- Daily - CERT.at

Tageszusammenfassung - Dienstag 19-03-2013
by Daily end-of-shift report 19 Mar '13

19 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-03-2013 18:00 − Dienstag 19-03-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** EA Origin vuln puts players at risk *** --------------------------------------------- Game platform allows remote exploits, millions vulnerable A flaw in EAs Origin game store puts its 40 million or so users at risk of remote execution vulnerabilities… --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/19/ea_origin_b… *** Vuln: Cisco IOS and IOS XE Insecure Password Hash Weakness *** --------------------------------------------- Cisco IOS and IOS XE Insecure Password Hash Weakness --------------------------------------------- http://www.securityfocus.com/bid/58557 *** Oracle Automated Service Manager Unsafe Temporary Files Let Local Users Modify Files on the Target System. *** --------------------------------------------- A vulnerability was reported in Oracle Automated Service Manager. A local user can modify files on the target system. --------------------------------------------- http://www.securitytracker.com/id/1028310 *** Siemens SIMATIC WinCC TIA Portal Multiple Vulnerabilities *** --------------------------------------------- Siemens SIMATIC WinCC TIA Portal Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52646 *** McAfee Vulnerability Manager Unspecified Cross-Site Scripting Vulnerability *** --------------------------------------------- McAfee Vulnerability Manager Unspecified Cross-Site Scripting Vulnerability --------------------------------------------- https://secunia.com/advisories/52688 *** Joomla! RSFiles! Component "cid" SQL Injection Vulnerability *** --------------------------------------------- Joomla! RSFiles! Component "cid" SQL Injection Vulnerability --------------------------------------------- https://secunia.com/advisories/52668 *** Ruby on Rails Multiple Vulnerabilities *** --------------------------------------------- Ruby on Rails Multiple Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52656 *** IBM WebSphere Application Server Multiple Java Vulnerabilities *** --------------------------------------------- IBM WebSphere Application Server Multiple Java Vulnerabilities --------------------------------------------- https://secunia.com/advisories/52703 *** Aruba Mobility Controller Administration WebUI SSID Script Insertion Vulnerability *** --------------------------------------------- Aruba Mobility Controller Administration WebUI SSID Script Insertion Vulnerability --------------------------------------------- https://secunia.com/advisories/52690 *** [webapps] - ViewGit 0.0.6 - Multiple XSS Vulnerabilities *** --------------------------------------------- ViewGit 0.0.6 - Multiple XSS Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24862 *** [webapps] - WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability *** --------------------------------------------- WordPress Count per Day Plugin 3.2.5 (counter.php) - XSS Vulnerability --------------------------------------------- http://www.exploit-db.com/exploits/24859 *** Botnetz scannt das Internet mit Hilfe von gehackten Endgeräten *** --------------------------------------------- Ein Hacker hat einen eigenen "Internet Census 2012" mittels eines extra dafür eingerichteten Botnetzes erstellt. Ergebnis der Aktion: 420 Millionen aktive Geräte antworten auf Anfragen - und jede Menge Sicherheitslecks kommen ans Licht. --------------------------------------------- http://www.heise.de/newsticker/meldung/Botnetz-scannt-das-Internet-mit-Hilf… *** Bugtraq: VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Use-After-Free (MFSA-2013-29 / CVE-2013-0787) *** --------------------------------------------- VUPEN Security Research - Mozilla Firefox "nsHTMLEditRules" Use-After-Free (MFSA-2013-29 / CVE-2013-0787) --------------------------------------------- http://www.securityfocus.com/archive/1/526050

1 0

Tageszusammenfassung - Montag 18-03-2013
by Daily end-of-shift report 18 Mar '13

18 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-03-2013 18:00 − Montag 18-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Stephan Richter *** Expert: Social Networks Targeted for Drive-By Exploits *** --------------------------------------------- "Malware was spread in unique ways in 2012, particularly through drive-by exploits. In 2013, organizations can expect more exploits targeting social networks, says Adam Kujawa of anti-malware vendor Malwarebytes."The method in which the links to drive-bys have been spread was pretty unique [in 2012]," says Kujawa, a malware intelligence analyst. "We can see that moving over into 2013."Kujawa says cybercriminals are increasingly targeting social networking sites and --------------------------------------------- http://www.govinfosecurity.com/malware-emerging-trends-a-5598 *** The World Has No Room For Cowards *** --------------------------------------------- Its not often that one has the opportunity to be the target of a kinetic and cyber attack at the same time. But that is exactly whats happened to me and my Web site over the past 24 hours. On Thursday afternoon, my site was the target of a fairly massive denial of service attack. That attack was punctuated by a visit from a heavily armed local police unit that was tricked into responding to a 911 call spoofed to look like it came from my home. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/uD9Evlztjaw/ *** Debian Security Advisory DSA-2649 lighttpd *** --------------------------------------------- fixed socket name in world-writable directory --------------------------------------------- http://www.debian.org/security/2013/dsa-2649 *** Sicherheitsunternehmen analysiert Angriffe auf Industriesteuerungen *** --------------------------------------------- Auf der Security-Konferenz Black Hat Europe stellte Trend Micro einen Forschungsbericht über einen einen Praxisversuch vor und zeigt, von wo aus und auf welche Art industrielle Systeme mit Malware angegriffen werden. --------------------------------------------- http://www.heise.de/security/meldung/Sicherheitsunternehmen-analysiert-Angr… *** Analysis of the Booter.TW *** --------------------------------------------- "Earlier this week, famous InfoSec blogger Brian Krebs website suffered from a denial of service attack that knocked it offline. Following the attack Brian posted an article, "The World has No Room for Cowards", which detailed how he had been SWATed following the attacks against his site. In his article he talked about some of the indicators of who may be behind the attack...." --------------------------------------------- http://www.reversecurity.com/2013/03/analysis-of-bootertw.html *** Android malware analysis tool *** --------------------------------------------- "Bluebox Labs announced Dexter, a free tool to help researchers and enterprise security teams analyze applications for malware and vulnerabilities. The Dexter platform provides software architecture information presented through a web-based user interface...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14605 *** You Only Click Twice: FinFisher's Global Proliferation *** --------------------------------------------- This post describes the results of a comprehensive global Internet scan for the command and control servers of FinFisher's surveillance software. It also details the discovery of a campaign using FinFisher in Ethiopia used to target individuals linked to an opposition group. --------------------------------------------- https://citizenlab.org/2013/03/you-only-click-twice-finfishers-global-proli… *** Online Security Tools (Malware, Sandboxes, Hash Checking, Cracking, DNSBL, SSL, BGP) *** --------------------------------------------- Some readers and friends convinced me recently to start posting some articles in english as well - to reach a wider audience. Lets start with a quick post containing a list of very useful online security tools. The services are very useful for incident responders, forensicators and security information practitioners. --------------------------------------------- http://sseguranca.blogspot.fr/2012/03/online-security-tools-malware-sandbox… *** Bugtraq: [SECURITY] [DSA 2646-1] typo3-src security update *** --------------------------------------------- [SECURITY] [DSA 2646-1] typo3-src security update --------------------------------------------- http://www.securityfocus.com/archive/1/526030 *** From Russia With Bots: Finding The Source Of Cyber Attacks *** --------------------------------------------- While media and government source continue to allude to China as the biggest source of cyber attacks hitting innocent servers on the Internet, recent evidence instead suggests it's the Russian Federation that's king of the cyber attack mountain. --------------------------------------------- http://readwrite.com/2013/03/18/from-russia-with-bots-finding-the-source-of…

1 0

Tageszusammenfassung - Freitag 15-03-2013
by Daily end-of-shift report 15 Mar '13

15 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-03-2013 18:00 − Freitag 15-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Vulnerability Summary for the Week of March 4, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains --------------------------------------------- http://www.us-cert.gov/ncas/bulletins/SB13-070 *** Debian Security Advisory DSA-2644 wireshark *** --------------------------------------------- several vulnerabilities --------------------------------------------- http://www.debian.org/security/2013/dsa-2644 *** Open-Xchange Server 6 - Multiple Vulnerabilities *** --------------------------------------------- Open-Xchange Server 6 - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24791 *** Mac OS X 10.8.3 steht bereit *** --------------------------------------------- Seit November testete Apple die nächste Version von Mountain Lion in Entwicklerkreisen schon, nun ist der Download für die Allgemeinheit verfügbar. Für Snow Leopard und Lion steht außerdem ein Sicherheitsupdate-Paket bereit. --------------------------------------------- http://www.heise.de/security/meldung/Mac-OS-X-10-8-3-steht-bereit-1823278.h… *** You've Been Hacked, But For How Long? *** --------------------------------------------- One of the big themes at the recent RSA Conference was awareness of threats already inside the network. The way you learn about these threats and lower your 'Mean Time To Know' (MTTW) about an intrusion is with profile-based network monitoring. --------------------------------------------- http://www.darkreading.com/blog/240150779/you-ve-been-hacked-but-for-how-lo… *** Security appliances are riddled with serious vulnerabilities, researcher says *** --------------------------------------------- The majority of email and Web gateways, firewalls, remote access servers, UTM (united threat management) systems and other security appliances have serious vulnerabilities, according to a security researcher who analyzed products from multiple vendors. --------------------------------------------- http://www.techworld.com.au/article/456433/security_appliances_riddled_seri… *** Trend Micro dupes wannabe hackers with honeypot scam *** --------------------------------------------- "Security firm Trend Micro has duped hackers into attacking fake industrial control systems (ICS), collecting invaluable data on their attack methods and goals and revealing surprising insights on the UKs hacking scene. The research was revealed at Blackhat Europe 2013 in Amsterdam on Friday and is the result of a collaborative project between Trend Micro and Scada security researcher Kyle Wilhoit. --------------------------------------------- http://www.v3.co.uk/v3-uk/news/2254867/trend-micro-dupes-wannabe-hackers-wi… *** UMTS-Sticks von Huawei gefährden Sicherheit der Nutzer *** --------------------------------------------- Ein russischer Hacker hat die Treiber-Software der UMTS-Sticks von Huawei untersucht. Ergebnis: zahlreiche Schwachstellen, die es Angreifern leicht machen, die Rechner der Stick-Nutzer zu infizieren. Auch eine massenhafte Infektion ist denkbar. --------------------------------------------- http://www.heise.de/security/meldung/UMTS-Sticks-von-Huawei-gefaehrden-Sich… *** Der Feind in meinem Dock *** --------------------------------------------- In Notebook-Docks von Dell ist noch viel Platz. Ein Sicherheitsforscher hat darin einen Mini-PC untergebracht, der Netzwerkverkehr, Audio- und Videosignale sowie USB-Datenverkehr des angedockten Notebooks ausspioniert. --------------------------------------------- http://www.heise.de/security/meldung/Der-Feind-in-meinem-Dock-1823723.html *** Highlights from BlackHat Europe 2013 in Amsterdam *** --------------------------------------------- Every year as Europe wakes up from the cold winter to the warm days of spring, BlackHat traditionally descends to Amsterdam. This year's conference is taking place on March 14-15 at the NH Grand Hotel Krasnapolsky, right Dam Square, the heart of Amsterdam. As spring doesn't necessarily equal warm days here in Europe right now, the 500 or so BlackHat participants hit the conference rooms to attend quite a few interesting talks. Here's a summary of the best talks at BlackHat Europe --------------------------------------------- http://www.securelist.com/en/blog/208194175/Highlights_from_BlackHat_Europe… *** TeamViewer authentication protocol *** --------------------------------------------- When a coworker recently gave me access to his system he recommended I use TeamViewer. TeamViewer is a free tool that is used to set up and use a VPN connection as well as allowing the user to remotely take control of another person's computer from their system. Given that it was my first time using this software, I decided to take a peek at the traffic. --------------------------------------------- http://blog.accuvantlabs.com/blog/bthomas/teamviewer-authentication-protocol *** Seagate blog compromised, leads to Blackhole and malware *** --------------------------------------------- A blog of well-known hard disk drive manufacturer Seagate has been compromised to contain malicious iFrame injections that redirect users to websites hosting the Blackhole exploit kit, warns Sophos. --------------------------------------------- http://www.net-security.org/malware_news.php?id=2440

1 0

Tageszusammenfassung - Donnerstag 14-03-2013
by Daily end-of-shift report 14 Mar '13

14 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-03-2013 18:00 − Donnerstag 14-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Otmar Lendl *** Heimtückische Hintertür in TP-Link-Routern *** --------------------------------------------- Quasi auf Zuruf laden einige WLAN-Router eine ausführbare Datei aus dem Netz und führen die dann auch gleich mit Root-Rechten aus. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/298834fb/l/0L0Sheise0Bde0Csec… *** Kaspersky fixt IPv6-Problem der Internet Security Suite *** --------------------------------------------- Ein einziges, etwas seltsames IPv6-Paket genügt, um einen Windows-PC mit Kasperskys Firewall zum Stillstand zu bringen. Nach der Veröffentlichung des Problems will es der Hersteller jetzt beseitigen. --------------------------------------------- http://www.heise.de/security/meldung/Kaspersky-fixt-IPv6-Problem-der-Intern… *** Mobile Drive-By Malware example *** --------------------------------------------- "Several days ago we received a complaint about javascrpt. ru. After a bit of research, we found that it tries to mimic ajax...." --------------------------------------------- http://blog.avast.com/2013/03/11/mobile-drive-by-malware-example/ *** US national vulnerability database hacked *** --------------------------------------------- Malware infection forces government vuln catalog offline The US governments online catalog of cyber-vulnerabilities has been taken offline ironically, due to a software vulnerability. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/14/us_malware_… *** Encryption Trojan attacks Spain and France *** --------------------------------------------- March 13, 2013 Russian anti-virus company Doctor Web has registered an ongoing massive spread of the encryption malware Trojan.ArchiveLock across PCs outside Russia. The program, dubbed Trojan.ArchiveLock.20, is infecting increasingly more computers in France and Spain. Last August, Doctor Web issued a warning about Trojan.ArchiveLock encryption malware. This program uses the archiver WinRAR to encrypt files. To spread the malware, criminals mount a brute force attack via the RDP protocol on --------------------------------------------- http://news.drweb.com/show/?i=3379&lng=en&c=9 *** Drupal Node Parameter Control 6.x Access Bypass *** --------------------------------------------- Topic: Drupal Node Parameter Control 6.x Access Bypass Risk: High Text:View online: http://drupal.org/node/1942330 * Advisory ID: DRUPAL-SA-CONTRIB-2013-034 * Project: Node Parameter Control... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/D5fwYJPc7EI/WLB-20… *** Expert Finds Way to Retrieve Facebook Authentication Token and Hack Any Account *** --------------------------------------------- "Security researcher Nir Goldshlager has identified yet another Facebook OAuth vulnerability that can be exploited to hack any account. In the attack method he presented back in February, the expert used the app_id of the Facebook Messenger to gain full access to accounts. The social media company has addressed the issue by using regex protection, but Goldshlager has discovered another method to exploit the Facebook Messenger app_id...." --------------------------------------------- http://news.softpedia.com/news/Expert-Finds-Way-to-Retrieve-Facebook-Authen… *** Cyber-attack in the Czech Republic - Thieves in the night *** --------------------------------------------- "A MYSTERIOUS wave of cyber-attacks in the Czech Republicthe most extensive in the countrys historyon March 11th briefly disabled the web site for Unicredit, a bank. Other targets have included media, banks, mobile phone operators, the stock exchange and even the Czech National Bank. All but the Unicredit attack were so-called DDoS (distributed denial of service) attacks...." --------------------------------------------- http://www.economist.com/blogs/easternapproaches/2013/03/cyber-attack-czech… *** Check Point 2013 Security Report Released *** --------------------------------------------- "The Check Point company has just released its already well known Check Point 2013 Security Report series report. The Check point 2013 Security Report examines top security threats, risky web applications that compromise network security, and loss of data caused by employees unintentionally. Based on research of 900 companies and 120,000 hours of monitored traffic, Check Points research reveals startling details of real risks faced by enterprises including:64% infected with bots91% used --------------------------------------------- http://www.felipemartins.info/2013/03/check-point-2013-security-report-rele… *** Antiviren-Software AVG hielt Systemdatei für Trojaner *** --------------------------------------------- Eine fälschlicherweise als Malware identifizierte Windows-DLL bescherte einigen AVG-Nutzern einen unruhigen Vormittag. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/299137b5/l/0L0Sheise0Bde0Csec… *** Erneuter Krypto-Angriff auf SSL/TLS-Verschlüsselung *** --------------------------------------------- Der vorgestellte Angriff auf das häufig eingesetzte Verschlüsselungsverfahren RC4 ist zwar noch nicht wirklich praktikabel, erschüttert aber das Fundament für sichere Internet-Verbindungen. --------------------------------------------- http://www.heise.de/security/meldung/Erneuter-Krypto-Angriff-auf-SSL-TLS-Ve… *** Blog: Reminder: be careful opening invoices on the 21st March *** --------------------------------------------- On March 4th we spotted a large number of unusual emails being blocked by our Linux Mail Security product. The emails all contained the same PDF attachment but were being sent from many different source addresses. --------------------------------------------- http://www.securelist.com/en/blog/837/Reminder_be_careful_opening_invoices_… *** Microsoft continues to focus on security in their products *** --------------------------------------------- "86% of vulnerabilities discovered in the most popular 50 programs in 2012 were in non-Microsoft (or third-party) programs. The result was published today in the Secunia Vulnerability Review 2013 that analyzes the evolution of software vulnerabilities from a global, industry, enterprise, and endpoint perspective. The identified 86% represent an increase from 2011, when non-Microsoft programs represented 78% of vulnerabilities discovered in the Top 50 most popular programs...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14595

1 0

Tageszusammenfassung - Mittwoch 13-03-2013
by Daily end-of-shift report 13 Mar '13

13 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-03-2013 18:00 − Mittwoch 13-03-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** MS13-026 - Important : Vulnerability in Office Outlook for Mac Could Allow Information Disclosure (2813682) - Version: 1.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-026 *** MS13-003 - Important : Vulnerabilities in System Center Operations Manager Could Allow Elevation of Privilege (2748552) - Version: 2.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-003 *** Flash: Unseren monatlichen Patch gib uns heute *** --------------------------------------------- Adobe veröffentlicht wieder Sicherheits-Updates für den Flash-Player, diesmal ausnahmsweise nicht außer der Reihe. Eine wesentliche Lücke bleibt dabei aber ungestopft. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/297e24e3/l/0L0Sheise0Bde0Csec… *** ASUS RT-N66U multiple vulns *** --------------------------------------------- Topic: ASUS RT-N66U multiple vulns Risk: Medium Text:Vulnerable product: ASUS RT-N66U Vulnerabilities: - Linux 2.6.22.19 - Old libraries and executables Interesting vulnerabili... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/o7EbpwGc_yk/WLB-20… *** Google rolls out initiative to help hacked sites *** --------------------------------------------- "With its new informational series, the Web giant aims to answer questions about why a site was hacked, what malware may have been used, and how to wipe the site clean of bugs. Its not pretty when a Web site gets a "this site may be compromised" or "this site may harm your computer" status note. Many webmasters and Web site owners can be at a loss of what to do in these situations...." --------------------------------------------- http://news.cnet.com/8301-1023_3-57573986-93/google-rolls-out-initiative-to… *** Security-Linux Kali tritt Nachfolge von BackTrack an *** --------------------------------------------- Mit einer neuen Tool-Auswahl und einem modernen Linux-Unterbau lässt Kali die Altlasten von BackTrack hinter sich. Die Distribution für Pentester, Admins und Forensiker steht ab sofort zum Download bereit. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2983f19a/l/0L0Sheise0Bde0Csec… *** Security agency tells Europe to find alternative to risky email *** --------------------------------------------- "European governments and businesses should investigate alternative communication channels to e-mail in the longer term after a string of alarming attacks, the EUs cyber security agency warned today (13 March) in a special alert. The European Network and Information Security Agency (ENISA) issued the so-called Flash Note in the wake of recent major cyber-attacks, calling for Europes businesses and governments to take urgent action to combat emerging cyber-attack trends. The report cites... --------------------------------------------- http://www.euractiv.com/infosociety/security-agency-tells-europe-fin-news-5… *** Exploit Kit Distribution in the Wild *** --------------------------------------------- Have you ever wondered which exploit kits are the most prevalent?We have been tracking several exploit kits that we have identified these past few months and its interesting to see which gets the biggest chunk of the pie:56% of the coverage is owned by only three exploit kits: Blackhole, Sweet Orange, and Cool.Blackhole, a kit that has been around for almost three years, is still keeping a strong presence at no. 1 with 27% of the exploit kit coverage. Followed by Sweet Orange with 18% and Cool... --------------------------------------------- http://www.f-secure.com/weblog/archives/00002522.html *** (IN)SECURE Magazine Issue 37 released *** --------------------------------------------- "IN)SECURE Magazine is a freely available digital security magazine discussing some of the hottest information security topics. Issue #37 has just been released - download the magazine! The articles in this issue include:Becoming a malware analystReview: Nipper StudioFive questions for Microsofts Chief Privacy OfficerApplication security testing for AJAX and JSONPenetrating and achieving persistence in highly secured networksReport: RSA Conference 2013Social engineering: An underestimated... --------------------------------------------- http://www.net-security.org/insecuremag.php *** Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1, (Wed, Mar 13th) *** --------------------------------------------- At Shmoocon 2013 Jake Williams (@MalwareJake) and I gave a presentation entitled Wipe the Drive. The point of the presentation was that you should always wipe the drive and reinstall the OS after a confirmed malware infection. We all know wiping the drive is the safest move but there are business pressures to simply remove the known malware and move on. Also, because we are security professionals there is often an expectation that we are able to remove all the malware. But, in my and Jakes... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15394&rss *** Bugtraq: Open-Xchange Security Advisory 2013-03-13 *** --------------------------------------------- http://www.securityfocus.com/archive/1/525979 *** Bugtraq: SEC Consult SA-20130313-0 :: QlikView Desktop Client Integer Overflow *** --------------------------------------------- http://www.securityfocus.com/archive/1/525980 *** Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing *** --------------------------------------------- Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week. --------------------------------------------- https://threatpost.com/en_us/blogs/issue-swfuploader-could-lead-xss-vulnera…

1 0

Tageszusammenfassung - Dienstag 12-03-2013
by Daily end-of-shift report 12 Mar '13

12 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-03-2013 18:00 − Dienstag 12-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Christian Wojner *** Improving the security for Android embedded systems *** --------------------------------------------- "McAfee has delivered a whitelisting security solution for Android based embedded systems. McAfee Application Control for Android resides in the Android kernel, embedded in the operating system and provides protection from the installation or execution of a malicious application on an Android-based device. McAfee also provides protection at the application layer to Android devices...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14574 *** Blacklist NJABL geht außer Betrieb *** --------------------------------------------- Die Anti-Spam-Blacklist NJABL hat ihre Datenbasis bereits ausgeblendet. Verantwortlichen von Mailservern, die sie dennoch weiterhin abfragen, droht Ungemach, sobald der Hoster auch die Namensdienst-Einträge abklemmt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971dffa/l/0L0Sheise0Bde0Csec… *** Australien: Hackerangriffe auf die Zentralbank *** --------------------------------------------- Australische Medien berichten von Hackerangriffen auf die Zentralbank des Landes und sprechen dabei von Spuren nach China und kompromittierten Informationen. Die Zentralbank bestätigt, dass es Cyberattacken gab, sonst nichts. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2971ee42/l/0L0Sheise0Bde0Csec… *** Google Docs CSRF & Clickjacking *** --------------------------------------------- Topic: Google Docs CSRF & Clickjacking Risk: Medium Text:CSRF & Clickjacking : Google Document, Drawing, Forms, Spreadsheet, Presentation Attacker can create Google Document, Dra... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/K1SfuqKrTTM/WLB-20… *** Vuln: Piwik Unspecified Cross Site Scripting Vulnerability *** --------------------------------------------- Piwik Unspecified Cross Site Scripting Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58392 *** TinyMCE XSS Vulnerability *** --------------------------------------------- Topic: TinyMCE XSS Vulnerability Risk: Low Text:Vulnerability Report Author: Justin C. Klein Keane Date: 5 March, 2013 CVE-2012-4230 Descrip... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/vAEUomxc8S8/WLB-20… *** Windows 8: Flash als Standard *** --------------------------------------------- Der Internet Explorer unter Windows 8 und RT soll wesentlich mehr Flash-Inhalte per default zulassen. Damit rückt der Software-Hersteller noch weiter von seiner bisherigen Linie bei der Flash-Unterstützung ab. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2977bea5/l/0L0Sheise0Bde0Csec… *** Chess CAPTCHA - a serious defence against spammers? *** --------------------------------------------- "CAPTCHAs - the questions that a website asks you to answer to prove if youre a human being or not - come in many shapes and forms. Although they most commonly ask you to decipher some words hidden in a distorted graphic, there are more elaborate versions which can ask you to solve some complicated mathematical calculation or ask you to add toppings to a pizza in an attempt to stop automated bots leaving spammy messages...." --------------------------------------------- http://nakedsecurity.sophos.com/2013/03/12/chess-captcha/ *** Phishing emails sent in pairs to lend authenticity, says training company *** --------------------------------------------- "Phishing emails are now being deployed in pairs to create the illusion of authenticity, says security awareness training firm PhishMe. Phishing emails try to trick the recipient into doing something risky by disguising malicious attachments or links in seemingly genuine content. In this new type of phishing email campaign, attackers typically send out a benign email that contains nothing harmful and does not ask for any information or response from the recipient...." --------------------------------------------- http://www.computerweekly.com/news/2240179364/Phishing-emails-sent-in-pairs… *** Google Play: Potentially Unwanted *** --------------------------------------------- Google Play has a problem and it isnt malware.Depending on location, Potentially Unwanted Applications (PUA) can be rather difficult to avoid.Heres a screenshot of User Reviews from a "weather widget" application:In English (both U.S. and U.K.), there are eight user reviews. Just eight. Even if you click on a link to "Read All User Reviews".But if you use the Danish UI this is one additional review youll see:And its good that Danes can see it, because the --------------------------------------------- http://www.f-secure.com/weblog/archives/00002521.html

1 0

Tageszusammenfassung - Montag 11-03-2013
by Daily end-of-shift report 11 Mar '13

11 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-03-2013 18:00 − Montag 11-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Yahoo! webmail! hijacks! are! back!... *** --------------------------------------------- Didnt! they! fix! that?! Yahoo! has blamed cross-site scripting security bugs, which it claims to have squashed, for a recent upsurge in webmail account takeovers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/yahoo_webma… *** Pwn2Own ends with all attackers winning *** --------------------------------------------- "The Pwn2Own competition at CanSecWest has come to an end with the second day being like the first day. No web browser plugin survived being attacked and Adobe Flash, Adobe Reader XI and Java were all successfully hacked. Vupen security, who had demonstrated exploits of Internet Explorer 10, Firefox and Java on day one, returned with an exploit for Adobe Flash...." --------------------------------------------- http://www.h-online.com/open/news/item/Pwn2Own-ends-with-all-attackers-winn… *** DNS Hijack Leads To Bitcoin Heist *** --------------------------------------------- First time accepted submitter FearTheFez writes "Social Engineering and poor DNS Security lead to a Bitcoin heist worth about $12000. Bitcoin broker Bitinstant was robbed after thieves managed to take over ownership of their domains. While Bitinstant claims that no customers lost any money, without 2 factor authentication all it took was a place of birth and a mothers maiden name to gain access. This looks like poor security from everyone involved." --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/_Jp5n8Dt8jA/story01.htm *** Trend Micro Examines Asprox Botnet *** --------------------------------------------- "TrendLabs recently published a research paper providing a detailed look at the Asprox botnet, which delivers malware via spam e-mails that claim to come from package delivery companies like FedEx, DHL, and the U.S. Postal Service."While Asprox has only been mentioned sporadically in the past few years, other spam campaigns with similar tactics as well as fake ticket scams using well-known airlines like Delta and American Airlines have received significant attention," --------------------------------------------- http://www.esecurityplanet.com/malware/trend-micro-examines-asprox-botnet.h… *** Raspberry Pi Hit by Cyber Attack (DDoS) *** --------------------------------------------- It's sad to see the Raspberry Pi Foundation, a charity with a good cause at its heart, has been the focus of a vicious attack. This stunt goes to highlight the unfortunate fact that any organisation, of any size and nature, is vulnerable. --------------------------------------------- http://www.esecurityplanet.com/network-security/raspberry-pi-hit-by-cyber-a… *** ICS-CERT sums up 2012 cyber security response activities *** --------------------------------------------- "The Industrial Control System Cyber Emergency Response Team (ICS-CERT) issued on March 7 a report on its activities in 2012. ICS-CERT provides Cyber security evaluations to support the reliability and resiliency of the systems that comprise and interconnect critical infrastructures. It develops and implements coordinated security measures in collaboration with partners from across public, private and international communities...." --------------------------------------------- http://www.gsnmagazine.com/node/28699?c=cyber_security *** Zimmerspion SmartTV *** --------------------------------------------- Ein Sicherheitsforscher hat SmartTVs von Samsung so manipuliert, dass er ihre Webcam zur Raumüberwachung nutzen konnte während der Fernseher augenscheinlich ausgeschaltet war. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/296010ec/l/0L0Sheise0Bde0Csec… *** Think your internet password is safe? Think again... *** --------------------------------------------- "Are you one of those naive types who believes that choosing the name of your first pet as an internet password is going to protect you from hacking and fraud? Be very, very afraid, warns Memphis Barker, who has discovered some deeply unsettling facts about the increasing sophistication of data breaches...." --------------------------------------------- http://www.independent.co.uk/life-style/gadgets-and-tech/features/think-you… *** Debian Security Advisory DSA-2642 sudo *** --------------------------------------------- several issues --------------------------------------------- http://www.debian.org/security/2013/dsa-2642 *** Apple schließt kritische Lücke in App Store *** --------------------------------------------- Eine Sicherheitslücke, die Angriffe auf iOS-Geräte ermöglichte, wurde nun endlich geschlossen. Gemeldet worden war das Problem bereits vor mehr als einem halben Jahr von einem Google-Sicherheitsforscher. Bekannt gemacht wurde es aber erst jetzt. --------------------------------------------- http://futurezone.at/digitallife/14564-apple-schliesst-kritische-luecke-in-… *** WordPress plugins vulnerable to CVE-2013-1808 *** --------------------------------------------- Topic: WordPress plugins vulnerable to CVE-2013-1808 Risk: Low Text: I tested WordPress plugins to see which are vulnerable to CVE-2013-1808, because original founder of this vulnerability did not... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/qEk7pVSgvcw/WLB-20… *** Kundendaten des deutschen Avast-Distributors im Netz *** --------------------------------------------- Wer über Avast.de eine Virenschutzsoftware gekauft hat, hat ein Problem: Im Netz kursieren offenbar die Daten von über 16.000 Kunden; darunter auch Zahlungsinformationen und Passwort-Hashes. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29698122/l/0L0Sheise0Bde0Csec… *** Vuln: Perl CVE-2013-1667 Input Rehashing Denial of Service Vulnerability *** --------------------------------------------- Perl CVE-2013-1667 Input Rehashing Denial of Service Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58311 *** Miniduke: web based infection vector *** --------------------------------------------- Together with our partner CrySyS Lab, weve discovered two new, previously-unknown infection mechanisms for Miniduke. These new infection vectors rely on Java and IE vulnerabilities to infect the victims PC. --------------------------------------------- http://www.securelist.com/en/blog/208194159/Miniduke_web_based_infection_ve… *** Help Keep Threats at Bay With 'Click-to-Play' *** --------------------------------------------- Muzzling buggy and insecure Web browser plugins like Java and Flash goes a long way toward blocking attacks from drive-by downloads and hacked or malicious Web sites. But leaving them entirely unplugged from the browser is not always practical, particularly with Flash, which is used on a majority of sites. Fortunately, there is a relatively simple and effective alternative: Click-to-Play.Related Posts:How to Unplug Java from the BrowserWhat You Need to Know About the Java ExploitBlocking --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/fXtHr18Ampk/ *** Bugtraq: Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 *** --------------------------------------------- Privoxy Proxy Authentication Credential Exposure - CVE-2013-2503 --------------------------------------------- http://www.securityfocus.com/archive/1/525958

1 0

Tageszusammenfassung - Freitag 8-03-2013
by Daily end-of-shift report 08 Mar '13

08 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-03-2013 18:00 − Freitag 08-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Advance Notification for March 2013 - Version: 1.0 *** --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-mar *** IPv6 Focus Month: Barriers to Implementing IPv6, (Thu, Mar 7th) *** --------------------------------------------- Ive been trying for a few months now to get my lab running IPv6 natively, with mixed success. Whats standing in my way you ask? A couple of things, which in turn have further implications:... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15361&rss *** IPv6 Focus Month: Filtering ICMPv6 at the Border, (Fri, Mar 8th) *** --------------------------------------------- Paulgear1 asked on twitter: help on interpreting RFC4890. I still havent turned on IPv6 because Im not confident in my firewall. First of all, what is RFC4890 all about [1]? The RFC is considered informational, not a standard. Usual guidance for IPv4 is to not block ICMP error messages, but one can get away with blocking all ICMP messages. The situation is a bit different when it comes to ICMPv6... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15367&rss *** Bugtraq: [security bulletin] HPSBGN02854 SSRT100881 rev.1 - HP Intelligent Management Center (iMC), iMC TACACS+ Authentication Manager (TAM), and iMC User Access Manager (UAM), Cross Site Scripting (XSS), Remote Code Execution, Remote Disclosure of *** --------------------------------------------- http://www.securityfocus.com/archive/1/525928 *** More Info on Recent ICS-CERT Advisories *** --------------------------------------------- "ICS-CERT has been busy this week. They updated an alert on Tuesday and issued two advisories yesterday. In two of those three actions there were some interesting questions raised about some of the information provided, or not provided in their documents...." --------------------------------------------- http://chemical-facility-security-news.blogspot.in/2013/03/more-info-on-rec… *** What ICS-CERT Is and Isnt *** --------------------------------------------- "When ICS-CERT was created I expected a lot more. I expected analysis and insight from skilled ICS security experts. The reality is ICS-CERT is merely a coordinator of communication between vulnerability finders and the vendor...." --------------------------------------------- http://www.digitalbond.com/blog/2013/03/07/what-ics-cert-is-and-isnt/ *** Android accounted for 79% of all mobile malware in 2012 *** --------------------------------------------- "A new study has found that Googles (GOOG) mobile operating system is targeted by hackers far more than any other mobile platform. Security firm F-Secure found that Android accounted for 79% of all mobile malware in 2012, an increase from 66. 7% in 2011 and 11...." --------------------------------------------- http://bgr.com/2013/03/07/android-malware-2012-362787/ *** Vuln: CoDeSys Gateway Server Multiple Security Vulnerabilities *** --------------------------------------------- CoDeSys Gateway Server Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/58032 *** Pwn2Own: IE10, Firefox, Chrome, Reader, Java hacks land $500k *** --------------------------------------------- Googles Chrome OS withstands attack in security contest Its back to the drawing board for coders at Microsoft, Google, Adobe, Mozilla, and Oracle after entrants in the annual Pwn2Own contest waltzed off with over half a million dollars in prizes for exploiting security holes in popular software... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/pwn2own_con… *** Bugtraq: SEC Consult SA-20130308-0 :: Multiple critical vulnerabilities in GroundWork Monitor Enterprise (part 1) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525938 *** Bugtraq: SEC Consult SA-20130308-1 :: Multiple vulnerabilities in GroundWork Monitor Enterprise (part 2) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525941 *** Leaked: The secret OAuth app keys to Twitters VIP lounge *** --------------------------------------------- Rogue apps could pose as micro-blogging sites Very Important Programs Twitters private OAuth login keys, used by the websites official applications to get preferential treatment from the micro-blogging site, have apparently been leaked. The secret credentials could now allow any software to masquerade as an approved Twitter client... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/08/twitter_oau… *** Heads-Up - Citadel Command and Control Domains *** --------------------------------------------- "We have detected new Citadel malware activity, again coming from within large, some Dutch, organizations. These Citadel Trojans are not part of the Pobelka botnet (Dutch) that we discovered last year on September 7, 2012. From the data we have gathered so far, we believe this new campaign is running since late November 2012...." --------------------------------------------- http://www.surfright.nl/en/citadel

1 0

Tageszusammenfassung - Donnerstag 7-03-2013
by Daily end-of-shift report 07 Mar '13

07 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-03-2013 18:00 − Donnerstag 07-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** Programm-Aktualisierer für kleine Unternehmen *** --------------------------------------------- Den Patch-Stand von Microsoft- sowie Drittanbieter-Programmen überprüfen die Werkzeuge von Secunia. Nun gibt es eine Version für KmU. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2946529e/l/0L0Sheise0Bde0Csec… *** D-Link fixes router vulnerabilities very quietly *** --------------------------------------------- "In November last year D-Link fixed critical vulnerabilities in its cylinder-shaped DIR-645 wireless router, but neglected to let its customers in on the secret. Users looking for firmware updates on D-Links US customer site for the router will come across a version 1. 03, dated 21 November 2012...." --------------------------------------------- http://www.h-online.com/security/news/item/D-Link-fixes-router-vulnerabilit… *** Vuln: WordPress Events Manager Plugin Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/57477 http://www.securityfocus.com/archive/1/525914 *** Java pfuscht bei Zertifikatschecks *** --------------------------------------------- Auf den Seiten der TU Chemnitz platzierten Gauner ein Java-Applet, das Rechner infizierte. Allerdings hätte das trotz digitaler Signatur nicht so einfach funktionieren sollen, weil das Zertifikat bereits gesperrt war. Aber wir reden ja von Oracle. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29482e3c/l/0L0Sheise0Bde0Csec… *** IPv6 Focus Month: Guest Diary: Stephen Groat - Geolocation Using IPv6 Addresses, (Wed, Mar 6th) *** --------------------------------------------- [Guest Diary: Stephen Groat] [Geolocation Using IPv6 Addresses] Today we bring you a guest diary from Stephen Groat where he speaks about validating that IPv6 address tracking and monitoring are possible. IPv6 designers developed a technique called stateless address autoconfiguration (SLAAC) to reduce the administrative burden of managing the immense IPv6 address space. To most operating systems current accepted definition of SLAAC, a nodes IPv6 addresss interface identifier (IID), or host... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15349&rss *** Bugtraq: Verax NMS (CVE-2013-1350) (CVE-2013-1631) (CVE-2013-1352 (CVE-2013-1351) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525907 http://www.securityfocus.com/archive/1/525918 http://www.securityfocus.com/archive/1/525917 http://www.securityfocus.com/archive/1/525916 *** 99 percent of web apps vulnerable to attack *** --------------------------------------------- "A new Cenzic report demonstrates that the overwhelming presence of web application vulnerabilities remains a constant problem, with an astounding 99 percent of applications tested revealing security risks, while additionally shedding light on pressing vulnerabilities within mobile application security. The report reveals the massive number of vulnerabilities prevalent in web and mobile applications today. It highlights the type, frequency and severity of vulnerabilities found and predicts... --------------------------------------------- http://www.net-security.org/secworld.php?id=14556 *** Ruby Entity expansion DoS vulnerability in REXML (XML bomb) *** --------------------------------------------- Topic: Ruby Entity expansion DoS vulnerability in REXML (XML bomb) Risk: Medium Text:http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/ == Unrestricted entity expansion can lead to a DoS vul... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/R4X5eZcZsGY/WLB-20… *** Heads-Up - Cybersecurity directive faces uncertain fate in Parliament *** --------------------------------------------- "EU attempts to introduce comprehensive new cybersecurity rules risk failure in the European Parliament, where senior administrators doubt the package will pass before the legislatures mandate expires, EurActiv has learned. In addition to the launch of its new over-arching Cybersecurity Strategy, the European Commission last month proposed a Directive with measures to ensure harmonised network and information security across the EU. The proposed legislation will oblige companies to be... --------------------------------------------- http://www.euractiv.com/specialreport-cybersecurity/cybersecurity-directive… *** [TYPO3-announce] Announcing TYPO3 CMS 4.5.25, 4.6.18, 4.7.10 and 6.0.4 *** --------------------------------------------- The TYPO3 Community has just released TYPO3 CMS versions 4.5.25, 4.6.18, 4.7.10 and 6.0.4, which are now ready for you to download. These versions are maintenance releases and contain bug fixes only. All packages fix one regression that has been introduced with the security releases yesterday: --------------------------------------------- http://typo3.org/news/article/typo3-cms-4525-4618-4710-and-604-released/ http://typo3.org/download/packages/ *** Cybercriminals Predicted To Expand Use Of Browser Proxies *** --------------------------------------------- "A technique for controlling a compromised systems browser, widely used in Brazilian banking schemes, will likely become popular amongst global cybercriminals in the next few years, say security experts. The technique abuses a legitimate way to control where a browser sends its requests, known as proxy auto-configuration or PAC, to take over a victims browser and send traffic--say, requests to a bank--to an attacker-controlled server instead. While the attackers still have to find a way to... --------------------------------------------- http://www.darkreading.com/advanced-threats/167901091/security/attacks-brea… *** [security bulletin] HPSBMU02849 SSRT101124 rev.1 - HP ServiceCenter, Remote Denial of Service (DoS) *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03680085 *** [security bulletin] HPSBPI02851 SSRT101078 rev.1 - Certain HP LaserJet Pro Printers, Unauthorized Access to Data *** --------------------------------------------- https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c03684249

1 0

Tageszusammenfassung - Mittwoch 6-03-2013
by Daily end-of-shift report 06 Mar '13

06 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-03-2013 18:00 − Mittwoch 06-03-2013 18:00 Handler: Stephan Richter Co-Handler: Otmar Lendl *** [TYPO3-announce] TYPO3 CMS Core Security Advisory TYPO3-CORE-SA-2013-001 *** --------------------------------------------- It has been discovered that the TYPO3 Core is susceptible to SQL Injection and Open Redirection For more details on the issues please read the accordant advisory --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa… *** Bugtraq: [IA32] HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting *** --------------------------------------------- [IA32] HP Intelligent Management Center v5.1 E0202 topoContent.jsf Non-Persistent Cross-Site Scripting --------------------------------------------- http://www.securityfocus.com/archive/1/525888 *** Vuln: Schneider Electric Products Multiple Security Vulnerabilities *** --------------------------------------------- Schneider Electric Products Multiple Security Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/57435 *** Blackhole outfitted with exploit for recently patched Java flaw *** --------------------------------------------- "The exploit for the recently patched CVE-2013-0431 Java vulnerability has been added to the Blackhole exploit kit, Trend Micro researchers report. The fact was discovered through the analysis of the latest PayPal-themed spam run that leads to a page hosting the exploit kit. Users are presented with a "Receipt for your PayPal payment to" email, and are urged to verify the details of the payment order by clicking on a link included in the message...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2430 *** CSA: What are 2013s top cloud security threats? *** --------------------------------------------- "The Cloud Security Alliance (CSA) has released a new report designed to examine the most pervasive security threats still threatening cloud in 2013. Called The Notorious Nine presumably using the same nomenclature that Enid Blyton employed for the protagonists of her fabled childrens books the CSA enlisted the help of industry experts, and is designed to be used in conjunction with other CSA best practice guides; Security Guidance for Critical Areas in Cloud Computing V. 3 and Security as... --------------------------------------------- http://www.cloudcomputing-news.net/news/2013/mar/04/csa-what-are-2013s-top-… *** Pwn Pad Steals the Show at RSA Cyber Security Conference in San Francisco *** --------------------------------------------- "Pwnie Express, the Vermont-based firm known for the Pwn Plug and Power Pwn, released a new appliance at RSA: the Pwn Pad. This handheld tablet allows security-and-IT-focused personnel to safely test their own network for wireless and wired security issues. The product brings an unprecedented level of ease to security testing, and has been met with critical acclaim at RSA...." --------------------------------------------- http://www.sfgate.com/business/prweb/article/Pwn-Pad-Steals-the-Show-at-RSA…

1 0

Tageszusammenfassung - Dienstag 5-03-2013
by Daily end-of-shift report 05 Mar '13

05 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-03-2013 18:00 − Dienstag 05-03-2013 18:00 Handler: Stephan Richter Co-Handler: n/a *** D-Link DSL-2740B (ADSL Router) Authentication Bypass *** --------------------------------------------- Topic: D-Link DSL-2740B (ADSL Router) Authentication Bypass Risk: High Text:+ + # Exploit Title : D-Link DSL-2740B (ADSL Router) Authentication Bypass # Date : 10-02-2013 #... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2Fn9pSNqklg/WLB-20… *** Cloudflare Briefly Drops Off Internet Deflecting DDOS Attack *** --------------------------------------------- "CloudFlares Juniper routers choked on a slight programming change designed to deflect a distributed denial-of-service attack, knocking the companys services off the Internet for about an hour early Sunday morning. The San Francisco-based company provides a service that speeds up the delivery of web pages and reduces bandwidth. It also provides a suite of security tools that helps website owners identify and filter malicious traffic...." --------------------------------------------- http://www.cio.com/article/729658/Cloudflare_Briefly_Drops_Off_Internet_Def… *** Cyber Security Bulletin (SB13-063) - Vulnerability Summary for the Week of February 25, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability... --------------------------------------------- http://www.us-cert.gov/ncas/bulletins/SB13-063 *** Vuln: OpenStack Keystone CVE-2013-0282 Security Bypass Vulnerability *** --------------------------------------------- OpenStack Keystone CVE-2013-0282 Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58033 *** Heads-UP - EU, US go separate ways on cybersecurity *** --------------------------------------------- "Europe and the United States look set to implement different approaches to cybersecurity, with Washington adopting voluntary reporting mechanisms against Brussels compulsory measures. The difference approaches threaten to create problems for companies across the two major trade blocs. President Barack Obama on 12 February issued an executive order on cybersecurity that calls for voluntary sharing of information on cyberattacks between business and government...." --------------------------------------------- http://www.euractiv.com/specialreport-cybersecurity/eu-us-set-different-app… *** Java trotz Notfall-Patch verwundbar *** --------------------------------------------- Oracle hat aktualisierte Versionen von Java 5, 6 und 7 bereitgestellt. Sie schließen zwei kritische Lücken, von denen eine bereits von Cyber-Kriminellen ausgenutzt wird. Sicher ist Java allerdings trotzdem nicht. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2936e0b6/l/0L0Sheise0Bde0Csec… *** Open standards are key for security in the cloud *** --------------------------------------------- "The current divide between proprietary and open approaches to enterprise cloud computing has implications beyond the obvious. More than just issues of cloud interoperability and data portability, open standards have benefits for user identity, authentication and security intelligence that closed or proprietary clouds threaten to compromise. Our belief is that an open cloud is a more secure one and it begins with identity...." --------------------------------------------- http://www.net-security.org/article.php?id=1812

1 0

Tageszusammenfassung - Montag 4-03-2013
by Daily end-of-shift report 04 Mar '13

04 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 01-03-2013 18:00 − Montag 04-03-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Bit9 Breach Began in July 2012 *** --------------------------------------------- Cyber espionage hackers who broke into security firm Bit9 initially breached the companys defenses in July 2012, according to evidence being gathered by security experts investigating the incident. Bit9 remains reluctant to name customers that were impacted by the intrusion, but the custom-made malicious software used in the attack was deployed last year in highly targeted attacks against U.S. Defense contractors.Related Posts:New Java 0-Day Attack Echoes Bit9 BreachSecurity Firm Bit9 Hacked, --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/T12Pp-nAeFw/ *** Exploit Sat on LA Times Website for 6 Weeks *** --------------------------------------------- The Los Angeles Times has scrubbed its Web site of malicious code that served browser exploits and malware to potentially hundreds of thousands of readers over the past six weeks.Related Posts:Amnesty International Site Serving Java ExploitWhat You Need to Know About the Java ExploitAttackers Pounce on Zero-Day Java ExploitNasty Twitter Worm OutbreakNew Java 0-Day Attack Echoes Bit9 Breach --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/6Ws9-MtXu3w/ *** Flame Windows Update Attack Could Have Been Repeated in 3 Days, Says Microsoft *** --------------------------------------------- "When the sophisticated state-sponsored espionage tool known as Flame was exposed last year, there was probably no one more concerned about the discovery than Microsoft, after realizing that the tool was signed with an unauthorized Microsoft certificate to verify its trustworthiness to victim machines. The attackers also hijacked a part of Windows Update to deliver it to targeted machines. After examining the nature of the certificate attack and everything the malicious actors needed to --------------------------------------------- http://www.wired.com/threatlevel/2013/03/flame-windows-update-copycat/ *** Apple blockiert veraltete Flash-Plug-ins in Safari *** --------------------------------------------- Apples hauseigener Browser lässt den Start alter Versionen des Flash-Plug-in nicht mehr zu. Das soll offenbar kürzlich bekanntgewordene Angriffsmöglichkeiten unterbinden. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2921880b/l/0L0Sheise0Bde0Csec… *** Notiz-Dienst Evernote wurde gehackt *** --------------------------------------------- Die Betreiber des Online-Notizbuchs haben alle Anwender aufgefordert, ihre Passwörter zu ändern, nachdem sich Kriminelle Zugang zur Benutzerdatenbank verschafft hatten. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/2925520f/l/0L0Sheise0Bde0Csec… *** More Java-based malware plagues the cross-platform runtime *** --------------------------------------------- "Java cannot seem to get a break. Only a few days after patching the last zero-day vulnerability, two more exploits are being found that make use of the runtime. One, as noted by Kaspersky, is a recent exploit of the latest runtimes attempts to install a McRAT executable by overwriting memory in the JVM that will trigger the executable to run...." --------------------------------------------- http://reviews.cnet.com/8301-13727_7-57572168-263/more-java-based-malware-p… *** Kaspersky Internet Security 2013 Remote system freeze *** --------------------------------------------- Topic: Kaspersky Internet Security 2013 Remote system freeze Risk: Medium Text:I usually do not write security advisories unless absolutely necessary. This time I should, however I have neither the time,... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/MKm3MtRa-Q0/WLB-20… *** Need an army of killer zombies? Yours for just $25 per 1,000 PCs *** --------------------------------------------- Bring out your dead - theres a price per botnet head As little as $25 will buy you access to a thousand malware-infected PCs, neatly packaged as a botnet army to control or spy on. Thats according to a security researcher studying underground souks of zombie computers. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/04/botnet_pric… *** Prices fall, services rise in malware-as-a-service market *** --------------------------------------------- "Prices are falling and the number of services is increasing as developers in the online underground compete fiercely for criminals looking to purchase botnets and other tools to mount cyber attacks. The trends in the so-called malware-as-a-service market reflect a maturing business in which any non-professional can buy or rent all the tools needed to build the malware, distribute it, and then siphon credit card and banking data and other personal information from compromised PCs. --------------------------------------------- http://www.infoworld.com/d/security/prices-fall-services-rise-in-malware-se…

1 0

Tageszusammenfassung - Freitag 1-03-2013
by Daily end-of-shift report 01 Mar '13

01 Mar '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-02-2013 18:00 − Freitag 01-03-2013 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Fake Flash Player download pages pushing malware *** --------------------------------------------- "As you may already heard, Adobe has pushed out an update for Flash Player that fixes vulnerabilities discovered to be currently exploited in the wild in targeted attacks. If you havent set up automatic updating for Flash, you will have to find and download the update yourself, and the best place from which to pick it up is Adobes official Flash page. Im reiterating this because there are web pages out there that spoof Adobes legitimate one, and they are pretty well crafted (click on the... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2429 *** Browser makers open local storage hole in HTML5 *** --------------------------------------------- Bad implementation of disk space limits A slip-up in the implementation of HTML5 on Chrome, Opera and Internet Explorer can be exploited to fill users’ hard drives, according to a 22-year-old Web developer from Stanford... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/28/html_5_impl… *** Bank of America Spy Team leaked emails by Anonymous *** --------------------------------------------- "Many Bank of America spy emails available to the public. Lot of fun stuff including stuff on Sopa, Money trails, Wikileakes, Sony, Stratfor, etc... these emails have been orgnised for the public by Par:AnoIA (Potentially Alarming Research: Anonymous Intelligence Agency)..." --------------------------------------------- http://www.cyberwarzone.com/bank-america-spy-team-leaked-emails-anonymous *** PHP-Fusion 7.02.05 XSS & LFI & SQL Injection *** --------------------------------------------- Topic: PHP-Fusion 7.02.05 XSS & LFI & SQL Injection Risk: High Text:[waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05 = Author: Janek Vind "warax... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/JWjlGvtaj28/WLB-20… *** Spearphishing in your office *** --------------------------------------------- "Spear Phishing is on the rise, and many of you dont even realize its happening to you. It used to be youd get a random email from a bank you dont do business with, claiming an account security issue. Its pretty easy to figure out, But what if you get an email from your companys HR department with a policy change notification, or vacation policy update...." --------------------------------------------- http://ktar.com/153/1613505/Spearphishing-in-your-office *** Sinkholes reveal more Chinese-hacked biz - and piggybacking crims *** --------------------------------------------- Its not just state-backed spies using snoop-ware armies Researchers have identified yet more high-profile organisations attacked by spying Chinese hackers after seizing hold of the miscreants command-and-control servers... --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/03/01/sinkhole_re… *** Stuxnet, The Prequel: Earlier Version Of Cyberweapon Discovered *** --------------------------------------------- "Researchers at Symantec have identified an earlier version of the Stuxnet malware that shows that the cyberattacks on Irans Natanz nuclear plant date back as early as 2005 and targeted another piece of uranium-enrichment equipment. Symantec found what it calls Stuxnet version 0. 5 of the sophisticated cyberweapon among the samples it had collected from the version of the malware that was first discovered in the wild back in July 2010 and was created in 2009...." --------------------------------------------- http://www.darkreading.com/advanced-threats/167901091/security/news/2401495… *** How Much Does A Botnet Cost? *** --------------------------------------------- "The cost of a botnet is contingent largely upon the physical location of the malware-infected computers inside of it. Therefore, a botnet containing only American or European machines is worth more than one with machines from less prosperous nations. Security researcher Dancho Danchev recently profiled an underground botnet service and found that the market for botnets fueled by American machines is more lucrative than botnets consisting of an international hodgepodge of IP... --------------------------------------------- http://threatpost.com/en_us/blogs/how-much-does-botnet-cost-022813 *** Malwares Future Looks A Lot Like Its Present *** --------------------------------------------- "What does the future of malicious software look like? Depressingly like the present, according to a panel of leading experts. Phishing attacks, spam and even self-propagating worms will continue to plague technology users in the years ahead, just as they have for much of the last two decades, according to experts at the RSA Security Conference in San Francisco on Wednesday...." --------------------------------------------- http://securityledger.com/what-will-malware-look-like-in-a-few-years/ *** sudo authentication bypass when clock is reset *** --------------------------------------------- Topic: sudo authentication bypass when clock is reset Risk: High Text:Sudo 1.8.6p7 and 1.7.10p7 are now available which include a fix for the following bug: Sudo authentication bypass when clock... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Cg957nnlc_A/WLB-20… *** Piwigo 2.4.6 Cross Site Request Forgery / Traversal Vulnerabilities *** --------------------------------------------- Topic: Piwigo 2.4.6 Cross Site Request Forgery / Traversal Vulnerabilities Risk: Medium Text:Product: Piwigo Vendor: Piwigo project Vulnerable Version(s): 2.4.6 and probably prior Tested Version: 2.4.6 Vendor Notific... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/4-cD4XbHTA0/WLB-20… *** [papers] - Post XSS Exploitation: Advanced Attacks and Remedies *** --------------------------------------------- http://www.exploit-db.com/download_pdf/24559 *** And the Java 0-days just keep on coming, (Fri, Mar 1st) *** --------------------------------------------- The bad guys certainly seem to be picking on Oracle in the last month or two. The folks over at Fireeye have posted some info about another 0-day affecting Java that is being exploited in the wild. This one hits even the latest versions of Java 6u41 and 7u15. From the writeup the it seems the exploit is currently not always successful, but when it is drops a remote access trojan on the systme and connects back to an HTTP command and control server. I havent had a chance to actually look at the... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15310&rss

1 0

Tageszusammenfassung - Donnerstag 28-02-2013
by Daily end-of-shift report 28 Feb '13

28 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-02-2013 18:00 − Donnerstag 28-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** Kelihos-Botnet ausgeknipst - Live on stage *** --------------------------------------------- Während einer Präsentation hat ein Sicherheitsforscher live die Kommunikationskanäle des Viagra-Spam-Botnets Kelihos vergiftet und das Zombie-Netzwerk damit de facto abgeschaltet. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/29084f8e/l/0L0Sheise0Bde0Csec… *** Hacking Victim Bit9 Blames SQL Injection Flaw *** --------------------------------------------- "Bit9 said a common Web application vulnerability was responsible for allowing hackers to ironically use the security vendors systems as a launch pad for attacks on other organizations. Based in Waltham, Massachusetts, the company sells a security platform that is designed in part to stop hackers from installing their own malicious software. In an embarrassing admission, Bit9 said earlier this month that it neglected to install its own software on a part of its network, which lead to the --------------------------------------------- http://www.cio.com/article/729401/Hacking_Victim_Bit9_Blames_SQL_Injection_… *** cPanel: Reset your root passwords! Hackers broke into our system *** --------------------------------------------- "Website administration firm cPanel has told The Reg that one of its proxy servers was hacked, potentially exposing customers administrator-level passwords. cPanel discovered that one of its systems, used to handle technical support tickets, was infiltrated nearly a week ago. The biz, which provides tools for managing Unix-powered websites, has urged anyone who contacted its help-desk within the last six months to change their root passwords - a credential requested in new support --------------------------------------------- http://www.theregister.co.uk/2013/02/27/cpanel_support_server_hacked/ *** Joomla! 3.0.2 PHP Object Injection *** --------------------------------------------- Topic: Joomla! 3.0.2 PHP Object Injection Risk: Medium Text: - Joomla! --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/q-jzkZbxx84/WLB-20… *** Drupal Creative Theme 7.x Cross Site Scripting *** --------------------------------------------- Topic: Drupal Creative Theme 7.x Cross Site Scripting Risk: Low Text:View online: https://drupal.org/node/1929474 * Advisory ID: DRUPAL-SA-CONTRIB-2013-024 * Project: Creative Theme [1] (t... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/SebLduXdSsE/WLB-20… *** 'MiniDuke' malware takes aim at Euro governments via Adobe *** --------------------------------------------- A new attack is targeting European governments through flaws exploited in Adobe's Reader software, according to security researchers. --------------------------------------------- http://news.cnet.com/8301-1009_3-57571571-83/miniduke-malware-takes-aim-at-… *** German Customers of PayPal, ING-DiBa Asked by Scammers to Update Accounts *** --------------------------------------------- In a brand new phishing campaign targeting Germans, scammers set their eyes on identification data of PayPal and ING customers in Germany. --------------------------------------------- http://www.hotforsecurity.com/blog/german-customers-of-paypal-ing-diba-aske… *** Moscows speed cameras knackered by MYSTERY malware *** --------------------------------------------- Infection spread from cops to traffic gear - report Malware has infected a Russian police computer network, knackering speed cameras in and around Moscow, according to reports. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/28/malware_hob… *** Vuln: Todd Miller Sudo CVE-2013-1775 Local Authentication Bypass Vulnerability *** --------------------------------------------- Todd Miller Sudo CVE-2013-1775 Local Authentication Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58203 *** Vuln: Todd Miller Sudo CVE-2013-1776 Local Security Bypass Vulnerability *** --------------------------------------------- Todd Miller Sudo CVE-2013-1776 Local Security Bypass Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/58207

1 0

Tageszusammenfassung - Mittwoch 27-02-2013
by Daily end-of-shift report 27 Feb '13

27 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-02-2013 18:00 − Mittwoch 27-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Ichitaro zero-day Vulnerability exploited in the wild, targets Japan users *** --------------------------------------------- "JustSystems Corporation, the developer of one of the top Japanese word processor Ichitaro, announced that Arbitrary code execution vulnerbility in Ichitaro is being exploited in the wild. When an user open a malicious document that exploits this vulnerability, the malware will be dropped in the victims machine. The malware can delete your data , warns JustSystems...." --------------------------------------------- http://www.ehackingnews.com/2013/02/ichitaro-zero-day-vulnerability.html *** Certified online banking trojan in the wild *** --------------------------------------------- "Jean-Ian Boutin, who works for AV firm Eset, has discovered trojans that carry a valid digital signature. This potentially allows online banking spyware to pass superficial tests as harmless. Apparently, the certificate in question was issued by the DigiCert Certificate Authority to a company that ceased to exist a long time ago...." --------------------------------------------- http://www.h-online.com/security/news/item/Certified-online-banking-trojan-… *** DSA-2632 linux-2.6 *** --------------------------------------------- privilege escalation/denial of service --------------------------------------------- http://www.debian.org/security/2013/dsa-2632 *** The email gaffe - how to control the damage *** --------------------------------------------- ""It sended!" says a distraught Gloria on TV comedy Modern Family. "Please come back."Its a familiar phrase said all too often in the tech era, where email gaffes happen every day. Take for example the story of the British bride-to-be who was humiliated after the hotel where she planned to hold her wedding described her and her fiance in an email as not "the right type of people" to stay there...." --------------------------------------------- http://www.smh.com.au/digital-life/hometech/the-email-gaffe--how-to-control… *** Schon wieder Notfall-Update für Flash-Player *** --------------------------------------------- Das Flash-Plugin wird in diesem Monat schon zum dritten Mal aktualisiert. Revision 11.6.602.171 soll zwei Lücken stopfen, die Adobe zufolge bereits aktiv ausgenutzt werden. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28ffb58c/l/0L0Sheise0Bde0Csec… *** Microsoft delivers final version of IE 10 for Windows 7 *** --------------------------------------------- "Microsoft released to the Web the final (non-test) build of Internet Explorer 10 for Windows 7 on February 26. As of today, Microsoft is making the final bits available for download from its IE site in 95 languages. (If that link doesnt work, try this one from the Microsoft Download Center.)Microsoft plans to begin auto-updating customers with Windows 7 Service Pack 1 and/or Windows Server 2008 R2 and higher with the IE10 "in the weeks ahead," officials said...." --------------------------------------------- http://www.zdnet.com/microsoft-delivers-final-version-of-ie-10-for-windows-… *** Encryption no longer seen as just an IT issue *** --------------------------------------------- "There has been a steady increase in the deployment of encryption solutions used by organizations over the past eight years. The percentage of overall IT security spending dedicated to encryption has also increased, almost doubling from 10% to 18%, demonstrating that organizations are prioritizing encryption over other security technologies, say the result of Thales Global Encryption Trends Study, released at RSA Conference 2013 in San Francisco. More than 4,000 business and IT managers --------------------------------------------- http://www.net-security.org/secworld.php?id=14493 *** The Real Story of Stuxnet *** --------------------------------------------- How Kaspersky Lab tracked down the malware that stymied Iran's nuclear-fuel enrichment program --------------------------------------------- http://beta.spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet *** Google sperrt hackende Spammer aus *** --------------------------------------------- Zusätzliche Sicherheitsmaßnahmen sollen den Missbrauch von legitimen Google-Accounts deutlich eingeschränkt haben. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/290553b0/l/0L0Sheise0Bde0Csec… *** Cisco Unified Communications Manager Multiple Denial of Service Vulnerabilities *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Cisco Unified Communications Manager contains two vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Exploitation of these vulnerabilities could cause an interruption of voice services.Cisco has released free software updates that address these vulnerabilities. This advisory is available at the following --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco Unified Communications Manager Multiple Denial of Service Vulnerabilities&vs_ *** Helping ISPs defend customers against bot infections *** --------------------------------------------- "At RSA Conference 2013 Kindsight announced the Kindsight Botnet Security service to help Internet service providers detect botnet activity in the network and protect subscribers against bot infections (click on the screenshot to enlarge it):The solution is embedded within the service providers networks to analyze Internet traffic for communications between infected devices and the bot masters command-and-control (C&C) servers...." --------------------------------------------- http://www.net-security.org/secworld.php?id=14506

1 0

Tageszusammenfassung - Dienstag 26-02-2013
by Daily end-of-shift report 26 Feb '13

26 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 25-02-2013 18:00 − Dienstag 26-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** Lücke im Linux-Kern ermöglicht Root-Rechte *** --------------------------------------------- Ein Fehler bei der Behandlung von Netlink-Nachrichten im Linux-Kernel kann dazu führen, dass ein Anwender sich Root-Rechte erschleicht. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28f137a9/l/0L0Sheise0Bde0Csec… *** Skyhigh Networks lets bosses snoop on employee cloud use *** --------------------------------------------- Big Brother for the (secure) common good RSA 2013 People have a tendency to skirt corporate IT policy and use their own applications on the network, and Skyhigh Networks thinks it has a way for IT admins to stop this from happening. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/25/skyhigh_sno… *** McAfee dumps signatures and proclaims an (almost) end to botnets *** --------------------------------------------- Claims first truly integrated security package RSA 2012 Signature-based malware identification has been around since the dawn of the computer security industry, but McAfee has said its dumping the system or rather, adapting it in an upgraded security suite which will (it claims) virtually eliminate susceptibility to botnets. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/26/mcafee_secu… *** Several Oil rigs computers infected by malware after employees downloaded P*** *** --------------------------------------------- ""Human is one of the worst vulnerable system". The recent report from Houston Chronicle is an example for this quote, several offshore oil rigs computers infected by malwares after employees downloaded P*** and Pirated contents. According to the report, the malware attacks have occurred at several offshore rigs and platforms and knocked some offline...." --------------------------------------------- http://www.ehackingnews.com/2013/02/oil-rigs-infected-by-malware.html *** Japanese gov builds APT database to study targeted attack info *** --------------------------------------------- Hopes to understand attackers MO, share info with US The Japanese government will respond to the increasing threats from targeted cyber attacks by building a centralised advanced persistent threat (APT) database designed to aggregate threat intelligence so it can be shared with domestic security organisations and foreign governments. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/26/japan_apt_d… *** Sicherheitslücke in neuester Java-Version entdeckt *** --------------------------------------------- Oracles Mitarbeiter dürften unter Dauerstress stehen. Auch die neueste Version soll eine Sicherheitslücke enthalten, gleichzeitig kursieren Exploits für die ältere Version 7u11. Nutzer sollten schleunigst updaten oder deinstallieren. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28f6819d/l/0L0Sheise0Bde0Csec… *** Google 2-step login verification flaw allows account hijacking *** --------------------------------------------- Duo Security researchers have found an easy way to bypass Google's two-step login verification by capturing a users application-specific password. --------------------------------------------- https://www.net-security.org/secworld.php?id485 *** DDoS Attacks on Banks Resume - Experts Warn Botnet Getting Stronger *** --------------------------------------------- "Izz ad-Din al-Qassam Cyber Fighters has launched a new wave of distributed-denial-of-service attacks against U.S. banks and credit unions, and experts say institutions can expect more incidents in the coming days. Just after 10 a.m. ET on Feb. 25, the opening day of RSA Conference 2013, a handful of U.S. banking institutions were reportedly targeted as part of the latest attacks...." --------------------------------------------- http://www.bankinfosecurity.com/ddos-attacks-on-banks-resume-a-5541

1 0

Tageszusammenfassung - Montag 25-02-2013
by Daily end-of-shift report 25 Feb '13

25 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-02-2013 18:00 − Montag 25-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: L. Aaron Kaplan *** SCADA & Security of Critical Infrastructures *** --------------------------------------------- "In the last few years there has been an increase within the worldwide security community consciousness of the risks related to cyber-attacks against critical infrastructures of a countries; an event considered by principal security experts extremely likely. Probably the strongest jolt has been caused by events such as the spread of the cyber weapon Stuxnet. This represented a historic change in the conception of military conflict: by using a malicious code, an actor in cyberspace could --------------------------------------------- http://resources.infosecinstitute.com/scada-security-of-critical-infrastruc… *** How researcher Hacked Facebook OAuth To Get Full Permission On Any Facebook Account *** --------------------------------------------- "A Security Researcher Nir Goldshlager, has discovered a security flaw in Facebook that allowed him to take a full control over any Facebook account. OAuth is used by Facebook to communicate between Applications and Facebook users, Usally users must allow/accept the application request to access their account before the communication can start. Facebook application might ask for different permissions...." --------------------------------------------- http://www.ehackingnews.com/2013/02/how-researcher-hacked-facebook-oauth-to… *** Auch Rechner bei Microsoft gehackt *** --------------------------------------------- Nach Facebook, Twitter und Apple ist auch Microsoft Opfer eines Hacker-Angriffs geworden. Das gab der Konzern in einem Blog bekannt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28df5094/l/0L0Sheise0Bde0Csec… *** When web sites go bad: bible . org compromise *** --------------------------------------------- "This is more of an "awareness" item to show to coworkers and relatives that you cant be careful enough. "bible . org" is a site that offers as the name implies access to the bible and related commentary as well as translations. Sadly, earlier this week the site go appearantly compromissed...." --------------------------------------------- http://www.cyberwarzone.com/when-web-sites-go-bad-bible-org-compromise *** SQL Injection vulnerability in extension CoolURI (cooluri) *** --------------------------------------------- It has been discovered that the extension "CoolURI" (cooluri) is vulnerable to SQL Injection. --------------------------------------------- http://typo3.org/news/article/sql-injection-vulnerability-in-extension-basi… *** Several vulnerabilities in third party extensions *** --------------------------------------------- Several vulnerabilities have been found in the following third-party TYPO3 extensions: attacalendar, attacpetition, eu_subscribe, exinit_job_offer, fefilebrowser, js_css_optimizer, kk_csv2table, lonewsseo, mn_mysql2json, news_search, tipafriend_plus, twitter_auth, sofortueberweisung2commerce, sys_messages --------------------------------------------- http://typo3.org/news/article/several-vulnerabilities-in-third-party-extens… *** Oracle Enterprise Manager dBClone SQL Injection *** --------------------------------------------- Topic: Oracle Enterprise Manager dBClone SQL Injection Risk: Medium Text: --BEGIN PGP SIGNED MESSAGE -- Hash: SHA1 TeamSHATTER Security Advisory SQL Injection in Oracle Enterprise Manager (dBCl... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/hJWisPeyKXY/WLB-20… *** Samsung Galaxy S3 Screen-Lock Bypass *** --------------------------------------------- Topic: Samsung Galaxy S3 Screen-Lock Bypass Risk: Medium Text:MTI Technology Vulnerability Research Team www.mti.com ukpentestinfo"at"mti.com Samsung Galaxy S3 partial screen-lock... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Ao6gcgJr_qc/WLB-20… *** Berichte: Hacker griffen Firmen und Behörden an *** --------------------------------------------- Hacker aus China haben 2012 deutsche Behörden und die Unternehmen EADS und ThyssenKrupp angegriffen, berichten Focus und Spiegel. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28e67749/l/0L0Sheise0Bde0Csec… *** Firefox to spit out third-party cookies *** --------------------------------------------- Mozilla says Apples got it more or less right The Mozilla Foundation has set up camp alongside Apple in the 'cookies are bad' section of the Internet, decreeing that three versions hence its flagship Firefox browser wont accept cookies from anyone other than the publisher of websites it visits. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/25/firefox_coo… *** Schwachstellen auf dem Silbertablett *** --------------------------------------------- Eine neue Suchmaschine namens Punkspider präsentiert die Scan-Ergebnisse der Sicherheitstests von Millionen von Web-Sites offen für jedermann. Ärger ist damit programmiert. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28eebfbc/l/0L0Sheise0Bde0Csec…

1 0

Tageszusammenfassung - Freitag 22-02-2013
by Daily end-of-shift report 22 Feb '13

22 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-02-2013 18:00 − Freitag 22-02-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** Bugtraq: [security bulletin] HPSBMU02836 SSRT101056 rev.1 - HP ArcSight Connector Appliance and ArcSight Logger, Remote Disclosure of Information, Command Injection, Cross-Site Scripting (XSS) *** --------------------------------------------- http://www.securityfocus.com/archive/1/525764 *** Vuln: Multiple OpenStack Products Information Disclosure and Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/58022 *** Why You Shouldnt Use the OWASP Top 10 as a List of Software Security Requirements *** --------------------------------------------- On February 15, the Open Web Application Security Project (OWASP) came out with its 2013 list of candidates for the Top 10 web application security flaws. This list is available here and open for public comment - the final Top 10 list will come out in April or May. If its anything like previous years, OWASP Top 10 2013 will become the de facto yardstick that organizations use to test if their applications are secure. This is at least partially because the Payment Card Industry Data... --------------------------------------------- http://www.infosecisland.com/blogview/22951-Why-You-Shouldnt-Use-the-OWASP-… *** libxml2 and expat internal and external XML entity expansion *** --------------------------------------------- Topic: libxml2 and expat internal and external XML entity expansion Risk: High Text: So here are the CVEs for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/v1lpK84nIpw/WLB-20… *** VMware releases new and updated security advisories, (Fri, Feb 22nd) *** --------------------------------------------- VMware has released the following new and updated security advisories: New: VMSA-2013-0003 http://www.vmware.com/security/advisories/VMSA-2013-0003.html Updated: VMSA-2012-0018 http://www.vmware.com/security/advisories/VMSA-2012-0018.html VMSA-2013-0001 http://www.vmware.com/security/advisories/VMSA-2013-0001.html Chris Mohan --- Internet Storm Center Handler on Duty (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15244&rss *** SSHD rootkit in the wild, (Thu, Feb 21st) *** --------------------------------------------- There are a lot of discussions at the moment about a SSHD rootkit hitting mainly RPM based Linux distributions. Thanks to our reader unSpawn, we received a bunch of samples of the rootkit. The rootkit is actually a trojanized library that links with SSHD and does *a lot* of nasty things to the system. At this point in time we still do not know what the initial attack vector is it is unknown how the attackers get root access on the compromised servers that is needed to change the legitimate... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15229&rss *** Risk Factory: Lets Get Physical *** --------------------------------------------- "Security issues associated with the Internet of hings (IoT)..." --------------------------------------------- http://www.slideshare.net/RichardHollis/risk-factory-lets-get-physical *** Employees May Be a Companys Greatest Cybersecurity Vulnerability *** --------------------------------------------- Apple Inc, disclosed a cyber attack Tuesday, which started when employees visited a website for software developers and inadvertently picked up malicious software that infected their computers. Similarly, Facebook announced last week that malware got onto employee laptops after some employees visited a compromised developer website. And in a recent report about hackers infiltrating systems at The New York Times, investigators came to suspect that employees opened malicious links or... --------------------------------------------- http://www.law.com/corporatecounsel/PubArticleCC.jsp?id=1202588933863&Emplo… *** Hidden security threats on enterprise networks *** --------------------------------------------- Check Point uncovered the major security risks and threats that impact organizations worldwide. Their new report examines the leading security threats, the risky web applications that compromise network security, and incidences of unintentional loss of data caused by employees. The report is based on research from 888 companies worldwide, and gives insight into the network security events that actually occurred within organizations during 2012, and the security risks that companies are... --------------------------------------------- http://www.net-security.org/secworld.php?id=14465 *** EU cyber laws should target IT suppliers security negligence *** --------------------------------------------- "Cyber security has made its ultimate mainstream breakthrough. This week, a relatively minor hack targeted at Apple not only made the BBC 10 Oclock News, but warranted a lengthy studio discussion between presenter Sophie Raworth and a BBC security correspondent. Attacks of varying sophistication and impact are becoming a near daily occurrence - and they are only the ones we hear about...." --------------------------------------------- http://www.computerweekly.com/blogs/editors-blog/2013/02/eu-cyber-laws-shou… *** Zertifizierter Online-Banking-Trojaner *** --------------------------------------------- Der AV-Hersteller Eset hat eine Reihe von Trojanern entdeckt, die mit einem gültigen Zertifikat signiert waren. Das hat der Zertifikatsherausgeber DigiCert ausgestellt – und zwar einer Firma, die es schon lang nicht mehr gibt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28d8d768/l/0L0Sheise0Bde0Csec… *** Protect your computer from hackers & viruses(Infographic) *** --------------------------------------------- http://blog.botrevolt.com/

1 0

Tageszusammenfassung - Donnerstag 21-02-2013
by Daily end-of-shift report 21 Feb '13

21 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-02-2013 18:00 − Donnerstag 21-02-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** SANS SCADA Summit at Orlando - Bigger problems and so far from getting them solved, (Wed, Feb 20th) *** --------------------------------------------- 7 days ago finished the eight version of the SANS SCADA Summit at Orlando. Conferences were really great and it was a great opportunity to see that I am not the only CISO that is having trouble developing and implementing an information security program to the ICS world of the company. The most important conclusions obtained back there are: Operators and professionals from the industrial world does only care about the process: they want it efficient, reliable, available all the time and... --------------------------------------------- http://isc.sans.edu/diary.html?storyid=15160&rss *** Vuln: Jenkins Cross-Site Scripting, Security Bypass, and Denial of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/57994 *** Vuln: Drupal Core Image Derivatives Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/58069 *** Vuln: Drupal Ubercart Views and Ubercart Modules full name field HTML Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/58065 *** Vuln: Drupal Menu Reference Module HTML Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/58067 *** Vuln: Drupal Banckle Chat Module Access Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/57942 *** Bugtraq: [CVE-2013-1636]Wordpress pretty-link plugin XSS in SWF‏ *** --------------------------------------------- http://www.securityfocus.com/archive/1/525758

1 0

Tageszusammenfassung - Mittwoch 20-02-2013
by Daily end-of-shift report 20 Feb '13

20 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-02-2013 18:00 − Mittwoch 20-02-2013 18:00 Handler: Stephan Richter Co-Handler: Christian Wojner *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-13:01.bind *** --------------------------------------------- FreeBSD Security Advisory FreeBSD-SA-13:01.bind --------------------------------------------- http://www.securityfocus.com/archive/1/525732 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-13:02.libc *** --------------------------------------------- FreeBSD Security Advisory FreeBSD-SA-13:02.libc --------------------------------------------- http://www.securityfocus.com/archive/1/525735 *** Oracle stopft Sicherheitslecks: Updates für Java 1.4 bis 7 *** --------------------------------------------- Oracle hat erneut ein Update für die Java-Laufzeitumgebung veröffentlicht. Es schliesst fünf Sicherheitslücken, drei davon mit der höchsten Gefährdungsstufe. Auch die Schwachstelle "Lucky 13" soll beseitigt sein. Weitere Patches sollen im April folgen. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28c21278/l/0L0Sheise0Bde0Csec… *** Apple FINALLY fills gaping Java hole that pwned its own devs *** --------------------------------------------- Zero-day vuln also downed Facebook staff and other Mac users Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apples own developers, their counterparts at Facebook and scores of other Mac-using companies. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2013/02/20/apple_java_… *** CloudFlare vs Incapsula vs ModSecurity - A Comparative Penetration Testing Analysis Report *** --------------------------------------------- This document contains the results of a comparative penetration test conducted by a team of security specialists at Zero Science Lab against three 'leading' web application firewall solutions. Our goal was to bypass security controls in place, in any way we can, circumventing whatever filters they have. This report also outlines the setup and configuration process, as well as a detailed security assessment. --------------------------------------------- http://zeroscience.mk/files/wafreport2013.pdf

1 0

Tageszusammenfassung - Dienstag 19-02-2013
by Daily end-of-shift report 19 Feb '13

19 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-02-2013 18:00 − Dienstag 19-02-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** Bugtraq: Reflective/Stored XSS in Responsive Logo Slideshow Plugin Cross-Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/525726 *** Bugtraq: Reflective XSS in Marekkis Watermark-Plugin Cross-Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/525724 *** Cyber Security Bulletin (SB13-049) - Vulnerability Summary for the Week of February 11, 2013 *** --------------------------------------------- "The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cyber Security Division (NCSD) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability --------------------------------------------- http://www.us-cert.gov/cas/bulletins/SB13-049.html *** Trust but verify: when CAs fall short *** --------------------------------------------- "Weve recently experienced yet another case of a root certificate authority (CA from now on) losing control of its own certificates. And yet again, we have been waiting for either the CA or the browser to do something about it. This whole mess stems, once again, from both a governance and a technical problem...." --------------------------------------------- http://www.securelist.com/en/blog/208194124/Trust_but_verify_when_CAs_fall_… *** [TYPO3-announce] [Ticket#2013021910000016] Security issues in several third party TYPO3 extensions including cooluri and static_info_tables *** --------------------------------------------- Several vulnerabilities have been found in the following third party TYPO3 extensions: CoolURI (cooluri) Static Info Tables (static_info_tables) Fluid Extbase Development Framework (fed) My quiz and poll (myquizpoll) RSS feed from records (push2rss_3ds) Slideshare (slideshare) WEC Discussion Forum (wec_discussion) For further information on the issue in the extension "CoolURI"... --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** Netzpolitik - Hackerangriff auf sparkasse.de *** --------------------------------------------- Unbekannte haben Website manipuliert --------------------------------------------- http://derstandard.at/1361240471623/Hackerangriff-auf-sparkassede

1 0

Tageszusammenfassung - Montag 18-02-2013
by Daily end-of-shift report 18 Feb '13

18 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-02-2013 18:00 − Montag 18-02-2013 18:00 Handler: Stephan Richter Co-Handler: L. Aaron Kaplan *** Most Malware-Laden Links Came From Legitimate Sites in 2012 *** --------------------------------------------- "More malicious Websites were spotted in 2012, and most of them werent found in the seedier parts of the Internet, according to a recently released report from Websense. Nearly 85 percent of malicious Web links last year were found on legitimate hosts that had been compromised, compared to 82 percent in 2011, Websense said Tuesday in its 2013 Threat Report. Websense also found a 600 percent increase malicious websites in 2012 over 2011 levels...." --------------------------------------------- http://www.securityweek.com/most-malware-laden-links-came-legitimate-sites-… *** Vuln: IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities *** --------------------------------------------- IBM Lotus Domino HTTP Response Splitting and Cross Site Scripting Vulnerabilities --------------------------------------------- http://www.securityfocus.com/bid/55095 *** 1st International Symposium for ICS & SCADA Cyber Security 2013 *** --------------------------------------------- "The 1st International Symposium for ICS & SCADA Cyber Security brings together researchers with an interest in the security of industrial control systems in the light of their increasing exposure to cyber-space. The topics of interests are broad, ranging from security for hardware/firmware used in industrial control systems, to system aspects of ICS such as secure architectures and vulnerability screening to the human aspects of cyber security such as behaviour modelling and training. --------------------------------------------- http://www.ics-csr.com/ *** ATM Fraud & Security Digest - January 2013 *** --------------------------------------------- "January 2013 commenced with a significant number of cash trapping events detected in Europe. In response to this type of ATM fraud, the ATMIA have published Best Practices for Preventing Cash Trapping at ATMs. Card trapping was also at a significant level in January prompting warnings to the public...." --------------------------------------------- http://www.atmsecurity.com/atm-security-monthly-digest/atm-fraud-security-d… *** Webmail and Online Banks Targeted By Phishing Proxies *** --------------------------------------------- An anonymous reader writes "Netcraft confirms a recent increase in the number of malicious proxy auto-config (PAC) scripts being used to sneakily route webmail and online banking traffic through rogue proxy servers. The scripts are designed to only proxy traffic destined for certain websites, while all other traffic is allowed to go direct. If the proxy can force the user to keep using HTTP instead of HTTPS, the fraudsters running these attacks can steal usernames, passwords, session... --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/VOI-9HX5F-k/story01.htm *** Examining How Facebook Got Hacked *** --------------------------------------------- "Even the most savvy information technologists arent immune from cyber-attacks. Just ask Facebook. The social-media titan says it fell victim to a sophisticated attack discovered in January in which an exploit allowed malware to be installed on employees laptops...." --------------------------------------------- http://www.databreachtoday.com/examining-how-facebook-got-hacked-a-5518 *** They Sent A Guy A Coffin With His Name On It Why Russian Cyber Crooks Are So Scary *** --------------------------------------------- "Russian cyber crooks hanging around the darkweb are the most advanced fraudsters on the planet. And, worryingly for the rest of the world, they are some of the most patriotic too. Thats what TechWeekEurope heard during a trip to RSAs Anti-Fraud Command Center (pictured) in Tel Aviv, Israel, where sleuths, who spend their days interacting with cyber crooks on the darkweb to learn about the latest trends amongst Russias Internet thieves, told one particularly Godfather-esque story...." --------------------------------------------- http://www.techweekeurope.co.uk/news/russian-cyber-crooks-scary-rsa-fraud-c… *** Schedule update to Security Advisory for Adobe Reader and Acrobat (APSA13-02) *** --------------------------------------------- We just updated the Security Advisory (APSA13-02) posted on Wednesday, February 13, 2013 to include the planned schedule for a patch to resolve CVE-2013-0640 and CVE-2013-0641. Adobe plans to make available updates for Adobe Reader and Acrobat XI (11.0.01 and earlier) for Windows and Macintosh, X (10.1.5 and earlier) for Windows and Macintosh, 9.5.3 and [...] --------------------------------------------- http://blogs.adobe.com/psirt/2013/02/schedule-update-to-security-advisory-f… *** IT-Sicherheit: Nur wenige handeln vernünftig *** --------------------------------------------- Eine neue Studie der TU und der Universität Wien beschreibt das Sicherheitsverhalten österreichischer Unternehmen und Privatpersonen. Das Sicherheitsbewusstsein im IT-Bereich bei Behörden und Großunternehmen ist hoch, doch doch selbst gut Informierte wappnen sich oft unzureichend. --------------------------------------------- http://futurezone.at/digitallife/14151-it-sicherheit-nur-wenige-handeln-ver… *** Tech Insight: Attribution is Much More Than a Source IP *** --------------------------------------------- "Recent attacks are shining more light on the need for attribution, but companies seem too quick to jump to the Chinese / APT bandwagon."The Chinese hacked us" is becoming an all too common phrase in recent corporate hacks. While it is no doubt true in some of the situations, its hard not to wonder how many of these attack victims are crying Red Army... er, uhm... wolf. Or, how many are simply basing their accusations on incomplete, faulty evidence...." --------------------------------------------- http://www.darkreading.com/threat-intelligence/167901121/security/attacks-b… *** [BSI] TW-T13/0016 - Mehrere Schwachstellen in Pidgin geschlossen *** --------------------------------------------- BETROFFENE SYSTEME - Pidgin vor Version 2.10.7 EMPFEHLUNG Das BürgerCERT empfiehlt die zeitnahe Installation der vom Hersteller bereitgestellten Sicherheitsupdates [4], um die Schwachstellen zu schlieÃŸen. BESCHREIBUNG Pidgin ist ein Instant Messaging Client, der mehrere Instant Messaging... --------------------------------------------- https://www.buerger-cert.de/archive?type=widtechnicalwarning&nr=TW-T13-0016 *** [webapps] - Netgear DGN2200B - Multiple Vulnerabilities *** --------------------------------------------- Netgear DGN2200B - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24513 *** Bugtraq: SI6 Networks IPv6 Toolkit v1.3 released! *** --------------------------------------------- SI6 Networks IPv6 Toolkit v1.3 released! --------------------------------------------- http://www.securityfocus.com/archive/1/525711 *** Bugtraq: CORE-2012-1128 - SAP Netweaver Message Server Multiple Vulnerabilities *** --------------------------------------------- CORE-2012-1128 - SAP Netweaver Message Server Multiple Vulnerabilities --------------------------------------------- http://www.securityfocus.com/archive/1/525708

1 0

Tageszusammenfassung - Freitag 15-02-2013
by Daily end-of-shift report 15 Feb '13

15 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 14-02-2013 18:00 − Freitag 15-02-2013 18:00 Handler: Matthias Fraidl Co-Handler: Robert Waldner *** CFP: 8th International Workshop on Critical Information Infrastructures Security *** --------------------------------------------- "(CRITIS 2013) Amsterdam, The Netherlands September 16-18, 2013Deadline for submission of papers: May 10, 2013Notification to authors: June 30, 2013Camera-ready papers: August 16, 2013The eighth CRITIS Conference on Critical Information Infrastructures Security is set to continue a tradition of presenting innovative research and exploring new challenges for the protection of critical information-based infrastructures. This conference focus is on the challenges regarding resilience of smart --------------------------------------------- http://www.critis2013.nl/ *** Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Cisco Unified IP Phones 7900 Series versions 9.3(1)SR1 and prior contain an arbitrary code execution vulnerability that could allow a local attacker to execute code or modify arbitrary memory with elevated privileges.This vulnerability is due to a failure to properly validate input passed to kernel system calls from applications running in userspace. An attacker could exploit this issue by gaining local access to --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=Cisco Unified IP Phone Local Kernel System Call Input Validation Vulnerability& *** Adobe adds anti-spearphishing feature for Word embedded Flash *** --------------------------------------------- "Scheduled update fixes 17 critical flaws in Flash, two in Shockwave and adds Click to Play auto-launch check for embedded Flash in Office documents. Hot of the heels of Adobes Flash zero-day fixes last Friday, the company has released a new update which integrates a security feature that could have helped prevent recent spearphishing attacks using embedded Flash in older versions of Microsoft Office documents. The Flash Player updates fix 17 critical vulnerabilities affecting it on --------------------------------------------- http://www.cso.com.au/article/453621/adobe_adds_anti-spearphishing_feature_… *** Edimax EW-7206APg & EW-7209APg Redirection / XSS / Header Injection *** --------------------------------------------- Topic: Edimax EW-7206APg & EW-7209APg Redirection / XSS / Header Injection Risk: Low Text:Device Name: EW-7206APg / EW-7209APg Vendor: Edimax Vulnerable Firmware Releases: Device: EW-7206APg Hardw... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/hKlz2mqtt70/WLB-20… *** TP-Link TL-WA701N / TL-WA701ND Directory Traversal & XSS *** --------------------------------------------- Topic: TP-Link TL-WA701N / TL-WA701ND Directory Traversal & XSS Risk: Medium Text:Device Name: TL-WA701N / TL-WA701ND Vendor: TP-Link Vulnerable Firmware Releases: Firmware Version: 3.12.6 Bui... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/KnenNycHmss/WLB-20… *** Raidsonic IB-NAS5220 / IB-NAS4220-B XSS / Authentication Bypass *** --------------------------------------------- Topic: Raidsonic IB-NAS5220 / IB-NAS4220-B XSS / Authentication Bypass Risk: High Text:Device Name: IB-NAS5220 / IB-NAS4220-B Vendor: Raidsonic Vulnerable Firmware Releases: Product Name IB-NAS5220... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/wLNEwqEuBik/WLB-20… *** Websense Security Labs Releases 2013 Threat Report *** --------------------------------------------- "Websense Security Labs has released its 2013 Threat Report. The study details the most prevalent mobile, social, email and web-based threats from last year. As far as the web is concerned, experts say it has become significantly more malicious in 2012...." --------------------------------------------- http://news.softpedia.com/news/Websense-Security-Labs-Releases-2013-Threat-… *** Wachsender Markt für Zero-Day-Exploits *** --------------------------------------------- Mit ihrer offensiven Cyberwar-Strategie fördert die US-Regierung einen globalen Markt für IT-Sicherheitslücken, beklagen Experten. Das könnte das Web noch unsicherer machen, als es heute schon ist. --------------------------------------------- http://www.heise.de/newsticker/meldung/Wachsender-Markt-fuer-Zero-Day-Explo… *** Apple kündigt Fix für Passcode-Problem in iOS 6.1 und 6.1.1 an *** --------------------------------------------- Das Unternehmen zeigt sich über den Fehler informiert, mit dem sich auf Kontakte, Fotoalbum sowie Telefonfunktion zugreifen lässt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/28978a85/l/0L0Sheise0Bde0Csec… *** Mobile network infections increase by 67% *** --------------------------------------------- "Kindsight released a new report that reveals security threats to home and mobile networks, including a small decline in home network infections and an increase in mobile network infections. Highlights include:The rate of home network infections decreased from 13 to 11 percent in Q4; 6 percent exhibited high-level threats, such as bots, rootkits and banking Trojans. The ZeroAccess botnet continued to be the most common malware threat, infecting 0...." --------------------------------------------- http://www.net-security.org/malware_news.php?id=2415

1 0

Tageszusammenfassung - Donnerstag 14-02-2013
by Daily end-of-shift report 14 Feb '13

14 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-02-2013 18:00 − Donnerstag 14-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Drupal Manager Change For Organic Groups 7.x Cross Site Scripting *** --------------------------------------------- Topic: Drupal Manager Change For Organic Groups 7.x Cross Site Scripting Risk: Low Text:View online: http://drupal.org/node/1916312 * Advisory ID: DRUPAL-SA-CONTRIB-2013-015 * Project: Manager Change for Org... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/_gQ6taUHG30/WLB-20… *** OpenPLI OS Command Execution / Cross Site Scripting *** --------------------------------------------- Topic: OpenPLI OS Command Execution / Cross Site Scripting Risk: High Text:Device Name: OpenPLI - Dream Multimedia Box with OpenPLI software Vendor of device: Dream Multimedia Vendor of Software: Open... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Xw2JT_kHdgI/WLB-20… *** Drupal Banckle Chat 7.x Access Bypass *** --------------------------------------------- Topic: Drupal Banckle Chat 7.x Access Bypass Risk: High Text:View online: http://drupal.org/node/1916370 * Advisory ID: DRUPAL-SA-CONTRIB-2013-016 * Project: Banckle Chat [1] (thir... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/rLZXZc-YDas/WLB-20… *** Foxit Reader Plugin URL Processing Buffer Overflow *** --------------------------------------------- Topic: Foxit Reader Plugin URL Processing Buffer Overflow Risk: High Text:## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/_YZtyNAPpCI/WLB-20… *** Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash *** --------------------------------------------- Topic: Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash Risk: Medium Text:Lua for Windows (LfW) V5.1.4-46 => os.getenv ntdll.dll Crash found by: devilteam.pl contact: info(a)devilteam.pl ... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/-0kYjNur224/WLB-20… *** DirectAdmin On-Line Demo SQL Injection *** --------------------------------------------- Topic: DirectAdmin On-Line Demo SQL Injection Risk: Medium Text:++++++++++++++++++++++++++++++++++++++ # Exploit Title :DirectAdmin On-Line Demo SQLInjection # *Vendor*:http://www.directadm... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/OL1UqRx5FGI/WLB-20… *** Datenschutzbedenken bei Google Play Store *** --------------------------------------------- Bei jedem Kauf in Googles App-Store werden automatisch Name, E-Mail-Adresse und Standortinformationen zum App-Entwickler übertragen, ohne, dass der Käufer dem explizit zustimmt. --------------------------------------------- http://futurezone.at/digitallife/14096-datenschutzbedenken-bei-google-play-… *** [webapps] - Sonicwall OEM Scrutinizer v9.5.2 - Multiple Vulnerabilities *** --------------------------------------------- Sonicwall OEM Scrutinizer v9.5.2 - Multiple Vulnerabilities --------------------------------------------- http://www.exploit-db.com/exploits/24500 *** [papers] - A Short Guide on ARM Exploitation *** --------------------------------------------- A Short Guide on ARM Exploitation --------------------------------------------- http://www.exploit-db.com/download_pdf/24493 *** Unscrambling an Android Telephone With FROST *** --------------------------------------------- Noryungi writes "Researchers at the University of Erlangen demonstrate how to recover an Android phone confidential content, with the help of a freezer and FROST, a specially-crafted Android ROM. Quite an interesting set of pictures, starting with wrapping your Android phone in a freezer bag." Read more of this story at Slashdot. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/RFQuYaJ5DZU/story01.htm *** iPhone-Lücke erlaubt Zugriff ohne Passcode *** --------------------------------------------- Durch eine Schwachstelle kann man bei gesperrten iOS-Geräten auf Kontakte und Fotos zugreifen, ohne den Passcode einzugeben. Auch Telefonate sind dadurch möglich. Wir konnten das Problem mit einem iPhone 4 und einem iPhone 5 nachvollziehen, auf denen jeweils die aktuelle iOS-Version 6.1 installiert ist --------------------------------------------- http://www.heise.de/newsticker/meldung/iPhone-Luecke-erlaubt-Zugriff-ohne-P…

1 0

Tageszusammenfassung - Mittwoch 13-02-2013
by Daily end-of-shift report 13 Feb '13

13 Feb '13

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-02-2013 18:00 − Mittwoch 13-02-2013 18:00 Handler: Robert Waldner Co-Handler: Matthias Fraidl *** Data protection practices in EU and Asia *** --------------------------------------------- "Research undertaken by Field Fisher Waterhouse into the existing legal framework mandating encryption of personal data in the EU and Asia. The study details legal requirements in the EU and Asia and reveals a trajectory of data protection regulation towards encryption as a compliance imperative. The litany of highly visible data breach incidents in 2012, further compounded by the steep penalties being delivered by data protection watchdogs, means that the pressure to protect the integrity --------------------------------------------- http://www.net-security.org/secworld.php?id=14395 *** Neues Sicherheits-Update für Ruby on Rails *** --------------------------------------------- Mit den Rails-Versionen 3.2.12 und 3.1.11 und 2.3.17 werden kritische Sicherheitslücken geschlossen. Zusätzlich sollen Nutzer das Gem für JSON auf die neuste Version aktualisieren. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/287dc9e1/l/0L0Sheise0Bde0Csec… *** Summary for February 2013 - Version: 1.1 *** --------------------------------------------- This bulletin summary lists security bulletins released for February 2013. With the release of the security bulletins for February 2013, this bulletin summary replaces the bulletin advance notification originally issued February 7, 2013. --------------------------------------------- http://technet.microsoft.com/en-us/security/bulletin/ms13-feb *** RADIUS Authentication Bypass *** --------------------------------------------- Please give us your feedback on Cisco Security Intelligence Operations. Thanks! Remote Authentication Dial In User Service (RADIUS) authentication on adevice that is running certain versions of Cisco Internetworking OperatingSystem (IOS) and configured with a fallback method to none canbe bypassed.Systems that are configured for other authentication methods or thatare not configured with a fallback method tonone are not affected.Only the systems that are running certain versions of Cisco IOS --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Security Advisory&vs_cat=Security Intelligence&vs_type=RSS&vs_p=RADIUS Authentication Bypass&vs_k=1 *** How Lockheed Martins Kill Chain Stopped SecurID Attack *** --------------------------------------------- "A few months after RSA had rocked the security world with news that it had been breached and its SecurID database exposed in a sophisticated attack, defense contractor Lockheed Martin discovered an intruder in its network using legitimate credentials."We almost missed it," says Steve Adegbite, director of cybersecurity for Lockheed Martin, of the intrusion sometime around May or early June 2011. "We thought at first it was a new person in the department ... but then it --------------------------------------------- http://www.darkreading.com/authentication/167901072/security/attacks-breach… *** SonicWALL Scrutinizer 9.5.2 SQL Injection *** --------------------------------------------- Topic: SonicWALL Scrutinizer 9.5.2 SQL Injection Risk: Medium Text:Title: Sonicwall Scrutinizer v9.5.2 - SQL Injection Vulnerability Date: == 2013-02-13 References: == htt... --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/2p4Vvj_j1ng/WLB-20… *** Vuln: EMC NetWorker nsrindexd RPC Service Buffer Overflow Vulnerability *** --------------------------------------------- EMC NetWorker nsrindexd RPC Service Buffer Overflow Vulnerability --------------------------------------------- http://www.securityfocus.com/bid/57182 *** Zero-Day-Lücke im Adobe Reader *** --------------------------------------------- Sicherheitsforscher haben ein speziell präpariertes PDF-Dokument entdeckt, das offenbar eine bislang unbekannte Schwachstelle im Reader ausnutzt. --------------------------------------------- http://rss.feedsportal.com/c/32407/f/463925/s/288471e5/l/0L0Sheise0Bde0Csec… *** OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability *** --------------------------------------------- Topic: OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability Risk: High Text: --------------------------------------------- http://feedproxy.google.com/~r/securityalert_database/~3/Q1XBAdgibv4/WLB-20…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily