Payloads XXE/XEE *** --------------------------------------------- The XML standard defines a concept of an external entites. XXE (XML eXternal Entity) attack is an attack on an application that parses XML input from untrusted sources using incorrectly configured XML parser. The application may be forced to open arbitrary files and/or network resources. Exploiting XXE issues on PHP applications may also lead to denial of service or in some cases (for example, when an 'expect' PHP module is installed) lead to command execution. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2550

1 0

Tageszusammenfassung - Dienstag 11-08-2015
by Daily end-of-shift report 11 Aug '15

11 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-08-2015 18:00 − Dienstag 11-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Beliebige SSL-Zertifikate durch Missbrauch der Uralt-Internettechnik BGP *** --------------------------------------------- Das für das globale Internet unabdingbare Border Gateway Protocol (BGP) lässt sich leicht manipulieren. Ein Hacker beschrieb auf der Black Hat, wie man darüber gültige SSL-Zertifikate für beliebige Domains ausstellen lassen kann. --------------------------------------------- http://heise.de/-2774454 *** Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36968 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=33996 *** CVE-2015-2419 - Internet Explorer Double-Free in Angler EK *** --------------------------------------------- The Angler Exploit Kit (EK) recently added support for an Internet Explorer (IE) vulnerability (CVE-2015-2419) that was patched in July 2015. Quickly exploiting recently patched vulnerabilities is standard for Angler EK authors, but the target has been Adobe Flash Player since the .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/08/cve-2015-2419_inte.html *** The Italian Connection: An analysis of exploit supply chains and digital quartermasters *** --------------------------------------------- On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team - an Italian pentesting company known .. --------------------------------------------- http://blog.shadowserver.org/2015/08/10/the-italian-connection-an-analysis-… *** QNAP Turbo NAS Series Devices Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Traverse the Directory, Execute Arbitrary Code, and Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033224 *** QNAP Logging Error Lets Local Users Obtain Disk Encryption Keys *** --------------------------------------------- http://www.securitytracker.com/id/1033223 *** Internal modem can be exploited by malware to gain persistence *** --------------------------------------------- Two security experts at the last Def Con hacking conference have demonstrated how Internal LTE/3G modems can be hacked to help malware survive OS reinstalls Many users totally ignore that LTE/3G modems built into new business laptops and .. --------------------------------------------- http://securityaffairs.co/wordpress/39252/hacking/internal-modem-hacking.ht… *** Who's Behind Your Proxy? Uncovering Bunitu's Secrets *** --------------------------------------------- In our previous analysis we showed how the Bunitu Trojan was distributed via the Neutrino exploit kit in various malvertising campaigns. After spending more time analyzing .. --------------------------------------------- https://blog.malwarebytes.org/botnets/2015/08/whos-behind-your-proxy-uncove… *** Watch out for Costly Mobile Ads *** --------------------------------------------- There are lots of ways you can have a bad hair day with a mobile device - a rogue app from the Play Store, a dubious file from a non-official source or even a phish attack which takes advantage of a mobile's smaller screen size. A less annoying issue is pop-ups, adverts .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/watch-out-for-costly-… *** Tanksysteme ungeschützt im Netz: Leichte Beute für Hacker *** --------------------------------------------- Bankomatkassen an Zapfsäulen wurden bereits zum Ziel von Hackerangriffen, um Daten zu stehlen. Doch Tankstellen könnten von Kriminellen im Internet auch für weitaus gefährlichere Attacken ins Visier genommen werden. Das Forscherteam von Rapid7 fand laut "Wired" .. --------------------------------------------- http://derstandard.at/2000020547838 *** Vulnerabilities iframe <= 3.0 *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8150 https://wpvulndb.com/vulnerabilities/8149 *** Threat Group-3390 Targets Organizations for Cyberespionage *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers investigated activities associated with Threat Group-3390[1] (TG-3390). Analysis of TG-3390s operations, targeting, and tools led CTU researchers to assess with moderate confidence .. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3… *** Instant KARMA Might Still Get You *** --------------------------------------------- About a year ago, I started looking into Android applications that arent validating SSL certificates. Users of these applications could be at risk if they fall victim to a man-in-the-middle (MITM) attack. Earlier this year, I also wrote about .. --------------------------------------------- https://insights.sei.cmu.edu/cert/2015/08/instant-karma-might-still-get-you… *** Dynamic DNS Security and Potential Threats *** --------------------------------------------- Recently I began to notice a trend that Dynamic DNS providers have been repeatedly abused as a part of malware campaigns. How is dynamic DNS a threat to your enterprise? What can be done to mitigate this threat? Before we answer these questions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-a… *** Another Android hole: "OCtoRuTA" - One (Java) Class to Rule Them All *** --------------------------------------------- Yet another large-scale vulnerability has been revealed in Android. This one lets an otherwise innocent-looking app go rogue, and enjoy privileges normally limited to the trusted parts of Android. --------------------------------------------- https://nakedsecurity.sophos.com/2015/08/11/another-android-hole-octoruta-o… *** Kali Linux 2.0 Released *** --------------------------------------------- We're still buzzing and recovering from the Black Hat and DEF CON conferences where we finished presenting our new Kali Linux Dojo, which was a blast. With the help of a few good people, the Dojo rooms were set up ready for the masses - where many .. --------------------------------------------- https://www.kali.org/releases/kali-linux-20-released/ *** Security Updates Available for Adobe Flash Player (APSB15-19) *** --------------------------------------------- A security bulletin (APSB15-19) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1254 *** Mobilfunkdaten bei Facebook massenhaft auslesbar *** --------------------------------------------- Einem Entwickler ist es gelungen, mit einem kleinen Skript binnen weniger Minuten zahlreiche Mobilfunknummern von Nutzern über Facebook abzufragen. Sicherheitsexperten drängen auf eine andere Voreinstellung. --------------------------------------------- http://heise.de/-2776623

1 0

Tageszusammenfassung - Montag 10-08-2015
by Daily end-of-shift report 10 Aug '15

10 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-08-2015 18:00 − Montag 10-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Tech Firm Ubiquiti Suffers $46M Cyberheist *** --------------------------------------------- Networking firm Ubiquiti Networks Inc. disclosed this week that cyber thieves recently stole $46.7 million using an increasingly common scam in which crooks spoof communications from executives at the victim firm in a bid to initiate unauthorized international wire transfers. --------------------------------------------- http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheis… *** Welcome to The Internet of Compromised Things *** --------------------------------------------- This post is a bit of a public service announcement, so Ill get right to the point: Every time you use WiFi, ask yourself: could I be connecting to the Internet through a compromised router with malware?Its becoming more and .. --------------------------------------------- http://blog.codinghorror.com/welcome-to-the-internet-of-compromised-things/ *** Black Hat: Schadsoftware per Windows-Update mit WSUS *** --------------------------------------------- Zwei Sicherheitsforscher demonstrierten auf der Black-Hat-Konferenz, wie sich die Windows Server Update Services (WSUS) zum Verteilen von gefälschten Windows-Updates in einem Unternehmensnetz benutzen lassen. Es gibt jedoch ein schlichtes Gegenmittel. --------------------------------------------- http://heise.de/-2775156 *** Black Hat: SMM weiterhin grosses Einfallstor *** --------------------------------------------- Ein Computerwissenschaftler zeigt ein Scheunentor, das schon zwanzig Jahre offen steht. --------------------------------------------- http://heise.de/-2775248 *** RIG Reloaded - Examining the Architecture of RIG Exploit Kit 3.0 *** --------------------------------------------- A few months ago the RIG exploit kit took quite a hit when its source code was leaked by a disgruntled reseller. At the time we wrote a blog post detailing the inner workings of RIGs infrastructure and business model,... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the… *** Stagefright: Online-Ganoven tarnen Android-Trojaner als Sicherheitsupdate *** --------------------------------------------- Während die meisten Hersteller keine oder wenige Firmware-Updates anbieten, die vor den gefährlichen Stagefright-Lücken schützen, können Online-Abzocker vermeintlich schon liefern. Es handelt sich dabei allerdings um einen Trojaner. --------------------------------------------- http://heise.de/-2775388 *** WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8145 *** Stagefright: Motorola verspricht umfassende Updates *** --------------------------------------------- Auch wenn es bisher noch keine Hinweise auf entsprechende Angriffe gibt – die vor zwei Wochen bekannt gewordenen Sicherheitslücken im Media Framework Stagefright haben ordentlich Bewegung in die Android-Welt gebracht. Nach Google, LG und Samsung meldet sich mit Motorola nun der nächste Hersteller zu Wort – und verspricht umfassende Updates. --------------------------------------------- http://derstandard.at/2000020502273 *** Data, Technologies and Security - Part 1 *** --------------------------------------------- A lot of technologies present themselves as solutions for multiple challenges. At BinaryEdge, we are big adepts of analyzing all the different technologies until we see what correctly adapts and fits our environment. From a security .. --------------------------------------------- http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ *** What's Next in Malware After Kuluoz? *** --------------------------------------------- Regular readers of this blog have heard all about the infamous Kuluoz malware. This family was the latest evolution of the Asprox malware and at its peak in 2014 it accounted for 80% of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-af… *** Getting in with the Proxmark 3 and ProxBrute *** --------------------------------------------- As a member of the Physical Security team here at SpiderLabs, some of my job responsibilities include getting into a facility by any (non-destructive) means necessary. When a client has decided once and for all that theyve trained their guards and fortified the gates, its time to test those defenses to measure just how resilient they actually are to an attack. And thats where we come in. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-in-with-the-Pro… *** Google Analytics by Yoast <= 5.4.4 - Authenticated Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8147 *** Mass Dark Web Scanning With PunkSPIDER *** --------------------------------------------- A while back we did some work in scanning Tor hidden services for vulnerabilities (read about it here - btw I love this article for its use of dark web and explaining that the term is highly disputed). Basically, if you dont want to read it, we did a massive scan of the Tor network for web app vulnerabilities as part of our .. --------------------------------------------- http://alex.hyperiongray.com/posts/289994-scanning-the-dark-web *** Stagefright Vulnerability Disclosure *** --------------------------------------------- StageFright which handles multiple media formats, is a system service for Android. This service is implemented by Native C++. The following diagram shows how media applications interact with .. --------------------------------------------- http://translate.wooyun.io/2015/08/08/Stagefright-Vulnerability-Disclosure.… *** Darkhotel APT Latest to Use Hacking Team Zero Day *** --------------------------------------------- The Darkhotel APT gang has extended its geographic reach to victims in a host of additional countries, and has added to its cache of zero days with its use of a HackingTeam exploit for a Flash zero-day vulnerability. --------------------------------------------- http://threatpost.com/darkhotel-apt-latest-to-use-hacking-team-zero-day/114…

1 0

Tageszusammenfassung - Freitag 7-08-2015
by Daily end-of-shift report 07 Aug '15

07 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-08-2015 18:00 − Freitag 07-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Updated DGA Changer Malware Generates Fake Domain Stream *** --------------------------------------------- Researchers at Seculert have discovered the latest twist to DGA Changer, which now is able to generate a fake stream of domains if it detects it's being executed in a virtual machine. --------------------------------------------- http://threatpost.com/updated-dga-changer-malware-generates-fake-domain-str… *** BLEKey Device Breaks RFID Physical Access Controls *** --------------------------------------------- A device called BEKey which is the size of a quarter and can be installed in 60 seconds on a proximity card reader could potentially be used to break physical access controls in 80 percent of deployments. --------------------------------------------- http://threatpost.com/blekey-device-breaks-rfid-physical-access-controls/11… *** BIND Denial of Service Vulnerability Blamed on Windows 2000 Compatibility Code *** --------------------------------------------- The BIND implementation of the Domain Name System (DNS) is a critical part of the infrastructure of the Internet. For example, almost all of the 13 root name servers use BIND. On July 28 a vulnerability was published in BIND that could be anonymously exploited by an attacker. To crash the server, all an attacker would have to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OQsKsP-w1DU/ *** Schwachstelle: Certifi-Gate erlaubt Zertifikatsmissbrauch unter Android *** --------------------------------------------- Bösartige Apps können in Android legitime Zertifikate nutzen, um erhöhte Rechte zu erhalten. Die Entdecker der Schwachstelle haben dieser den Namen Certifi-Gate gegeben. Google bestätigt die Lücke, betont aber, dass Apps im Play Store auf ein solches Missbrauchspotential überprüft würden. --------------------------------------------- http://www.golem.de/news/schwachstelle-certifi-gate-erlaubt-zertifikatsmiss… *** HTTPS: BGP-Angriff gefährdet TLS-Zertifikatssystem *** --------------------------------------------- Auf der Black Hat weisen Sicherheitsforscher auf ein Problem mit TLS-Zertifizierungsstellen hin: Die Prüfung, wem eine Domain gehört, findet über ein ungesichertes Netz statt. Dieser Weg ist angreifbar - beispielsweise mittels des Routingprotokolls BGP. --------------------------------------------- http://www.golem.de/news/https-bgp-angriff-gefaehrdet-tls-zertifikatssystem… *** Kryptographie: Rechenfehler mit großen Zahlen *** --------------------------------------------- Kryptographische Algorithmen benötigen oft Berechnungen mit großen Ganzzahlen. Immer wieder werden Fehler in den entsprechenden Bibliotheken gefunden. Diese können zu Sicherheitslücken werden. --------------------------------------------- http://www.golem.de/news/kryptographie-rechenfehler-mit-grossen-zahlen-1508… *** Zwölf Sicherheitslücken in PHP geschlossen, Support für Version 5.5 ausgelaufen *** --------------------------------------------- Das PHP-Entwickerteam hat seinen Interpreter sicherer gemacht und weist darauf hin, dass der Support für Version 5.5 vor kurzem abgelaufen ist. Wer kann, sollte auf Version 5.6 umsteigen. --------------------------------------------- http://heise.de/-2774343 *** The GasPot experiment: Hackers target gas tanks *** --------------------------------------------- Physically tampering with gasoline tanks is dangerous enough, given how volatile gas can be. Altering a fuel gauge can cause a tank to overflow, and a simple spark can set everything ablaze. But imagi... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/5bYYfndJK74/secworld.php *** Auto-Hacking: Gehackte Teslas lassen sich bei voller Fahrt ausschalten *** --------------------------------------------- Insgesamt sechs Lücken haben IT-Sicherheitsforscher in der Software der Automobile von Tesla entdeckt. Über sie gelang es ihnen, die Kontrolle über das Fahrzeug zu übernehmen. --------------------------------------------- http://www.golem.de/news/auto-hacking-gehackte-teslas-lassen-sich-bei-volle… *** Firefox exploit found in the wild *** --------------------------------------------- Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1. https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ --------------------------------------------- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-w… *** CrackLord: Gratis-Tool zum Steuern von Cracking-Clustern *** --------------------------------------------- Forscher haben mit CrackLord eine Open-Source-Software vorgestellt, die CPU-/GPU-Cluster zum Cracken von Passwörtern ansteuert und Aufgaben verwaltet und verteilt. --------------------------------------------- http://heise.de/-2774582 *** Scada-Sicherheit: Siemens-PLC wird zum Einbruchswerkzeug *** --------------------------------------------- Über die oftmals frei aus dem Internet zugänglichen Programmable Logic Controller (PLC) zum Steuern von Scada-Systemen können Angreifer Scanner zum Spionieren in Industrie-Systeme schmuggeln. Die dafür nötige Software steht frei zum Download. --------------------------------------------- http://heise.de/-2774812 *** Citrix XenServer Security Update for CVE-2015-5154 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to compromise the host ... --------------------------------------------- http://support.citrix.com/article/CTX201593 *** USN-2706-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2706-16th August, 2015openjdk-6 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security issues were fixed in OpenJDK 6.Software description openjdk-6 - Open Source Java implementation DetailsSeveral vulnerabilities were discovered in the OpenJDK JRE related toinformation disclosure, data integrity, and availability. An attackercould exploit these to cause a denial of service or expose sensitivedata... --------------------------------------------- http://www.ubuntu.com/usn/usn-2706-1/ *** Security Advisory: Java SE vulnerabilities CVE-2015-2590 and CVE-2015-4732 *** --------------------------------------------- (SOL17079) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17079.htm… *** DSA-3329 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernelthat may lead to a privilege escalation, denial of service orinformation leak. --------------------------------------------- https://www.debian.org/security/2015/dsa-3329 *** Apache Subversion Bugs Let Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033215 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A Security Vulnerability, exists in the Android platform used by the Cordova tools in Rational Application Developer for WebSphere Software (CVE-2015-1835) *** http://www.ibm.com/support/docview.wss?uid=swg21962128 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM Security Identity Governance *** http://www.ibm.com/support/docview.wss?rs=0&uid=swg21963438 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem V840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005344 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem 840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005339 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960191 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Monitoring (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962739 *** IBM Security Bulletin: A vulnerability in Open Source Struts affects the IBM FlashSystem 840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005329 *** IBM Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V840 (CVEs 2015-0204, 2015-0488, and 2015-1916) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005328 *** IBM Security Bulletin: A vulnerability in Open Source Struts affect the IBM FlashSystem V840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005331 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21883959 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Mobile. *** http://www.ibm.com/support/docview.wss?uid=swg21963158 *** IBM Security Bulletin: Multiple vulnerability in Product IBM Tivoli Common Reporting(CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2014-0227, CVE-2015-0209 , CVE-2015-0286 , CVE-2015-0289) *** http://www.ibm.com/support/docview.wss?uid=swg21963024 *** IBM Security Bulletin: A vulnerability in Open Source OpenSSL affects the IBM FlashSystem 840 (CVE 2015-0286) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005341 *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat affect the IBM FlashSystem V840, (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005204

1 0

Tageszusammenfassung - Donnerstag 6-08-2015
by Daily end-of-shift report 06 Aug '15

06 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-08-2015 18:00 − Donnerstag 06-08-2015 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Jetzt Android-Geräte auf Stagefright-Lücken testen! *** --------------------------------------------- Mit einer kostenlosen App kann man überprüfen, ob die eigenen Android-Geräte über die Stagefright-Lücken angreifbar sind. --------------------------------------------- http://heise.de/-2773801 *** Stagefright-Sicherheitslücke: Elf Wege, ein Android-System zu übernehmen *** --------------------------------------------- Auf der Black-Hat-Konferenz hat Joshua Drake die Hintergründe zu den Stagefright-Sicherheitslücken erläutert. Über mindestens elf verschiedene Wege lässt sich ein Android-System seinem Vortrag zufolge angreifen. Fortschritte gibt es bei den Android-Updates. (Android, Firefox) --------------------------------------------- http://www.golem.de/news/stagefright-sicherheitsluecke-elf-wege-ein-android… *** APT Group Gets Selective About Data it Steals *** --------------------------------------------- Dell SecureWorks researchers today at Black Hat released a new report on Emissary Panda, or TG-3390, a China-sponsored APT gang that has refined the types of data it covets. --------------------------------------------- http://threatpost.com/apt-group-gets-selective-about-data-it-steals/114103 *** Inside the $100M 'Business Club' Crime Gang *** --------------------------------------------- New research into a notorious Eastern European organized cybercrime gang accused of stealing than $100 million from banks and businesses worldwide provides an unprecedented, behind-the-scenes look at an exclusive "business club" that dabbled in cyber espionage and worked closely with phantom Chinese firms on Russias far eastern border. --------------------------------------------- http://www.krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-… *** Corporate networks can be compromised via Windows Updates *** --------------------------------------------- Yesterday at Black Hat USA 2015, researchers from UK-based Context Information Security demonstrated how Windows Update can be abused for internal attacks on corporate networks by exploiting insecurely configured enterprise implementations of Windows Server Update Services (WSUS). --------------------------------------------- http://www.net-security.org/secworld.php?id=18725 *** Exploit-Kit Rig: Verbrechen lohnt sich wieder *** --------------------------------------------- Vor einigen Monaten wurde der Quellcode des Exploit-Kits RIG 2.0 veröffentlicht; damit war der Shooting-Star der Crimeware-Szene erstmal aus dem Rennen. Jetzt sind die Entwickler mit einer Version 3.0 zurück - und verdienen besser denn je. --------------------------------------------- http://heise.de/-2772951 *** How Scammers Abuse Our Brains *** --------------------------------------------- Your brain is awesome. We're not just flattering you, it's true. It's also true of the guy sat next to you, the woman across the street, even your kid cousin who still thinks that flicking boogers is the height of hilarity. Each one of us is blessed with a brain that has unparalleled amounts of storage, and ferocious processing power. That said, our minds are still finite. The amount of information we can attend to at a given moment is limited. --------------------------------------------- https://blog.team-cymru.org/2015/08/how-scammers-abuse-our-brains/ *** Bugtraq: Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows *** --------------------------------------------- the just released latest version 5.0.0.5 of LibreOffice.org for Windows distributes (once again) a completely outdated and vulnerable MSVC++ runtime. --------------------------------------------- http://www.securityfocus.com/archive/1/536144 *** Nicholas Weaver on iPhone Security *** --------------------------------------------- Excellent essay: Yes, an iPhone configured with a proper password has enough protection that, turned off, Id be willing to hand mine over to the DGSE, NSA, or Chinese. But many (perhaps most) users dont configure their phones right. Beyond just waiting for the suspect to unlock his phone, most people either use a weak 4-digit passcode ... --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/nicholas_weaver_1.html *** Sigcheck and virustotal-search, (Thu, Aug 6th) *** --------------------------------------------- In my last diary entry I mentioned offline use of Sysinternal tools with my tool virustotal-search. So you want to use sigcheck but you cant connect the machine to the Internet. Then you can use sigchecks option -h to calculate cryptographic hashes of the files it checks, and option -c to produce a CSV output (-ct for CSV with a tab separator). If you want, you can limit sigcheck" /> To extract a unique list of MD5 hashes, you can use this pipe of awk, tail, sed and sort ... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20009&rss *** How Social Engineering Security Awareness Stops 3 Common Scams *** --------------------------------------------- Social engineering, in the context of information security, refers to the use of psychological manipulation to trick people into divulging sensitive information (information gathering) or performing actions (fraud/unauthorized system access). It is a non-technical confidence scam that resembles a very elaborate plan that consists of several stages (See the Typical Phases part). --------------------------------------------- http://resources.infosecinstitute.com/how-social-engineering-security-aware… *** Sick of Flash security holes? HTML5 has its own *** --------------------------------------------- HTML5 has been billed as the natural, standards-based successor to proprietary plug-ins such as Adobes Flash Player for providing rich multimedia services on the Web. But when it comes to security, one of Flashs major weaknesses, HTML5 is no panacea.In fact, HTML5 has security issues of its own. Julien Bellanger, CEO of application security monitoring firm Prevoty, says HTML5 makes security more complex, not simpler. HTML5 security has been a question mark for years, and it has not improved --------------------------------------------- http://www.csoonline.com/article/2960695/application-security/sick-of-flash… *** 'Funtenna' software hack turns a laser printer into a covert radio *** --------------------------------------------- Researcher demonstrates how attacker could exfiltrate data over airwaves. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/RCktE3iPj7M/ *** Black Hat: Sicherheitsforscher klonen verschlüsselte SIM-Karten *** --------------------------------------------- Die Verschlüsselung via AES 256 gilt auch langfristig als sicher. Im Zuge eines Angriffes über Bande wurden nun derartig verschlüsselte SIM-Karten in wenigen Minuten geknackt. --------------------------------------------- http://heise.de/-2773751 *** Bugtraq: [security bulletin] HPSBUX03388 SSRT102180 rev.1 - HP-UX running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running OpenSSL with SSL/TLS enabled. This is the TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as Logjam which could be exploited remotely resulting in disclosure of information. --------------------------------------------- http://www.securityfocus.com/archive/1/536142 *** FreeBSD patch(1) Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- A vulnerability was reported in FreeBSD patch(1). A remote user can cause arbitrary commands to be executed on the target system. The patch(1) utility does not properly sanitize the input patch stream. A remote user can create a specially crafted patch file that, when processed by the target user via patch(1), will run ed(1) commands (in addition to running valid version control system commands) with the privileges of the target user. --------------------------------------------- http://www.securitytracker.com/id/1033188 *** FreeBSD routed(8) RIP Query Processing Flaw Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A remote user on a network that is not directly connected to the target system's network can send a specially crafted routing information protocol (RIP) query to trigger a flaw in the target routed(8) daemon and cause the daemon to crash. As a result, the target system's routing table will no longer be updated. Systems with the routed(8) daemon enabled are affected. --------------------------------------------- http://www.securitytracker.com/id/1033185 *** Security Notice - Statement on the UAP2015 Vulnerability Mentioned at the BlackHat USA Conference *** --------------------------------------------- The investigation is still ongoing. Huawei PSIRT will keep updating the SN and will give the related views as soon as possible. Please stay tuned. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 5-08-2015
by Daily end-of-shift report 05 Aug '15

05 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-08-2015 18:00 − Mittwoch 05-08-2015 18:00 Handler: n/a Co-Handler: n/a *** Nuclear EK traffic patterns in August 2015, (Wed, Aug 5th) *** --------------------------------------------- Introduction About two weeks ago, Nuclear exploit kit (EK)changed its URL patterns. Now it looks a bit likeAngler EK. Kafeine originally announced the change on 2015-07-21 [1], and we collected examples the next day. Heres how Nuclear EK looked on" /> Here" /> Now that were into August 2015,URL patterns for Nuclear EK have altered again. These changes are similar to weve seen withAngler EK since June 2015 [3]. Theyre not the same URL patternsas Angler, but the changes are... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20001&rss *** Wait, what? TrueCrypt decrypted by FBI to nail doc-stealing sysadmin *** --------------------------------------------- Do the Feds know something we dont about crypto-tool? Or did bloke squeal his password? Discontinued on-the-fly disk encryption utility TrueCrypt was unable to keep out the FBI in the case of a US government techie who stole copies of classified military documents. How the Feds broke into the IT bods encrypted TrueCrypt partition isnt clear. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/truecrypt_d… *** WordPress-Update schließt sechs Sicherheitslücken *** --------------------------------------------- Die Version 4.2.4 des Content-Management-Systems behebt unter anderem eine SQL-Injection-Lücke, durch die Angreifer die Installation übernehmen können. --------------------------------------------- http://heise.de/-2771541 *** Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware *** --------------------------------------------- Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious. --------------------------------------------- http://www.darkreading.com/cloud/man-in-the-cloud-owns-your-dropbox-google-… *** Email Security Awareness: How To Get Quick Results *** --------------------------------------------- Phishing and Spear phishing attacks on the rise Phishing and spear phishing attacks are the most effective attack vectors. Despite the high level of awareness of the cyber threats, bad actors still consider email their privileged attack vector. According to the security experts at Trend Micro firm, spear phishing is the attack method used in... --------------------------------------------- http://resources.infosecinstitute.com/email-security-awareness-how-to-get-q… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part I *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only "Subscriber" user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web... --------------------------------------------- http://blog.checkpoint.com/2015/08/04/wordpress-vulnerabilities-1/ *** Android-Schwachstelle: Telekom schaltet wegen Stagefright-Exploits direktes MMS ab *** --------------------------------------------- MMS-Nutzer müssen wegen einer Android-Schwachstelle auf die direkte Zustellung verzichten. Die Telekom will so ihre Kunden schützen. --------------------------------------------- http://www.golem.de/news/android-schwachstelle-telekom-schaltet-wegen-stage… *** MVEL as an attack vector *** --------------------------------------------- Java-based expression languages provide significant flexibility when using middleware products such as Business Rules Management System (BRMS). This flexibility comes at a price as there are significant security concerns in their use. In this article MVEL is used in JBoss... --------------------------------------------- https://securityblog.redhat.com/2015/08/05/mvel-as-an-attack-vector/ *** Root-Exploit: Apple bereitet offenbar Patch mit MacOS 10.10.5 vor *** --------------------------------------------- Der Mac-Hersteller setzt einem Bericht zufolge zunächst auf verschiedene Maßnahmen, um die Ausnutzung einer Rechteausweitungslücke zur Malware-Installation zu erschweren. Das ausstehende Update auf OS X 10.10.5 soll die Schwachstelle dann beseitigen. --------------------------------------------- http://heise.de/-2772715 *** Bugtraq: [SECURITY] [DSA 3328-2] wordpress regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/536135 *** Apple OS X DYLD_PRINT_TO_FILE Environment Variable Validation Flaw Lets Local Users Obtain Root Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033177 *** [2015-08-05] Websense Content Gateway stack buffer overflow in handle_debug_network *** --------------------------------------------- A stack-based buffer overflow was identified in the Websense Content Manager administrative interface, which allows execution of arbitrary code. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security Advisory - CF Card Information Leak Vulnerability on Multiple Huawei Products *** --------------------------------------------- The CF cards on some Huawei switches contain some sensitive information in plaintext. Once an attacker gets such a CF card, it may result in the leak of sensitive information (HWPSIRT-2015-07048). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security_Advisory-Two Security Vulnerabilities in the ME906 Wireless Module *** --------------------------------------------- The upgrade package of the ME906 wireless module contains the hash values of the root account and password. An attacker can obtain the password of the root account through reverse cracking, connect to the serial port of the wireless module, and enter the root account and password to log in to the operating system of the module. (HWPSIRT-2015-02009) | This module implements upgrade check using CRC16, which is insecure. Much study is done for reversely cracking this algorithm. (HWPSIRT-2015-06032) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily