- Daily - CERT.at

Tageszusammenfassung - Dienstag 10-03-2015
by Daily end-of-shift report 10 Mar '15

10 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-03-2015 18:00 − Dienstag 10-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** MS15-MAR - Microsoft Security Bulletin Summary for March 2015 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for March 2015. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-MAR *** Apple Patches for iOS, OS X and Apple TV, (Tue, Mar 10th) *** --------------------------------------------- With yesterdays updates for iOS, OS X and Apple TV, Apple also addressed a number of security vulnerabilities, most notably the Freak vulnerability. After updating, the affected operating systems no longer support export quality ciphers. However, Apple browsers continue to support SSLv3 and as a result, continue to be vulnerable to POODLE. Quick Summary of the security content of Apples updates: XCode 6.2: This update addresses 4 vulnerabilities in subversion and 1 in git. OS X: 5... --------------------------------------------- https://isc.sans.edu/diary/Apple+Patches+for+iOS%2C+OS+X+and+Apple+TV/19443 *** Exploiting the DRAM rowhammer bug to gain kernel privileges *** --------------------------------------------- "Rowhammer" is a problem with some recent DRAM devices in which repeatedly accessing a row of memory can cause bit flips in adjacent rows. We tested a selection of laptops and found that a subset of them exhibited the problem. We built two working privilege escalation exploits that use this effect. One exploit uses rowhammer-induced bit flips to gain kernel privileges on x86-64 Linux when run as an unprivileged userland process. When run on a machine vulnerable to the rowhammer... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/03/exploiting-dram-rowhammer-b… *** Network Forensics What Are Your Investigations Missing - SANS DFIR WEBCAST *** --------------------------------------------- Traditionally, computer forensic investigations focused exclusively on data from the seized media associated with a system of interest.Recently, memory analysis has become an integral part of forensic analysis, resulting in a new and significantly different way for digital examiners and investigators to perform their craft.Now another evolution in computer forensics is at hand - one that includes data collected from network devices as well as the from wires themselves. Every day, more and more... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/03/09/network-forensics-wh… *** Yahoo Patches Critical eCommerce, Small Business Vulnerabilities *** --------------------------------------------- Yahoo has fixed a handful of vulnerabilities that could have given an attacker free reign over all of its user-run eCommerce websites and caused multiple headaches for small business owners. --------------------------------------------- http://threatpost.com/yahoo-patches-critical-ecommerce-small-business-vulne… *** Attackers targeting Elasticsearch remote code execution hole *** --------------------------------------------- Devs ring patch alarm bells, drop shell code Attackers are targeting a patched remote code execution vulnerability in Elasticsearch that grants unauthenticated bad guys access through a buggy API. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/10/elastic_sea… *** SMS Trojan bypasses CAPTCHA *** --------------------------------------------- Trojan-SMS.AndroidOS.Podec proved to be remarkable: it can send messages to premium-rate numbers employing tools that bypass the Advice of Charge system. It can also subscribe users to premium-rate services while bypassing CAPTCHA. --------------------------------------------- http://securelist.com/analysis/publications/69169/sms-trojan-bypasses-captc… *** Xen Security Advisory CVE-2015-2150 / XSA-120 *** --------------------------------------------- Non-maskable interrupts triggerable by guests --------------------------------------------- http://xenbits.xen.org/xsa/advisory-120.html *** Xen Security Advisory CVE-2015-2151 / XSA-123 *** --------------------------------------------- Hypervisor memory corruption due to x86 emulator flaw --------------------------------------------- http://xenbits.xen.org/xsa/advisory-123.html *** Xen Security Advisory XSA-124 *** --------------------------------------------- Non-standard PCI device functionality may render pass-through insecure --------------------------------------------- http://xenbits.xen.org/xsa/advisory-124.html *** Exploiting the DRAM "Row Hammer" Bug *** --------------------------------------------- IBM has determined that all IBM System z, System p, and System x products are not vulnerable to this attack. IBM is analyzing other IBM products to determine if they are potentially impacted by this issue. Please actively monitor both your IBM Support Portal for available fixes and/or remediation steps and this blog for additional information. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/exploiting_the_dram_r… *** Row Hammer Privilege Escalation Vulnerability *** --------------------------------------------- cisco-sa-20150309-rowhammer --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150310-ssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response *** --------------------------------------------- Topic: Varnish 4.0.3 heap-buffer-overflow while parsing backend server HTTP response Risk: High Text:Hi there, Latest varnish-cache 4.0.3 (https://www.varnish-cache.org/) seem to have a problem with parsing HTTP responses fro... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030056 *** Foxit Reader Update Service Unsafe Service Path Lets Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031879 *** Foxit Reader GIF File LZWMinimumCodeSize Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031878 *** Foxit Reader GIF File Ubyte Size Memory Corruption Error Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031877 *** Red Hat Enterprise MRG Messaging Qpid Daemon Bugs Let Remote Users Deny Service and Access the System *** --------------------------------------------- http://www.securitytracker.com/id/1031872 *** Rails ActiveModel::Name Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031873 *** Security Advisory: MainWP-Child WordPress Plugin *** --------------------------------------------- Security Risk: Critical Exploitation level: Very Easy/Remote DREAD Score: 9/10 Vulnerability: Password bypass / Privilege Escalation Patched Version: 2.0.9.2 During a routine audit of our Website Firewall (WAF), we found a critical vulnerability affecting the popular MainWP Child WordPress plugin. According to worpdress.org, it is installed on more than 90,000 WordPress sites as as remote administration... --------------------------------------------- http://blog.sucuri.net/2015/03/security-advisory-mainwp-child-wordpress-plu… *** Google Analytics by Yoast 5.3.2 - Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7838 *** Fraction Theme <= 1.1.1 - Privilege Escalation via CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7840

1 0

Tageszusammenfassung - Montag 9-03-2015
by Daily end-of-shift report 09 Mar '15

09 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-03-2015 18:00 − Montag 09-03-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Attackers concealing malicious macros in XML files *** --------------------------------------------- XML files are harmless text files right? Wrong! The group behind the malicious Microsoft Office document campaigns have started to utilize Microsoft Office XML formats to hide malicious macros. This week, our spam traps were flooded with spam with XML... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attackers-concealing-ma… *** Samba Remote Code Execution Vulnerability - CVE-2015-0240 *** --------------------------------------------- The Samba team reported CVE-2015-0240 last February 23, 2015. This vulnerability is very difficult to exploit and we are not aware of successful exploitation. However, it is quite interesting from the point for view of detection. There are two important facts: The vulnerability resides in the Netlogon Remote Protocol implementation of Samba which is a... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/samba-remote-cod… *** How Malware Generates Mutex Names to Evade Detection, (Mon, Mar 9th) *** --------------------------------------------- Malicious software sometimes uses mutex objects to avoid infecting the system more than once, as well as to coordinate communications among its multiple components on the host. Incident responders can look for known mutex names to spot the presence of malware on the system. To evade detection, some malware avoids using a hardcoded name for its mutex, as is the case with the specimen discussed in this note. Static Mutex Names as Indicators of Compromise For background details about mutex... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19429&rss *** New crypto ransomware in town : CryptoFortress *** --------------------------------------------- This post has been heavily edited to fix my mistake. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** Seagate Confirms NAS Zero Day, Won't Patch Until May *** --------------------------------------------- Seagate confirmed a publicly disclosed vulnerability in one of its network attached storage products, but said it wont have a patch available until May. --------------------------------------------- http://threatpost.com/seagate-confirms-nas-zero-day-wont-patch-until-may/11… *** OpenSSL Audit *** --------------------------------------------- IntroductionThe reputation built by NCC Group, including iSEC Partners, Matasano Security, Intrepidus Group and NGS Secure, has led compani ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/03/openssl-audit/ *** l+f: Vernetzte Wetterstation funkte WLAN-Passwort zum Hersteller *** --------------------------------------------- Die Netatmo-Wetterstationen schickten nicht nur ihre Messwerte ins Netz, sondern auch SSID und WLAN-Passwort des Nutzers. --------------------------------------------- http://heise.de/-2571218 *** Update - Notizen zu FREAK *** --------------------------------------------- In den letzten Tagen gab es wieder einmal große mediale Aufmerksamkeit für eine Schwachstelle in OpenSSL und anderen Crypto-Libraries. Der Eintrag für die zugehörige CVE-ID CVE-2015-0204 besteht seit November letzten Jahres, aktualisierte Versionen von OpenSSL wurden heuer im Jänner veröffentlicht. | Update 2015-03-09 | Ergänzung: Auflistungen betroffener Bibliotheken/Anbieter finden sich auf... --------------------------------------------- http://www.cert.at/services/blog/20150306175713-1442.html *** Mono TLS vulnerabilities *** --------------------------------------------- Topic: Mono TLS vulnerabilities Risk: Medium Text:Hi A TLS impersonation attack was discovered in Monos TLS stack by researchers at Inria. During checks on our TLS stack, w... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030042 *** IBM Security Bulletin: Multiple Vulnerabilities in the IBM Java SDK affect IBM Notes and Domino (Oracle January 2015 Critical Patch Update) *** --------------------------------------------- 2015-03-09T11:05:28-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698222 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-3570, CVE-2014-3572, CVE-2015-0204) *** --------------------------------------------- 2015-03-09T11:04:47-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21698574 *** IBM Security Bulletin: Vulnerability in SSLv3 Affects Power Hardware Management Console (CVE-2014-3513, CVE-2014-3566, CVE-2014-3567, CVE-2014-3568) *** --------------------------------------------- 2015-03-09T11:01:43-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=nas8N1020593 *** IBM Security Bulletin: Vulnerability in SSLv3 enabled in IBM Host On-Demand affects Rational Functional Tester (CVE-2014-3566) *** --------------------------------------------- 2015-03-09T11:01:10-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697348 *** IBM Security Bulletin: Fixes available for Security Vulnerabilities in IBM WebSphere Portal (CVE-2014-6214; CVE-2015-0139; CVE-2015-0177) *** --------------------------------------------- 2015-03-09T11:10:19-04:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697213 *** HPSBUX03235 SSRT101750 rev.3 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** Vulnerabilities in WordPress Pluins *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 https://wpvulndb.com/vulnerabilities/7827 https://wpvulndb.com/vulnerabilities/7828 https://wpvulndb.com/vulnerabilities/7829 https://wpvulndb.com/vulnerabilities/7830 https://wpvulndb.com/vulnerabilities/7831 https://wpvulndb.com/vulnerabilities/7832 https://wpvulndb.com/vulnerabilities/7833 https://wpvulndb.com/vulnerabilities/7834 https://wpvulndb.com/vulnerabilities/7835 https://wpvulndb.com/vulnerabilities/7836 https://wpvulndb.com/vulnerabilities/7837

1 0

Tageszusammenfassung - Freitag 6-03-2015
by Daily end-of-shift report 06 Mar '15

06 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-03-2015 18:00 − Freitag 06-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Oracle hängt Adware an den Java-Installer für Mac OS X *** --------------------------------------------- Bei der Installation von Java wird nun auch Mac-Nutzern Adware angedreht - dabei handelt es sich aktuell um eine Browser-Erweiterung. --------------------------------------------- http://heise.de/-2568995 *** Intuit Failed at 'Know Your Customer' Basics *** --------------------------------------------- Intuit, the makers of TurboTax, recently introduced several changes to beef up the security of customer accounts following a spike in tax refund fraud at the state and federal level. Unfortunately, those changes dont go far .. --------------------------------------------- http://krebsonsecurity.com/2015/03/intuit-failed-at-know-your-customer-basi… *** Why A Free Obfuscator Is Not Always Free. *** --------------------------------------------- We all love our code but some of us love it so much that we don't want anyone else to read or understand it. When you think about it, that's understandable - hours and hours of hard dev work, days of testing and weeks .. --------------------------------------------- http://blog.sucuri.net/2015/03/why-a-free-obfuscator-is-not-always-free.html *** Cisco IOS Autonomic Networking Infrastructure Self-Referential Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Contact Form DB 2.8.29 - CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7826 *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco IOS XR Software Malformed SNMP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Freak: Auch Windows von SSL-Lücke betroffen *** --------------------------------------------- Deutlich mehr Clients gefährdet als bisher angenommen - Neben Android und iOS auch Opera unter Linux .. --------------------------------------------- http://derstandard.at/2000012569585 *** Internetdienst Onlinetvrecorder.com gehackt *** --------------------------------------------- Der Internet-Aufnahmedienst Onlinetvrecorder.com ist Opfer eines Hackangriffes geworden. Der Anbieter empfiehlt allen Nutzern, ihr Passwort zu ändern. --------------------------------------------- http://heise.de/-2569350 *** Multiple vulnerabilities in Siemens products *** --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-064-01 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-02 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-03 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-04 https://ics-cert.us-cert.gov//advisories/ICSA-15-064-05 *** Verbraucherschützer warnen vor falschen E-Mails von Paketdiensten *** --------------------------------------------- Links führen laut deutscher Verbraucherzentrale zu Schadsoftware - Falsche Mails nutzen Namen von DHL und UPS --------------------------------------------- http://derstandard.at/2000012593805 *** Powerspy: Stalking über den Akkuverbrauch *** --------------------------------------------- Statt über Bluetooth und per GPS lassen sich Smartphone-Benutzer auch anhand ihres Akkuverbrauchs verfolgen. Powerspy macht's möglich. --------------------------------------------- http://www.golem.de/news/powerspy-stalking-ueber-den-akkuverbrauch-1503-112… *** Adobe drückt sich vor Finderlohn für gemeldete Lücken *** --------------------------------------------- Wer Lücken im Adobe Reader, Flash und Co. findet, kann diese jetzt über ein Belohnungsprogramm an den Hersteller melden. Eine geldwerte Belohnung gibt es allerdings nicht – zumindest nicht von Adobe. --------------------------------------------- http://heise.de/-2569878 *** The Ongoing Debate about the Gap between Compliance and Security *** --------------------------------------------- Companies required to comply with the Payment Card Industry Data Security Standard (PCI DSS) must meet a wide range of technical and operation requirements. The challenge organizations face regarding PCI compliance has shifted from achieving the minimum level required to satisfy PCI audit .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/the-ongoing-debate-abo…

1 0

Tageszusammenfassung - Donnerstag 5-03-2015
by Daily end-of-shift report 05 Mar '15

05 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-03-2015 18:00 − Donnerstag 05-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MICROSYS PROMOTIC Stack Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in the MICROSYS, spol. s r.o. PROMOTIC application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-01 *** Adobe Launches Web Application Vulnerability Disclosure Program on HackerOne *** --------------------------------------------- In recognition of the important role that independent security researchers play in keeping Adobe customers safe, today Adobe launches a web application .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1179 *** SA-CONTRIB-2015-063 - Webform - Cross Site Scripting (XSS) *** --------------------------------------------- The module doesn't sufficiently escape user data presented to administrative users in the webform results table. This issue affects the 7.x-4.x branch only. This vulnerability is mitigated by the fact that an attacker .. --------------------------------------------- https://www.drupal.org/node/2445935 *** Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Secure Access Control Server Default Tomcat Administration Interface Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Toshiba Bluetooth Stack Untrusted Service Path Lets Local Users Gain System Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031825 *** BIND DNSSEC Guide *** --------------------------------------------- ISC has new documentation introducing DNSSEC, configuring BIND for common DNSSEC features, and basic DNSSEC troubleshooting. ISCs BIND DNSSEC Guide, co-written with DeepDive Networking, covers DNSSEC requirements, setting up a validating resolver, maintaining signed authoritative zones, and .. --------------------------------------------- http://users.isc.org/~jreed/dnssec-guide/dnssec-guide.html *** SANS ICS410 Vienna *** --------------------------------------------- SANS presents the essential ICS/SCADA training course, ICS410 ICS Security Essentials. This specialist training event is running with the support of the International Atomic Energy Agency (IAEA) and follows the IAEAs International Conference on Computer Security in a Nuclear World which takes place the preceding week in Vienna. --------------------------------------------- https://www.sans.org/event/ics410-vienna-with-iaea *** Malware "Casper": Wie die Franzosen in Syrien spionieren *** --------------------------------------------- Sicherheitsforscher analysieren Schadprogramm, das wohl von Frankreichs Geheimdiensten eingesetzt wird --------------------------------------------- http://derstandard.at/2000012513213 *** Format Injection Vulnerability in Duo Security Web SDK *** --------------------------------------------- Format Injection is not a new bug, but it was never described as a subclass of A1 Injection. You probably already hate me for giving it a name (at least I didn't create a logo!) but calling it an 'injection' is too general. --------------------------------------------- http://sakurity.com/blog/2015/03/03/duo_format_injection.html *** The State Of The Internet *** --------------------------------------------- One great idea behind the internet is to connect devices from nearly every position on earth. Well, this idea sometimes has its drawbacks. In order to get an overview about devices that are actually connected, the University of .. --------------------------------------------- https://splone.com/blog/2015/3/4/the-state-of-the-internet *** Schutz vor Freak Attack: Diese Browser sind betroffen *** --------------------------------------------- Der Freak-Angriff kompromittiert unzählige verschlüsselte Webseiten und Angreifer könnten sensible Daten ausspionieren. Ob man für die Attacke anfällig ist, hängt aber vom eingesetzten Betriebssystem, Webbrowser und der besuchten Internetseite ab. --------------------------------------------- http://heise.de/-2567655 *** OpenSSL Cookbook 2nd Edition released *** --------------------------------------------- Today we're releasing the second edition of OpenSSL Cookbook, Feisty Ducks free OpenSSL book. This edition is a major update, with some improvements to the existing text and new content added. The new edition has about 95 pages, an increase of about 35 pages. --------------------------------------------- http://blog.ivanristic.com/2015/03/openssl-cookbook-second-edition-released… *** Utilizing NLP To Detect APT in DNS *** --------------------------------------------- Imagine that after a nice, relaxing long weekend, you come in to work Monday morning at your job at the bank. While waking up with a cup of coffee, you begin checking email. Among the usual messages, there's a message about a security update and you click it. Security updates are so common these days that it's .. --------------------------------------------- https://labs.opendns.com/2015/03/05/nlp-apt-dns/ *** l+f: Abgelaufenes SSL-Zertifikat bei Visa *** --------------------------------------------- Wenn der Browser beim Besuch von Visa.de einen Zertifikatswarnung anzeigt, kann ein Angriff im Gange sein – oder der Admin hat vergessen, wann das Zertifikat abläuft. --------------------------------------------- http://heise.de/-2568054 *** VB2014 paper: Leaving our ZIP undone: how to abuse ZIP to deliver malware apps *** --------------------------------------------- Gregory Panakkal explains there are different ways of looking at APK files - and that sometimes has unintended consequences.Since the close of the VB2014 conference in Seattle in October, we have been sharing VB2014 conference papers as well as video recordings of the presentations. Today, we .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_05.xml *** Domain Trusts: Why You Should Care *** --------------------------------------------- Red teams have been abusing Windows domain trusts for years with great success, but the topic is still underrepresented in public infosec discussions. While the community has started to talk more about Active Directory .. --------------------------------------------- http://www.harmj0y.net/blog/redteaming/domain-trusts-why-you-should-care/ *** Decoding ZeuS Disguised as an .RTF File *** --------------------------------------------- While going through emails that were reported by our internal users using Reporter, I came across a particularly nasty looking phishing email that had a .doc attachment. At first when I detonated the sample in my VM, it seemed that the attackers weaponized the attachment incorrectly. .. --------------------------------------------- http://phishme.com/decoding-zeus-disguised-as-an-rtf-file/

1 0

Tageszusammenfassung - Mittwoch 4-03-2015
by Daily end-of-shift report 04 Mar '15

04 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-03-2015 18:00 − Mittwoch 04-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Datensicherheit: Smartphones sollen sicherer werden - zumindest ein bisschen *** --------------------------------------------- Wie lassen sich mobile Geräte wenn schon nicht sicher, dann zumindest weniger unsicher machen? In Barcelona stellen Silent Circle, Jolla und Qualcomm ihre Ideen vor. --------------------------------------------- http://www.golem.de/news/datensicherheit-smartphones-sollen-sicherer-werden… *** phpMoAdmin 0-day Nmap Script *** --------------------------------------------- An 0-day vulnerability has been posted on Full-Disclosure this morning. It affects the MongoDB GUI phpMoAdmin. The GUI is similar to the well-known phpMyAdmin and allows the DB administrator to perform maintenance tasks on the .. --------------------------------------------- http://blog.rootshell.be/2015/03/04/phpmoadmin-0-day-nmap-script/ *** Freak Attack: SSL-Verschlüsselung von Millionen Webseiten angreifbar *** --------------------------------------------- Wenn Nutzer von Apple- und Android-Geräten eine der Millionen für den Angriff Freak anfälligen Webseiten ansurfen, kann ein Man-in-the-Middle die verschlüsselten Verbindungen knacken. Angreifer können nicht nur Daten mitlesen, sondern auch manipulieren. --------------------------------------------- http://heise.de/-2566444 *** CryptoFortress : Teerac.A (aka TorrentLocker) got a new identity *** --------------------------------------------- Blitz post. I was hunting for Gootkit (pushed in a Nuclear Pack instance in France those days) but instead I got a Teerac.A. --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cryptofortress-teeraca-aka.html *** SuperFish SSL Sniffing *** --------------------------------------------- Let's start off by saying that SuperFish may top Adobe's ColdFusion un-authenticated remote code executions versions 6-10. Although, Adobe may not have put those vulnerabilities in there themselves and knowingly, Lenovo has no excuse. --------------------------------------------- http://pashakravtsov.com/2015/03/03/SuperFish-SSL-Sniffing/ *** Forensik-Training: Shellshock-Hinweise in Serverlogs aufspüren *** --------------------------------------------- Die europäische Sichereitsbehörde ENISA hat ihr Trainingsmaterial für netzwerkforensische Analysen aktualisiert und um neue Themen ergänzt. --------------------------------------------- http://heise.de/-2566554 *** Threat Spotlight: Angler Lurking in the Domain Shadows *** --------------------------------------------- Over the last several months Talos researchers have been monitoring a massive exploit kit campaign that is utilizing hijacked registrant accounts to create large amounts .. --------------------------------------------- http://blogs.cisco.com/security/talos/angler-domain-shadowing *** A Few Thoughts on Cryptographic Engineering *** --------------------------------------------- This is the story of how a handful of cryptographers hacked the NSA. Its also a story of encryption backdoors, and why they never quite work out the way you want them to. --------------------------------------------- http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-fac… *** Google: Chrome-Support für Android 4.0 wird eingestellt *** --------------------------------------------- Der Chrome-Browser wird für Android 4.0 nur noch wenige Wochen mit Updates versorgt. Nach Version 42 wird der Support beendet. Der steigende Wartungsaufwand für das dreieinhalb Jahre alte Android sei nicht mehr gerechtfertigt, sagt Google. --------------------------------------------- http://www.golem.de/news/google-chrome-support-fuer-android-4-0-wird-einges… *** Skyfall Meets Skype *** --------------------------------------------- The portmanteau-named SKYPEFALL.EXE is the latest, very active, malware-spamming campaign spreading through Skype. --------------------------------------------- http://securelist.com/blog/incidents/69065/skyfall-meets-skype/

1 0

Tageszusammenfassung - Dienstag 3-03-2015
by Daily end-of-shift report 03 Mar '15

03 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-03-2015 18:00 − Dienstag 03-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Ads Gone Bad *** --------------------------------------------- FireEye Labs tracks malvertising activity and recently discovered hundreds of sites that may have been exposed to malvertisements via abuse of ad networks that use real-time bidding (RTB). Since February 4, 2015, FireEye Labs has seen over 1,700 advertiser RTB requests that resulted in downloading of malicious SWF files. We believe this activity is part of an active malvertising operation. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/ads_gone_bad.html *** D-Link Routers Haunted by Remote Command Injection Bug *** --------------------------------------------- Some D-Link routers contain a vulnerability that leaves them open to remote attacks that can give an attacker root access, allow DNS hijacking and other attacks. The vulnerability affects affects a number of D-Link's home routers and the key .. --------------------------------------------- http://threatpost.com/d-link-routers-haunted-by-remote-command-injection-bu… *** Older Keen Team Use-After-Free IE Exploit Added to Angler Exploit Kit *** --------------------------------------------- Attackers behind one of the more popular exploit kits, Angler, have added a tweaked version of an exploit from last fall, a use after free vulnerability in Microsofts Internet Explorer browser. --------------------------------------------- http://threatpost.com/older-keen-team-use-after-free-ie-exploit-added-to-an… *** How to keep your Smart Home safe *** --------------------------------------------- The Internet of Things (IoT) devices can help you save time and hassle and improve your quality of life. As an example, you can check the contents of your fridge and turn on the oven while at the grocery store thus saving money, uncertainty, and .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002792.html *** Symantec NetBackup OpsCenter Server Javascript Injection RCE *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** SSH-Client Putty: Fast vergessene Sicherheitslücke geschlossen *** --------------------------------------------- Der Schöpfer von Putty entschuldigt sich dafür, eine Sicherheitslücke erst nach eineinhalb Jahren vollständig geschlossen zu haben und ergänzt die neue Version um weitere Bugfixes und zwei neue Funktionen. --------------------------------------------- http://heise.de/-2563230 *** SA-CONTRIB-2015-050 - Services Basic Authentication - Access bypass *** --------------------------------------------- https://www.drupal.org/node/2428851 *** New gTLD Portals Taken Offline by ICANN Due to Security Flaw *** --------------------------------------------- The Internet Corporation for Assigned Names and Numbers (ICANN) shut down two new generic top-level domain (gTLD) portals on February 27 after learning of a vulnerability that could have been exploited to view users' data. --------------------------------------------- http://www.securityweek.com/new-gtld-portals-taken-offline-icann-due-securi… *** Cyber criminals target call center operators in Apple Pay fraud schema *** --------------------------------------------- Cybercriminals are targeting call centers operators in Apple Pay fraud to circumvent the checks implemented by Apple, banks and card issuers. The security expert Cherian Abraham revealed a spike in the fraud on Apple's .. --------------------------------------------- http://securityaffairs.co/wordpress/34359/cyber-crime/apple-pay-fraud.html *** Captcha <= 4.0.6 - Captcha Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7822 *** Financial Trojans in 2014: Takedowns contributed to 53 percent drop in infections, but threat is still prevalent *** --------------------------------------------- While the number of financial Trojan detections decreased in 2014, the threat was still .. --------------------------------------------- http://www.symantec.com/connect/blogs/financial-trojans-2014-takedowns-cont… *** phpMoAdmin Zero-day Vulnerability Puts Websites Using MongoDB at Risk *** --------------------------------------------- About two weeks back, over 40,000 organizations running MongoDB were found unprotected and vulnerable to hackers. Now, once again the users of MongoDB database are at risk because of a critical zero-day vulnerability making .. --------------------------------------------- http://thehackernews.com/2015/03/phpMoAdmin-mongoDB-exploit.html *** Ted Unangst: OpenBSD will Browser sicherer machen *** --------------------------------------------- Mindestens ein Webbrowser soll durch die Umsetzung einer Speicherrichtlinie aus OpenBSD abgesichert werden. Dafür bezahlt die Stiftung des Betriebssystems einen Entwickler mit Erfahrung bei Libressl. --------------------------------------------- http://www.golem.de/news/ted-unangst-openbsd-will-browser-sicherer-machen-1… *** Thanks for the Memories: Identifying Malware from a Memory Capture *** --------------------------------------------- Weve all seen attackers try and disguise their running malware as something legitimate. They might use a file name of a legitimate Windows file or even inject code into a legitimate process thats already running. Regardless of how its done, that code has to run, which means it has to be in memory. Somewhere. --------------------------------------------- http://www.contextis.com/resources/blog/thanks-memories-identifying-malware… *** LogPOS - New Point of Sale Malware Using Mailslots *** --------------------------------------------- There has been an explosion in POS malware in the last year. At Morphick, Jeremy Humble and I found 2 undiscovered families in 2014 and we just found our first new family of 2015. This new malware which were calling .. --------------------------------------------- http://morphick.com/blog/2015/2/27/mailslot-pos *** Change to Lollipop Encryption Policy May Not Have Much Effect, Experts Say *** --------------------------------------------- Google has made a subtle, but important, shift in the requirements for Android handset makers, saying now that OEMs manufacturing phones that will run Lollipop do not have to enable disk encryption by default. This is a major change from the .. --------------------------------------------- http://threatpost.com/change-to-lollipop-encryption-policy-may-not-have-muc… *** Cisco Network Analysis Module Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 2-03-2015
by Daily end-of-shift report 02 Mar '15

02 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-02-2015 18:00 − Montag 02-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Abusing Blu-ray Players Pt. 1 - Sandbox Escapes *** --------------------------------------------- tl;drIn today's (28 February) closing keynote talk at the Abertay Ethical Hacking Society's Secuir-Tay conference I discussed how it was po ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/abusing-blu-ray-players-pt-1-sandb… *** dnstest - Monitor Your DNS for Hijacking *** --------------------------------------------- In light of the latest round of attacks against and/or hijacking of DNS, it occurred to me that most people really don't know what to do about it. More importantly, many companies don't even notice they've been attacked until a customer complains. Especially for smaller companies who may not have as many customers, or only... --------------------------------------------- https://blog.whitehatsec.com/dnstest-monitor-your-dns-for-hijacking/ *** Virtualization Incident Response *** --------------------------------------------- Virtualization is a game changer, this session looks at the new world of virtualization and the impact on Incident Response & Computer Forensics. Details include answers to several important questions: Is forensics more difficult or perhaps actually easier in the virtual realm? What do I image if the Data Store has PI from 200 different companies on it that are not subjects to the investigation? Where are virtual machine files stored? What files are of forensic value? What about all of... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/27/virtualization-incid… *** TorrentLocker campaign uses email authentication to tune the operations *** --------------------------------------------- The emails of a new TorrentLocker campaign use Domain-based Message Authentication, Reporting and Conformance (DMARC) to avoid detection and collect data. Cyber criminals are continuously improving the technique to spread malicious code and avoid detection systems. Recently security experts at Trend Micro noticed an improvement in the evasion techniques implemented by malware authors to spread the... --------------------------------------------- http://securityaffairs.co/wordpress/34268/cyber-crime/new-torrentlocker-cam… *** The Rmnet botnet is very much alive! *** --------------------------------------------- February 27, 2015 Despite the numerous reports of news agencies that Europol held massive operation to stop the Rmnet botnet, Doctor Webs analysts continue to monitor this botnets activity. According to the media reports, the staff of British polices office engaged in combating cyber crimes, together with experts from Germany, Italy and the Netherlands, has suppressed the activity of several major Rmnets command and control servers. According to the news reports, on February 24, 2015 command... --------------------------------------------- http://news.drweb.com/show/?i=9310&lng=en&c=9 *** The return of the dangerous Trojan for Mac OS X *** --------------------------------------------- February 27, 2015 Doctor Web analysts conducted a research of a new version of the backdoor Trojan for Mac OS X named Mac.BackDoor.OpinionSpy.3. This malicious program is intended to spy on Mac users: it can collect and transmit information about loaded web pages to the attackers, analyze the traffic passing through the computers network card, intercept the network packets sent by instant messaging programs and perform some other dangerous features. Mac.BackDoor.OpinionSpy programs have been... --------------------------------------------- http://news.drweb.com/show/?i=9309&lng=en&c=9 *** OWASP ProActive Controls: Part 1 *** --------------------------------------------- What is OWASP ProActive Controls? In one line, this project can be explained as "Secure Coding Practices by Developers for Developers". OWASP ProActive Controls is a document prepared for developers who are developing or are new to developing software/application with secure software development. This OWASP project lists 10 controls that can help a developer implement... --------------------------------------------- http://resources.infosecinstitute.com/owasp-proactive-controls-part-1/ *** Xen Hypervisor Flaws Force Amazon, Rackspace to Reboot Servers (SecurityWeek) *** --------------------------------------------- Rackspace, Amazon, Linode and likely other cloud providers will reboot some of their servers over the next week after they patch several vulnerabilities affecting the Xen open-source hypervisor. --------------------------------------------- http://www.securityweek.com/xen-hypervisor-flaws-force-amazon-rackspace-reb… *** Zero-Day-Lücken in Seagates Business NAS *** --------------------------------------------- Wer ein Business-NAS von Seagate nutzt, sollte sicherstellen, dass es nicht über das Internet erreichbar ist. Im Webinterface klaffen kritische Lücken, zu denen bereits ein passender Exploit kursiert. --------------------------------------------- http://heise.de/-2563240 *** Cisco ACE 4710 Application Control Engine and Application Networking Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- CVE-2015-0651 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- CVE-2015-0655 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletin: A page in IBM Curam Universal Access contains a risk of Sensitive Information Exposure(CVE-2014-4804) *** --------------------------------------------- 2015-02-27T18:10:56-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695931 *** Jetty 9.2.8 Shared Buffer Leakage *** --------------------------------------------- Topic: Jetty 9.2.8 Shared Buffer Leakage Risk: High Text:GDS LABS ALERT: CVE-2015-2080 JetLeak Vulnerability Remote Leakage Of Shared Buffers In Jetty Web Server SYNOPSIS == Go... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020151 *** Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution *** --------------------------------------------- Topic: Apache Standard Taglibs 1.2.1 XXE / Remote Command Execution Risk: High Text:CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags Severity: Important Vendor: The Apache Software Foundation ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020154 *** HPSBST03274 rev.1 - HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux, Remote Cross-site Scripting (XSS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP XP P9000 Command View Advanced Edition Software Online Help for Windows and Linux. The vulnerabilities could be exploited resulting in remote Cross-site scripting (XSS). --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IP Blacklist Cloud - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7816 *** WP-ViperGB 1.3.10 - XSS Weakness and CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7817

1 0

Tageszusammenfassung - Freitag 27-02-2015
by Daily end-of-shift report 27 Feb '15

27 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-02-2015 18:00 − Freitag 27-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** #JetLeak: Jetty-Webserver gibt Verbindungsdaten preis *** --------------------------------------------- Der Jetty-Server steckt unter anderem in Hadoop, Heroku, Eclipse und der Google AppEngine. Angreifer können eine jetzt entdeckte Lücke dazu nutzen, Daten aus den Verbindungen anderer Nutzer auszuspionieren. --------------------------------------------- http://heise.de/-2560894 *** Spam Uses Default Passwords to Hack Routers *** --------------------------------------------- In case you needed yet another reason to change the default username and password on your wired or wireless Internet router: Phishers are sending out links that, when clicked, quietly alter the settings on vulnerable routers to harvest online banking credentials and other sensitive data from victims. Sunnyvale, Calif. based security firm Proofpoint said it recently detected a four-week spam... --------------------------------------------- http://krebsonsecurity.com/2015/02/spam-uses-default-passwords-to-hack-rout… *** Adventures in Xen exploitation *** --------------------------------------------- tl;drThis post is about my experience trying to exploit the Xen SYSRET bug (CVE-2012-0217).This issue was patched in June 2012 and was dis ... --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/adventures-in-xen-exploitation/ *** Sicherheits-Tool PrivDog telefoniert nach Hause - unverschlüsselt *** --------------------------------------------- Das vermeintliche Sicherheits-Tool PrivDog steht erneut in der Kritik, denn es sendet alle besuchten URLs unverschlüsselt an den Hersteller. --------------------------------------------- http://heise.de/-2560926 *** Dridex Downloader Analysis *** --------------------------------------------- Introduction Yesterday I received in my company inbox an email with an attached .xlsm file named D92724446.xlsm coming from Clare588(a)78-83-77-53.spectrumnet.bg. Central and local AV engines did not find anything malicious, and a multiengine scan got 0/57 as result. I decided to investigate a little more in-depth in order to confirm that was a malicious file... --------------------------------------------- http://resources.infosecinstitute.com/dridex-downloader-analysis/ *** D-Link remote access vulnerabilities remain unpatched *** --------------------------------------------- D-Link routers have several unpatched vulnerabilities, the worst of which could allow an attacker to gain total control over a device, according to a systems engineer in Canada. Peter Adkins, who does security research in his free time, released details of the flaws on Thursday. Adkins said in a phone interview that he has been in intermittent contact with D-Link since Jan. 11 on the issues, but the company has not indicated when it might patch. --------------------------------------------- http://www.cio.com/article/2889994/dlink-remote-access-vulnerabilities-rema… *** Microsoft Malware Protection Center assists in disrupting Ramnit *** --------------------------------------------- Recent disruption of the Ramnit malware family was successful due to a multinational collaboration, led by Europol's European Cybercrime Center (EC3), in partnership with Financial Services and Information Sharing & Analysis Center (FS-ISAC), Symantec, AnubisNetworks, Microsoft's Digital Crimes Unit (DCU), and the Microsoft Malware Protection Center (MMPC). The MMPC has been closely monitoring Ramnit since its discovery in April 2010, as you can see by reading: Ramnit - The... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/25/microsoft-malware-protec… *** The Evil CVE: CVE-666-666 - "Report Not Read" *** --------------------------------------------- I had an interesting discussion with a friend this morning. He explained that, when he is conducting a pentest, he does not hesitate to add sometimes in his report a specific finding regarding the lack of attention given to the previous reports. If some companies are motivated by good intentions and ask for regular pentests against their infrastructure or a specific application, what if they even don't... --------------------------------------------- http://blog.rootshell.be/2015/02/26/the-evil-cve-cve-666-666-report-not-rea… *** Weekly Metasploit Wrapup *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/26/weekly-me… *** Threatpost News Wrap, February 27, 2015 *** --------------------------------------------- Mike Mimoso and Dennis Fisher discuss the news of the last week, including the Superfish fiasco, the Gemalto SIM hack controversy and the continuing NSA drama. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-february-27-2015/111312 *** VMSA-2015-0001.1 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** Security Advisory: BIG-IP ASM cross-site scripting (XSS) vulnerability CVE-2015-1050 *** --------------------------------------------- (SOL16081) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/000/sol16081.htm… *** Security Advisory: OpenSSL vulnerability CVE-2014-0160 *** --------------------------------------------- (SOL15159) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/100/sol15159.htm… *** Security Advisory: XSS vulnerability in echo.jsp CVE-2014-4023 *** --------------------------------------------- (SOL15532) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15532.htm… *** Cisco Security Notices *** --------------------------------------------- *** Vulnerability in IPv6 Neighbor Discovery in Cisco IOS and IOS-XE Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Vulnerability in Authentication Proxy Feature in Cisco IOS Software *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… *** Cisco Common Services Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco ACE 4710 Application Control Engine and Application Neworking Manager Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- *** DSA-3176 request-tracker4 - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in Request Tracker, anextensible trouble-ticket tracking system. The Common Vulnerabilitiesand Exposures project identifies the following problems: --------------------------------------------- https://www.debian.org/security/2015/dsa-3176 *** Network Vision IntraVue Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability in Network Vision's IntraVue software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01 *** [2015-02-27] Multiple vulnerabilities in Loxone Smart Home *** --------------------------------------------- Multiple design and implementation flaws within Loxone Smart Home enable an attacker to control arbitrary devices connected to the system, execute JavaScript code in the users browser, steal the users credentials and cause a denial of service. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3 CMS 6.2.10 released *** --------------------------------------------- The TYPO3 Community announces the version 6.2.10 LTS of the TYPO3 Enterprise Content Management System. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6210-released/ *** IBM Security Bulletin: Rational Integration Tester component in Rational Test Workbench affected by Netty vulnerability (CVE-2014-3488) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695042 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Castor Library vulnerablity (CVE-2014-3004) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21695037 --------------------------------------------- *** Huge-IT Slider - SQL Injection *** https://wpvulndb.com/vulnerabilities/7811 *** CrossSlide jQuery Plugin <= 2.0.5 - Stored XSS & CSRF *** https://wpvulndb.com/vulnerabilities/7812 *** WPBook - CSRF *** https://wpvulndb.com/vulnerabilities/7813 *** WPBook <= 2.7 - Cross-Site Request Forgery (CSRF) *** https://wpvulndb.com/vulnerabilities/7813 *** WP Media Cleaner <= 2.2.6 - Cross-Site Scripting (XSS) *** https://wpvulndb.com/vulnerabilities/7814 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 26-02-2015
by Daily end-of-shift report 26 Feb '15

26 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-02-2015 18:00 − Donnerstag 26-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** 2014 Spam Landscape: UPATRE Trojan Still Top Malware Attached to Spam *** --------------------------------------------- The malware UPATRE was first spotted in August 2013 following the demise of the Blackhole Exploit kit. It was since known as one of the top malware seen attached to spammed messages and continues to be so all throughout 2014 with particularly high numbers seen in the fourth quarter of the year. We have released... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/jUSb_mMOQCc/ *** Webnic Registrar Blamed for Hijack of Lenovo, Google Domains *** --------------------------------------------- Two days ago, attackers allegedly associated with the fame-seeking group Lizard Squad briefly hijacked Googles Vietnam domain (google.com.vn). On Wednesday, Lenovo.com was similarly attacked. Sources now tell KrebsOnSecurity that both hijacks were possible because the attackers seized control over Webnic.cc, the Malaysian registrar that serves both domains and 600,000 others. --------------------------------------------- http://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-le… *** Why Websites Get Hacked *** --------------------------------------------- I spend a good amount of time engaging with website owners across a broad spectrum of businesses. Interestingly enough, unless I'm talking large enterprise, there is a common question that often comes up: Why would anyone ever hack my website? Depending on who you are, the answer to this can vary. Nonetheless, it often revolves... --------------------------------------------- http://blog.sucuri.net/2015/02/why-websites-get-hacked.html *** 5 New Vulnerabilities Uncovered In SAP *** --------------------------------------------- ERP security researchers at Onapsis have discovered five new vulnerabilities in SAP BusinessObjects and SAP HANA, three of them high-risk. One in particular gives attackers the power to overwrite data within mission-critical systems. --------------------------------------------- http://www.darkreading.com/application-security/5-new-vulnerabilities-uncov… *** Electronic Arts Origin Client 9.5.5 Multiple Privilege Escalation Vulnerabilities *** --------------------------------------------- Title: Electronic Arts Origin Client 9.5.5 Multiple Privilege | Escalation Vulnerabilities | Advisory ID: ZSL-2015-5231 | Type: Local | Impact: Privilege Escalation | Risk: (3/5) | Release Date: 26.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5231.php *** Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation *** --------------------------------------------- Title: Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege | Escalation | Advisory ID: ZSL-2015-5230 | Type: Local | Impact: Privilege Escalation | Risk: (2/5) | Release Date: 25.02.2015 --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5230.php *** HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04580241 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04580241 Version: 1 HPSBUX03273 SSRT101951 rev.1 - HP-UX running Java6, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites *** --------------------------------------------- Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04556853 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04556853 Version: 2 HPSBUX03244 SSRT101885 rev.2 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilites --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM Sterling Connect:Direct File Agent (CVE-2014-3065, CVE-2014-6468) *** --------------------------------------------- 2015-02-26T11:42:30-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21696580 *** Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution (CVE-2014-3566, CVE-2014-6558) *** --------------------------------------------- 2015-02-25T12:49:31-05:00 --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697112 *** Security Advisory-Multiple Vulnerabilities on Huawei Tecal Server Products *** --------------------------------------------- Feb 26, 2015 09:44 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory-Glibc Buffer Overflow Vulnerability *** --------------------------------------------- Feb 26, 2015 16:35 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** EasyCart 1.1.30 - 3.0.20 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7808 *** WP All Import Pro <= 4.1.0 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7810 *** WP All Import <= 3.2.3 - RCE *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7809 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** SA-CONTRIB-2015-062 - Watchdog Aggregator - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437993 *** SA-CONTRIB-2015-061 - Ubercart Webform Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437991 *** SA-CONTRIB-2015-060 - Custom Sitemap - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437985 *** SA-CONTRIB-2015-059 - Spider Video Player - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437981 *** SA-CONTRIB-2015-058 - Spider Catalog - Cross Site Request Forgery (CSRF) - Unsupported *** https://www.drupal.org/node/2437977 *** SA-CONTRIB-2015-057 - Spider Contacts - Multiple vulnerabilities - Unsupported *** https://www.drupal.org/node/2437973 *** SA-CONTRIB-2015-056 - inLinks Integration - Cross Site Scripting (XSS) - Unsupported *** https://www.drupal.org/node/2437969 *** SA-CONTRIB-2015-055 - Services single sign-on server helper - Open Redirect - Unsupported *** https://www.drupal.org/node/2437965 *** SA-CONTRIB-2015-054 - SMS Framework - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437943 *** SA-CONTRIB-2015-053 - Entity API - Cross Site Scripting (XSS) *** https://www.drupal.org/node/2437905 *** SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF) *** https://www.drupal.org/node/2424409 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 25-02-2015
by Daily end-of-shift report 25 Feb '15

25 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-02-2015 18:00 − Mittwoch 25-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Security Advisory - WP-Slimstat 3.9.5 and lower *** --------------------------------------------- Advisory for: WP-Slimstat Security Risk: Very high Exploitation level: Remote DREAD Score: 8/10 Vulnerability: Weak Cryptographic keys leading to SQL injections Patched Version: 3.9.6 WP-Slimstat's users should update as soon as possible! During a routine audit for our WAF, we discovered a security bug that an attacker could, by breaking the plugin's weak "secret" key, use to perform a SQL... --------------------------------------------- http://blog.sucuri.net/2015/02/security-advisory-wp-slimstat-3-9-5-and-lowe… *** Finding Unknown Malware *** --------------------------------------------- If you have ever been given the mission to "Find Evil" on a compromised system, you understand the enormity of that tasking. In this technical presentation, Alissa will introduce sound methodology for identifying malware, using strategies based on "Knowing Normal", "Data Reduction" and "Least Frequency of Occurrence" in order to identify malicious binaries and common methods of persistence. The skills and tools presented here will aid in efficient... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/24/finding-unknown-malw… *** A new strain of banking trojan VAWTRAK uses Macros and abuses Windows PowerShell *** --------------------------------------------- Security experts at TrendMicro observed significant improvements in VAWTRAK banking trojan which couples use malicious macros and Windows PowerShell. Early 2015 the Microsoft Malware Protection Center (MMPC) issued an alert about a surge in the infections of malware using macros to spread their malicious code. The experts MMPC have observed a significant increase in enable-macros ... --------------------------------------------- http://securityaffairs.co/wordpress/34107/cyber-crime/vawtrak-uses-macros-w… *** Scanning Internet-exposed Modbus devices for fun & fun *** --------------------------------------------- [...] here is a scan I have run against the whole IPv4 address space, looking for Internet-exposed Modbus services. --------------------------------------------- http://pierre.droids-corp.org/blog/html/2015/02/24/scanning_internet_expose… *** "Surreptitiously Weakening Cryptographic Systems" *** --------------------------------------------- New paper: "Surreptitiously Weakening Cryptographic Systems," by Bruce Schneier, Matthew Fredrikson, Tadayoshi Kohno, and Thomas Ristenpart. Abstract: Revelations over the past couple of years highlight the importance of understanding malicious and surreptitious weakening of cryptographic systems. We provide an overview of this domain, using a number of historical examples to drive development of a weaknesses taxonomy. This allows comparing different... --------------------------------------------- https://www.schneier.com/blog/archives/2015/02/surreptitiously_1.html *** Mozilla Thunderbird Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031792 *** Mozilla Firefox Multiple Flaws Let Remote Users Deny Service, Execute Arbitrary Code, Bypass Security Restrictions, and Obtain Potentially Sensitive Information and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1031791 *** FreeBSD IGMP Integer Overflow Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1031798 *** Splunk Enterprise 6.2.2 addresses two vulnerabilities *** --------------------------------------------- Description Splunk Enterprise version 6.2.2 addresses two vulnerabilities Multiple vulnerabilities in OpenSSL prior to 1.0.1k (SPL-95203, CVE-2014-3572, CVE-2015-0204) Splunk Web crashes due to specific HTTP requests (SPL-93754) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on our Splunk Product Security Portal. Use SPL numbers when referencing issues in... --------------------------------------------- http://www.splunk.com/view/SP-CAAANV8 *** Software Toolbox Top Server Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Software Toolbox Top Server application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-01 *** Kepware Resource Exhaustion Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a resource exhaustion vulnerability in the Kepware Technologies DNP Master Driver for the KEPServerEX Communications Platform. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-02 *** Schneider Electric Invensys Positioner Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Device Type Manager software for Schneider Electric's Invensys SRD Control Valve Positioner product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-055-03 *** HPSBMU03260 rev.1 - HP System Management Homepage running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP System Management Homepage running OpenSSL on Linux and Windows. This vulnerability is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** IBM Security Bulletins *** --------------------------------------------- Rational Reporting for Development Intelligence - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697194 AppScan Enterprise can be affected by multiple vulnerabilities (CVE-2014-6136, CVE-2014-8918) http://www.ibm.com/support/docview.wss?uid=swg21697249 Rational Insight - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697034 Rational Reporting for Development Intelligence - Jazz Reporting Service report results can be viewed without user log-in (CVE-2014-6115) http://www.ibm.com/support/docview.wss?uid=swg21697035 Tivoli Storage Manager client encryption key password vulnerability (CVE-2014-4818) http://www.ibm.com/support/docview.wss?uid=swg21697022 Tivoli Common Reporting(TCR) iFixes for Security Vulnerability http://www.ibm.com/support/docview.wss?uid=swg21695800 Multiple vulnerabilities in IBM Java SDK affects multiple IBM Rational products based on IBM Jazz technology (CVE-2014-3566, CVE-2014-6457, CVE-2014-6468) http://www.ibm.com/support/docview.wss?uid=swg21697112 Vulnerabilities in OpenSSL affect IBM Systems Director (CVE-2014-3513 and CVE-2014-3567) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097159 Rational Insight - OpenSSL support for SSL 3.0 Fallback protection + 3 other CVEs http://www.ibm.com/support/docview.wss?uid=swg21697193 --------------------------------------------- *** Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Dienstag 24-02-2015
by Daily end-of-shift report 24 Feb '15

24 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-02-2015 18:00 − Dienstag 24-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Open Source Threat Intelligence - Developing a Threat intelligence program using open source tools and public sources *** --------------------------------------------- Overview of building a threat intelligence program outlining the processes, tasks and activities associated with the development of a functional intelligence program. Developing an Open Source Threat Intelligence Program from Open Source Tools and Public Sources is aimed at bringing business value and technical mitigation efforts, while dispelling common myths like "We're too small", "Who would attack us, we make widgets?" and "We have nothing anyone would... --------------------------------------------- http://blog.malwareresearch.institute/video/2015/02/23/open-source-threat-i… *** RIG Exploit Kit - Diving Deeper into the Infrastructure *** --------------------------------------------- Following our previous blog post about the leaking of the RIG exploit kits source code, we dug deeper into the architecture that facilitates the massive infections using RIG. The screen shot below diagrams RIGs infrastructure. RIG Exploit Kit Infrastructure Most... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%e2%80%… *** Insider threats continue to dominate *** --------------------------------------------- Ordinary employees, privileged users and the supply chain - such as contractors and third party service providers - are all conduits for a traditional insider threat, according to Vormetric. But the s... --------------------------------------------- http://www.net-security.org/secworld.php?id=17993 *** Overview of handheld malware for 2014 *** --------------------------------------------- February 24, 2015 Russian anti-virus company Doctor Web presents its 2014 overview of malware for handheld devices. The last year proved to be rather turbulent and rich in terms of information security events. We witnessed the emergence of a variety of new malicious applications for Android. In particular, the number of banking Trojans whose numerous modifications attacked devices in many countries increased significantly. Furthermore, 2014 saw the discovery of the first ransomware programs as... --------------------------------------------- http://news.drweb.com/show/?i=9222&lng=en&c=9 *** Bypassing Windows Lock Screen via Flash Screensaver *** --------------------------------------------- bypass windows lock screen We have recently discovered an easy method to bypass the Windows Lock screen when a flash screensaver is running. The method allows an attacker to gain unauthorized access to a user’s Windows session if he has physical access to a locked machine. --------------------------------------------- http://securitycafe.ro/2015/02/23/bypassing-windows-lock-screen-via-flash-s… *** Windows Exploit Mitigation Technology - Part 2 *** --------------------------------------------- In Part 1, we explained GS cookies and Safe SEH. If you haven't read that part, it is highly recommended to read it first. The Enhanced Mitigation Experience Toolkit, or EMET, is rudimentally a shield or a shell that runs over Windows applications and protects them, regardless of how those applications have authentically been coded... --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology… *** Announcing TYPO3 CMS 7.1 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS 7.1, the second version within the CMS 7 development cycle. --------------------------------------------- http://typo3.org/news/article/typo3-cms-71-released-home-improvement/ *** DSA-3171 samba - security update *** --------------------------------------------- Richard van Eeden of Microsoft Vulnerability Research discovered thatSamba, a SMB/CIFS file, print, and login server for Unix, contains aflaw in the netlogon server code which allows remote code execution withroot privileges from an unauthenticated connection. --------------------------------------------- https://www.debian.org/security/2015/dsa-3171 *** DSA-3170 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a denial of service, information leaks or privilegeescalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3170

1 0

Tageszusammenfassung - Montag 23-02-2015
by Daily end-of-shift report 23 Feb '15

23 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-02-2015 18:00 − Montag 23-02-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Wichtige Sicherheitsupdates für PHP *** --------------------------------------------- Neue PHP-Versionen schließen unter anderem eine kritische Sicherheitslücke, zu der bereits ein Exploit kursiert. Admins sollten daher keine Zeit verlieren. --------------------------------------------- http://heise.de/-2557586 *** Data Traffic & Network Security *** --------------------------------------------- Introduction Last year - dubbed "the Year of the Hack" - saw numerous major cyber attacks against prominent corporations, including JP Morgan bank and Sony Pictures Entertainment. And after Target in 2013, another retailer, Home Depot, suffered a data breach with more than 56 million credit cards stolen. The consequences of these incidents can be... --------------------------------------------- http://resources.infosecinstitute.com/data-traffic-network-security/ *** Flaw makes Cisco routing hardware vulnerable to DoS attacks *** --------------------------------------------- A serious vulnerability affecting the software of some of Ciscos routing hardware systems for telecommunications and Internet service providers could be exploited to mount DoS attacks, the company ha... --------------------------------------------- http://www.net-security.org/secworld.php?id=17990 *** Samba vulnerability (CVE-2015-0240) *** --------------------------------------------- CVE-2015-0240 is a security flaw in the smbd file server daemon. It can be exploited by a malicious Samba client, by sending specially-crafted packets to the Samba server. No authenticated is required to exploit this flaw. It can result in remotely controlled execution of arbitrary code as root. --------------------------------------------- https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-024… *** Superfish not the only app using Komodias SSL-busting code *** --------------------------------------------- As Lenovo backtracked on its initial position that the Superfish adware pre-installed on some of its notebooks is not a security danger, and released a security advisory about the "vulnerability" that... --------------------------------------------- http://www.net-security.org/secworld.php?id=17991 *** Privdog: Comodo-Adware hebelt HTTPS-Sicherheit aus *** --------------------------------------------- Die Adware Privdog hebelt ähnlich wie Superfish den Schutz von HTTPS komplett aus. Pikant daran: Privdog wurde von Comodo verbreitet, einer der größten Zertifizierungsstellen für TLS-Zertifikate. --------------------------------------------- http://www.golem.de/news/privdog-comodo-adware-hebelt-https-sicherheit-aus-… *** FireEye shares details on Masque Attack II affecting iOS devices *** --------------------------------------------- Masque Attack II entails bypassing an iOS prompt for trust and app URL scheme hijacking, FireEye said. --------------------------------------------- http://www.scmagazine.com/fireeye-shares-details-on-masque-attack-ii-affect… *** Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability *** --------------------------------------------- CVE-2015-0631 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** Cisco AsyncOS Software HTTP Redirect Vulnerability *** --------------------------------------------- CVE-2015-0624 --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** IBM Security Bulletins *** --------------------------------------------- Tivoli Storage Manager Stack-based Buffer Overflow Elevation of Privilege: CVE-2014-6184 http://www.ibm.com/support/docview.wss?uid=swg21695878 Vulnerability in SSLv3 affects Tivoli Storage Manager for Virtual Environments 7.1 and FlashCopy Manager for VMware 4.1 (CVE-2014-3566) http://www.ibm.com/support/docview.wss?uid=swg21690828 OpenSSL vulnerabilities announced August 6th 2014 affect Juniper EX Series Network Switches sold by IBM for use in IBM Products (9 CVEs) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097073 Vulnerabilities in OpenSSL. Juniper EX Series Network Switches sold by IBM for use in IBM Products. (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097126 --------------------------------------------- *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-050-01 *** Vibe 3.4 - Hot Patch 1 *** --------------------------------------------- Abstract: This patch addresses the Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability and also provides a number of general bug fixes for Novell Vibe 3.4.Document ID: 5198730Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:NV-Vibe60DayEval-001.xml (719 bytes)NV-Vibe10Usr-001.xml (730 bytes)novell-vibe-3.4.0-windows.zip (185.69 MB)readme-Vibe-3.4-HP1.txt (4.13 kB)novell-vibe-3.4.0-linux.tar (187.8 MB)Products:Vibe 3.4Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=EaNhJs2Offs~ *** Bugtraq: iTunes 12.1.1 for Windows: still outdated and VULNERABLE 3rd party libraries, still UNQUOTED and VULNERABLE pathnames C:\Program Files\... *** --------------------------------------------- http://www.securityfocus.com/archive/1/534728 *** MyBB 1.8.3 Multiple stored XSS-vulnerabilities *** --------------------------------------------- Topic: MyBB 1.8.3 Multiple stored XSS-vulnerabilities Risk: Low Text: The researchers adamziaja, Devilshakerz, DingjieYang and me found multiple stored XSS-vulnerabilities in the administrative ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015020109 *** DSA-3169 eglibc - security update *** --------------------------------------------- Several vulnerabilities have been fixed in eglibc, Debians version ofthe GNU C library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3169 *** DSA-3164 typo3-src - security update *** --------------------------------------------- Pierrick Caillon discovered that the authentication could be bypassed inthe Typo 3 content management system. Please refer to the upstreamadvisory for additional information: --------------------------------------------- https://www.debian.org/security/2015/dsa-3164 *** Security Advisory: Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. Fixed versions: Versions 1.3.8 and 1.4.3 disable sandboxing for Groovy by default. As a consequence, dynamic script execution is disabled for Groovy. CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://securityvulns.com/docs31742.html *** HPSBUX03240 SSRT101872 rev.1 - HP-UX Running NTP, Remote Execution of Code, Denial of Service (DoS), or Other Vulnerabilties *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_…

1 0

Tageszusammenfassung - Freitag 20-02-2015
by Daily end-of-shift report 20 Feb '15

20 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-02-2015 18:00 − Freitag 20-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Gemalto hack - lessons learned *** --------------------------------------------- In der Nacht auf FR, 20.2.2015 ist die nächste Bombe aus den Snowden leaks eingeschlagen: der niederländische Chipkartenhersteller Gemalto ist zumindest im Zeitraum Jänner 2010 bis März 2010 von GCHQ und NSA gehackt worden. Hierbei sind angeblich .. --------------------------------------------- https://www.cert.at/services/blog/20150220150747-1386.html *** Superfish - Eine Zusammenfassung *** --------------------------------------------- Die meisten im Handel erhältlichen Notebooks werden mit einer vorinstallierten Version von Windows in Kombination mit weiterer "nützlicher" Software - gemeinhin als "Bloatware" bezeichnet - ausgeliefert. Für die meisten Leute ist diese auf Notebooks vorinstallierte Bloatware .. --------------------------------------------- http://www.cert.at/services/blog/20150220162905-1395.html *** The Great SIM Heist - How Spies Stole the Keys to the Encryption Castle *** --------------------------------------------- American and british spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden. --------------------------------------------- https://firstlook.org/theintercept/2015/02/19/great-sim-heist/ *** Hackers now popping Cisco VPN portals *** --------------------------------------------- Crackers are popping customised Cisco virtual private networks, stealing credentials and spraying malware using a flaw reported by Aussie hacker Alec Stuart-Muirk, the company warns. Organisations running the Cisco Clientless SSL .. --------------------------------------------- http://www.theregister.co.uk/2015/02/20/hackers_popping_cisco_vpn_portals/ *** Suit Up and Protect WordPress *** --------------------------------------------- In the final part of the series, I am going to show a few practical tips and tricks for protecting your WordPress blog. --------------------------------------------- https://blog.gaborszathmari.me/2015/02/19/suit-up-and-protect-wordpress/ *** Evil CSS injection bug warning: Dont let hackers cross paths with your website (The Register) *** --------------------------------------------- http://www.theregister.co.uk/2015/02/20/prssi_web_vuln/ *** Filme, Musik, Logindaten: 190.000 Festplatten sind ungesichert im Netz *** --------------------------------------------- Junger Informatiker grast das Netz mit eigenem Tool ab und wundert sich über "Fahrlässigkeit" --------------------------------------------- http://derstandard.at/2000011951714 *** 'TNT' gang has released a new hardware TDoS tool in the criminal underground *** --------------------------------------------- Telephone DDoS attacks are on the rise, the criminal group known as 'TNT' gang has released a new hardware tool in the underground ecosystem. The IntelCrawler cyber threat intelligence company has discovered a new advanced tool, dubbed .. --------------------------------------------- http://securityaffairs.co/wordpress/33867/cyber-crime/tnt-gang-released-tdo… *** IETF verbietet RC4-Verschlüsselung in TLS *** --------------------------------------------- Das Gremium für Internet-Standards will den Einsatz des als geknackt betrachteten Verschlüsselungsverfahrens RC4 offenbar den Garaus machen. --------------------------------------------- http://heise.de/-2556520 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Donnerstag 19-02-2015
by Daily end-of-shift report 19 Feb '15

19 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 18-02-2015 18:00 − Donnerstag 19-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** SA-CONTRIB-2015-052 - RESTful Web Services - Access Bypass *** --------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The RESTWS Basic Auth submodule doesn't sufficiently disable page caching for ... --------------------------------------------- https://www.drupal.org/node/2428863 *** SA-CONTRIB-2015-048 - Avatar Uploader - Arbitrary PHP code execution *** --------------------------------------------- Avatar Uploader module provides an alternative way to upload user pictures. The module doesn't sufficiently enforce file extensions when an avatar is uploaded, allowing users to bypass Drupal's normal file upload protections to .. --------------------------------------------- https://www.drupal.org/node/2428793 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** BIND: A Problem with Trust Anchor Management Can Cause named to Crash *** --------------------------------------------- BIND servers which are configured to perform DNSSEC validation and which are using managed-keys (which occurs implicitly when using "dnssec-validation auto;" or "dnssec-lookaside auto;") may terminate with an assertion failure when . --------------------------------------------- https://kb.isc.org/article/AA-01235/0 *** OWASP AppSensor - implement real-time intrusion detection within in your software *** --------------------------------------------- Free, open source, DevOps friendly and cloud compatible AppSensor provides real-time application-layer attack detection and response. --------------------------------------------- https://www.owasp.org/images/8/8e/Appsensor_intro_for_developers.pdf *** Lenovo-Laptops durch Superfish-Adware angreifbar *** --------------------------------------------- Eine Adware namens Superfish wird offenbar schon seit mehreren Monaten auf Laptops von Lenovo ausgeliefert. Diese fügt Werbung in fremde Webseiten ein und installiert dafür ein Root-Zertifikat - eine riesige Sicherheitslücke. --------------------------------------------- http://www.golem.de/news/adware-lenovo-laptops-durch-superfish-adware-angre… *** Macros? Really?! *** --------------------------------------------- .. macro-based malware is now making a "successful" comeback. Last week, we saw a significant Dridex malware run that was using macros in Excel files (.XLSM), and earlier this week, the crooks behind the banking spyware "Vawtraq" started to spam the usual "Fedex Package" and "Tax Refund" emails, .. --------------------------------------------- https://isc.sans.edu/diary/Macros%3F+Really%3F!/19349 *** Automating Removal of Java Obfuscation *** --------------------------------------------- In this post we detail a method to improve analysis of Java code for a particular obfuscator, we document the process that was followed and demonstrate the results of automating our method. Obscurity will not stop an attacker and once the method is known, methodology can be developed to automate the process. --------------------------------------------- http://www.contextis.com/resources/blog/automating-removal-java-obfuscation/ *** IETF: RC4 in TLS offiziell nicht mehr erlaubt *** --------------------------------------------- Die RC4-Verschlüsselung darf laut dem neuen RFC 7465 nicht mehr für TLS-Verbindungen genutzt werden. Der Algorithmus gilt schon lange als problematisch, Details über neue Angriffe sollen in Kürze veröffentlicht werden. --------------------------------------------- http://www.golem.de/news/ietf-rc4-in-tls-offiziell-nicht-mehr-erlaubt-1502-… *** Cross-Site Tracing (XST): The misunderstood vulnerability *** --------------------------------------------- Alas, the 'XS' in XST evokes similarity to XSS (Cross-Site Scripting) which has the consequence of leading people to mistake XST as a method for injecting JavaScript. (Thankfully, character encoding attacks have avoided the term Cross-Site Unicode, XSU.) Although XST attacks rely on browser scripting .. --------------------------------------------- http://deadliestwebattacks.com/2010/05/18/cross-site-tracing-xst-the-misund… *** Duplicator 0.5.8 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7799 *** Technology doping: Competitive advantage by abusing security flaws in smart sports equipment *** --------------------------------------------- The term 'Technology doping' has recently been used [1] to mean the practice of gaining a competitive advantage through using sports equipment e.g. The LZR Racer bodysuit [2] that was used by many of the swimmers during the Beijing Olympics, resulting in world records being broken. Shortly afterwards, FINA (Federation Internationale de Natation), the international .. --------------------------------------------- https://www.nccgroup.com/en/blog/2015/02/technology-doping-competitive-adva… *** l+f: Geklonte SSH-Schlüssel sind böse *** --------------------------------------------- Tausende von Geräten im Netz verwenden ein und den selben SSH-Schlüssel. Das birgt Gefahren. --------------------------------------------- http://heise.de/-2555229 *** Erpressungs-Software im Aufstieg: Wenn Daten zur Geisel werden *** --------------------------------------------- Immer mehr Kriminelle setzen auf "Ransomware", um Lösegeld zu erpressen. Ihr nächstes Ziel: Mobiltelefone. --------------------------------------------- http://derstandard.at/2000011389615

1 0

Tageszusammenfassung - Mittwoch 18-02-2015
by Daily end-of-shift report 18 Feb '15

18 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-02-2015 18:00 − Mittwoch 18-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Sicher surfen trotz Android 4.3 *** --------------------------------------------- Der WebView-Bug von Android 4.3 könnte sich stärker auswirken als bisher bekannt. Auch wenn die Angriffsszenarien bisher nur theoretische Proof-of-Concepts sind, sollten Sie ein paar Vorsichtsmaßnahmen ergreifen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Sicher-surfen-trotz-Android-4-3-2552… *** Bug des Tages: Der FreeBSD-Zufallszahlengenerator war ... *** --------------------------------------------- Bug des Tages: Der FreeBSD-Zufallszahlengenerator war seit vier Monaten kaputt. Das betrifft glaube ich nur FreeBSD-current. Wer in der Zeit PGP- oder SSH- oder sonstige Krypto-Keys generiert hat, sollte die dann wohl auch mal zurückrufen und neue machen. --------------------------------------------- http://blog.fefe.de/?ts=aa1d7111 *** Fuzzing for MS15-010 *** --------------------------------------------- Intro This past Patch Tuesday Microsoft released MS15-010: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution. This patch addressed multiple privately reported vulnerabilities in .. --------------------------------------------- http://blog.beyondtrust.com/fuzzing-for-ms15-010 *** Siemens SIMATIC STEP 7 TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC STEP 7 TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-01 *** Siemens SIMATIC WinCC TIA Portal Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for authentication vulnerabilities in the Siemens SIMATIC WinCC TIA Portal application. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-02 *** Yokogawa HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library utilized in Yokogawa's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-048-03 *** D-Link DSL-2640B DNS hijacking *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/100955 *** Duplicate SSH Keys Everywhere *** --------------------------------------------- Back in December when I revamped the SSH banner and started collecting the fingerprint I noticed an odd behavior. It turns out that a few SSH keys are used a lot more than once. --------------------------------------------- https://blog.shodan.io/duplicate-ssh-keys-everywhere/ *** Beware of fake Facebook "Copyright Violations" warnings *** --------------------------------------------- The latest Facebook-themed phishing messages doing rounds are trying to trick users into believing they are "making copyright violations" on their Facebook page. "Please review your .. --------------------------------------------- http://www.net-security.org/secworld.php *** Microsoft wirbt mit Sicherheit nach ISO 27018 *** --------------------------------------------- Microsofts Cloud-Dienste Office 365 und Dynamics CRM Online sind von dem British Standards Institute (BSI) nach den Sicherheitsstandards zertifiziert worden, wie sie in ISO/IEC 27018 definiert sind. Diese Standards sollen für Microsoft weltweit gelten. Azure hat bereits eine solche .. --------------------------------------------- http://www.golem.de/news/cloud-dienste-microsoft-wirbt-mit-sicherheit-nach-… *** Kippo Modifications - New Features *** --------------------------------------------- Since summer last year I've been working on extensions and contributions to the well known Kippo honeypot developed by desaster. ... New Features: SFTP support, Exec support, SSH tunnelling (direct-tcpip) support, SSH Fingerprint .. --------------------------------------------- http://www.micheloosterhof.com/kippo-modifications/ *** ENISA's recommendations for Certifying ICS/SCADA professionals *** --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa2019s-recommendations-… *** Die Geister, die ich rief: Netgear-Router über Genie-App angreifbar *** --------------------------------------------- Eine Reihe von Netgear-Routerm plaudern durch die Schnittstelle für die Fernwartungs-App Genie wichtige Informationen über das eigene Netzwerk aus. Unter anderem können Angreifer aus dem Netz so Passwörter auslesen. --------------------------------------------- http://heise.de/-2553224

1 0

Tageszusammenfassung - Dienstag 17-02-2015
by Daily end-of-shift report 17 Feb '15

17 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-02-2015 18:00 − Dienstag 17-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** HITBSecConf2015 Amsterdam *** --------------------------------------------- Held once again at De Beurs van Berlage, HITB2015AMS takes place from the 26th till the 29th of May 2015 and runs alongside HITB Haxpo - our 3-day technology expo for hackers, makers, builders and breakers. --------------------------------------------- http://conference.hitb.org/hitbsecconf2015ams/ *** Anunak (aka Carbanak) Update *** --------------------------------------------- ... basically Anunak is the name the malware author gave to the main malware used in these attacks. Carbanak is the name the AV industry gave to this malware, which is a combination of the .. --------------------------------------------- http://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/ *** HTTP Strict Transport Security comes to Internet Explorer *** --------------------------------------------- As part of our ongoing commitment to help build an interoperable, secure web that just works, were excited to announce support for HTTP Strict Transport Security (HSTS) in Internet Explorer. This change can be previewed using Internet Explorer in the Windows 10 Technical Preview, and will come to Project Spartan in a later update. --------------------------------------------- http://blogs.msdn.com/b/ie/archive/2015/02/16/http-strict-transport-securit… *** TYPO3-EXT-SA-2015-005: Cross-Site Scripting in extension Gridelements (gridelements) *** --------------------------------------------- The extension fails to properly escape user input in HTML context. Backend Editor permissions with access to any text field within any data table are required to exploit this vulnerability. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** MongoDB: Tipps für sichere Benutzung veröffentlicht *** --------------------------------------------- Nach Schlagzeilen über ungesicherte Online-Installationen der Datenbank MongoDB gibt der Hersteller der kommerziellen Variante Sicherheits-Empfehlungen. Sie zeigen, wie man die populäre Software ohne Datenleck übers Netz nutzen kann. --------------------------------------------- http://www.heise.de/newsticker/meldung/MongoDB-Tipps-fuer-sichere-Benutzung… *** TYPO3: Important Security-Bulletin Pre-Announcement *** --------------------------------------------- A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. --------------------------------------------- http://typo3.org/news/article/important-security-bulletin-pre-announcement/ *** Bericht: Lightning-Anschluss gehackt *** --------------------------------------------- Einem Entwickler hat es geschafft, den von Apple verwendeten Sicherheitschip für die Anschlusskabel von iPhone und Co. teilweise zu entschlüsseln und eine serielle Konsole aufzurufen. Das könnte zu ganz neuen Angriffsformen führen. --------------------------------------------- http://heise.de/-2550921 *** Defeating TrueCrypt: Practical Attacks against TrueCrypt Security *** --------------------------------------------- The need to defend confidentiality of our sensitive information against persistently rising cyber threats has turned most of us toward using encryption on a daily basis. This is facilitated by easy-to-use GUI tools like TrueCrypt that offer advanced encryption without hassles. TrueCrypt .. --------------------------------------------- http://resources.infosecinstitute.com/defeating-truecrypt-practical-attacks… *** SSA-315836 (Last Update 2015-02-17): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V12 and V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Vawtrack malware peddlers turn to malicious macros *** --------------------------------------------- Cybercriminals spreading new versions of the Vawtrak banking Trojan are the latest ones to use the once again popular macro-based attack. Popular in the early 2000s, this type of attack was abandon... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2967 *** APT Groups Emerging in Middle East *** --------------------------------------------- Since security researchers and vendors began exposing the inner workings of APT groups a few years ago, virtually all of the operations that have been made public have been the work of attackers in Europe, Asia or North America. But .. --------------------------------------------- http://threatpost.com/apt-groups-emerging-in-middle-east/111124 *** Inside nls_933w.dll, the Equation APT Persistence Module *** --------------------------------------------- The persistence module used by the Equation APT Group uncovered by researchers at Kaspersky Lab has been called the ultimate cyberattack tool. --------------------------------------------- http://threatpost.com/inside-nls_933w-dll-the-equation-apt-persistence-modu… *** Keeping Up with SSL *** --------------------------------------------- SSL is becoming an evermore important aspect of serving and consuming content on the Internet, so its only fit that Shodan extends the information that it gathers for every SSL-capable service. The banners for SSL services, such as HTTPS, have included the certificate in PEM format for a long time and youve been able to access that data through the REST API or real-time stream. --------------------------------------------- https://blog.shodan.io/ssl-update/

1 0

Tageszusammenfassung - Montag 16-02-2015
by Daily end-of-shift report 16 Feb '15

16 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-02-2015 18:00 − Montag 16-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Microsoft February Patch Failures Continue: KB3023607 vs. Cisco AnyConnect Client *** --------------------------------------------- Another patch released by Microsoft this month is causing problems. This time it is KB3023607,which was supposed to mitigate the POODLE vulnerability. Once applied, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19331 *** PostgreSQL Bugs Let Remote Authenticated Users Obtain Potentially Sensitive Information, Execute Arbitrary Code, and Deny Service *** --------------------------------------------- Several vulnerabilities were reported in PostgreSQL. A remote authenticated user can execute arbitrary code on the target system. A remote authenticated user can cause denial of service conditions. A remote authenticated user can obtain .. --------------------------------------------- http://www.securitytracker.com/id/1031742 *** SSA-234789 (Last Update 2015-02-13): Vulnerabilities in SIMATIC STEP 7 (TIA Portal) V13 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerShell: Better phishing for all! *** --------------------------------------------- PowerShell is able to import functions from any DLL, this allows you to use functions like VirtualAlloc, memset and CreateThread. This will allow you to allocate executable memory, fill it with your program and execute it. --------------------------------------------- http://d.uijn.nl/?p=116 *** Analysis of the Fancybox-For-WordPress Vulnerability *** --------------------------------------------- We were alerted last week of a malware outbreak affecting WordPress sites using version 3.0.2 and lower of the fancybox-for-wordpress plugin. As announced, here are some of the details explaining how attackers could use this .. --------------------------------------------- http://blog.sucuri.net/2015/02/analysis-of-the-fancybox-for-wordpress-vulne… *** Probleme mit Windows RT: Microsoft zieht PowerPoint-Patch zurück *** --------------------------------------------- Per Patch wollte Microsoft die Stabilität von PowerPoint verbessern. Nutzer von Windows RT-Geräten hatten jedoch nach der Installation des Patches berichtet, dass sich Powerpoint nicht mehr starten lasse. Jetzt hat Microsoft den Patch zurückgezogen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Probleme-mit-Windows-RT-Microsoft-zi… *** Sicherheitslücke in Gruppenrichtlinien: Mit dem Patchen allein ist es nicht getan *** --------------------------------------------- Admins aufgepasst: Eines der am Februar-Patchday ausgelieferten Updates schützt nur, wenn man eine Reihe von Anweisungen befolgt. Tut man das nicht, bleibt die Infrastruktur für Man-in-the-Middle-Angriffe anfällig. --------------------------------------------- http://heise.de/-2550209 *** The Great Bank Heist, or Death by 1,000 Cuts? *** --------------------------------------------- I received a number of media requests and emails from readers over the weekend to comment on a front-page New York Times story about an organized gang of cybercriminals pulling off 'one of the largest bank heists ever.' Turns out, I reported on this gang's activities in December 2014, although my story ran minus many of the superlatives in the Times piece. --------------------------------------------- http://krebsonsecurity.com/2015/02/the-great-bank-heist-or-death-by-1000-cu… *** The research: Mobile Internet traffic hijacking via GTP and GRX *** --------------------------------------------- Most users assume that mobile network access is much safer because a big mobile-telecoms provider will protect subscribers. Unfortunately, as practice shows, mobile Internet is a great opportunity for the attacker. --------------------------------------------- http://blog.ptsecurity.com/2015/02/the-research-mobile-internet-traffic.html *** Angriffsziel Bitcoinbörse: Bter und Exco.in gehackt *** --------------------------------------------- Die Jagdsaison auf Bitcoinbörsen scheint wieder loszugehen: Unbekannte haben die Handelsplattform Bter um Coins im Wert von fast 1,5 Millionen Euro erleichtern können. Die Börse Exco.in wurde gleich aller Bitcoins beraubt. --------------------------------------------- http://heise.de/-2550175

1 0

Tageszusammenfassung - Freitag 13-02-2015
by Daily end-of-shift report 13 Feb '15

13 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-02-2015 18:00 − Freitag 13-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Open-Xchange Access Control Flaw Lets Remote Authenticated Users Access Restricted Files *** --------------------------------------------- A vulnerability was reported in Open-Xchange. A remote authenticated user can access certain files on the target system. A remote authenticated user with access to publications can access shared files without permission to access them. --------------------------------------------- http://www.securitytracker.com/id/1031744 *** Security Advisory-Information Leakage Vulnerability in Huawei P7 Smartphone *** --------------------------------------------- MeWidget is a plug-in of Huawei Emotion UI. The MeWidget module on Huawei smartphone P7 has a vulnerability that could lead to the disclosure of contact information. Attackers can obtain the name and URI information of mobile phone users through the malware installed on the smartphones. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Apple: Zwei-Faktor-Schutz für iMessage und FaceTime *** --------------------------------------------- Apple bietet ab sofort die Zwei-Faktor-Authentifizierung auch für seine Dienste FaceTime und iMessage an. Dieses schützt das Konto mit einem zweiten Passwort. --------------------------------------------- http://futurezone.at/digital-life/apple-zwei-faktor-schutz-fuer-imessage-un… *** NetGear WNDR Authentication Bypass / Information Disclosure *** --------------------------------------------- .. viewing and setting of certain router parameters, such as: WLAN credentials and SSIDs. Connected clients. Guest WLAN credentials and SSIDs. Parental control settings. ... As this SOAP service is called via the built-in HTTP / CGI daemon, unauthenticated queries will be answered from the WAN if remote management has been enabled on the device. As a result, affected devices can be interrogated and hijacked with as little as a well placed HTTP query. --------------------------------------------- https://github.com/darkarnium/secpub/blob/master/NetGear/SOAPWNDR/README.md *** vBulletin XSS (Cross-Site Scripting) Security Vulnerabilities *** --------------------------------------------- Vulnerable Versions: 5.1.3, 5.0.5, 4.2.2, 3.8.7, 3.6.7, 3.6.0, 3.5.4 Vulnerability Details: vBulletin has a security problem. It can be exploited by XSS attacks. The vulnerability occurs at "forum/help" page. Add "hash symbol" first. Then add script at the end of it. CVE Reference: CVE-2014-9469 CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) --------------------------------------------- http://securityrelated.blogspot.co.at/2015/02/cve-2014-9469-vbulletin-xss-c… *** Netatmo Weather Station Sends WPA Passwords In the Clear *** --------------------------------------------- UnderAttack writes The SANS Internet Storm Center is writing that Netatmo weather stations will send the users WPA password in the clear back to Netatmo. Netatmo states that this is some forgotten debug code that was left in the device. Overall, the device doesnt bother with encryption, but sends all data, not just the password, in the clear. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-VdGyumpxjY/story01.htm *** Windows Exploit Mitigation Technology - Part 1 *** --------------------------------------------- The spree of exploits on Windows has led to the creation of a certain type of exploit protection mechanism on Windows. Protection from things like buffer overflow, heap overwrite and return originated exploits have been deployed on Windows compilers and OS. --------------------------------------------- http://resources.infosecinstitute.com/windows-exploit-mitigation-technology…

1 0

Tageszusammenfassung - Donnerstag 12-02-2015
by Daily end-of-shift report 12 Feb '15

12 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-02-2015 18:00 − Donnerstag 12-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Advantech EKI-1200 Buffer Overflow *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in Advantech EKI-1200 product line. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-041-01 *** MSRT February: Escad and NukeSped *** --------------------------------------------- This month we added three new families to the Microsoft Malicious Software Removal Tool (MSRT) to help protect our customers: Win32/Escad, Win32/Jinupd and Win32/NukeSped. While this blog focuses on Escad and NukeSped, we want to note that Jinupd is point-of-sale malware that steals sensitive data, such as credit card information and sends it to a malicious hacker. The Escad and NukeSped malware families have backdoor capabilities that have been used as part of targeted attacks. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/02/10/msrt-february-escad-and-… *** February 2015 Updates *** --------------------------------------------- Today, as part of Update Tuesday, we released nine security bulletins - three rated Critical and six rated Important in severity, to address 56 unique Common Vulnerabilities and Exposures (CVEs) in Microsoft Windows, Microsoft Office, Internet Explorer, and Microsoft Server software. We encourage you to apply all of these updates. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/02/10/february-2015-updates.as… *** A Crypto Trick That Makes Software Nearly Impossible to Reverse-Engineer *** --------------------------------------------- Software reverse engineering, the art of pulling programs apart to figure out how they work, is what makes it possible for sophisticated hackers to scour code for exploitable bugs. It's also what allows those same hackers' dangerous malware to be deconstructed and neutered. Now a new encryption trick could make both those tasks much, much harder. --------------------------------------------- http://feeds.wired.com/c/35185/f/661467/s/434d3df8/sc/4/l/0L0Swired0N0C20A1… *** Decrypting TLS Browser Traffic With Wireshark - The Easy Way *** --------------------------------------------- It turns out that Firefox and the development version of Chrome both support logging the symmetric session key used to encrypt TLS traffic to a file. You can then point Wireshark at said file and presto! decrypted TLS traffic. Read on to learn how to set this up. --------------------------------------------- https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wiresh… *** Elasticsearch vulnerability CVE-2015-1427 *** --------------------------------------------- Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerabilities allow an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM. We have been assigned CVE-2015-1427 for this. ... CVSS: Overall CVSS score: 5.8 --------------------------------------------- http://www.securityfocus.com/archive/1/534689 *** NIST requests final comments on ICS security guide *** --------------------------------------------- Included in the final draft are updates on ICS vulnerabilities and risk management practices, along with information on security capabilities and tools for industrial control systems. Also added to the guide were methods for aligning guidance with other ICS security standards and guidelines. --------------------------------------------- http://www.scmagazine.com/nist-requests-final-comments-on-ics-security-guid… *** Pannen-Patch: Microsoft probierts noch mal *** --------------------------------------------- Unangekündigt hat Microsoft erneut damit begonnen, den Patch KB3001652 über Windows Update zu verteilen. Im ersten Anlauf hatte das Unternehmen damit zahlreiche Rechner lahm gelegt. Unterdessen beschweren sich Nutzer über einen weiteren Patch. --------------------------------------------- http://www.heise.de/newsticker/meldung/Pannen-Patch-Microsoft-probierts-noc… *** Cisco Security Advisories *** --------------------------------------------- Cisco IOS Software Access Control List Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 11-02-2015
by Daily end-of-shift report 11 Feb '15

11 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-02-2015 18:00 − Mittwoch 11-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** MS15-FEB - Microsoft Security Bulletin Summary for February 2015 - Version: 1.0 *** --------------------------------------------- MS15-009 Security Update for Internet Explorer MS15-010 Vulnerabilities in Windows Kernel-Mode Driver Could Allow Remote Code Execution MS15-011 Vulnerability in Group Policy Could Allow Remote Code Execution MS15-012 Vulnerabilities in Microsoft Office Could Allow Remote Code Execution MS15-013 Vulnerability in Microsoft Office Could Allow Security Feature Bypass MS15-014 Vulnerability in Group Policy Could Allow Security Feature Bypass MS15-015 Vulnerability in Microsoft Windows Could Allow Elevation of Privilege MS15-016 Vulnerability in Microsoft Graphics Component Could Allow Information Disclosure MS15-017 Vulnerability in Virtual Machine Manager Could Allow Elevation of Privilege --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-FEB *** Vorsicht! Microsoft-Patch legt Rechner lahm *** --------------------------------------------- An seinem Februar-Patchday schließt Microsoft 56 Lücken - und beschert Windows-Nutzern auch neue Probleme. Durch ein älteres Update, das nun automatisch verteilt wird, hängt der Rechner beim Installieren fest. --------------------------------------------- http://heise.de/-2545913 *** SSL Is Officially Declared Dead *** --------------------------------------------- On January 30, 2015, QSAs received the latest edition of the Council's Assessor Newsletter. Buried in that edition was the following statement. "The impacting change is related to several vulnerabilities in the SSL protocol. Because of this, no version of SSL meets PCI SSCs definition of strong cryptography, and updates to the standards are needed to address this issue." ... Therefore, those of you still using SSL to secure transmissions containing cardholder data (CHD) need to ... --------------------------------------------- https://pciguru.wordpress.com/2015/02/07/ssl-is-officially-declared-dead/ *** MS15-011 & MS15-014: Hardening Group Policy *** --------------------------------------------- Today we are releasing MS15-011 & MS15-014 which harden group policy and address network access vulnerabilities that can be used to achieve remote code execution (RCE) in domain networks. The MS15-014 update addresses an issue in Group Policy update which can be used to disable client-side global SMB Signing requirements, bypassing an existing security feature built into the product. MS15-011 adds new functionality, hardening network file access to block access to untrusted, attacker --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-har… *** Internet of Thieves: All that shiny home security gear is crap, warns HP *** --------------------------------------------- If you can monitor your house across the web, so can everyone else In a recent study, every connected home security system tested by HP contained significant vulnerabilities, including but not limited to password security, encryption, and authentication issues. --------------------------------------------- http://www.theregister.co.uk/2015/02/10/iot_home_insecurity/ *** ZDI-15-041: Samsung Security Manager ActiveMQ Broker Service DELETE Method Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to delete files of their choosing from systems running vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-041/ *** Security Advisory- Local Denial of Service Vulnerability in Huawei Ascend P7 *** --------------------------------------------- Huawei Ascend P7 (Sophia-L09) uses Android 4.4, which is the upgrade version of EMUI 3.0. The phone module crashes when a third-party app sends specific broadcast messages or enables specific UIs. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7 *** --------------------------------------------- Android versions earlier than 5.0 are affected by the vulnerability, which allows an attacker to escalate privilege. Huawei Mate7 is affected by the vulnerability CVE-2014-7911 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Offene Key-Value Stores *** --------------------------------------------- Offene Key-Value Stores11. Februar 2015Wie Heise berichtet wurden in den letzten Tagen von einer Gruppe Studenten zehntausende vollständig ungesicherte Instanzen der NoSQL-Datenbank MongoDB im Internet entdeckt. In den meisten Fällen war nicht nur lesender Zugriff sondern auch die Manipulation von Datensätzen möglich. --------------------------------------------- http://www.cert.at/services/blog/20150211085411-1367.html *** Research, Low-Level, Vulnerabilities, Exploitation *** --------------------------------------------- Today, Microsoft released their latest Patch Tuesday. This Patch includes a fix for vulnerability CVE-2015-0057, an IMPORTANT-rated exploitable vulnerability which we responsibly disclosed to Microsoft a few months ago. As part of our research, we revealed this privilege escalation vulnerability which, if exploited, enables a threat actor to complete control of a Windows machine. --------------------------------------------- http://breakingmalware.com/vulnerabilities/one-bit-rule-bypassing-windows-1… *** Google Play Store X-Frame-Options (XFO) Gaps Enable Android Remote Code Execution (RCE) *** --------------------------------------------- Due to a lack of complete coverage for X-Frame-Options (XFO) support on Googles Play Store web application domain, a malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers, to remotely install and launch the main intent of an arbitrary Play Store provided Android package (APK). Affected Platforms: Many versions of Android 4.3 (Jelly Bean) and earlier ship ... --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2015/02/10/r7-2015-0… *** NetFlow Collection and Analysis Using NFCAPD, Python, and Splunk *** --------------------------------------------- NetFlow data is often collected for network monitoring and management, but it has many applications for the security analyst. NetFlow data can be used to identify variations from established traffic baselines, traffic originating from critical systems, and communications with known bad external hosts. Many edge devices support the generation of NetFlow data, but the collection and analysis often requires commercial tools. Options based on open source and free tools will allow an analyst to ... --------------------------------------------- https://www.sans.org/reading-room/whitepapers/incident/netflow-collection-a… *** Firmware: Hacker veröffentlicht Anleitung für UEFI-Rootkits *** --------------------------------------------- Ein russischer Hacker hat eine Anleitung veröffentlicht, wie Rootkits über manipulierte UEFIs eingepflanzt werden können. Wie leicht es ist, aktuelle UEFI-Implementierungen anzugreifen, hatten Hacker bereits auf dem 31C3 demonstriert. --------------------------------------------- http://www.golem.de/news/firmware-hacker-veroeffentlicht-anleitung-fuer-uef… *** Cisco Security Advisories *** --------------------------------------------- Cisco Secure Access Control System SQL Injection Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Measurement Aggregation and Correlation Engine Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS ACL Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco TelePresence IX5000 Series Web Management Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 10-02-2015
by Daily end-of-shift report 10 Feb '15

10 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-02-2015 18:00 − Dienstag 10-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Safer Internet Day: BSI-Poster für mehr Sicherheit im Netz *** --------------------------------------------- Mit 40 "leicht umsetzbaren" Tipps sollen Internetnutzer die allermeisten Standardangriffe im Internet abwehren können, meint das Bundesamt für Sicherheit in der Informationstechnik. Deswegen hat es die auf Postern zusammengefasst und online gestellt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Safer-Internet-Day-BSI-Poster-fuer-m… *** European Cyber Security Month reporting to the benefit of EU citizen *** --------------------------------------------- ENISA publishes a report on the deployment of the European Cyber Security Month. The objective of this report is to: * Present its preparatory work * Carry out an objective evaluation * Draw conclusions that can be used in future editions of the ECSM --------------------------------------------- http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-r… *** TR-32 - key-value store and NoSQL security recommendations *** --------------------------------------------- Key-value stores, caches or NoSQL databases became an important piece of software in today's internet and web services. In contrast to conventional DB sytems, the security model of NoSQL data stores is often very limited due to their inherent nature to be used within internal trusted networks. Strong attention should be given to the configuration of key-value stores especially regarding their access from the Internet. --------------------------------------------- http://www.circl.lu/pub/tr-32/ *** PlugX, Go-To Malware for Targeted Attacks, More Prominent Than Ever *** --------------------------------------------- The popular remote access tool PlugX enjoyed an ascent in popularity in 2014 and is now a go-to malware for attack groups. --------------------------------------------- http://threatpost.com/plugx-go-to-malware-for-targeted-attacks-more-promine… *** Cisco Security Advisories *** --------------------------------------------- Cisco Prime Infrastructure Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Site Request Forgery Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Software Zone-Based Firewall Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco IOS Software Kernel Timer Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Prime Security Manager Cross-Site Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco Prime Infrastructure Cross-Frame Scripting Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014… --------------------------------------------- Cisco IOS Shell Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015…

1 0

Tageszusammenfassung - Montag 9-02-2015
by Daily end-of-shift report 09 Feb '15

09 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-02-2015 18:00 − Montag 09-02-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Analyzing Angler: The World's Most Sophisticated Exploit Kit *** --------------------------------------------- Anglers unique obfuscation, ability to detect antivirus and virtual machines, encrypted payload and fileless infection have some calling it the most sophisticated exploit kit. --------------------------------------------- http://threatpost.com/analyzing-angler-the-worlds-most-sophisticated-exploi… *** Bindead - a static analysis tool for binaries. *** --------------------------------------------- Bindead is an analyzer for executable machine code. It features a disassembler that translates machine code bits into an assembler like language (RREIL) that in turn is then analyzed by the static analysis component using abstract interpretation. As Bindead operates on the machine code level, it can be used without having the source code of the program to be analyzed. In fact, the purpose of Bindead is to help with the reverse engineering of executable code or binaries. --------------------------------------------- https://bitbucket.org/mihaila/bindead/wiki/Home *** ENISA: Threat Landscape for Smart Home and Media Convergence *** --------------------------------------------- The study identifies threats to all asset classes, across the several alternative design pathways to smart homes. As it develops, the smart home will exhibit a high cyber security risk profile for the individual context, with additional systematic effects on broader information security. --------------------------------------------- https://www.enisa.europa.eu/activities/risk-management/evolving-threat-envi… *** Online Windows Binary Analyzer *** --------------------------------------------- http://labs.nccgroup.com/NCCGroupWindowsBinaryAnalyzer/ *** Firmware Forensics: Diffs, Timelines, ELFs and Backdoors *** --------------------------------------------- This post covers some common techniques that I use to analyze and reverse firmware images. These techniques are particularly useful to dissect malicious firmwares, spot backdoors and detect unwanted modifications. --------------------------------------------- http://w00tsec.blogspot.co.at/2015/02/firmware-forensics-diffs-timelines-el… *** Moodle Directory Traversal Flaw Lets Remote Users View Arbitrary Files *** --------------------------------------------- A vulnerability was reported in Moodle. A remote user can view files on the target system. The software does not properly validate user-supplied input to some scripts that serve JavaScript. A remote user can supply a specially crafted request containing the '../' string to view files on target system that are located outside of the document directory. --------------------------------------------- http://www.securitytracker.com/id/1031712 *** Cisco Security Advisories *** --------------------------------------------- Cisco AsyncOS Software Uuencode Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vunerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… --------------------------------------------- Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… --------------------------------------------- Cisco Adaptive Security Appliance WebVPN Content Rewriter Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013…

1 0

Tageszusammenfassung - Freitag 6-02-2015
by Daily end-of-shift report 06 Feb '15

06 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-02-2015 18:00 − Freitag 06-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Filmkan: Mysterious Turkish Botnet Grows Through Facebook *** --------------------------------------------- On January 31, a security researcher named Mohammad Faghani posted an analysis of malware that was being distributed through Facebook posts. Based on the number of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/02/filmkan-mysterious-turki… *** Microsoft: Firmen entdecken Cyberattacken erst nach 243 Tagen *** --------------------------------------------- Firmen brauchen nach Angaben von Microsoft durchschnittlich 243 Tage, um eine Cyberattacke auf ihr Netzwerk zu entdecken. "Sie haben 243 Tage lang .. --------------------------------------------- http://derstandard.at/2000011347067 *** Revetons design refreshed - Winter 2015 *** --------------------------------------------- Those days Reveton is mainly pushed on adult traffic via "standalone" CVE-2015-0311 flash (posing as advert) calling an Xtea encoded stream. After not far from 2 years with the same design it's now showing some .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/02/RevetonWinter2015.html *** The Anthem Breach: What We Know Now *** --------------------------------------------- I learned about the breach directly from the CEO before all the hype and speculation hit. This is the level of caring and responsibility I personally expect as an Anthem customer. So now that the news is out there, let's talk about the technical aspects of the breach. --------------------------------------------- http://blog.beyondtrust.com/the-anthem-breach-what-we-know-now *** GE and MACTek HART Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01 *** Pepperl+Fuchs Hart Device DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an improper input vulnerability in the CodeWrights GmbH HART Device DTM library utilized in Pepperl+Fuchs' HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-02 *** CodeWrights GmbH HART Device DTM Vulnerability (Update C) *** --------------------------------------------- This updated advisory is a follow-up to the updated advisory titled ICSA-15-012-01B CodeWrights GmbH HART DTM Vulnerability that was published January 27, 2015, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-012-01C *** Datenschutz: Wie sicher ist die IP-Telefonie? *** --------------------------------------------- Können Dritte ohne großen Aufwand IP-Telefonate mithören? Die Antwort ist wie so oft: Jein. Denn trotz mangelnder Verschlüsselung ist die IP-Telefonie nicht ganz so unsicher wie behauptet - zumindest ist es für Angreifer schwierig, Telefonate abzuhören. --------------------------------------------- http://www.golem.de/news/datenschutz-wie-sicher-ist-die-ip-telefonie-1502-1… *** Preparing for the unknown - A peek into Cyber Europe *** --------------------------------------------- ENISA is supporting Member States to cope with major cybersecurity crises with its flagship Cyber Europe programme. Five years after the first ever European wide cyber exercise, Cyber Europe evolved into a unique multinational crisis simulation which immerses participants into the unknown. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/preparing-for-the-unknown-a-pee… *** 7 Best WordPress Security Plugins *** --------------------------------------------- WordPress is the most popular blogging platform in the world. Millions of websites including various popular blogs are using WordPress as a content publishing platform. So, hackers are also more interested in hacking .. --------------------------------------------- http://resources.infosecinstitute.com/7-best-wordpress-security-plugins/ *** Neue Spuren im Sony-Hack führen nach Russland *** --------------------------------------------- Neue Indizien im Fall des Sony-Hacks sollen belegen, dass russische Hacker in den Vorfall involviert sind. Einem Bericht zufolge haben diese aktuell immer noch Zugriff auf das Netzwerk von Sony Pictures Entertainment. --------------------------------------------- http://heise.de/-2543005 *** Fessleak malvertising campaign used to serve ransomware *** --------------------------------------------- Invincea has been monitoring the Fessleak campaign in which hackers leveraged Adobe Flash Player exploits and file-less infections to serve ransomware. --------------------------------------------- http://securityaffairs.co/wordpress/33153/cyber-crime/fessleak-malvertising…

1 0

Tageszusammenfassung - Donnerstag 5-02-2015
by Daily end-of-shift report 05 Feb '15

05 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-02-2015 18:00 − Donnerstag 05-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Zero-day in the Fancybox-for-WordPress Plugin *** --------------------------------------------- Our research team was alerted to a possible malware outbreak affecting many WordPress websites. All the infections had a similar malicious iframe from '203koko' injected into the website. We were also directed to a forum thread .. --------------------------------------------- http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugi… *** SA-CONTRIB-2015-037 - Path Breadcrumbs - Access Bypass *** --------------------------------------------- https://www.drupal.org/node/2420139 *** Analyzing CVE-2015-0313: The New Flash Player Zero Day *** --------------------------------------------- Adobe has started rolling out an update to Flash Player which fixes the zero-day vulnerability we discussed earlier this week. This particular vulnerability can be exploited .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-20… *** Russische Malware zielt auf iOS-Geräte, saugt alle Daten ab *** --------------------------------------------- Die IT-Sicherheitsfirma "TrendLabs" berichtet, dass eine SpyWare namens XAgent sich mittlerweile auf iPhone und iPads ausgebreitet hat. Bereits vergangenes Jahr war von dem Schadprogramm die Rede, damals griff die Anwendung Windows-Rechner in Regierungsorganisationen, .. --------------------------------------------- http://derstandard.at/2000011311181 *** Sicherheitsstandards ignoriert: BMW-Hack war vermeidbar *** --------------------------------------------- Der kürzlich bekannt gewordene Hack von Autos der Marke BMW wäre auf einfache Weise vermeidbar gewesen. Das Computermagazin c’t zeigt im Detail, wie der Autokonzern zentrale .. --------------------------------------------- http://derstandard.at/2000011322698 *** Flash Zero Days Dominate Exploit Landscape *** --------------------------------------------- The recent Flash zero-day vulnerabilities and exploits have uncovered the relatively quiet Hanjuan exploit kit, and further exposed the dangers of malvertising. --------------------------------------------- http://threatpost.com/flash-zero-days-dominate-exploit-landscape/110871 *** Internet Explorer Cross-Site Scripting Vulnerability Now Public *** --------------------------------------------- Security researcher David Leo has disclosed a new vulnerability in Microsoft Internet Explorer. The vulnerability allows the same origin policy of the browser to be violated. The same-origin policy restricts how a document or .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/internet-explore… *** Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited *** --------------------------------------------- This is the tale of an ongoing SSH brute forcing campaign, targeting servers and network devices, that distributes a new family of Linux rootkit malware named 'XOR.DDoS'. While typical DDoS bots are straightforward in operation and often programmed in a high-level script such as PHP or Perl, the XOR.DDoS family is programming in C/C++ and incorporates multiple .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/02/anatomy_of_a_brutef.ht… *** Security updates available for Adobe Flash Player (APSB15-04) *** --------------------------------------------- A Security Bulletin (APSB15-04) has been published regarding security updates for Adobe Flash Player. These updates address CVE-2015-0313, which is being actively exploited in the wild via drive-by-download attacks against systems .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1175

1 0

Tageszusammenfassung - Mittwoch 4-02-2015
by Daily end-of-shift report 04 Feb '15

04 Feb '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-02-2015 18:00 − Mittwoch 04-02-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New Wave of CTB-Locker/Critroni Ransomware Hitting Victims *** --------------------------------------------- There is a new wave of attacks delivering the CTB-Locker or Critroni crypto ransomware, arriving through spam messages with a variety of lures in several different countries. CTB-Locker is one of the newer variants in the crypto .. --------------------------------------------- http://threatpost.com/new-wave-of-ctb-lockercritroni-ransomware-hitting-vic… *** Advisory - Dangerous "nonce" leak in UpdraftPlus *** --------------------------------------------- Advisory for: UpdraftPlus Security Risk: High Exploitation level: Remote DREAD Score: 7/10 Vulnerability: Privilege Escalation Patched Version: 1.9.51 If you're a user of the UpdraftPlus plugin for WordPress, now is the time to update. During .. --------------------------------------------- http://blog.sucuri.net/2015/02/advisory-dangerous-nonce-leak-in-updraftplus… *** UpdraftPlus <= 1.9.50 - Privilege Escalation *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7781 *** 1,800 Domains Overtaken by Flash Zero Day *** --------------------------------------------- Researchers at Cisco say that a Flash zero day exploit has compromised 1,800 domains, the majority of those during a 48-hour period last week. --------------------------------------------- http://threatpost.com/1800-domains-overtaken-by-flash-zero-day/110835 *** Multiple vulnerabilities in Cisco Unified IP Phone 9900 *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015… *** MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code *** --------------------------------------------- MIT Kerberos Multiple Flaws in kadmind Let Remote Users Obtain Potentially Sensitive Information and Remote Authenticted Users Execute Arbitrary Code --------------------------------------------- http://www.securitytracker.com/id/1031691 *** Siemens SCALANCE X-200IRT Switch Family User Impersonation Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a user impersonation vulnerability in the Siemens SCALANCE X-200IRT Switch Family. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-01 *** Siemens Ruggedcom WIN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in the Siemens Ruggedcom WIN firmware. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-034-02 *** An In-depth analysis of the Fiesta Exploit Kit: An infection in 2015 *** --------------------------------------------- A while ago I blogged about the Fiesta exploit kit, this was back in September 2013 [Fiesta Exploit Kit analysis serving MSIE exploit CVE-2013-2551] in this blog I focused on the integration of the MSIE exploit and parts of the landing page. --------------------------------------------- http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-e… *** Play Store: Weit verbreitete Apps zeigen Adware verzögert an *** --------------------------------------------- Apps aus Googles Play Store mit Downloadzahlen von stellenweise über 5 Millionen beinhalten Adware, die den Nutzer zu dubiosen Appstores oder Anwendungen mit Premium-SMS-Versand weiterleiten. Interessant ist dabei die Art und Weise, wie die Werbung an den Nutzer gebracht wird. --------------------------------------------- http://www.golem.de/news/play-store-weit-verbreitete-apps-zeigen-adware-ver… *** Threat Analysis Template For BYOD Applications *** --------------------------------------------- Your IT department is certainly not at a loss when it comes to worrying about BYOD applications. Indeed, the list of threats to enterprise applications and the data they contain is a long one, and security professionals are .. --------------------------------------------- http://resources.infosecinstitute.com/threat-analysis-template-byod-applica… *** So schützen Sie sich vor der Flash-Lücke *** --------------------------------------------- Während Adobe weiterhin keine konkreten Schutzmaßnahmen kennt oder nennt, rät das BSI ganz klar zur Deinstallation des Flash Player. Wer nicht handelt und Flash weiterhin aktiv lässt, geht ein großes Risiko ein. --------------------------------------------- http://heise.de/-2539858 *** Cisco WebEx Meetings Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Pawn Storm Update: iOS Espionage App Found *** --------------------------------------------- In our continued research on Operation Pawn Storm, we found one interesting poisoned pawn - spyware specifically designed for espionage on iOS devices. While spyware targeting Apple users is highly notable by itself, this particular spyware is also involved in a targeted attack. Background .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-updat…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily