- Daily - CERT.at

Tageszusammenfassung - Mittwoch 18-12-2013
by Daily end-of-shift report 18 Dec '13

18 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 17-12-2013 18:00 − Mittwoch 18-12-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cybercriminals offer fellow cybercriminals training in Operational Security (OPSEC) *** --------------------------------------------- In need of a fresh example that malicious and fraudulent adversaries continue professionalizing, and standardizing demanded cybercrime-friendly products and services, all for the sake of monetizing their experience and expertise in the profitable world of cybercrime? Publicly launched around the middle of 2013, a product/training course targeting novice cybercriminals is offering them a manual, recommendations for open source/free software, as well as access to a private forum set up for... --------------------------------------------- http://www.webroot.com/blog/2013/12/17/cybercriminals-offer-fellow-cybercri… *** Apple stopft Lücken in WebKit und Safari *** --------------------------------------------- Mit den Safari-Versionen 6.1.1 und 7.0.1 behebt Apple einige Speicherverwaltungsfehler in WebKit, die zur Ausführung von Schadcode über das Internet missbraucht werden können. --------------------------------------------- http://www.heise.de/security/meldung/Apple-stopft-Luecken-in-WebKit-und-Saf… *** DGA Changer Malware Able to Modify Domain-Generation Seed on the Fly *** --------------------------------------------- Malware authors have been using domain-generation algorithms for a few years now, often in botnet-related malware that needs to stay one step ahead of takedown attempts and law enforcement agencies. Now, researchers have discovered that a strain of malware that may have been part of the attack in October on PHP.net is employing a DGA... --------------------------------------------- http://threatpost.com/dga-changer-malware-able-to-modify-domain-generation-… *** The Biggest Skimmers of All: Fake ATMs *** --------------------------------------------- This blog has spotlighted some incredibly elaborate and minaturized ATM skimmers, fraud devices that thieves attach to ATMs in a bid to steal card data and PINs. But a skimmer discovered in Brazil last month takes this sort of fraud to another level, using a completely fake ATM designed to be stacked directly on top... --------------------------------------------- http://krebsonsecurity.com/2013/12/the-biggest-skimmers-of-all-fake-atms/ *** A quick look at a (new?) cross-platform DDoS botnet *** --------------------------------------------- At the beginning of December we started to observe a new botnet spreading on both Linux and Windows machines. In case of the Linux operating systems, the bot was installed through an SSH dictionary attack. The attacker logged in to compromised server and simply downloaded and executed a bot file. The malware... --------------------------------------------- https://www.cert.pl/news/7849/langswitch_lang/en *** [SECURITY] [DSA 2821-1] gnupg security update *** --------------------------------------------- http://lists.debian.org/debian-security-announce/2013/msg00235.html *** Cisco ONS 15454 Transport Node Controller Denial of Service Vulnerability *** --------------------------------------------- An issue in the tNetTaskLimit process of the Cisco ONS 15454 Transport Node Controller (TNC) could allow an unauthenticated, remote attacker to cause the TNC to reload due to a watchdog timeout. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** Security Bulletin: Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services *** --------------------------------------------- Multiple vulnerabilities exist in IBM SPSS Collaboration and Deployment Services. See the individual descriptions for details. --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21660191 *** IBM Scale Out Network Attached Storage (SONAS) Multiple Vulnerabilities *** --------------------------------------------- Multiple vulnerabilities have been reported in IBM Scale Out Network Attached Storage, which can be exploited by malicious people to conduct spoofing attacks, disclose potentially sensitive information, bypass certain security restrictions, and compromise a user's system. --------------------------------------------- https://secunia.com/advisories/56095 *** Security Bulletin: GSKit SSL negotiation vulnerability in Tivoli Access Manager for e-business (CVE-2013-6329) *** --------------------------------------------- A vulnerability has been identified in the GSKit component utilized by Tivoli Access Manager for e-business (TAM). A specially crafted SSL message can cause the TAM server component using GSKit to crash CVE(s): CVE-2013-6329 Affected product(s) and affected version(s): All supported Tivoli Access Manager for e-business versions are affected. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_gsk… *** RealOne RMP File Heap Overflow Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029511 *** Vuln: Juvia Ruby on Rails secret_token.rb Default Secret Key Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/64368 *** Vuln: ownCloud Admin Page Unspecified Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63926 *** Zimbra Collaboration Server Unspecified Vulnerability *** --------------------------------------------- https://secunia.com/advisories/56138 *** Python Hash Collision Denial of Service Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55955

1 0

Tageszusammenfassung - Dienstag 17-12-2013
by Daily end-of-shift report 17 Dec '13

17 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 16-12-2013 18:00 − Dienstag 17-12-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Rapid7 Webcasts: A Great Week to Learn About Pentesting SAP Infrastructures *** --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/12/16/rapid7-we… *** Three Books You Too Should Read This Year (Or Early 2014) *** --------------------------------------------- For the holiday season, The Grumpy Reader fishes out a selecton of recent books you should read even if you think youre too busy.Im sure youve had that feeling too: There are times when theres too much coming your way when youre already busy, so some things just fall by the wayside for too long. In my case the victims of my unpredictable schedule were books that publishers sent me for review in one form or the other, and those reviews just never got written as I wanted to in between other... --------------------------------------------- http://bsdly.blogspot.com/2013/12/three-books-you-too-should-read-this.html *** How hackers made minced meat of Department of Engergy networks *** --------------------------------------------- Hint: Some critical security patches not installed for years. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/HKg_RoYby0g/story01… *** Predictions for 2014 and the December 2013 Security Bulletin Webcast, Q&A, and Slide Deck *** --------------------------------------------- Today we're publishing the December 2013 Security Bulletin Webcast Questions & Answers page. We answered 17 questions in total, with the majority of questions focusing on the Graphics Component bulletin (MS13-096), Security Advisory 2915720 and Security Advisory 2905247. We also wanted to note a new blog on the Microsoft Security Blog site on the top cyber threat predications for 2014. Topics from ransomware to regulation are covered by seven of Trustworthy Computing's top... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/12/16/predictions-for-2014-and… *** Dissection of Zertsecurity - Banking Trojan. *** --------------------------------------------- Zertsecurity is a well known banking Trojan based on phishing schemes targeting German Android users. Lets see how it works. After installing the application, it prompts the user for account and PIN numbers. The application takes the values of the account and PIN numbers via input boxes and saves them to the cfg.txt file. It then sends this file to a remote command and control (C&C)... --------------------------------------------- http://research.zscaler.com/2013/12/dissection-of-zertsecurity-banking.html *** The Case for a Compulsory Bug Bounty *** --------------------------------------------- Security experts have long opined that one way to make software more secure is to hold software makers liable for vulnerabilities in their products. This idea is often dismissed as unrealistic and one that would stifle innovation in an industry that has been a major driver of commercial growth and productivity over the years. But a new study released this week presents perhaps the clearest economic case yet for compelling companies to pay for information about security vulnerabilities in their... --------------------------------------------- http://krebsonsecurity.com/2013/12/the-case-for-a-compulsory-bug-bounty/ *** Big Data in Security *** --------------------------------------------- Cisco's TRAC team about Big Data security challenges, tools and methodologies. --------------------------------------------- http://blogs.cisco.com/security/big-data-in-security-part-i-trac-tools/ http://blogs.cisco.com/security/big-data-in-security-part-ii-the-amplab-sta… http://blogs.cisco.com/security/big-data-in-security-part-iii-graph-analyti… http://blogs.cisco.com/security/big-data-in-security-part-iv-email-auto-rul… http://blogs.cisco.com/security/big-data-in-security-part-v-anti-phishing-i… *** Hintergrund: iOS-Verschlüsselung durchleuchtet *** --------------------------------------------- Neben der Hardware-Verschlüsselung bietet iOS noch eine optionale Datei-Verschlüsselung. Bei iOS 7 hat Apple deren Einsatz für Apps automatisiert. Allerdings genehmigt sich Apple selbst großzügige Ausnahmen für eigene Anwendungen. --------------------------------------------- http://www.heise.de/security/artikel/iOS-Verschluesselung-durchleuchtet-206… *** Android anti-virus apps CANT kill nasties on sight like normal AV - and thats Googles fault *** --------------------------------------------- Bad news if youre not a tech-savvy fandroid Android users expecting Windows levels of performance from Android-specific anti-virus packages are likely to be disappointed because only Google can automatically delete dodgy apps on Android devices, say malware experts. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/12/17/android_ant… *** Apple security updates Mac OS X and Safari, (Tue, Dec 17th) *** --------------------------------------------- Apple have released the following security advisories and updates for Mac OS X and Safari. OS X Mavericks v10.9.1 and APPLE-SA-2013-12-16-1 Safari 6.1.1 and Safari 7.0.1. More information will be available from their web site: http://support.apple.com/kb/HT1222 --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17234 *** Blog: ChewBacca - a new episode of Tor-based Malware *** --------------------------------------------- We have discovered a new Tor-based malware, named "ChewBacca" and detected as "Trojan.Win32.Fsysna.fej". Adding Tor to malware is not unique to this sample, but it's still a rare feature. Lately Tor has become more attractive as a service to ensure users' anonymity. Also criminals use it for their activities, but they are only slowly adopting this to host their malicious infrastructure. --------------------------------------------- http://www.securelist.com/en/blog/208214185/ChewBacca_a_new_episode_of_Tor_… *** Trojan.Skimer.18 infects ATMs *** --------------------------------------------- December 16, 2013 Russian anti-virus company Doctor Web is warning users about the Trojan program Trojan.Skimer.18. The criminals behind this malware are targeting ATMs of one of the worlds largest manufacturers. The Trojan can intercept and transmit bank card information processed by ATMs as well as data stored on the card and its PIN code. Trojan.Skimer.18 is by no means the first backdoor to infect ATM software, but it is the first to target devices so common throughout the world. The --------------------------------------------- http://news.drweb.com/show/?i=4167&lng=en&c=9 *** Cisco EPC3925 cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89713 *** Bugtraq: [security bulletin] HPSBHF02953 rev.1 - HP B-series SAN Network Advisor, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/530357 *** Asterisk Dialplan Functions Let Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1029500 *** Asterisk SMS Message Buffer Overflow Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029499

1 0

Tageszusammenfassung - Montag 16-12-2013
by Daily end-of-shift report 16 Dec '13

16 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 13-12-2013 18:00 − Montag 16-12-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Bitcoin Mining Operation Seen Across Numerous Malware Families *** --------------------------------------------- The talent over at Malwarebytes broke a story this week regarding Fake Flash Player phishing attempts dropping malicious content onto victim machines for the purpose of mining Bitcoins. The threat tricks users into thinking that they are downloading a new version of Flash Player. In actuality, the threat drops a few malicious executables (stored in "[username]/AppData/Roaming/Data"), called... --------------------------------------------- http://research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.ht… *** IETF To Change TLS Implementation In Applications *** --------------------------------------------- Trailrunner7 writes "The NSA surveillance scandal has created ripples all across the Internet, and the latest one is a new effort from the IETF to change the way that encryption is used in a variety of critical application protocols, including HTTP and SMTP. The new TLS application working group was formed to help developers and the people who deploy their applications incorporate the encryption protocol correctly. TLS is the successor to SSL and is used to encrypt information in a variety... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/5p7fpD5WwtY/story01.htm *** Predictions for 2014 *** --------------------------------------------- 2014 is less than one month away, what better time to ask ourselves about the top security trends to watch for in the coming year. Malware Creation: OK, this won't sound too original but it is a safe bet to say that malware creation will hit a new record high in 2014. Actually, such was... --------------------------------------------- http://pandalabs.pandasecurity.com/predictions-for-2014/ *** Botnet Enlists Firefox Users to Hack Web Sites *** --------------------------------------------- An unusual botnet that has ensnared more than 12,500 systems disguises itself as a legitimate add-on for Mozilla Firefox and forces infected PCs to scour Web sites for vulnerabilities that can be used to install malware, an investigation by KrebsOnSecurity has discovered. --------------------------------------------- http://krebsonsecurity.com/2013/12/botnet-enlists-firefox-users-to-hack-web… *** Cybercriminals Using Targeted Attack Methodologies (Part 1) *** --------------------------------------------- One of our 2014 security predictions is that cyber criminals will more frequently leverage targeted attack methodologies. Some of these tactics include using spear phishing attacks, as well as well-known vulnerabilities that have been used successfully in targeted attacks. Let's see why cybercriminals are taking a closer look at these techniques, and how this can... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/CY7n7WI2qUY/ *** Attacking Online Poker Players *** --------------------------------------------- This story is about how at least two professional online poker players had their hotel rooms broken into and their computers infected with malware. I agree with the conclusion: So, whats the moral of the story? If you have a laptop that is used to move large amounts of money, take good care of it. Lock the keyboard when you... --------------------------------------------- https://www.schneier.com/blog/archives/2013/12/attacking_onlin.html *** P2P-Botnetz ZeroAccess kaum tot zu kriegen *** --------------------------------------------- Die gemeinsame Aktion von Microsoft, dem FBI und Europol, die zum Ziel hatte, das Klickbetrug-Botnetz ZeroAccess lahmzulegen schoss wohl größtenteils am Ziel vorbei. Das Botnetz scheint nach wie vor quicklebendig. --------------------------------------------- http://www.heise.de/security/meldung/P2P-Botnetz-ZeroAccess-kaum-tot-zu-kri… *** Bogus Antivirus Program Uses a Dozen Stolen Signing Certificates *** --------------------------------------------- A fake antivirus program in circulation uses at least a dozen stolen digital code-signing certificates, indicating cybercriminals are increasingly breaching the networks of software developers, Microsoft wrote on Sunday. The application, branded as "Antivirus Security Pro," was first detected in 2009 and has gone by a handful of other names over the years, according to a Microsoft advisory, which calls it by a single name, "Win32/Winwebsec." --------------------------------------------- http://www.cio.com/article/744689/Bogus_Antivirus_Program_Uses_a_Dozen_Stol… *** Old Apple Safaris leave IDs and passwords for scavengers to peck *** --------------------------------------------- ... the problem derives from Safaris retention of browser history as applied in the "Reopen All Windows from Last Session" feature that enables users to quickly revisit the sites they opened during a previous Safari session. Sadly, however, Kaspersky has found that the document Safari creates to allow such restoration is in plaintext and contains user IDs and passwords. The file is hidden, but isnt hard to find once you know what you are looking for. --------------------------------------------- http://www.theregister.co.uk/2013/12/16/kaspersky_says_old_apple_safaris_ex… *** Newly launched 'HTTP-based botnet setup as a service' empowers novice cybercriminals with bulletproof hosting capabilities - part three *** --------------------------------------------- In a series of blog posts throughout 2013, we emphasized on the lowering of the entry barriers into the world of cybercrime, largely made possible by the rise of managed services, the re-emergence of the DIY (do-it-yourself) trend, and the development of niche market segments, like the practice of setting up and offering bulletproof hosting for a novice cybercriminal's botnet generating platform. The proliferation of these easy to use, once only found in the arsenal of tools of the --------------------------------------------- http://www.webroot.com/blog/blog/2013/12/16/newly-launched-http-based-botne… *** Siemens COMOS Privilege Escalation *** --------------------------------------------- Siemens notified NCCIC/ICS-CERT of a privilege escalation vulnerability in the Siemens COMOS database application. An update has been produced by Siemens and is available to resolve the vulnerability.The client application used for accessing the database system might allow authenticated Windows users to elevate their rights in regard to the database access over the COMOS graphical user interface --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-347-01 *** Cisco WebEx Training Center open redirect *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89686 *** WordPress Broken Link Checker Plugin Two Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/56053 *** IBM Rational Focal Point Webservice Axis Gateway information disclosure 1 *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/87293 *** IBM Rational Focal Point Webservice Axis Gateway information disclosure 2 *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/87294

1 0

Tageszusammenfassung - Freitag 13-12-2013
by Daily end-of-shift report 13 Dec '13

13 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 12-12-2013 18:00 − Freitag 13-12-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Android 4.4.2 Update Fixes Flash SMS DoS Vulnerability *** --------------------------------------------- Google has patched a previously disclosed issue in its Nexus line of phones that could have opened a user up to a nasty series of SMS-based denial of service attacks. --------------------------------------------- http://threatpost.com/android-4-4-2-update-fixes-flash-sms-dos-vulnerabilit… *** Tumblr under fire from DIY CAPTCHA-solving, proxies-supporting automatic account registration tools *** --------------------------------------------- Next to the ubiquitous for the cybercrime ecosystem, traffic acquisition tactics such as, blackhat SEO (search engine optimization), malvertising, embedded/injected redirectors/doorways on legitimate Web sites, establishing purely malicious infrastructure, and social engineering driven spam campaigns, cybercriminals are also masters of utilizing social media for the purpose of attracting traffic to their fraudulent/malicious campaigns. --------------------------------------------- http://www.webroot.com/blog/blog/2013/12/12/tumblr-fire-diy-captcha-solving… *** Bitcoin-Related Malware Continues to Flourish *** --------------------------------------------- One good way to measure the popularity of an emerging technology or trend is to see how much attention attackers and malware authors are paying it. Using that as a yardstick, Bitcoin is moving its way up the charts in a hurry. The latest indication is some malware that researchers at Arbor Networks identified that ... --------------------------------------------- http://threatpost.com/bitcoin-related-malware-continues-to-flourish/103177 *** WordPress OptimizePress Theme - File Upload Vulnerability *** --------------------------------------------- We´re a few days short on this, but it´s still worth releasing as the number of attacks against this vulnerability are increasing ten-fold. The folks at OSIRT were the first to report this in late November, 2013. In our cases we´re seeing mostly defacement attacks, and although not devastating, they can be a big nuisance for an unsuspecting website owner. --------------------------------------------- http://blog.sucuri.net/2013/12/wordpress-optimizepress-theme-file-upload-vu… *** Weekly Metasploit Update: New Meterpreter Extended API, Learning About HttpServer, HttpClient, and SAP *** --------------------------------------------- Weekly Metasploit Update: New Meterpreter Extended API, Learning About HttpServer, HttpClient, and SAP --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/12/12/weekly-me… *** VU#586958: SketchUp Viewer buffer overflow vulnerability *** --------------------------------------------- Vulnerability Note VU#586958 SketchUp Viewer buffer overflow vulnerability Original Release date: 12 Dec 2013 | Last revised: 12 Dec 2013 Overview SketchUp Viewer version 13.0.4124 is vulnerable to a buffer overflow when opening a malformed .SKP file. Description CWE-121: Stack-based Buffer Overflow - CVE-2013-6038SketchUp Viewer version 13.0.4124 is vulnerable to a stack buffer overflow when parsing a specially crafted .SKP file. When executed, it may allow a remote unauthenticated attacker --------------------------------------------- http://www.kb.cert.org/vuls/id/586958 *** Cooper Power Systems Improper Input Validation Vulnerability *** --------------------------------------------- Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in the Cooper Power Systems SMP Gateway DNP3 protocol components. Cooper Power Systems has produced a new firmware version that mitigates this vulnerability. The researchers have tested the new firmware version to validate that it resolves the vulnerability.This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-346-01 *** Dear Gmailer: I know what you read last summer (and last night and today) *** --------------------------------------------- How Gmails image tweak is a boon to marketers, stalkers, and debt collectors. --------------------------------------------- http://arstechnica.com/security/2013/12/dear-gmailer-i-know-what-you-read-l… *** Report: Bot traffic is up to 61.5% of all website traffic *** --------------------------------------------- Last March we published a study that showed the majority of website traffic (51%) was generated by non-human entities, 60% of which were clearly malicious. As we soon learned, these facts came as a surprise to many Internet users, for whom they served as a rare glimpse of 'in between the lines' of Google Analytics. --------------------------------------------- http://www.incapsula.com/the-incapsula-blog/item/820-bot-traffic-report-2013 *** Five Deadly Security Venoms - Youre Still Doing it Wrong *** --------------------------------------------- With all the hype and hooplah surrounding the US governments tapping of everything under the sun, I have seen an influx of articles related to security. "This is how you encrypt!", "this is how you secure!", "this is how... Youre doing it wrong." --------------------------------------------- http://infiltrated.net/index.php?option=com_content&view=article&id=61 *** Tech Pick of the Week: Log anomaly detection tools *** --------------------------------------------- An important part of creating successful digital services is the ability to monitor system´s health and to respond to exceptional situations in a timely fashion. Log files contain information that a maintainer needs in figuring out causes for application failures or unexpected behavior. --------------------------------------------- http://blog.futurice.com/tech-pick-of-the-week-log-anomaly-detection-tools *** New Gmail image server proxies raise security risks *** --------------------------------------------- A new Gmail policy that allows e-mailed image attachments to load automatically comes at a price, say two security researchers. Google announced on Thursday that Gmail would once again load attached images by default. The feature had been disabled years ago, as a way of clamping down on malware and phishing attacks. --------------------------------------------- http://news.cnet.com/8301-1009_3-57615502-83/new-gmail-image-server-proxies… *** Top 8 breaches in 2013 *** --------------------------------------------- >From the headline-grabbing Adobe breach to LivingSocials password debacle, here are the top 8 breaches that have occurred this year and created even more security awareness. --------------------------------------------- http://www.scmagazine.com/top-8-breaches-in-2013/slideshow/1673/ *** Hacked Via RDP: Really Dumb Passwords *** --------------------------------------------- Businesses spend billions of dollars annually on software and hardware to block external cyberattacks, but a shocking number of these same organizations shoot themselves in the foot by poking gaping holes in their digital defenses and then advertising those vulnerabilities to attackers. Todays post examines an underground service which rents access to hacked PCs at organizations that make this all-too-common mistake. --------------------------------------------- http://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/ *** Safari Stores Previous Secure Browsing Session Data Unencrypted *** --------------------------------------------- The Safari browser stores data from previous sessions in an unencrypted format on a hidden folder that leaves users vulnerable to information loss. --------------------------------------------- http://threatpost.com/safari-stores-previous-secure-browsing-session-data-u… *** Debian update for php5 *** --------------------------------------------- https://secunia.com/advisories/55918 *** Cisco Unified Communications Manager - TFTP Service *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120093 *** libvirt Bugs Let Remote and Local Users Deny Service and Let Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1029444 *** Ruby Gem Webbynode 1.0.5.3 Command injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120095 *** Vuln: Monitorix HTTP Server handle_request() Remote Command Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/64178

1 0

Tageszusammenfassung - Donnerstag 12-12-2013
by Daily end-of-shift report 12 Dec '13

12 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 11-12-2013 18:00 − Donnerstag 12-12-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** How cybercriminals efficiently violate YouTube, Facebook, Twitter, Instagram, SoundCloud and Google+'s ToS *** --------------------------------------------- With social media, now an inseparable part of the marketing expenditures for every modern organization, cybercriminals quickly adapted to the ongoing buzz, and over the last couple of years, have been persistently supplying the market segment with social media metrics performance boosts, in the the form of bogus likes, dislikes, comments, favorites, subscribers, and video/music plays. --------------------------------------------- http://www.webroot.com/blog/2013/12/11/cybercriminals-efficiently-violate-m… *** Inside the TextSecure, CyanogenMod Integration *** --------------------------------------------- Moxie Marlinspike explains how Open WhisperSystems plans to bring end-to-end encrypted secure communications to major platforms such as Android, iOS and popular Web browsers. --------------------------------------------- http://threatpost.com/inside-the-textsecure-cyanogenmod-integration/103164 *** The Kernel is calling a zero(day) pointer - CVE-2013-5065 - Ring Ring *** --------------------------------------------- SpiderLabs investigates a number of suspicious binary files on a daily basis. A week ago we came across a PDF file which had two different vulnerabilities, a remote-code-execution vulnerability in Adobe Reader and a new escalation-of-privileges vulnerability in Windows Kernel. --------------------------------------------- http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-… *** Software defense: mitigating common exploitation techniques *** --------------------------------------------- In our previous posts in this series, we described various mitigation improvements that attempt to prevent the exploitation of specific classes of memory safety vulnerabilities such as those that involve stack corruption, heap corruption, and unsafe list management and reference count mismanagement. These mitigations are typically associated with a specific developer mistake such as writing beyond the bounds of a stack or heap buffer, failing to correctly track reference counts, and so on. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2013/12/11/software-defense-mitigati… *** Operation Ke3chang: Targeted Attacks Against Ministries of Foreign Affairs *** --------------------------------------------- This week, FireEye released a report detailing how Chinese-speaking advanced persistent threat (APT) actors systematically attacked European ministries of foreign affairs (MFAs). Within 24 hours, the Chinese government officially responded. --------------------------------------------- http://www.fireeye.com/blog/technical/malware-research/2013/12/operation-ke… *** Blog: Forecasts for 2014 - expert opinion *** --------------------------------------------- In 2014 we expect significant growth in the number of threats related to economic and domestic cyber-espionage, with cyber-mercenaries/cyber-detectives playing an active role in such attacks. --------------------------------------------- http://www.securelist.com/en/blog/8167/Forecasts_for_2014_expert_opinion Tausende Online-Shops auf Basis von xt:Commerce akut bedroht --------------------------------------------- Die Shop-Software xt:Commerce 3 und deren Ableger wie Gambio und Modified enthalten zwei Fehler, die es in Kombination erlauben, Shops komplett zu übernehmen. Ersten groben Schätzungen zufolge wird die Software ungefähr 50.000 Shops eingesetzt. Zum Glück gibt es Workarounds und Patches, um sich zu schützen. --------------------------------------------- http://www.heise.de/security/meldung/Tausende-Online-Shops-auf-Basis-von-xt… *** D-Link DSL-6740U Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55999 *** InstantCMS "orderby" SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/56041 *** PHP OpenSSL Extension X.509 Certificate Parsing Memory Corruption Vulnerability *** --------------------------------------------- https://secunia.com/advisories/56055 *** Adobe ColdFusion 9/10 Administrative Login Bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120084 *** Vtiger 5.4.0 Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120088 *** Plone Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/56015

1 0

Tageszusammenfassung - Mittwoch 11-12-2013
by Daily end-of-shift report 11 Dec '13

11 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 10-12-2013 18:00 − Mittwoch 11-12-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Summary for December 2013 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for December 2013. With the release of the security bulletins for December 2013, this bulletin summary replaces the bulletin advance notification originally issued December 5, 2013. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-dec *** Rotbrow: the Sefnit distributor *** --------------------------------------------- This months addition to the Microsoft Malicious Software Removal Tool is a family that is both old and new. Win32/Rotbrow existed as far back as 2011, but the first time we saw it used for malicious purposes was only in the past few months. In September, Geoff blogged about the dramatic resurgence of Win32/Sefnit (aka Mevade). At the time, we knew of several ways in which Sefnit was distributed, but we continued investigating how it was able to get on so many machines. When we concentrated on --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2013/12/10/rotbrow-the-sefnit-distr… *** Firefox 26 Makes Java Plugins Click-to-Play, Fixes 14 Security Flaws *** --------------------------------------------- Mozilla has released a major new version of Firefox, which includes fixes for more than a dozen security vulnerabilities as well as an important change that makes all Java plugins click-to-play be default. This feature prevents those plugins from running automatically on Web pages, which helps protect users against some Web-based attacks. The modification to […] --------------------------------------------- http://threatpost.com/firefox-26-makes-java-plugins-click-to-play-fixes-14-… *** DSA-2815 munin *** --------------------------------------------- Christoph Biedl discovered two denial of service vulnerabilities in munin, a network-wide graphing framework. --------------------------------------------- http://www.debian.org/security/2013/dsa-2815 *** Zero-Day Fixes From Adobe, Microsoft *** --------------------------------------------- Adobe and Microsoft today each separately released security updates to remedy zero-day bugs and other critical vulnerabilities in their software. Adobe issued fixes for its Flash and Shockwave players, while Microsoft pushed out 11 updates addressing addressing at least two dozen flaws in Windows and other software. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/gWnv_MqLeM4/ *** WordPress 3.7.1 Maintenance Release *** --------------------------------------------- WordPress 3.7.1 is now available! This maintenance release addresses 11 bugs in WordPress 3.7 --------------------------------------------- http://wordpress.org/news/2013/10/wordpress-3-7-1/ *** Adobe Shockwave Player Two Memory Corruption Vulnerabilities *** --------------------------------------------- Two vulnerabilities have been reported in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system. 1) An unspecified error can be exploited to cause memory corruption. 2) Another unspecified error can be exploited to cause memory corruption. Successful exploitation of the vulnerabilities may allow execution of arbitrary code. --------------------------------------------- https://secunia.com/advisories/55952 *** Thought your Android phone was locked? THINK AGAIN *** --------------------------------------------- Another day, another vulnerability Android has taken another step to cement its place behind Java in the world of repeatedly-vulnerable software, with German group Curesec discovering that an attacker can get past users PINs to unlock the phone.… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/12/10/android_has… *** ENISA lists top cyber-threats in this year’s Threat Landscape Report. *** --------------------------------------------- The EU’s cyber security Agency ENISA has issued its annual Threat Landscape 2013 report, where over 200 publicly available reports and articles have been analysed. Questions addressed are: What are the top cyber-threats of 2013? Who are the adversaries? What are the important cyber-threat trends in the digital ecosystem? --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/enisa-lists-top-cyber-threa… *** HP Officejet Pro 8500 Printer Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- A vulnerability was reported in the HP Officejet Pro 8500 Printer. A remote user can conduct cross-site scripting attacks. The printer interface does not properly filter HTML code from user-supplied input before displaying the input. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the HP Printer interface and will run in the security context of that site... --------------------------------------------- http://www.securitytracker.com/id/1029466 *** A New Vulnerability in the Android Framework: Fragment Injection *** --------------------------------------------- We have recently disclosed a new vulnerability to the Android Security Team. The vulnerability affected many apps, including Settings (the one that is found on every Android device), Gmail, Google Now, DropBox and Evernote. To be more accurate, any App which extended the PreferenceActivity class using an exported activity was automatically vulnerable. --------------------------------------------- http://securityintelligence.com/new-vulnerability-android-framework-fragmen… *** TYPO3-FLOW-SA-2013-001: Cross-Site Scripting in TYPO3 Flow *** --------------------------------------------- Problem Description: The errorAction method in the ActionController base class of Flow returns error messages without properly encoding them. Because these error messages can contain user input, this could lead to a Cross-Site Scripting vulnerability in Flow driven applications. --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-flow/typo3-flow-sa… *** Creepware - Who’s Watching You? *** --------------------------------------------- Some people stick a piece of tape over the webcam on their laptop, maybe you even do it yourself. Are they over cautious, paranoid, a little strange? Are you? Or is there reason behind this madness? Many of us have heard the stories about people being spied on using their own computer or people being blackmailed using embarrassing or incriminating video footage unknowingly recorded from compromised webcams... --------------------------------------------- http://www.symantec.com/connect/blogs/creepware-who-s-watching-you *** Blog: The inevitable move - 64-bit ZeuS has come enhanced with Tor *** --------------------------------------------- The more people switch to 64-bit platforms, the more 64-bit malware appears. We have been following this process for several years now. The more people work on 64-bit platforms, the more 64-bit applications that are developed as well. Sometimes these include some very specific applications, for example, banking applications.... If someone wants to hack into an application like this and steal information, the best tool for that would also be a 64-bit agent. And what’s the most notorious --------------------------------------------- http://www.securelist.com/en/blog/208214171/The_inevitable_move_64_bit_ZeuS… *** TYPO3 Multiple Vulnerabilities *** --------------------------------------------- A weakness and multiple vulnerabilities have been reported in TYPO3, which can be exploited by malicious users to disclose sensitive information, conduct script insertion attacks, manipulate certain data, and bypass certain security restrictions and by malicious people to conduct cross-site scripting and spoofing attacks. --------------------------------------------- https://secunia.com/advisories/55958 *** SAProuter Authentication Bypass Security Bypass Vulnerability *** --------------------------------------------- ERPScan has reported a vulnerability in SAProuter, which can be exploited by malicious people to bypass certain security restrictions. The vulnerability is caused due to the application not properly restricting access to certain functionalities, which can be exploited to e.g. manipulate the configuration. --------------------------------------------- https://secunia.com/advisories/56060

1 0

Tageszusammenfassung - Dienstag 10-12-2013
by Daily end-of-shift report 10 Dec '13

10 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 09-12-2013 18:00 − Dienstag 10-12-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** French Government Spoofs Google Certificate *** --------------------------------------------- Google revoked digital certificates for some of its domains that had been fraudulently signed by an intermediate certificate authority with links to ANSSI, Frances cyber-defense agency. --------------------------------------------- http://threatpost.com/french-government-spoofs-google-certificate/103128 *** How We Decoded Some Nasty Multi-Level Encoded Malware *** --------------------------------------------- >From time to time, we come up with interesting bits of malware that are just calling us to decode and learn more about them. This is one of those cases. Recently, I crossed pathes with this little gem: That snippet is encoded malicious content. --------------------------------------------- http://blog.sucuri.net/2013/12/how-we-decoded-some-nasty-multi-level-encode… *** Microsoft Security Advisory (2916652): Improperly Issued Digital Certificates Could Allow Spoofing - Version: 1.0 *** --------------------------------------------- Microsoft is aware of an improperly issued subordinate CA certificate that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The subordinate CA certificate was improperly issued by the Directorate General of the Treasury (DG Trésor), subordinate to the Government of France CA (ANSSI), which is a CA present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue. --------------------------------------------- http://technet.microsoft.com/en-us/security/advisory/2916652 *** Untouched P2P Communication Infrastructure Keeps ZeroAccess Up and Running *** --------------------------------------------- Microsofts takedown of the ZeroAccess botnet wasnt a complete success. Experts point out that Microsoft targeted only the money-making aspects of the botnet, and that its communication protocol was untouched. --------------------------------------------- http://threatpost.com/untouched-p2p-communication-infrastructure-keeps-zero… *** The Curious Case of the Malicious IIS Module *** --------------------------------------------- Recently, we´ve seen a few instances of a malicious DLL that is installed as an IIS module making its rounds in forensic cases. This module is of particular concern as it is currently undetectable by almost all anti-virus products. The malware is used by attackers to target sensitive information in POST requests, and has mechanisms in place for data exfiltration. --------------------------------------------- http://blog.spiderlabs.com/2013/12/the-curious-case-of-the-malicious-iis-mo… *** CyanogenMod to have built in text message encryption system *** --------------------------------------------- People are now more concerned regarding their privacy after discovering about efforts made by governments to spy on their communications. The most practical solution to keep messages, emails and calls secure is to use a cryptographic encryption mechanism. However, just like the name of the method, the installation process is complex for most users. To solve this, CyanogenMod will come equipped with built in encryption system for text messages. --------------------------------------------- http://www.muktware.com/2013/12/cyanogenmod-built-text-message-encryption-s… *** Phantom menace? A guide to APTs - and why most of us have little to fear from these 'cyberweapons' *** --------------------------------------------- APTs - or Advanced Persistent Threats - are the most menacing cyber attack there is, some say. Orchestrated by teams of hundreds of experts, they penetrate systems so deeply that they can remain for years, stealing secrets by the terabyte. --------------------------------------------- http://www.welivesecurity.com/2013/12/09/phantom-menace-a-guide-to-apts-and… *** New security features added to Microsoft accounts *** --------------------------------------------- We´re excited to announce that over the next couple of days we´re rolling out a few new capabilities - based on your ongoing feedback - that give you more visibility and control of your Microsoft account. --------------------------------------------- http://blogs.technet.com/b/microsoft_blog/archive/2013/12/09/new-security-f… *** Analysis: Kaspersky Security Bulletin 2013. Overall statistics for 2013 *** --------------------------------------------- This section of the report forms part of the Kaspersky Security Bulletin 2013 and is based on data obtained and processed using Kaspersky Security Network. KSN integrates cloud-based technologies into personal and corporate products, and is one of Kaspersky Lab´s most important innovations. --------------------------------------------- http://www.securelist.com/en/analysis/204792318/Kaspersky_Security_Bulletin… *** November 2013 virus activity review from Doctor Web *** --------------------------------------------- December 2, 2013 Virus analysts at the Russian anti-virus company Doctor Web discovered and examined quite a variety of information security threats in November 2013. In particular, a Trojan targeting SAP business software and malware that generates fake search results on Windows machines were added to the Dr.Web virus database at the beginning of the month. --------------------------------------------- http://news.drweb.com/show/?i=4122&lng=en&c=9 *** DSA-2812 samba *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2812 *** RSA Security Analytics Core Can Be Accessed By Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1029446 *** pam_userdb password hashes arent compared case-sensitive *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120069 *** TYPO3-CORE-SA-2013-004: Multiple Vulnerabilities in TYPO3 CMS *** --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… *** McAfee Email Gateway 7.6 multiple vulnerabilities *** --------------------------------------------- http://seclists.org/fulldisclosure/2013/Dec/18

1 0

Tageszusammenfassung - Montag 9-12-2013
by Daily end-of-shift report 09 Dec '13

09 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 06-12-2013 18:00 − Montag 09-12-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** RuggedCom ROS Multiple Vulnerabilities *** --------------------------------------------- Siemens has reported to NCCIC/ICS-CERT multiple vulnerabilities in the RuggedCom Rugged OS (ROS). Siemens has produced a firmware update that mitigates these vulnerabilities. Exploitation of these vulnerabilities could allow an attacker to hijack an active Web session and access administrative functions on the devices without proper authorization. These vulnerabilities could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-340-01 *** The Biggest Security Stories of 2013 *** --------------------------------------------- As 2013 comes to a close, security experts are looking back at the major stories and developments of the year, including the Edward Snowden NSA leaks and major malware attacks. In this video, Vitaly Kamluk of Kaspersky Lab examines the biggest security news of 2013 and talks about the lasting effects they may have. --------------------------------------------- http://threatpost.com/the-biggest-security-stories-of-2013/103125 *** Microsoft teams up with Feds, Europol in ZeroAccess botnet zombie hunt *** --------------------------------------------- Just dont bork our crim-busting honeypots again Microsoft has teamed up with the FBI to launch a renewed attempt to disrupt the operations of the infamous ZeroAccess botnet. --------------------------------------------- http://www.theregister.co.uk/2013/12/06/zeroaccess_zombienet_takedown/ *** FAQ: Pony Malware Payload Discovery *** --------------------------------------------- Our team´s discovery of the spoils of yet another instance of Pony 1.9 has kept us busy the past couple of days. We´ve enjoyed explaining our discovery to journalists and trying our best to answer the questions that arise over social networks and email with each publication of a story. A lot of those questions tend to be similar. --------------------------------------------- http://blog.spiderlabs.com/2013/12/faq-pony-malware-payload-discovery.html *** 2014 Predictions: Blurring Boundaries *** --------------------------------------------- The past year has been an interesting one in the world of cyber security. Mobile malware has become a large-scale threat, government surveillance has users asking "does privacy still exist?", cybercrime continues to steal money from individuals and businesses, and new targets for hackers like AIS and SCADA have been identified. 2013 was many things, but boring was not one of them. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/2014-predictions… *** The state of targeted attacks *** --------------------------------------------- Trusteer announced the results of a recent study on the State of Targeted Attacks, which took into consideration the feedback from over 750 IT and IT security practitioners who have involvement in defensive efforts against APTs launched at their organisations. --------------------------------------------- http://www.net-security.org/secworld.php?id=16059 *** Android-Apps: Sicherheitslücke durch fehlerhafte SSL-Prüfung *** --------------------------------------------- Das Fraunhofer-Institut für Sichere Informationstechnologie hat mehrere Android-Apps ausfindig gemacht, bei denen die fehlerhafte Prüfung des SSL-Zertifikats den Zugriff auf Zugangsdaten möglich macht. Nur etwa die Hälfte aller kontaktierten Hersteller hat die Sicherheitslücke bisher geschlossen. --------------------------------------------- http://www.golem.de/news/android-apps-sicherheitsluecke-durch-fehlerhafte-s… *** The world´s most dangerous mobile phone spying app just moved into the tablet and iPad market *** --------------------------------------------- The evolution of GPS and the smart-phone market has spawned a macabre industry of surveillance apps designed to be covertly installed onto the cellphones of vulnerable employees, business associates, partners and children. --------------------------------------------- http://www.privacysurgeon.org/blog/incision/the-worlds-most-dangerous-mobil… *** Bypassing Windows AppLocker using a Time of Check Time of Use vulnerability *** --------------------------------------------- Windows AppLocker is Microsoft´s replacement to Software Restriction Policies in Windows 7, Windows 8, Server 2008 and Server 2012. Windows AppLocker has been promoted by several government agencies such as the National Security Agency and the New Zealand National Cyber Security Center as an effective mechanism to combat the execution of unauthorized code on modern Microsoft Windows based systems. --------------------------------------------- http://www.nccgroup.com/media/495634/2013-12-04_-_ncc_-_technical_paper_-_b… *** Automater - IP URL and MD5 OSINT Analysis *** --------------------------------------------- Automater is a URL/Domain, IP Address, and Md5 Hash OSINT tool aimed at making the analysis process easier for intrusion Analysts. Given a target (URL, IP, or HASH) or a file full of targets Automater will return relevant results from sources like the following: IPvoid.com, Robtex.com, Fortiguard.com, unshorten.me, Urlvoid.com, Labs.alienvault.com, ThreatExpert, VxVault, and VirusTotal. --------------------------------------------- http://www.tekdefense.com/automater/ *** Drei GIMP-Lücken auf einen Streich *** --------------------------------------------- Das Sicherheits-Team von Red Hat hat drei Speicherverwaltungsprobleme in der Bildverarbeitungssoftware GIMP gefunden und beseitigt, die dazu ausgenutzt werden könnten, dem Benutzer Schadcode unterzuschieben. --------------------------------------------- http://www.heise.de/security/meldung/Drei-GIMP-Luecken-auf-einen-Streich-20… *** Malicious multi-hop iframe campaign affects thousands of Web sites, leads to a cocktail of client-side exploits - part two *** --------------------------------------------- Ever since we exposed and profiled the evasive, multi-hop, mass iframe campaign that affected thousands of Web sites in November, we continued to monitor it, believing that the cybercriminal(s) behind it, would continue operating it, basically switching to new infrastructure once the one exposed in the post got logically blacklisted, thereby undermining the impact of the campaign internationally. --------------------------------------------- http://www.webroot.com/blog/2013/12/09/malicious-multi-hop-iframe-campaign-… *** Putting malware in the picture *** --------------------------------------------- Spammers actively spread malware using fake notifications on behalf of various financial and banking institutions, booking and delivery services and other companies. The arsenal of tricks used by cybercriminals is constantly being updated. In particular, in recent years we have registered a number of English- and German-language mass mailings in which the attackers try to hide malware under photos and pictures. --------------------------------------------- https://www.securelist.com/en/blog/8159/Putting_malware_in_the_picture *** [webapps] - Zimbra 0day exploit / Privilegie escalation via LFI *** --------------------------------------------- http://www.exploit-db.com/exploits/30085 *** D-Link DSR Router Remote Root Shell Exploit *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120055 *** WordPress DZS Video Gallery 3.1.3 Remote File Disclosure *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120050 *** cURL Certificate Validation Flaw Lets Remote Users Spoof SSL Servers *** --------------------------------------------- http://www.securitytracker.com/id/1029434 *** Security Bulletin: Multiple Security vulnerability fix for IBM Tivoli Storage Manager Administration Center (CVE-2012-5081, CVE-2013-0169, CVE-2013-0443). *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Steinberg MyMp3PRO SEH buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89468

1 0

Tageszusammenfassung - Freitag 6-12-2013
by Daily end-of-shift report 06 Dec '13

06 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 05-12-2013 18:00 − Freitag 06-12-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Advance Notification Service for December 2013 Security Bulletin Release *** --------------------------------------------- Today we're providing advance notification for the release of 11 bulletins, five Critical and six Important, for December 2013. The Critical updates address vulnerabilities in Internet Explorer, Windows, Microsoft Exchange and GDI+. The Critical update for GDI+ fully addresses the publicly disclosed issue described in Security Advisory 2896666. This release won't include an update for the issue described in Security Advisory 2914486. We're still working to develop a security... --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/12/05/advance-notification-ser… *** Google Docs Scam Stealing Passwords *** --------------------------------------------- Scammers are up to mischief again by tricking users into clicking false webmail widgets. The core goal of any phishing attempt is to compromise the victims access to a particular service. Usually this is done by posing as the service the attacker wants to hijack from the victim, and sending the username and password information back to the attacker. Ive seen plenty phishing schemes in the --------------------------------------------- http://research.zscaler.com/2013/12/google-docs-scam-stealing-passwords-in.… *** Study finds zero-day vulnerabilities abound in popular software *** --------------------------------------------- Organizations selling exploits for vulnerabilities in software from major companies including Microsoft, Apple, Oracle, and Adobe --------------------------------------------- http://www.csoonline.com/article/744307/study-finds-zero-day-vulnerabilitie… *** EU cyber security Agency ENISA argues that better protection of SCADA Systems is needed *** --------------------------------------------- How long can we afford having critical infrastructures that use unpatched SCADA systems, the EU's cyber security Agency ENISA asks? ENISA argues that the EU Member States could proactively deploy patch management to enhance the security of SCADA systems. --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/eu-cyber-security-agency-en… *** Hacking a Reporter: Sleepless Nights Outside a Brooklyn Brownstone (Part 3 of 3) *** --------------------------------------------- This post is the conclusion of a three-part series that goes into more depth about our experience hacking journalist Adam Penenberg, which resulted in an article on PandoDaily in October. Parts one and two detail the malware aspects of our hack with contributions from Josh Grunzweig, Matt Jakubowski and Daniel Chechik. I, Garret Picchioni (voted to be the bald hacker with a heart tattoo in the original article artwork), will discuss the details of the... --------------------------------------------- http://blog.spiderlabs.com/2013/12/hacking-a-reporter-sleepless-nights-outs… *** Weekly Metasploit Update: SAP and Silverlight *** --------------------------------------------- We've been all SAP all the time here in the Independent Nations of Metasploit, and expect to be for the rest of the week. You might recall that Metasploit exploit dev, Juan Vazquez published his SAP survey paper a little while back; on Tuesday, we did a moderated twitter chat on the hashtag #pwnSAP with the major SAP-focused Metasploit contributors Bruno Morrison, Chris John Riley, and Dave Hartley; and today (Thursday, December 5), Juan and I will be hosting a webcast on the various and sundry SAP exposures that Metasploit covers, and There Will Be Demos and Q&A, so it should be fun. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/12/05/weekly-me… *** CVE-2013-3346/5065 Technical Analysis *** --------------------------------------------- In our last post, we warned of a new Windows local privilege escalation vulnerability being used in the wild. We noted that the Windows bug (CVE-2013-5065) was exploited in conjunction with a patched Adobe Reader bug (CVE-2013-3346) to evade the... --------------------------------------------- http://www.fireeye.com/blog/technical/cyber-exploits/2013/12/cve-2013-33465… *** Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Control Center *** --------------------------------------------- A number of security vulnerabilities have been discovered in the Java Runtime Environment and the Cognos Business Intelligence components included in IBM SCC.CVE(s): CVE-2013-1557, CVE-2013-1478, CVE-2013-1571, CVE-2013-1500, CVE-2013-2988, CVE-2013-2978 and CVE-2013-0586 Affected product(s) and affected version(s): IBM InfoSphere Information Server Versions 8.0, 8.1, 8.5, 8.7, and 9.1 running on all platforms Refer to the following reference URLs for remediation and additional vulnerability... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Information Server (CVE-2013-4066 and CVE-2013-4067) *** --------------------------------------------- Multiple security vulnerabilities exist in the IBM JRE that is shipped with the Rational Reporting for Development Intelligence (RRDI). The same security vulnerabilities also exist in the IBM Java SDK that is shipped with the IBM WebSphere Application Server (WAS). CVE(s): CVE-2013-4066 and CVE-2013-4067 Affected product(s) and affected version(s): IBM InfoSphere Information Server Versions 8.0, 8.1, 8.5, 8.7, and 9.1 running on all platforms Refer to the following reference URLs for... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** Sonicwall GMS 7.x Filter Bypass *** --------------------------------------------- Topic: Sonicwall GMS 7.x Filter Bypass Risk: Low Text:Document Title: Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability References (Source): == http... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120048 *** VMware ESX Server Service Console Two Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55917 *** SSA-568732 (Last Update 2013-12-06): Privilege Escalation in COMOS *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** WordPress JS Hotel Plugin "roomid" Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55919 *** NVIDIA Graphics Drivers GPU Access Privilege Escalation Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55904 *** HP-UX update for Java *** --------------------------------------------- https://secunia.com/advisories/55978 *** IBM Forms Viewer XFDL buffer overflow *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/87911

1 0

Tageszusammenfassung - Donnerstag 5-12-2013
by Daily end-of-shift report 05 Dec '13

05 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 04-12-2013 18:00 − Donnerstag 05-12-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Phishing-Mail ködert WordPress-Admins *** --------------------------------------------- Mit einer kostenlosen Version eines beliebten SEO-Plugins für WordPress versuchen Spammer, Administratoren zu ködern. Das Plugin entpuppt sich als Malware, dass eine Hintertür im Server öffnet und Besucher der Seite infiziert. --------------------------------------------- http://www.heise.de/security/meldung/Phishing-Mail-koedert-WordPress-Admins… *** In new campaign, Dexter point-of-sale malware strikes U.S. and abroad *** --------------------------------------------- After recently impacting banks in South Africa, the malware is now infecting point-of-sale systems throughout the globe, including those in the U.S., a security firm found. --------------------------------------------- http://www.scmagazine.com/in-new-campaign-dexter-point-of-sale-malware-stri… *** Bugtraq: [PT-2013-63] Hash Length Extension in HTMLPurifier *** --------------------------------------------- http://www.securityfocus.com/archive/1/530142 *** SA-CONTRIB-2013-097 - OG Features - Access bypass *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2013-097 Project: OG Features (third-party module)Version: 6.x Date: 2013-December-04Security risk: Not Critical Exploitable from: Remote Vulnerability: Access bypass --------------------------------------------- https://drupal.org/node/2149791 *** Siemens SINAMICS S/G Authentication Bypass Vulnerability *** --------------------------------------------- Siemens has identified an authentication bypass vulnerability in the SINAMICS S/G product family. Siemens has produced a firmware update that mitigates this vulnerability and has tested the update to validate that it resolves the vulnerability. Exploitation of this vulnerability could allow an attacker to access administrative functions on the device without authentication. This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-338-01 *** Security Bulletins: Rational Insight and Rational Reporting for Development Intelligence - Oracle CPU June 2013 (CVE-2013-2407, CVE-2013-2450) *** --------------------------------------------- Multiple security vulnerabilities exist in the IBM JRE that is shipped with Rational Insight and Rational Reporting for Development Intelligence. --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_rat… https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_rat… *** IBM QRadar SIEM Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55895 https://secunia.com/advisories/55891 *** Imagam iFiles 1.16.0 File Inclusion / Shell Upload / Command Injection *** --------------------------------------------- Topic: Imagam iFiles 1.16.0 File Inclusion / Shell Upload / Command Injection Risk: High Text:Document Title: Imagam iFiles v1.16.0 iOS - Multiple Web Vulnerabilities References (Source): == http://ww... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120038 *** bugs in IJG jpeg6b & libjpeg-turbo *** --------------------------------------------- jpeg6b and some of its optimized clones (e.g., libjpeg-turbo) will use uninitialized memory when decoding images with missing SOS data for the luminance component (Y) in presence of valid chroma data (Cr, Cb). --------------------------------------------- http://www.securityfocus.com/archive/1/530137 *** IQ3 Series Trend LAN Controllers "ovrideStart" Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55827

1 0

Tageszusammenfassung - Mittwoch 4-12-2013
by Daily end-of-shift report 04 Dec '13

04 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 03-12-2013 18:00 − Mittwoch 04-12-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Mitigating attacks on Industrial Control Systems (ICS); the new Guide from EU Agency ENISA *** --------------------------------------------- The EU's cyber security agency ENISA has provided a new manual for better mitigating attacks on Industrial Control Systems (ICS), supporting vital industrial processes primarily in the area of critical information infrastructure (such as the energy and chemical transportation industries) where sufficient knowledge is often lacking. As ICS are now often connected to Internet platforms, extra security preparations have to be taken. This new guide provides the necessary key considerations... --------------------------------------------- http://www.enisa.europa.eu/media/press-releases/mitigating-attacks-on-indus… *** Elecsys Director Gateway Improper Input Validation Vulnerability *** --------------------------------------------- Adam Crain of Automatak and independent researchers Chris Sistrunk and Adam Todorski have identified an improper input validation in the Elecsys Director Gateway application. Elecsys has produced a patch that mitigates this vulnerability. Adam Todorski has tested the patch to validate that it resolves the vulnerability.This vulnerability could be exploited remotely. --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-337-01 *** Ruby on Rails Multiple Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, and Generate Unsafe Queries *** --------------------------------------------- Ruby on Rails Multiple Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, and Generate Unsafe Queries --------------------------------------------- http://www.securitytracker.com/id/1029420 *** Cisco ONS 15454 Controller Cards Can Be Reset By Remote Users *** --------------------------------------------- http://www.securitytracker.com/id/1029421 *** D-Link DIR Series Routers __show_info.php information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89343

1 0

Tageszusammenfassung - Dienstag 3-12-2013
by Daily end-of-shift report 03 Dec '13

03 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 02-12-2013 18:00 − Dienstag 03-12-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** A Pentester's Introduction to SAP & ABAP *** --------------------------------------------- If you’re conducting security assessments on enterprise networks, chances are that you’ve run into SAP systems. In this blog post, I’d like to give you an introduction to SAP and ABAP to help you with your security audit. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/12/02/a-pentest… *** Analysis: Kaspersky Security Bulletin 2013. Malware Evolution *** --------------------------------------------- Once again, it’s time for us to deliver our customary retrospective of the key events that have defined the threat landscape in 2013. Let’s start by looking back at the things we thought would shape the year ahead, based on the trends we observed in the previous year. --------------------------------------------- http://www.securelist.com/en/analysis/204792316/Kaspersky_Security_Bulletin… *** How does the NSA break SSL? *** --------------------------------------------- A few weeks ago I wrote a long post about the NSAs BULLRUN project to subvert modern encryption standards. I had intended to come back to this at some point, since I didnt have time to discuss the issues in detail. --------------------------------------------- http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html *** On Covert Acoustical Mesh Networks in Air *** --------------------------------------------- Fraunhofer FKIE, Wachtberg, Germany Abstract: Covert channels can be used to circumvent system and network policies by establishing communications that have not been considered in the design of the computing system. We construct a covert channel between different computing systems that utilizes audio modulation/demodulation to exchange data between the computing systems over the air medium. The underlying network stack is based on a... --------------------------------------------- http://www.jocm.us/index.php?m=content&c=index&a=show&catid=124&id=600 *** Cisco ASA Malformed DNS Reply Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DNS code of Cisco ASA Software could allow an unauthenticated, remote attacker to cause the reload of an affected system. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013… *** phpThumb 1.7.12 Server Side Request Forgery *** --------------------------------------------- Topic: phpThumb 1.7.12 Server Side Request Forgery Risk: Low Text:#phpThumb phpThumbDebug Server Side Request Forgery #Google Dork: inurl:phpThumb.php #Author: Rafay Baloch And Deepanker Ar... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120020 *** Folo theme for WordPress jplayer.swf cross-site scripting *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89318 *** Orange Themes for WordPress upload-handler.php file upload *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89325 *** Zend Framework application.ini information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89328 *** TP-Link TD-8840t change administrator password cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89329 *** JMultimedia component for Joomla! phpThumb.php file upload *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89333 *** Bugtraq: Multiple issues in OpenSSL - BN (multiprecision integer arithmetics). *** --------------------------------------------- http://www.securityfocus.com/archive/1/530120 *** Bugtraq: D-Link DIR-XXX remote root access exploit. *** --------------------------------------------- http://www.securityfocus.com/archive/1/530119

1 0

Tageszusammenfassung - Montag 2-12-2013
by Daily end-of-shift report 02 Dec '13

02 Dec '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-11-2013 18:00 − Montag 02-12-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** SMS-Angriff zwingt Nexus-Smartphones in die Knie *** --------------------------------------------- Der Empfang vieler Flash-SMS-Nachrichten soll Google-Nexus-Geräte rebooten. Davon betroffen sind auch Nexus-Smartphones mit aktuellem Android 4.4 (Kitkat). --------------------------------------------- http://www.heise.de/security/meldung/SMS-Angriff-zwingt-Nexus-Smartphones-i… *** Windows TIFF-Lücke bereits seit Juli ausgenutzt - Patch Fehlanzeige *** --------------------------------------------- Bereits im Sommer wurden E-Mails verschickt, die mit TIFF-Bildern eine kürzlich bekannt gewordene Windows-Lücke ausnutzten. Und während die Zahl dieser Schädlinge weiter wächst, gibt es immer noch keinen Patch vom Microsoft. --------------------------------------------- http://www.heise.de/security/meldung/Windows-TIFF-Luecke-bereits-seit-Juli-… *** Nachholbedarf beim Schutz von industriellen Kontrollsystemen *** --------------------------------------------- Sicherheitsprobleme mit industriellen Kontrollsystemen machen immer wieder Schlagzeilen. Das BSI gibt Betreibern nun mit einem 124-seitigen Leitfaden bewährte Methoden an die Hand, um ihre Systeme abzusichern. --------------------------------------------- http://www.heise.de/security/meldung/Nachholbedarf-beim-Schutz-von-industri… *** Important Security Update for D-Link Routers *** --------------------------------------------- D-Link has released an important security update for some of its older Internet routers. The patch closes a backdoor in the devices that could let attackers seize remote control over vulnerable routers. --------------------------------------------- krebsonsecurity.com/2013/12/important-security-update-for-d-link-routers/ *** File Sharing Apps Expose iOS To Security Risks - Trustwave *** --------------------------------------------- File sharing apps for Apple iOS mobile devices can potentially represent a security risk to users, according to a Trustwave security researcher. --------------------------------------------- http://www.techweekeurope.co.uk/news/researcher-file-sharing-apps-expose-io… *** Manipulation of hard drive firmware to conceal entire partitions *** --------------------------------------------- Tools created by the computer hacking community to circumvent security protection on hard drives can have unintentional consequences for digital forensics. Tools originally developed to circumvent Microsoft's Xbox 360 hard drive protection can be used, independently of the Xbox 360 system, to change the reported size/model of a hard drive enabling criminals to hide data from digital forensic software and hardware. --------------------------------------------- https://www.comp.glam.ac.uk/staff/kxynos/papers/read13-DI-HDD-manipulation.… *** Description of Cumulative Update 3 for Exchange Server 2013 *** --------------------------------------------- This article describes Cumulative Update 3 for Microsoft Exchange Server 2013 that provides the latest fixes for Exchange Server 2013 and contains stability and performance improvements. --------------------------------------------- http://support.microsoft.com/kb/2892464 *** Uptime Agent 5.0.1 Stack Overflow Vulnerability *** --------------------------------------------- Topic: Uptime Agent 5.0.1 Stack Overflow Vulnerability Risk: Medium Text:# Exploit Title: Up.Time Agent 5.0.1 Stack Overflow # Date: 28/11/2013 # Exploit Author: Denis Andzakovic # Vendor Homepage:... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013120009 *** Vuln: ABB MicroSCADA wserver.exe Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63901 *** Vuln: Jenkins Exclusion Plugin CVE-2013-6373 Unspecified Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63876 *** Google Nexus SMS Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029414

1 0

Tageszusammenfassung - Freitag 29-11-2013
by Daily end-of-shift report 29 Nov '13

29 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-11-2013 18:00 − Freitag 29-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Stealing Credit Cards - A WordPress and vBulletin Hack *** --------------------------------------------- What better way to celebrate Thanksgiving than to share an interesting case that involves two of the most popular CMS applications out there - vBulletin and WordPress. Here is a real case that we just worked on this week, involving an attacker dead set on stealing credit card information. Enjoy! The Environment The client runs... --------------------------------------------- http://blog.sucuri.net/2013/11/stealing-credit-cards-a-wordpress-and-vbulle… *** JPEG Files Used For Targeted Attack Malware *** --------------------------------------------- We recently came across some malware of the SOGOMOT and MIRYAGO families that update themselves in an unusual way: they download JPEG files that contain encrypted configuration files/binaries. Not only that, we believe that this activity has been ongoing since at least the middle of 2010. A notable detail of the malware we came across... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/l94pQWbJ28g/ *** Security Bulletin: IBM BladeCenter Advanced Management Module Account Information Exposure (CVE-2013-6718) *** --------------------------------------------- An interface on the IBM BladeCenter Advanced Management Module (AMM) may expose user account names and passwords that have been configured on that AMM. CVE(s): CVE-2013-6718 Affected product(s) and affected version(s): These IBM BladeCenter Advanced Management Module Firmware versions are affected: v3.64B (BPET64B, BBET64B, and BPEO64B) v3.64C (BPET64C, BBET64C, and BPEO64C) v3.64G (BPET64G, BBET64G, and BPEO64G) This applies to the following hardware products: BladeCenter --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** Google Android com.android.settings Lets Local Applications Remove Device Locks *** --------------------------------------------- http://www.securitytracker.com/id/1029410 *** Cisco IOS XR SNMP Memory Leak Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029408 *** Cisco IOS XE MPLS Processing Flaw Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029407 *** Joomla! All Video Share Component "avssearch" SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55888 *** FFmpeg Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55802 *** WordPress Highlight - Powerful Premium Theme Arbitrary File Upload Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55671 *** WordPress Store Locator Plugin Cross-Site Request Forgery Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55276

1 0

Tageszusammenfassung - Donnerstag 28-11-2013
by Daily end-of-shift report 28 Nov '13

28 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-11-2013 18:00 − Donnerstag 28-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Fake 'October´s Billing Address Code' (BAC) form themed spam campaign leads to malware *** --------------------------------------------- Have you received a casual-sounding email enticing you into signing a Billing Address Code (BAC) form for October, in order for the Payroll Manager to proceed with the transaction? Based on our statistics, tens of thousands of users received these malicious spam emails over the last 24 hours, with the cybercriminal(s) behind them clearly interested in expanding the size of their botnet through good old fashioned 'casual social engineering' campaigns. --------------------------------------------- http://www.webroot.com/blog/2013/11/27/fake-octobers-billing-address-code-b… *** Sharik Back for More After Php.Net Compromise *** --------------------------------------------- Sharik is a Trojan which injects itself into legitimate processes and adds registry entries for an added level of persistence. The infection also sends information about the victims PC to a remote server. The threat can also receive commands from a known CnC server to download further malicious files. --------------------------------------------- http://research.zscaler.com/2013/11/sharik-back-for-more-after-phpnet.html *** ATM Traffic + TCPDump + Video = Good or Evil?, (Wed, Nov 27th) *** --------------------------------------------- I was working with a client recently, working through the move of a Credit Union branch. In passing, he mentioned that they were looking at a new security camera setup, and the vendor had mentioned that it would need a SPAN or MIRROR port on the switch set up. At that point my antennae came online - SPAN or MIRROR ports set up a session where all packets from one switch ports are "mirrored" to another switch port. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17111 *** Microsoft Security Advisory (2914486): Vulnerability in Microsoft Windows Kernel Could Allow Elevation of Privilege - Version: 1.0 *** --------------------------------------------- Microsoft is investigating new reports of a vulnerability in a kernel component of Windows XP and Windows Server 2003. We are aware of limited, targeted attacks that attempt to exploit this vulnerability. --------------------------------------------- http://technet.microsoft.com/en-ca/security/advisory/2914486 *** THOUSANDS of Ruby on Rails sites leave logins lying around *** --------------------------------------------- A security researcher has warned that a Ruby on Rails vulnerability first outlined in September is continuing to linger on the Web, courtesy of admins that don't realise a vulnerability exists in its default CookieStore session storage mechanism. --------------------------------------------- http://www.theregister.co.uk/2013/11/28/thousands_of_ror_sites_leave_logins… *** FakeAV + Ransomware = Windows Expert Console *** --------------------------------------------- During the last months we have been talking mainly about police virus infections, and more recently about CryptoLocker, the new major ransomware family. However that doesn´t mean that our good 'old friends' known as FakeAV aren´t around. --------------------------------------------- http://pandalabs.pandasecurity.com/fakeav-ransomware-windows-expert-console/ *** Linux Worm Targeting Hidden Devices *** --------------------------------------------- Symantec has discovered a new Linux worm that appears to be engineered to target the 'Internet of things'. The worm is capable of attacking a range of small, Internet-enabled devices in addition to traditional computers. Variants exist for chip architectures usually found in devices such as home routers, set-top boxes and security cameras. --------------------------------------------- http://www.symantec.com/connect/blogs/linux-worm-targeting-hidden-devices *** You have a Skype voicemail. PSYCHE! Its just some fiendish Trojan-flinging spam *** --------------------------------------------- A spam run of fake Skype voicemail alert emails actually comes packed with malware, a UK police agency warns. Action Fraud said the zip file attachments come contaminated with a variant of the notorious ZeuS banking Trojan. --------------------------------------------- http://www.theregister.co.uk/2013/11/28/skype_voicemail_alert_spam_flings_z… *** Microsoft Cybersecurity Report: Top 10 Most Wanted Enterprise Threats *** --------------------------------------------- The latest report found that in the enterprise environment, on average about 11% of systems encountered malware, worldwide between the third quarter of 2012 (3Q12) and the second quarter of 2013 (2Q13). The "encounter rate" is defined as the percentage of computers running Microsoft real-time security software that report detecting malware - typically resulting in a blocked installation of malware. --------------------------------------------- http://blogs.technet.com/b/security/archive/2013/11/25/microsoft-cybersecur… *** Quassel IRC Backlog Access Bypass Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55640 *** DSA-2804 drupal7 *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2804 *** DSA-2803 quagga *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2803 *** HP Service Manager and ServiceCenter Unspecified Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029400 *** Subversion mod_dontdothat Path Validation Flaw Lets Remote Users Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1029402 *** Yahoo Open Redirect Vulnerability or "Designing vulnerabilities" *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110200 *** ownCloud Unspecified Security Bypass Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55792

1 0

Tageszusammenfassung - Mittwoch 27-11-2013
by Daily end-of-shift report 27 Nov '13

27 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-11-2013 18:00 − Mittwoch 27-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** The Season For Danger: Holiday Season Spam And Phishing *** --------------------------------------------- For many, the holiday season is a season for shopping and spending. But cybercriminals see it in a different light-they see it as a prime opportunity to steal. Take, for example, online shopping. Malicious websites to try and trick online shoppers into giving them their money instead of the legitimate shopping websites. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-season-for-d… *** InMobi: Another Vulnaggressive Adware Opens Billions of JavaScript 'Sidedoors' on Android Devices *** --------------------------------------------- FireEye mobile security researchers identified another new mobile threat, which we call 'JavaScript Sidedoors', which we discovered in the popular InMobi ad library. InMobi exposes dangerous behaviors such as making phone calls without user consent through JavaScript interfaces, which creates a 'sidedoor' for attackers to exploit by injecting malicious JavaScript through hijacking InMobi's HTTP traffic. ... --------------------------------------------- http://www.fireeye.com/blog/technical/vulnerabilities/2013/11/inmobi-anothe… *** Ruby on Rails CookieStore Vulnerability Plagues Prominent Websites *** --------------------------------------------- Websites using an older version of Ruby on Rails, including Kickstarter and UrbanSpoon, remain vulnerable to a vulnerability in the frameworks cookie storage mechanism. --------------------------------------------- http://threatpost.com/ruby-on-rails-cookiestore-vulnerability-plagues-promi… *** An Anti-Fraud Service for Fraudsters *** --------------------------------------------- Many online businesses rely on automated fraud detection tools to weed out suspicious and unauthorized purchases. Oddly enough, the sorts of dodgy online businesses advertised by spam do the same thing, only they tend to use underground alternatives that are far cheaper and tuned to block not only fraudulent purchases, but also "test buys" from security researchers, law enforcement and other meddlers. --------------------------------------------- http://krebsonsecurity.com/2013/11/anti-fraud-service-for-fraudsters/ *** Security and policy surrounding bring your own devices (BYOD) *** --------------------------------------------- As the proliferation of devices continues to capture the imagination of consumers, and has ignited what is referred to as bring your own device (BYOD) revolution, many IT departments across the globe are now facing increased security considerations. While organizations encourage BYOD for cost savings and productivity, it is also important to have robust security policies supporting BYOD. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2013/11/26/security-and-policy-surr… *** Our protection metrics - October results *** --------------------------------------------- Last month we introduced our monthly protection metrics and talked about our September results. Today, we'd like to talk about our results from October. If you want a refresh on the definition of the metrics we use in our monthly results, see our prior post: Our protection metrics - September results. During October 2013, while our rate of incorrect detections remained low, and our performance metrics stayed fairly consistent, the infection rate of 0.18 percent was higher in --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2013/11/26/our-protection-metrics-o… *** White hat Wi-Fi hacking shows vulnerability of business data *** --------------------------------------------- White hat hackers have shown that usernames, passwords, contact lists, details of e-commerce accounts and banking details can be sniffed easily from public Wi-Fi hotspots. --------------------------------------------- http://www.computerweekly.com/news/2240209927/White-hat-Wi-Fi-hacking-shows… *** Volatility 2.3 and FireEyes diskless, memory-only Trojan.APT.9002 *** --------------------------------------------- FireEyes Operation Ephemeral Hydra: IE Zero-Day Linked to DeputyDog Uses Diskless Method, posted 10 NOV 2013 is specific to an attack that "loaded the payload directly into memory without first writing to disk." As such, this "will further complicate network defenders ability to triage compromised systems, using traditional forensics methods." --------------------------------------------- http://holisticinfosec.blogspot.co.uk/2013/11/volatility-23-and-fireeyes-di… *** Malware creation hits record-high numbers In 2013, according to PandaLabs Q3 Report *** --------------------------------------------- Panda Security, The Cloud Security Company, has just published the results of its Quarterly Report for Q3 2013, drawn up by PandaLabs, the company's anti-malware laboratory. One of the main conclusions that can be drawn from this global study is that malware creation has hit a new record high, with nearly 10 million new strains identified so far this year. --------------------------------------------- http://press.pandasecurity.com/news/malware-creation-hits-record-high-numbe… *** Security Headers on the Top 1,000,000 Websites: November 2013 Report *** --------------------------------------------- It has been almost exactly a year since we conducted the first top 1 million security headers report so it is a great time to re-run the analysis and see how well security header adoption is growing. As before, the latest Chrome and Firefox User-Agent strings were used to make requests to the top 1 million sites over both HTTP and HTTPS. --------------------------------------------- https://www.veracode.com/blog/2013/11/security-headers-on-the-top-1000000-w… *** Finding Cryptolocker Encrypted Files using the NTFS Master File Table *** --------------------------------------------- For the most part, everyone seems to be familiar with the new variants of Cyptolocker making the rounds these days. To quickly summarize, this form of ransomware that encrypts documents and pictures found on local and mapped network drives in an attempt to obtain payment for the decryption keys. --------------------------------------------- http://securitybraindump.blogspot.ru/2013/11/finding-cryptolocker-encrypted… *** Rogue that takes webcam pictures of you *** --------------------------------------------- Recently we heard of a rogue fake antivirus that takes screenshots and webcam images in an attempt to further scare you into succumbing to it's scam. We gathered a sample and sure enough, given some time it will indeed use the webcam and take a picture of what's in front of the camera at that time. This variant is called "Antivirus Security Pro" and it's as nasty as you can get. --------------------------------------------- http://www.webroot.com/blog/2013/11/27/new-rogue-now-takes-screenshots/ *** Vuln: Drupal Core Image Module HTML Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63848 *** Xen Privileged Ring Access Flaw Lets Local Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1029396 *** Debian Security Advisory DSA-2804 drupal7 *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2804 *** Debian Security Advisory DSA-2803 quagga *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2803

1 0

Tageszusammenfassung - Dienstag 26-11-2013
by Daily end-of-shift report 26 Nov '13

26 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-11-2013 18:00 − Dienstag 26-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Rätselhafte Entführungen im Internet *** --------------------------------------------- Geheimdienste müssen gar nicht direkt am Kabel lauschen. Der Netzwerkdienstleister Renesys berichtet von einer deutlichen Zunahme von seltsamen Routing-Vorfällen, bei denen Netzwerkverkehr über andere Länder, manchmal sogar Kontinente umgeleitet wird. --------------------------------------------- http://www.heise.de/security/meldung/Raetselhafte-Entfuehrungen-im-Internet… *** The Need for Incident Response *** --------------------------------------------- On an average day in the UK more than 100 .co.uk domain websites are hacked according to the statistics in the Zone-h.org online database. Website hacks are increasing the volume of targeted attacks today. --------------------------------------------- http://www.fireeye.com/blog/corporate/2013/11/the-need-for-incident-respons… *** Fake tech support scam is trouble for legitimate remote help company *** --------------------------------------------- Fraud victims mistake legitimate tech company for fraudsters. --------------------------------------------- http://arstechnica.com/information-technology/2013/11/fake-tech-support-sca… *** VBScript Malware SOYSOS Deletes CAD Files *** --------------------------------------------- Cybercriminals can do just as much damage deleting users´ data as stealing it because file deletion can result in both data or monetary loss. One example would be CryptoLocker, which became notorious for combining the two - demanding money with the threat of data destruction. We recently came across a malware, detected as VBS_SOYSOS, that deletes important image files including .DWG files. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/vbscript-malware… *** Surge in "BlackShades" infections exposes machines worldwide to RAT *** --------------------------------------------- Over the last two months, attackers have opted to spread the malware via the Neutrino exploit kit, researchers found. --------------------------------------------- http://www.scmagazine.com/surge-in-blackshades-infections-exposes-machines-… *** A Look At A Silverlight Exploit *** --------------------------------------------- Recently, independent security researchers found that the Angler Exploit Kit had added Silverlight to their list of targeted software, using CVE-2013-0074. When we analyzed the available exploit, we found that in addition to CVE-2013-0074, a second vulnerability, CVE-2013-3896, in order to bypass ASLR. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-a-silv… *** [Honeypot Alert] More PHP-CGI Scanning (apache-magika.c) *** --------------------------------------------- In the past 24 hours, one of the WASC Distributed Web Honeypot participant's sensors picked up continued scanning for CVE-2012-1823 which is a vulnerability within PHP-CGI. --------------------------------------------- http://blog.spiderlabs.com/2013/11/honeypot-alert-more-php-cgi-scanning-apa… *** New Exploit Kit Atrax Boasts Tor Connectivity, Bitcoin Extraction *** --------------------------------------------- Yet another commercial crimekit has been spotted making the rounds on the underground malware forums that uses the anonymity network Tor to stealthily communicate with its command and control servers. --------------------------------------------- http://threatpost.com/new-exploit-kit-atrax-boasts-tor-connectivity-bitcoin… *** The internet mystery that has the world baffled *** --------------------------------------------- For the past two years, a mysterious online organisation has been setting the worlds finest code-breakers a series of seemingly unsolveable problems. But to what end? Welcome to the world of Cicada 3301. --------------------------------------------- http://www.telegraph.co.uk/technology/internet/10468112/The-internet-myster… *** Das Stuxnet-Duo: Bösartige Geschwister *** --------------------------------------------- Der deutsche Experte Ralph Langner hat nach drei Jahren Analyse ein abschließendes Papier zu Stuxnet vorgelegt. Demnach besteht die Cyber-Waffe aus zwei Schädlingen, von denen nur die zweite richtig bekannt wurde - zu Unrecht, meint Langner. --------------------------------------------- http://www.heise.de/security/meldung/Das-Stuxnet-Duo-Boesartige-Geschwister… *** Analysis: Online banking faces a new threat *** --------------------------------------------- Neverquest supports just about every possible trick on online bank attacks. In light of Neverquest´s self-replication capabilities, the number of users attacked could increase over a short period of time. --------------------------------------------- http://www.securelist.com/en/analysis/204792315/Online_banking_faces_a_new_… *** Nachholbedarf bei IT-Sicherheit: EU-Parlamentarier tappten in Hotspot-Falle *** --------------------------------------------- Alle EU-Parlamentarier sollen jetzt dringend ihre Passwörter ändern, fordert eine Mail der IT-Abteilung. Sie bestätigt, dass durch Angriffe im ungesicherten Parlaments-WLAN Zugangspasswörter ausspioniert wurden. --------------------------------------------- http://www.heise.de/security/meldung/Nachholbedarf-bei-IT-Sicherheit-EU-Par… *** How To Combat Online Surveillance *** --------------------------------------------- Governments have transformed the internet into a surveillance platform, but they are not omnipotent. They´re limited by material resources as much as the rest of us. We might not all be able to prevent the NSA and GCHQ from spying on us, but we can at least create more obstacles and make surveilling us more expensive. The more infrastructure you run, the safer the communication will be. --------------------------------------------- http://theoccupiedtimes.org/?p=12362 *** Why Crimekit Atrax will attract attention *** --------------------------------------------- CSIS researchers have observed an introduction of a new commercial crimekit being sold on several underground web forums. The kit is dubbed 'Atrax' and is both a cheap kit - costs less than $250 for the main platform - as well as it utilizes the TOR protocol for stealthy communication with C&Cs from where it is intended to get instructions, updates and new modules. --------------------------------------------- https://www.csis.dk/en/csis/blog/4103 *** Blackhole and Cool Exploit Kits Nearly Extinct *** --------------------------------------------- When authorities in Russia arrested Paunch, the alleged creator of the Blackhole exploit kit, last month, security researchers and watchers of the malware underground predicted that taking him off the board would put a dent in the use of Blackhole and force its customers onto other platforms. Six weeks later, it now appears that Blackhole is almost gone and the Cool exploit kit, another alleged creation of Paunch, has essentially disappeared, as well. --------------------------------------------- http://threatpost.com/blackhole-and-cool-exploit-kits-nearly-extinct/103034 *** IBM WebSphere Application Server Java Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55870 *** WordPress Contact Form 7 3.5.2 Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110177 *** WordPress Pinboard Shell Upload *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110175 *** TPLINK WR740N / WR740ND Cross Site Request Forgery *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110181 *** NETGEAR ReadyNAS Perl Code Evaluation *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110179 *** Vuln: HP LoadRunner Virtual User Generator CVE-2013-4837 Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63475 *** Bugtraq: Open-Xchange Security Advisory 2013-11-25 *** --------------------------------------------- http://www.securityfocus.com/archive/1/530008

1 0

Tageszusammenfassung - Montag 25-11-2013
by Daily end-of-shift report 25 Nov '13

25 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-11-2013 18:00 − Montag 25-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Second Look at Stuxnet Reveals Older Dangerous Variant *** --------------------------------------------- ICS expert Ralph Langner has thrown back the covers on Stuxnet revealing a two-pronged attack intent not only on disrupting Irans nuclear capabilities, but flexing the attackers muscle in building weaponized malware. --------------------------------------------- http://threatpost.com/second-look-at-stuxnet-reveals-older-dangerous-varian… *** Google fixes flaw in Gmail password reset process *** --------------------------------------------- According to the researcher who discovered the bug, Google swiftly addressed the security issue, which could leave users passwords vulnerable to theft. --------------------------------------------- http://www.scmagazine.com/google-fixes-flaw-in-gmail-password-reset-process… *** Five Years Old And Still On The Run: DOWNAD *** --------------------------------------------- Five years ago, Conficker/DOWNAD was first seen and quickly became notorious due to how quickly it spread and how much damage it caused. Remarkably, after all that time, it´s still alive. It can still pose a serious problem, as it can propagate to other systems on the same network as an infected machine - a factor that may explain its high rate of infection to this day. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/five-years-old-a… *** Another Fake WordPress Plugin - And Yet Another SPAM Infection! *** --------------------------------------------- We clean hundreds and thousands of infected websites, a lot of the cleanups can be considered to be somewhat "routine". If you follow our blog, you often hear us say we´ve seen "this" numerous times, we´ve cleaned "that" numerous times. --------------------------------------------- http://blog.sucuri.net/2013/11/another-fake-wordpress-plugin-and-yet-anothe… *** Top Security Predictions for 2014 *** --------------------------------------------- As 2013 draws to a close, FireEye researchers are already looking ahead to 2014 and the shifting threat landscape. Expect fewer Java zero-day exploits and more browser-based ones. Watering-hole attacks may supplant spear-phishing attacks. --------------------------------------------- http://www.fireeye.com/blog/corporate/2013/11/top-security-predictions-for-… *** Port 0 DDOS, (Fri, Nov 22nd) *** --------------------------------------------- Following on the stories of amplification DDOS attacks using Chargen, and stories of "booters" via Brian Kreb's, I am watching with interest the increase in port 0 amplification DDOS attacks. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17081 *** Spam-Friendly Registrar 'Dynamic Dolphin' Shuttered *** --------------------------------------------- The organization that oversees the Internet domain name registration industry last week revoked the charter of Dynamic Dolphin, a registrar that has long been closely associated with spam and cybercrime. --------------------------------------------- http://krebsonsecurity.com/2013/11/spam-friendly-registrar-dynamic-dolphin-… *** LG smart TV snooping extends to home networks, second blogger says *** --------------------------------------------- A second blogger has published evidence that his LG-manufactured smart television is sharing sensitive user data with the Korea-based company in a post that offers support for the theory that the snooping isnt isolated behavior that affects a small number of sets. --------------------------------------------- http://arstechnica.com/security/2013/11/lg-smart-tv-snooping-extends-to-hom… *** CryptoLocker gang teams with botnet-builders on ransomware *** --------------------------------------------- The cyber-gang running the CryptoLocker extortion racket is sharing a big cut of any payments they squeeze out of their victims with criminal botnet owners working closely with them, says Symantec, which has been monitoring this underworld activity online. --------------------------------------------- http://www.pcworld.com/article/2066741/cryptolocker-gang-teams-with-botnet-… *** DSA-2802 nginx *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2802 *** DSA-2801 libhttp-body-perl *** --------------------------------------------- http://www.debian.org/security/2013/dsa-2801 *** [webapps] - TPLINK WR740N/WR740ND - Multiple CSRF Vulnerabilities *** --------------------------------------------- http://www.exploit-db.com/exploits/29802 *** ImpressPages CMS 3.8 Stored XSS Vulnerability *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110168 *** Pirelli Discus DRG A125g Remote Change SSID Value Vulnerability *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110167 *** Google Gmail IOS Mobile Application - Persistent / Stored XSS *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110170 *** Ruby Heap Overflow in Floating Point Parsing Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1029388 *** Drupal Core Bugs Let Remote Users Conduct Cross-Site Scripting, Cross-Site Request Forgery, and Open Redirect Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1029386

1 0

Tageszusammenfassung - Freitag 22-11-2013
by Daily end-of-shift report 22 Nov '13

22 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-11-2013 18:00 − Freitag 22-11-2013 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** DNP3 Implementation Vulnerability (Update A) *** --------------------------------------------- Adam Crain of Automatak and independent researcher Chris Sistrunk reported an improper input validation vulnerability to NCCIC/ICS-CERT that was evident in numerous slave and/or master station software products. The researchers emphasize that the vulnerability is not with the DNP3 stack but with the --------------------------------------------- http://ics-cert.us-cert.gov/advisories/ICSA-13-291-01A *** Facebook Vulnerability Discloses Friends Lists Defined as Private *** --------------------------------------------- Researchers from the Quotium Seeker Research Center identified a security flaw in Facebook privacy controls. The vulnerability allows attackers to see the friends list of any user on Facebook. This attack is carried out by abusing the 'People You May Know' mechanism on Facebook, ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110157 *** Imperva WAF/DAF 9.5 patch8 and 10.0 patch 2 localroot vulnerability *** --------------------------------------------- Topic: Imperva WAF/DAF 9.5 patch8 and 10.0 patch 2 localroot vulnerability Risk: High Text: Imperva use hardened centos 5.4 to run Web Application Firewall and Database Activity Monitoring product. It could be expl... --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110158 *** Instagram for iOS Flattr account security bypass *** --------------------------------------------- Instagram for iOS could allow a remote attacker to bypass security restrictions, caused by an implementation error when the Instagram for iOS and Flattr are linked. An attacker could exploit this vulnerability by flattring the photos causing the money from the users account to be redirected. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89162 *** Instagram for iOS upload module file upload *** --------------------------------------------- Instagram for iOS could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious PHP script, which could allow the attacker to execute arbitrary PHP code on the vulnerable system. --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89160 *** prettyPhoto Cross-Site Scripting Vulnerability *** --------------------------------------------- Input appended to the URL after /#!prettyPhoto/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. The vulnerability is confirmed in version 3.1.4. Prior versions may also be affected. --------------------------------------------- https://secunia.com/advisories/55769 *** Security Bulletin: IBM iNotes Cross-Site Scripting Vulnerability (CVE-2013-0595) *** --------------------------------------------- IBM iNotes versions 8.5.3 and 9.0 contain a cross-site scripting vulnerability. The fix for this issue is available starting in IBM Domino versions 8.5.3 Fix Pack 5 and 9.0.1. CVE(s): CVE-2013-0595 Affected product(s) and affected version(s): IBM iNotes 9.0 IBM iNotes 8.5.3 through 8.5.3 Fix Pack 4 --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm… *** VU#893462: Thomson Reuters Velocity Analytics Vhayu Analytic Server version 6.9.4 build 2995 contains a code injection vulnerability *** --------------------------------------------- Overview Thomson Reuters Velocity Analytics Vhayu Analytic Server version 6.94 build 2995 and possibly earlier versions contain a code injection vulnerability (CWE-94). Description CWE-94: Improper Control of Generation of Code (Code Injection) --------------------------------------------- http://www.kb.cert.org/vuls/id/893462 *** Dovecot checkpassword-reply Security Bypass Security Issue *** --------------------------------------------- A security issue has been reported in Dovecot, which can be exploited by malicious, local users to bypass certain security restrictions. --------------------------------------------- https://secunia.com/advisories/54808

1 0

Tageszusammenfassung - Donnerstag 21-11-2013
by Daily end-of-shift report 21 Nov '13

21 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-11-2013 18:00 − Donnerstag 21-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** EFF Scorecard Shows Crypto Leaders and Laggards *** --------------------------------------------- The Electronic Frontier Foundation (EFF) released its Encrypt the Web Report demonstrating how much encryption leading Internet companies and service providers are deploying. --------------------------------------------- http://threatpost.com/eff-scorecard-shows-crypto-leaders-and-laggards/102987 *** Tomcat-Wurm springt von Server zu Server *** --------------------------------------------- Symantec hat einen Wurm entdeckt, der Apaches Java-Webserver infiziert und als Java-Servlet von Server zu Server springt. Infizierte Rechner werden als DDoS-Schleudern und Proxys missbraucht. --------------------------------------------- http://www.heise.de/security/meldung/Tomcat-Wurm-springt-von-Server-zu-Serv… *** Are large scale Man in The Middle attacks underway?, (Thu, Nov 21st) *** --------------------------------------------- Renesys is reporting two separate incidents where they observed traffic for 1500 IP blocks being diverted for extended periods of time. They observed the traffic redirection for more than 2 months over the last year. Does it seem unusual for internet traffic between Ashburn Virginia (63.218.44.78) and Washington DC (63.234.113.110) to go through Russia to Belarus? That is exactly what they observed. Once traffic flows through your routers there are countless opportunities to capture and modify... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17075&rss *** A look at security effectiveness by industry *** --------------------------------------------- BitSight analyzed security ratings for over 70 Fortune 200 companies in four industries - energy, finance, retail and technology. The objective was to uncover quantifiable differences in security effectiveness and performance across industries from October 2012 through September 2013. --------------------------------------------- http://www.net-security.org/secworld.php?id=15991 *** 5 Considerations For Post-Breach Security Analytics *** --------------------------------------------- Preparing collection mechanisms ahead of time, preserving chain of custody on forensics data, and performing focused analysis all key in inspecting security data after a compromise --------------------------------------------- http://www.darkreading.com/5-considerations-for-post-breach-securit/2401641… *** EMC Document Sciences xPression cross-site request forgery *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/89073 *** SA-CORE-2013-003 - Drupal core - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2013-003 Project: Drupal coreVersion: 6.x, 7.x Date: 2013-November-20 Security risk: Highly critical Exploitable from: Remote Vulnerability: Multiple vulnerabilities Description: Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.Multiple vulnerabilities due to optimistic cross-site request forgery protection (Form API validation - Drupal 6 and 7)Drupals form API has built-in cross-site request forgery (CSRF) validation, and also allows any... --------------------------------------------- https://drupal.org/SA-CORE-2013-003 *** SA-CONTRIB-2013-096 - Entity reference - Access bypass *** *** SA-CONTRIB-2013-095 - Organic Groups - Access bypass *** *** SA-CONTRIB-2013-094 - EU Cookie Compliance - Cross Site Scripting (XSS) *** *** SA-CONTRIB-2013-093 - Invitation - Access Bypass *** --------------------------------------------- https://drupal.org/node/2140237 https://drupal.org/node/2140217 https://drupal.org/node/2140123 https://drupal.org/node/2140097 *** Vuln: SAP NetWeaver SHSTI_UPLOAD_XML() Function XML External Entity Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63779 *** Vuln: SAP NetWeaver Logviewer Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/58615 *** Vuln: SAP NetWeaver SAP Portal URI Redirection Weakness *** --------------------------------------------- http://www.securityfocus.com/bid/63783 *** Vuln: SAProuter NI Route Message Handling Heap Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/60054 *** Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Master Data Management - Collaborative Edition (CVE-2013-0478, CVE-2013-0477) *** --------------------------------------------- IBM InfoSphere Master Data Management - Collaborative Edition versions 10.1, 10.0 and IBM InfoSphere Master Data Management Server for Product Information Management versions 9.1, 9.0, 6.0 are vulnerable to cross-site scripting and content spoofing. CVE(s): CVE-2013-0477, and CVE-2013-0478 Affected product(s) and affected version(s): IBM InfoSphere Master Data Management - Collaborative Edition Versions 10.1 and 10.0 IBM InfoSphere Master Data Management Server for Product Information... --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_mul… *** SKIDATA RFID Freemotion.Gate Unauthenticated Web Service Aribtrary Remote Command Execution *** --------------------------------------------- Title: SKIDATA RFID Freemotion.Gate Unauthenticated Web Service Aribtrary Remote Command Execution Product: Freemotion.Gate Vendor: SKIDATA, http://www.skidata.com/en/ Vulnerable Versions: 4.1.3.5 and likely all prior versions. --------------------------------------------- http://www.keepingkidsonshred.com/2013/11/skidata-rfid-freemotiongate.html *** Splunk Cross-Site Scripting Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55774 *** WHMCS "unserialize()" PHP Code Execution and Multiple Unspecified Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55717

1 0

Tageszusammenfassung - Mittwoch 20-11-2013
by Daily end-of-shift report 20 Nov '13

20 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-11-2013 18:00 − Mittwoch 20-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** New variant of Android ransomware "Fake Defender" surfaces *** --------------------------------------------- Symantec researchers believe the malicious app is a variant of "Fake Defender," malware used in earlier ransomware scams. --------------------------------------------- http://www.scmagazine.com/new-variant-of-android-ransomware-fake-defender-s… *** Google Extends Scope of External Bug Bounty *** --------------------------------------------- Google has expanded the bounds of its Patch Rewards Program to include open source components of Android, Apache, Sendmail, OpenVPN and other services. --------------------------------------------- http://threatpost.com/google-extends-scope-of-external-bug-bounty/102962 *** TrustKeeper Scan Engine Update - November 14, 2013 *** --------------------------------------------- It's time again for another TrustKeeper Scan Engine update. This release contains over 30 new tests vulnerabilities in Cisco ASA/IOS, JIRA, jQuery, Microsoft Windows, Oracle Database/MySQL, and more. This release also contains default credential checks for both WordPress and Cisco ASA SSL VPN (aka: AnyConnect). --------------------------------------------- http://blog.spiderlabs.com/2013/11/trustkeeper-scan-engine-update-november-… *** VU#295276: Adobe ColdFusion is vulnerable to cross-site scripting via the logviewer directory *** --------------------------------------------- Adobe ColdFusion 10 update 11 and possibly earlier versions contains a reflected cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary HTML content (including script) within the /logviewer/ directory. The vulnerability requires using a relative path, although there is no directory traversal vulnerability. --------------------------------------------- http://www.kb.cert.org/vuls/id/295276 *** Understanding Google´s Blacklist Cleaning Your Hacked Website and Removing From Blacklist *** --------------------------------------------- Today we found an interesting case where Google was blacklisting a client´s site but not sharing the reason why. The fact they were sharing very little info should not be new, but what we found as we dove a little deeper should be. The idea is to provide you webmasters with the required insight toRead More --------------------------------------------- http://blog.sucuri.net/2013/11/understanding-googles-blacklist-cleaning-you… *** Searching live memory on a running machine with winpmem, (Wed, Nov 20th) *** --------------------------------------------- Winpmem may appear to be a simple a memory acquisition tool, but it is really much more. One of my favorite parts of Winpmem is that it has the ability to analyze live memory on a running computer. Rather than dumping the memory and analyzing it in two seperate steps you can search for memory on a running system. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17063 *** Netflixers Beware: Angler Exploit Kit Targets Silverlight Vulnerability *** --------------------------------------------- Developers behind the Angler Exploit Kit have added a new exploit over the last week that leverages a vulnerability in Microsoft´s Silverlight framework. --------------------------------------------- http://threatpost.com/netflixers-beware-angler-exploit-kit-targets-silverli… *** Mobile threats in October 2013 *** --------------------------------------------- In 2013, Russian anti-virus company Doctor Web started using a new system to collect statistics, so that it could promptly obtain information about the malicious applications that are threatening Google Android. An analysis of the data collected in October showed that the Dr.Web resident monitor under Android detected malware about 11 million times, and over 4 million threats to Android were detected by the scanner. These figures correspond to data obtained in September 2013. --------------------------------------------- http://news.drweb.com/show/?i=4061&lng=en&c=9 *** Repeated attacks hijack huge chunks of Internet traffic, researchers warn *** --------------------------------------------- Man-in-the-middle attacks divert data on scale never before seen in the wild. --------------------------------------------- http://arstechnica.com/security/2013/11/repeated-attacks-hijack-huge-chunks… *** US police department pays $750 Cryptolocker Trojan ransom demand *** --------------------------------------------- A US police department was so determined to get back important files that had been encrypted by the rampaging Cryptolocker Trojan it decided to pay the sizable ransom being demanded by the criminals. --------------------------------------------- http://news.techworld.com/security/3489937/us-police-department-pays-750-cr… *** Backup the best defense against (Cri)locked files *** --------------------------------------------- Crilock also known as CryptoLocker - is one notorious ransomware that´s been making the rounds since early September. Its primary payload is to target and encrypt your files, such as your pictures and Office documents. All of the file types that can be encrypted are listed in our Trojan:Win32/Crilock.A and Trojan:Win32/Crilock.B descriptions. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2013/11/19/backup-the-best-defense-… *** JBoss Attacks Up Since Exploit Code Disclosure *** --------------------------------------------- Researchers at Imperva have detected a surge in attacks against webservers running JBoss Application Server since the public disclosure of exploit code last month. --------------------------------------------- http://threatpost.com/jboss-attacks-up-since-exploit-code-disclosure/102971 *** [webapps] - Ruckus Wireless Zoneflex 2942 Wireless Access Point - Authentication Bypass *** --------------------------------------------- http://www.exploit-db.com/exploits/29709 *** nginx URI Parsing Flaw Lets Remote Users Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1029363 *** PayPal Billsafe Cross Site Scripting *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110142 *** EMC Document Sciences xPression XSS / CSRF / Redirect / SQL Injection *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110139

1 0

Tageszusammenfassung - Dienstag 19-11-2013
by Daily end-of-shift report 19 Nov '13

19 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-11-2013 18:00 − Dienstag 19-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Am I Sending Traffic to a "Sinkhole"?, (Mon, Nov 18th) *** --------------------------------------------- It has become common practice to setup "Sinkholes" to capture traffic sent my infected hosts to command and control servers. These Sinkholes are usually established after a malicious domain name has been discovered and registrars agreed to redirect respective NS records to a specific name server configured by the entity operating the Sinkhole. More recently for example Microsoft gained court orders to take over... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17048 *** Google Completes Upgrade of its SSL Certificates to 2048-Bit RSA *** --------------------------------------------- Google announced today it has completed upgrading all of its SSL certificates to 2048-bit RSA or better, up from 1024. --------------------------------------------- http://threatpost.com/google-completes-upgrade-of-its-ssl-certificates-to-2… *** Facebook URL redirection vulnerability patched *** --------------------------------------------- A Facebook URL redirection vulnerability discovered last week was patched just a day after a blog post detailing the bug went live. --------------------------------------------- http://www.scmagazine.com//facebook-url-redirection-vulnerability-patched/a… *** Winpmem - Mild mannered memory aquisition tool??, (Tue, Nov 19th) *** --------------------------------------------- There should be little argument that with todays threats you should always acquire a memory image when dealing with any type of malware. Modern desktops can have 16 gigabytes of RAM or more filled with evidence that is usually crutial to understanding what was happening on that machine. Failure to acquire that memory will make analyzing the other forensic artifacts difficult or in some cases impossible. Chad Tilbury (@chadtilbury) recently told me about a new memory acquisition tool that I want... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17054&rss *** Old JBoss vuln in the wild, needs patching *** --------------------------------------------- Remote code execution, the usual thing JBoss sysadmins need to get busy hardening their systems, with a rising number of attacks against the system, according to Imperva. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/11/19/old_jboss_v… *** Cybercriminals spamvertise tens of thousands of fake "Sent from my iPhone" themed emails, expose users to malware *** --------------------------------------------- Cybercriminals are currently mass mailing tens of thousands of malicious emails, supposedly including a photo attachment that's been "Sent from an iPhone". The social engineering driven spam campaign is, however, the latest attempt by a cybercriminal/group of cybercriminals that we've been monitor for a while, to attempt to trick gullible users into unknowingly joining the botnet operated by the malicious actor(s) behind the campaign. Detection rate for the spamvertised... --------------------------------------------- http://www.webroot.com/blog/2013/11/19/cybercriminals-spamvertise-tens-thou… *** A .BIT Odd *** --------------------------------------------- Like many security researchers, I see a lot of new malicious sites every week, far too many in fact. One thing that sets security researchers apart is that we can see a top-level domain (TLD) like .cc and recall instantly that it belongs to the Cocos Islands in the Indian Ocean, with a tiny population,... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rFeNuxSPHUg/ *** Vuln: Chainfire SuperSU CVE-2013-6775 Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63715 *** Vuln: Multiple Android Superuser Packages CVE-2013-6769 Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63712 *** Opera Unspecified Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55720 *** Network Security Services (NSS) Multiple Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55557 *** Vuln: MIT Kerberos 5 CVE-2013-6800 Remote Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63770 *** Elastix Multiple Cross-Site Scripting Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55739 *** Splunk Test Scripts Let Remote Authenticated Users Execute Arbitrary Shell Scripts on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1029316

1 0

Tageszusammenfassung - Montag 18-11-2013
by Daily end-of-shift report 18 Nov '13

18 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-11-2013 18:00 − Montag 18-11-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** Password hack of vBulletin.com fuels fears of in-the-wild 0-day attacks *** --------------------------------------------- Hacks on sites using the widely used forum software spread to its maker. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/FIA9t0-8N04/story01… *** BKDR_SHIZ Responsible For SAP Attacks, And More *** --------------------------------------------- There have been recent reports of malware that targeted SAP users for information theft. We detect this threat as BKDR_SHIZ.TO, and it belongs to a malware family that has been detected since 2010. So far, this particular family has received little attention, but its targeting of SAP applications has raised its profile considerably. So what... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/O578f6Dl3Js/ *** Exploiting the Supermicro Onboard IPMI Controller *** --------------------------------------------- Last week @hdmoore published the details about several vulnerabilities into the Supermicro IPMI firmware. With the advisory's release, several modules were landed into Metasploit in order to check Supermicro's device against several of the published vulnerabilities. --------------------------------------------- https://community.rapid7.com/community/metasploit/blog/2013/11/15/exploitin… *** Explaining and Speculating About QUANTUM *** --------------------------------------------- Nicholas Weaver has a great essay explaining how the NSAs QUANTUM packet injection system works, what we know it does, what else it can possibly do, and how to defend against it. Remember that while QUANTUM is an NSA program, other countries engage in these sorts of attacks as well. By securing the Internet against QUANTUM, we protect ourselves against... --------------------------------------------- https://www.schneier.com/blog/archives/2013/11/explaining_and.html *** Various Schneier Audio and Video Talks and Interviews *** --------------------------------------------- News articles about me (or with good quotes by me). My talk at the IETF Vancouver meeting on NSA and surveillance. Im the first speaker after the administrivia. Press articles about me and the IETF meeting. Other video interviews with me.... --------------------------------------------- https://www.schneier.com/blog/archives/2013/11/various_schneie.html *** Sagan as a Log Normalizer, (Sat, Nov 16th) *** --------------------------------------------- "Sagan is an open source (GNU/GPLv2) high performance, real-time log analysis & correlation engine that run under *nix operating systems (Linux/FreeBSD/ OpenBSD/etc)."[1] Sagan is a log analysis engine that uses structure rules with the same basic structure as Snort rules. The alerts can be written to a Snort IDS/IPS database in the Unified2 file format using Barnyard2. This mean the alerts can be read using Sguil, BASE or SQueRT to name a few. It is easy to setup, just need to --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17039&rss *** SpiderLabs Radio November 15, 2013 w/ Space Rogue *** --------------------------------------------- This weeks episode of SpiderLabs Radio hosted by Space Rogue is brought to you by Trustwave SpiderLabs and features stories about Stuxnet on ISS, Facebook scans for Adobe, MacRumours, SEA hits Vice, bitcash.cz, Cracked gets cracked, Loyaltybuild, No Nukes in JP, OWASP AppSec USA, SRs Last SLR and more! Listen to SpiderLabs radio in iTunes. Or you can download the MP3 file directly here. Or listen right from your browser with this embedded player. --------------------------------------------- http://blog.spiderlabs.com/2013/11/spiderlabs-radio-november-15-2013-w-spac… *** Vendor of TDoS products/services releases new multi-threaded SIP-based TDoS tool *** --------------------------------------------- Telephony Denial of Service Attacks (TDoS) continue representing a growing market segment within the Russian/Eastern European underground market, with more vendors populating it with propositions for products and services aiming to disrupt the phone communications of prospective victims. From purely malicious in-house infrastructure - dozens of USB hubs with 3G USB modems using fraudulently obtained, non-attributable SIM cards - abuse of legitimate infrastructure, like Skype, ICQ, a... --------------------------------------------- http://www.webroot.com/blog/2013/11/15/vendor-tdos-productsservices-release… *** Bugtraq: Cross-Site Scripting (XSS) in Tweet Blender Wordpress Plugin *** --------------------------------------------- http://www.securityfocus.com/archive/1/529853 *** Vuln: GnuTLS libdane/dane.c CVE-2013-4487 Incomplete Fix Remote Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/63469 *** MS13-095 - Important : Vulnerability in Digital Signatures Could Allow Denial of Service (2868626) - Version: 1.0 *** --------------------------------------------- This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service when an affected web service processes a specially crafted X.509 certificate. --------------------------------------------- http://technet.microsoft.com/en-gb/security/bulletin/ms13-095 *** SAP Netweaver Web Application Server J2EE SAP Portal Redirection Weakness *** *** SAP Netweaver DataCollector and JavaDumpService Servlets Multiple Cross-Site Scripting Vulnerabilities *** *** SAP NetWeaver Input Validation Flaw in SRTT_GET_COUNT_BEFORE_KEY_RFC Function Lets Remote Authenticated Users Inject SQL Commands *** --------------------------------------------- https://secunia.com/advisories/55778 https://secunia.com/advisories/55777 http://www.securitytracker.com/id/1029352 *** gitlab-shell Multiple Vulnerabilities *** *** GitLab API Access Security Bypass Security Issue *** --------------------------------------------- https://secunia.com/advisories/55683 https://secunia.com/advisories/55691 *** IBM Tivoli System Automation Application Manager Java Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55794 *** Foreman Host and Host Group SQL Injection Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55722 *** [webapps] - ManageEngine DesktopCentral 8.0.0 build 80293 - Arbitrary File Upload Vulnerability *** --------------------------------------------- http://www.exploit-db.com/exploits/29674

1 0

Tageszusammenfassung - Freitag 15-11-2013
by Daily end-of-shift report 15 Nov '13

15 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-11-2013 18:00 − Freitag 15-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Blog: The rush for CVE-2013-3906 - a hot commodity *** --------------------------------------------- Two days ago FireEye reported that the recent CVE-2013-3906 exploit has begun to be used by new threat actors other than the original ones. The new infected documents share similarities with previously detected exploits but carry a different payload. This time these exploits are being used to deliver Taidoor and PlugX backdoors, according to FireEye. --------------------------------------------- http://www.securelist.com/en/blog/208214158/The_rush_for_CVE_2013_3906_a_ho… *** CVE-2012-1889 is still alive! *** --------------------------------------------- In Zscaler´s daily scanning, we identified an instance where CVE-2012-1889 (MSXML Uninitialized Memory Corruption Vulnerability) is still alive. Lets take a look. --------------------------------------------- http://research.zscaler.com/2013/11/cve-2012-1889-is-still-alive.html *** Febipos for Internet Explorer *** --------------------------------------------- In a previous blog post we discussed Trojan:JS/Febipos.A, a malicious browser extension that targets the Facebook profiles of Google Chrome and Mozilla Firefox users. We recently came across a new Febipos sample that was specifically developed for Internet Explorer - we detect it as Trojan:Win32/Febipos.B!dll. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2013/11/14/febipos-for-internet-exp… *** Linux backdoor squirts code into SSH to keep its badness buried *** --------------------------------------------- Fokirtor! It LOOKED like legitimate traffic... Security researchers have discovered a Linux backdoor that uses a covert communication protocol to disguise its presence on compromised systems. --------------------------------------------- http://www.theregister.co.uk/2013/11/15/stealthy_linux_backdoor/ *** Mobile Pwn2Own: Internet Explorer 11 geknackt, Chrome schon geflickt *** --------------------------------------------- Die von Pinkie Pie benutzte Chrome-Lücke wurde von Google mittlerweile geschlossen. Forscher der Zero Day Initiative gelang es unterdessen, Internet Explorer 11 auf einem Surface Pro zu übernehmen. --------------------------------------------- http://www.heise.de/security/meldung/Mobile-Pwn2Own-Internet-Explorer-11-ge… *** Blog: AutoCAD - new platform for start page Trojans *** --------------------------------------------- In China, start page Trojans have become a popular type of malware because by changing users´ browser start pages to point to some navigation site, the owner of the site can get a large amount of web traffic which can then be converted into large sums of money. In order to spread such Trojans as broadly as possible, Trojan authors have even turned their sights to AutoCAD. --------------------------------------------- http://www.securelist.com/en/blog/8141/AutoCAD_new_platform_for_start_page_… *** Research Into BIOS Attacks Underscores Their Danger *** --------------------------------------------- For three years, Dragos Ruiu has attempted to track down a digital ghost in his network, whose presence is only felt in strange anomalies and odd system behavior. The anomalies ranged from system instability, to "bricked" USB sticks and data seemingly modified on the fly, according to online posts. --------------------------------------------- http://www.darkreading.com/advanced-threats/research-into-bios-attacks-unde… *** Eight Security Predictions for 2014 *** --------------------------------------------- 2013 was not an easy year in cybersecurity and we expect 2014 attacks will be even more complex. In a new report out today, Websense Security Labs researchers collectively outlined eight predictions and recommendations for 2014. --------------------------------------------- http://community.websense.com/blogs/securitylabs/archive/2013/11/14/eight-s… *** The Security Impact of HTTP Caching Headers, (Fri, Nov 15th) *** --------------------------------------------- Earlier this week, an update for Media-Wiki fixed a bug in how it used caching headers. The headers allowed authenticated content to be cached, which may lead to sessions being shared between users using the same proxy server. I think this is a good reason to talk a bit about caching in web applications and why it is important for security. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=17033&rss *** Google Chrome for Android Multiple Memory Corruption Vulnerabilities *** --------------------------------------------- https://secunia.com/advisories/55744 *** Nagios XI "tfPassword" SQL Injection Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55695 *** VMSA-2013-0013 *** --------------------------------------------- VMware Workstation host privilege escalation vulnerability --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2013-0013.html *** Cisco IOS CSG Parse Error Drop Function Flaw Lets Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1029342 *** Cisco ASA IPv6 NAT Bug Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1029341 *** mod_nss FakeBasicAuth authentication bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110110 *** APPLE-SA-2013-11-14-1 iOS 7.0.4 *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2013/Nov/msg00000.ht… *** Security Bulletin: IBM Platform Cluster Manager Standard Edition (CVE-2013-2251 CVE-2013-2248 CVE-2013-2135 CVE-2013-2134 CVE-2013-2115 CVE-2013-1966 CVE-2013-1965 CVE-2013-4310) *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_ibm…

1 0

Tageszusammenfassung - Donnerstag 14-11-2013
by Daily end-of-shift report 14 Nov '13

14 Nov '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-11-2013 18:00 − Donnerstag 14-11-2013 18:00 Handler: Matthias Fraidl Co-Handler: n/a *** Stanford Metaphone Project Aims to Show Dangers of Metadata Collection *** --------------------------------------------- When the first NSA surveillance story broke in June, about the agency´s collection of phone metadata from Verizon, most people likely had never heard the word metadata before. Even some security and privacy experts weren´t sure what the term encompassed, and now a group of security researchers at Stanford have started a new project to collect data from Android users to see exactly how much information can be drawn from the logs of phone calls and texts. --------------------------------------------- http://threatpost.com/stanford-metaphone-project-aims-to-show-dangers-of-me… *** Thunderbird gibt falschem Absender das Echtheits-Siegel *** --------------------------------------------- Eigentlich sollen digitale Signaturen sicherstellen, dass man sich auf den Absender einer E-Mail verlassen kann. Allerdings stellt sich Thunderbird im Umgang mit signierten E-Mails so ungeschickt an, dass man falsche Absender vortuschen kann. --------------------------------------------- http://www.heise.de/security/meldung/Thunderbird-gibt-falschem-Absender-das… *** Unusual BHEK-Like Spam With Attachment Found *** --------------------------------------------- Soon after Paunch was arrested, we found that the flow of spam campaigns going to sites with the Blackhole Exploit Kit (BHEK) had slowed down considerably. Instead, we saw an increase in messages with a malicious attachment. Recently, however, we came across rather unusual spam samples that combines characteristics of both attacks. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/unusual-bhek-lik… *** Mobile Pwn2Own: Galaxy S4 und iOS gehackt *** --------------------------------------------- Am ersten Tag des Wettbewerbs Mobile Pwn2Own in Tokio wurde auf Samsungs Galaxy S4 eine Sicherheitslücke gezeigt, die es ermöglicht, beliebige Apps zu installieren. Chinesische Hacker zeigten Schwachstellen in Safari unter iOS 6.1.4 und 7.0.3. --------------------------------------------- http://www.heise.de/security/meldung/Mobile-Pwn2Own-Galaxy-S4-und-iOS-gehac… *** Analysis: IT Threat Evolution: Q3 2013 *** --------------------------------------------- IT Threat Evolution: Q3 2013 Targeted Attacks / APT Malware Stories Web security and data breaches Mobile malware --------------------------------------------- http://www.securelist.com/en/analysis/204792312/IT_Threat_Evolution_Q3_2013 *** A-DOH!-BE hack: Facebook warns users whose logins were spilled *** --------------------------------------------- Facebook is using a list of hacked Adobe accounts posted by the miscreants themselves to warn its own customers about password reuse. --------------------------------------------- http://www.theregister.co.uk/2013/11/14/facebook_adobe_password_leak_warnin… *** New OSX/Crisis or Business Cards Gone Wild *** --------------------------------------------- In these days of computer conspiracies, the Mac is not left out. A new variant of Remote Control System, Hacking Team´s spyware, landed on VirusTotal with a detection rate of 0 out of 47 scanners. RCS, also known as OSX/Crisis, is an expensive rootkit used by governments during targeted attacks. --------------------------------------------- http://www.intego.com/mac-security-blog/new-osx-crisis-business-cards-gone-… *** Cracked.com Serving Malware in Drive-By Downloads *** --------------------------------------------- The popular humor website, Cracked[dot]com reportedly hosted malware that infected the machines of of its visitors over the weekend and may still be doing so, according to Barracuda Labs research. --------------------------------------------- http://threatpost.com/cracked-com-serving-malware-in-drive-by-downloads/102… *** eGroupware HTML File Uploads Script Insertion Vulnerability *** --------------------------------------------- https://secunia.com/advisories/54368 *** LastPass Android Container PIN / Auto-Wipe Bypass *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2013110101 *** IBM Multiple Storage Products Apache Struts Security Bypass Vulnerability *** --------------------------------------------- https://secunia.com/advisories/55706 *** SA-CONTRIB-2013-091 - Groups, Communities and Co (GCC) - Access Bypass *** --------------------------------------------- Remote Vulnerability: Access bypassDescriptionThis module enables you to manage groups and assign content and users to groups.The module doesnt sufficiently check permissions to some of the configuration pages allowing unprivileged users to access the roles and permissions pages of the GCC module.CVE --------------------------------------------- https://drupal.org/node/2135267 *** SA-CONTRIB-2013-090 - Revisioning - Access Bypass *** --------------------------------------------- Remote Vulnerability: Access bypassDescriptionThis module enables you to create content publication workflows whereby one version of the content is "live" (publicly visible), while another is being edited and moderated privately until found fit for publication.The module doesnt sufficiently apply node access permissions --------------------------------------------- https://drupal.org/node/2135257

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily