- Daily - CERT.at

Tageszusammenfassung - Freitag 22-05-2015
by Daily end-of-shift report 22 May '15

22 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-05-2015 18:00 − Freitag 22-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake jQuery Scripts in Nulled WordPress Plugins *** --------------------------------------------- We recently investigated some random redirects on a WordPress website that would only happen to certain visitors. Traffic analysis showed us that it was not a server-side redirect, rather it happened due to some script loaded by the web pages. A quick look through the HTML code revealed this script: It was very suspicious for... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NmLDakrD_1U/fake-jquery-scrip… *** Researchers publish developer guidance for medical device security *** --------------------------------------------- The guidance is organized into 10 categories, and serves as "starting point for a more complete code," report authors said. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/jvWoZydXqwc/ *** Researchers observe SVG files being used to distribute ransomware *** --------------------------------------------- When downloaded and executed, the SVG files cause websites to open up that download what appears to be CryptoWall ransomware. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Aa-yVI5Bd-A/ *** Exploring CVE-2015-1701 - A Win32k Elevation of Privilege Vulnerability Used in Targeted Attacks *** --------------------------------------------- Our analysis of the win32k.sys vulnerability used in a recent targeted attack reveals that it opens up an easy way to bypass the sandbox, making it a bigger threat than originally thought. As mentioned in Microsoft security bulletin MS15-051, CVE-2015-1701 is an elevation of privilege vulnerability that exists when the Win32k.sys kernel-mode driver improperly handles... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RuzGqW0kQdY/ *** Digital Agenda Seminar: European Cyber Security Month *** --------------------------------------------- Within the context of European Cyber Security Month (ECSM) preparations, the ENISA team is organising several seminars and trainings in order to build up the coalition for Cybersecurity Education action. You are invited to participate in the second seminar in Berlin, Germany on June 5th, 2015. In this half-day seminar we discuss and provide the latest information on Digital Agenda topics such as e-skills, Network Information Security, educational tools and advocacy initiatives. To participate it is necessary to confirm participation to daria.catalui(a)enisa.europa.eu by June 4th, 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/digital-agenda-seminar-european… *** Daten von Millionen zurückgesetzten Android-Smartphones wiederherstellbar *** --------------------------------------------- Wer sein Android-Smartphone verkauft hat, muss befürchten, dass trotz gelöschten Gerätespeichers noch private Daten wie etwa Nachrichten und Log-in-Daten im Speicher schlummern, die unter Umständen wiedergehergestellt werden können. --------------------------------------------- http://heise.de/-2663267 *** Forensic Analysis of Smartphone Factory Reset Function *** --------------------------------------------- ADISA, the organisation that sets security standards around the secure disposal of IT Assets, has released new research into the forensic analysis of smartphone factory reset functions. Written by Steve Mellings, Founder of ADISA, and Professor Andrew Blyth of the University of South Wales, the white paper explores how effective smartphone factory reset functions actually are at removing data. This data is then used to offer businesses and individual users advice on how best to protect their... --------------------------------------------- http://www.informationsecuritybuzz.com/forensic-analysis-of-smartphone-fact… *** When Security Makes Users Asleep! *** --------------------------------------------- It's a fact, in industries or on building sites, professional people make mistakes or, worse, get injured. Why? Because their attention is reduced at a certain point. When you're doing the same job all day long, you get tired and lack of concentration. The same can apply in information security! For a long time, more and more solutions are deployed in companies to protect their data and users. Just... --------------------------------------------- http://blog.rootshell.be/2015/05/22/when-security-makes-users-asleep/ *** Citrix Security Advisory for DHE_EXPORT TLS Vulnerability CVE-2015-4000 *** --------------------------------------------- A TLS protocol vulnerability has been recently disclosed that could result in attackers being able to intercept and modify SSL/TLS encrypted traffic ... --------------------------------------------- http://support.citrix.com/article/CTX201114 *** Citrix Security Advisory for CVE-2015-3456 *** --------------------------------------------- Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the ... --------------------------------------------- http://support.citrix.com/article/CTX201078 *** python-kerberos checkPassword() spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103310 *** Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38946 *** ICU Buffer Overflows in resolveImplicitLevels() Let Remote Users Deny Service and Potentially Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032366 *** Schneider Electric OFS Server Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a DLL hijacking vulnerability in the Schneider Electric OPC Factory Server (OFS) server application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 *** Emerson AMS Device Manager SQL Injection Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an SQL injection vulnerability in the Emerson AMS Device Manager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 *** OleumTech WIO Family Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-202-01 OleumTech WIO Family Vulnerabilities that was published July 21, 2014. This advisory provides vulnerability details in the OleumTech WIO family including the sensors and the DH2 data collector. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-202-01A *** HPSBMU03336 rev.1- HP Helion OpenStack affected by VENOM, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has identitfied with HP Helion OpenStack. The vulnerability could be exploited resulting in Denial of Service (DoS) or execution of arbitrary code. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c… *Next End-of-Shift report on 2015-05-26*

1 0

Tageszusammenfassung - Donnerstag 21-05-2015
by Daily end-of-shift report 21 May '15

21 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-05-2015 18:00 − Donnerstag 21-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RIG Exploit Kit Infection Cycle Analysis *** --------------------------------------------- Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes weve observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post well cover an example of a full RIG infection cycle. Delivery... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JM9Mp15Wupg/rig-exploit-… *** New Router Attack Displays Fake Warning Messages *** --------------------------------------------- Just because security researchers report about threats doesn't mean we're exempted from them. I recently experienced an incident at home that involved tampered DNS router settings. I was redirected to warning pages that strongly resemble those used in previous FAKEAV attacks. I noticed that my home internet router DNS settings have been modified from its default settings. (My router... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/dJj2wXBlvgk/ *** Exploit kits delivering Necurs, (Thu, May 21st) *** --------------------------------------------- Introduction In the past few days, weve seenNuclear and Anglerexploit kits (EKs) deliveringmalware identified as Necurs. It certainly isntthe only payload sentfrom Nuclear and otherEKs, but I hadnt really looked into EK traffic sending Necurs lately. Documented as early as 2012, Necurs is a type of malware that opens a back door on the infected computer [1]. It may also disable antivirus products as well as download additional malware [1][2]. I sawNecurs as a malware payload from Nuclear and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19719&rss *** Das Erste-Hilfe-Kit gegen Krypto-Trojaner *** --------------------------------------------- Mit einer Reihe von Werkzeugen will ein Forscher den Opfern von Erpressungs-Trojanern helfen, ihre Daten zu retten und ihre Systeme zu reinigen. Allerdings ist bei der Anwendung Vorsicht geboten. --------------------------------------------- http://heise.de/-2661154 *** Mumblehard Malware *** --------------------------------------------- Introduction In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives the full control of the infected machine to cybercriminals. Mumblehard malware -Components Perl Backdoor Perl backdoor will request for commands from its Command &Control Server and... --------------------------------------------- http://resources.infosecinstitute.com/mumblehard-malware/ *** Logjam: the latest TLS vulnerability explained *** --------------------------------------------- 21 May 2015 by Filippo Valsorda --------------------------------------------- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ *** The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange *** --------------------------------------------- Logjam is a new attack against the Diffie-Hellman key-exchange protocol used in TLS. Basically: The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html *** CVE-2015-4000 alias "Logjam" .. *** --------------------------------------------- http://www.cert.at/services/blog/20150521111403-1485.html *** Vuln: OpenSSL CVE-2015-0288 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73237 *** Vuln: OpenSSL /evp/encode.c Remote Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73228 *** Samba Memory Corruption Error in prs_append_some_prs_data() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032362 *** Cisco Security Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 *** Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38937 *** Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 *** DSA-3265 zendframework - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in Zend Framework, a PHPframework. Except for CVE-2015-3154, all these issues were already fixedin the version initially shipped with Jessie. --------------------------------------------- https://www.debian.org/security/2015/dsa-3265

1 0

Tageszusammenfassung - Mittwoch 20-05-2015
by Daily end-of-shift report 20 May '15

20 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-05-2015 18:00 − Mittwoch 20-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS, (Wed, May 20th) *** --------------------------------------------- Theres a new vulnerability in town... As reported by the Wall Street Journal, The new bug, dubbed LogJam, is a cousin of Freak. But its in the basic design of TLS itself, meaning all Web browsers, and some email servers, are vulnerable. [1] According to the article, Internet-security experts crafted a fix for a previously undisclosed bug in security tools used by all modern Web browsers. But deploying the fix could break the Internet for thousands of websites. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19717&rss *** Logjam: PFS Deployment Guide *** --------------------------------------------- Guide to Deploying Diffie-Hellman for TLS | Our study finds that the current real-world deployment of Diffie-Hellman is less secure than previously believed. This page explains how to properly deploy Diffie-Hellman on your server. | We have three recommendations for correctly deploying Diffie-Hellman for TLS:... --------------------------------------------- https://weakdh.org/sysadmin.html *** DDoS Attacks on the rise in Q1 2015, says Akamai *** --------------------------------------------- DDoS attacks even more dangerous according to the last report published by Akamai Technologies, the "Q1 2015 State of the Internet - Security Report". According to Akamai Technologies, Q1 2015 showed that distributed denial-of-service attacks are on the rise again, and according to Akamai Technologies, Q1 set a record for the number of DDoS attacks,... --------------------------------------------- http://securityaffairs.co/wordpress/36983/security/akamai-ddos-q1-2015.html *** "Los Pollos Hermanos" ransomware - what will they think of next? *** --------------------------------------------- The latest visual meme in ransomware comes from a cult TV show...about ficticious crooks. Paul Ducklin walks you through "PolloCrypt," more correctly known as Troj/LPoLock-A... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/jdSKvU31t58/ *** JSON, Homoiconicity, and Database Access *** --------------------------------------------- During a recent review of an internal web application based on the Node.js platform, we discovered that combining JavaScript Object Notation (JSON) and database access (database query generators or object-relational mappers, ORMs) creates interesting security challenges, particularly for JavaScript programming... --------------------------------------------- https://securityblog.redhat.com/2015/05/20/json-homoiconicity-and-database-… *** iOS Security Guide (iOS 8.3) *** --------------------------------------------- https://www.apple.com/business/docs/iOS_Security_Guide.pdf *** What We Learned From a Data Exfiltration Incident at an Electric Utility *** --------------------------------------------- We often hear about the dangers of a cyberattacks taking down the grid, but seldom is public information available about the loss of sensitive information, particularly from the OT. The confidential information in this case was the utilitys smart grid and metering R&D knowledge base, which is intellectual property and information that attackers can use to compromise the smart grid. --------------------------------------------- http://www.elp.com/articles/powergrid_international/print/volume-20/issue-5… *** 5 Signs Credentials In Your Network Are Being Compromised *** --------------------------------------------- Where should you start to keep ahead of attackers using insiders to steal corporate secrets or personal identifiable information? Check out these common scenarios. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/5-signs-credentials-in… *** Update soll Mac-Outlook 2011 reanimieren *** --------------------------------------------- Mit Version 14.5.1 der Office-Version 2011 für OS X will Microsoft ein Problem bei Outlook beseitigen - der E-Mail-Client ließ sich nach Installation des vorausgehehenden Updates unter Umständen nicht mehr verwenden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-soll-Mac-Outlook-2011-reanimi… *** MS15-046 - Version: 2.0 *** --------------------------------------------- V2.0 (May 19, 2015): Bulletin revised to announce the release of the Microsoft Office for Mac 14.5.1 update. The release addresses a potential issue with Microsoft Outlook for Mac when customers install the Microsoft Office for Mac 14.5.0 update. Customers who have not already installed the 14.5.0 update should install the 14.5.1 update to be fully protected from this vulnerability. To avoid the possibility of future issues with Microsoft Outlook for Mac, Microsoft recommends that customers... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-046 *** HPSBGN03286 rev.1 - HP LoadRunner, Buffer Overflow *** --------------------------------------------- A potential security vulnerability has been identified with HP LoadRunner. The vulnerability could be exploited remotely to allow a buffer overflow. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04594015 *** HPSBUX03334 SSRT102000 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679334 *** HPSBUX03333 SSRT102029 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS), or Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679309 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- 38913 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38913 *** ZDI-15-235: ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x_So65VKXQk/ *** ZDI-15-234: ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NDUhf-djzIs/ *** ZDI-15-233: Valve Steam Client Detection Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute a denial of service attack on vulnerable installations of Valve Steam. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/z6v9MWWd9O4/ *** Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities *** --------------------------------------------- Topic: Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities Risk: High Text:Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Bru... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050127 *** IPsec-Tools 0-day Denial of Service *** --------------------------------------------- Topic: IPsec-Tools 0-day Denial of Service Risk: High Text:Denial of Service in IPsec-Tools Vulnerability Report May 19, 2015 Product: IPsec-Tools Version: 0.8.2 Website: http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050128 *** Security Advisory - Two Privilege Escalation Vulnerabilities in Huawei Mate 7 Smartphones *** --------------------------------------------- May 20, 2015 14:40 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23257]: Stored XSS in WP Photo Album Plus WordPress Plugin *** --------------------------------------------- Product: WP Photo Album Plus WordPress Plugin v6.1.2Vulnerability Type: Cross-Site Scripting [CWE-79]Risk level: Medium Creater: J.N. BreetveltAdvisory Publication: April 29, 2015 [without technical details]Public Disclosure: May 20, 2015 CVE Reference: CVE-2015-3647 CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N) Vulnerability Details: High-Tech Bridge Security Research Lab discovered stored XSS vulnerability in WP Photo Album Plus WordPress plugin, which can be exploited to perform... --------------------------------------------- https://www.htbridge.com/advisory/HTB23257 *** Bugtraq: Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535576

1 0

Tageszusammenfassung - Dienstag 19-05-2015
by Daily end-of-shift report 19 May '15

19 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-05-2015 18:00 − Dienstag 19-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tracking SSL Issues with the SSL Labs API *** --------------------------------------------- The SSL and TLS protocols have been on the front of the stage for months. Besides many vulnerabilities disclosed in the OpenSSL library, the deployment of SSL and TLS is not always easy. They are weak cyphers (like RC4), weak signatures, certificates issues (self-signed, expiration or fake ones). Other useful features are mis-understood and not often not configured like PFS ("Perfect Forward Secrecy"). Encryption effectiveness is directly related... --------------------------------------------- http://blog.rootshell.be/2015/05/18/tracking-ssl-issues-with-the-ssl-labs-a… *** Magnitude Exploit Kit leading to Ransomware via Malvertising *** --------------------------------------------- Magnitude Exploit Kit is a malicious exploit package that leverages a victim's vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack, which is often leveraged on compromised websites and malicious advertising networks. We recently found a number of compromised pages following the structure of fake search engine... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/YQBX1Zq733A/magnitude-ex… *** Website Security - How Do Websites Get Hacked? *** --------------------------------------------- In 2014 the total number of websites on the internet reached 1 billion, today it's hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let's take a minute to absorb that number for a moment. Another surprising statistic is... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/w0FMyW_q_bA/website-security-… *** Cyber Security Challenge 2015 *** --------------------------------------------- Cyber Security Challenge 2015 | 19. Mai 2015 | Auch heuer gibt es wieder die Cyber Security Challenge zur Suche von Hacker-Nachwuchstalenten. 2015 wird das europäische Finale zwischen 6 Ländern ausgespielt, und Österreich muss den Titel verteidigen.Die Qualifizierungsrunde läuft heuer von 4. Mai bis 3. August und steht Schülern und Studenten offen. Details siehe www.verbotengut.at.Wir wollen wieder ein gutes Team zusammenbekommen, wir bitten daher alle Leser, diesen Hinweis... --------------------------------------------- http://www.cert.at/services/blog/20150519084602-1482.html *** Cmstar Downloader: Lurid and Enfal's New Cousin *** --------------------------------------------- In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as "Enfal". Cmstar was named for the log message "CM**" used by the downloader. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-… *** SSH-Client Putty: Trojaner-Version im Umlauf *** --------------------------------------------- Wer mit dem SSH-Client Putty auf Geräte zugreifen will, sollte auf die Quelle des Clients achten. Aktuell geistert nämlich eine Version durch das Internet, die einen Trojaner auf Computer schmuggelt, um Daten abzugreifen. --------------------------------------------- http://heise.de/-2654274 *** More on Chris Roberts and Avionics Security *** --------------------------------------------- Last month ago I blogged about security researcher Chris Roberts being detained by the FBI after tweeting about avionics security while on a United flight: But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/more_on_chris_r.html *** How much money do cyber crooks collect via crypto ransomware? *** --------------------------------------------- FireEye researchers have calculated that the cybercriminals wielding TeslaCrypt and AlphaCrypt have managed to extort $76,522 from 163 victims in only two months. "This amount may seem trivial co... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uK_6Ovw0K9M/malware_news.… *** Address spoofing Safari bug opens door for phishing attacks *** --------------------------------------------- Hacker David Leo has released a PoC exploit for a Safari vulnerability that can be misused to trick users into thinking they are on one site while they are actually on another - a boon for phishers. ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/6F6ptWfI8rw/secworld.php *** Address-Spoofing Bug Haunts Android Stock Browser *** --------------------------------------------- There's an easily exploitable vulnerability in the Android stock browser that enables an attacker to spoof the URL in the address bar and force a victim to visit a malicious site while believing he is visiting a benign one. Security researcher Rafay Baloch discovered the vulnerability and developed the technique for exploiting it. The problem... --------------------------------------------- http://threatpost.com/address-spoofing-bug-haunts-android-stock-browser/112… *** KCodes NetUSB: How a Small Taiwanese Software Company Can Impact the Security of Millions of Devices Worldwide *** --------------------------------------------- Today the SEC Consult Vulnerability Lab released an advisory regarding a vulnerability in a software component called NetUSB. This post intends to give some background information about this vulnerability.NetUSB is a proprietary technology developed by the Taiwanese company KCodes, intended to provide "USB over IP" functionality. USB devices (e.g. printers, external hard drives, flash drives) plugged into a Linux-based embedded system (e.g. a router, an access point or a dedicated... --------------------------------------------- http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html *** [2015-05-19] Critical buffer overflow vulnerability in KCodes NetUSB *** --------------------------------------------- KCodes NetUSB is vulnerable to a buffer overflow via the network that results in a denial of service or code execution. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38905 *** IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by cross-site scripting (XSS) Vulnerabilities in Dojo Toolkit *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21902837 *** Moodle Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1032358 *** Bugtraq: [SECURITY] [DSA 3175-2] kfreebsd-9 security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/535562

1 0

Tageszusammenfassung - Montag 18-05-2015
by Daily end-of-shift report 18 May '15

18 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-05-2015 18:00 − Montag 18-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyberattacks on Oil and Gas Firms Launched with no Malware at all *** --------------------------------------------- Oil and gas industry targeted by hackers with a genuine looking windows file, not a malware. The attacks are ongoing for about two years. A unique targeted attack being underway for about two consecutive years exploits Windows file functions that look legitimate and a couple of homemade scripts - but not malware - in order... --------------------------------------------- http://securityaffairs.co/wordpress/36843/cyber-crime/cyberattacks-on-oil-a… *** Microsoft Stops Chinese Group from Using TechNet Site for Attacks (May 14, 2015) *** --------------------------------------------- Microsoft and FireEye have taken steps to prevent a group of Chinese cyber criminals known as APT17 from using the companys TechNet website in its attacks... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/38/302 *** VENOM - Does it live up to the hype?, (Sat, May 16th) *** --------------------------------------------- Unless you have been hiding under a rock this week you have heard about VENOM. The first article that I saw was fromZDNet with the headline of Bigger than Heartbleed, Venom security vulnerability threatens most datacenters. Pretty provocative stuff. Is VENOM really worth that much hype? VENOM stands for Virtualized Environment Neglected Operations Manipulation. The cuteacronym basically means that the exploit takes advantage of a vulnerability in legacy code.In short thevulnerability is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19701&rss *** AEADs: getting better at symmetric cryptography *** --------------------------------------------- I gave a talk a couple of weeks ago at the Yahoo Unconference. The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer, articulation of its contents. --------------------------------------------- http://www.imperialviolet.org/2015/05/16/aeads.html *** About the supposed factoring of a 4096 bit RSA key *** --------------------------------------------- tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key. Earlier today a blog post claiming the factoring of a 4096 bit RSA key was published and quickly made it to the top of Hacker News. The key in question was the PGP key of a well-known Linux kernel developer. I already commented on Hacker News why this is most likely wrong, but I thought Id write up some more details. To understand what is going on I have to explain some background both on RSA and... --------------------------------------------- https://blog.hboeck.de/archives/872-No,-nobody-has-factored-a-4096-bit-RSA-… *** Google App Engine: Google reagiert träge auf Java-Sicherheitslücken *** --------------------------------------------- Klammheimlich patcht Google Java-Schwachstellen in seiner Entwicklungsumgebung App Engine und ignoriert den Entdecker der Lücken weitgehend. Einige Sicherheitslücken klaffen immer noch. --------------------------------------------- http://heise.de/-2652121 *** Angreifer nutzen kritische Lücke in ProFTPD aus *** --------------------------------------------- Wer den FTP-Server ProFTPD betreibt, muss handeln: Durch eine schwerwiegende Schwachstelle können Online-Ganoven beliebigen Code ausführen. Und das tun sie auch bereits. --------------------------------------------- http://heise.de/-2652114 *** Screech! Grand Theft Auto V malware mods warning *** --------------------------------------------- Gamers find themselves in latest Mods & Rockstar punch-up Cybercrooks are cooking up malware disguised as mods for the Grand Theft Auto V video game. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/18/gta_malware… *** Rombertiks disk wiping mechanism is aimed at pirates, not researchers *** --------------------------------------------- Rombertik, the information-stealing malware that was recently analyzed by Cisco researchers and which apparently tries to prevent researchers from doing so by rewriting the computers Master Boot Reco... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/oE0fh7NZ4sg/malware_news.… *** Oracle Patches VENOM Vulnerability *** --------------------------------------------- Oracle on Saturday released its patch for the VENOM vulnerability, a guest escape flaw that affects many virtualization platforms. --------------------------------------------- http://threatpost.com/oracle-patches-venom-vulnerability/112868 *** openssh 6.8p1 heap buffer overflow *** --------------------------------------------- Topic: openssh 6.8p1 heap buffer overflow Risk: High Text:Quick background story: I started a while ago to develop a solution to use american fuzzy lop with networking input. I did so b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050105 *** Bugtraq: [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine *** --------------------------------------------- http://www.securityfocus.com/archive/1/535548 *** ZDI-15-230: ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/qN5KZVA4xgA/ *** ZDI-15-229: ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/PLAGhXOxQh0/ *** ZDI-15-231: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/HtMlLoJoKXI/ *** Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38884 *** DSA-3261 libmodule-signature-perl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libmodule-signature-perl, aPerl module to manipulate CPAN SIGNATURE files. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3261 *** SAP Sybase Unwired Platform Online Data Proxy Discloses Password and Username Information to Local Users *** --------------------------------------------- http://www.securitytracker.com/id/1032310 *** SAP Customer Relationship Management Bugs Let Users Execute Arbitrary Code and Remote Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032309 *** SAP NetWeaver RFC SDK Discloses Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032308

1 0

Tageszusammenfassung - Freitag 15-05-2015
by Daily end-of-shift report 15 May '15

15 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-05-2015 18:00 − Freitag 15-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38789 http://tools.cisco.com/security/center/viewAlert.x?alertId=38808 http://tools.cisco.com/security/center/viewAlert.x?alertId=38811 http://tools.cisco.com/security/center/viewAlert.x?alertId=38833 http://tools.cisco.com/security/center/viewAlert.x?alertId=38864 http://tools.cisco.com/security/center/viewAlert.x?alertId=38865 http://tools.cisco.com/security/center/viewAlert.x?alertId=38866 http://tools.cisco.com/security/center/viewAlert.x?alertId=38869 http://tools.cisco.com/security/center/viewAlert.x?alertId=38868 *** Multiple vulnerabilities in Loxone Smart Home (part 2) *** --------------------------------------------- The Loxone Smart Home vulnerabilities published in February 2015 (SA-20150227-0) have not been fixed entirely and can still be exploited. Furthermore, new security issues have been identified. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Openlitespeed <= 1.3.10 Multiple Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050096 *** Hospira LifeCare PCA Infusion System Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification .. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A *** Organizational Challenges in the Internet of Things *** --------------------------------------------- As a result of the increase in cyber-attacks launched by nation-states, cybercriminals, hacktivist groups and other entities, it has become increasingly important to understand the ecosystem of hardware, O/S, software, and services that are used in each organization's network, including .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/organizational-c… *** Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked *** --------------------------------------------- mSpy, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the companys servers was posted on the Dark Web, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-cu… *** Vulnerabilities in PHPMyAdmin *** --------------------------------------------- http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php *** Kritik an fehlenden Sicherheitsfunktionen der Apple Watch *** --------------------------------------------- Die Apple Watch lässt sich ohne Kenntnis des Gerätecodes zurücksetzen – im Unterschied zu iPhone und iPad gibt es allerdings keine Aktivierungssperre, die die frische Inbetriebnahme durch einen Dieb verhindert. --------------------------------------------- http://heise.de/-2650499 *** Erpresser drohen zahlreichen deutschen Shops mit DDoS-Attacken *** --------------------------------------------- Eine Erpresserwelle verunsichert Betreiber von deutschen Online-Shops: Wer nicht zahlt, verliert womöglich Kunden. Was tun? --------------------------------------------- http://heise.de/-2650465 *** McAfees Reinigungs-Tool Stinger installiert heimlichen Wächter *** --------------------------------------------- Wer McAfees Scan-Tool "Stinger" benutzt, um seinen PC zu säubern, bekommt ungefragt einen Virenwächter im Betastadium untergeschoben. Einen Opt-Out gibt es nicht. --------------------------------------------- http://heise.de/-2645759 *** Hacking communities in the Deep Web *** --------------------------------------------- The role of hackers has changed over the years, in the past these professionals were viewed as dangerous criminals that needed to be kept at arm's length; meanwhile today they are highly sought from private companies, intelligence .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-communities-in-the-deep-web/ *** SAP LZC LZH Compression Multiple Vulnerabilities *** --------------------------------------------- SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the .. --------------------------------------------- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vul… *** Latest Microsoft Security Intelligence Report Now Available *** --------------------------------------------- This volume of the SIR focuses on the second half of 2014 and contains longer term trend data as well. SIR volume 18 contains data, insights and practical guidance on a range of global and regional cybersecurity threats including vulnerability disclosures, malware and unwanted software including the latest on .. --------------------------------------------- http://blogs.microsoft.com/cybertrust/2015/05/14/latest-microsoft-security-… *** If Youre Typing the Word MCRYPT Into Your Code, Youre Doing It Wrong *** --------------------------------------------- Foreword: You probably should not be deploying your own cryptography to begin with, especially if you dont already understand that encryption is not authentication. For production systems, use PECL libsodium or defuse/php-encryption and save yourself the headache. The rest of this post is intended for PHP developers who still want to write their own cryptography code, or already have. --------------------------------------------- https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-c… *** One year of DANE Tales and Lessons Learned *** --------------------------------------------- https://ripe70.ripe.net/presentations/183-dane-ripe.pdf *** Cylance SPEAR Team: A Threat Actor Resurfaces *** --------------------------------------------- Attackers typically shut down campaigns or halt activity after they are exposed by security researchers, thereby creating the impression they have dropped off the map. This often leads to a false sense of security within the community and perpetuates the idea that public exposure makes us all safer. While the .. --------------------------------------------- http://blog.cylance.com/spear-a-threat-actor-resurfaces

1 0

Tageszusammenfassung - Mittwoch 13-05-2015
by Daily end-of-shift report 13 May '15

13 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-05-2015 18:00 − Mittwoch 13-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-09: Security updates available for Adobe Flash Player APSB15-10: Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1197 *** How Social Media Blacklisting Happens *** --------------------------------------------- In today's world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in .. --------------------------------------------- https://blog.sucuri.net/2015/05/how-social-media-blacklisting-happens.html *** Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web-based administration interface of the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38767 *** Another look at Niteris : post exploitation WMI and Fiddler checks *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html *** Adobe, Microsoft Push Critical Security Fixes *** --------------------------------------------- Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-f… *** [2015-05-13] Multiple critical vulnerabilities in WSO2 Identity Server *** --------------------------------------------- An unauthenticated attacker is able to read arbitrary local files from the WSO2 Identity Server by using the SAMLv2 authentication interface. Moreover, targeted attacks against users or administrators of the Identity Server may be conducted using CSRF and XSS vulnerabilities. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security: Wie Google Android sicher macht *** --------------------------------------------- HTTPS soll ausgemustert, Android sicherer werden, und es soll ein PGP-Plugin für Gmail geben: Google verstärkt seinen Einsatz im Bereich IT-Sicherheit enorm. Wir haben mit Googles IT-Sicherheitsexperten Stephan Somogyi darüber gesprochen. (Google, Gmail) --------------------------------------------- http://www.golem.de/news/security-wie-google-android-sicher-macht-1505-1140… *** Microsoft Security Bulletin Summary for May 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for May 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. Microsoft also .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-may *** VENOM, don't get bitten. *** --------------------------------------------- QEMU is a generic and open source machine emulator and virtualizer and is incorporated in some Red Hat products as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM hypervisors. CVE-2015-3456 (aka VENOM) .. --------------------------------------------- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ *** Anatomy of an APT Attack: Step by Step Approach *** --------------------------------------------- This article will explore the technique, design and the inner workings of an APT (Advanced Persistent Threat) attack. It will also relate various stages of attack with a few attacks that were custom-created to penetrate enterprises for extraction of internal data, trade secrets, and sensitive business .. --------------------------------------------- http://resources.infosecinstitute.com/anatomy-of-an-apt-attack-step-by-step… *** Spam and Phishing in the First Quarter of 2015 *** --------------------------------------------- The share of spam in email traffic in the first quarter of 2015 was 59.2%; the percentage of spam gradually declined during the quarter. Spam traffic included a large number of mass mailings with Microsoft Word or Excel attachments containing macro viruses. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/69932/spam-and-phishi… *** OSIsoft PI AF Incorrect Default Permissions Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 *** Edge: Wie Microsoft seinen neuen Browser absichern will *** --------------------------------------------- Detailliert beschreibt Microsoft neue und bekannte Techniken, mit denen die Sicherheit des Edge-Browsers "fundamental" verbessert werden soll. Dabei hilft auch der Verzicht auf alte Technik des Internet Explorers. --------------------------------------------- http://www.golem.de/news/edge-wie-microsoft-seinen-neuen-browser-absichern-… Aufgrund des morgigen (14.05.2015) Feiertages erscheint der nächste End-of-Shift-Report erst am Freitag, den 15.05.2015.

1 0

Tageszusammenfassung - Dienstag 12-05-2015
by Daily end-of-shift report 12 May '15

12 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-05-2015 18:00 − Dienstag 12-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Steganography and Malware: Concealing Code and C&C Traffic *** --------------------------------------------- In our earlier post discussing steganography, I discussed how it is now being used to hide configuration data by malware attackers. Let's go discuss this subject another facet of this topic in this post: how actual malware code is hidden in similar ways. Security analysts will probably throw their hands up in the air and say, 'we've .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/steganography-an… *** Add GitHub dorking to list of security concerns *** --------------------------------------------- One of the big lessons that weve learned in the last 10 years is that even little pieces of once disparate data, gathered in a single location, can yield startling truths. With Facebook, that lesson crystallized with the introduction of its Graph Search feature in 2013, when the online world .. --------------------------------------------- http://www.csoonline.com/article/2921177/application-security/add-github-do… *** Golem.de-Test mit Kaspersky: So sicher sind Fototerminals und Copyshops *** --------------------------------------------- Wie gefährlich ist es, mit beschreibbaren USB-Sticks und SD-Karten Fotos und Dateien ausdrucken zu lassen? Golem.de hat zusammen mit dem Sicherheitsunternehmen Kaspersky getestet, ob auch Windows-XP-Terminals ohne Virenscanner sicher sind. --------------------------------------------- http://www.golem.de/news/golem-de-test-mit-kaspersky-so-sicher-sind-fototer… *** Verschlüsselte OSGP-Kommunikation von Smart Metern leicht belauschbar *** --------------------------------------------- Wenn Geräte im Smart Grid Informationen austauschen, könnten Angreifer trotz Krypto-Einsatz zumindest beim Standard Open Smart Grid Protocol Daten abgreifen. Sicherheitsforscher machen dafür das schwache Protokoll verantwortlich. --------------------------------------------- http://heise.de/-2642228 *** The State of ASLR on Android Lollipop *** --------------------------------------------- Modern platforms like Android devices enforce execute protections on memory, so injecting code into the process is often no longer the lowest hanging fruit for exploitation. Reusing the existing code and data has become the norm, and statistical defense via Address-Space Layout randomization is still the only widely available .. --------------------------------------------- https://copperhead.co/2015/05/11/aslr-android-zygote *** How secure will our data be in the post-quantum era? *** --------------------------------------------- Build your security for the next 50 years. If the speed of processing doubles every two years, make sure your cryptographic systems can't be brute forced in 50 years. If you use 2048 bit RSA, it will take some quadrillion years to break it. Good enough, right? --------------------------------------------- https://medium.com/@amarchenkova/how-secure-will-our-data-be-in-the-post-qu… *** Bublik Trojan - Variant Evolves with New Features *** --------------------------------------------- While there are many similar types of malware in use today, Bublik is being used for malicious activity and appears to be under active development, suggesting that its creators have paying customers. Because security involves a dynamic interaction .. --------------------------------------------- http://www.isightpartners.com/2015/05/bublik-trojan-variant-evolves-with-ne…

1 0

Tageszusammenfassung - Montag 11-05-2015
by Daily end-of-shift report 11 May '15

11 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-05-2015 18:00 − Montag 11-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 *** VMSA-2015-0003.8 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38763 *** Who's Scanning Your Network? (A: Everyone) *** --------------------------------------------- Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldnt believe that people actually still cared about scanning, and I told him as much: These days there are .. --------------------------------------------- http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/ *** NCSC publishes factsheet Help! My website has been defaced *** --------------------------------------------- To deface a website the attacker changes the content of existing pages or adds new ones. Hundreds of websites are defaced every day, often without being specifically targeted. It is becoming increasingly common for defacements to .. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-he… *** Jellyfish: Malware nistet sich in GPUs ein *** --------------------------------------------- Nutzt eine Malware den Prozessor einer Grafikkarte, ist sie nicht nur schwerer aufzuspüren, sondern kann auch die höhere Rechenleistung der GPU nutzen. Jellyfish will zeigen, dass solcher Schadcode funktioniert. --------------------------------------------- http://www.golem.de/news/jellyfish-malware-nistet-sich-in-gpus-ein-1505-113… *** Yubikey: Nie mehr schlechte Passwörter *** --------------------------------------------- Unser Autor hat 152 Onlinekonten, die er möglichst gut absichern will. Mit dem Passwortmanager Keepass und einem sogenannten Token - dem Yubikey Neo. Eine Anleitung. --------------------------------------------- http://www.golem.de/news/yubikey-nie-mehr-schlechte-passwoerter-1505-113872… *** Tor-Bridges für Amazon EC2 eingestampft *** --------------------------------------------- Ab sofort wird es schwerer, Nutzern alternative Zugänge zum Anonymisierungsnetz Tor zur Verfügung zu stellen. Das entsprechende Projekt für Cloud-Images wurde eingestellt. --------------------------------------------- http://heise.de/-2640793 *** 60 Days of Watching Hackers Attack Elasticsearch *** --------------------------------------------- Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the .. --------------------------------------------- https://jordan-wright.github.io/blog/2015/05/11/60-days-of-watching-hackers… *** Finger printing: Print the Finger of an Application *** --------------------------------------------- When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, .. --------------------------------------------- http://resources.infosecinstitute.com/finger-printing-print-the-finger-of-a… *** Angler exploit kit using tricks to avoid referrer chain leading back to malvertisement provider *** --------------------------------------------- For some time I've been seeing the Angler exploit kit pop up and infect clients without through malvertising campaigns without having a referer when visitng the landing page. The reason why this is interesting is that it makes it a lot harder to track down the malicious creative IDs which can .. --------------------------------------------- http://blog.0x3a.com/post/118366451134/angler-exploit-kit-using-tricks-to-a…

1 0

{Spam?} Tageszusammenfassung - Freitag 8-05-2015
by Daily end-of-shift report 08 May '15

08 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-05-2015 18:00 − Freitag 08-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB15-10) *** --------------------------------------------- A prenotification Security Advisory has been posted regarding upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 12, 2015. We will continue to provide updates on the upcoming release via the Security Advisory as well as the Adobe PSIRT blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1193 *** Compromised WordPress sites leaking credentials *** --------------------------------------------- Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/63XGcunva0k/compromised-… *** GPU-based malware, the evolution of rootkits and keyloggers *** --------------------------------------------- Malware developers have presented two proof-of-concept malware, a rootkit and a keylogger, which exploit the GPU of the infected host. Malware authors always demonstrate a great creativity and the ability to propose even more effective solutions, recently developers have published two strains of malware, Jellyfish rootkit and the Demon keylogger, that implement an unusual way to run on a victim's... --------------------------------------------- http://securityaffairs.co/wordpress/36634/malware/gpu-based-malware.html *** Almost EVERY SAP install hackable, researchers say *** --------------------------------------------- Even worse when you tinker with it. A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/08/sap_95_perc… *** l+f: Kritische Lücke in Überwachungs-Software für kritische Systeme *** --------------------------------------------- Über einen Bug in Symantecs Server-Überwachungs-Software können Angreifer den Systemen beliebige Dateien unterjubeln und diese ausführen. --------------------------------------------- http://heise.de/-2638669 *** The USBKILL anti-forensics tool - it doesnt do *quite* what it says on the tin *** --------------------------------------------- A hacker who very modestly goes by the handle Hephaestos has just announced an "anti-forensic kill switch" dubbed, well, usbkill. It doesnt do quite what the name might suggest, and it could cut either way, so use it with care! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/tzGEjCOTbq4/ *** Flawed Open Smart Grid Protocol is a risk for Smart Grid *** --------------------------------------------- More than four million smart meters and similar devices worldwide are open to cyber attacks due to the security issued in the Open Smart Grid Protocol. The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) that are implemented today by more than four million smart... --------------------------------------------- http://securityaffairs.co/wordpress/36648/hacking/flaws-open-smart-grid-pro… *** IETF spezifiziert Richtlinien für den Einsatz von Verschlüsselung *** --------------------------------------------- Das Gremium für Internet-Standards dokumentiert Richtlinien für den sinnvollen Einsatz der Transportverschlüsselung TLS. Der RFC 7525 enthält gute Anleitungen, Tipps und Hinweise auf Fallstricke für jeden, der Verschlüsselung selbst einrichtet. --------------------------------------------- http://heise.de/-2639221 *** Angreifer können Viren-Scanner von BullGuard und Panda lahmlegen *** --------------------------------------------- Mehrere Antiviren-Anwendungen von BullGuard und Panda weisen eine Sicherheitslücke auf, über die Angreifer die Schutzfunktionen deaktivieren können. --------------------------------------------- http://heise.de/-2639307 *** DSA-3253 pound - security update *** --------------------------------------------- Pound, a HTTP reverse proxy and load balancer, had several issuesrelated to vulnerabilities in the Secure Sockets Layer (SSL) protocol. --------------------------------------------- https://www.debian.org/security/2015/dsa-3253 *** Sentinel 7.3 HF1 (Sentinel 7.3.0.1) Build 1800 7.3.0.1 *** --------------------------------------------- Abstract: Sentinel 7.3.0.1 upgrade patch for Sentinel 7.Document ID: 5202070Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:sentinel_server-7.3.0.1-1817.x86_64.tar.gz.sha256 (109 bytes)sentinel_server-7.3.0.1-1817.x86_64.tar.gz (1.67 GB)Products:Sentinel 7.1SentinelSentinel 7.1.1Sentinel 7.1.2Sentinel 7.XSentinel 7.3Sentinel 7.2.2Sentinel 7.2.1Sentinel 7.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=mBuUwDq2kD0~ *** Rockwell Automation RSLinx Classic Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Rockwell Automation's OPCTest.exe, which is a test client for RSLinx Classic's support of the OPC-DA protocol. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02 *** VMSA-2015-0003.7 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** ZDI Security Advisories for EMC AutoStart and for ManageEngine Products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/published/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21902444 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli System Automation for Multiplatforms (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21882749 *** IBM Security Bulletin: Multiple Kernel vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022146 *** IBM Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer *** http://www.ibm.com/support/docview.wss?uid=swg21883926 *** Security Bulletin: Vulnerability in SSLv3 affects Upward Integration Modules (UIM) (CVE-2014-3566) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097659 *** IBM Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022149 *** IBM Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022145 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Endpoint Manager (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883852 *** Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097676

1 0

Tageszusammenfassung - Donnerstag 7-05-2015
by Daily end-of-shift report 07 May '15

07 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-05-2015 18:00 − Donnerstag 07-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco UCS Central Software Arbitrary Command Execution Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco UCS Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** eShop 6.3.11 - Remote Code Execution *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7967 *** Multiple vulnerabilities in ManageEngine Applications Manager *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-170 http://www.zerodayinitiative.com/advisories/ZDI-15-169 http://www.zerodayinitiative.com/advisories/ZDI-15-168 http://www.zerodayinitiative.com/advisories/ZDI-15-167 http://www.zerodayinitiative.com/advisories/ZDI-15-166 *** Macro Malware: When Old Tricks Still Work, Part 2 *** --------------------------------------------- In the first part of this series, we discussed about the macro malware we have recently seen in the threat landscape. This second entry will delve deeper into the techniques or routines of macro malware. Unintended consequences Let us put things into .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/macro-malware-wh… *** APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 *** --------------------------------------------- Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00000.ht… *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Wie gestern (06. Mai) bekannt wurde, gibt es eine Sicherheitslücke im "Genericons icon font package" von WordPress, welches in vielen populären Themes und Erweiterungen, darunter das .. --------------------------------------------- http://cert.at/warnings/all/20150507.html *** Protect your network with DNS Firewall *** --------------------------------------------- If you run your own mail server, you will quickly find out that 90% of the e-mails you receive are spam. The solution .. --------------------------------------------- http://securityblog.switch.ch/2015/05/07/protect-your-network-with-dns-fire… *** Security Operations Center *** --------------------------------------------- Ensuring the confidentiality, integrity, and availability of a modern information technology enterprise is a big job. Cyber security breaches are becoming common news. The role of .. --------------------------------------------- http://resources.infosecinstitute.com/security-operations-center/ *** Analyzing Quantum Insert Attacks *** --------------------------------------------- A Quantum Insert Attack is a classic example of man-in-the-middle attacks which resurfaced into news among the top 10 biggest .. --------------------------------------------- http://resources.infosecinstitute.com/analyzing-quantum-insert-attacks/ *** Avast verdächtigt Windows-Bibliotheken als Trojaner *** --------------------------------------------- Der Virenwächter Avast hat DLL-Dateien von Windows als gefährlich eingestuft und in Quarantäne verschoben. Danach liefen bei betroffenen Nutzern einige Programme nicht mehr. --------------------------------------------- http://heise.de/-2638093 *** Falscher PC-Experte überwies während Fernwartung Geld nach Bangkok *** --------------------------------------------- Mehrere Hundert Euro Schaden - Bank konnte Transaktion nicht mehr rückgängig machen - Polizei warnt vor Betrugsmasche mit falschen Microsoft-Mitarbeitern --------------------------------------------- http://derstandard.at/2000015448793 *** How to make two binaries with the same MD5 hash *** --------------------------------------------- One question I was asked when I demod creating two PHP files with the same hash is; does it work on compiled binaries? --------------------------------------------- http://natmchugh.blogspot.co.uk/2015/05/how-to-make-two-binaries-with-same-…

1 0

Tageszusammenfassung - Mittwoch 6-05-2015
by Daily end-of-shift report 06 May '15

06 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-05-2015 18:00 − Mittwoch 06-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Root-Shell im Krankenhaus: Hospira-Infusionspumpe mit Telnet-Lücke *** --------------------------------------------- Computer, die in Krankenhäusern die Abgabe von Medikamenten direkt ins Blut der Patienten steuern, sollten eigentlich einigermaßen abgesichert sein. Bei in US-Kliniken verbreiteten Infusionspumpen wurde jedoch eine "game-over vulnerability" entdeckt. --------------------------------------------- http://heise.de/-2633529 *** Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the CUCReports page of Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the CUCReports web interface. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38675 *** Cisco Unified Communications Manager SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38674 *** Spearphishing: A New Weapon in Cyber Terrorism *** --------------------------------------------- Introduction: Spear phishing attacks Spear phishing and its evolutions like the watering hole attack represent one of the most insidious attack techniques adopted by the majority of threat actors in cyber space. According to the experts .. --------------------------------------------- http://resources.infosecinstitute.com/spearphishing-a-new-weapon-in-cyber-t… *** Hospira LifeCare PCA Infusion System Vulnerabilities *** --------------------------------------------- This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in the Hospira LifeCare PCA Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 *** Studie: Die Smart City ist intelligent, aber angreifbar *** --------------------------------------------- Smarte Städte könnten zum Ziel von Hackerangriffen werden. Durch die zunehmende Vernetzung potenzieren sich die Sicherheitslücken, wie eine Studie zeigt. --------------------------------------------- http://www.golem.de/news/studie-die-smart-city-ist-intelligent-aber-angreif… *** Tinba - Yet another anti-sandbox tricks *** --------------------------------------------- Malware authors certainly do not take a breather when it comes to inventing new tricks for detecting sandbox, a very useful system to automatically analyze millions of samples nowadays. Recently, Seculert unveiled an unprecedented sandbox detection method that was employed by the Dyre/Dyreza malware. We had seen similar anti-sandbox tricks used by the .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002810.html *** Erneut massive Sicherheitslücke bei Lenovo-Rechnern *** --------------------------------------------- Hacker konnten durch Fehler im Update-System Schadprogramme als Lenovo-Software ausgeben --------------------------------------------- http://derstandard.at/2000015349945 *** IT threat evolution in Q1 2015 *** --------------------------------------------- In the first quarter of 2015 Kaspersky Lab products detected a total of 2,2 bln malicious attacks and more than 93 mln unique malicious URLs. The story of the powerful Equation cyberespionage group was perhaps the most talked-about news story of Q1. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/69872/it-threat-ev… *** Nmap Cheat Sheet 5: The Final View of a Ninja Pentester *** --------------------------------------------- As we discussed in the last topic of our Nmap Series, this will be our final touch for the cheat sheet. Here we will try to cover most of the topic as required for Vulnerability Assessment and Penetration Testing. As a Ninja Pentester, .. --------------------------------------------- http://resources.infosecinstitute.com/nmap-cheat-sheet-5-the-final-view-of-… *** Explaining Security Lingo *** --------------------------------------------- This post is aimed to clarify certain terms often used in the security community. Let's start with the easiest one: vulnerability. A vulnerability is a flaw in a selected system .. --------------------------------------------- https://securityblog.redhat.com/2015/05/06/explaining-security-lingo/ *** Multiple Fortiguard products cross-site scripting vulnerabilities *** --------------------------------------------- The Web User Interface of FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiADC D models are vulnerable to reflected cross-site scripting vulnerabilities. --------------------------------------------- http://www.fortiguard.com/advisory/FG-IR-15-005/ *** JetPack and TwentyFifteen Vulnerable to DOM-based XSS - Millions of WordPress Websites Affected *** --------------------------------------------- Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with .. --------------------------------------------- https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom… *** Google-Studie: Millionen Computer mit Adware infiziert *** --------------------------------------------- Fast 5,4 Millionen Google-Besucher haben Adware auf ihren Computern installiert. Ein Grossteil davon geht auf Googles eigene Kappe, denn viele der Werbe-Einblender stammen aus dem Chrome Web Store. --------------------------------------------- http://heise.de/-2636130

1 0

Tageszusammenfassung - Dienstag 5-05-2015
by Daily end-of-shift report 05 May '15

05 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-05-2015 18:00 − Dienstag 05-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** In-Console-Able *** --------------------------------------------- Posted by James Forshaw, giving the security community a shoulder to cry on.TL;DR; this blog post describes an unfixed bug in Windows 8.1 which allows you to escape restrictive job objects in order to help to develop a sandbox escape chain in Chrome or similar sandboxes. If you're trying to develop a secure application sandbox in user-mode you're at the mercies of the underlying operating system. While you can try and use every available security feature, sometimes the OS developer... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/05/in-console-able.html *** Upatre/Dyre - the daily grind of botnet-based malspam, (Tue, May 5th) *** --------------------------------------------- Malicious spam (malspam) delivering Upatre/Dyre has been an ongoing issue for quite some time. Many organizations have posted articles about this malware. Ive read good information on Dyre last year [1, 2] and this year [3]. Upatre is the malware downloader that retrieves Dyre (Dyreza), an information stealer described as a Zeus-like banking Trojan [4]. Earlier this year, EmergingThreats reported Upatre and Dyre are under constant development [5], while SecureWorks told us banking botnets... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19657&rss *** Analogue modems allow UNSTOPPABLE Android attack ... at 13bps *** --------------------------------------------- Yes its slow, but its enough to leak data to another Android The better your Android smartphones audio, the worse its security - the audio channel is the latest path for "low and slow" data leak attacks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/boffins_rev… *** Rombertik malware kills host computers if you attempt a cure *** --------------------------------------------- Say goodbye to your master boot record and home directory if you try to stop it Cisco researchers Ben Baker and Alex Chiu have found new malware that destroys a machines Master Boot Record and home directories if it detects meddling white hats. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/rombertik_m… *** Macro Malware: When Old Tricks Still Work, Part 1 *** --------------------------------------------- Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters: Figure 1. Microsoft Word security warning for macros I went around my peers this afternoon and asked, "On the top of your head, can you give me a name of an effective macro malware? Better if its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/LjTF4yhzWt8/ *** Introducing FIDO: Automated Security Incident Response *** --------------------------------------------- Were excited to announce the open source release of FIDO (Fully Integrated Defense Operation - apologies to the FIDO Alliance for acronym collision), our system for automatically analyzing security events and responding to security incidents. --------------------------------------------- http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html *** Revealing the Secrets: Advances in Android and iOS Attacks *** --------------------------------------------- In recent months, Unit 42, the cyber threat intelligence team at Palo Alto Networks, has encountered several game-changing advances in mobile malware for both iOS and Android. For example, WireLurker employed a multistage infection that... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/revealing-secrets-advanc… *** Steganography and Malware: Why and How *** --------------------------------------------- Threats that can evade detection are among the most dangerous kind we're facing today. We see these characteristics in the most challenging security issues like targeted attacks and zero-day exploits. Being able to stay hidden can determine the success of an attack, making it something that attackers continuously want to achieve. In this series of blog posts, we... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G-eR3GU5L3Y/ *** ICU Project Overflow Vulnerabilities Patched *** --------------------------------------------- Buffer and integer overflow vulnerabilities have been patched in the ICU Project ICU4C library, used in hundreds of open source and enterprise software packages. --------------------------------------------- http://threatpost.com/icu-project-overflow-vulnerabilities-patched/112623 *** Usbkill Script Can Render Computers Useless *** --------------------------------------------- The idea of needing to disable a computer quickly as the police - or another potential adversary - comes through the door typically has been the concern of criminals. But in today's climate activists, journalists, and others may find themselves wanting to make their laptops unusable in short order, and that's where usbkill comes in. The new tool is a... --------------------------------------------- http://threatpost.com/usbkill-script-can-render-computers-useless/112622 *** VU#978652: Bomgar Remote Support Portal deserializes untrusted data *** --------------------------------------------- Vulnerability Note VU#978652 Bomgar Remote Support Portal deserializes untrusted data Original Release date: 05 May 2015 | Last revised: 05 May 2015 Overview Bomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data without sufficient validation, allowing an attacker to potentially execute arbitrary PHP code. Description CWE-502: Deserialization of Untrusted DataBomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data... --------------------------------------------- http://www.kb.cert.org/vuls/id/978652 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM OS Images for Red Hat Linux Systems and AIX. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883879 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005217 *** IBM Security Bulletin: IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models nodes are affected by vulnerabilities in Apache's Struts library (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005078 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor (CVE-2014-6585, CVE-2014-6591, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21883285 *** DSA-3250 wordpress - security update *** --------------------------------------------- Multiple security issues have been discovered in Wordpress, a weblogmanager, that could allow remote attackers to upload files with invalidor unsafe names, mount social engineering attacks or compromise a sitevia cross-site scripting, and inject SQL commands. --------------------------------------------- https://www.debian.org/security/2015/dsa-3250

1 0

Tageszusammenfassung - Montag 4-05-2015
by Daily end-of-shift report 04 May '15

04 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-04-2015 18:00 − Montag 04-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** eBay ignoriert XSS-Lücke ein Jahr lang *** --------------------------------------------- Eine Schwachstelle in eBay erlaubt es Angreifern eine Session mitzuschneiden und im schlimmsten Fall einen Account zu übernehmen. Die Lücke ist ein Jahr alt und wurde immer noch nicht geschlossen. --------------------------------------------- http://heise.de/-2630964 *** Threatpost News Wrap, May 1, 2015 *** --------------------------------------------- Dennis Fisher and Mike Mimoso discuss the post-RSA news, including the MySQL bug, the progress of the OpenSSL overhaul and the wildly entertaining House hearing on crypto backdoors. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-may-1-2015/112538 *** 3062591 - Local Administrator Password Solution (LAPS) Now Available - Version: 1.0 *** --------------------------------------------- Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3062591 *** New Google Password Alert extension already hacked *** --------------------------------------------- A few hours after the presentation of the Google Password Alert extension a researcher already have developed two methods to bypass it. A few hours ago, Google released the Password Alert extension that was designed to warn users when they are submitting their Google credentials to fraudulent websites. Here's how it works for consumer accounts. Once you've... --------------------------------------------- http://securityaffairs.co/wordpress/36483/hacking/password-alert-extension-… *** VolDiff, for memory image differential analysis, (Sun, May 3rd) *** --------------------------------------------- VolDiff is a bash script that runs Volatility plugins against memory images captured before and after malware execution providing a differential analysis, helping identify IOCs and understand advanced malware behaviour. I had intended to include it in my latest toolsmith article, Attack Detection: Hunting in-memory adversaries with Rekall and WinPmem, but quite literally ran out of space and time. Using WinPmem, as part of Rekall and GRR offerings, you can acquire two memory images, one clean --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19651&rss *** Traffic pattern change noted in Fiesta exploit kit, (Mon, May 4th) *** --------------------------------------------- A few hours ago, Jerome Segura, the Senior Security Researcher at Malwarebytes, tweeted about a change in traffic patterns from Fiesta exploit kit (EK) [1]. What had been semi-colons in the URLs from Fiesta EK are now commas. Here" /> Here" /> Any signatures for detecting Fiesta EK that depend on those semi-colons will need to be updated. A pcap of the traffic is available at http://malware-traffic-analysis.net/2015/05/04/2015-05-04-Fiesta-EK-traffic…, and a zip file of the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19655&rss *** Securing the smart grid: European Network of Cyber Security *** --------------------------------------------- Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this int... --------------------------------------------- http://www.net-security.org/article.php?id=2270 *** Nasty Dyre malware bests white hat sandboxes *** --------------------------------------------- Core checker a defensive wrecker Seculert CTO Aviv Raff says a nasty piece of malware linked to widespread destruction and bank account plundering has become more dangerous with the ability to evade popular sandboxes. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/04/dyre_malwar… *** Anti-Phishing-Erweiterung für Chrome mehrfach unterwandert *** --------------------------------------------- Eigentlich soll das Chrome-Plug-in Passwort-Warnung Alarm schlagen, wenn Nutzer ihre Log-in-Daten auf Phishing-Webseiten eingeben. Mittlerweile wurde die Funktion aber schon zum wiederholten Male ausgehebelt. --------------------------------------------- http://heise.de/-2632031 *** Linuxwochen von 7. bis 9. Mai in Wien *** --------------------------------------------- Am FH Technikum Wien finden von Donnerstag bis Sonntag Workshops und Vorträge zu Verschlüsselung, 3D-Druck und Open Hardware statt. --------------------------------------------- http://futurezone.at/produkte/linuxwochen-von-7-bis-9-mai-in-wien/128.621.4… *** AlphaCrypt *** --------------------------------------------- We've encountered yet another encrypting ransomware variant and at this point it's expected since the scam has exploaded in popularity since it's inception in late 2013. This one has a GUI that is almost... --------------------------------------------- http://www.webroot.com/blog/2015/05/04/alphacrypt/ *** Microsoft Security Bulletin MS15-032 - Critical *** --------------------------------------------- V2.0 (April 30, 2015): Updated bulletin to inform customers running Internet Explorer on Windows Server 2003 Service Pack 2 that the 3038314 update on the Microsoft Download Center was updated on April 22, 2015. Microsoft recommends that customers who installed the 3038314 update prior to April 22 should reinstall the update to be fully protected from the vulnerabilities discussed in this bulletin. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-032 *** DSA-3249 jqueryui - security update *** --------------------------------------------- Shadowman131 discovered that jqueryui, a JavaScript UI library fordynamic web applications, failed to properly sanitize its titleoption. This would allow a remote attacker to inject arbitrary codethrough cross-site scripting. --------------------------------------------- https://www.debian.org/security/2015/dsa-3249 *** DSA-3244 owncloud - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in ownCloud, a cloud storageweb service for files, music, contacts, calendars and many more. --------------------------------------------- https://www.debian.org/security/2015/dsa-3244 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco Finesse Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38607 *** Squid SSL-Bump Certificate Validation Flaw Lets Remote Servers Bypass Client-side Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032221 *** VMSA-2015-0003.6 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** VU#581276: EMC AutoStart is vulnerable to remote code execution via specially crafted packets *** --------------------------------------------- Vulnerability Note VU#581276 EMC AutoStart is vulnerable to remote code execution via specially crafted packets Original Release date: 30 Apr 2015 | Last revised: 30 Apr 2015 Overview EMC AutoStart, version 5.5.0 and earlier, is vulnerable to remote command execution via specially crafted packets. Description EMC AutoStart is an enterprise software application developed to help networks and service maintain a high level of availability. AutoStart can manage clusters of applications or nodes --------------------------------------------- http://www.kb.cert.org/vuls/id/581276 *** Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities *** --------------------------------------------- Description Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities. Multiple vulnerabilities in OpenSSL prior to 1.0.1m (SPL-98351) Disable SSLv3 in KV Store Replication (SPL-96280) Secure flag inconsistently set for session cookies when appServerPorts!=0 (SPL-95798) Cross-site scripting in Search (SPL-95594) Cross-site scripting in management and configuration (SPL-93516) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have --------------------------------------------- http://www.splunk.com/view/SP-CAAANZ7 *** RSA Identity Management and Governance Password Reset Weakness Lets Remote Users Gain Privileged Access *** --------------------------------------------- http://www.securitytracker.com/id/1032218 *** Security Advisory: TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 *** --------------------------------------------- (SOL14190) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/14000/100/sol14190.htm… *** OPTO 22 Multiple Product Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that are present in the OPTO 22 PAC Project Professional, PAC Project Basic, OptoOPCServer, OptoDataLink, PAC Display Basic, and PAC Display Professional products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 *** Clam AntiVirus Multiple File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032223 *** Dell SonicWALL Secure Remote Access Access Control Flaw in cgi-bin/editBookmark Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032227 *** SSA-311412 (Last Update 2015-05-04): Incorrect Certificate Verification in Android App HomeControl for Room Automation *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit…

1 0

Tageszusammenfassung - Donnerstag 30-04-2015
by Daily end-of-shift report 30 Apr '15

30 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-04-2015 18:00 − Donnerstag 30-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101 *** --------------------------------------------- The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2480253 *** My Website Was Blacklisted By Google and Distributing Email Spam *** --------------------------------------------- Being blacklisted is one of the worst things that can happen to a website. The public shame coming from every visitor being stopped by the Big Red Warning page can literally destroy .. --------------------------------------------- https://blog.sucuri.net/2015/04/my-website-was-blacklisted-by-google-and-di… *** Cisco StarOS for Cisco ASR 5000 Series HTTP Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38580 *** Bedep trojan malware spread by the Angler exploit kit gets political *** --------------------------------------------- We recently observed what seems to be a group of cybercriminals helping spread pro-Russia messaging by artificially inflating video views and ratings on a popular video website. The .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malware-sp… *** Cyber threat intelligence group links Russia to cyber espionage and attacks *** --------------------------------------------- "Operation Armageddon," active since at least mid-2013, exposes a cyber espionage campaign devised to provide a military advantage to Russian leadership by targeting Ukrainian government, law enforcement, and military .. --------------------------------------------- http://www.liveleak.com/view?i=b39_1430249732 *** WhatsApp durchleuchtet: Vorbildliche Verschlüsselung weitgehend nutzlos *** --------------------------------------------- Um die Frage zu beantworten wie vertrauenswürdig die von WhatsApp seit einigen Monaten eingesetzte Ende-zu-Ende-Verschlüsselung ist, hat c't sie unter die Lupe genommen: Zwar setzt WhatsApp die richtige Technik ein, viel nützt das aber trotzdem nicht. --------------------------------------------- http://heise.de/-2629081 *** Voiceprint: Stimmenerkennung ist die neue Gesichtserkennung *** --------------------------------------------- Statt mit einem Passwort können sich Bankkunden mittlerweile mit ihrer Stimme am Telefon identifizieren. Akustische Biometriesysteme werden in immer mehr Firmen eingesetzt. Die Gefahr: Auch Geheimdienste und Staaten können auf die Technik zugreifen. --------------------------------------------- http://www.golem.de/news/voiceprint-stimmenerkennung-ist-die-neue-gesichtse… *** Analysis of a MICROSOFT WORD INTRUDER sample: execution, check-in and payload delivery *** --------------------------------------------- On April 1st FireEye released a report on 'MWI; and 'MWISTAT' which is a sort of exploit kit for Word Documents if you will: A New Word Document Exploit Kit In the article FireEye goes over MWI which is the short for 'Microsoft Word Intruder' coded .. --------------------------------------------- http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intrude… *** A Brief Look at DNS Zone Transfer for Alexia's Top 1M Domains *** --------------------------------------------- The folks at Rapid7 have released another scan. This one is looking at Alexa's top 1 million domains for DNS servers which have allowed unauthenticated requests for Zone Transfer. --------------------------------------------- http://atechdad.com/a-brief-look-at-dns-zone-transfer-for-alexias-top-1m-do… *** TA15-120A: Securing End-to-End Communications *** --------------------------------------------- Securing end-to-end communications plays an important role in protecting privacy and preventing some forms of man-in-the-middle (MITM) attacks. Recently, researchers described a MITM attack used to inject code, .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A-0 *** The BACKRONYM MySQL Vulnerability *** --------------------------------------------- Earlier this year, I - along with some members of our DevOps team - noticed some interesting behavior in libmysqlclient and the MySQL CLI: no matter how hard we tried (no matter how many MYSQL_OPT_SSL_* options we set) we could not make the client enforce the use of SSL. If the server claimed not to support it, the .. --------------------------------------------- https://www.duosecurity.com/blog/backronym-mysql-vulnerability

1 0

Tageszusammenfassung - Mittwoch 29-04-2015
by Daily end-of-shift report 29 Apr '15

29 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-04-2015 18:00 − Mittwoch 29-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** VU#534407: Barracuda Web Filter insecurely performs SSL inspection *** --------------------------------------------- Barracuda Web Filter prior to version 8.1.0.005 does not properly check upstream certificate validity when performing SSL inspection, and delivers one of three default root CA certificates across multiple machines for SSL inspection. --------------------------------------------- http://www.kb.cert.org/vuls/id/534407 *** Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Overlay Transport Virtualization (OTV) processing code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 *** Cisco StarOS for Cisco ASR 5000 Series HAMGR Service Proxy Mobile IPv6 Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in proxy mobile (PM) IPv6 processing of Cisco StarOS for Cisco ASR 5000 Series devices could allow an unauthenticated, remote attacker to cause a reload of the hamgr service on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38557 *** Android: Tausende Apps akzeptieren gefälschte Zertifikate *** --------------------------------------------- Die Schwachstelle ist seit einem halben Jahr bekannt, doch noch immer können Tausende Android-Apps mit gefälschten Zertifikaten überlistet werden, verschlüsselte Verbindungen aufzubauen. Über diese können Zugangsdaten abgegriffen werden --------------------------------------------- http://www.golem.de/news/android-tausende-apps-akzeptieren-gefaelschte-zert… *** Example setup of WordPress with static export *** --------------------------------------------- 'the only winning move is not to play' - Joshua, Wargames 2 So another advice from CIRCL is: whenever it is possible, the Content Management System component should be removed from the attack surface. This article gives an example about how to set up a system that exposes only static websites without dynamically generated content to the user and attacker. --------------------------------------------- https://www.circl.lu/pub/tr-36/ *** Malware Analysis-Basics: Static Analysis *** --------------------------------------------- Hi all, I have started learning malware analysis sometime back, and will share my learning through a series of articles on malware analysis. I will start from very basic and go to advanced level of analysis. So in this this document we .. --------------------------------------------- http://resources.infosecinstitute.com/malware-analysis-basics-static-analys… *** Und täglich grüsst die D-Link-Lücke *** --------------------------------------------- Seit mindestens August klafft eine kritische Lücke in Routern der Firmen D-Link und Trendnet. Diese geht auf ein Toolkit der Firma Realtek zurück, die Anfragen von Sicherheitsforschern für Monate beharrlich ignorierte. Nun ist die Lücke öffentlich. --------------------------------------------- http://heise.de/-2628562 *** Unboxing Linux/Mumblehard: Muttering spam from your servers *** --------------------------------------------- Today, ESET researchers reveal a family of Linux malware that stayed under the radar for more than 5 years. We have named this family Linux/Mumblehard. A white paper about this threat is available for download on WeLiveSecuriy. --------------------------------------------- http://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering… *** Magento updaten! ASAP! *** --------------------------------------------- Für die Onlineshop-Software Magento ist bereits im Februar ein Patch (SUPEE-5344) erschienen, der eine schwerwiegende Sicherheitslücke schliesst. Die Firma Check Point, die die Schwachstelle entdeckt hat, .. --------------------------------------------- http://www.cert.at/services/blog/20150429154511-1469.html *** TA15-119A: Top 30 Targeted High Risk Vulnerabilities *** --------------------------------------------- Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A *** Container Security: Just The Good Parts *** --------------------------------------------- Security is usually a matter of trade-offs. Questions like: 'Is X Secure?', don't often have direct yes or no answers. A technology can mitigate certain classes of risk even .. --------------------------------------------- https://securityblog.redhat.com/2015/04/29/container-security-just-the-good… *** Report: SSDP reflection attacks spike, and other Q1 2015 DDoS trends *** --------------------------------------------- The largest distributed denial-of-service attack ever detected by Arbor Networks systems was observed in the first quarter of this year. --------------------------------------------- http://www.scmagazine.com/largest-ddos-detected-in-q1-report-says/article/4… *** ZDI-15-157: Samsung Security Manager ActiveMQ Broker Service MOVE Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-157/ *** ZDI-15-156: Samsung Security Manager ActiveMQ Broker Service PUT Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-156/

1 0

Tageszusammenfassung - Dienstag 28-04-2015
by Daily end-of-shift report 28 Apr '15

28 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-04-2015 18:00 − Dienstag 28-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Fake Security Scams - 2015 Edition *** --------------------------------------------- New Year, Similar Scams In 2013, I wrote an article talking about the popular Fake Microsoft Security Scams that were doing the rounds. As expected, these type of scams have continued to grow .. --------------------------------------------- http:////www.webroot.com/blog/2015/04/27/fake-security-scams-2015-edition/ *** 10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed *** --------------------------------------------- Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management? --------------------------------------------- http://blog.beyondtrust.com/10-reasons-your-privileged-password-management-… *** When Prevention Fails, Incident Response Begins, (Mon, Apr 27th) *** --------------------------------------------- Ive been asked a few times this year ($dayjob) to discuss and review incident handling practices with some of our clients. This topic seems to have come up to the surface again, and with some breaches getting main-stream coverage, it only .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19629 *** WordPress 4.2.1 Security Release *** --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-2-1/ *** SendGrid: Employee Account Hacked, Used to Steal Customer Credentials *** --------------------------------------------- Sendgrid, an email service used by tens of thousands of companies -- including Silicon Valley giants as well as Bitcoin exchange Coinbase -- said attackers compromised a Sendgrid employees account, which was then used to steal the usernames, email .. --------------------------------------------- http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to… *** Booby trapped! Malvertising campaign hit Adult Site xHamster *** --------------------------------------------- A New malvertising campaign hit adult website xHamster by abusing ad provider TrafficHaus and exploiting the Google's URL shortener service. Malversting campaigns are becoming a serious problem for web users, cyber criminals are exploiting .. --------------------------------------------- http://securityaffairs.co/wordpress/36367/cyber-crime/malvertising-campaign… *** Best Free and Open Source SQL Injection Tools *** --------------------------------------------- SQL injection is one of the most common attacks against web applications. This is used against websites which use SQL to query data from the database server. A successful .. --------------------------------------------- http://resources.infosecinstitute.com/best-free-and-open-source-sql-injecti… *** Hacker tarnen sich als Rüstungsfirma und tricksen Antiviren-Programme aus *** --------------------------------------------- Angreifer nutzten die Gunst der Stunde und verschickten im Zuge einer Firmenübernahme als Willkommensnachricht getarnte Phishing-Mails, um mit einer raffinierten Methode Schadcode auf die Computer von Angestellten zu schmuggeln. --------------------------------------------- http://heise.de/-2625892 *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Angesichts der potentiellen Auswirkung der Lücke und der hohen Anzahl an installierten WordPress Content Management Systemen bittet CERT.at um Beachtung der folgenden .. --------------------------------------------- https://cert.at/warnings/all/20150428.html *** Inside the Zeroaccess Trojan *** --------------------------------------------- The Zeroaccess trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. --------------------------------------------- http://blog.norsecorp.com/2015/04/27/inside-the-zeroaccess-trojan/ *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote attacker could exploit this vulnerability by sending crafted RADIUS packets to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38544 *** Cisco IOS Software and Cisco IOS XE Software Crafted DHCPv6 Sequence Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper handling of DHCPv6 packets for a SOLICIT message for an Identity Association for Non-Temporary Addresses (IA-NA) by a device running the affected software. An unauthenticated, adjacent attacker could exploit this vulnerability by sending a crafted sequence exchange of DHCPv6 packets for a SOLICIT message for an IA-NA to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38543

1 0

Tageszusammenfassung - Montag 27-04-2015
by Daily end-of-shift report 27 Apr '15

27 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-04-2015 18:00 − Montag 27-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitslücke im Yubikey Neo *** --------------------------------------------- Der USB-Stick Yubikey Neo lässt sich auch als Smartcard nutzen. Durch einen Bug kann man die eigentlich erforderliche Eingabe der PIN umgehen. Ein Angreifer kann die Krypto-Funktionen dadurch sogar über Funk missbrauchen. --------------------------------------------- http://heise.de/-2621122 *** CVE-2015-0359 (Flash up to 17.0.0.134) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134… *** Security Advisory: NTP vulnerability CVE-2015-1799 *** --------------------------------------------- The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16506.htm… *** What's Your Security Maturity Level? *** --------------------------------------------- Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think 15 pieces of flair). When .. --------------------------------------------- http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/ *** Sunday, April 26. 2015 How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security *** --------------------------------------------- Lately a lot of attention has been payed to software like Superfish and Privdog that intercepts TLS connections to be able to manipulate HTTPS traffic. These programs had severe (technically different) vulnerabilities that allowed attacks on HTTPS connections. --------------------------------------------- https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-t… *** Pwning a thin client in less than two minutes *** --------------------------------------------- The point of this blog post is to demonstrate that a malicious actor can compromise such thin clients in a trivial and quick way provided physical access, a standard prerequisite in an attack against a kiosk. --------------------------------------------- http://blog.malerisch.net/2015/04/pwning-hp-thin-client.html *** Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information .. --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. *** --------------------------------------------- A lot of network defense goes wrong before any contact with an adversary, starting with how defenders conceive of the battlefield. Most defenders focus on protecting their assets, prioritizing them, and sorting them by workload and .. --------------------------------------------- http://blogs.technet.com/b/johnla/archive/2015/04/26/defenders-think-in-lis… *** IBM Security Bulletin: SPSS Statistics ActiveX Control Code Execution Vulnerability Notification *** --------------------------------------------- SPSS Statistics ActiveX control on Windows 32 bit installations could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially-crafted Web page with Internet Explorer, a local attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697746 *** A Javascript-based DDoS Attack as seen by Safe Browsing *** --------------------------------------------- To protect users from malicious content, Safe Browsing's infrastructure analyzes web pages with web browsers running in virtual machines. This allows us to determine if a page contains malicious content, such as Javascript .. --------------------------------------------- http://googleonlinesecurity.blogspot.co.at/2015/04/a-javascript-based-ddos-… *** Node.js Server-Side JavaScript Injection Detection & Exploitation *** --------------------------------------------- Late last year, Burp scanner started testing for Server-Side JavaScript (SSJS) code injection. As you'd expect, this is where an attacker injects JavaScript into a server side parser and results in arbitrary code execution. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/4/15/nodejs-server-side-javascript-in… *** Critical Persistent XSS 0day in WordPress *** --------------------------------------------- Yes, you've read it right: a critical, unpatched 0-day vulnerability affecting WordPress' comment mechanisms was disclosed earlier today by Klikki Oy. Who's affected If your .. --------------------------------------------- https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.h… *** TeslaCrypt - Decrypt It Yourself *** --------------------------------------------- After the takedown of Cryptolocker, we have seen the rise of Cryptowall. Cryptowall 2 introduced 'features' such as advanced anti-debugging techniques, only to have many of those features removed in Cryptowall 3. Ransomware is .. --------------------------------------------- http://blogs.cisco.com/security/talos/teslacrypt

1 0

Tageszusammenfassung - Freitag 24-04-2015
by Daily end-of-shift report 24 Apr '15

24 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-04-2015 18:00 − Freitag 24-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** When automation does not help, (Thu, Apr 23rd) *** --------------------------------------------- In a lot of web application penetration tests that Ive done in last couple of years I noticed that the amount of technical vulnerabilities (i.e. XSS or SQL injection) is slowly declining.Of course, this depends on developers awareness but also on frameworks that are used for development of such applications. One of the best (or worst, depending on the point of view) is definitely .NET (yeah, I know, it feels weird to say that Microsoft is best in something security related). With .NET... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19615&rss *** Security Advisory: NTP vulnerability CVE-2015-1798 *** --------------------------------------------- (SOL16505) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16505.htm… *** CVE-2014-6284 - Probe login access vulnerability in SAP ASE *** --------------------------------------------- The SpiderLabs team at Trustwave published a new advisory today which details issues discovered in the SAP ASE (Adaptive Server Enterprise) by Martin Rakhmanov, a SpiderLabs Senior Researcher. SAP ASE is a relational database management system for UNIX, Linux, and... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-6284----Probe-… *** VMSA-2015-0003.5 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** The Rise of Counterintelligence in Malware Investigations *** --------------------------------------------- The key to operationalizing cybersecurity threat intelligence rests in the critical thinking that establishes that a given indicator is, in fact, malicious. There has been a great deal of talk about the emerging field of cybersecurity threat intelligence in recent years. CTI is the application of intelligence tactics to gain insights on adversarial actors and their tools, techniques, and procedures. However, one aspect that's not frequently discussed is the use of counterintelligence... --------------------------------------------- http://www.darkreading.com/partner-perspectives/general-dynamics-fidelis/th… *** Objectifying Cyber Intel Indicators *** --------------------------------------------- I've had the fortune of visiting a good number of SOCs (including building some) and meeting with a number of leaders in the SOC/IR space over the years- and the better teams will tell you that you simply cannot look at every single alert that fires. Expanding upon this even more, in regards to an Intel-driven IR program, this means that you cannot simply dump all indicators into production; I've seen this fail for both immature programs (overwhelmed with alerts) as well as mature... --------------------------------------------- http://seanmason.com/2014/08/25/objectifying-cyber-intel-indicators/ *** Honeywell XLWEB SCADA Path Traversal *** --------------------------------------------- Topic: Honeywell XLWEB SCADA Path Traversal Risk: Medium Text:SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual X... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040161 *** Magento-Lücke wird aktiv ausgenutzt *** --------------------------------------------- Wer einen Magento-Shop betreibt und noch nicht das jüngste Sicherheits-Update installiert hat, muss mit unerwünschten Besuchern rechnen. Hacker nutzen die Lücke aus, um SQL-Befehle in den Datenbankserver einzuschleusen. --------------------------------------------- http://heise.de/-2620110 *** IBM Products affected by Vulnerability in RC4 stream cipher ("Bar Mitzvah Attack") and other Vulnerabilities *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Dyreza's anticrypt *** --------------------------------------------- In the previous post, we have described how to set up a loft to monitor Dyreza with the help of virtual machines configured with breakpoints at addresses where communications appear in clear text. Configuration file updates can thus be obtained in real-time easily. Another way to monitor this kind of malware using a decentralised architecture is to implement parts of the malicious binary in a thin client, which requires to fully understand its decryption routine details. --------------------------------------------- http://www.lexsi-leblog.com/cert-en/dyrezas-anticrypt.html *** Antiviren-Software und Apples Schutzmechanismen für Mac OS X nutzlos *** --------------------------------------------- Einem Sicherheitsforscher zufolge sei es trivial, einen Mac nachhaltig mit Malware zu verseuchen. Weder würde gängige Antivirensoftware helfen, noch Apples eigene Mechanismen wie XProtect oder das Signieren von Apps. --------------------------------------------- http://heise.de/-2620049 *** HTML5 Security: Local Storage *** --------------------------------------------- In a previous article of mine, I discussed Cross Domain Messaging in HTML5. This article walks you through another feature, called local storage, and its security. Local Storage Local storage is one of the new features added in HTML5. It was first introduced in Mozilla 1.5 and eventually embraced by the HTML5 specification. We can... --------------------------------------------- http://resources.infosecinstitute.com/html5-security-local-storage/ *** Yubikey NEO (JavaCard OpenPGP) private key operations can be accessed without PIN *** --------------------------------------------- The source code contains a logical flaw related to user PIN (aka PW1) verification that allows an attacker with local host privileges and/or physical proximity (NFC) to perform security operations without knowledge of the user's PIN code. --------------------------------------------- https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.h…

1 0

Tageszusammenfassung - Donnerstag 23-04-2015
by Daily end-of-shift report 23 Apr '15

23 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-04-2015 18:00 − Donnerstag 23-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Deep dive into QUANTUM INSERT *** --------------------------------------------- Summary and recommendations QUANTUMINSERT (QI) is actually a relatively old technique. In order to exploit it, you will need a monitoring capabilities to leak information of observed TCP sessions and a host that can send spoofed packets. Your spoofed packet also needs to arrive faster than the original packet to be able to be successful. Any... --------------------------------------------- http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ *** Sicherheitsfirma warnt vor iOS-Killer-Funktion *** --------------------------------------------- Ein bösartiger Hotspot könnte iOS-Geräte in einen endlosen Reboot-Cycle schicken, warnt eine Sicherheitsfirma. Ursache ist anscheinend ein Fehler in Apples Verschlüsselungsimplementierung. --------------------------------------------- http://heise.de/-2617385 *** New Threat Report *** --------------------------------------------- Our latest comprehensive threat report, based on our analysis of H2 2014 data, is now available. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002805.html *** Mobile Threats Incident Handling: Updated ENISA material *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/mobile-threats-incident-handlin… *** Schadcode durch WLAN-Pakete *** --------------------------------------------- Durch eine Lücke in dem Standard-Tool wpa_supplicant können Angreifer anfällige Systeme über WLAN kompromittieren. Es kommt unter anderem bei Android und Linux zum Einsatz. Abhilfe schafft ein Patch, eine abgesicherte Version soll folgen. --------------------------------------------- http://heise.de/-2618115 *** wpa_supplicant P2P SSID processing vulnerability *** --------------------------------------------- A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from --------------------------------------------- http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt *** SSA-237894 (Last Update 2015-04-23): Vulnerability in SIMATIC PCS 7 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerDNS decompression bug can cause crashes *** --------------------------------------------- Topic: PowerDNS decompression bug can cause crashes Risk: Medium Text:Hi everybody, Please be aware of PowerDNS Security Advisory 2015-01 (http://doc.powerdns.com/md/security/powerdns-advisory-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040155 *** Security patch 02 for ZEN 11 Appliance - Freak - See TID 7016312 *** --------------------------------------------- Abstract: Patch for CVE-2015-0204 (FREAK) - OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability for ZCM ApplianceDocument ID: 5207650Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11_Security_Patch_2.zip (12.65 MB)Products:ZENworks Configuration Management 11ZENworks Configuration Management 11.1ZENworks Configuration Management 11 SP3ZENworks Configuration Management 11.2ZENworks Configuration Management 11.2.1ZENworks Configuration Management --------------------------------------------- https://download.novell.com/Download?buildid=Ddi7yDlFrqA~ *** ZDI-15-149: Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to disclose Session IDs of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ly4m30xpA5I/ *** ZDI-15-148: Novell Zenworks schedule.ScheduleQuery SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/04USkHANe4s/ *** ZDI-15-147: Novell Zenworks GetStoredResult.class SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/vaCwk090UHI/ *** ZDI-15-153: Novell ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sPdD0Sy4sxQ/ *** ZDI-15-152: Novell Zenworks com.novell.zenworks.inventory.rtr.actionclasses.wcreports Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/GTCY2AUbObw/ *** ZDI-15-151: Novell Zenworks Rtrlet doPost Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. By default, authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Wi0h3ROfwWc/ *** ZDI-15-150: Novell Zenworks FileViewer Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/-6nZPEvRTF0/ *** Security Advisory: Linux kernel vulnerabilities CVE-2014-8159 and CVE-2014-8369 *** --------------------------------------------- (SOL16478) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16478.htm… *** Security Advisory: Rsync vulnerability CVE-2007-6199 *** --------------------------------------------- (SOL15549) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15549.htm… *** Security Advisory: Linux kernel vulnerability CVE-2009-4537 *** --------------------------------------------- (SOL16479) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16479.htm… *** DSA-3232 curl - security update *** --------------------------------------------- Several vulnerabilities were discovered in cURL, an URL transfer library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3232 *** iPassword Manager 2.6 Script Insertion *** --------------------------------------------- Topic: iPassword Manager 2.6 Script Insertion Risk: Low Text:Document Title: iPassword Manager v2.6 iOS - Persistent Vulnerabilities References (Source): == http://www... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040147 *** Docker Privilege Escalation *** --------------------------------------------- Topic: Docker Privilege Escalation Risk: Medium Text:TLDR; Don’t use the ‘docker’ group Docker, if you aren’t already familiar with it, is a lightweight runtime and pack... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040151 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM/Cisco switches and directors (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005132 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affecting Sametime Unified Telephony (OpenSSL: CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8725, CVE-2015-0204, CVE-2015-0205) *** http://www.ibm.com/support/docview.wss?uid=swg21882876 *** IBM Security Bulletin: RPM vulnerability issue on IBM SONAS (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005166 *** IBM Security Bulletin: RPM vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005160 *** IBM Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005147 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM Storwize V7000 Unified (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005075 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM SONAS (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005152 *** IBM Security Bulletin: NSS vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005148 *** IBM Security Bulletin: Vulnerability in NSS affects SAN Volume Controller and Storwize Family (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005209 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by several OpenSSL vulnerabilities. *** http://www.ibm.com/support/docview.wss?uid=nas8N1020693 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect IBM Sterling B2B Integrator (CVE-2015-0209, CVE-2015-0287, CVE-2015-0292, and others) *** http://www.ibm.com/support/docview.wss?uid=swg21883249 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects Rational Software Architect for Websphere Software *** http://www.ibm.com/support/docview.wss?uid=swg21882955 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Mobile (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701358 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701548 *** IBM Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005125 *** IBM Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005157 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883226 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Composite Application Manager for Transactions (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21701114

1 0

Tageszusammenfassung - Mittwoch 22-04-2015
by Daily end-of-shift report 22 Apr '15

22 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-04-2015 18:00 − Mittwoch 22-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How attackers exploit end-users psychology *** --------------------------------------------- At RSA Conference 2015, Proofpoint released the results of its annual study that details the ways attackers exploit end-users psychology to circumvent IT security. Last year was the year attacke... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/tTatKVMFrgE/secworld.php *** How to hack Avaya phones with a simple text editor *** --------------------------------------------- At RSA conference 2015 a researcher demonstrated that Avaya's Ethernet office phones can be compromised with just a simple text editor. At the RSA conference 2015 in San Francisco, Dr Ang Cui from Columbia University PhD and Red Ballon Security cofounder announced that Avaya's Ethernet office phones can be compromised with just a simple text... --------------------------------------------- http://securityaffairs.co/wordpress/36187/hacking/how-to-hack-avaya-phone.h… *** 2 out of 3 IT pros put systems at risk by making undocumented changes *** --------------------------------------------- The Netwrix 2015 State of IT Changes Survey of more than 700 IT professionals across 40 industries found that 70% of companies forget about documenting changes, up from 57% last year. Most surprisingl... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4YM1XhU4vq4/secworld.php *** The CozyDuke APT *** --------------------------------------------- CozyDuke (aka CozyBear, CozyCar or "Office Monkeys") is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets. The White House and Department of State are two of the most spectacular... --------------------------------------------- http://securelist.com/blog/research/69731/the-cozyduke-apt/ *** CozyDuke, TLP: White *** --------------------------------------------- This whitepaper provides an overview of CozyDuke, a set of tools used by one or more malicious actors for performing targeted attacks against high profile organizations, such as governmental organizations and other entities that work closely with these institutions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002804.html *** "No iOS Zone" - A New Vulnerability Allows DoS Attacks on iOS Devices *** --------------------------------------------- In today's RSA Conference presentation, (Tuesday, April 21, 2015 | 3:30 PM - 4:20 PM | West | Room: 2001) Adi Sharabani, CEO and my fellow co-founder at Skycure, and I covered the lifecycle of vulnerabilities and vendor pitfalls. We also shared some details about a vulnerability our team recently identified in iOS 8 - a vulnerability that we are currently working with Apple to fix. --------------------------------------------- https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ *** Regular expressions and recommended practices *** --------------------------------------------- Whenever a security person crosses a vulnerability report, one of the the first steps is to ensure that the reported problem is actually a vulnerability. Usually, the issue falls into well known and studied categories and this step is done... --------------------------------------------- https://securityblog.redhat.com/2015/04/22/regular-expressions-and-recommen… *** RSA 2015: Thousands of Android apps found to be vulnerable *** --------------------------------------------- Vulnerability testing by CERT found tens of thousands of Android apps are vulnerable and no full register exists as they dont all get CVE assigned. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/42uHv7yPt0M/ *** RSA 2015: Experts discuss six dangerous attack techniques *** --------------------------------------------- Data breaches, ransomware, and threats against industrial control system were were discussed during an RSA Conference 2015 session on dangerous attack techniques. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yup3ar8W41U/ *** SSA-994726 (Last Update 2015-04-22): GHOST Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-451236 (Last Update 2015-04-22): Vulnerability in SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** HPSBGN03308 rev.1 - HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS), Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with the HP TippingPoint Security Management System (SMS) and vSMS. A vulnerability in JBOSS RMI could be exploited to allow remote code execution. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626974 *** Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting Risk: Low Text: = Reflected XSS Vulnerability In Manage Engine Firewall Analyzer = . contents:: Table Of Content Overview == ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040128 *** Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38486 *** Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38461 *** Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38460 *** DSA-3231 subversion - security update *** --------------------------------------------- Several vulnerabilities were discovered in Subversion, a version controlsystem. The Common Vulnerabilities and Exposures project identifies thefollowing problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3231 *** Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032178 *** Platform Agent 2011.1r2 *** --------------------------------------------- Abstract: The Novell Audit Platform Agent (Platform Agent) facilitates auditing events by transmitting log data from multiple applications to the Audit server.Document ID: 5207351Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Platform-Agent_2011.1r2.sha256 (93 bytes)Platform-Agent_2011.1r2.zip (16.8 MB)Products:Sentinel 7.0Sentinel 7.0.1Sentinel 7.0.2Sentinel 7.0.3Sentinel 7.1Sentinel 7.1.1Sentinel 7.1.2Sentinel 7.2Sentinel 7.2.1Sentinel 7.2.2Sentinel 7.3Sentinel Log --------------------------------------------- https://download.novell.com/Download?buildid=dpHkpNu89zw~

1 0

Tageszusammenfassung - Dienstag 21-04-2015
by Daily end-of-shift report 21 Apr '15

21 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-04-2015 18:00 − Dienstag 21-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** JavaScript CPU cache snooper tells crooks EVERYTHING you do online *** --------------------------------------------- New research sends browser kingpins scurrying for fixes Four Cornell University boffins reckon they can spy on keystrokes and mouse clicks in a web browser tab by snooping on the PCs processor caches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/21/cache_creep… *** New fileless malware found in the wild *** --------------------------------------------- Since the discovery of the Poweliks fileless Trojan in August 2014, researchers have been expecting other similar malware to pop up. The wait over: Phasebot malware, which also has fileless infecti... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/fLPIj0uz1VY/malware_news.… *** Cross-Site-Scripting: Zahlreiche Wordpress-Plugins verwenden Funktion fehlerhaft *** --------------------------------------------- Eine schlecht dokumentierte Funktion der Wordpress-API ist von zahlreichen populären Plugins fehlerhaft verwendet worden. Der Fehler führt zu Cross-Site-Scripting-Lücken: Betroffen sind unter anderem das Jetpack-Plugin, die Plugins von Yoast und das All-in-one-SEO-Plugin. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-zahlreiche-wordpress-plugins-… *** 2nd workshop on National Cyber Security Strategies: 13th May *** --------------------------------------------- ENISA and the Latvian Ministry of Defence are hosting on the 13th of May 2015, the 2nd workshop on National Cyber Security Strategies in Riga, during the Presidency of the Council of the European Union. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/2nd-workshop-on-national-cyber-… *** Fehlerhafte Netzwerkbibliothek macht iOS-Apps angreifbar *** --------------------------------------------- Durch einen Bug in der Bibliothek AFNetwork kann man die verschlüsselten Verbindungen zahlreicher Apps angreifen, die sie einsetzen. Eine Online-Datenbank verrät, welche Apps betroffen waren oder sind. --------------------------------------------- http://heise.de/-2615960 *** WordPress 4.1.2 Security Release *** --------------------------------------------- WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-1-2/ *** Security Advisory: glibc vulnerability CVE-2013-7424 *** --------------------------------------------- (SOL16472) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16472.htm… *** VU#260780: NetNanny uses a shared private key and root CA *** --------------------------------------------- Vulnerability Note VU#260780 NetNanny uses a shared private key and root CA Original Release date: 20 Apr 2015 | Last revised: 20 Apr 2015 Overview NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used --------------------------------------------- http://www.kb.cert.org/vuls/id/260780 *** Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38455 *** Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38459 *** HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03305 rev.1 - HP Business Service Management (BSM) products running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Business Service Management (BSM), SiteScope, Business Service Management (BSM) Integration Adaptor, Operations Manager for Windows, Unix and Linux, Reporter, Operation Agent Virtual Appliance, Performance Manager, Virtualization Performance Viewer, Operations Agent, BSM Connector and Service Health Reporter running SSLv3. The vulnerability could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626982

1 0

Tageszusammenfassung - Montag 20-04-2015
by Daily end-of-shift report 20 Apr '15

20 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-04-2015 18:00 − Montag 20-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Handling Special PDF Compression Methods, (Sun, Apr 19th) *** --------------------------------------------- Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. A couple of months before, I had started developing my pdf-parser tool, and Maartens diary entry motivated me to continue adding features to pdf-parser. Extracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. You select the object that contains the stream... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19597&rss *** Taking Down Fraud Sites is Whac-a-Mole *** --------------------------------------------- I've been doing quite a bit of public speaking lately - usually about cybercrime and underground activity - and there's one question that nearly always comes from the audience: "Why are these fraud Web sites allowed to operate, and not simply taken down?" This post is intended to serve as the go-to spot for answering... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Da3rhmEIBt0/ *** An Analysis Of MS15-034 *** --------------------------------------------- By now you've undoubtedly heard about MS15-034. The following is a collection of my cursory research and thoughts on this vulnerability. --------------------------------------------- http://www.securitysift.com/an-analysis-of-ms15-034/ *** How to use a malicious JPEG to hack corporate networks *** --------------------------------------------- Security researcher Marcus Murray discovered a method to exploit a malicious JPEG to compromise modern Windows servers inside corporate networks. Security expert and penetration tester Marcus Murray discovered a way to use a malicious JPEG to compromise modern Windows servers and elevate privileges over targeted networks. The researcher has demonstrated the attack a few days.... --------------------------------------------- http://securityaffairs.co/wordpress/36130/hacking/malicious-jpeg-hack-corpo… *** Fiesta Exploit Kit Spreading Crypto-Ransomware - Who Is Affected? *** --------------------------------------------- Exploits kits have long been used to deliver threats to users, but they seem to have gone retro: it was recently being used to deliver fake antivirus malware. We closely monitor exploit kit activity because of their widespread use (we discussed their use in malvertising recently), so it was no great surprise to see the Fiesta... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/F_yFw0VwfG8/ *** "Rootpipe"-Lücke in OS X besteht offenbar weiter *** --------------------------------------------- Trotz Patch in der letzten Yosemite-Version scheint die Rechteausweitung nicht behoben zu sein. Schadcode soll die Lücke schon 2014 ausgenutzt haben. Ein Blogger zeigt unterdessen eine Möglichkeit auf, den Bug auch in früheren OS-X-Versionen zu fixen. --------------------------------------------- http://heise.de/-2612346 *** Bypassing Same Origin Policy, Part 3: Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Bypassing Packet Filters with IP Fragmentation Overlapping *** --------------------------------------------- 1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-packet-filters-with-ip-frag… *** Threats From Within: The Out of Office Reply *** --------------------------------------------- As the guy who sends out the marketing emails at Cyveillance (yes, I'm THAT guy) I see a lot of Out-of-Office auto-responders in any given month. Having worked in cybersecurity for more than seven years, I've developed an appreciation for both information and physical security. With the RSA Conference coming up in a few days, and awaiting my barrage of Out of Office emails, I think now is the perfect time to discuss this seemingly innocuous topic. Why? Amazingly, even in the security... --------------------------------------------- https://blog.cyveillance.com/threats-from-within-the-out-of-office-reply/ *** Upatre malware gets full SSL comms encryption *** --------------------------------------------- The extremely popular Upatre Trojan downloader has undergone considerable changes that will make it and its communication more difficult to spot and block. The changes were implemented in the new v... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/qIIbd4nwtHA/malware_news.… *** Critical Magento Shoplift Vulnerability (SUPEE-5344) - Patch Immediately! *** --------------------------------------------- The Magento team released a critical security patch (SUPEE-5344) to address a remote command execution (RCE) vulnerability back in February. It's been more than two months since the release and still more than 50% of all the Magento installations have not been patched, leaving them open to attacks. This means hundreds of thousands of websites are... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/lfn2WVKTfWo/critical-magento-… *** DSA-3228 ppp - security update *** --------------------------------------------- Emanuele Rocca discovered that ppp, a daemon implementing thePoint-to-Point Protocol, was subject to a buffer overflow whencommunicating with a RADIUS server. This would allow unauthenticatedusers to cause a denial-of-service by crashing the daemon. --------------------------------------------- https://www.debian.org/security/2015/dsa-3228 *** GnuTLS RSA PKCS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/102423 *** Zenworks Architecture ZDI Vulnerability - See TID 7016431 *** --------------------------------------------- Abstract: Fix for ZDI-CAN-2491: ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability Document ID: 5206350Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11.3.2_FRU1_Patch_921190.zip (3.53 MB)ZCM_11.2.4_MU1_Patch_921190.zip (1.63 MB)Products:ZENworks Configuration Management 11.3.2ZENworks Configuration Management 11.2.4ZENworks Configuration Management 11.3.1ZENworks Configuration Management 11 SP3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BJbybNUmQRQ~ *** Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-085Project: Invoice (third-party module)Version: 6.x, 7.xDate: 2015-March-25 Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionInvoice module allows you to create invoices in Drupal.The module doesnt sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.Additionally, some URLs were not --------------------------------------------- https://www.drupal.org/node/2459337 *** DSA-3229 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.43. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2015/dsa-3229 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21883028 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2015-0208, CVE-2015-0286, CVE-2015-0292) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21713653 *** IBM Security Bulletin: RC4 stream cipher vulnerability and HTTP request smuggling vulnerability affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2808, CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21882717 *** Bugtraq: CVE-2014-7953 Android backup agent code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/535296 *** Android 4.4 MTP Path Traversal *** --------------------------------------------- Topic: Android 4.4 MTP Path Traversal Risk: Medium Text:MTP path traversal vulnerability in Android 4.4 -- doSendObjectInfo() method of the MtpServer class implemen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040116

1 0

Tageszusammenfassung - Freitag 17-04-2015
by Daily end-of-shift report 17 Apr '15

17 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-04-2015 18:00 − Freitag 17-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Internet broken as usual. *** --------------------------------------------- We continue to see active exploitation against MS15-034. But nothing different from yesterday, so back to Infocon Green for now. (Fri, Apr 17th) --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19593&rss *** USB Defense: Stop Data Walking Out The Door *** --------------------------------------------- The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. --------------------------------------------- http://thehackernews.com/2015/04/usb-security-software.html *** US-Polizei schickt Malware an Whistleblower-Anwalt *** --------------------------------------------- Drei Whistelblower beschuldigen eine Polizei in Arkansas der Korruption und des Mobbings. Das Gericht ordnet die Freigabe von Dokumenten an. Die Polizei schickt eine Festplatte mit Passwortlogger, Backdoor und Command&Control Software. --------------------------------------------- http://heise.de/-2610436 *** On false alarms in detection of DGA botnet domains - part 1 *** --------------------------------------------- Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and botnet itself) from a takeover. Often domains generated this way are composed of random .. --------------------------------------------- http://www.cert.pl//news/9887/langswitch_lang/en *** Google's April Fool's prank inadvertently broke their security *** --------------------------------------------- As part of its traditional series of April Fools day jokes, Google used its own .google gTLD to launch a backwards version of its home page from the domain com.google on 1st April. However, this years joke inadvertently undermined an important security feature on Googles real homepage, which made it vulnerable to user interface redressing attacks such as click-jacking. This vulnerability would have allowed a remote attacker to change a users search settings, including turning off SafeSearch --------------------------------------------- http://news.netcraft.com/archives/2015/04/17/googles-april-fools-prank-inad… *** GnuTLS Certificate Validation Flaw Lets Remote Users Force a Signature Algorithm Downgrade *** --------------------------------------------- A vulnerability was reported in GnuTLS. A remote user can force the use of a weaker signature algorithm. The software does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm specified in the certificate. A remote user can exploit this to force the use of a weaker encryption algorithm. --------------------------------------------- http://www.securitytracker.com/id/1032148

1 0

Tageszusammenfassung - Donnerstag 16-04-2015
by Daily end-of-shift report 16 Apr '15

16 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-04-2015 18:00 − Donnerstag 16-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Impacts of a Hack on a Magento Ecommerce Website *** --------------------------------------------- Recently we wrote about the impacts of a hacked website and how it is important to give website visitors a safe online experience In this post, I'll show you how a hacked website results in almost immediate loss of money. We are not talking about drive-by infections that can be prevented by using a good anti-virus, updated software, and extensions like NoScript. ... This time, we're talking about using legitimate sites that have absolutely no externally visible signs of compromise. --------------------------------------------- https://blog.sucuri.net/2015/04/impacts-of-a-hack-on-a-magento-ecommerce-we… *** Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2015-096 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-096 Project: Services (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 16/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass, Arbitrary PHP code execution --------------------------------------------- https://www.drupal.org/node/2471879 *** Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-095 Project: Display Suite (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting --------------------------------------------- https://www.drupal.org/node/2471733 *** The Delicate Art of Remote Checks - A Glance Into MS15-034 *** --------------------------------------------- Recently, the research team posted a testing script for the MS15-034 vulnerability to pastebin for the greater community to test. We received some feedback about how exactly we figured out how to check, and remote checks in general. --------------------------------------------- http://blog.beyondtrust.com/the-delicate-art-of-remote-checks-a-glance-into… *** Denial of Service Attacks Possible with OpenSSL Vulnerability CVE-2015-1787 *** --------------------------------------------- On March 19 we wrote about how OpenSSL disclosed and fixed 13 vulnerabilities to address several security holes. Among the vulnerabilities addressed was CVE-2015-1787, which can result in a complete denial of service on an application compiled with OpenSSL library. This blog post will tackle how the bug can be exploited ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Q6dMoVlcsE4/ *** Exploit kits (still) pushing Teslacrypt ransomware, (Thu, Apr 16th) *** --------------------------------------------- Teslacrypt is a form of ransomware that was first noted in January of this year. This malware apparently targets video game-related files. Ive seen Teslacrypt dropped by the Sweet Orange exploit kit (EK), and its also been dropped by Nuclear EK. McAfee saw it dropped by Angler EK last month. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19581&rss *** New POS Malware Emerges - Punkey *** --------------------------------------------- During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey. It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges… *** IBM stellt seine Security-Datenbank ins Netz *** --------------------------------------------- IBM Security macht seine IT-Sicherheitsdatenbank künftig auf der Sharing-Plattform X-Force Exchange in der Cloud zugänglich. --------------------------------------------- http://heise.de/-2608795 *** crossdomain.xml : Beware of Wildcards *** --------------------------------------------- This blog entry will describe a wide spread Flash vulnerability that affected many big websites including paypal.com. The description will picture the state of the website paypal.com and ebay.com in 2013-2014. The vulnerabilities were completely fixed two weeks ago. Therefore, it is not possible to reproduce this vulnerability as-is. --------------------------------------------- http://blog.h3xstream.com/2015/04/crossdomainxml-beware-of-wildcards.html *** Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38403 *** Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily