- Daily - CERT.at

Tageszusammenfassung - 23.02.2024
by Daily end-of-shift report 23 Feb '24

23 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 22-02-2024 18:00 − Freitag 23-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Web3 Crypto Malware: Angel Drainer – From Phishing Sites to Malicious Injections ∗∗∗ --------------------------------------------- In this post, we’ll describe how bad actors have started using crypto drainers to monetize traffic to compromised sites. Our analysis starts with a brief overview of the threat landscape and investigation of Wave 2 (the most massive infection campaign) before covering Angel Drainer scan statistics, predecessors, and most recent variants of website hacks that involve crypto drainers. --------------------------------------------- https://blog.sucuri.net/2024/02/web3-crypto-malware-angel-drainer.html ∗∗∗ Shortcuts-Lücke: Zero-Day-Exploit konnte Apples Systemsicherheit aushebeln ∗∗∗ --------------------------------------------- Apples TCC-Verfahren soll eigentlich verhindern, dass böswillige Apps ausgeführt werden. Mittels Shortcuts war das doch möglich. Die Lücke ist gestopft. --------------------------------------------- https://www.heise.de/-9636600 ∗∗∗ Intruders in the Library: Exploring DLL Hijacking ∗∗∗ --------------------------------------------- Dynamic-link library (DLL) hijacking remains a popular technique to run malware. We address its evolution using examples from the realm of cybercrime and more. --------------------------------------------- https://unit42.paloaltonetworks.com/dll-hijacking-techniques/ ∗∗∗ Everything you need to know about IP grabbers ∗∗∗ --------------------------------------------- You would never give your personal ID to random strangers, right? So why provide the ID of your computer? Unsuspecting users beware, IP grabbers do not ask for your permission. --------------------------------------------- https://www.welivesecurity.com/en/cybersecurity/everything-you-need-to-know… ∗∗∗ Weitere Informationen zu Angriffen gegen ConnectWise ScreenConnect ∗∗∗ --------------------------------------------- Sophos hat einen Überblick über Angriffe gegen ConnectWise ScreenConnect veröffentlicht. Demnach wurden bereits verschiedene Arten von Ransomware, verschiedene Information Stealer und auch unterschiedliche Remote-Access-Trojans (RATs) auf Basis der kürzlich von ConnectWise veröffentlichten Vulnerabilities in ScreenConnect deployt. Diese heterogene Bedrohungslage bedingt zur Abklärung einer bereits stattgefundenen Kompromittierung auch einen abstrahierten Blick auf etwaige eigene Installationen. Sophos beschreibt in den Kapiteln "Recommendations" und "Threat hunting information" Empfehlungen zur Vorgangsweise, selbst betriebene Instanzen auf Kompromittierungen zu untersuchen. Wir empfehlen weiterhin, etwaige eigene Installationen von ConnectWise ScreenConnect eine genaueren Untersuchung zuzuführen - auch wenn die vom Hersteller herausgegebenen Updates bereits eingespielt wurden. --------------------------------------------- https://cert.at/de/aktuelles/2024/2/weitere-informationen-zu-angriffen-gege… ∗∗∗ ProxyNotShell: Scan-Problematik der "false positives" bei Exchange (nmap, Greenbone) ∗∗∗ --------------------------------------------- Ende September 2022 scheuchte die als ProxyNotShell bekannt gewordene Schwachstelle in Microsoft Exchange Server Administratoren auf. Die Anfang August 2022 entdeckte Schwachstelle wurde als 0-day mit Exploits angegriffen und Microsoft brauchte mehrere Versuche, die Sicherheitslücke zu schließen. Inzwischen gibt es Scanner wie nmap oder Greenbone, um Exchange Server auf diese Schwachstelle zu prüfen. Allerdings liefern diese Scanner ggf. auch Fehlalarme. --------------------------------------------- https://www.borncity.com/blog/2024/02/23/proxynotshell-scan-problematik-der… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdate: Root-Lücke bedroht Servermonitoringtool Nagios XI ∗∗∗ --------------------------------------------- Admins sollten das Dienste-Monitoring mit Nagios XI aus Sicherheitsgründen zeitnah auf den aktuellen Stand bringen. --------------------------------------------- https://www.heise.de/-9636505 ∗∗∗ Sicherheitslücken: GitLab gegen mögliche Attacken abgesichert ∗∗∗ --------------------------------------------- Updates schließen mehrere Schwachstellen in GitLab. Eine Lücke bleibt aber offensichtlich erstmal bestehen. --------------------------------------------- https://www.heise.de/-9636995 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, imagemagick, and iwd), Fedora (chromium, firefox, and pdns-recursor), Mageia (nodejs and yarnpkg), Red Hat (firefox, postgresql, and postgresql:15), and SUSE (bind, mozilla-nss, openssh, php-composer2, python-pycryptodome, python-uamqp, python310, and tiff). --------------------------------------------- https://lwn.net/Articles/963352/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Sonicwall: SMA100 MFA Improper Access Control Vulnerability ∗∗∗ --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0001 ∗∗∗ F5: K000138693 : Linux kernel vulnerabilities CVE-2023-4206, CVE-2023-4207, and CVE-2023-4208 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138693 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.02.2024
by Daily end-of-shift report 22 Feb '24

22 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-02-2024 18:00 − Donnerstag 22-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ New SSH-Snake malware steals SSH keys to spread across the network ∗∗∗ --------------------------------------------- A threat actor is using an open-source network mapping tool named SSH-Snake to look for private keys undetected and move laterally on the victim infrastructure. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-ssh-snake-malware-steals… ∗∗∗ Google Play Store: Banking-Trojaner nimmt europäische Nutzer ins Visier ∗∗∗ --------------------------------------------- Im Google Play Store tauchen Varianten des Anatsa-Banking-Trojaners auf. Sie kommen auf über 100.000 Installationen. --------------------------------------------- https://www.heise.de/news/Google-Play-Store-Banking-Trojaner-nimmt-europaei… ∗∗∗ Why ransomware gangs love using RMM tools—and how to stop them ∗∗∗ --------------------------------------------- More and more ransomware gangs are using RMM tools in their attacks. --------------------------------------------- https://www.malwarebytes.com/blog/business/2024/02/why-ransomware-gangs-lov… ∗∗∗ Unmasking Lorenz Ransomware: A Dive into Recent Tactics, Techniques and Procedures ∗∗∗ --------------------------------------------- In the ever-evolving landscape of cyber threats, ransomware remains a persistent menace, with groups like Lorenz actively exploiting vulnerabilities in small to medium businesses globally. --------------------------------------------- https://research.nccgroup.com/2024/02/22/unmasking-lorenz-ransomware-a-dive… ∗∗∗ Angriffe gegen ConnectWise ScreenConnect ∗∗∗ --------------------------------------------- Die Remote Desktop und Access Software ConnectWise ScreenConnect ist aktuell Ziel von Cyberangriffen. Der Hersteller der Software hatte kürzlich ein Security Advisory bezüglich Authentication Bypass und Path Traversal Vulnerabilities veröffentlicht und dieses inzwischen um Hinweise auf bereits laufende Angriff und Indikatoren für eine bereits stattgefundene Kompromittierung erweitert. --------------------------------------------- https://cert.at/de/aktuelles/2024/2/angriffe-gegen-connectwise-screenconnect ∗∗∗ TinyTurla-NG in-depth tooling and command and control analysis ∗∗∗ --------------------------------------------- Cisco Talos, in cooperation with CERT.NGO, has discovered new malicious components used by the Turla APT. New findings from Talos illustrate the inner workings of the command and control (C2) scripts deployed on the compromised WordPress servers utilized in the compromise we previously disclosed. --------------------------------------------- https://blog.talosintelligence.com/tinyturla-ng-tooling-and-c2/ ∗∗∗ LockBit Attempts to Stay Afloat With a New Version ∗∗∗ --------------------------------------------- This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations. --------------------------------------------- https://www.trendmicro.com/en_us/research/24/b/lockbit-attempts-to-stay-afl… ∗∗∗ Decrypted: HomuWitch Ransomware ∗∗∗ --------------------------------------------- HomuWitch is a ransomware strain that initially emerged in July 2023. Unlike the majority of current ransomware strains, HomuWitch targets end-users - individuals - rather than institutions and companies. --------------------------------------------- https://decoded.avast.io/threatresearch/decrypted-homuwitch-ransomware/ ∗∗∗ “To live is to fight, to fight is to live! - IBM ODM Remote Code Execution ∗∗∗ --------------------------------------------- In today’s match-up, we’re looking at various versions(both old and new!) of IBM’s “Operational Decision Manager” (ODM). --------------------------------------------- https://labs.watchtowr.com/double-k-o-rce-in-ibm-operation-decision-manager/ ===================== = Vulnerabilities = ===================== ∗∗∗ Codeschmuggel-Lücke in diversen HP Laser-Druckern ∗∗∗ --------------------------------------------- HP warnt mit gleich zwei Sicherheitsmeldungen vor Lücken in diversen Laserjet-Druckern. Firmwareupdates sollen sie schließen. --------------------------------------------- https://www.heise.de/news/Codeschmuggel-Luecke-in-diversen-HP-Laser-Drucker… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (python-pillow), Debian (firefox-esr and imagemagick), Fedora (kernel, mbedtls, rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, and rust-vergen), Gentoo (LibreOffice), Red Hat (kpatch-patch), Slackware (mozilla), SUSE (docker, python-pycryptodome, python3, and qemu), [...] --------------------------------------------- https://lwn.net/Articles/963205/ ∗∗∗ Progress Kemp LoadMaster (Load-Balancer) Schwachstelle CVE-2024-1212 ∗∗∗ --------------------------------------------- Zum 8. Februar 2024 gab es den Hinweis für Administratoren, die den Load-Balancer LoadMaster von Progress Kemp verwenden, dessen Firmware zu aktualisieren. --------------------------------------------- https://www.borncity.com/blog/2024/02/22/progress-kemp-loadmaster-load-bala… ∗∗∗ 2024-02-22: Cyber Security Advisory - B&R Automation Studio & Technology Guarding products use insufficient communication encryption ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA23P019_Automation_Studio_Upgrade_… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ WAGO: Multiple products affected by Terrapin ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-014/ ∗∗∗ [R1] Tenable Identity Exposure Secure Relay Version 3.59.4 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2024-03 ∗∗∗ [R1] Tenable Identity Exposure Version 3.59.4 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2024-04 ∗∗∗ Delta Electronics CNCSoft-B DOPSoft ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-053-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.02.2024
by Daily end-of-shift report 21 Feb '24

21 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-02-2024 18:00 − Mittwoch 21-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Open Source in Enterprise Environments - Where Are We Now and What Is Our Way Forward? ∗∗∗ --------------------------------------------- We have been used to hearing that free and open source software and enterprise environments in Big Business are fundamentally opposed and do not mix well. Is that actually the case, or should we rather explore how business and free software can both benefit going forward? --------------------------------------------- https://bsdly.blogspot.com/2022/09/open-source-in-enterprise-environments.h… ∗∗∗ VoltSchemer attacks use wireless chargers to inject voice commands, fry phones ∗∗∗ --------------------------------------------- A team of academic researchers show that a new set of attacks called VoltSchemer can inject voice commands to manipulate a smartphones voice assistant through the magnetic field emitted by an off-the-shelf wireless charger. --------------------------------------------- https://www.bleepingcomputer.com/news/security/voltschemer-attacks-use-wire… ∗∗∗ Security: Forscher erzeugen Fingerabdrücke aus Wischgeräuschen ∗∗∗ --------------------------------------------- Die Methode basiert auf einer Reihe komplexer Algorithmen, mit denen sich schließlich ein Master-Fingerabdruck erzeugen lässt. --------------------------------------------- https://www.golem.de/news/security-forscher-erzeugen-fingerabdruecke-aus-wi… ∗∗∗ Phishing pages hosted on archive.org, (Wed, Feb 21st) ∗∗∗ --------------------------------------------- The Internet Archive is a well-known and much-admired institution, devoted to creating a “digital library of Internet sites and other cultural artifacts in digital form”[1]. [...] Unfortunately, since it allows for uploading of files by users, it is also used by threat actors to host malicious content from time to time[2,3]. --------------------------------------------- https://isc.sans.edu/diary/rss/30676 ∗∗∗ Breakdown of Tycoon Phishing-as-a-Service System ∗∗∗ --------------------------------------------- Just weeks after Trustwave SpiderLabs reported on the Greatness phishing-as-a-service (PaaS) framework, SpiderLabs’ Email Security team is tracking another PaaS called Tycoon Group. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/breakdown-o… ∗∗∗ re: Zyxel VPN Series Pre-auth Remote Command Execution ∗∗∗ --------------------------------------------- An unauthenticated command injection exploit affecting Zyxel firewalls was published in late January without an associated CVE. The vulnerability turns out to be CVE-2023-33012. The associated disclosure did not mention any caveats to exploitation, but it turns out only an uncommon configuration is affected. --------------------------------------------- https://vulncheck.com/blog/zyxel-cve-2023-33012 ∗∗∗ Vibrator virus steals your personal information ∗∗∗ --------------------------------------------- One of our customers found their vibrator was buzzing with a hint of malware. --------------------------------------------- https://www.malwarebytes.com/blog/news/2024/02/vibrator-virus-steals-your-p… ∗∗∗ Redis Servers Targeted With New ‘Migo’ Malware ∗∗∗ --------------------------------------------- Attackers weaken Redis instances to deploy the new Migo malware and install a rootkit and cryptominers. --------------------------------------------- https://www.securityweek.com/redis-servers-targeted-with-new-migo-malware/ ∗∗∗ Fake-SMS zum Ablauf der Finanz-Online ID im Umlauf! ∗∗∗ --------------------------------------------- Kriminelle versenden aktuell massenhaft SMS im Namen des BMF zum angeblichen Ablauf der FinanzOnline ID, beziehungsweise ID Austria. Links in den Smishing-Nachrichten führen auf gefälschte Finanz-Online-Websites, auf denen persönliche Daten abgegriffen werden. Diese Daten können anschließend für personalisierte Folgebetrugsmaschen eingesetzt werden. Ignorieren Sie diese SMS-Nachrichten! --------------------------------------------- https://www.watchlist-internet.at/news/fake-sms-zum-ablauf-der-finanz-onlin… ∗∗∗ Detecting Malicious Actors By Observing Commands in Shell History ∗∗∗ --------------------------------------------- Among the myriad techniques and tools at the disposal of cybersecurity experts, one subtle yet powerful method often goes unnoticed: the analysis of shell history to detect malicious actors. --------------------------------------------- https://orca.security/resources/blog/understand-shell-commands-detect-malic… ∗∗∗ Practical Vulnerability Archaeology Starring Ivantis CVE-2021-44529 ∗∗∗ --------------------------------------------- In 2021, Ivanti patched a vulnerability that they called “code injection”. Rumors say it was a backdoor in an open source project. Let’s find out what actually happened! --------------------------------------------- https://www.greynoise.io/blog/practical-vulnerability-archaeology-starring-… ∗∗∗ CISA, EPA, and FBI Release Top Cyber Actions for Securing Water Systems ∗∗∗ --------------------------------------------- Today, CISA, the Environmental Protection Agency (EPA), and the Federal Bureau of Investigation (FBI) released the joint fact sheet Top Cyber Actions for Securing Water Systems. This fact sheet outlines the following practical actions Water and Wastewater Systems (WWS) Sector entities can take to better protect water systems from malicious cyber activity and provides actionable guidance [...] --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/21/cisa-epa-and-fbi-release… ∗∗∗ Lucifer DDoS botnet Malware is Targeting Apache Big-Data Stack ∗∗∗ --------------------------------------------- Aqua Nautilus has unveiled a new campaign targeting Apache big-data stack, specifically Apache Hadoop and Apache Druid. Upon investigation, it was discovered that the attacker exploits existing misconfigurations and vulnerabilities within our Apache cloud honeypots to execute the attacks. --------------------------------------------- https://blog.aquasec.com/lucifer-ddos-botnet-malware-is-targeting-apache-bi… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Unified Intelligence Center Insufficient Access Control Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modify data in a repository that belongs to an internal service on an affected device. This vulnerability is due to insufficient access control implementations on cluster configuration CLI requests. An attacker could exploit this vulnerability by sending a cluster configuration CLI request to specific directories on an affected device. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability ∗∗∗ --------------------------------------------- In February 2024, the Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ WS_FTP Server Service Pack (February 2024) ∗∗∗ --------------------------------------------- This article contains the details of the specific updates within the WS_FTP Server February 2024 Service Pack. The Service Pack contains a fix for the newly disclosed CVE described below. Progress highly recommends you apply this Service Pack for product updates and security improvements. For Service Pack content, please review the Service Pack Release Notes and this knowledgebase article carefully. --------------------------------------------- https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-Februar… ∗∗∗ Broadcom schließt Sicherheitslücken in VMware Aria Operations und EAP-Plug-in ∗∗∗ --------------------------------------------- Broadcom verteilt Updates für VMware Aria Operations und das EAP Browser Plug-in. Sie bessern teils kritische Sicherheitslücken aus. --------------------------------------------- https://www.heise.de/-9634714.html ∗∗∗ Firefox und Thunderbird: Neue Versionen liefern Sicherheitsfixes ∗∗∗ --------------------------------------------- Neue Versionen von Firefox, Firefox ESR und Thunderbird stehen bereit. Sie dichten im Kern Sicherheitslücken ab. --------------------------------------------- https://www.heise.de/-9634418.html ∗∗∗ VMSA-2024-0003 ∗∗∗ --------------------------------------------- Addressing Arbitrary Authentication Relay and Session Hijack Vulnerabilities in Deprecated VMware Enhanced Authentication Plug-in (EAP) (CVE-2024-22245, CVE-2024-22250) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2024-0003.html ∗∗∗ VMSA-2024-0004 ∗∗∗ --------------------------------------------- VMware Aria Operations updates address local privilege escalation vulnerability. (CVE-2024-22235) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2024-0004.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (linux-firmware and python-reportlab), Debian (unbound), Fedora (freeglut and syncthing), Red Hat (edk2, go-toolset:rhel8, java-1.8.0-ibm, kernel, kernel-rt, mysql:8.0, oniguruma, and python-pillow), Slackware (libuv and mozilla), SUSE (abseil-cpp, grpc, opencensus-proto, protobuf, python- abseil, python-grpcio, re2, bind, dpdk, firefox, hdf5, libssh, libssh2_org, libxml2, mozilla-nss, openssl-1_1, openvswitch, postgresql12, postgresql13, postgresql14, postgresql15, postgresql16, python-aiohttp, python-time-machine, python-pycryptodomex, runc, and webkit2gtk3), and Ubuntu (kernel, libspf2, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, and linux, linux-aws, linux-kvm, linux-lts-xenial). --------------------------------------------- https://lwn.net/Articles/963035/ ∗∗∗ Chrome 122, Firefox 123 Patch High-Severity Vulnerabilities ∗∗∗ --------------------------------------------- Google and Mozilla resolve high-severity memory safety vulnerabilities with the latest Chrome and Firefox updates. --------------------------------------------- https://www.securityweek.com/chrome-122-firefox-123-patch-high-severity-vul… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ K000138649 : GnuTLS vulnerability CVE-2023-5981 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138649 ∗∗∗ K000138650 : cURL vulnerability CVE-2023-46218 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138650 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.02.2024
by Daily end-of-shift report 20 Feb '24

20 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Montag 19-02-2024 18:00 − Dienstag 20-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Ransomware: Lockbit durch Ermittler zerschlagen - zwei Festnahmen ∗∗∗ --------------------------------------------- Operation Cronos: Je eine Verhaftung in Polen und der Ukraine, Ermittler haben Datenschatz sowie Zugriff auf Kryptogeld und Websites von Lockbit erbeutet. --------------------------------------------- https://www.heise.de/-9633327 ∗∗∗ Hackers exploit critical RCE flaw in Bricks WordPress site builder ∗∗∗ --------------------------------------------- Hackers are actively exploiting a critical remote code execution (RCE) flaw impacting the Brick Builder Theme to run malicious PHP code on vulnerable sites. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-rce… ∗∗∗ Cactus ransomware claim to steal 1.5TB of Schneider Electric data ∗∗∗ --------------------------------------------- The Cactus ransomware gang claims they stole 1.5TB of data from Schneider Electric after breaching the companys network last month. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cactus-ransomware-claim-to-s… ∗∗∗ Over 28,500 Exchange servers vulnerable to actively exploited bug ∗∗∗ --------------------------------------------- Up to 97,000 Microsoft Exchange servers may be vulnerable to a critical severity privilege escalation flaw tracked as CVE-2024-21410 that hackers are actively exploiting. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-28-500-exchange-servers… ∗∗∗ Vorsicht vor falschen Microsoft-Sicherheitswarnungen beim Surfen im Internet ∗∗∗ --------------------------------------------- Beim Surfen im Internet taucht plötzlich eine Sicherheitswarnung von Microsoft auf. Darin heißt es, dass Ihr Gerät von einem Virus befallen sei und Sie die „Windowshilfe“ anrufen sollen. Rufen Sie diese Nummer keinesfalls an. Es handelt sich um ein betrügerisches Pop-Up-Fenster. Wenn Sie anrufen, stehlen Kriminelle Daten und Geld! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-falschen-microsoft-sich… ∗∗∗ Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns ∗∗∗ --------------------------------------------- Google Cloud Run is currently being abused in high-volume malware distribution campaigns, spreading several banking trojans such as Astaroth (aka Guildma), Mekotio and Ousaban to targets across Latin America and Europe. The volume of emails associated with these campaigns has significantly increased since September 2023 and we continue to regularly observe new email distribution campaigns. --------------------------------------------- https://blog.talosintelligence.com/google-cloud-run-abuse/ ∗∗∗ A technical analysis of the BackMyData ransomware used to attack hospitals in Romania ∗∗∗ --------------------------------------------- Summary According to BleepingComputer, a ransomware attack that occurred starting 0n February 11 forced 100 hospitals across Romania to take their systems offline. BackMyData ransomware, which took credit for it, belongs to the Phobos family. --------------------------------------------- https://cybergeeks.tech/a-technical-analysis-of-the-backmydata-ransomware-u… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Flaws Found in ConnectWise ScreenConnect Software - Patch Now ∗∗∗ --------------------------------------------- ConnectWise has released software updates to address two security flaws in its ScreenConnect remote desktop and access software, including a critical bug that could enable remote code execution on affected systems. The vulnerabilities, which currently lack CVE identifiers, are listed below - Authentication bypass using an alternate path or channel (CVSS score: 10.0) - Improper limitation of a pathname to a restricted directory aka "path traversal" (CVSS score: 8.4) --------------------------------------------- https://thehackernews.com/2024/02/critical-flaws-found-in-connectwise.html ∗∗∗ Multiple Stored Cross-Site-Scripting Vulnerabilities in OpenOLAT (Frentix GmbH) ∗∗∗ Several stored XSS vulnerabilities were identified in the open source e-learning application OpenOLAT, as well as missing security measures in the standard configurations regarding content security policy (CSP). [..] The vendor provides a patch which should be installed immediately. --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/mutiple-stored-cross-sit… ∗∗∗ SQL Injection Vulnerability Patched in RSS Aggregator by Feedzy WordPress Plugin ∗∗∗ --------------------------------------------- On February 1st, 2024, during our second Bug Bounty Extravaganza, we received a submission for a SQL Injection vulnerability in RSS Aggregator by Feedzy, a WordPress plugin with more than 50,000+ active installations. The vulnerability enables threat actors with contributor-level permissions or higher to extract sensitive data from the database, such as password hashes. --------------------------------------------- https://www.wordfence.com/blog/2024/02/sql-injection-vulnerability-patched-… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (freeglut, hugin, libmodsecurity, qemu, rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, and rust-vergen), Mageia (packages, radare2, ruby-rack, and wireshark), Oracle (.NET 8.0 and python-pillow), Red Hat (gimp:2.8, java-1.8.0-ibm, and kpatch-patch), SUSE (dpdk and opera), and Ubuntu (bind9, curl, linux-raspi, linux-raspi-5.4, node-ip, and tiff). --------------------------------------------- https://lwn.net/Articles/962881/ ∗∗∗ Zyxel security advisory for multiple vulnerabilities in firewalls and APs ∗∗∗ --------------------------------------------- Zyxel has released patches addressing multiple vulnerabilities in some firewall and access point (AP) versions. Users are advised to install the patches for optimal protection. CVEs: CVE-2023-6397, CVE-2023-6398, CVE-2023-6399, CVE-2023-6764 --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ Joomla: [20240205] - Core - Inadequate content filtering within the filter code ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/929-20240205-core-inadequa… ∗∗∗ Joomla: [20240204] - Core - XSS in mail address outputs ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/928-20240204-core-xss-in-m… ∗∗∗ Joomla: [20240203] - Core - XSS in media selection fields ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/927-20240203-core-xss-in-m… ∗∗∗ Joomla: [20240202] - Core - Open redirect in installation application ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/926-20240202-core-open-red… ∗∗∗ Joomla: [20240201] - Core - Insufficient session expiration in MFA management views ∗∗∗ --------------------------------------------- https://developer.joomla.org:443/security-centre/925-20240201-core-insuffic… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Mozilla: Security Vulnerabilities fixed in Firefox 123 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-05/ ∗∗∗ MISP 2.4.185 released with sighting performance improvements, security and bugs fixes. ∗∗∗ --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.185 ∗∗∗ Ethercat Zeek Plugin ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-02 ∗∗∗ Mitsubishi Electric Electrical Discharge Machines ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-03 ∗∗∗ Commend WS203VICM ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.02.2024
by Daily end-of-shift report 19 Feb '24

19 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-02-2024 18:00 − Montag 19-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Anatsa Android malware downloaded 150,000 times via Google Play ∗∗∗ --------------------------------------------- The Anatsa banking trojan has been targeting users in Europe by infecting Android devices through malware droppers hosted on Google Play. --------------------------------------------- https://www.bleepingcomputer.com/news/security/anatsa-android-malware-downl… ∗∗∗ Mirai-Mirai On The Wall... [Guest Diary], (Sun, Feb 18th) ∗∗∗ --------------------------------------------- This article is about one of the ways attackers on the open Internet are attempting to use the Mirai Botnet [1][2] malware to exploit vulnerabilities on exposed IoT devices. --------------------------------------------- https://isc.sans.edu/diary/rss/30658 ∗∗∗ Remote Access Trojan (RAT): Types, Mitigation & Removal ∗∗∗ --------------------------------------------- Remote Access Trojans (RATs) are a serious threat capable of giving attackers control over infected systems. This malware stealthily enters systems (often disguised as legitimate software or by exploiting a vulnerability in the system) and opens backdoors for attackers to perform a wide range of malicious activities on the victim’s computer. This blog post is designed to educate readers on RATs - how they work, the risks they pose, and how to protect against them. --------------------------------------------- https://blog.sucuri.net/2024/02/remote-access-trojan-rat-types-mitigation-r… ∗∗∗ The scary DNS “KeyTrap” bug explained in plain words ∗∗∗ --------------------------------------------- If you were following the IT media last week, you’d have been forgiven for awaiting the imminent implosion of the internet, with DNS itself in desperate danger. [...] Obviously, the next step is for the community to update the DNSSEC specifications, and thereby to protect proactively against this sort of extreme denial-of-service attack by building in new precautions for everyone to follow. --------------------------------------------- https://pducklin.com/2024/02/18/the-scary-dns-keytrap-bug-explained-in-plai… ∗∗∗ KI: OpenAI und Microsoft schließen Konten staatlicher Bedrohungsakteure ∗∗∗ --------------------------------------------- Microsoft und OpenAI haben Konten mutmaßlicher staatlicher Bedrohungsakteure geschlossen, die ChatGPT für kriminelle Zwecke nutzten. --------------------------------------------- https://www.heise.de/-9631899.html ∗∗∗ Mastodon: Spamwelle zeigt Schwächen auf und weckt Sorge vor schlimmerer Methode ∗∗∗ --------------------------------------------- Seit Tagen klagen einige User auf Mastodon über eine Spamwelle. Der liegen automatisierte Angriffe auf unzureichend geschützte Teile des Fediverse zugrunde. --------------------------------------------- https://www.heise.de/-9632055.html ∗∗∗ CVE Prioritizer: Open-source tool to prioritize vulnerability patching ∗∗∗ --------------------------------------------- CVE Prioritizer is an open-source tool designed to assist in prioritizing the patching of vulnerabilities. It integrates data from CVSS, EPSS, and CISA’s KEV catalog to offer insights into the probability of exploitation and the potential effects of vulnerabilities on your systems. --------------------------------------------- https://www.helpnetsecurity.com/2024/02/19/cve-prioritizer-open-source-vuln… ∗∗∗ Why keeping track of user accounts is important ∗∗∗ --------------------------------------------- CISA has issued an advisory after the discovery of documents containing information about a state government organization’s network environment on a dark web brokerage site. --------------------------------------------- https://www.malwarebytes.com/blog/news/2024/02/why-keeping-track-of-user-ac… ∗∗∗ Gefälschtes Flixbus-Angebot: „Verlorenes Gepäck für 2 Euro“ ∗∗∗ --------------------------------------------- Auf Facebook und Instagram kursiert eine gefälschte Flixbus-Werbung. In der Anzeige steht, dass Flixbus angeblich verlorenes Gepäck um 2 Euro verkauft. Geködert werden Sie mit dem Versprechen, dass sich in den Koffern oft Handys, Laptops oder Schmuck befinden. Es handelt sich aber um eine Abo-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschtes-flixbus-angebot-verlore… ∗∗∗ The Most Dangerous Entra Role You’ve (Probably) Never Heard Of ∗∗∗ --------------------------------------------- Entra ID has a built-in role called “Partner Tier2 Support” that enables escalation to Global Admin, but [...] --------------------------------------------- https://posts.specterops.io/the-most-dangerous-entra-role-youve-probably-ne… ===================== = Vulnerabilities = ===================== ∗∗∗ CVE-2024-23724: Ghost CMS Stored XSS Leading to Owner Takeover ∗∗∗ --------------------------------------------- During research on the Ghost CMS application, the Rhino research team identified a Stored Cross-Site Scripting (XSS) vulnerability which can be triggered by a malicious profile image. [...] The vendor does not view this as a valid vector so will not be releasing an official patch, but it’s important to us at Rhino to not release unpatched vulnerabilities. While this is a unique case, we’ve decided to make the patch ourselves [...] --------------------------------------------- https://rhinosecuritylabs.com/research/cve-2024-23724-ghost-cms-stored-xss/ ∗∗∗ Solarwinds: Codeschmuggel möglich, Updates verfügbar ∗∗∗ --------------------------------------------- Solarwinds schließt Sicherheitslücken in Access Rights Manager und Platform (Orion). Angreifer können Schadcode einschleusen. --------------------------------------------- https://www.heise.de/-9632541.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (engrampa, openvswitch, pdns-recursor, and runc), Fedora (caddy, expat, freerdp, libgit2, libgit2_1.6, mbedtls, python-cryptography, qt5-qtbase, and sudo), Gentoo (Apache Log4j, Chromium, Google Chrome, Microsoft Edge, CUPS, e2fsprogs, Exim, firefox, Glade, GNU Tar, intel-microcode, libcaca, QtNetwork, QtWebEngine, Samba, Seamonkey, TACACS+, Thunar, and thunderbird), Mageia (dnsmasq, unbound, and vim), Oracle (container-tools:4.0, container-tools:ol8, dotnet6.0, dotnet7.0, kernel, nss, openssh, and sudo), Red Hat (python-pillow), and SUSE (bitcoin, dpdk, libssh, openvswitch, postgresql12, and postgresql13). --------------------------------------------- https://lwn.net/Articles/962753/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ ADS-TEC Industrial IT: Docker vulnerability affects multiple products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-016/ ∗∗∗ K000138640 : Perl vulnerability CVE-2023-47038 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138640 ∗∗∗ K000138641 : cURL vulnerability CVE-2023-46219 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138641 ∗∗∗ K000138643 : OpenSSH vulnerability CVE-2023-51767 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000138643 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.02.2024
by Daily end-of-shift report 16 Feb '24

16 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-02-2024 18:00 − Freitag 16-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ RansomHouse gang automates VMware ESXi attacks with new MrAgent tool ∗∗∗ --------------------------------------------- The RansomHouse ransomware operation has created a new tool named MrAgent that automates the deployment of its data encrypter across multiple VMware ESXi hypervisors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomhouse-gang-automates-v… ∗∗∗ Berliner Kritis-Lieferant: PSI Software nimmt Systeme nach Cyberangriff offline ∗∗∗ --------------------------------------------- Der Softwarekonzern beliefert unter anderem Betreiber von Energienetzen und Verkehrsinfrastrukturen sowie Kunden aus den Bereichen Industrie und Logistik. --------------------------------------------- https://www.golem.de/news/berliner-kritis-lieferant-psi-software-nimmt-syst… ∗∗∗ Phishing und Spoofing: BSI gibt Hinweise zur E-Mail-Authentifizierung ∗∗∗ --------------------------------------------- Gewappnet mit Standards wie SPF, DKIM und DMARC könnten Anbieter selbst neue Angriffe wie SMTP-Smuggling erschweren, heißt es in einer Technischen Richtlinie. --------------------------------------------- https://www.heise.de/-9631309 ∗∗∗ F5 behebt 20 Sicherheitslücken in Big-IP-Loadbalancer, WAF und nginx ∗∗∗ --------------------------------------------- Unter anderem konnten Angreifer eigenen Code in den Loadbalancer einschmuggeln, nginx hingegen verschluckte sich an HTTP3/QUIC-Anfragen. --------------------------------------------- https://www.heise.de/-9629983 ∗∗∗ Falsche DHL-Boten fordern am Telefon SMS-Code für vermeintliche Paketzustellung ∗∗∗ --------------------------------------------- Kriminelle ergaunern SMS-Codes für Paket-Zustellungen. Dabei geben sich die Täter gegenüber potenziellen Opfern als angebliche DHL-Mitarbeiter aus. --------------------------------------------- https://www.heise.de/-9630541 ∗∗∗ Alpha Ransomware Emerges From NetWalker Ashes ∗∗∗ --------------------------------------------- Alpha, a new ransomware that first appeared in February 2023 and stepped up its operations in recent weeks, has strong similarities to the long-defunct NetWalker ransomware, which disappeared in January 2021 following an international law enforcement operation. --------------------------------------------- https://symantec-enterprise-blogs.security.com/threat-intelligence/alpha-ne… ===================== = Vulnerabilities = ===================== ∗∗∗ CISA Warning: Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability ∗∗∗ --------------------------------------------- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched security flaw impacting Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software to its Known Exploited Vulnerabilities (KEV) catalog, following reports that its being likely exploited in Akira ransomware attacks. --------------------------------------------- https://thehackernews.com/2024/02/cisa-warning-akira-ransomware.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Mageia (bind), Red Hat (.NET 8.0 and kpatch-patch), SUSE (golang-github-prometheus-alertmanager, java-1_8_0-openj9, kernel, libaom, openssl-3, postgresql15, salt, SUSE Manager Client Tools, SUSE Manager Server 4.3, and webkit2gtk3), and Ubuntu (shadow). --------------------------------------------- https://lwn.net/Articles/962506/ ∗∗∗ Eight Vulnerabilities Disclosed in the AI Development Supply Chain ∗∗∗ --------------------------------------------- Details of eight vulnerabilities found in the open source supply chain used to develop in-house AI and ML models have been disclosed. All have CVE numbers, one has critical severity, and seven have high severity. [..] They are: CVE-2023-6975: arbitrary file write in MLFLow, CVSS 9.8, CVE-2023-6753: arbitrary file write on Windows in MLFlow, CVSS 9.6, CVE-2023-6730: RCE in Hugging Face Transformers via RagRetriever.from_pretrained(), CVSS 9.0, CVE-2023-6940: server side template injection bypass in MLFlow, CVSS 9.0, CVE-2023-6976: arbitrary file upload patch bypass in MLFlow, CVSS 8.8, CVE-2023-31036: RCE via arbitrary file overwrite in Triton Inference Server, CVSS 7.5, CVE-2023-6909: local file inclusion in MLFlow, CVSS 7.5, CVE-2024-0964: LFI in Gradio, CVSS 7.5 --------------------------------------------- https://www.securityweek.com/eight-vulnerabilities-disclosed-in-the-ai-deve… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.02.2024
by Daily end-of-shift report 15 Feb '24

15 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-02-2024 18:00 − Donnerstag 15-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Warnung vor kritischer Outlook RCE-Schwachstelle CVE-2024-21413 ∗∗∗ --------------------------------------------- In Microsoft Outlook wurde eine als kritisch eingestufte CVE-2024-21413 bekannt, die mit den Februar 2024 Sicherheitsupdates geschlossen wird. Die Remote Code Execution-Schwachstelle lässt sich geradezu trivial ausnutzen. [..] Die von Checkpoint Security aufgedeckte Schwachstelle ermöglicht einem Angreifer die geschützte Office-Ansicht zu umgehen und das Dokument im Bearbeitungsmodus statt im geschützten Modus zu öffnen. [..] Dazu muss der Angreifer einen bösartigen Link erstellen, der das Protected View-Protokoll umgeht. Das führt dann zum Abfluss lokaler NTLM-Anmeldeinformationen und zur Remotecodeausführung (RCE). --------------------------------------------- https://www.borncity.com/blog/2024/02/15/warnung-vor-kritischer-outlook-rce… ∗∗∗ Nachlese zu CU 14 für Exchange 2019 und Schwachstelle CVE-2024-21410 (Feb. 2024) ∗∗∗ --------------------------------------------- Zum 13. Februar 2024 wurde ja eine kritische Schwachstelle CVE-2024-21410 in Microsoft Exchange Server öffentlich. [..] Was ist mit Exchange Server 2016 und was muss ich tun, um vor CVE-2024-21410 geschützt zu sein. Hier eine Nachlese mit einem groben Abriss. --------------------------------------------- https://www.borncity.com/blog/2024/02/15/nachlese-zu-cu-14-fr-exchange-2019… ∗∗∗ New ‘Gold Pickaxe’ Android, iOS malware steals your face for fraud ∗∗∗ --------------------------------------------- A new iOS and Android trojan named GoldPickaxe employs a social engineering scheme to trick victims into scanning their faces and ID documents, which are believed to be used to generate deepfakes for unauthorized banking access. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-gold-pickaxe-android-ios… ∗∗∗ QR Phishing. Fact or Fiction? ∗∗∗ --------------------------------------------- To understand the attack you need understand the challenge that the attacker faces. Currently, most initial access attempts are carried out with social engineering, commonly phishing. Why is that? Well, it looks like people have finally got good at patching. According to the 2022 Verizon data breach incident report only 5% of data breaches investigated by them were caused by software vulnerabilities. --------------------------------------------- https://www.pentestpartners.com/security-blog/qr-phishing-fact-or-fiction/ ∗∗∗ Vorsicht vor dieser Fake Erste Bank SMS ∗∗∗ --------------------------------------------- Kriminelle versenden SMS im Namen der Erste Bank bzw. George. Darin behaupten sie, dass eine Überweisung über einen hohen Geldbetrag freigegeben oder ein Darlehen aufgenommen wurde und bitten um Kontaktaufnahmen. Kontaktieren Sie nicht die angegebene Nummer, Sie werden dazu verleitet Schadsoftware zu installieren! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-dieser-fake-erste-bank-… ∗∗∗ The Complete Guide to Advanced Persistent Threats ∗∗∗ --------------------------------------------- Understanding the mechanics and implications of APTs is essential to safeguard organizations and individuals. In this comprehensive guide, we explore the world of APTs, explaining their nature, mechanisms, and the best strategies to counteract them. --------------------------------------------- https://www.emsisoft.com/en/blog/44815/the-complete-guide-to-advanced-persi… ∗∗∗ TinyTurla Next Generation - Turla APT spies on Polish NGOs ∗∗∗ --------------------------------------------- Talos, in cooperation with CERT.NGO, investigated another compromise by the Turla threat actor, with a new backdoor quite similar to TinyTurla, that we are calling TinyTurla-NG (TTNG). [..] Talos identified the existence of three different TinyTurla-NG samples, but only obtained access to two of them. This campaign’s earliest compromise date was Dec. 18, 2023, and was still active as recently as Jan. 27, 2024. However, we assess that the campaign may have started as early as November 2023 based on malware compilation dates. --------------------------------------------- https://blog.talosintelligence.com/tinyturla-next-generation/ ===================== = Vulnerabilities = ===================== ∗∗∗ AlphaESS Wechselrichter: WLAN-Zugang mit unveränderlichem Passwort ∗∗∗ --------------------------------------------- Wechselrichter und Speichersysteme von AlphaESS kommen mit optionalem WLAN-Modul. Das spannt einen Zugangspunkt mit Standard-Passwort auf. --------------------------------------------- https://www.heise.de/-9628912 ∗∗∗ Node.js: Sicherheitsupdates beheben Codeschmuggel und Serverabstürze ∗∗∗ --------------------------------------------- Neben Problemen im Kern des Projekts aktualisiert das Node-Projekt auch einige externe Bibliotheken. --------------------------------------------- https://www.heise.de/-9629299 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (edk2, postgresql-13, and postgresql-15), Fedora (engrampa, vim, and xen), Mageia (mbedtls and quictls), Oracle (nss, openssh, and tcpdump), Red Hat (.NET 8.0), SUSE (hugin, kernel, pdns-recursor, python3, tomcat, and tomcat10), and Ubuntu (clamav, edk2, linux-gcp-6.2, linux-intel-iotg-5.15, linux-oem-6.1, and ujson). --------------------------------------------- https://lwn.net/Articles/962284/ ∗∗∗ Drupal: CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-009 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (February 5, 2024 to February 11, 2024) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/02/wordfence-intelligence-weekly-wordpr… ∗∗∗ Autodesk: ZDI reported security vulnerabilities in the Autodesk AutoCAD Desktop Software ∗∗∗ --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002 ∗∗∗ Palo Alto: CVE-2024-0011 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-0011 ∗∗∗ Palo Alto: CVE-2024-0008 PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-0008 ∗∗∗ Palo Alto: CVE-2024-0010 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-0010 ∗∗∗ Palo Alto: CVE-2024-0007 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-0007 ∗∗∗ Palo Alto: CVE-2024-0009 PAN-OS: Improper IP Address Verification in GlobalProtect Gateway (Severity: MEDIUM) ∗∗∗ --------------------------------------------- https://security.paloaltonetworks.com/CVE-2024-0009 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.02.2024
by Daily end-of-shift report 14 Feb '24

14 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-02-2024 18:00 − Mittwoch 14-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Ubuntu command-not-found tool can be abused to spread malware ∗∗∗ --------------------------------------------- A logic flaw between Ubuntus command-not-found package suggestion system and the snap package repository could enable attackers to promote malicious Linux packages to unsuspecting users. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ubuntu-command-not-found-too… ∗∗∗ Security review for Microsoft Edge version 121 ∗∗∗ --------------------------------------------- Microsoft Edge version 121 introduced 11 new computer settings and 11 new user settings. We have included a spreadsheet listing the new settings in the release to make it easier for you to find them. --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/securit… ∗∗∗ Fake-Angebote für Samsungs Galaxy S24, S24+ und S24 Ultra mit Nachnahmezahlung! ∗∗∗ --------------------------------------------- Vor wenigen Wochen hat Samsung das Galaxy S24, das Galaxy S24+ sowie das Galaxy S24 Ultra vorgestellt. Die Preise für die neuen Geräte bewegen sich zum Marktstart zwischen 780 und 1800 Euro für die unterschiedlichen Modelle. Um vieles billiger versprechen Kriminelle das Gerät. Für 269 Euro per Nachnahme gibt es das teuerste Gerät auf shop.mgmmgme.shop. So viel ist sicher: Das versprochene Gerät wird hier nie geliefert und Zahlungen per Nachnahme sind verloren. --------------------------------------------- https://www.watchlist-internet.at/news/fake-angebote-fuer-samsungs-galaxy-s… ∗∗∗ The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture ∗∗∗ --------------------------------------------- Recently, Check Point Research released a white paper titled “The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors”, detailing various attack vectors on Outlook to help the industry understand the security risks the popular Outlook app may bring into organizations. As mentioned in the paper, we discovered an interesting security issue in Outlook when the app handles specific hyperlinks. In this blog post, we will share our research on the issue with the security community and help defend against it. We will also highlight the broader impact of this bug in other software. --------------------------------------------- https://research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-mi… ∗∗∗ TicTacToe Dropper ∗∗∗ --------------------------------------------- We analyzed multiple samples of this dropper. The executable malware file was usually delivered through an .iso file. From cases directly observed in the wild, these iso files were delivered to the victim via phishing as an attachment (T1566.001). This technique of packing malware inside an iso file is typically employed to avoid detection by antivirus software and as a mark-of-the-web (MOTW) bypass technique (T1553.005). --------------------------------------------- https://feeds.fortinet.com/~/869921006/0/fortinet/blogs~TicTacToe-Dropper ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Adobe schließt Schadcode-Lücken in Acrobat & Co. ∗∗∗ --------------------------------------------- Für mehrere Adobe-Produkte sind wichtige Sicherheitsupdates erschienen. Damit haben die Entwickler unter anderem kritische Schwachstellen geschlossen. --------------------------------------------- https://www.heise.de-9627753 ∗∗∗ Webkonferenz-Tool Zoom: Rechteausweitung durch kritische Schwachstelle ∗∗∗ --------------------------------------------- Zoom warnt vor mehreren Schwachstellen in den Produkten des Unternehmens. Eine gilt als kritisches Sicherheitsrisiko. --------------------------------------------- https://www.heise.de/-9627817 ∗∗∗ Microsoft Security Update Summary (13. Februar 2024) ∗∗∗ --------------------------------------------- Am 13. Februar 2024 hat Microsoft Sicherheitsupdates für Windows-Clients und -Server, für Office – sowie für weitere Produkte – veröffentlicht. Die Sicherheitsupdates beseitigen 73 Schwachstellen (CVEs), zwei sind 0-day Sicherheitslücken, die bereits ausgenutzt werden. --------------------------------------------- https://www.borncity.com/blog/2024/02/13/microsoft-security-update-summary-… ∗∗∗ Released: 2024 H1 Cumulative Update for Exchange Server ∗∗∗ --------------------------------------------- Today we are announcing the availability of the 2024 H1 Cumulative Update (CU) for Exchange Server 2019 (aka CU14). CU14 includes fixes for customer reported issues, a security change, and all previously released Security Updates (SUs). --------------------------------------------- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-2024-h1-… ∗∗∗ Chipmaker Patch Tuesday: AMD and Intel Patch Over 100 Vulnerabilities ∗∗∗ --------------------------------------------- AMD and Intel patch dozens of vulnerabilities on February 2024 Patch Tuesday, including multiple high-severity bugs.The post Chipmaker Patch Tuesday: AMD and Intel Patch Over 100 Vulnerabilities appeared first on SecurityWeek. --------------------------------------------- https://www.securityweek.com/chipmaker-patch-tuesday-amd-and-intel-patch-ov… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bind9 and unbound), Fedora (clamav, firecracker, libkrun, rust-event-manager, rust-kvm-bindings, rust-kvm-ioctls, rust-linux-loader, rust-userfaultfd, rust-versionize, rust-vhost, rust-vhost-user-backend, rust-virtio-queue, rust-vm-memory, rust-vm-superio, rust-vmm-sys-util, and virtiofsd), Red Hat (.NET 6.0, dotnet6.0, and dotnet7.0), Slackware (bind and dnsmasq), and Ubuntu (dotnet6, dotnet7, dotnet8, linux-lowlatency, linux-raspi, linux-nvidia-6.2, and ujson). --------------------------------------------- https://lwn.net/Articles/962077/ ∗∗∗ F5: K000138353 : Quarterly Security Notification (February 2024) ∗∗∗ --------------------------------------------- On February 14, 2024, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. --------------------------------------------- https://my.f5.com/manage/s/article/K000138353 ∗∗∗ F5: K98606833 : BIG-IP and BIG-IQ scp vulnerability CVE-2024-21782 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K98606833 ∗∗∗ F5: K91054692 : BIG-IP Appliance mode iAppsLX vulnerability CVE-2024-23976 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K91054692 ∗∗∗ F5: K000137521 : BIG-IP AFM vulnerability CVE-2024-21763 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137521 ∗∗∗ F5: K000137334 : F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability CVE-2024-23805 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137334 ∗∗∗ 2024-02-14: Cyber Security Advisory - B&R APROL SSH service vulnerable to Terrapin attack ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA24P004_SSH_Service_Vulnerable_To_… ∗∗∗ tenable: [R1] Security Center Version 6.3.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2024-02 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Lenovo Security Advisories ∗∗∗ --------------------------------------------- https://support.lenovo.com/at/en/product_security/home -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.02.2024
by Daily end-of-shift report 13 Feb '24

13 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Montag 12-02-2024 18:00 − Dienstag 13-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ The (D)Evolution of Pikabot ∗∗∗ --------------------------------------------- Pikabot is a malware loader that originally emerged in early 2023. Over the past year, ThreatLabz has been tracking the development of Pikabot and its modus operandi. There was a significant increase in usage in the second half of 2023 following the FBI-led takedown of Qakbot. This was likely the result of a BlackBasta ransomware affiliate replacing Qakbot with Pikabot for initial access. However, Pikabot ceased activity shortly after Christmas 2023, with its version number being 1.1.19 at that time. In recent campaigns, which started in February 2024, Pikabot reemerged with significant changes in its code base and structure. --------------------------------------------- https://www.zscaler.com/blogs/security-research/d-evolution-pikabot ∗∗∗ GMX, Web.de, Online-Dienste: Angriffe auf Zugangsdaten nehmen zu ∗∗∗ --------------------------------------------- Etwas alarmistisch melden einige Medien, dass es vermehrt Angriffe auf Zugangskonten von GMX oder Web.de gebe, die unter anderem sehr populäre Webmail-Dienste bereitstellen. Es werden dort bei zahlreichen Konten sehr hohe Zahlen für fehlerhafte Log-in-Versuche angezeigt. Es handelt sich offenbar um die alltäglichen Angriffe auf Zugangsdaten von Cyberkriminellen, die versuchen, mit gestohlenen Accountinformationen auf Online-Dienste zuzugreifen. --------------------------------------------- https://www.heise.de/-9626994 ∗∗∗ Vorsicht vor gefälschten WKÖ-E-Mails ∗∗∗ --------------------------------------------- Kriminelle geben sich als Wirtschaftskammer Österreich aus und bitten Unternehmen in einem E-Mail, Kontaktdaten zu aktualisieren. Klicken Sie keinesfalls auf den Link, Sie werden auf eine gefälschte WKÖ-Seite geführt. Dort stehlen Kriminelle Firmen- und Bankdaten. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-gefaelschten-wkoe-e-mai… ∗∗∗ Directory.ReadWrite.All Is Not As Powerful As You Might Think ∗∗∗ --------------------------------------------- Directory.ReadWrite.All is an MS Graph permission that is frequently cited as granting high amounts of privilege, even being equated to the Global Admin Entra ID role [..] Misleading or incorrect documentation create most of the misconceptions regarding this permission. --------------------------------------------- https://posts.specterops.io/directory-readwrite-all-is-not-as-powerful-as-y… ∗∗∗ Ongoing Microsoft Azure account hijacking campaign targets executives ∗∗∗ --------------------------------------------- A phishing campaign detected in late November 2023 has compromised hundreds of user accounts in dozens of Microsoft Azure environments, including those of senior executives. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ongoing-microsoft-azure-acco… ∗∗∗ Fileless Revenge RAT Malware ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) recently discovered the distribution of Revenge RAT malware that had been developed based on legitimate tools. It appears that the attackers have used tools such as ‘smtp-validator’ and ‘Email To Sms’. At the time of execution, the malware creates and runs both a legitimate tool and a malicious file, making it difficult for users to realize that a malicious activity has occurred. --------------------------------------------- https://asec.ahnlab.com/en/61584/ ===================== = Vulnerabilities = ===================== ∗∗∗ Request Tracker Write-up (CVE-2023-41259, CVE-2023-41260) ∗∗∗ --------------------------------------------- Without authentication we were able to extract file-attachments that were uploaded to RT, including e-mails received from and to users regarding tickets and issues. We also found it was possible to obtain information about tickets and users. --------------------------------------------- https://www.linkedin.com/pulse/request-tracker-write-up-tom-wolters-ygsae ∗∗∗ PowerDNS Security Advisory 2024-01: crafted DNSSEC records in a zone can lead to a denial of service in Recursor ∗∗∗ --------------------------------------------- An attacker can publish a zone that contains crafted DNSSEC related records. While validating results from queries to that zone using the RFC mandated algorithms, the Recursor’s resource usage can become so high that processing of other queries is impacted, resulting in a denial of service. Note that any resolver following the RFCs can be impacted, this is not a problem of this particular implementation. --------------------------------------------- https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-202… ∗∗∗ DNS-Server: Bind und Unbound stolpern über Sicherheitslücke "KeyTrap" ∗∗∗ --------------------------------------------- Mit einer präparierten DNS-Anfrage können Angreifer eine hohe Prozessorlast verursachen und den Dienst für legitime Nutzer so blockieren. Patches stehen bereit. --------------------------------------------- https://www.heise.de/-9627276 ∗∗∗ Sicherheitslücken: Angreifer können Dell Unity kompromittieren ∗∗∗ --------------------------------------------- Die Fehler stecken in Dell Unity Operating Enviroment (OE). Die Entwickler geben an, die Ausgabe 5.4.0.0.5.094 repariert zu haben. Von den Sicherheitsproblemen sind unter anderem Dell EMC Unity, Dell EMC Unity XT 380F und Dell EMC Unity Hybrid betroffen. Alle verwundbaren Produkte sind in der Warnmeldung aufgelistet. --------------------------------------------- https://www.heise.de/-9626407 ∗∗∗ Qnap: Sicherheitslücken in Firmware erlauben Einschleusen von Befehlen ∗∗∗ --------------------------------------------- In der Sicherheitswarnung schreibt Qnap, dass es sich um zwei Schwachstellen handelt. Die Beschreibung für beide lautet: Eine Befehlsschmuggel-Schwachstelle wurde in mehreren Qnap-Betriebssystemversionen gemeldet. Sofern sie missbraucht werden, erlauben sie Nutzern, Befehle über das Netzwerk auszuführen (CVE-2023-47218, CVE-2023-50358, CVSS 5.8, Risiko "mittel"). --------------------------------------------- https://www.heise.de/-9626319 ∗∗∗ SAP patcht: 13 Sicherheitslücken abgedichtet ∗∗∗ --------------------------------------------- SAP verteilt Software-Updates, die Schwachstellen aus 13 Sicherheitsmitteilungen ausbessern. Eine Lücke ist kritisch. --------------------------------------------- https://www.heise.de/-9626592 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (clamav and virtiofsd), Oracle (gimp), Red Hat (gnutls and nss), SUSE (kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t and squid), and Ubuntu (openssl). --------------------------------------------- https://lwn.net/Articles/961937/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ TYPO3 Security Advisories ∗∗∗ --------------------------------------------- https://typo3.org/help/security-advisories ∗∗∗ Autodesk: Multiple Vulnerabilities in Autodesk InfraWorks software ∗∗∗ --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0001 ∗∗∗ Mitsubishi Electric MELSEC iQ-R Series Safety CPU ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01 ∗∗∗ HIMA: Multiple products affected by DoS and Port-Based-VLAN Crossing ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-013/ ∗∗∗ Schneider Electric Security Advisories ∗∗∗ --------------------------------------------- https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.… ∗∗∗ SSA-943925 V1.0: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-943925.html ∗∗∗ SSA-871717 V1.0: Multiple Vulnerabilities in Polarion ALM ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-871717.html ∗∗∗ SSA-806742 V1.0: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-806742.html ∗∗∗ SSA-797296 V1.0: XT File Parsing Vulnerability in Parasolid ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-797296.html ∗∗∗ SSA-753746 V1.0: Denial of Service Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-753746.html ∗∗∗ SSA-716164 V1.0: Multiple Vulnerabilities in Scalance W1750D ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-716164.html ∗∗∗ SSA-665034 V1.0: Vulnerability in Nozomi Guardian/CMC before 23.3.0 on RUGGEDCOM APE1808 devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-665034.html ∗∗∗ SSA-647068 V1.0: Ripple20 in SIMATIC RTLS Gateways ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-647068.html ∗∗∗ SSA-602936 V1.0: Multiple Vulnerabilities in SCALANCE SC-600 Family before V3.1 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-602936.html ∗∗∗ SSA-580228 V1.0: Use of Hard-Coded Credentials Vulnerability in Location Intelligence before V4.3 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-580228.html ∗∗∗ SSA-543502 V1.0: Local Privilege Escalation Vulnerability in Unicam FX ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-543502.html ∗∗∗ SSA-516818 V1.0: TCP Sequence Number Validation Vulnerability in the TCP/IP Stack of CP343-1 Devices ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-516818.html ∗∗∗ SSA-108696 V1.0: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-108696.html ∗∗∗ SSA-017796 V1.0: Multiple File Parsing Vulnerabilities in Tecnomatix Plant Simulation ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-017796.html ∗∗∗ SSA-000072 V1.0: Multiple File Parsing Vulnerabilities in Simcenter Femap ∗∗∗ --------------------------------------------- https://cert-portal.siemens.com/productcert/html/ssa-000072.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.02.2024
by Daily end-of-shift report 12 Feb '24

12 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-02-2024 18:00 − Montag 12-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Free Rhysida ransomware decryptor for Windows exploits RNG flaw ∗∗∗ --------------------------------------------- South Korean researchers have publicly disclosed an encryption flaw in the Rhysida ransomware encryptor, allowing the creation of a Windows decryptor to recover files for free. --------------------------------------------- https://www.bleepingcomputer.com/news/security/free-rhysida-ransomware-decr… ∗∗∗ Hackers exploit Ivanti SSRF flaw to deploy new DSLog backdoor ∗∗∗ --------------------------------------------- Hackers are exploiting a server-side request forgery (SSRF) vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA gateways to deploy the new DSLog backdoor on vulnerable devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-exploit-ivanti-ssrf-… ∗∗∗ Exploit against Unnamed "Bytevalue" router vulnerability included in Mirai Bot, (Mon, Feb 12th) ∗∗∗ --------------------------------------------- Today, I noticed the following URL showing up in our "First Seen" list: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/30642 ∗∗∗ Microsoft Defender: Der Erkennung mit Komma entgehen ∗∗∗ --------------------------------------------- Ein IT-Forscher hat entdeckt, dass sich die Erkennung des Microsoft Defenders mit einem Komma austricksen lässt. --------------------------------------------- https://www.heise.de/-9625770.html ∗∗∗ SiCat: Open-source exploit finder ∗∗∗ --------------------------------------------- SiCat is an open-source tool for exploit research designed to source and compile information about exploits from open channels and internal databases. Its primary aim is to assist in cybersecurity, enabling users to search the internet for potential vulnerabilities and corresponding exploits. --------------------------------------------- https://www.helpnetsecurity.com/2024/02/12/sicat-open-source-exploit-finder/ ∗∗∗ Warzone RAT Shut Down by Law Enforcement, Two Arrested ∗∗∗ --------------------------------------------- Warzone RAT dismantled in international law enforcement operation that also involved arrests of suspects in Malta and Nigeria. --------------------------------------------- https://www.securityweek.com/warzone-rat-shut-down-by-law-enforcement-two-a… ∗∗∗ Diving Into Gluptebas UEFI Bootkit ∗∗∗ --------------------------------------------- A 2023 Glupteba campaign includes an unreported feature - a UEFI bootkit. We analyze its complex architecture and how this botnet has evolved. --------------------------------------------- https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/ ∗∗∗ Bitdefender warnt vor neuer Backdoor für macOS ∗∗∗ --------------------------------------------- Sie bleibt vermutlich mindestens drei Monate unentdeckt. RustDoor erlaubt die gezielte Suche nach Daten und deren Übertragung an einen externen Server. --------------------------------------------- https://www.zdnet.de/88414203/bitdefender-warnt-vor-neuer-backdoor-fuer-mac… ∗∗∗ Angreifer spoofen Temu ∗∗∗ --------------------------------------------- Die Popularität des E-Commerce-Shops lockt Betrüger, die sich auf gefälschte Werbegeschenkcodes spezialisieren. --------------------------------------------- https://www.zdnet.de/88414209/angreifer-spoofen-temu/ ===================== = Vulnerabilities = ===================== ∗∗∗ ExpressVPN: Fehler führt zu ungeschützter Übertragung von DNS-Anfragen ∗∗∗ --------------------------------------------- Durch den Fehler können Drittanbieter potenziell nachverfolgen, welche Webseiten ExpressVPN-Nutzer besucht haben - trotz aktiver VPN-Verbindung. --------------------------------------------- https://www.golem.de/news/expressvpn-fehler-fuehrt-zu-ungeschuetzter-uebert… ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/09/cisa-adds-one-known-expl… ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CVE-2023-43770 Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/12/cisa-adds-one-known-expl… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libgit2), Fedora (chromium, firecracker, libkrun, openssh, python-nikola, runc, rust-event-manager, rust-kvm-bindings, rust-kvm-ioctls, rust-linux-loader, rust-userfaultfd, rust-versionize, rust-vhost, rust-vhost-user-backend, rust-virtio-queue, rust-vm-memory, rust-vm-superio, rust-vmm-sys-util, virtiofsd, webkitgtk, and wireshark), Mageia (filezilla and xpdf), Oracle (gimp), Red Hat (libmaxminddb, linux-firmware, squid:4, and tcpdump), Slackware (xpdf), SUSE (cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont and suse-build-key), and Ubuntu (python-glance-store and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/961842/ ∗∗∗ Mehrere Cross-Site Scripting Schwachstellen in Statamic CMS ∗∗∗ --------------------------------------------- https://sec-consult.com/de/vulnerability-lab/advisory/mehrere-cross-site-sc… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.02.2024
by Daily end-of-shift report 09 Feb '24

09 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-02-2024 18:00 − Freitag 09-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ SonicOS SSL-VPN: Angreifer können Authentifzierung umgehen ∗∗∗ --------------------------------------------- Sonicwall warnt vor einer Sicherheitslücke im SonicOS SSL-VPN, durch die Angreifer die Authentifizierung umgehen können. --------------------------------------------- https://www.heise.de/-9623611.html ∗∗∗ Sicherheitsupdates: Authentifizierung von Ivanti Connect Secure & Co. defekt ∗∗∗ --------------------------------------------- Angreifer können ohne Anmeldung auf Ivanti Connect Secure, Policy Secure und ZTA Gateway zugreifen. --------------------------------------------- https://www.heise.de/-9623653.html ∗∗∗ Elastic Stack: Pufferüberlauf ermöglicht Codeschmuggel in Kibana-Komponente ∗∗∗ --------------------------------------------- Der in Kibana integrierte Chromium-Browser verursachte das Problem nur auf bestimmten Plattformen. Updates und eine Übergangslösung stehen bereit. --------------------------------------------- https://www.heise.de/-9624274.html ∗∗∗ Android XLoader malware can now auto-execute after installation ∗∗∗ --------------------------------------------- A new version of the XLoader Android malware was discovered that automatically executes on devices it infects, requiring no user interaction to launch. --------------------------------------------- https://www.bleepingcomputer.com/news/security/android-xloader-malware-can-… ∗∗∗ New RustDoor macOS malware impersonates Visual Studio update ∗∗∗ --------------------------------------------- A new Rust-based macOS malware spreading as a Visual Studio update to provide backdoor access to compromised systems uses infrastructure linked to the infamous ALPHV/BlackCat ransomware gang. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-rustdoor-macos-malware-i… ∗∗∗ Form Tools Remote Code Execution: We Need To Talk About PHP ∗∗∗ --------------------------------------------- To whet your appetite for what we’re going to demonstrate, below is a deep dive into a Local File Inclusion vulnerability which can lead to Remote Code Execution in installations of ‘Form Tools’, an open-source PHP-based application for creating, storing and sharing forms on the Internet, of over 15 year vintage. A short search across open data platforms reveals over 1,000 installations with "we just discovered Shodan"-tier fingerprints. --------------------------------------------- https://labs.watchtowr.com/form-tools-we-need-to-talk-about-php/ ∗∗∗ Juniper Support Portal Exposed Customer Device Info ∗∗∗ --------------------------------------------- Until earlier this week, the support website for networking equipment vendor Juniper Networks was exposing potentially sensitive information tied to customer products, including the exact devices each customer bought, as well as each devices warranty status, service contracts and serial numbers. Juniper said it has since fixed the problem, and that the inadvertent data exposure stemmed from a recent upgrade to its support portal. --------------------------------------------- https://krebsonsecurity.com/2024/02/juniper-support-portal-exposed-customer… ∗∗∗ Zahlreiche betrügerische E-Mails im Namen der Österreichischen Gesundheitskasse im Umlauf! ∗∗∗ --------------------------------------------- Derzeit werden der Watchlist Internet zahlreiche E-Mails gemeldet, die Kriminelle im Namen der Österreichischen Gesundheitskasse versenden. Angeblich erhalten die Empfänger:innen eine Rückerstattung durch die Krankenasse. Dazu sollen sie einen Link anklicken und Kreditkartendaten eingeben. Machen Sie das auf keinen Fall, da es sich um eine Phishing-Falle handelt. --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-betruegerische-e-mails-im… ∗∗∗ CISA Partners With OpenSSF Securing Software Repositories Working Group to Release Principles for Package Repository Security ∗∗∗ --------------------------------------------- Today, CISA partnered with the Open Source Security Foundation (OpenSSF) Securing Software Repositories Working Group to publish the Principles for Package Repository Security framework. Recognizing the critical role package repositories play in securing open source software ecosystems, this framework lays out voluntary security maturity levels for package repositories. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/08/cisa-partners-openssf-se… ∗∗∗ Raspberry Robin: Evolving Cyber Threat with Advanced Exploits and Stealth Tactics ∗∗∗ --------------------------------------------- Raspberry Robin leverages new 1-day Local Privilege Escalation (LPE) exploits developed ahead of public knowledge, hinting at either an in-house development capability or access to a sophisticated exploit market. --------------------------------------------- https://blog.checkpoint.com/security/raspberry-robin-evolving-cyber-threat-… ∗∗∗ January 2024’s Most Wanted Malware: Major VexTrio Broker Operation Uncovered and Lockbit3 Tops the Ransomware Threats ∗∗∗ --------------------------------------------- Researchers uncovered a large cyber threat distributor known as VexTrio, which serves as a major traffic broker for cybercriminals to distribute malicious content. Meanwhile, LockBit3 topped the list of active ransomware groups and Education was the most impacted industry worldwide --------------------------------------------- https://blog.checkpoint.com/research/january-2024s-most-wanted-malware-majo… ∗∗∗ Niederlande: Militärnetzwerk über FortiGate gehackt; Volt Typhoon-Botnetz seit 5 Jahren in US-Systemen ∗∗∗ --------------------------------------------- Gerade ist eine Spionageaktion der chinesischen Regierung in einem Computernetzwerk des niederländischen Militärs aufgeflogen. Das Militärnetzwerk wurde über eine Schwachstelle in FortiGate gehackt. Das ist auch für andere Fortinet-Kunden relevant. Und mittlerweile wurde bekannt, dass das mutmaßlich von staatsnahen chinesischen [...] --------------------------------------------- https://www.borncity.com/blog/2024/02/08/niederlande-militrnetzwerk-ber-for… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (webkit2gtk), Fedora (atril, chromium, gnutls, python-aiohttp, and webkitgtk), Gentoo (libxml2), Mageia (gnutls, gpac, kernel, kernel-linus, microcode, pam, and postfix), Red Hat (container-tools:2.0, container-tools:3.0, container-tools:4.0, container-tools:rhel8, gimp, libmaxminddb, python-pillow, runc, and unbound), SUSE (cosign, netpbm, python, python-Pillow, python3, and python36), and Ubuntu (libde265, linux-gcp, linux-gcp-5.4, and linux-intel-iotg). --------------------------------------------- https://lwn.net/Articles/961584/ ∗∗∗ Kritische Sicherheitslücken in Fortinet FortiOS, Updates verfügbar ∗∗∗ --------------------------------------------- Fortinet hat zwei kritische Security Advisories veröffentlicht. Beide Security Advisories behandeln Sicherheitslücken, die es unauthentifizierten Angreifer:innen erlauben, Code auf betroffenen Geräten auszuführen. Fortinet gibt bezüglich einer dieser Sicherheitslücken an, dass diese potentiell bereits aktiv für Angriffe ausgenutzt wird. --------------------------------------------- https://cert.at/de/warnungen/2024/2/kritische-sicherheitslucken-in-fortinet… ∗∗∗ Wichtige ESET Produkt-Updates verfügbar (8. Feb. 2024) ∗∗∗ --------------------------------------------- Kurzer, weiterer Informationssplitter für Administratoren, die ESET Endpoint Antivirus/Security unter Windows einsetzen. Der Hersteller hat ein wichtiges Produkt-Update für seine Windows-Produktlinie herausgegeben, welches sofort installiert werden sollte. Das Update behebt eine Schwachstelle, [...] --------------------------------------------- https://www.borncity.com/blog/2024/02/08/wichtige-eset-produkt-updates-verf… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ FortiClientEMS - Improper privilege management for site super administrator ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-357 ∗∗∗ FortiManager - Informative error messages ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-268 ∗∗∗ FortiNAC - XSS in Show Audit Log ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-063 ∗∗∗ FortiOS - Format String Bug in fgfmd ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-029 ∗∗∗ FortiOS - Fortilink lack of certificate validation ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-301 ∗∗∗ FortiOS - Out-of-bound Write in sslvpnd ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ∗∗∗ FortiOS & FortiProxy - CVE-2023-44487 - Rapid Reset HTTP/2 vulnerability ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-397 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.02.2024
by Daily end-of-shift report 08 Feb '24

08 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-02-2024 18:00 − Donnerstag 08-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Fortinet: APTs Exploiting FortiOS Vulnerabilities in Critical Infrastructure Attacks ∗∗∗ --------------------------------------------- One of the exploited vulnerabilities is CVE-2022-42475, which Fortinet patched in December 2022, when it warned that it had been aware of in-the-wild exploitation. [..] The second vulnerability described in Fortinet’s new warning is CVE-2023-27997, which came to light in June 2023, when the cybersecurity firm informed customers that it had been exploited as a zero-day in limited attacks. Fortinet noted on Wednesday that some customers have yet to patch the two FortiOS vulnerabilities and the company has seen several attacks and attack clusters, including ones aimed at the government, service provider, manufacturing, consultancy, and critical infrastructure sectors. --------------------------------------------- https://www.securityweek.com/fortinet-apts-exploiting-fortios-vulnerabiliti… ∗∗∗ State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure ∗∗∗ --------------------------------------------- CISA, NSA, FBI and the following partners are releasing this advisory to warn critical infrastructure organizations about this assessment, which is based on observations from the U.S. authoring agencies’ incident response activities at critical infrastructure organizations compromised by the PRC state-sponsored cyber group known as Volt Typhoon (also known as Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus). --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a ∗∗∗ Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure ∗∗∗ --------------------------------------------- Fortinet is warning of two new unpatched patch bypasses for a critical remote code execution vulnerability in FortiSIEM, Fortinets SIEM solution. [..] Earlier today, BleepingComputer published an article that the CVEs were released by mistake after being told by Fortinet that they were duplicates of the original CVE-2023-34992. [..] After contacting Fortinet once again, we were told their previous statement was “misstated” and that the two new CVEs are variants of the original flaw. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fortinet-warns-of-new-fortis… ∗∗∗ Coyote: A multi-stage banking Trojan abusing the Squirrel installer ∗∗∗ --------------------------------------------- We will delve into the workings of the infection chain and explore the capabilities of the new Trojan that specifically targets users of more than 60 banking institutions, mainly from Brazil. --------------------------------------------- https://securelist.com/coyote-multi-stage-banking-trojan/111846/ ∗∗∗ Facebook ads push new Ov3r_Stealer password-stealing malware ∗∗∗ --------------------------------------------- A new password-stealing malware named Ov3r_Stealer is spreading through fake job advertisements on Facebook, aiming to steal account credentials and cryptocurrency. --------------------------------------------- https://www.bleepingcomputer.com/news/security/facebook-ads-push-new-ov3r-s… ∗∗∗ The toothbrush DDoS attack: How misinformation spreads in the cybersecurity world ∗∗∗ --------------------------------------------- No, three million smart toothbrushes didnt launch a DDoS attack against a Swiss company. --------------------------------------------- https://grahamcluley.com/the-toothbrush-ddos-attack-how-misinformation-spre… ∗∗∗ Fake LastPass password manager spotted on Apple’s App Store ∗∗∗ --------------------------------------------- LastPass is warning that a fake copy of its app is being distributed on the Apple App Store, likely used as a phishing app to steal users' credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-lastpass-password-manag… ===================== = Vulnerabilities = ===================== ∗∗∗ FortiGate / FortiOS 7.4.3 FortiOS Release Notes ∗∗∗ --------------------------------------------- 2024-02-07 Initial release --------------------------------------------- https://docs.fortinet.com/document/fortigate/7.4.3/fortios-release-notes/55… ∗∗∗ SonicOS SSL-VPN Improper Authentication ∗∗∗ --------------------------------------------- An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow a remote attacker to bypass authentication.This issue affects only firmware version SonicOS 7.1.1-7040. CVE: CVE-2024-22394 Last updated: Feb. 6, 2024, 4:44 p.m. --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0003 ∗∗∗ SSD Advisory – TOTOLINK LR1200GB Auth Bypass ∗∗∗ --------------------------------------------- A vulnerability in TOTOLINK LR1200GB allows remote unauthenticated attackers to become authenticated due to a stack overflow vulnerability in the web interface. [..] Multiple emails to the vendor went unanswered, we are releasing this information without being able to get from the vendor a patch or response. --------------------------------------------- https://ssd-disclosure.com/ssd-advisory-totolink-lr1200gb-auth-bypass/ ∗∗∗ Sicherheitslücken: Codeschmuggel und Leistungsverweigerung bei ClamAV ∗∗∗ --------------------------------------------- Der Parser für das OLE2-Dateiformat enthält einen Pufferüberlauf und mit speziell präparierten Dateinamen lassen sich offenbar eigene Befehlszeilen ausführen. --------------------------------------------- https://www.heise.de/-9622674 ∗∗∗ Samsung Magician: Update stopft Sicherheitsleck im SSD-Tool ∗∗∗ --------------------------------------------- Samsung bietet mit Magician eine Software zum Verwalten von SSDs, Speichersticks und -Karten des Herstellers. Ein Update schließt eine Lücke darin. --------------------------------------------- https://www.heise.de/-9622729 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium), Red Hat (gimp, kernel, kernel-rt, and runc), Slackware (expat), SUSE (libavif), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, and linux, linux-aws, linux-gcp, linux-hwe-6.5, linux-laptop, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5, linux-oracle, linux-raspi, linux-starfive). --------------------------------------------- https://lwn.net/Articles/961330/ ∗∗∗ Drupal: Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-008 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (January 29, 2024 to February 4, 2024) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/02/wordfence-intelligence-weekly-wordpr… ∗∗∗ Qolsys IQ Panel 4, IQ4 HUB ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-039-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.02.2024
by Daily end-of-shift report 07 Feb '24

07 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-02-2024 18:00 − Mittwoch 07-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Fortinet snafu: Critical FortiSIEM CVEs are duplicates, issued in error ∗∗∗ --------------------------------------------- It turns out that critical Fortinet FortiSIEM vulnerabilities tracked as CVE-2024-23108 and CVE-2024-23109 are not new and have been published this year in error. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fortinet-snafu-critical-fort… ∗∗∗ Schlüssel ausgelesen: Bastler umgeht Bitlocker-Schutz mit Raspberry Pi Pico ∗∗∗ --------------------------------------------- Möglich war ihm dies durch das Abfangen der Kommunikation des auf dem Mainboard des Notebooks verlöteten TPM-Chips mit der CPU. [..] Auf die Möglichkeit solcher Angriffe auf Systeme mit externen TPM-Chips wiesen Sicherheitsforscher schon im Sommer 2021 hin. Grund dafür sei die unverschlüsselte Übertragung des Verschlüsselungsschlüssels, so dass sich der Schlüssel einfach über die Kontakte des TPMs abfangen lasse, hieß es schon damals. --------------------------------------------- https://www.golem.de/news/schluessel-ausgelesen-bastler-umgeht-bitlocker-sc… ∗∗∗ Unleashing the Power of Scapy for Network Fuzzing ∗∗∗ --------------------------------------------- Cybersecurity is a critical aspect of any network or software system, and fuzzing is arguably one of the most potent techniques used to identify such security vulnerabilities. Fuzzing involves injecting unexpected or invalid data into the system, which can trigger unforeseen behaviours, potentially leading to security breaches or crashes. Scapy is one of the many tools that can be used for fuzzing, and it stands out as a versatile and efficient option. --------------------------------------------- https://www.darkrelay.com/post/unleashing-the-power-of-scapy-for-network-fu… ∗∗∗ Anydesk-Einbruch: Französisches BSI-Pendant vermutet Dezember als Einbruchsdatum ∗∗∗ --------------------------------------------- Der IT-Sicherheitsvorfall bei Anydesk datiert womöglich auf den Dezember 2023, wie den Hinweisen der französischen IT-Sicherheitsbehörde zu entnehmen ist. --------------------------------------------- https://www.heise.de/news/Anydesk-Einbruch-datiert-vermutlich-auf-Dezember-… ∗∗∗ E-Mail von DNS EU ist betrügerisch ∗∗∗ --------------------------------------------- Derzeit erhalten viele Website-Betreiber:innen E-Mails von einer vermeintlichen Firma namens DNS EU. Im E-Mail behauptet das Unternehmen, dass es einen „Registrierungsantrag“ für eine Domain erhalten hat, die Ihrer eigenen Domain sehr ähnlich ist. Ihnen wird angeboten, diese Domain für € 297,50 zu kaufen. Ignorieren Sie dieses E-Mail, das Angebot ist Fake. --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-von-dns-eu-ist-betruegerisch/ ∗∗∗ Vermehrte Ransomware-Angriffe mit Lockbit 3.0 ∗∗∗ --------------------------------------------- In den letzten Tagen sind österreichische Unternehmen und Organisationen vermehrt von Angriffen mit der Ransomware Lockbit 3.0 betroffen. Dabei handelt es sich um Ransomware-as-a-Service, was es einer Vielzahl von Kriminellen ermöglicht, unabhängig voneinander zu agieren und eine grössere Anzahl von Zielen zu attackieren. Bedrohungsakteure, die im Rahmen ihrer Angriffe Lockbit 3.0 einsetzen erlangen vor allem über den Missbrauch von RDP-Verbindungen (beispielsweise unter Einsatz anderweitig gestohlener Zugangsdaten) und die Ausnutzung von Schwachstellen in aus dem Internet erreichbaren Applikationen Zugang zu den Netzwerken ihrer Opfer. Wir empfehlen nachdrücklich, die eigenen Sicherheitsmaßnahmen zu überprüfen [..] --------------------------------------------- https://cert.at/de/aktuelles/2024/2/vermehrte-ransomware-angriffe-mit-lockb… ∗∗∗ Cyber Security Glossary: The Ultimate List ∗∗∗ --------------------------------------------- If you have anything to do with cyber security, you know it employs its own unique and ever-evolving language. Jargon and acronyms are the enemies of clear writing—and are beloved by cyber security experts. So Morphisec has created a comprehensive cyber security glossary that explains commonly used cybersecurity terms, phrases, and technologies. We designed this list to demystify the terms that security professionals use when describing security tools, threats, processes, and techniques. We will periodically update it, and hope you find it useful. --------------------------------------------- https://blog.morphisec.com/cyber-security-glossary ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in JetBrains TeamCity On-Premises ∗∗∗ --------------------------------------------- Das Softwareunternehmen JetBrains hat Informationen über eine kritische Sicherheitslücke in JetBrains TeamCity On-Premises veröffentlicht. Eine Ausnutzung der Schwachstelle, CVE-2024-23917, erlaubt unauthentifizierten Angreifer:innen mit HTTP(s)-Zugriff auf eine verwundbare Instanz von TeamCity das Umgehen von Authentifizierungskontrollen und somit die vollständige Übernahme der betroffenen Installation. --------------------------------------------- https://cert.at/de/aktuelles/2024/2/kritische-sicherheitslucke-in-jetbrains… ∗∗∗ Shim: Kritische Schwachstelle gefährdet Secure Boot unter Linux ∗∗∗ --------------------------------------------- In einer von den meisten gängigen Linux-Distributionen verwendeten EFI-Anwendung namens Shim wurde eine kritische Schwachstelle entdeckt, die es Angreifern ermöglicht, Schadcode auszuführen und die vollständige Kontrolle über ein Zielsystem zu übernehmen. Ausgenutzt werden könne der Fehler durch eine speziell gestaltete HTTP-Anfrage, die zu einem kontrollierten Out-of-bounds-Schreibvorgang führe, heißt es in der Beschreibung zu CVE-2023-40547. --------------------------------------------- https://www.golem.de/news/shim-kritische-schwachstelle-gefaehrdet-secure-bo… ∗∗∗ Zeroshell vulnerable to OS command injection ∗∗∗ --------------------------------------------- Zeroshell Linux distribution contains an OS command injection vulnerability. This vulnerability was reported on August 2020. The Zeroshell project reached EOL on April 2021. The communication with the developer was established on November 2023, and this JVN publication was agreed upon. --------------------------------------------- https://jvn.jp/en/jp/JVN44033918/ ∗∗∗ Cisco: (High) ClamAV OLE2 File Format Parsing Denial of Service Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. CVE-2024-20290 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco: (Critical) Cisco Expressway Series Cross-Site Request Forgery Vulnerabilities ∗∗∗ --------------------------------------------- Multiple vulnerabilities in the Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks, which could allow the attacker to perform arbitrary actions on an affected device. CVE-2024-20255, CVE-2024-20254, CVE-2024-20252 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ SolarWinds Platform 2024.1 Release Notes ∗∗∗ --------------------------------------------- SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited and has not been reported outside of the initial report by the researcher. 8.0 High, CVE-2023-50395, CVE-2023-35188 --------------------------------------------- https://documentation.solarwinds.com/en/success_center/orionplatform/conten… ∗∗∗ VMware Aria: Sicherheitslücken erlauben etwa Rechteausweitung ∗∗∗ --------------------------------------------- Insgesamt fünf Sicherheitslücken dichtet VMware in Aria Operations for Networks – ehemals mit dem Namen vRealize im Umlauf – mit aktualisierter Software ab. Der Schweregrad reicht nach Einschätzung der Entwickler des Unternehmens bis zur Risikostufe "hoch". Bösartige Akteure können durch die Schwachstellen unbefugt ihre Rechte an verwundbaren Systemen erhöhen. --------------------------------------------- https://www.heise.de/-9621415 ∗∗∗ Rechtausweitung durch Lücken in Veeam Recovery Orchestrator möglich ∗∗∗ --------------------------------------------- Veeam flickt die Recovery Orchestrator-Software. Sicherheitslücken darin erlauben bösartigen Akteuren die Ausweitung von Rechten. --------------------------------------------- https://www.heise.de/-9621609 ∗∗∗ Sicherheitsupdates: Dell schließt ältere Lücken in Backuplösungen wie Avamar ∗∗∗ --------------------------------------------- Schwachstellen in Komponenten von Drittanbietern gefährden die Sicherheit von Dell-Backup-Software. Sicherheitsupdates sind verfügbar. --------------------------------------------- https://www.heise.de/9621283 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Red Hat (gimp) and Ubuntu (firefox, linux-oracle, linux-oracle-5.15, and python-django). --------------------------------------------- https://lwn.net/Articles/961173/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Google Chrome 121.0.6167.160/161 / 120.0.6099.283 mit Sicherheitsfixes ∗∗∗ --------------------------------------------- https://www.borncity.com/blog/2024/02/07/google-chrome-121-0-6167-160-161-1… ∗∗∗ [R1] Nessus Version 10.7.0 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2024-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.02.2024
by Daily end-of-shift report 06 Feb '24

06 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Montag 05-02-2024 18:00 − Dienstag 06-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Rust Won’t Save Us: An Analysis of 2023’s Known Exploited Vulnerabilities ∗∗∗ --------------------------------------------- We have analyzed all critical vulnerabilities from the CISA KEV catalog starting from January 2023 through January 2024, categorized the vulnerability root causes, and attempted to analyze if the current efforts in the information security industry match with the current threat vectors being abused. --------------------------------------------- https://www.horizon3.ai/analysis-of-2023s-known-exploited-vulnerabilities/ ∗∗∗ Unseriöse Dirndl-Shops drohen mit Anzeige? Ignorieren Sie die Nachrichten! ∗∗∗ --------------------------------------------- Zahlreiche Betroffene wenden sich aktuell an die Watchlist Internet, weil unseriöse Bekleidungs- und Dirndl-Shops Monate nach den Bestellungen versuchen, Kund:innen einzuschüchtern und zu einer Zahlung zu drängen. Da völlig falsche Produkte geliefert wurden, besteht aber kein Grund zur Zahlung und somit auch kein Grund zur Sorge! --------------------------------------------- https://www.watchlist-internet.at/news/unserioese-dirndl-shops-drohen-mit-a… ∗∗∗ How are user credentials stolen and used by threat actors? ∗∗∗ --------------------------------------------- You’ve probably heard the phrase, “Attackers don’t hack anyone these days. They log on.” In this blog, we describe the various tools and techniques bad actors are using to steal credentials so they can log on with valid account details, and outline our recommendations for defense. --------------------------------------------- https://blog.talosintelligence.com/how-are-user-credentials-stolen-and-used… ∗∗∗ Navigating the Rising Tide of CI/CD Vulnerabilities: The Jenkins and TeamCity Case Studies ∗∗∗ --------------------------------------------- In the evolving landscape of cybersecurity, a new threat has emerged, targeting the core of software development processes. Recently, an alarming incident has brought to light a significant vulnerability in Jenkins CI/CD servers. Approximately 45,000 Jenkins servers have been left exposed to remote code execution (RCE) attacks, leveraging multiple exploit public POCs. This breach is not just a standalone event but a symptom of a growing trend of attacks on Continuous Integration/Continuous Deployment (CI/CD) software supply chains. --------------------------------------------- https://checkmarx.com/blog/navigating-the-rising-tide-of-ci-cd-vulnerabilit… ∗∗∗ Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services ∗∗∗ --------------------------------------------- Three new security vulnerabilities have been discovered in Azure HDInsights Apache Hadoop, Kafka, and Spark services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition. [..] Following responsible disclosure, Microsoft has rolled out fixes as part of updates released on October 26, 2023. --------------------------------------------- https://thehackernews.com/2024/02/high-severity-flaws-found-in-azure.html ∗∗∗ Exploring the (Not So) Secret Code of Black Hunt Ransomware ∗∗∗ --------------------------------------------- In this analysis we examined the BlackHunt sample shared on X (formerly Twitter). During our analysis we found notable similarities between BlackHunt ransomware and LockBit, which suggested that it uses leaked code of Lockbit. In addition, it uses some techniques similar to REvil ransomware. --------------------------------------------- https://www.rapid7.com/blog/post/2024/02/05/exploring-the-not-so-secret-cod… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday Android: Kritische Schadcode-Lücke auf Systemebene geschlossen ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken gefährden Android-Geräte. Für bestimmte Smartphones und Tablets sind Updates erschienen. --------------------------------------------- https://www.heise.de/-9619910 ∗∗∗ Sicherheitsupdate: Mehrere Lücken gefährden Server-Monitoring-Tool Nagios XI ∗∗∗ --------------------------------------------- Unter bestimmten Bedingungen können Angreifer Schadcode auf Server mit Nagios XI laden. Ein Sicherheitsupdate schließt diese und weitere Schwachstellen. --------------------------------------------- https://www.heise.de/-9620155 ∗∗∗ Kritische Schwachstellen in Multifunktions- und Laserdruckern von Canon ∗∗∗ --------------------------------------------- Canon warnt vor kritischen Sicherheitslücken in einigen SOHO-Multifunktions- und Laserdruckern. Gegenmaßnahmen sollen helfen. --------------------------------------------- https://www.heise.de/-9620345 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (firefox, gstreamer1-plugins-bad-free, and tigervnc), Debian (ruby-sanitize), Fedora (kernel, kernel-headers, qt5-qtwebengine, and runc), Oracle (gnutls, kernel, libssh, rpm, runc, and tigervnc), Red Hat (runc), and SUSE (bouncycastle, jsch, python, and runc). --------------------------------------------- https://lwn.net/Articles/961083/ ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2024-0001 ∗∗∗ --------------------------------------------- CVE identifiers: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213, CVE-2023-40414, CVE-2023-42833, CVE-2014-1745 --------------------------------------------- https://webkitgtk.org/security/WSA-2024-0001.html ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- Google Chromium V8 Type Confusion Vulnerability CVE-2023-4762 --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/06/cisa-adds-one-known-expl… ∗∗∗ MISP 2.4.184 released with performance improvements, security and bugs fixes. ∗∗∗ --------------------------------------------- A series of security fixes were done in this release, the vulnerabilities are accessible to authenticated users, especially those with specific privileges like Org admin. We urge users to update to this version especially if you have different organisations having access to your instances. --------------------------------------------- https://github.com/MISP/MISP/releases/tag/v2.4.184 ∗∗∗ ZDI-24-086: TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-086/ ∗∗∗ ZDI-24-085: (Pwn2Own) TP-Link Omada ER605 DHCPv6 Client Options Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-085/ ∗∗∗ ZDI-24-087: (Pwn2Own) Western Digital MyCloud PR4100 RESTSDK Server-Side Request Forgery Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-24-087/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Pilz: Multiple products affected by uC/HTTP vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-002/ ∗∗∗ HID Global Encoders ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-01 ∗∗∗ HID Global Reader Configuration Cards ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-037-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.02.2024
by Daily end-of-shift report 05 Feb '24

05 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-02-2024 18:00 − Montag 05-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Newest Ivanti SSRF zero-day now under mass exploitation ∗∗∗ --------------------------------------------- An Ivanti Connect Secure and Ivanti Policy Secure server-side request forgery (SSRF) vulnerability tracked as CVE-2024-21893 is currently under mass exploitation by multiple attackers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/newest-ivanti-ssrf-zero-day-… ∗∗∗ Cyberangriff: Fernwartungssoftware-Anbieter Anydesk gehackt ∗∗∗ --------------------------------------------- Anydesk ist Opfer eines Cyberangriffs geworden. Die Folgen sind noch nicht klar, aber möglicherweise gravierend. --------------------------------------------- https://www.golem.de/news/cyberangriff-fernwartungssoftware-anbieter-anydes… ∗∗∗ Darknet: Anydesk-Zugangsdaten in Hackerforen aufgetaucht ∗∗∗ --------------------------------------------- Quelle der Daten ist nach aktuellen Erkenntnissen wohl nicht der jüngste Sicherheitsvorfall bei Anydesk. Ein Passwortwechsel wird dennoch empfohlen. --------------------------------------------- https://www.golem.de/news/darknet-anydesk-zugangsdaten-in-hackerforen-aufge… ∗∗∗ How to hack the Airbus NAVBLUE Flysmart+ Manager ∗∗∗ --------------------------------------------- Airbus Navblue Flysmart+ Manager allowed attackers to tamper with the engine performance calculations and intercept data. Flysmart+ is a suite of apps for pilot EFBs, helping deliver efficient and safe departure and arrival of flights. Researchers from Pen Test Partners discovered a vulnerability in Navblue Flysmart+ Manager that can be exploited [...] --------------------------------------------- https://securityaffairs.com/158661/hacking/airbus-flysmart-flaw.html ∗∗∗ Encrypted Attacks: Impact on Public Sector ∗∗∗ --------------------------------------------- Following FBI and CISA warnings to public sector defenders in November regarding increased targeting by infamous ransomware groups, the imperative to understand and defend against evolving - and increasingly covert - cyber threats has intensified. According to Zscaler ThreatLabz analysis of the 2023 threat landscape, 86% of threats hide within encrypted traffic. What does this mean for the public sector? --------------------------------------------- https://www.zscaler.com/blogs/security-research/encrypted-attacks-impact-pu… ∗∗∗ Hacking a Smart Home Device ∗∗∗ --------------------------------------------- How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant. --------------------------------------------- https://jmswrnr.com/blog/hacking-a-smart-home-device ∗∗∗ Videokonferenz voller KI-Klone: Angestellter schickt Betrügern 24 Millionen Euro ∗∗∗ --------------------------------------------- Bislang werden im Rahmen der "Chef-Masche" Angestellte zumeist von einer Person überzeugt, Geld herauszugeben. Ein Fall in Hongkong hat nun eine neue Qualität. --------------------------------------------- https://www.heise.de/-9618064.html ∗∗∗ Hartkodiertes Passwort: Wärmepumpen von Alpha Innotec und Novelan angreifbar ∗∗∗ --------------------------------------------- Ein IT-Forscher hat in der Firmware von Alpha Innotec- und Novelan-Wärmepumpen das hartkodierte Root-Passwort gefunden. Updates bieten Abhilfe. --------------------------------------------- https://www.heise.de/-9618846.html ∗∗∗ Ivanti Zero Day – Threat Actors observed leveraging CVE-2021-42278 and CVE-2021-42287 for quick privilege escalation to Domain Admin ∗∗∗ --------------------------------------------- TL;dr NCC Group has observed what we believe to be the attempted exploitation of CVE-2021-42278 and CVE-2021-42287 as a means of privilege escalation, following the successful compromise of an Ivanti Secure Connect VPN using the following zero-day vulnerabilities reported by Volexity1 on 10/01/2024: [...] --------------------------------------------- https://research.nccgroup.com/2024/02/05/ivanti-zero-day-threat-actors-obse… ∗∗∗ Achtung: E-Card mit 500 Euro Guthaben für Apothekenkäufe ist Fake ∗∗∗ --------------------------------------------- Auf Facebook wird eine „E-Card-Gutscheinkarte“ beworben. Wenn Sie eine kurze Umfrage ausfüllen und 2 Euro überweisen, erhalten Sie angeblich 500 Euro für Apothekeneinkäufe. Achtung, dabei handelt es sich um Betrug. Ein solches Angebot gibt es nicht! --------------------------------------------- https://www.watchlist-internet.at/news/achtung-e-card-mit-500-euro-guthaben… ∗∗∗ Sicherheitsvorfall bei der AnyDesk Software GmbH ∗∗∗ --------------------------------------------- Der deutsche Softwarehersteller AnyDesk Software GmbH, Entwickler der Fernwartungssoftware AnyDesk, hat am Abend des 02.02.2024 im Rahmen einer Pressemeldung über einen erfolgreichen Angriff gegen seine Infrastruktur informiert. Laut dem Unternehmen wurde direkt nach Entdeckung des Vorfalles ein externer Sicherheitsdienstleister zur Behandlung des Vorfalls hinzugezogen und die zuständigen Behörden informiert. Weiters gibt das Unternehmen an, dass keinerlei private Schlüssel, [...] --------------------------------------------- https://cert.at/de/aktuelles/2024/2/sicherheitsvorfall-bei-der-anydesk-soft… ===================== = Vulnerabilities = ===================== ∗∗∗ Docker, Kubernetes und co.: Hacker können aus Containern auf Hostsysteme zugreifen ∗∗∗ --------------------------------------------- Die Schwachstellen dafür beziehen sich auf Buildkit und das CLI-Tool runc. Eine davon erreicht mit einem CVSS von 10 den maximal möglichen Schweregrad. --------------------------------------------- https://www.golem.de/news/docker-kubernetes-und-co-hacker-koennen-aus-conta… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (rear, runc, sudo, and zbar), Fedora (chromium, grub2, libebml, mingw-python-pygments, and python-aiohttp), Gentoo (FreeType, GNAT Ada Suite, Microsoft Edge, NBD Tools, OpenSSL, QtGui, SDDM, Wireshark, and Xen), Mageia (dracut, glibc, nss and firefox, openssl, packages, perl, and thunderbird), Slackware (libxml2), SUSE (java-11-openjdk, java-17-openjdk, perl, python-uamqp, slurm, and xerces-c), and Ubuntu (libssh and openssl). --------------------------------------------- https://lwn.net/Articles/960952/ ∗∗∗ 2024-02-05: Cyber Security Advisory - B&R Automation Runtime FTP uses unsecure encryption mechanisms ∗∗∗ --------------------------------------------- https://www.br-automation.com/fileadmin/SA23P004_FTP_uses_unsecure_encrypti… ∗∗∗ Canon: CPE2024-001 – Regarding vulnerabilities for Small Office Multifunction Printers and Laser Printers – 05 February 2024 ∗∗∗ --------------------------------------------- https://www.canon-europe.com/support/product-security-latest-news/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ QNAP: Neue Firmware-Versionen beheben Befehlsschmuggel-Lücke ∗∗∗ --------------------------------------------- https://www.heise.de/-9617332.html ∗∗∗ IT-Sicherheitsüberwachung Juniper JSA für mehrere Attacken anfällig ∗∗∗ --------------------------------------------- https://www.heise.de/-9617677.html ∗∗∗ HCL schließt Sicherheitslücken in Bigfix, Devops Deploy und Launch ∗∗∗ --------------------------------------------- https://www.heise.de/-9618224.html -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.02.2024
by Daily end-of-shift report 02 Feb '24

02 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-02-2024 18:00 − Freitag 02-02-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Abschaltbefehl: US-Behörden müssen Ivanti-Geräte vom Netz nehmen ∗∗∗ --------------------------------------------- In einer Notfallanordnung trägt die US-Cybersicherheitsbehörde betroffenen Stellen auf, in den nächsten Stunden zu handeln. Ivanti-Geräte sollen vom Netz. --------------------------------------------- https://www.heise.de/news/Abschaltbefehl-US-Behoerden-muessen-Ivanti-Geraet… ∗∗∗ Bericht: Wie Angreifer in das Netzwerk von Cloudflare eingedrungen sind ∗∗∗ --------------------------------------------- Nach Abschluss der Untersuchungen eines IT-Sicherheitsvorfalls schildert der CDN-Betreiber Cloudflare, wie die Attacke abgelaufen ist. --------------------------------------------- https://www.heise.de/news/Bericht-Wie-Angreifer-in-das-Netzwerk-von-Cloudfl… ∗∗∗ VajraSpy: Ein Patchwork-Sammelsurium voller Spionage-Apps ∗∗∗ --------------------------------------------- ESET-Forscher entdeckten mehrere Android-Apps, die VajraSpy beinhalten, ein RAT, der von der Patchwork APT-Gruppe verwendet wird. --------------------------------------------- https://www.welivesecurity.com/fr/cybersecurite/vajraspy-ein-patchwork-samm… ∗∗∗ Scheinbar harmloser PDF-Viewer leert Bankkonten ahnungsloser Android-Nutzer:innen ∗∗∗ --------------------------------------------- Derzeit ist eine neue Welle von Schadsoftware im Umlauf, die bereits in der Vergangenheit zahlreiche Bankkonten leergeräumt hat. Es handelt sich dabei um den Banking-Trojaner Anatsa, der über die Installation von Apps wie PDF Viewer oder PDF Reader über den Google Play Store verbreitet wird. --------------------------------------------- https://www.watchlist-internet.at/news/scheinbar-harmloser-pdf-viewer-leert… ∗∗∗ Exploring the Latest Mispadu Stealer Variant ∗∗∗ --------------------------------------------- Evaluation of a new variant of Mispadu, a banking Trojan, highlights how infostealers evolve over time and can be hard to pin to past campaigns. --------------------------------------------- https://unit42.paloaltonetworks.com/mispadu-infostealer-variant/ ∗∗∗ How Memory Forensics Revealed Exploitation of Ivanti Connect Secure VPN Zero-Day Vulnerabilities ∗∗∗ --------------------------------------------- As outlined in the previous blog series, while Volexity leveraged network packet captures and disk images to reconstruct parts of the attack, it was ultimately a memory sample that allowed Volexity to confirm exploitation. --------------------------------------------- https://www.volexity.com/blog/2024/02/01/how-memory-forensics-revealed-expl… ∗∗∗ Threat Actors Installing Linux Backdoor Accounts ∗∗∗ --------------------------------------------- Threat actors install malware by launching brute force and dictionary attacks against Linux systems that are poorly managed, such as using default settings or having a simple password. --------------------------------------------- https://asec.ahnlab.com/en/61185/ ∗∗∗ How We Were Able to Infiltrate Attacker Telegram Bots ∗∗∗ --------------------------------------------- It is not uncommon for attackers to publish malicious packages that exfiltrate victims’ data to them using Telegram bots. However, what if we could eavesdrop on what the attacker sees? --------------------------------------------- https://checkmarx.com/blog/how-we-were-able-to-infiltrate-attacker-telegram… ∗∗∗ Jenkins Vulnerability Estimated to Affect 43% of Cloud Environments ∗∗∗ --------------------------------------------- >From our scans on the Orca Cloud Security Platform, we found that 43% of organizations operate at least one unmanaged Jenkins server in their environment. --------------------------------------------- https://orca.security/resources/blog/jenkins-arbitrary-file-read-vulnerabil… ===================== = Vulnerabilities = ===================== ∗∗∗ CISA-Warnung: Alte iPhone-Schwachstelle wird aktiv ausgenutzt ∗∗∗ --------------------------------------------- Eine von Apple gestopfte Kernel-Lücke wird der US-Sicherheitsbehörde zufolge für Angriffe aktiv genutzt. Für ältere iPhones scheint es keinen Patch zu geben. --------------------------------------------- https://www.heise.de/news/CISA-Warnung-Alte-iPhone-Schwachstelle-wird-aktiv… ∗∗∗ Sicherheitsupdate: IBM-Sicherheitslösung QRadar SIEM unter Linux angreifbar ∗∗∗ --------------------------------------------- Mehrere Komponenten eines Add ons von IBMs Security Information and Event Management-System QRadar sind verwundbar. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdate-IBM-Sicherheitsloesung-QRadar-S… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, man-db, and openjdk-17), Fedora (chromium, indent, jupyterlab, kernel, and python-notebook), Gentoo (glibc), Oracle (firefox, thunderbird, and tigervnc), Red Hat (rpm), SUSE (cpio, gdb, gstreamer, openconnect, slurm, slurm_18_08, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, squid, webkit2gtk3, and xerces-c), and Ubuntu (imagemagick and xorg-server, xwayland). --------------------------------------------- https://lwn.net/Articles/960604/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ QNAP Security Advisories ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisories/ ∗∗∗ Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/02/01/moby-and-open-container-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.02.2024
by Daily end-of-shift report 01 Feb '24

01 Feb '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 31-01-2024 18:00 − Donnerstag 01-02-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Exploit released for Android local elevation flaw impacting 7 OEMs ∗∗∗ --------------------------------------------- A proof-of-concept (PoC) exploit for a local privilege elevation flaw impacting at least seven Android original equipment manufacturers (OEMs) is now publicly available on GitHub. However, as the exploit requires local access, its release will mostly be helpful to researchers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-released-for-android… ∗∗∗ Hackers push USB malware payloads via news, media hosting sites ∗∗∗ --------------------------------------------- A financially motivated threat actor using USB devices for initial infection has been found abusing legitimate online platforms, including GitHub, Vimeo, and Ars Technica, to host encoded payloads embedded in seemingly benign content. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-push-usb-malware-pay… ∗∗∗ The Fun and Dangers of Top Level Domains (TLDs), (Wed, Jan 31st) ∗∗∗ --------------------------------------------- In the beginning, life was easy. We had a very limited set of top-level domains: .com, .edu, .gov, ..int, org, .mil, .net, .org, .edu. In addition, we had .arpa for infrastructure use and various two letter country level domains. [..] But yesterday, I noticed some news about a new interesting TLD that you may want to consider adopting: .internal. --------------------------------------------- https://isc.sans.edu/diary/rss/30608 ∗∗∗ FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network ∗∗∗ --------------------------------------------- The threat actor behind a peer-to-peer (P2P) botnet known as FritzFrog has made a return with a new variant that leverages the Log4Shell vulnerability to propagate internally within an already compromised network. --------------------------------------------- https://thehackernews.com/2024/02/fritzfrog-returns-with-log4shell-and.html ∗∗∗ Stealthy Persistence & PrivEsc in Entra ID by using the Federated Auth Secondary Token-signing Cert. ∗∗∗ --------------------------------------------- Microsoft Entra ID (formerly known as Azure AD) offers a feature called federation that allows you to delegate authentication to another Identity Provider (IdP), such as AD FS with on-prem Active Directory. When users log in, they will be redirected to the external IdP for authentication, before being redirected back to Entra ID who will then verify the successful authentication on the external IdP and the user’s identity. [..] The external IdP signs the token with a private key, which has an associated public key stored in a certificate. [..] In this post, I’ll show you where this certificate can be found and how attackers can add it (given the necessary privileges) and use it to forge malicious tokens. Finally, I will provide some recommendations for defense in light of this. --------------------------------------------- https://medium.com/tenable-techblog/stealthy-persistence-privesc-in-entra-i… ∗∗∗ OAS Engine Deep Dive: Abusing low-impact vulnerabilities to escalate privileges ∗∗∗ --------------------------------------------- Open Automation Software recently released patches for multiple vulnerabilities in their OAS Engine. Cisco Talos publicly disclosed these issues after working with Open Automation Software to ensure that patches were available for users. Now that a fix has been released with Version 19, we want to take the time to dive into a few of these vulnerabilities and show how a handful of bugs that could be viewed as low-impact could be exploited as a series to carry out various malicious actions, even going as far to gaining access to the underlying system. --------------------------------------------- https://blog.talosintelligence.com/oas-engine-deep-dive/ ===================== = Vulnerabilities = ===================== ∗∗∗ Mastodon: Diebstahl beliebiger Identitäten im föderierten Kurznachrichtendienst ∗∗∗ --------------------------------------------- Angreifer können jeden beliebigen Account übernehmen und fälschen. [..] Die Sicherheitslücke hat die CVE-ID CVE-2024-23832 erhalten und hat immerhin 9,4 von 10 CVSS-Punkten. Es handelt sich nach Einschätzung des Mastodon-Teams um eine leicht aus der Ferne ausnutzbare Lücke, die keinerlei Vorbedingungen mitbringt. Weder muss der Angreifer über besondere Privilegien verfügen, noch einen legitimen Nutzer austricksen, etwa mit einem gefälschten Link. Weitere Details verraten die Entwickler erst am 15. Februar. --------------------------------------------- https://www.heise.de/-9615961 ∗∗∗ Security Update for Ivanti Connect Secure and Ivanti Policy Secure Gateways ∗∗∗ --------------------------------------------- Update 1 February: A patch addressing all known vulnerabilities is now available for Ivanti Connect Secure version 22.5R2.2 and Ivanti Policy Secure 22.5R1.1. --------------------------------------------- https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-i… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (debian-security-support, firefox-esr, openjdk-11, and python-asyncssh), Fedora (glibc, python-templated-dictionary, thunderbird, and xorg-x11-server-Xwayland), Gentoo (Chromium, Google Chrome, Microsoft Edge and WebKitGTK+), Red Hat (firefox, gnutls, libssh, thunderbird, and tigervnc), SUSE (mbedtls, rear116, rear1172a, runc, squid, and tinyssh), and Ubuntu (glibc and runc). --------------------------------------------- https://lwn.net/Articles/960436/ ∗∗∗ Gessler GmbH WEB-MASTER ∗∗∗ --------------------------------------------- Successful exploitation of these vulnerabilities could allow a user to take control of the web management of the device. An attacker with access to the device could also extract and break the password hashes for all users stored on the device. CVSS v3 9.8 --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-01 ∗∗∗ Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-007 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Lexmark Security Advisories ∗∗∗ --------------------------------------------- https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisorie… ∗∗∗ Juniper: (Critical) 2024-01 Security Bulletin: JSA Series: Multiple vulnerabilities resolved in JSA Applications ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-JSA-S… ∗∗∗ Juniper: (Medium) 2024-01 Security Bulletin: JSA Series: Multiple vulnerabilities resolved in 7.5.0 UP7 IF04 ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-JSA-S… ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (January 22, 2024 to January 28, 2024) ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/02/wordfence-intelligence-weekly-wordpr… ∗∗∗ AVEVA Edge products (formerly known as InduSoft Web Studio) ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-032-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.01.2024
by Daily end-of-shift report 31 Jan '24

31 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 30-01-2024 18:00 − Mittwoch 31-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Debian, Ubuntu und mehr: glibc-Schwachstelle ermöglicht Root-Zugriff unter Linux ∗∗∗ --------------------------------------------- Darüber hinaus wurden weitere Schwachstellen in der Gnu-C-Bibliothek aufgedeckt. Eine davon existiert wohl schon seit über 30 Jahren. --------------------------------------------- https://www.golem.de/news/debian-ubuntu-und-mehr-glibc-schwachstelle-ermoeg… ∗∗∗ Tracking 15 Years of Qakbot Development ∗∗∗ --------------------------------------------- Qakbot (aka QBot or Pinkslipbot) is a malware trojan that has been used to operate one of the oldest and longest running cybercriminal enterprises. Qakbot has evolved from a banking trojan to a malware implant that can be used for lateral movement and the eventual deployment of ransomware. In August 2023, the Qakbot infrastructure was dismantled by law enforcement. However, just several months later in December 2023, the fifth (and latest) version of Qakbot was released, [...] --------------------------------------------- https://www.zscaler.com/blogs/security-research/tracking-15-years-qakbot-de… ∗∗∗ Ransomware: Online-Tool entschlüsselt unter Umständen BlackCat & Co. ∗∗∗ --------------------------------------------- Stimmen die Voraussetzungen, können Ransomwareopfer auf einer Website Daten entschlüsseln, ohne Lösegeld zu zahlen. --------------------------------------------- https://www.heise.de/-9614278.html ∗∗∗ A zero-day vulnerability (and PoC) to blind defenses relying on Windows event logs ∗∗∗ --------------------------------------------- A zero-day vulnerability that, when triggered, could crash the Windows Event Log service on all supported (and some legacy) versions of Windows could spell trouble for enterprise defenders. Discovered by a security researcher named Florian and reported to Microsoft, the vulnerability is yet to be patched. In the meantime, the researcher has gotten the go-ahead from the company to publish a PoC exploit. --------------------------------------------- https://www.helpnetsecurity.com/2024/01/31/windows-event-log-vulnerability/ ∗∗∗ Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation ∗∗∗ --------------------------------------------- Update (Jan. 31): We released a follow-up blog post containing additional details from our investigations into this threat, along with more recommendations for defenders. Note: This is a developing campaign under active analysis by Mandiant and Ivanti. We will continue to add more indicators, detections, and information to this blog post as needed. --------------------------------------------- https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-d… ∗∗∗ CISA and FBI Release Secure by Design Alert Urging Manufacturers to Eliminate Defects in SOHO Routers ∗∗∗ --------------------------------------------- Today, CISA and the Federal Bureau of Investigation (FBI) published guidance on Security Design Improvements for SOHO Device Manufacturers as a part of the new Secure by Design (SbD) Alert series that focuses on how manufacturers should shift the burden of security away from customers by integrating security into product design and development. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-and-fbi-release-sec… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (bind9 and glibc), Fedora (ncurses), Gentoo (containerd, libaom, and xorg-server, xwayland), Mageia (python-pillow and zlib), Oracle (grub2 and tomcat), Red Hat (avahi, c-ares, container-tools:3.0, curl, firefox, frr, kernel, kernel-rt, kpatch-patch, libfastjson, libmicrohttpd, linux-firmware, oniguruma, openssh, perl-HTTP-Tiny, python-pip, python-urllib3, python3, rpm, samba, sqlite, tcpdump, thunderbird, tigervnc, and virt:rhel and virt-devel:rhel modules), SUSE (python-Pillow, slurm, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, and xen), and Ubuntu (libde265, linux-nvidia, mysql-8.0, openldap, pillow, postfix, and xorg-server, xwayland). --------------------------------------------- https://lwn.net/Articles/960248/ ∗∗∗ Mattermost security updates 9.4.2 / 9.3.1 / 9.2.5 / 8.1.9 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses low- to medium-level severity vulnerabilities. We highly recommend that you apply the update. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-9-4-2-9-3-1-9-2-5-8… ∗∗∗ CISA ICS Advisories ∗∗∗ --------------------------------------------- - Hitron Systems Security Camera DVR - Rockwell Automation ControlLogix and GuardLogix - Rockwell Automation FactoryTalk Service Platform - Rockwell Automation LP30/40/50 and BM40 Operator Interface --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories?f%5B0%5D=advisory… ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-48618 Apple Multiple Products Improper Authentication Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-adds-one-known-expl… ∗∗∗ Security Advisory Report - OBSO-2401-03 ∗∗∗ --------------------------------------------- A Command injection vulnerability has been identified in the MyPortal@Work application of Atos OpenScape Business which, if successfully exploited, could allow a malicious actor to execute arbitrary scripts on a client machine. The severity is rated high. Customers are advised to update the systems with the available fix release. --------------------------------------------- https://networks.unify.com/security/advisories/OBSO-2401-03.pdf ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Google Chrome: Update schließt vier Sicherheitslücken ∗∗∗ --------------------------------------------- https://www.heise.de/-9613823.html ∗∗∗ SVD-2024-0112: Third-Party Package Updates in Splunk Add-on Builder - January 2024 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0112 ∗∗∗ SVD-2024-0111: Sensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0111 ∗∗∗ SVD-2024-0110: Session Token Disclosure to Internal Log Files in Splunk Add-on Builder ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2024-0110 ∗∗∗ The WordPress 6.4.3 Security Update – What You Need to Know ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/01/the-wordpress-6-4-3-security-update-… ∗∗∗ Tor Code Audit Finds 17 Vulnerabilities ∗∗∗ --------------------------------------------- https://www.securityweek.com/tor-code-audit-finds-17-vulnerabilities/ ∗∗∗ Update #5: Kritische Sicherheitslücken in Ivanti Connect Secure und Ivanti Policy Secure - aktiv ausgenützt - Patches verfügbar ∗∗∗ --------------------------------------------- https://cert.at/de/warnungen/2024/1/kritische-sicherheitslucken-in-ivanti-c… ∗∗∗ List of Security Fixes and Improvements in Veeam Backup for Nutanix AHV ∗∗∗ --------------------------------------------- https://www.veeam.com/kb4236 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.01.2024
by Daily end-of-shift report 30 Jan '24

30 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Montag 29-01-2024 18:00 − Dienstag 30-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ransomwareattacke: Hacker greifen interne Daten von Schneider Electric ab ∗∗∗ --------------------------------------------- Angeblich steckt die Ransomwaregruppe Cactus hinter dem Angriff. Sie hat offenbar mehrere TByte an Daten exfiltriert und fordert ein Lösegeld. --------------------------------------------- https://www.golem.de/news/ransomwareattacke-hacker-greifen-interne-daten-vo… ∗∗∗ What did I say to make you stop talking to me?, (Tue, Jan 30th) ∗∗∗ --------------------------------------------- We use Cowrie to emulate an SSH and Telnet server for our honeypots. Cowrie is great software maintained by Michel Oosterhof. --------------------------------------------- https://isc.sans.edu/diary/rss/30604 ∗∗∗ New ZLoader Malware Variant Surfaces with 64-bit Windows Compatibility ∗∗∗ --------------------------------------------- Threat hunters have identified a new campaign that delivers the ZLoader malware, resurfacing nearly two years after the botnets infrastructure was dismantled in April 2022. --------------------------------------------- https://thehackernews.com/2024/01/new-zloader-malware-variant-surfaces.html ∗∗∗ Is Your SAP Cloud Connector Safe? The Risk You Can’t Ignore ∗∗∗ --------------------------------------------- In this article, we will discuss security issues and provide recommendations to mitigate the risks associated with using SAP CC on the Windows platform. --------------------------------------------- https://redrays.io/blog/sap-cloud-connector-security/ ∗∗∗ Ransomware-Bericht: Immer weniger Opfer zahlen Lösegeld ∗∗∗ --------------------------------------------- Sicherheitsforscher zeigen aktuelle Trends bei Verschlüsselungstrojanern auf. Unter anderem schrumpfen die Summen von Lösegeldern. --------------------------------------------- https://www.heise.de/news/Ransomware-Bericht-Immer-weniger-Opfer-zahlen-Loe… ∗∗∗ Lieber nicht: Abnehm-Pillen von Keto Base ∗∗∗ --------------------------------------------- In einem gefälschten Online-Artikel werden Abnehm-Pillen von Keto Base beworben. Angeblich wurde dieses „Wundermittel“ zum schnellen Abnehmen in der TV-Show „Höhle des Löwen“ vorgestellt und finanziert. Dabei handelt es sich aber um Fake News. Dieses Angebot ist unseriös und schädigt im schlimmsten Fall Ihrer Gesundheit. --------------------------------------------- https://www.watchlist-internet.at/news/lieber-nicht-abnehm-pillen-von-keto-… ∗∗∗ Trigona Ransomware Threat Actor Uses Mimic Ransomware ∗∗∗ --------------------------------------------- AhnLab SEcurity intelligence Center (ASEC) has recently identified a new activity of the Trigona ransomware threat actor installing Mimic ransomware. --------------------------------------------- https://asec.ahnlab.com/en/61000/ ∗∗∗ DarkGate malware delivered via Microsoft Teams - detection and response ∗∗∗ --------------------------------------------- While most end users are well-acquainted with the dangers of traditional phishing attacks, such as those delivered via email or other media, a large proportion are likely unaware that Microsoft Teams chats could be a phishing vector. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/darkgate-malware-de… ===================== = Vulnerabilities = ===================== ∗∗∗ DLL Proxying: Trend Micro liefert Updates, weitere Hersteller angreifbar ∗∗∗ --------------------------------------------- Bei Antivirenprogrammen mehrerer Hersteller haben IT-Forscher DLL-Proxying-Schwachstellen gefunden. Trend Micro hat schon Updates. --------------------------------------------- https://www.heise.de/news/DLL-Proxying-Trend-Micro-liefert-Updates-weitere-… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (pillow, postfix, and redis), Fedora (python-templated-dictionary and selinux-policy), Red Hat (gnutls, kpatch-patch, libssh, and tomcat), and Ubuntu (amanda, ceph, linux-azure, linux-azure-4.15, linux-kvm, and tinyxml). --------------------------------------------- https://lwn.net/Articles/960008/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ XSA-450 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-450.html ∗∗∗ XSA-449 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-449.html ∗∗∗ Festo: Multiple products contain CoDe16 vulnerability ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-063/ ∗∗∗ Pilz: Vulnerabiiity in PASvisu and PMI v8xx ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-050/ ∗∗∗ Emerson Rosemount GC370XA, GC700XA, GC1500XA ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-01 ∗∗∗ Mitsubishi Electric FA Engineering Software Products ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-02 ∗∗∗ Mitsubishi Electric MELSEC WS Series Ethernet Interface Module ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 ∗∗∗ Zyxel security advisory for post-authentication command injection vulnerability in NAS products ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.01.2024
by Daily end-of-shift report 29 Jan '24

29 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 26-01-2024 18:00 − Montag 29-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Token-Leak: Quellcode von Mercedes-Benz lag wohl frei zugänglich im Netz ∗∗∗ --------------------------------------------- Ein Authentifizierungstoken von Mercedes-Benz lag wohl für mehrere Monate in einem öffentlichen Github-Repository - mit weitreichenden Zugriffsrechten. --------------------------------------------- https://www.golem.de/news/token-leak-quellcode-von-mercedes-benz-lag-wohl-f… ∗∗∗ Exploit Flare Up Against Older Altassian Confluence Vulnerability, (Mon, Jan 29th) ∗∗∗ --------------------------------------------- Last October, Atlassian released a patch for CVE-2023-22515 [1]. This vulnerability allowed attackers to create new admin users in Confluence. Today, I noticed a bit a "flare up" in a specific exploit variant. --------------------------------------------- https://isc.sans.edu/diary/rss/30600 ∗∗∗ Trusted Domain, Hidden Danger: Deceptive URL Redirections in Email Phishing Attacks ∗∗∗ --------------------------------------------- In this ever-evolving landscape of cyberthreats, email has become a prime target for phishing attacks. Cybercriminals continue to adapt and employ more sophisticated methods to effectively deceive users and bypass detection measures. One of the most prevalent tactics nowadays involves exploiting legitimate platforms for redirection through deceptive links. In this blog post, well explore how trusted platforms are increasingly being exploited as redirectors, [...] --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trusted-dom… ∗∗∗ Albabat, Kasseika, Kuiper: New Ransomware Gangs Rise with Rust and Golang ∗∗∗ --------------------------------------------- Cybersecurity researchers have detected in the wild yet another variant of the Phobos ransomware family known as Faust. Fortinet FortiGuard Labs, which detailed the latest iteration of the ransomware, said its being propagated by means of an infection that delivers a Microsoft Excel document (.XLAM) containing a VBA script. --------------------------------------------- https://thehackernews.com/2024/01/albabat-kasseika-kuiper-new-ransomware.ht… ∗∗∗ Jetzt updaten! Exploits für kritische Jenkins-Sicherheitslücke im Umlauf ∗∗∗ --------------------------------------------- Für die in der vergangenen Woche bekanntgewordene kritische Sicherheitslücke in Jenkins ist Exploit-Code aufgetaucht. Höchste Zeit zum Aktualisieren! --------------------------------------------- https://www.heise.de/-9611923.html ∗∗∗ Erpressung in Südwestfalen: Akira kam mit geratenem Passwort ins kommunale Netz ∗∗∗ --------------------------------------------- Ein nun vorliegender forensischer Bericht stellt dem kommunalen IT-Verbund ein mittelprächtiges Zeugnis aus. Die Krisenbewältigung läuft weiter. --------------------------------------------- https://www.heise.de/-9610102.html ∗∗∗ 10 things to do to improve your online privacy ∗∗∗ --------------------------------------------- Its Data Privacy Week so here are 10 tips from our VP of Consumer Privacy, Oren Arar, about how to stay private online. --------------------------------------------- https://www.malwarebytes.com/blog/personal/2024/01/10-things-to-do-to-impro… ∗∗∗ So werden Sie bei der Wohnungssuche abgezockt ∗∗∗ --------------------------------------------- Zentrale Lage, frisch renoviert, hochwertige Möbel - und das vergleichsweise günstig. Wer auf Wohnungssuche ist, stößt früher oder später auf ein solches Angebot und ist überwältigt. Leider handelt es sich hierbei sehr wahrscheinlich um ein betrügerisches Inserat. Kriminelle versuchen Ihnen mit einmaligen Angeboten, Vorauszahlungen zu entlocken. Wir zeigen Ihnen, wie Sie bei der Wohnungssuche nicht betrogen werden. --------------------------------------------- https://www.watchlist-internet.at/news/so-werden-sie-bei-der-wohnungssuche-… ∗∗∗ Akira Ransomware and exploitation of Cisco Anyconnect vulnerability CVE-2020-3259 ∗∗∗ --------------------------------------------- In several recent incident response missions, the Truesec CSIRT team made forensic observations indicating that the old vulnerability CVE-2020-3259 is likely to be actively exploited --------------------------------------------- https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by CentOS (gstreamer-plugins-bad-free, java-1.8.0-openjdk, java-11-openjdk, kernel, LibRaw, python-pillow, and xorg-x11-server), Debian (gst-plugins-bad1.0, libspreadsheet-parsexlsx-perl, mariadb-10.3, and slurm-wlm), Fedora (atril, dotnet8.0, gnutls, prometheus-podman-exporter, python-jinja2, sudo, and vips), Oracle (frr, kernel, php:8.1, python-urllib3, python3.9, rpm, sqlite, and tomcat), Slackware (pam), SUSE (cpio, rear23a, rear27a, sevctl, and xorg-x11-server), and Ubuntu (exim4 and firefox). --------------------------------------------- https://lwn.net/Articles/959882/ ∗∗∗ Vulnerabilities in WatchGuard, Panda Security Products Lead to Code Execution ∗∗∗ --------------------------------------------- Two memory safety vulnerabilities in WatchGuard and Panda Security products could lead to code execution with System privileges. --------------------------------------------- https://www.securityweek.com/vulnerabilities-in-watchguard-panda-security-p… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Trumpf: Multiple products contain WIBU CodeMeter vulnerabilities ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-001/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 26.01.2024
by Daily end-of-shift report 26 Jan '24

26 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 25-01-2024 18:00 − Freitag 26-01-2024 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Über Push-Benachrichtigungen: Prominente iOS-Apps spähen heimlich Gerätedaten aus ∗∗∗ --------------------------------------------- Zu den Datensammlern zählen wohl iOS-Apps namhafter Onlinedienste wie Tiktok, Facebook, Instagram, Threads, Linkedin, Bing und X. --------------------------------------------- https://www.golem.de/news/ueber-push-benachrichtigungen-prominente-ios-apps… ∗∗∗ MFA war inaktiv: Microsoft deckt auf, wie Hacker an interne Mails kamen ∗∗∗ --------------------------------------------- Die Angreifer haben laut Microsoft zuerst einen Testaccount mit inaktiver MFA infiltriert - unter Einsatz einer Proxy-Infrastruktur. --------------------------------------------- https://www.golem.de/news/mfa-war-inaktiv-microsoft-deckt-auf-wie-hacker-an… ∗∗∗ Präparierte URL kann für Juniper-Firewalls und Switches gefährlich werden ∗∗∗ --------------------------------------------- Entwickler von Juniper haben in Junos OS mehrere Sicherheitslücken geschlossen. Noch sind aber nicht alle Updates verfügbar. --------------------------------------------- https://www.heise.de/-9609333.html ∗∗∗ Verwirrend: Internet-Domain fritz.box zeigt NFT-Galerie statt Router-Verwaltung ∗∗∗ --------------------------------------------- Bereits vor einer Woche haben Unbekannte die Domain "fritz.box" für sich registriert. Ihr Vorhaben ist unklar, Fritz-Besitzer sollten sich vorsehen. --------------------------------------------- https://www.heise.de/-9610149.html ∗∗∗ Blackwood hackers hijack WPS Office update to install malware ∗∗∗ --------------------------------------------- A previously unknown advanced threat actor tracked as Blackwood is using sophisticated malware called NSPX30 in cyberespionage attacks against companies and individuals. --------------------------------------------- https://www.bleepingcomputer.com/news/security/blackwood-hackers-hijack-wps… ∗∗∗ Midnight Blizzard: Guidance for responders on nation-state attack ∗∗∗ --------------------------------------------- The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-… ∗∗∗ A Batch File With Multiple Payloads, (Fri, Jan 26th) ∗∗∗ --------------------------------------------- Windows batch files (.bat) are often seen by people as very simple but they can be pretty complex or.. contain interesting encoded payloads! I found one that contains multiple payloads decoded and used by a Powershell process. The magic is behind how comments can be added to such files. --------------------------------------------- https://isc.sans.edu/diary/rss/30592 ∗∗∗ Erbschaft per SMS: Ignorieren Sie diese betrügerische Nachricht ∗∗∗ --------------------------------------------- Immer wieder warnen wir vor E-Mails, in denen Betrüger:innen das große Geld versprechen: Millionengewinne, eine Spende oder eine Erbschaft sollen die Empfänger:innen plötzlich reich machen. Aktuell setzen Kriminelle jedoch nicht nur auf E-Mails, sondern auch auf SMS, um mit potenziellen Opfern in Kontakt zu treten. Danach läuft die Masche wie gewohnt ab: Mit Angeboten, die zu schön sind, um wahr zu sein, werden gutgläubige Opfer um ihr Geld gebracht. --------------------------------------------- https://www.watchlist-internet.at/news/erbschaft-per-sms-ignorieren-sie-die… ∗∗∗ Assessing and mitigating supply chain cybersecurity risks ∗∗∗ --------------------------------------------- Blindly trusting your partners and suppliers on their security posture is not sustainable – it’s time to take control through effective supplier risk management --------------------------------------------- https://www.welivesecurity.com/en/business-security/assessing-mitigating-cy… ∗∗∗ Cybersecurity for Industrial Control Systems: Best practices ∗∗∗ --------------------------------------------- Network segmentation, software patching, and continual threats monitoring are key cybersecurity best practices for Industrial Control Systems (ICS). --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/cybersecurity-for-i… ∗∗∗ Guidance: Assembling a Group of Products for SBOM ∗∗∗ --------------------------------------------- Today, CISA published Guidance on Assembling a Group of Products created by the Software Bill of Materials (SBOM) Tooling & Implementation Working Group, one of the five SBOM community-driven workstreams facilitated by CISA. CISA’s community-driven working groups publish documents and reports to advance and refine SBOM and ultimately promote adoption. Specifically, software producers often need to assemble and test products together before releasing them to customers. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/26/guidance-assembling-grou… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco Unified Communications Products Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- Version 1.1 - Updated list of affected products and products confirmed not vulnerable. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Jenkins CLI PoC CVE-2024-23897 ∗∗∗ --------------------------------------------- Remote Code Execution: Jenkins CLI arbitrary read (CVE-2024-23897 applies to versions below 2.442 and LTS 2.426.3) --------------------------------------------- https://github.com/gquere/pwn_jenkins/blob/master/README.md#jenkins-cli-arb… ∗∗∗ Microsoft Edge 121 unterstützt moderne Codecs und stopft Sicherheitslecks ∗∗∗ --------------------------------------------- Microsoft hat den Webbrowser Edge in Version 121 herausgegeben. Sie stopft eine kritische Sicherheitslücke und liefert Support für AV1-Videos. --------------------------------------------- https://www.heise.de/-9609475.html ∗∗∗ Diesmal bitte patchen: Security-Update behebt kritische Schwachstelle in GitLab ∗∗∗ --------------------------------------------- GitLab 16.x enthält fünf Schwachstellen, von denen eine als kritisch eingestuft ist. Patchen ist nicht selbstverständlich, wie jüngst eine Untersuchung zeigte. --------------------------------------------- https://www.heise.de/-9609319.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (xorg-server), Fedora (chromium, dotnet8.0, firefox, freeipa, and thunderbird), Red Hat (avahi, c-ares, curl, edk2, expat, freetype, frr, git, gnutls, grub2, kernel, kernel-rt, libcap, libfastjson, libssh, libtasn1, libxml2, linux-firmware, ncurses, oniguruma, openssh, openssl, perl-HTTP-Tiny, protobuf-c, python-urllib3, python3, python3.9, rpm, samba, shadow-utils, sqlite, tcpdump, tomcat, and virt:rhel and virt-devel:rhel modules), SUSE (cpio, jasper, rear23a, thunderbird, and xorg-x11-server), and Ubuntu (jinja2, kernel, linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency-hwe-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-hwe-6.5, linux-laptop, linux-lowlatency, linux-lowlatency-hwe-6.5, linux-oem-6.5, linux-oracle, linux-raspi, linux-starfive, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-aws, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-oem-6.1, and mariadb, mariadb-10.3, mariadb-10.6). --------------------------------------------- https://lwn.net/Articles/959640/ ∗∗∗ 2024-01 Reference Advisory: Junos OS and Junos OS Evolved: Impact of Terrapin SSH Attack (CVE-2023-48795) ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Reference-Advisory-Juno… ∗∗∗ 2024-01 Out-of-Cycle Security Bulletin: Junos OS: SRX Series and EX Series: Multiple vulnerabilities in J-Web have been addressed ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2024-01-Out-of-Cycle-Security-B… ∗∗∗ Security Vulnerabilities fixed in Focus for iOS 122 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-03/ ∗∗∗ Open redirect in parameter might affect IBM Storage Defender Data Protect. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7106918 ∗∗∗ AIX is vulnerable to a denial of service (CVE-2023-5678, CVE-2023-6129, CVE-2023-6237) and an attacker may obtain sensitive information (CVE-2023-5363) due to OpenSSL ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7111837 ∗∗∗ IBM Sterling Connect:Direct for UNIX is vulnerable to multiple issues due to Eclipse Jetty. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7111880 ∗∗∗ Vulnerabilities in GNU Binutils, Bootstrap, PortSmash, Node.js, and libarchive might affect IBM Storage Defender Data Protect. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7091980 ∗∗∗ Multiple vulnerabilities in IBM Semeru Runtime may affect IBM Decision Optimization for IBM Cloud Pak for Data (CVE-2023-22006, CVE-2023-22036 & CVE-2023-22049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7112089 ∗∗∗ IBM Security Directory Integrator affected by multiple vulnerabilities affecting IBM Java SDK ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7047118 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.01.2024
by Daily end-of-shift report 25 Jan '24

25 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 24-01-2024 18:00 − Donnerstag 25-01-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits ∗∗∗ --------------------------------------------- A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. --------------------------------------------- https://thehackernews.com/2024/01/new-cherryloader-malware-mimics.html ∗∗∗ SystemBC Malwares C2 Server Analysis Exposes Payload Delivery Tricks ∗∗∗ --------------------------------------------- Cybersecurity researchers have shed light on the command-and-control (C2) server of a known malware family called SystemBC. --------------------------------------------- https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html ∗∗∗ Memory Scanning for the Masses ∗∗∗ --------------------------------------------- In this blog post we will go into a user-friendly memory scanning Python library that was created out of the necessity of having more control during memory scanning. --------------------------------------------- https://research.nccgroup.com/2024/01/25/memory-scanning-for-the-masses/ ∗∗∗ ADCS Attack Paths in BloodHound — Part 1 ∗∗∗ --------------------------------------------- This blog post details the ESC1 domain escalation requirements and explains how BloodHound incorporates the relevant components. --------------------------------------------- https://posts.specterops.io/adcs-attack-paths-in-bloodhound-part-1-799f3d3b… ∗∗∗ CERT.at/GovCERT Austria PGP Teamkey Rotation ∗∗∗ --------------------------------------------- Da diese in einem Monat ablaufen, haben wir gestern neue PGP Keys für team(a)cert.at, reports(a)cert.at, team(a)govcert.gv.at sowie reports(a)govcert.gv.at generiert und ausgerollt. --------------------------------------------- https://cert.at/de/aktuelles/2024/1/certatgovcert-austria-pgp-teamkey-rotat… ∗∗∗ Ablauf einer Schwachstellen-Information durch CERT.at am Beispiel Ivanti Connect Secure VPN (CVE-2024-21887, CVE-2023-46805) ∗∗∗ --------------------------------------------- Nach der Veröffentlichung begann nun der normale Prozess für CERTs weltweit, ebenso natürlich für CERT.at ... die Verbreitung der Information über die Schwachstellen vorzubreiten beziehungsweise zu finalisieren. Die CERTs veröffentlichten und sendeten ihre Warnung aus. Unsere Warnung, die laufend aktualisiert wird, wurde Donnerstag 11.01.24 gegen Mittag ins Netz gestellt, über den freien RSS-Feed für Abonnenten zugänglich gemacht und ausgesandt. --------------------------------------------- https://cert.at/de/blog/2024/1/ablauf-einer-schwachstellen-information-durc… ===================== = Vulnerabilities = ===================== ∗∗∗ Konfigurationsfehler: Unzählige Kubernetes-Cluster sind potenziell angreifbar ∗∗∗ --------------------------------------------- Viele Nutzer räumen der Gruppe system:authenticated ihres GKE-Clusters aufgrund einer Fehlannahme zu viele Rechte ein - mit gravierenden Folgen. --------------------------------------------- https://www.golem.de/news/konfigurationsfehler-unzaehlige-kubernetes-cluste… ∗∗∗ Trend Micro Apex Central: Update schließt im zweiten Anlauf Sicherheitslücken ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in Trend Micros Apex Central ermöglichen Angreifern etwa, Schadcode einzuschleusen. Ein erstes Update machte Probleme. --------------------------------------------- https://www.heise.de/news/Trend-Micro-Apex-Central-Update-schliesst-im-zwei… ∗∗∗ Tausende Gitlab-Server noch für Zero-Click-Kontoklau anfällig ∗∗∗ --------------------------------------------- IT-Forscher haben das Netz durchforstet und dabei mehr als 5000 verwundbare Gitlab-Server gefunden. Angreifer können dort einfach Konten übernehmen. --------------------------------------------- https://www.heise.de/news/Tausende-Gitlab-Server-noch-fuer-Zero-Click-Konto… ∗∗∗ Cisco: Lücke erlaubt komplette Übernahme von Unified Communication-Produkten ∗∗∗ --------------------------------------------- Cisco warnt vor einer kritischen Lücke in Unified Communication-Produkten, durch die Angreifer die Kontrolle übernehmen können. --------------------------------------------- https://www.heise.de/news/Cisco-Luecke-erlauben-komplette-Uebernahme-von-Un… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, firefox-esr, php-phpseclib, phpseclib, thunderbird, and zabbix), Fedora (dotnet7.0, firefox, fonttools, and python-jinja2), Mageia (avahi and chromium-browser-stable), Oracle (java-1.8.0-openjdk, java-11-openjdk, LibRaw, openssl, and python-pillow), Red Hat (gnutls, kpatch-patch, php:8.1, and squid:4), SUSE (apache-parent, apache-sshd, bluez, cacti, cacti-spine, erlang, firefox, java-11-openjdk, opera, python-Pillow, tomcat, tomcat10, [...] --------------------------------------------- https://lwn.net/Articles/959455/ ∗∗∗ Potentielle Remote Code Execution in Jenkins - Patch verfügbar ∗∗∗ --------------------------------------------- Mit der neuesten Version der CI/CD-Plattform Jenkins haben die Entwickler:innen neun Sicherheitslücken behoben - darunter befindet sich auch eine kritische Schwachstelle, CVE-2024-23987. --------------------------------------------- https://cert.at/de/aktuelles/2024/1/potentielle-remote-code-execution-in-je… ∗∗∗ Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-006 ∗∗∗ Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-005 ∗∗∗ Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-004 ∗∗∗ Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2024-003 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Publish SBA-ADV-20200707-02: CloudLinux CageFS Insufficiently Restric… ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/fd86295907334f9cd81d8c1a7f… ∗∗∗ Publish SBA-ADV-20200707-01: CloudLinux CageFS Token Disclosure ∗∗∗ --------------------------------------------- https://github.com/sbaresearch/advisories/commit/c2db0b1da76486e2876f1c64f9… ∗∗∗ SystemK NVR 504/508/516 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.01.2024
by Daily end-of-shift report 24 Jan '24

24 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Dienstag 23-01-2024 18:00 − Mittwoch 24-01-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Firefox: Passkey-Unterstützung und Sicherheitsfixes ∗∗∗ --------------------------------------------- Die Version 122 von Firefox kann mit Passkeys umgehen. Außerdem schließen die Entwickler darin wie in Firefox ESR und Thunderbird 115.7 Sicherheitslecks. --------------------------------------------- https://www.heise.de/-9606909 ∗∗∗ "Mother of all Breaches": 26 Milliarden altbekannte Datensätze ∗∗∗ --------------------------------------------- Was die Entdecker als "Mutter aller Lücken" bezeichnen, entpuppt sich laut dem "Have I Been Pwned"- Gründer Troy Hunt als Sammlung längst bekannter Daten. --------------------------------------------- https://www.heise.de/-9604882 ∗∗∗ Trello API abused to link email addresses to 15 million accounts ∗∗∗ --------------------------------------------- An exposed Trello API allows linking private email addresses with Trello accounts, enabling the creation of millions of data profiles containing both public and private information. --------------------------------------------- https://www.bleepingcomputer.com/news/security/trello-api-abused-to-link-em… ∗∗∗ Cybercrime’s Silent Operator: The Unraveling of VexTrio’s Malicious Network Empire ∗∗∗ --------------------------------------------- VexTrio is a massive and complex malicious TDS (traffic direction system) organization. It has a network of more than 60 affiliates that divert traffic into VexTrio, while it also operates its own TDS network. While aspects of the operation have been discovered and analyzed by different researchers, the core network has remained largely unknown. --------------------------------------------- https://www.securityweek.com/cybercrimes-silent-operator-the-unraveling-of-… ∗∗∗ Orca Flags Dangerous Google Kubernetes Engine Misconfiguration ∗∗∗ --------------------------------------------- A misconfiguration in Google Kubernetes Engine (GKE) could allow attackers to take over Kubernetes clusters and access sensitive information, according to a warning from cloud security startup Orca Security. The issue is related to the privileges granted to users in the system:authenticated group, which includes all users with a Google account, although it could be mistakenly believed to include only verified identities. --------------------------------------------- https://www.securityweek.com/orca-flags-dangerous-google-kubernetes-engine-… ∗∗∗ PC- und Online-Gamer:innen: Vorsicht beim Account-Handel über Marktplätze! ∗∗∗ --------------------------------------------- Aktuell erreichen uns immer wieder Meldungen zu betrügerischen Angeboten im Gaming-Bereich auf Marktplätzen wie difmark.com oder in diversen Internet-Foren. Kriminelle bieten dort unter anderem Gaming-Accounts und Nutzungsprofile an. Das Problem: Diese dürften laut Nutzungsbedingungen eigentlich gar nicht verkauft werden und Sperren sind möglich. Auch nach erfolgreichen Käufen lauern noch Fallen, durch die Spielende plötzlich durch die Finger schauen können. --------------------------------------------- https://www.watchlist-internet.at/news/pc-und-online-gamerinnen-vorsicht-be… ∗∗∗ Update #3: Kritische Sicherheitslücken in Ivanti Connect Secure und Ivanti Policy Secure - aktiv ausgenützt ∗∗∗ --------------------------------------------- Update #3: 24. Jänner 2024: Mandiant und Volexity berichten davon, Exploits gegen diese Sicherheitslücken bereits Anfang Dezember 2023 beobachtet zu haben. Es empfiehlt sich daher, gegebenenfalls den Zeitraum etwaiger Untersuchungen auf stattgefundene Angriffsversuche zumindest bis inklusive Dezember 2023 auszudehnen. --------------------------------------------- https://cert.at/de/warnungen/2024/1/kritische-sicherheitslucken-in-ivanti-c… ===================== = Vulnerabilities = ===================== ∗∗∗ Fortra GoAnywhere MFT: Kritische Lücke macht Angreifer zu Admins ∗∗∗ --------------------------------------------- Jetzt patchen! Es ist Exploitcode für die Dateiübertragungslösung Fortra GoAnywhere MFT in Umlauf. --------------------------------------------- https://www.heise.de/-9606659 ∗∗∗ Codeschmuggel-Lücke in HPE Oneview ∗∗∗ --------------------------------------------- Mehrere Sicherheitslücken in der IT-Infrastrukturverwaltung HPE Oneview ermöglichen Angreifern, etwa Schadcode einzuschleusen. Updates stehen bereit. --------------------------------------------- https://www.heise.de/-9607490 ∗∗∗ Chrome-Update dichtet 17 Sicherheitslecks ab ∗∗∗ --------------------------------------------- Googles Entwickler aktualisieren den Chrome-Webbrowser und schließen 17 Sicherheitslücken darin. Einige ermöglichen wohl Codeschmuggel. --------------------------------------------- https://www.heise.de/-9606618 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jinja2, openjdk-11, ruby-httparty, and xorg-server), Fedora (ansible-core and mingw-jasper), Gentoo (GOCR, Ruby, and sudo), Oracle (gstreamer-plugins-bad-free, java-17-openjdk, java-21-openjdk, python-cryptography, and xorg-x11-server), Red Hat (kernel, kernel-rt, kpatch-patch, LibRaw, python-pillow, and python-pip), Slackware (mozilla), SUSE (python-Pillow, rear118a, and redis7), and Ubuntu (libapache-session-ldap-perl and pycryptodome). --------------------------------------------- https://lwn.net/Articles/959325/ ∗∗∗ Cisco Unified Communications Products Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. CVE-2024-20253, CVSS Score: Base 9.9 --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Unity Connection Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Small Business Series Switches Stacked Reload ACL Bypass Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ High Severity Arbitrary File Upload Vulnerability Patched in File Manager Pro WordPress Plugin ∗∗∗ --------------------------------------------- https://www.wordfence.com/blog/2024/01/high-severity-arbitrary-file-upload-… ∗∗∗ APsystems Energy Communication Unit (ECU-C) Power Control Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-01 ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2024/01/24/cisa-adds-one-known-expl… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.01.2024
by Daily end-of-shift report 23 Jan '24

23 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Montag 22-01-2024 18:00 − Dienstag 23-01-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries ∗∗∗ --------------------------------------------- Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. --------------------------------------------- https://thehackernews.com/2024/01/hackers-hijack-popular-java-and-android.h… ∗∗∗ Cactus Ransomware malware analysis ∗∗∗ --------------------------------------------- On January 20th the Cactus ransomware group attacked a number of victims across varying industries. The attacks were disclosed on their leak site with the accompanying victim data. --------------------------------------------- https://www.shadowstackre.com/analysis/cactus ∗∗∗ Vorsicht vor Peek & Cloppenburg Fake-Shops ∗∗∗ --------------------------------------------- Auf Facebook und Instagram werden gefälschte Angebote vom Modehaus „Peek & Cloppenburg“ beworben. In den gefälschten Werbeanzeigen werden Rabatte bis zu 90 % versprochen. Wenn Sie auf die Anzeige klicken, landen Sie in einem betrügerischen Shop, mit einer glaubwürdigen Internetadresse: „peek-cloppenburgsale.shop“. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-peek-cloppenburg-fake-s… ∗∗∗ Threat Assessment: BianLian ∗∗∗ --------------------------------------------- We analyze the extremely active ransomware group BianLian. Mostly targeting healthcare, they have moved from double-extortion to extortion without encryption. --------------------------------------------- https://unit42.paloaltonetworks.com/bianlian-ransomware-group-threat-assess… ∗∗∗ Conditional QR Code Routing Attacks ∗∗∗ --------------------------------------------- Over the summer, we saw a somewhat unexpected rise in QR-code based phishing attacks. These attacks were all fairly similar. The main goal was to induce the end-user to scan the QR Code, where they would be redirected to a credential harvesting page. --------------------------------------------- https://blog.checkpoint.com/harmony-email/conditional-qr-code-routing-attac… ∗∗∗ Lazarus Group Uses the DLL Side-Loading Technique (2) ∗∗∗ --------------------------------------------- Through the “Lazarus Group Uses the DLL Side-Loading Technique” [1] blog post, AhnLab SEcurity intelligence Center(ASEC) has previously covered how the Lazarus group used the DLL side-loading attack technique using legitimate applications in the initial access stage to achieve the next stage of their attack process. --------------------------------------------- https://asec.ahnlab.com/en/60792/ ∗∗∗ Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver ∗∗∗ --------------------------------------------- In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware. --------------------------------------------- https://www.trendmicro.com/en_us/research/24/a/kasseika-ransomware-deploys-… ===================== = Vulnerabilities = ===================== ∗∗∗ Fortra warns of new critical GoAnywhere MFT auth bypass, patch now ∗∗∗ --------------------------------------------- Fortra is warning of a new authentication bypass vulnerability impacting GoAnywhere MFT (Managed File Transfer) versions before 7.4.1 that allows an attacker to create a new admin user. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fortra-warns-of-new-critical… ∗∗∗ Exploiting 0-click Android Bluetooth vulnerability to inject keystrokes without pairing ∗∗∗ --------------------------------------------- A recently discovered critical vulnerabilities (CVE-2023-45866, CVE-2024-21306) in Bluetooth can be exploited to inject keystrokes without user confirmation – by accepting any Bluetooth pairing request. --------------------------------------------- https://www.mobile-hacker.com/2024/01/23/exploiting-0-click-android-bluetoo… ∗∗∗ Sicherheitsfixes: Apple aktualisiert ältere Systeme – und räumt Zero Days ein ∗∗∗ --------------------------------------------- Apple hat neben macOS 14.3 und iOS 17.3 auch neue Versionen von iOS 15, 16, macOS 12 und 13 sowie Safari veröffentlicht. Es gab einen erneuten Zero-Day-Exploit. --------------------------------------------- https://www.heise.de/news/Sicherheitsfixes-Apple-aktualisiert-aeltere-Syste… ∗∗∗ Konfigurationsübertragung kann Behelfslösung zum Schutz von Ivanti ICS aufheben ∗∗∗ --------------------------------------------- Bislang können Admins Ivanti Connect Secure und Policy Secure nur über einen Workaround vor laufenden Attacken schützen. Dieser funktioniert aber nicht immer. --------------------------------------------- https://www.heise.de/news/Konfigurationsuebertragung-kann-Behelfsloesung-zu… ∗∗∗ Barracuda WAF: Kritische Sicherherheitslücken ermöglichen Umgehung des Schutzes ∗∗∗ --------------------------------------------- Barracuda hat einen Sicherheitshinweis bezüglich der Web Application Firewall veröffentlicht. Sicherheitslücken ermöglichen das Umgehen des Schutzes. --------------------------------------------- https://www.heise.de/news/Barracuda-WAF-Kritische-Sicherherheitsluecken-erm… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (kodi and squid), Fedora (ansible-core, java-latest-openjdk, mingw-python-jinja2, openssh, and pgadmin4), Gentoo (Apache XML-RPC), Red Hat (gnutls and xorg-x11-server), Slackware (postfix), SUSE (bluez and openssl-3), and Ubuntu (gnutls28, libssh, and squid). --------------------------------------------- https://lwn.net/Articles/959127/ ∗∗∗ Splunk Security Advisories 2024-01-22 ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ XSA-448 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-448.html ∗∗∗ Security Vulnerabilities fixed in Thunderbird 115.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-04/ ∗∗∗ Security Vulnerabilities fixed in Firefox ESR 115.7 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-02/ ∗∗∗ Security Vulnerabilities fixed in Firefox 122 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2024-01/ ∗∗∗ TRUMPF: Oseon contains vulnerable version of OpenSSL 1.1.x ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-006/ ∗∗∗ TRUMPF: Multiple products include a vulnerable version of Notepad++ ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-003/ ∗∗∗ TRUMPF: Multiple products contain vulnerable version of 7-zip ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-005/ ∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2023-46838 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX587605/citrix-hypervisor-security-bul… ∗∗∗ Crestron AM-300 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-02 ∗∗∗ Lantronix XPort ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-05 ∗∗∗ Voltronic Power ViewPower Pro ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-03 ∗∗∗ Orthanc Osimis DICOM Web Viewer ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-023-01 ∗∗∗ APsystems Energy Communication Unit (ECU-C) Power Control Software ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-01 ∗∗∗ Westermo Lynx 206-F2G ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.01.2024
by Daily end-of-shift report 22 Jan '24

22 Jan '24

===================== = End-of-Day report = ===================== Timeframe: Freitag 19-01-2024 18:00 − Montag 22-01-2024 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Cracked software beats gold: new macOS backdoor stealing cryptowallets ∗∗∗ --------------------------------------------- We review a new macOS backdoor that piggybacks on cracked software to replace Bitcoin and Exodus wallets with malware. --------------------------------------------- https://securelist.com/new-macos-backdoor-crypto-stealer/111778/ ∗∗∗ Apache ActiveMQ Flaw Exploited in New Godzilla Web Shell Attacks ∗∗∗ --------------------------------------------- Cybersecurity researchers are warning of a "notable increase" in threat actor activity actively exploiting a now-patched flaw in Apache ActiveMQ to deliver the Godzilla web shell on compromised hosts. --------------------------------------------- https://thehackernews.com/2024/01/apache-activemq-flaw-exploited-in-new.html ∗∗∗ Confluence: Kritische Sicherheitslücke in veralteten Versionen wird ausgenutzt ∗∗∗ --------------------------------------------- Wie das Shadowserver-Projekt auf Mastodon meldet, durchpflügen Angreifer derzeit von 600 verschiedenen IP-Adressen das Netz nach möglichen Opfern. Eine simple HTTP-POST-Anfrage genügt, um die Sicherheitslücke auszunutzen und den Confluence-Server zu übernehmen. [..] Der Hersteller wies seine Kunden bereits am vergangenen Dienstag auf die Sicherheitslücke hin, die er wie 27 weitere im Rahmen des Atlassian-Patchday behoben hat. --------------------------------------------- https://www.heise.de/-9605028 ∗∗∗ VMware vCenter Server seit Monaten über CVE-2023-3404 angegriffen; Attacken weiten sich aus ∗∗∗ --------------------------------------------- Inzwischen hat auch VMware bestätigt, dass eine im Oktober 2023 gepatchte vCenter Server-Sicherheitslücke jetzt aktiv ausgenutzt wird. vCenter Server ist die Management-Plattform für VMware vSphere-Umgebungen, die Administratoren bei der Verwaltung von ESX- und ESXi-Servern und virtuellen Maschinen (VMs) unterstützt. [..] Sicherheitsforscher von Mandiant haben in diesem Beitrag offen gelegt, dass die chinesische Spionage-Gruppe UNC3886 diese Schwachstelle CVE-2023-34048 längst kannte und diese seit mindestens Ende 2021 aktiv angegriffen habe. --------------------------------------------- https://www.borncity.com/blog/2024/01/22/vmware-vcenter-server-seit-monaten… ∗∗∗ NS-STEALER Uses Discord Bots to Exfiltrate Your Secrets from Popular Browsers ∗∗∗ --------------------------------------------- Cybersecurity researchers have discovered a new Java-based "sophisticated" information stealer that uses a Discord bot to exfiltrate sensitive data from compromised hosts. The malware, named NS-STEALER, is propagated via ZIP archives masquerading as cracked software, Trellix security researcher Gurumoorthi Ramanathan said in an analysis published last week. --------------------------------------------- https://thehackernews.com/2024/01/ns-stealer-uses-discord-bots-to.html ∗∗∗ Domain Escalation – Backup Operator ∗∗∗ --------------------------------------------- The Backup Operators is a Windows built-in group. Users which are part of this group have permissions to perform backup and restore operations. More specifically, these users have the SeBackupPrivilege assigned which enables them to read sensitive files from the domain controller i.e. Security Account Manager (SAM). --------------------------------------------- https://pentestlab.blog/2024/01/22/domain-escalation-backup-operator/ ∗∗∗ Vorsicht vor PayLife-E-Mails mit einem QR-Code ∗∗∗ --------------------------------------------- In einem gefälschten E-Mail werden Sie informiert, dass Ihre myPayLife App gesperrt ist. Angeblich können Sie keine Aufträge oder Internetzahlungen mehr freigeben. Um die Sperre aufzuheben, müssen Sie einen QR-Code scannen. Ignorieren Sie dieses E-Mail, es handelt sich um eine Phishing-Falle. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-paylife-e-mails-mit-ein… ∗∗∗ Parrot TDS: A Persistent and Evolving Malware Campaign ∗∗∗ --------------------------------------------- Traffic detection system Parrot has infected tens of thousands of websites worldwide. We outline the scripting evolution of this injection campaign and its scope. --------------------------------------------- https://unit42.paloaltonetworks.com/parrot-tds-javascript-evolution-analysi… ∗∗∗ Is the Google search bar enough to hack Belgian companies? ∗∗∗ --------------------------------------------- In this blog post, we will go over a technique called Google Dorking and demonstrate how it can be utilized to uncover severe security vulnerabilities in web applications hosted right here in Belgium, where NVISO was founded. --------------------------------------------- https://blog.nviso.eu/2024/01/22/is-the-google-search-bar-enough-to-hack-be… ∗∗∗ The Confusing History of F5 BIG-IP RCE Vulnerabilities ∗∗∗ --------------------------------------------- If you want to know way too much about attacks against F5 BIG-IP devices, then this is the blog for you! --------------------------------------------- https://www.greynoise.io/blog/the-confusing-history-of-f5-big-ip-rce-vulner… ===================== = Vulnerabilities = ===================== ∗∗∗ Gambio 4.9.2.0 - Insecure Deserialization ∗∗∗ --------------------------------------------- Gambio is software designed for running online shops. It provides various features and tools to help businesses manage their inventory, process orders, and handle customer interactions. According to their homepage, the software is used by more than 25.000 shops. Security Risk: Critical, CVE Number: Pending, Vendor Status: Not fixed --------------------------------------------- https://herolab.usd.de/security-advisories/usd-2023-0046/ ∗∗∗ Sicherheitsupdates: Schlupflöcher für Schadcode in Lexmark-Druckern geschlossen ∗∗∗ --------------------------------------------- Angreifer können an vielen Druckermodellen von Lexmark ansetzen, um Geräte zu kompromittieren. Derzeit soll es noch keine Attacken geben. --------------------------------------------- https://www.heise.de/-9604795 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (keystone and subunit), Fedora (dotnet6.0, golang, kernel, sos, and tigervnc), Mageia (erlang), Red Hat (openssl), SUSE (bluez, python-aiohttp, and seamonkey), and Ubuntu (postfix and xorg-server). --------------------------------------------- https://lwn.net/Articles/959006/ ∗∗∗ Critical Vulnerabilities Found in Open Source AI/ML Platforms ∗∗∗ --------------------------------------------- Security researchers flag multiple severe vulnerabilities in open source AI/ML solutions MLflow, ClearML, Hugging Face.The post Critical Vulnerabilities Found in Open Source AI/ML Platforms appeared first on SecurityWeek. --------------------------------------------- https://www.securityweek.com/critical-vulnerabilities-found-in-ai-ml-open-s… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ WAGO: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2024-007/ ∗∗∗ Spring: CVE-2024-22233: Spring Framework server Web DoS Vulnerability ∗∗∗ --------------------------------------------- https://spring.io/blog/2024/01/22/cve-2024-22233-spring-framework-server-we… ∗∗∗ Roundcube: Update 1.6.6 released ∗∗∗ --------------------------------------------- https://roundcube.net/news/2024/01/20/update-1.6.6-released -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily