- Daily - CERT.at

Tageszusammenfassung - 23.11.2023
by Daily end-of-shift report 23 Nov '23

23 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 22-11-2023 18:00 − Donnerstag 23-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Proof of Concept Exploit Publicly Available for Critical Windows SmartScreen Flaw ∗∗∗ --------------------------------------------- Threat actors were actively exploiting CVE-2023-36025 before Microsoft patched it in November. --------------------------------------------- https://www.darkreading.com/vulnerabilities-threats/proof-of-concept-exploi… ∗∗∗ Consumer cyberthreats: predictions for 2024 ∗∗∗ --------------------------------------------- Kaspersky experts review last years predictions on consumer cyberthreats and try to anticipate the trends for 2024. --------------------------------------------- https://securelist.com/kaspersky-security-bulletin-consumer-threats-2024/11… ∗∗∗ Mirai-based Botnet Exploiting Zero-Day Bugs in Routers and NVRs for Massive DDoS Attacks ∗∗∗ --------------------------------------------- An active malware campaign is leveraging two zero-day vulnerabilities with remote code execution (RCE) functionality to rope routers and video recorders into a Mirai-based distributed denial-of-service (DDoS) botnet. “The payload targets routers and network video recorder (NVR) devices with default admin credentials and installs Mirai variants when successful,” Akamai said in an advisory. --------------------------------------------- https://thehackernews.com/2023/11/mirai-based-botnet-exploiting-zero-day.ht… ∗∗∗ The Platform Matters: A Comparative Study on Linux and Windows Ransomware Attacks ∗∗∗ --------------------------------------------- During the last few months, we conducted a study of some of the top ransomware families (12 in total) that either directly developed ransomware for Linux systems or were developed in languages with a strong cross-platform component, such as Golang or Rust, thereby allowing them to be compiled for both Windows and Linux indiscriminately. Our main objectives were to increase our understanding of the main motivations for developing ransomware targeting Linux instead of Windows systems, which historically have been the main target until now. --------------------------------------------- https://research.checkpoint.com/2023/the-platform-matters-a-comparative-stu… ∗∗∗ Your voice is my password ∗∗∗ --------------------------------------------- AI-driven voice cloning can make things far too easy for scammers – I know because I’ve tested it so that you don’t have to learn about the risks the hard way. --------------------------------------------- https://www.welivesecurity.com/en/cybersecurity/your-voice-is-my-password/ ∗∗∗ Israel-Hamas War Spotlight: Shaking the Rust Off SysJoker ∗∗∗ --------------------------------------------- SysJoker, initially discovered by Intezer in 2021, is a multi-platform backdoor with multiple variants for Windows, Linux and Mac. The same malware was also analyzed in another report a few months after the original publication. Since then, SysJoker Windows variants have evolved enough to stay under the radar. --------------------------------------------- https://research.checkpoint.com/2023/israel-hamas-war-spotlight-shaking-the… ===================== = Vulnerabilities = ===================== ∗∗∗ Uninstall Key Caching in Fortra Digital Guardian Agent Uninstaller (CVE-2023-6253) ∗∗∗ --------------------------------------------- The Digital Guardian Management Console is vulnerable to a Stored Cross-Site Scripting attack in the PDF Template functionality. The vendor replied that this is an intended feature. The Digital Guardian Agent Uninstaller File also caches the Uninstall Key which can be extracted by an attacker and be used to terminate and uninstall the agent. --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/uninstall-key-caching-in… ∗∗∗ Sicherheitsschwachstellen in easySoft und easyE4 (SYSS-2023-007/-008/-009/-010) ∗∗∗ --------------------------------------------- In der Software „easySoft“ sowie dem Steuerrelais „easyE4“ der Eaton Industries GmbH wurden Schwachstellen gefunden. Diese ermöglichen sowohl das Extrahieren des Projektpassworts aus einer easySoft-Projektdatei als auch das Berechnen von Passwortkandidaten für easyE4-Programme, welche auf einer SD-Karte gespeichert sind. Darüber hinaus können auch Passwortkandidaten aus einem Netzwerkstream extrahiert werden, der z. B. während der Administration eines easyE4 aufgezeichnet wurde. --------------------------------------------- https://www.syss.de/pentest-blog/sicherheitsschwachstellen-in-easysoft-und-… ∗∗∗ ownCloud Security Advisories 2023-11-21 ∗∗∗ --------------------------------------------- ownCloud released 3 security advisories: 2x critical, 1x high --------------------------------------------- https://owncloud.com/security/https://owncloud.com/security/ ∗∗∗ Atlassian rüstet Jira Data Center and Server & Co. gegen mögliche Attacken ∗∗∗ --------------------------------------------- Es gibt wichtige Sicherheitsupdates für verschiedene Softwarelösungen von Atlassian. Es kann Schadcode auf Systeme gelangen. --------------------------------------------- https://www.heise.de/-9537138 ∗∗∗ Sicherheitsupdates in Foxit PDF Reader 2023.3 und Foxit PDF Editor 2023.3 verfügbar ∗∗∗ --------------------------------------------- https://www.foxit.com/de/support/security-bulletins.html ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.11.2023
by Daily end-of-shift report 22 Nov '23

22 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 21-11-2023 18:00 − Mittwoch 22-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ HrServ – Previously unknown web shell used in APT attack ∗∗∗ --------------------------------------------- In this report Kaspersky researchers provide an analysis of the previously unknown HrServ web shell, which exhibits both APT and crimeware features and has likely been active since 2021. --------------------------------------------- https://securelist.com/hrserv-apt-web-shell/111119/ ∗∗∗ ClearFake Campaign Expands to Deliver Atomic Stealer on Macs Systems ∗∗∗ --------------------------------------------- The macOS information stealer known as Atomic is now being delivered to target via a bogus web browser update chain tracked as ClearFake."This may very well be the first time we see one of the main social engineering campaigns, previously reserved for Windows, branch out not only in terms of geolocation but also operating system," Malwarebytes Jérôme Segura said in a Tuesday analysis. --------------------------------------------- https://thehackernews.com/2023/11/clearfake-campaign-expands-to-deliver.html ∗∗∗ Lumma malware can allegedly restore expired Google auth cookies ∗∗∗ --------------------------------------------- The Lumma information-stealer malware (aka LummaC2) is promoting a new feature that allegedly allows cybercriminals to restore expired Google cookies, which can be used to hijack Google accounts. [..] This new feature allegedly introduced in recent Lumma releases is yet to be verified by security researchers or Google, so whether or not it works as advertised remains uncertain. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lumma-malware-can-allegedly-… ∗∗∗ Windows Hello Fingerprint Authentication Bypassed on Popular Laptops ∗∗∗ --------------------------------------------- Researchers have tested the fingerprint sensors used for Windows Hello on three popular laptops and managed to bypass them. --------------------------------------------- https://www.securityweek.com/windows-hello-fingerprint-authentication-bypas… ∗∗∗ „Ich möchte meine Bankdaten ändern“: Dieses Mail an die Personalabteilung könnte Betrug sein ∗∗∗ --------------------------------------------- Kriminelle geben sich als Mitarbeiter:innen Ihres Unternehmens aus und bitten um Änderung Ihrer Bankdaten für die Gehaltsüberweisung. Wird das E-Mail nicht als Fake erkannt, wird das Gehalt der jeweiligen Mitarbeiter:innen auf das Bankkonto von Kriminellen überwiesen. Wir zeigen Ihnen, woher Kriminelle die Daten kennen und wie Sie sich schützen. --------------------------------------------- https://www.watchlist-internet.at/news/ich-moechte-meine-bankdaten-aendern-… ∗∗∗ The Ticking Supply Chain Attack Bomb of Exposed Kubernetes Secrets ∗∗∗ --------------------------------------------- Exposed Kubernetes secrets pose a critical threat of supply chain attack. Aqua Nautilus researchers found that the exposed Kubernetes secrets of hundreds of organizations and open-source projects allow access to sensitive environments in the Software Development Life Cycle (SDLC) and open a severe supply chain attack threat. Among the companies were SAP’s Artifacts management system with over 95 million, two top blockchain companies, and various other fortune-500 companies. --------------------------------------------- https://blog.aquasec.com/the-ticking-supply-chain-attack-bomb-of-exposed-ku… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Vulnerabilities in m-privacy TightGate-Pro ∗∗∗ --------------------------------------------- There are several vulnerabilities in the server which enables attackers to view the VNC sessions of other users, infect the VNC session with keyloggers and start internal phishing attacks. Additionally, a TightGate-Pro administrator can push malicious PDFs to the endpoint of the user. Furthermore, the update servers which are only reachable via an SSH-tunnel are severely outdated (2003). CVEs: CVE-2023-47250, CVE-2023-47251 --------------------------------------------- https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities… ∗∗∗ Several Critical Vulnerabilities including Privilege Escalation, Authentication Bypass, and More Patched in UserPro WordPress Plugin ∗∗∗ --------------------------------------------- On May 1, 2023, the Wordfence Threat Intelligence team began the responsible disclosure process for multiple high and critical severity vulnerabilities we discovered in Kirotech’s UserPro plugin, which is actively installed on more than 20,000 WordPress websites [..] We made an initial attempt to contact Kirotech, the vendor of UserPro, on May 1, 2023, but we did not receive a response until May 10, 2023, after many additional attempts. After providing full disclosure details, the developer released the first patch on July 27, 2023, and the final patch on October 31, 2023. --------------------------------------------- https://www.wordfence.com/blog/2023/11/several-critical-vulnerabilities-inc… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gimp), Fedora (audiofile and firefox), Mageia (postgresql), Red Hat (binutils, c-ares, fence-agents, glibc, kernel, kernel-rt, kpatch-patch, libcap, libqb, linux-firmware, ncurses, pixman, python-setuptools, samba, and tigervnc), Slackware (kernel and mozilla), SUSE (apache2-mod_jk, avahi, container-suseconnect, java-1_8_0-openjdk, libxml2, openssl-1_0_0, openssl-1_1, openvswitch, python3-setuptools, strongswan, ucode-intel, and util-linux), and Ubuntu (frr, gnutls28, hibagent, linux, linux-aws, linux-aws-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-bluefield, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-raspi, linux-starfive, linux, linux-aws, linux-aws-hwe, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-laptop, linux-lowlatency, linux-oem-6.5, linux-oracle, linux-raspi, linux-starfive, linux-oem-6.1, mosquitto, rabbitmq-server, squid, and tracker-miners). --------------------------------------------- https://lwn.net/Articles/952312/ ∗∗∗ Mozilla Releases Security Updates for Firefox and Thunderbird ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/22/mozilla-releases-securit… ∗∗∗ Fix for BIRT Report Engine that is vulnerable due to nested jtidy.jar r938 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7081112 ∗∗∗ Vulnerability in Apache HTTP Server affects IBM HTTP Server used by IBM Rational ClearQuest ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7081354 ∗∗∗ IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7081403 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.11.2023
by Daily end-of-shift report 21 Nov '23

21 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Montag 20-11-2023 18:00 − Dienstag 21-11-2023 18:00 Handler: Robert Waldner Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Kinsing Hackers Exploit Apache ActiveMQ Vulnerability to Deploy Linux Rootkits ∗∗∗ --------------------------------------------- The Kinsing threat actors are actively exploiting a critical security flaw in vulnerable Apache ActiveMQ servers to infect Linux systems with cryptocurrency miners and rootkits."Once Kinsing infects a system, it deploys a cryptocurrency mining script that exploits the hosts resources to mine cryptocurrencies like Bitcoin, [..] --------------------------------------------- https://thehackernews.com/2023/11/kinsing-hackers-exploit-apache-activemq.h… ∗∗∗ How Multi-Stage Phishing Attacks Exploit QRs, CAPTCHAs, and Steganography ∗∗∗ --------------------------------------------- Phishing attacks are steadily becoming more sophisticated, with cybercriminals investing in new ways of deceiving victims into revealing sensitive information or installing malicious software. One of the latest trends in phishing is the use of QR codes, CAPTCHAs, and steganography. See how they are carried out and learn to detect them. --------------------------------------------- https://thehackernews.com/2023/11/how-multi-stage-phishing-attacks.html ∗∗∗ Gefälschte Zeitungsartikel bewerben betrügerische Investment-Angebote ∗∗∗ --------------------------------------------- Kriminelle fälschen Webseiten von Medien wie oe24 und ORF und füllen diese mit Fake-News. In den gefälschten Artikeln wird eine Möglichkeit beworben, wie man schnell reich wird. Angeblich geben Christoph Grissemann, Miriam Weichselbraun oder Armin Assinger Investitionstipps und erklären, dass jeder Mensch mit nur 250 Euro in wenigen Monaten eine Million machen kann. --------------------------------------------- https://www.watchlist-internet.at/news/gefaelschte-zeitungsartikel-bewerben… ∗∗∗ CISA, FBI, MS-ISAC, and ASD’s ACSC Release Advisory on LockBit Affiliates Exploiting Citrix Bleed ∗∗∗ --------------------------------------------- Today, the (CISA), (FBI), (MS-ISAC), and Australian (ASD’s ACSC) released a joint Cybersecurity Advisory (CSA), #StopRansomware: LockBit Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability (along with an accompanying analysis report MAR-10478915-1.v1 Citrix Bleed), in response to LockBit 3.0 ransomware affiliates and multiple threat actor groups exploiting CVE-2023-4966. Labeled Citrix Bleed, the vulnerability affects Citrix’s NetScaler web application delivery control (ADC) and NetScaler Gateway appliances. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/21/cisa-fbi-ms-isac-and-asd… ===================== = Vulnerabilities = ===================== ∗∗∗ Technical Advisory: Adobe ColdFusion WDDX Deserialization Gadgets ∗∗∗ --------------------------------------------- Multiple vulnerabilities identified in Adobe ColdFusion allow an unauthenticated attacker to obtain the service account NTLM password hash, verify the existence of a file or directory on the underlying operating system, and configure central config server settings. CVE Identifiers: CVE-2023-44353, CVE-2023-29300, CVE-2023-38203, CVE-2023-38204 --------------------------------------------- https://research.nccgroup.com/2023/11/21/technical-advisory-adobe-coldfusio… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (activemq, strongswan, and wordpress), Mageia (u-boot), SUSE (avahi, frr, libreoffice, nghttp2, openssl, openssl1, postgresql, postgresql15, postgresql16, python-Twisted, ucode-intel, and xen), and Ubuntu (avahi, hibagent, nodejs, strongswan, tang, and webkit2gtk). --------------------------------------------- https://lwn.net/Articles/952088/ ∗∗∗ Synology-SA-23:16 SRM (PWN2OWN 2023) ∗∗∗ --------------------------------------------- The vulnerabilities allow man-in-the-middle attackers to execute arbitrary code or access intranet resources via a susceptible version of Synology Router Manager (SRM).A vulnerability reported by PWN2OWN 2023 has been addressed. --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_23_16 ∗∗∗ [nextcloud]: Server-Side Request Forgery (SSRF) in Mail app ∗∗∗ --------------------------------------------- An attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4… ∗∗∗ [nextcloud]: DNS pin middleware can be tricked into DNS rebinding allowing SSRF ∗∗∗ --------------------------------------------- The DNS pin middleware was vulnerable to DNS rebinding allowing an attacker to perform SSRF as a final result. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8… ∗∗∗ [nextcloud]: user_ldap app logs user passwords in the log file on level debug ∗∗∗ --------------------------------------------- When the log level was set to debug the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3… ∗∗∗ [nextcloud]: Can enable/disable birthday calendar for any user ∗∗∗ --------------------------------------------- An attacker could enable and disable the birthday calendar for any user on the same server. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8… ∗∗∗ [nextcloud]: Admins can change authentication details of user configured external storage ∗∗∗ --------------------------------------------- It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2… ∗∗∗ [nextcloud]: Self XSS when pasting HTML into Text app with Ctrl+Shift+V ∗∗∗ --------------------------------------------- When a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p… ∗∗∗ [nextcloud]: HTML injection in search UI when selecting a circle with HTML in the display name ∗∗∗ --------------------------------------------- An attacker could insert links into circles name that would be opened when clicking the circle name in a search filter. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w… ∗∗∗ [nextcloud]: Users can make external storage mount points inaccessible for other users ∗∗∗ --------------------------------------------- A malicious user could update any personal or global external storage, making them inaccessible for everyone else as well. --------------------------------------------- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-f… ∗∗∗ Zyxel security advisory for out-of-bounds write vulnerability in SecuExtender SSL VPN Client software ∗∗∗ --------------------------------------------- The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software could allow a local authenticated user to gain a privilege escalation by sending a crafted CREATE message. --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… ∗∗∗ WAGO: Remote Code execution vulnerability in managed Switches ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-037/ ∗∗∗ PHOENIX CONTACT: WIBU-SYSTEMS CodeMeter Runtime vulnerabilities in multiple products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-062/ ∗∗∗ Multiple vulnerabilities on [Bosch Rexroth] ctrlX HMI / WR21 ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-175607.html ∗∗∗ IBM Sterling B2B Integrator is affected by vulnerability in JDOM (CVE-2021-33813) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080105 ∗∗∗ IBM Sterling B2B Integrator dashboard is vulnerable to cross-site request forgery (CVE-2022-35638) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080104 ∗∗∗ IBM Sterling B2B Integrator affected by FasterXML Jackson-data vulnerabilities (CVE-2022-42003, CVE-2022-42004) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080107 ∗∗∗ IBM Sterling B2B Integrator affected by XStream security vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080106 ∗∗∗ IBM Sterling Connect:Direct Browser User Interface is vulnerable to multiple vulnerabilities due to Jetty. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080117 ∗∗∗ IBM Sterling Connect:Direct Web Services is vulnerable to multiple vulnerabilities due to Eclipse Jetty ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080118 ∗∗∗ Multiple security vulnerabilities have been identified in DB2 JDBC driver shipped with IBM Tivoli Business Service Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080122 ∗∗∗ There is an Apache vulnerability in Liberty used by the IBM Maximo Manage application in the IBM Maximo Application Suite (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080157 ∗∗∗ There is a vulnerability in jetty-http-9.4.48.v20220622.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-26049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080156 ∗∗∗ There is a vulnerability in jetty-server-9.4.48.v20220622.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2023-26049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080155 ∗∗∗ Multiple security vulnerabilities in Snake YAML affect IBM Sterling B2B Integrator ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080177 ∗∗∗ IBM Sterling B2B Integrator affected by remote code execution due to Snake Yaml (CVE-2022-1471) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080174 ∗∗∗ IBM Sterling B2B Integrator is vulnerable to information disclosure (CVE-2023-25682) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080172 ∗∗∗ IBM Sterling B2B Integrator is affected by sensitive information exposure due to Apache James MIME4J (CVE-2022-45787) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080175 ∗∗∗ IBM Sterling B2B Integrator is vulnerable to denial of service due to Apache Commons FileUpload (CVE-2023-24998) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080176 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.11.2023
by Daily end-of-shift report 20 Nov '23

20 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 17-11-2023 18:00 − Montag 20-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Exploit for CrushFTP RCE chain released, patch now ∗∗∗ --------------------------------------------- A proof-of-concept exploit was publicly released for a critical remote code execution vulnerability in the CrushFTP enterprise suite, allowing unauthenticated attackers to access files on the server, execute code, and obtain plain-text passwords. --------------------------------------------- https://www.bleepingcomputer.com/news/security/exploit-for-crushftp-rce-cha… ∗∗∗ Lumma Stealer malware now uses trigonometry to evade detection ∗∗∗ --------------------------------------------- The Lumma information-stealing malware is now using an interesting tactic to evade detection by security software - the measuring of mouse movements using trigonometry to determine if the malware is running on a real machine or an antivirus sandbox. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lumma-stealer-malware-now-us… ∗∗∗ Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits ∗∗∗ --------------------------------------------- The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems. --------------------------------------------- https://www.bleepingcomputer.com/news/security/kinsing-malware-exploits-apa… ∗∗∗ New "Agent Tesla" Variant: Unusual "ZPAQ" Archive Format Delivers Malware ∗∗∗ --------------------------------------------- A new variant of Agent Tesla uses the uncommon compression format ZPAQ to steal information from approximately 40 web browsers and various email clients. But what exactly is this file compression format? What advantage does it provide to threat actors? And why it is assumed that the version of Agent Tesla is “new”? --------------------------------------------- https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq ∗∗∗ DarkGate and PikaBot Malware Resurrect QakBots Tactics in New Phishing Attacks ∗∗∗ --------------------------------------------- Phishing campaigns delivering malware families such as DarkGate and PikaBot are following the same tactics previously used in attacks leveraging the now-defunct QakBot trojan. “These include hijacked email threads as the initial infection, URLs with unique patterns that limit user access, and an infection chain nearly identical to what we have seen with QakBot delivery,” Cofense said in a report [...] --------------------------------------------- https://thehackernews.com/2023/11/darkgate-and-pikabot-malware-resurrect.ht… ∗∗∗ NetSupport RAT Infections on the Rise - Targeting Government and Business Sectors ∗∗∗ --------------------------------------------- Threat actors are targeting the education, government and business services sectors with a remote access trojan called NetSupport RAT. "The delivery mechanisms for the NetSupport RAT encompass fraudulent updates, drive-by downloads, utilization of malware loaders (such as GHOSTPULSE), and various forms of phishing campaigns," VMware Carbon Black researchers said in a report [...] --------------------------------------------- https://thehackernews.com/2023/11/netsupport-rat-infections-on-rise.html ∗∗∗ Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions ∗∗∗ --------------------------------------------- In this blog post, we present code vulnerabilities we found in GitLens (27 million installs) and GitHub Pull Requests and Issues (15 million installs). We will first give some background on VSCode internals, then explain the vulnerable portions of the code, and finally show how these issues can be prevented. --------------------------------------------- https://www.sonarsource.com/blog/vscode-security-markdown-vulnerabilities-i… ∗∗∗ Xen Project Releases Version 4.18 with New Security, Performance, and Architecture Enhancements for AI/ML Applications ∗∗∗ --------------------------------------------- The Xen Project, an open source hypervisor hosted at the Linux Foundation, today announced the release of Xen Project Hypervisor 4.18 with architecture enhancements for High Performance Computing (HPC) and Machine Learning (ML) applications, as well as higher security and performance features. --------------------------------------------- https://xenproject.org/2023/11/20/xen-project-releases-version-4-18-with-ne… ∗∗∗ How to perform basic digital forensics on a Windows computer ∗∗∗ --------------------------------------------- Digital forensics is a critical field in the investigation of cybercrimes, data breaches, and other digital incidents. As our reliance on computers continues to grow, the need for skilled digital forensics professionals is more crucial than ever. In this guide, we will explore the basics of performing digital [...] --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/how-to-perform-basi… ===================== = Vulnerabilities = ===================== ∗∗∗ Updates für Trellix ePolicy Orchestrator schließen Sicherheitslücken ∗∗∗ --------------------------------------------- Trellix, Nachfolger von McAfee und FireEye, hat den ePolicy Orchestrator aktualisiert. Das Update schließt etwa eine hochriskant eingestufte Schwachstelle. --------------------------------------------- https://www.heise.de/-9533816.html ∗∗∗ Synology schließt kritische Firmware-Lücke in Überwachungskameras ∗∗∗ --------------------------------------------- Angreifer können eigenen Code auf Überwachungskameras von Synology ausführen. --------------------------------------------- https://www.heise.de/-9534072.html ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (freerdp2, lwip, netty, and wireshark), Fedora (dotnet6.0, dotnet7.0, golang, gst-devtools, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, gstreamer1-vaapi, podman-tui, prometheus-podman-exporter, python-gstreamer1, syncthing, and tigervnc), Mageia (chromium-browser-stable, haproxy, and tigervnc), Oracle (curl, ghostscript, microcode_ctl, nghttp2, open-vm-tools, samba, and squid), SUSE (gcc13, postgresql14, and yt-dlp), and Ubuntu (iniparser). --------------------------------------------- https://lwn.net/Articles/951999/ ∗∗∗ Schwachstelle CVE-2023-46302 in Apache Submarine ∗∗∗ --------------------------------------------- In Apache Submarine gibt es eine kritische Remote Code Execution-Schwachstelle CVE-2023-46302. Die Schwachstelle rührt von einer Sicherheitslücke in snakeyaml (CVE-2022-1471) her und gefährdet Apache Submarine-Benutzer, da Angreifer beliebigen Code auf verwundbaren Systemen ausführen können. --------------------------------------------- https://www.borncity.com/blog/2023/11/20/schwachstelle-cve-2023-46302-in-ap… ∗∗∗ Multiple vulnerabilities in LuxCal Web Calendar ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN15005948/ ∗∗∗ WAGO: Improper privilege management in web-based management ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-015/ ∗∗∗ [R1] Security Center Version 6.2.1 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-42 ∗∗∗ CVE-2022-41713 An issue was discovered in deep-object-diff version 1.1.0 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7079403 ∗∗∗ CVE-2022-24434 An issue was discovered in the npm package dicer ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7079460 ∗∗∗ Vulnerability in d3-color affects IBM UrbanCode Velocity . WS-2022-0322 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7079484 ∗∗∗ IBM Storage Protect for Virtual Environments is vulnerable to arbitrary code execution, sensitive information disclosure, and denial of service due to CVEs in Apache Velocity, Apache Jena, and XStream (woodstox) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7079947 ∗∗∗ QRadar Suite Software includes components with multiple known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080058 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Go HTML injection vulnerabilitiy [CVE-2023-24539] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7080057 ∗∗∗ IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to libcurl and cURL. (CVE-2023-38546, CVE-2023-38545) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7076344 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 17.11.2023
by Daily end-of-shift report 17 Nov '23

17 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 16-11-2023 18:00 − Freitag 17-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ MySQL servers targeted by Ddostf DDoS-as-a-Service botnet ∗∗∗ --------------------------------------------- MySQL servers are being targeted by the Ddostf malware botnet to enslave them for a DDoS-as-a-Service platform whose firepower is rented to other cybercriminals. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mysql-servers-targeted-by-dd… ∗∗∗ Beyond -n: Optimizing tcpdump performance, (Thu, Nov 16th) ∗∗∗ --------------------------------------------- If you ever had to acquire packets from a network, you probably used tcpdump. Other tools (Wireshark, dumpcap, snort...) can do the same thing, but none is as widely used as tcpdump. tcpdump is simple to use, fast, and universally available (and free!). --------------------------------------------- https://isc.sans.edu/diary/rss/30408 ∗∗∗ Beware: Malicious Google Ads Trick WinSCP Users into Installing Malware ∗∗∗ --------------------------------------------- Threat actors are leveraging manipulated search results and bogus Google ads that trick users who are looking to download legitimate software such as WinSCP into installing malware instead.Cybersecurity company Securonix is tracking the ongoing activity under the name SEO#LURKER. --------------------------------------------- https://thehackernews.com/2023/11/beware-malicious-google-ads-trick.html ∗∗∗ Understanding the Phobos affiliate structure and activity ∗∗∗ --------------------------------------------- Cisco Talos identified the most prolific Phobos variants, TTPs and affiliate structure, based on their activity and analysis of over 1,000 samples from VirusTotal dating back to 2019. We assess with moderate confidence Eking, Eight, Elbie, Devos and Faust are the most common variants --------------------------------------------- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-struc… ∗∗∗ ALPHV (BlackCat) Ransomware Gang Uses Google Ads for Targeted Victims ∗∗∗ --------------------------------------------- Researchers noted that ALPHV/BlackCat threat actors gain initial access to their target’s IT networks through three methods. These include exploiting stolen or compromised login credentials to gain unauthorized access, exploiting vulnerabilities in remote management/monitoring tools to access IT systems, and browser-based attacks in which users are tricked into visiting malicious websites that deliver malware or malicious links in emails or social media posts. --------------------------------------------- https://www.hackread.com/alphv-blackcat-ransomware-gang-google-ads/ ∗∗∗ CISA Releases The Mitigation Guide: Healthcare and Public Health (HPH) Sector ∗∗∗ --------------------------------------------- Today, CISA released the Mitigation Guide: Healthcare and Public Health (HPH) Sector as a supplemental companion to the HPH Cyber Risk Summary, published July 19, 2023. This guide provides defensive mitigation strategy recommendations and best practices to combat pervasive cyber threats affecting this critical infrastructure sector. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/17/cisa-releases-mitigation… ===================== = Vulnerabilities = ===================== ∗∗∗ Bildbearbeitung: Angreifer können Gimp Schadcode unterjubeln ∗∗∗ --------------------------------------------- Die freie Open-Source-Bildbearbeitung Gimp ist in Version 2.10.36 erschienen. Sie schließt Sicherheitslücken, die Codeschmuggel erlauben. --------------------------------------------- https://www.heise.de/news/Bildbearbeitung-Angreifer-koennen-Gimp-Schadcode-… ∗∗∗ FortiNet flickt schwere Sicherheitslücken in FortiOS und anderen Produkten ∗∗∗ --------------------------------------------- Neben FortiOS und FortiClient sind auch FortiSIEM, FortiWLM und weitere von zum Teil kritischen Security-Fehlern betroffen. Admins sollten patchen. --------------------------------------------- https://www.heise.de/news/FortiNet-flickt-schwere-Sicherheitsluecken-in-For… ∗∗∗ Anonymisierendes Linux: Tails 5.19.1 behebt Tor-Lücke, Audit-Ergebnisse sind da ∗∗∗ --------------------------------------------- Ein offenbar aus der Ferne ausnutzbarer Bug in Tor führte zum neuerlichen Update. Die Ergebnisse der kürzlichen Sicherheitsprüfung hingegen sind positiv. --------------------------------------------- https://www.heise.de/news/Anonymisierendes-Linux-Tails-5-19-1-behebt-Tor-Lu… ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (webkit2gtk), Fedora (microcode_ctl, pack, and tigervnc), Slackware (gimp), SUSE (frr, gcc13, go1.20, go1.20-openssl, go1.21, go1.21-openssl, libnbd, libxml2, python-Pillow, python-urllib3, and xen), and Ubuntu (intel-microcode and openvpn). --------------------------------------------- https://lwn.net/Articles/951801/ ∗∗∗ Over a Dozen Exploitable Vulnerabilities Found in AI/ML Tools ∗∗∗ --------------------------------------------- Since August 2023, members of the Huntr bug bounty platform for artificial intelligence (AI) and machine learning (ML) have uncovered over a dozen vulnerabilities exposing AI/ML models to system takeover and sensitive information theft. Identified in tools with hundreds of thousands or millions of downloads per month, such as H2O-3, MLflow, and Ray, these issues potentially impact the entire AI/ML supply chain --------------------------------------------- https://www.securityweek.com/over-a-dozen-exploitable-vulnerabilities-found… ∗∗∗ [R1] Nessus Agent Version 10.4.4 Fixes One Vulnerability ∗∗∗ --------------------------------------------- An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. --------------------------------------------- https://www.tenable.com/security/tns-2023-41 ∗∗∗ [R1] Nessus Version 10.6.3 Fixes One Vulnerability ∗∗∗ --------------------------------------------- An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. --------------------------------------------- https://www.tenable.com/security/tns-2023-40 ∗∗∗ [R1] Nessus Version 10.5.7 Fixes One Vulnerability ∗∗∗ --------------------------------------------- An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus Rules variables to overwrite arbitrary files on the remote host, which could lead to a denial of service condition. --------------------------------------------- https://www.tenable.com/security/tns-2023-39 ∗∗∗ Juniper Releases Security Advisory for Juniper Secure Analytics ∗∗∗ --------------------------------------------- Juniper released a security advisory to address multiple vulnerabilities affecting Juniper Secure Analytics. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system.CISA encourages users and administrators to review the Juniper advisory JSA74298 and apply the necessary updates. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/17/juniper-releases-securit… ∗∗∗ ZDI-23-1716: Luxion KeyShot Viewer KSP File Parsing Memory Corruption Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1716/ ∗∗∗ SVD-2023-1107: November 2023 Splunk Universal Forwarder Third-Party Updates ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1107 ∗∗∗ SVD-2023-1106: November 2023 Third-Party Package Updates in Splunk Enterprise ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1106 ∗∗∗ SVD-2023-1105: November 2023 Third Party Package updates in Splunk Enterprise ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1105 ∗∗∗ SVD-2023-1104: Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1104 ∗∗∗ SVD-2023-1103: Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search Page ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1103 ∗∗∗ SVD-2023-1102: Third Party Package Update in Splunk Add-on for Google Cloud Platform ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1102 ∗∗∗ SVD-2023-1101: Third Party Package Update in Splunk Add-on for Amazon Web Services ∗∗∗ --------------------------------------------- https://advisory.splunk.com//advisories/SVD-2023-1101 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077733 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Ivy information disclosure vulnerabilitiy [CVE-2023-46751] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077734 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh denial of service vulnerability [CVE-2023-3603] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077736 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to snappy-java information disclosure vulnerabilitiy [CVE-2023-43642] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077735 ∗∗∗ IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to libssh denial of service vulnerability [CVE-2023-3603] ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077739 ∗∗∗ IBM QRadar SIEM contains multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070736 ∗∗∗ IBM Storage Fusion may be vulnerable to Unauthorized requests (SSRF), Improper path traversal, via k8s.io\/apimachinery, k8s.io\/apiserver (CVE-2022-3172, CVE-2022-3162) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077936 ∗∗∗ InfoSphere Information Server is vulnerable due to improper access control (CVE-2023-40363) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070742 ∗∗∗ IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2023-26049) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070740 ∗∗∗ IBM Storage Fusion may be vulnerable to Denial of Service via use of golang.org\/x\/net, x\/crypto, and x\/text (CVE-2022-30633, CVE-2022-27664, CVE-2022-28131, CVE-2022-41721, CVE-2021-43565, CVE-2022-27191, CVE-2022-32149) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077942 ∗∗∗ IBM Planning Analytics is affected by vulnerabilities in IBM Java, IBM Websphere Application Server Liberty and IBM GSKit ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070140 ∗∗∗ IBM Storage Fusion may be vulnerable to Denial of Service via use of openshift\/machine-api-operator, openshift\/machine-config-operator (CVE-2020-28851, CVE-2020-28852, CVE-2021-44716) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077938 ∗∗∗ IBM Storage Fusion may be vulnerable to Injection, Regular Expression Denial of Service (ReDoS), and Arbitrary Code Execution and via use of postcss, semver, babel-traverse (CVE-2023-45133, CVE-2022-25883, CVE-2023-44270) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077947 ∗∗∗ Java SE issues disclosed in the Oracle October 2023 Critical Patch Update plus CVE-2023-5676 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7078433 ∗∗∗ IBM Security SOAR is using a component with multiple known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7063706 ∗∗∗ IBM MQ Operator and Queue manager container images are vulnerable to libcurl vulnerabilities (CVE-2023-38546, CVE-2023-38545) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7077530 ∗∗∗ IBM Sterling B2B Integrator is vulnerable to cross-site scripting (CVE-2022-43578) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/6957156 ∗∗∗ Watson Machine Learning Accelerator on Cloud Pak for Data is affected by multiple vulnerabilities in Grafana ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7078751 ∗∗∗ Multiple Vulnerabilities in IBM\u00ae Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to the October 2023 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7078745 ∗∗∗ Red Lion Sixnet RTUs ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.11.2023
by Daily end-of-shift report 16 Nov '23

16 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 15-11-2023 18:00 − Donnerstag 16-11-2023 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Zero-Day Flaw in Zimbra Email Software Exploited by Four Hacker Groups ∗∗∗ --------------------------------------------- A zero-day flaw in the Zimbra Collaboration email software was exploited by four different groups in real-world attacks to pilfer email data, user credentials, and authentication tokens. --------------------------------------------- https://thehackernews.com/2023/11/zero-day-flaw-in-zimbra-email-software.ht… ∗∗∗ Deep Dive: Learning from Okta – the hidden risk of HAR files ∗∗∗ --------------------------------------------- HAR is short for HTTP Archive, and it’s a way of saving full details of the high-level network traffic in a web browsing session, usually for development, debugging, or testing purposes. --------------------------------------------- https://pducklin.com/2023/11/14/deep-dive-learning-from-okta-the-hidden-ris… ∗∗∗ Fake-Shops locken mit Black-Friday-Angeboten ∗∗∗ --------------------------------------------- Rund um den Blackfriday lässt sich das ein oder andere Schnäppchen ergattern. Wir raten aber dazu, Online-Shops vor einer Bestellung genau zu prüfen. --------------------------------------------- https://www.watchlist-internet.at/news/fake-shops-locken-mit-black-friday-a… ∗∗∗ Attacker – hidden in plain sight for nearly six months – targeting Python developers ∗∗∗ --------------------------------------------- For close to six months, a malicious actor has been stealthily uploading dozens of malicious Python packages, most of them mimicking the names of legitimate ones, to bait unsuspecting developers. --------------------------------------------- https://checkmarx.com/blog/attacker-hidden-in-plain-sight-for-nearly-six-mo… ∗∗∗ FBI and CISA Release Advisory on Scattered Spider Group ∗∗∗ --------------------------------------------- Today, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint Cybersecurity Advisory (CSA) on Scattered Spider—a cybercriminal group targeting commercial facilities sectors and subsectors. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/16/fbi-and-cisa-release-adv… ===================== = Vulnerabilities = ===================== ∗∗∗ New PoC Exploit for Apache ActiveMQ Flaw Could Let Attackers Fly Under the Radar ∗∗∗ --------------------------------------------- Cybersecurity researchers have demonstrated a new technique that exploits a critical security flaw in Apache ActiveMQ to achieve arbitrary code execution in memory. --------------------------------------------- https://thehackernews.com/2023/11/new-poc-exploit-for-apache-activemq.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and openvpn), Oracle (kernel, microcode_ctl, plexus-archiver, and python), Red Hat (.NET 6.0, dotnet6.0, dotnet7.0, dotnet8.0, kernel, linux-firmware, and open-vm-tools), SUSE (apache2, chromium, jhead, postgresql12, postgresql13, and qemu), and Ubuntu (dotnet6, dotnet7, dotnet8, frr, python-pip, quagga, and tidy-html5). --------------------------------------------- https://lwn.net/Articles/951681/ ∗∗∗ Mollie for Drupal - Moderately critical - Faulty payment confirmation logic - SA-CONTRIB-2023-052 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-052 ∗∗∗ FortiOS & FortiProxy VM - Bypass of root file system integrity checks at boot time on VM ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-22-396 ∗∗∗ FortiOS & FortiProxy - DOS in headers management ∗∗∗ --------------------------------------------- https://fortiguard.fortinet.com/psirt/FG-IR-23-151 ∗∗∗ Cisco Secure Client Software Denial of Service Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IP Phone Stored Cross-Site Scripting Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Secure Endpoint for Windows Scanning Evasion Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Identity Services Engine Vulnerabilities ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco AppDynamics PHP Agent Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ FortiSIEM - OS command injection in Report Server ∗∗∗ --------------------------------------------- https://www.fortiguard.com/psirt/FG-IR-23-135 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ 2023-11 Security Bulletin: JSA Series: Multiple vulnerabilities resolved ∗∗∗ --------------------------------------------- https://supportportal.juniper.net/s/article/2023-11-Security-Bulletin-JSA-S… ∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2023-0010 ∗∗∗ --------------------------------------------- https://webkitgtk.org/security/WSA-2023-0010.html ∗∗∗ Released: November 2023 Exchange Server Security Updates ∗∗∗ --------------------------------------------- https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november… ∗∗∗ Citrix Releases Security Updates for Citrix Hypervisor ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/16/citrix-releases-security… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.11.2023
by Daily end-of-shift report 15 Nov '23

15 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 14-11-2023 18:00 − Mittwoch 15-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ IPStorm botnet with 23,000 proxies for malicious traffic dismantled ∗∗∗ --------------------------------------------- The U.S. Department of Justive announced today that Federal Bureau of Investigation took down the network and infrastructure of a botnet proxy service called IPStorm. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ipstorm-botnet-with-23-000-p… ∗∗∗ The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses ∗∗∗ --------------------------------------------- At Fox-IT (part of NCC Group) identifying servers that host nefarious activities is a critical aspect of our threat intelligence. One approach involves looking for anomalies in responses of HTTP servers. --------------------------------------------- https://blog.fox-it.com/2023/11/15/the-spelling-police-searching-for-malici… ∗∗∗ #StopRansomware: Rhysida Ransomware ∗∗∗ --------------------------------------------- This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders detailing various ransomware variants and ransomware threat actors. --------------------------------------------- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a ===================== = Vulnerabilities = ===================== ∗∗∗ WP Fastest Cache plugin bug exposes 600K WordPress sites to attacks ∗∗∗ --------------------------------------------- The WordPress plugin WP Fastest Cache is vulnerable to an SQL injection vulnerability that could allow unauthenticated attackers to read the contents of the sites database. --------------------------------------------- https://www.bleepingcomputer.com/news/security/wp-fastest-cache-plugin-bug-… ∗∗∗ Reptar: Intel-CPU-Schwachstelle ermöglicht Rechteausweitung und DoS ∗∗∗ --------------------------------------------- Entdeckt wurde die Schwachstelle von Google-Forschern. Sie basiert wohl auf der Art und Weise, wie Intel-CPUs redundante Präfixe verarbeiten. --------------------------------------------- https://www.golem.de/news/reptar-intel-cpu-schwachstelle-ermoeglicht-rechte… ∗∗∗ Kein Patch verfügbar: VMware warnt vor kritischer Schwachstelle in Cloud Director ∗∗∗ --------------------------------------------- Die Schwachstelle ermöglicht es Angreifern, die Authentifizierung anfälliger VMware-Systeme zu umgehen und Schadcode einzuschleusen. --------------------------------------------- https://www.golem.de/news/kein-patch-verfuegbar-vmware-warnt-vor-kritischer… ∗∗∗ Cloud-Schutzlösung: IBM Security Guardium vielfältig attackierbar ∗∗∗ --------------------------------------------- Die IBM-Entwickler haben viele Sicherheitslücken in verschiedenen Komponenten von Security Guardium geschlossen. --------------------------------------------- https://www.heise.de/news/Cloud-Schutzloesung-IBM-Security-Guardium-vielfae… ∗∗∗ CacheWarp: Loch in Hardware-Verschlüsselung von AMD-CPUs ∗∗∗ --------------------------------------------- Der jetzt vorgestellte CacheWarp-Angriff überwindet die RAM-Verschlüsselung, mit der AMD-Prozessoren Cloud-Instanzen voneinander abschotten wollen. --------------------------------------------- https://www.heise.de/news/CacheWarp-Loch-in-Hardware-Verschluesselung-von-A… ∗∗∗ Patchday Adobe: Schadcode-Lücken in Acrobat, Photoshop & Co. geschlossen ∗∗∗ --------------------------------------------- Adobe hat Sicherheitsupdates für 15 Anwendungen veröffentlicht. Im schlimmsten Fall können Angreifer eigenen Code auf Systemen ausführen. --------------------------------------------- https://www.heise.de/news/Patchday-Adobe-Schadcode-Luecken-in-Acrobat-Photo… ∗∗∗ Patchday: SAP schließt eine kritische Sicherheitslücke ∗∗∗ --------------------------------------------- Der November-Patchday weicht vom gewohnten Umfang ab: Lediglich drei neue Sicherheitslücken behandelt SAP. --------------------------------------------- https://www.heise.de/news/Patchday-SAP-schliesst-eine-kritische-Sicherheits… ∗∗∗ Sicherheitsupdates: Access Points von Aruba sind verwundbar ∗∗∗ --------------------------------------------- Angreifer können Schadcode auf Acces Points von Aruba ausführen. Sicherheitspatches sind verfügbar. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Acces-Points-von-Aruba-sind-ve… ∗∗∗ Patchday: Intel patcht sich durch sein Produkportfolio ∗∗∗ --------------------------------------------- Angreifer können mehrere Komponenten von Intel attackieren. In vielen Fällen sind DoS-Attacken möglich. --------------------------------------------- https://www.heise.de/news/Patchday-Intel-patcht-sich-durch-sein-Produkportf… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (libclamunrar and ruby-sanitize), Fedora (frr, roundcubemail, and webkitgtk), Mageia (freerdp and tomcat), Red Hat (avahi, bind, c-ares, cloud-init, container-tools:4.0, container-tools:rhel8, cups, dnsmasq, edk2, emacs, flatpak, fwupd, ghostscript, grafana, java-21-openjdk, kernel, kernel-rt, libfastjson, libmicrohttpd, libpq, librabbitmq, libreoffice, libreswan, libX11, linux-firmware, mod_auth_openidc:2.3, nodejs:20, opensc, perl-HTTP-Tiny, [...] --------------------------------------------- https://lwn.net/Articles/951480/ ∗∗∗ November-Patchday: Microsoft schließt 63 Sicherheitslücken ∗∗∗ --------------------------------------------- Fünf Anfälligkeiten sind als kritisch eingestuft. Davon betroffen sind alle unterstützten Versionen von Windows. --------------------------------------------- https://www.zdnet.de/88412929/november-patchday-microsoft-schliesst-63-sich… ∗∗∗ QNX-2023-001 Vulnerability in QNX Networking Stack Impacts BlackBerry QNX Software Development Platform ∗∗∗ --------------------------------------------- https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumbe… ∗∗∗ ZDI-23-1636: NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1636/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Citrix Hypervisor Security Bulletin for CVE-2023-23583 and CVE-2023-46835 ∗∗∗ --------------------------------------------- https://support.citrix.com/article/CTX583037/citrix-hypervisor-security-bul… ∗∗∗ NVIDIA GPU Display Driver Advisory - October 2023 ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500588-NVIDIA-GPU-DISPLAY-DRIV… ∗∗∗ NetApp SnapCenter Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500587-NETAPP-SNAPCENTER-PRIVI… ∗∗∗ AMD Radeon Graphics Kernel Driver Privilege Management Vulnerability ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500586-AMD-RADEON-GRAPHICS-KER… ∗∗∗ AMD Graphics Driver Vulnerabilities- November, 2023 ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500583-AMD-GRAPHICS-DRIVER-VUL… ∗∗∗ Intel Graphics Driver Advisory ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500584-INTEL-GRAPHICS-DRIVER-A… ∗∗∗ Intel Rapid Storage Technology Software Advisory ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500585 ∗∗∗ Multi-vendor BIOS Security Vulnerabilities (November 2023) ∗∗∗ --------------------------------------------- http://support.lenovo.com/product_security/PS500589-MULTI-VENDOR-BIOS-SECUR… ∗∗∗ Fortinet Releases Security Updates for FortiClient and FortiGate ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/14/fortinet-releases-securi… ∗∗∗ K000137584 : Linux kernel vulnerability CVE-2023-1829 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137584 ∗∗∗ K000137582 : BIND vulnerability CVE-2023-3341 ∗∗∗ --------------------------------------------- https://my.f5.com/manage/s/article/K000137582 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.11.2023
by Daily end-of-shift report 14 Nov '23

14 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Montag 13-11-2023 18:00 − Dienstag 14-11-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ CISA warns of actively exploited Juniper pre-auth RCE exploit chain ∗∗∗ --------------------------------------------- CISA warned federal agencies today to secure Juniper devices on their networks by Friday against four vulnerabilities now used in remote code execution (RCE) attacks as part of a pre-auth exploit chain. The alert comes one week after Juniper updated its advisory to notify customers that the flaws found in Juniper's J-Web interface (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) have been successfully exploited in the wild. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cisa-warns-of-actively-explo… ∗∗∗ ChatGPT, Bard und andere: KI-Systeme ermöglichen Ausleiten von Daten ∗∗∗ --------------------------------------------- Durch gezielte Abfragen lassen sich private und geschützte Daten aus KI-Systemen ausleiten. Die Angriffe zeigen ein prinzipielles Problem. --------------------------------------------- https://www.golem.de/news/chatgpt-bard-und-andere-ki-systeme-ermoeglichen-a… ∗∗∗ Noticing command and control channels by reviewing DNS protocols, (Mon, Nov 13th) ∗∗∗ --------------------------------------------- Malicious software pieces installed in computers call home. Some of them can be noticed because they perform DNS lookup and some of them initiates connection without DNS lookup. For this last option, this is abnormal and can be noticed by any Network Detection and Response (NDR) tool that reviews the network traffic by at least two weeks. Most companies do not have money to afford a NDR, so I'm going to show you today an interesting tip that have worked for me to notice APT calling home when they perform DNS lookup. --------------------------------------------- https://isc.sans.edu/diary/rss/30396 ∗∗∗ Bug hunters on your marks: TETRA radio encryption algorithms to enter public domain ∗∗∗ --------------------------------------------- The algorithms are used by TETRA – short for the Terrestrial Trunked Radio protocol – and they are operated by governments, law enforcement, military and emergency services organizations in Europe, the UK, and other countries. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/11/14/tetra_encryp… ∗∗∗ Novel backdoor persists even after critical Confluence vulnerability is patched ∗∗∗ --------------------------------------------- Got a Confluence server? Listen up. Malware said to have wide-ranging capabilities. A new backdoor was this week found implanted in the environments of organizations to exploit the recently disclosed critical vulnerability in Atlassian Confluence. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/11/14/novel_backdo… ∗∗∗ Nothing new, still broken, insecure by default since then: Pythons e-mail libraries and certificate verification ∗∗∗ --------------------------------------------- Today, basically every e-mail provider supports TLS for their services and programmatically accessing e-mail services with Python code using TLS-wrapped clients is common. Python offers three libraries shipped with a standard installation for handling e-mail transfer. These modules are smtplib, imaplib, and poplib. While Python programming is usually straightforward, using these Python libraries require passing a magic parameter in the right way to use secure communication. --------------------------------------------- https://www.pentagrid.ch/en/blog/python-mail-libraries-certificate-verifica… ∗∗∗ LockBit ransomware group assemble strike team to breach banks, law firms and governments. ∗∗∗ --------------------------------------------- [...] I thought it would be good to break down what is happening and how they’re doing it, since LockBit are breaching some of the world’s largest organisations - many of whom have incredibly large security budgets. Through data allowing the tracking of ransomware operators, it has been possible to track individual targets. Recently, it has become clear they have been targeting a vulnerability in Citrix Netscaler, called CitrixBleed. --------------------------------------------- https://doublepulsar.com/lockbit-ransomware-group-assemble-strike-team-to-b… ∗∗∗ CVE Half-Day Watcher ∗∗∗ --------------------------------------------- CVE Half-Day Watcher is a security tool designed to highlight the risk of early exposure of Common Vulnerabilities and Exposures (CVEs) in the public domain. It leverages the National Vulnerability Database (NVD) API to identify recently published CVEs with GitHub references before an official patch is released. By doing so, CVE Half-Day Watcher aims to underscore the window of opportunity for attackers to "harvest" this information and develop exploits. --------------------------------------------- https://github.com/Aqua-Nautilus/CVE-Half-Day-Watcher ∗∗∗ Vorsicht vor Jobangeboten per SMS oder WhatsApp ∗∗∗ --------------------------------------------- Unerwartet erhalten Sie eine Nachricht von einer Personalvermittlungsagentur: Ihnen wird ein Job angeboten. Die Bezahlung ist gut und die Arbeitszeiten sind flexibel. Es geht darum, Hotels und Touristenattraktionen zu bewerten. Bei Interesse sollten Sie dem Arbeitgeber eine WhatsApp-Nachricht schicken. Ignorieren Sie dieses Jobangebot, es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-jobangeboten-per-sms-od… ∗∗∗ Ddostf DDoS Bot Malware Attacking MySQL Servers ∗∗∗ --------------------------------------------- The ASEC analysis team has recently discovered that the Ddostf DDoS bot is being installed on vulnerable MySQL servers. Ddostf is a DDoS bot capable of conducting Distributed Denial of Service (DDoS) attacks on specific targets and was first identified around 2016. --------------------------------------------- https://asec.ahnlab.com/en/58878/ ∗∗∗ A Closer Look at ChatGPTs Role in Automated Malware Creation ∗∗∗ --------------------------------------------- This blog entry explores the effectiveness of ChatGPTs safety measures, the potential for AI technologies to be misused by criminal actors, and the limitations of current AI models. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/k/a-closer-look-at-chatgpt-s-r… ∗∗∗ Malicious Abrax666 AI Chatbot Exposed as Potential Scam ∗∗∗ --------------------------------------------- As of now, based on the information regarding the sale of the Abrax666 AI Chatbot, cybersecurity researchers are of the opinion that the chatbot is most likely a scam. --------------------------------------------- https://www.hackread.com/abrax666-ai-chatbot-exposed-as-potential-scam/ ===================== = Vulnerabilities = ===================== ∗∗∗ Siemens Security Advisories ∗∗∗ --------------------------------------------- Siemens has released 14 new and 18 updated Security Advisories. --------------------------------------------- https://www.siemens.com/global/en/products/services/cert.html?d=2023-11#Sie… ∗∗∗ Xen Security Advisory CVE-2023-46835 / XSA-445 - x86/AMD: mismatch in IOMMU quarantine page table levels ∗∗∗ --------------------------------------------- A device in quarantine mode can access data from previous quarantine page table usages, possibly leaking data used by previous domains that also had the device assigned. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-445.html ∗∗∗ Xen Security Advisory CVE-2023-46836 / XSA-446 - x86: BTC/SRSO fixes not fully effective ∗∗∗ --------------------------------------------- An attacker in a PV guest might be able to infer the contents of memory belonging to other guests. --------------------------------------------- https://xenbits.xen.org/xsa/advisory-446.html ∗∗∗ SAP Security Patch Day –November2023 ∗∗∗ --------------------------------------------- On 14th of November 2023, SAP Security Patch Day saw the release of 3 new Security Notes. Further, there were 3 updates to previously released Security Notes. --------------------------------------------- https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (postgresql-11, postgresql-13, and postgresql-15), Fedora (chromium, optipng, and radare2), Scientific Linux (plexus-archiver and python), Slackware (tigervnc), SUSE (apache2, containerized-data-importer, kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed, postgresql, postgresql15, postgresql16, postgresql12, postgresql13, python-Django1, squashfs, and xterm), and Ubuntu (firefox and memcached). --------------------------------------------- https://lwn.net/Articles/951311/ ∗∗∗ ICS Patch Tuesday: 90 Vulnerabilities Addressed by Siemens and Schneider Electric ∗∗∗ --------------------------------------------- Siemens and Schneider Electric’s Patch Tuesday advisories for November 2023 address 90 vulnerabilities affecting their products. --------------------------------------------- https://www.securityweek.com/ics-patch-tuesday-90-vulnerabilities-addressed… ∗∗∗ Mattermost security updates 9.1.3 / 9.0.4 / 8.1.6 (ESR) / 7.8.15 (ESR) released ∗∗∗ --------------------------------------------- The security update is available for Mattermost dot releases 9.1.3, 9.0.4, 8.1.6 (Extended Support Release), and 7.8.15 (Extended Support Release), for both Team Edition and Enterprise Edition. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-9-1-3-9-0-4-8-1-6-e… ∗∗∗ TYPO3-CORE-SA-2023-007: By-passing Cross-Site Scripting Protection in HTML Sanitizer ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2023-007 ∗∗∗ TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2023-006 ∗∗∗ TYPO3-CORE-SA-2023-005: Information Disclosure in Install Tool ∗∗∗ --------------------------------------------- https://typo3.org/security/advisory/typo3-core-sa-2023-005 ∗∗∗ IBM Integration Bus is vulnerable to multiple CVEs due to Apache Tomcat. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7072626 ∗∗∗ IBM QRadar Network Packet Capture includes components with multiple known vulnerabilities (CVE-2023-2828, CVE-2023-24329, CVE-2022-4839) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7073360 ∗∗∗ IBM Security Guardium is affected by multiple OS level vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7073592 ∗∗∗ AVEVA Operations Control Logger ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-01 ∗∗∗ Rockwell Automation SIS Workstation and ISaGRAF Workbench ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-318-02 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.11.2023
by Daily end-of-shift report 13 Nov '23

13 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 10-11-2023 18:00 − Montag 13-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ In a first, cryptographic keys protecting SSH connections stolen in new attack ∗∗∗ --------------------------------------------- An error as small as a single flipped memory bit is all it takes to expose a private key. --------------------------------------------- https://arstechnica.com/?p=1983026 ∗∗∗ Hackers breach healthcare orgs via ScreenConnect remote access ∗∗∗ --------------------------------------------- Security researchers are warning that hackers are targeting multiple healthcare organizations in the U.S. by abusing the ScreenConnect remote access tool. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-breach-healthcare-or… ∗∗∗ New Ransomware Group Emerges with Hives Source Code and Infrastructure ∗∗∗ --------------------------------------------- The threat actors behind a new ransomware group called Hunters International have acquired the source code and infrastructure from the now-dismantled Hive operation to kick-start its own efforts in the threat landscape. "It appears that the leadership of the Hive group made the strategic decision to cease their operations and transfer their remaining assets to another group, Hunters [...] --------------------------------------------- https://thehackernews.com/2023/11/new-ransomware-group-emerges-with-hives.h… ∗∗∗ Abusing Microsoft Access “Linked Table” Feature to Perform NTLM Forced Authentication Attacks ∗∗∗ --------------------------------------------- 1. Microsoft Access (part of the Office suite) has a “linking to remote SQL Server tables” feature. 2. This feature can be abused by attackers to automatically leak the Windows user’s NTLM tokens to any attacker-controlled server, via any TCP port, such as port 80. 3. The attack can be launched as long as the victim opens an .accdb or .mdb file. In fact, any more-common Office file type (such as a .rtf ) can work as well 4. This technique allows the attacker to bypass existing Firewall rules designed to block NTLM information stealing initiated by external attacks. --------------------------------------------- https://research.checkpoint.com/2023/abusing-microsoft-access-linked-table-… ∗∗∗ Bericht: IT-Sicherheit in Gesundheitsämtern vernachlässigt ∗∗∗ --------------------------------------------- Fehlendes Know-How, knappes Budget und unsichere Software. Ein Bericht schildert gravierende Sicherheitslücken in Gesundheitsämtern. --------------------------------------------- https://www.heise.de/-9404608.html ∗∗∗ Don’t throw a hissy fit; defend against Medusa ∗∗∗ --------------------------------------------- Our technical experts have written a blog series focused on Tactics, Techniques and Procedures (TTP’s) deployed by four ransomware families recently observed during NCC Group’s incident response engagements. --------------------------------------------- https://research.nccgroup.com/2023/11/13/dont-throw-a-hissy-fit-defend-agai… ∗∗∗ Cyber Threat Intelligence: Den Gegnern auf der Spur ∗∗∗ --------------------------------------------- Durch das Sammeln, Analysieren und Kontextualisieren von Informationen über mögliche Cyber-Bedrohungen, einschließlich der fortschrittlichsten, bietet Threat Intelligence eine wichtige Methode zur Identifizierung, Bewertung und Minderung von Cyber-Risiken --------------------------------------------- https://www.welivesecurity.com/de/business-security/cyber-threat-intelligen… ∗∗∗ CISA Adds Six Known Exploited Vulnerabilities to Catalog ∗∗∗ --------------------------------------------- CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/13/cisa-adds-six-known-expl… ∗∗∗ Ransomware tracker: The latest figures [November 2023] ∗∗∗ --------------------------------------------- Note: this Ransomware Tracker is updated on the second Sunday of each month to stay current Ransomware attacks across several key sectors dipped significantly in October, breaking a streak that has gone on for much of 2023. Ransomware gangs posted 243 victims to their extortion sites in October — a sharp decrease from the 455 [...] --------------------------------------------- https://therecord.media/ransomware-tracker-the-latest-figures ∗∗∗ RCE-Exploit für Wyze Cam v3 veröffentlicht (Nov. 2023) ∗∗∗ --------------------------------------------- Kurzer Hinweis für Besitzer von Indoor-Kameras des Anbieters Wyze. Deren Modell Wyze Com v3 enthält wohl Schwachstellen, über die Dritte auf die Kameradaten zugreifen können. Inzwischen ist ein RCE-Exploit für die Wyze Cam v3 veröffentlicht worden. --------------------------------------------- https://www.borncity.com/blog/2023/11/11/rce-exploit-fr-wyze-cam-v3-verffen… ∗∗∗ Facebook Fake-Benachrichtigungen "Seiten wegen Verletzung der Gemeinschaftsstandard gesperrt" ∗∗∗ --------------------------------------------- Auf Facebook scheint eine kriminelle Masche über den Messenger zu laufen, bei denen die Empfänger angeblich von Facebook-Meta-Mitarbeitern informiert werden, dass die Seiten wegen Verletzungen der Gemeinschaftsstandards o.ä. gesperrt worden seien. Es kommt ein Link mit Aufforderung zum Entsperren. Das ist aber Fake und ein Phishing-Versuch, um die Zugangsdaten abzufischen. --------------------------------------------- https://www.borncity.com/blog/2023/11/12/facebook-fake-benachrichtigungen-s… ∗∗∗ OracleIV DDoS Botnet Malware Targets Docker Engine API Instances ∗∗∗ --------------------------------------------- OracleIV is not a supply chain attack, it highlights the ongoing threat of misconfigured Docker Engine API deployments. --------------------------------------------- https://www.hackread.com/oracleiv-ddos-botnet-malware-docker-engine-api-ins… ∗∗∗ ACSC and CISA Release Business Continuity in a Box ∗∗∗ --------------------------------------------- Today, the Australian Signals Directorate’s Australian Cyber Security Centre (ASDs ACSC) and CISA released Business Continuity in a Box. Business Continuity in a Box, developed by ACSC with contributions from CISA, assists organizations with swiftly and securely standing up critical business functions during or following a cyber incident. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/13/acsc-and-cisa-release-bu… ===================== = Vulnerabilities = ===================== ∗∗∗ Local Privliege Escalation in Check Point Endpoint Security Remediation Service ∗∗∗ --------------------------------------------- This vulnerability allows local attackers to escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. --------------------------------------------- https://support.checkpoint.com/results/sk/sk181597 ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (audiofile and ffmpeg), Fedora (keylime, python-pillow, and tigervnc), Mageia (quictls and vorbis-tools), Oracle (grub2), Red Hat (galera, mariadb, plexus-archiver, python, squid, and squid34), and SUSE (clamav, kernel, mupdf, postgresql14, tomcat, tor, and vlc). --------------------------------------------- https://lwn.net/Articles/951237/ ∗∗∗ CVE-2023-5950 Rapid7 Velociraptor Reflected XSS ∗∗∗ --------------------------------------------- This advisory covers a specific issue identified in Velociraptor and disclosed by a security code review. Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. --------------------------------------------- https://www.rapid7.com/blog/post/2023/11/10/cve-2023-5950-rapid7-velocirapt… ∗∗∗ Ivanti EPMM CVE-2023-39335/39337 ∗∗∗ --------------------------------------------- As part of our ongoing strengthening of the security of our products we have discovered two new vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core. We are reporting these vulnerabilities as CVE-2023-39335 and CVE-2023-39337. --------------------------------------------- https://www.ivanti.com/blog/ivanti-epmm-cve-2023-39335-39337 ∗∗∗ Mutiple Vulnerabilties Affecting Watson Machine Learning Accelerator on Cloud Pak for Data version ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7071340 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 10.11.2023
by Daily end-of-shift report 10 Nov '23

10 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 09-11-2023 18:00 − Freitag 10-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Ducktail fashion week ∗∗∗ --------------------------------------------- The Ducktail malware, designed to hijack Facebook business and ads accounts, sends marketing professionals fake ads for jobs with major clothing manufacturers. --------------------------------------------- https://securelist.com/ducktail-fashion-week/111017/ ∗∗∗ Routers Targeted for Gafgyt Botnet [Guest Diary], (Thu, Nov 9th) ∗∗∗ --------------------------------------------- The threat actor attempts to add my honeypot into a botnet so the threat actor can carry out DDoS attacks. The vulnerabilities used for the attack were default credentials and CVE-2017-17215. To prevent these attacks, make sure systems are patched and using strong credentials. --------------------------------------------- https://isc.sans.edu/diary/rss/30390 ∗∗∗ Malware: Mehr als 600 Millionen Downloads 2023 in Google Play ∗∗∗ --------------------------------------------- Kaspersky hat in diesem Jahr bereits mehr als 600 Millionen Malware-Downloads aus dem Google-Play-Store gezählt. Der bleibt aber sicherste Paketquelle. --------------------------------------------- https://www.heise.de/news/Malware-Mehr-als-600-Millionen-Downloads-2023-in-… ∗∗∗ Demystifying Cobalt Strike’s “make_token” Command ∗∗∗ --------------------------------------------- Cobalt Strike provides the make_token command to achieve a similar result to runas /netonly. --------------------------------------------- https://research.nccgroup.com/2023/11/10/demystifying-cobalt-strikes-make_t… ∗∗∗ High Traffic + High Vulnerability = an Attractive Target for Criminals: The Dangers of Viewing Clickbait Sites ∗∗∗ --------------------------------------------- Clickbait articles are highlighted in this article. A jump in compromised sites exploiting CVE-2023-3169 stresses the danger of web-based threats. --------------------------------------------- https://unit42.paloaltonetworks.com/dangers-of-clickbait-sites/ ∗∗∗ Cerber Ransomware Exploits Atlassian Confluence Vulnerability CVE-2023-22518 ∗∗∗ --------------------------------------------- We encountered the Cerber ransomware exploiting the Atlassian Confluence vulnerability CVE-2023-22518 in its operations. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/k/cerber-ransomware-exploits-c… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Fedora (community-mysql, matrix-synapse, and xorg-x11-server-Xwayland), Mageia (squid and vim), Oracle (dnsmasq, python3, squid, squid:4, and xorg-x11-server), Red Hat (fence-agents, insights-client, kernel, kpatch-patch, mariadb:10.5, python3, squid, squid:4, tigervnc, and xorg-x11-server), Scientific Linux (bind, firefox, java-1.8.0-openjdk, java-11-openjdk, kernel, libssh2, python-reportlab, python3, squid, thunderbird, and xorg-x11-server), [...] --------------------------------------------- https://lwn.net/Articles/951066/ ∗∗∗ Multiple Vulnerabilities in QuMagie ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-50 ∗∗∗ Vulnerability in QTS, QuTS hero, and QuTScloud ∗∗∗ --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-24 ∗∗∗ AIX is affected by a denial of service (CVE-2023-45167) and a security restrictions bypass (CVE-2023-40217) due to Python ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7068084 ∗∗∗ Multiple vulnerabilities in Eclipse Jetty affect IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070298 ∗∗∗ The IBM Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Apr 2023 - Includes Oracle April 2023 CPU plus CVE-2023-2597 ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070548 ∗∗∗ Multiple security vulnerabilities have been identified in IBM DB2 which is shipped with IBM Intelligent Operations Center. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070539 ∗∗∗ IBM QRadar SIEM contains multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070736 ∗∗∗ Ivanti Secure Access Client security notifications ∗∗∗ --------------------------------------------- https://www.ivanti.com/blog/ivanti-secure-access-client-security-notificati… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.11.2023
by Daily end-of-shift report 09 Nov '23

09 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 08-11-2023 18:00 − Donnerstag 09-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Highly invasive backdoor snuck into open source packages targets developers ∗∗∗ --------------------------------------------- Packages downloaded thousands of times targeted people working on sensitive projects. --------------------------------------------- https://arstechnica.com/?p=1982281 ∗∗∗ Google ads push malicious CPU-Z app from fake Windows news site ∗∗∗ --------------------------------------------- A threat actor has been abusing Google Ads to distribute a trojanized version of the CPU-Z tool to deliver the Redline info-stealing malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/google-ads-push-malicious-cp… ∗∗∗ Visual Examples of Code Injection, (Thu, Nov 9th) ∗∗∗ --------------------------------------------- I spotted an interesting sample that perform this technique and I was able to collect “visible” information. The malware was delivered through a phishing email with a ZIP archive. --------------------------------------------- https://isc.sans.edu/diary/rss/30388 ∗∗∗ Google Play: Extra-Sicherheitsprüfungen sollen Apps vertrauenswürdiger machen ∗∗∗ --------------------------------------------- Ab sofort sind bestimmte Apps in Google Play mit einem neuen Banner gekennzeichnet, der mehr Sicherheit garantieren soll. Den Anfang machen einige VPN-Apps. --------------------------------------------- https://www.heise.de/-9357280 ∗∗∗ Spammers abuse Google Forms’ quiz to deliver scams ∗∗∗ --------------------------------------------- Cisco Talos has recently observed an increase in spam messages abusing a feature of quizzes created within Google Forms. --------------------------------------------- https://blog.talosintelligence.com/google-forms-quiz-spam/ ∗∗∗ GhostLocker - A “Work In Progress” RaaS ∗∗∗ --------------------------------------------- GhostSec, has introduced a novel Ransom-as-a-Service encryptor known as GhostLocker. --------------------------------------------- https://www.rapid7.com/blog/post/2023/11/08/ghostlocker-a-work-in-progress-… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cacti and chromium), Fedora (CuraEngine, podman, and rubygem-rmagick), Mageia (gnome-shell, openssl, and zlib), SUSE (salt), and Ubuntu (xrdp). --------------------------------------------- https://lwn.net/Articles/950850/ ∗∗∗ CVE-2023-3282 Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine (Severity: MEDIUM) ∗∗∗ --------------------------------------------- This issue is applicable only to Cortex XSOAR engines installed through the shell method that are running on a Linux operating system. --------------------------------------------- https://security.paloaltonetworks.com/CVE-2023-3282 ∗∗∗ CVE-2023-47246: SysAid Zero-Day Vulnerability Exploited By Lace Tempest ∗∗∗ --------------------------------------------- A new zero-day vulnerability (CVE-2023-47246) in SysAid IT service management software is being exploited by the threat group responsible for the MOVEit Transfer attack in May 2023. --------------------------------------------- https://www.rapid7.com/blog/post/2023/11/09/etr-cve-2023-47246-sysaid-zero-… ∗∗∗ Drupal: GraphQL - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2023-051 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-051 ∗∗∗ Drupal: GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-050 ∗∗∗ Weidmüller: WIBU Vulnerability in multiple Products ∗∗∗ --------------------------------------------- https://cert.vde.com/de/advisories/VDE-2023-032/ ∗∗∗ Johnson Controls Quantum HD Unity ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-01 ∗∗∗ Hitachi Energy eSOMS ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-313-02 ∗∗∗ IBM Security Guardium is affected by denial of service vulnerabilities (CVE-2023-3635, CVE-2023-28118) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7069238 ∗∗∗ IBM Security Guardium is affected by a denial of service vulnerability in Apache Struts (CVE-2023-34149) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7069237 ∗∗∗ Vulnerabilities in Linux Kernel, Samba, Golang, Curl, and openssl can affect IBM Spectrum Protect Plus ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7069319 ∗∗∗ A vulnerability in Samba affects IBM Storage Scale SMB protocol access method (CVE-2022-2127) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7070025 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.11.2023
by Daily end-of-shift report 08 Nov '23

08 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 07-11-2023 18:00 − Mittwoch 08-11-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Example of Phishing Campaign Project File, (Wed, Nov 8th) ∗∗∗ --------------------------------------------- We all have a love and hate relation with emails. When newcomers on the Internet starts to get emails, they are so happy but their feeling changes quickly. Then, they hope to reduce the flood of emails received daily... Good luck! Of course, tools have been developed to organize marketing campaigns. From marketing to spam or phishing, there is only one step. Bad guys started to use the same programs for malicious purpose. --------------------------------------------- https://isc.sans.edu/diary/rss/30384 ∗∗∗ Researchers Uncover Undetectable Crypto Mining Technique on Azure Automation ∗∗∗ --------------------------------------------- Cybersecurity researchers have developed whats the first fully undetectable cloud-based cryptocurrency miner leveraging the Microsoft Azure Automation service without racking up any charges. Cybersecurity company SafeBreach said it discovered three different methods to run the miner, including one that can be executed on a victims environment without attracting any attention. --------------------------------------------- https://thehackernews.com/2023/11/researchers-uncover-undetectable-crypto.h… ∗∗∗ Hunderte Experten warnen vor staatlichen Root-Zertifikaten ∗∗∗ --------------------------------------------- Bald sollen EU-Bürger sich auf grenzüberschreitende elektronische Dienste und Vertrauensstellen verlassen müssen. Experten schlagen Alarm. --------------------------------------------- https://www.heise.de/-9355165.html ∗∗∗ Angebliches LinkedIn-Datenleck: Daten von Tätern konstruiert ∗∗∗ --------------------------------------------- Im digitalen Untergrund haben Kriminelle Daten aus einem angeblichen LinkedIn-Leck angeboten. Diese entpuppen sich als künstlich aufgebläht. --------------------------------------------- https://www.heise.de/-9355976.html ∗∗∗ Tool Release: Magisk Module – Conscrypt Trust User Certs ∗∗∗ --------------------------------------------- Android 14 introduced a new feature which allows to remotely install CA certificates. This change implies that instead of using the /system/etc/security/cacerts directory to check the trusted CA’s, this new feature uses the com.android.conscrypt APEX module, and reads the certificates from the directory /apex/com.android.conscrypt/cacerts. Inspired by this blog post by Tim Perry, I decided to create a [...] --------------------------------------------- https://research.nccgroup.com/2023/11/08/tool-release-magisk-module-conscry… ∗∗∗ Sumo Logic Urges Users to Change Credentials Due to Security Breach ∗∗∗ --------------------------------------------- Cloud monitoring and SIEM firm Sumo Logic is urging users to rotate credentials following the discovery of a security breach. --------------------------------------------- https://www.securityweek.com/sumo-logic-urges-users-to-change-credentials-d… ∗∗∗ Vorsicht vor stark verbilligten Amazon-Schnäppchen ∗∗∗ --------------------------------------------- Man glaubt es kaum: Tablets, Smartphones oder Notebooks, die auf Amazon um die Hälfte billiger angeboten werden. Solche Schnäppchen entpuppen sich aber als Lockangebote, um Ihnen Geld zu stehlen. Wir zeigen Ihnen, wie diese Betrugsmasche funktioniert! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-stark-verbilligten-amaz… ∗∗∗ Vorsicht vor vermeintlichen Rechnungen der „Click Office World“ ∗∗∗ --------------------------------------------- Fake-Rechnungen sind nichts Neues in der Welt des Unternehmensbetrugs, aktuell scheinen Betrüger:innen jedoch wieder massenhaft solche Rechnungen zu versenden. So erhalten viele Unternehmen derzeit per Post englischsprachige Rechnungen von „CLICK OFFICE WORLD“, in denen eine 14-tägige Zahlungsfrist und ein Betrag von 955 Euro gefordert werden. Zahlen Sie nichts, es handelt sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-vermeintlichen-rechnung… ∗∗∗ Warning Against Phobos Ransomware Distributed via Vulnerable RDP ∗∗∗ --------------------------------------------- AhnLab Security Emergency response Center (ASEC) has recently discovered the active distribution of the Phobos ransomware. Phobos is a variant known for sharing technical and operational similarities with the Dharma and CrySis ransomware. These ransomware strains typically target externally exposed Remote Desktop Protocol (RDP) services with vulnerable securities as attack vectors. --------------------------------------------- https://asec.ahnlab.com/en/58753/ ∗∗∗ Lazarus-Linked BlueNoroff APT Targeting macOS with ObjCShellz Malware ∗∗∗ --------------------------------------------- Threat Labs’ security experts have discovered a new malware variant attributed to the BlueNoroff APT group. --------------------------------------------- https://www.hackread.com/lazarus-bluenoroff-apt-macos-objcshellz-malware/ ∗∗∗ A Balanced Approach: New Security Headers Grading Criteria ∗∗∗ --------------------------------------------- The Security Headers grading criteria is something that doesnt change often, but when it does, theres a good reason behind the change. In this blog, I will outline the new grading criteria and the reasons why weve made the change. --------------------------------------------- https://scotthelme.co.uk/a-balanced-approach-new-security-headers-grading-c… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Kritische System-Lücke bedroht Android 11, 12 und 13 ∗∗∗ --------------------------------------------- Google hat wichtige Sicherheitsupdates für verschiedene Android-Versionen veröffentlicht. --------------------------------------------- https://www.heise.de/-9355953.html ∗∗∗ Malware-Schutz: Rechteausweitung in Trend Micros Apex One möglich ∗∗∗ --------------------------------------------- In Trend Micros Schutzsoftware Apex One können Angreifer Schwachstellen missbrauchen, um ihre Privilegien auszuweiten. Updates korrigieren das. --------------------------------------------- https://www.heise.de/-9356484.html ∗∗∗ Webbrowser: Lücke mit hohem Risiko in Google Chrome geschlossen ∗∗∗ --------------------------------------------- Google schließt mit dem Update von Chrome eine hochriskante Sicherheitslücke, die Webseiten offenbar das Unterschieben von Schadcode ermöglicht. --------------------------------------------- https://www.heise.de/-9355888.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (python-urllib3 and tang), Fedora (chromium, mlpack, open-vm-tools, and salt), Red Hat (avahi, binutils, buildah, c-ares, cloud-init, containernetworking-plugins, cups, curl, dnsmasq, edk2, flatpak, frr, gdb, ghostscript, glib2, gmp, grafana, haproxy, httpd, mod_http2, java-21-openjdk, kernel, krb5, libfastjson, liblouis, libmicrohttpd, libpq, libqb, librabbitmq, LibRaw, libreoffice, libreswan, libssh, libtiff, libvirt, libX11, linux-firmware, mod_auth_openidc, ncurses, nghttp2, opensc, pcs, perl-CPAN, perl-HTTP-Tiny, podman, procps-ng, protobuf-c, python-cryptography, python-pip, python-tornado, python-wheel, python3.11, python3.11-pip, python3.9, qemu-kvm, qt5 stack, runc, samba, samba, evolution-mapi, openchange, shadow-utils, skopeo, squid, sysstat, tang, tomcat, toolbox, tpm2-tss, webkit2gtk3, wireshark, xorg-x11-server, xorg-x11-server-Xwayland, and yajl), Slackware (sudo), SUSE (squid), and Ubuntu (python-urllib3). --------------------------------------------- https://lwn.net/Articles/950694/ ∗∗∗ CISA Adds One Known Exploited Vulnerability to Catalog ∗∗∗ --------------------------------------------- CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-29552 Service Location Protocol (SLP) Denial-of-Service Vulnerability --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/08/cisa-adds-one-known-expl… ∗∗∗ GE MiCOM S1 Agile ∗∗∗ --------------------------------------------- Successful exploitation of this vulnerability could allow an attacker to upload malicious files and achieve code execution. --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-311-01 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.11.2023
by Daily end-of-shift report 07 Nov '23

07 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Montag 06-11-2023 18:00 − Dienstag 07-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Microsoft Authenticator now blocks suspicious MFA alerts by default ∗∗∗ --------------------------------------------- Microsoft has introduced a new protective feature in the Authenticator app to block notifications that appear suspicious based on specific checks performed during the account login stage. --------------------------------------------- https://www.bleepingcomputer.com/news/security/microsoft-authenticator-now-… ∗∗∗ MacBook Pro M3 läuft unter Umständen noch mit altem macOS – Update nicht möglich ∗∗∗ --------------------------------------------- Auf manchem neuen MacBook Pro M3 läuft eine Version von macOS 13, die gravierende Sicherheitslücken hat. Sie lässt sich offenbar nicht direkt updaten. --------------------------------------------- https://www.heise.de/-9355709 ∗∗∗ New GootLoader Malware Variant Evades Detection and Spreads Rapidly ∗∗∗ --------------------------------------------- A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. --------------------------------------------- https://thehackernews.com/2023/11/new-gootloader-malware-variant-evades.html ∗∗∗ Phishing With Dynamite ∗∗∗ --------------------------------------------- Token stealing is getting harder. Instead, stealing whole logged-in browser instances may be an easier and more generic approach. One attack, known as “browser-in-the-middle” (BitM), makes it possible to virtually place a user in front of our browser and request them to log in for us. One of my old work buddies referred to it as “phishing with dynamite” after using it on a few social engineering campaigns. --------------------------------------------- https://posts.specterops.io/phishing-with-dynamite-7d33d8fac038 ∗∗∗ D0nut encrypt me, I have a wife and no backups ∗∗∗ --------------------------------------------- Our technical experts have written a blog series focused on Tactics, Techniques and Procedures (TTP’s) deployed by four ransomware families recently observed during NCC Group’s incident response engagements. In case you missed it, last time we analysed an Incident Response engagement involving BlackCat Ransomware. In this instalment, we take a deeper dive into the D0nut extortion group. --------------------------------------------- https://research.nccgroup.com/2023/11/06/d0nut-encrypt-me-i-have-a-wife-and… ∗∗∗ Post-exploiting a compromised etcd – Full control over the cluster and its nodes ∗∗∗ --------------------------------------------- When considering the attack surface in Kubernetes, we consider certain unauthenticated components, such as the kube-apiserver and kubelet, as well as leaked tokens or credentials that grant access to certain cluster features, and non-hardened containers that may provide access to the underlying host. However, when discussing etcd, it is often perceived solely as an information storage element within the cluster from which secrets can be extracted. However, etcd is much more than that. --------------------------------------------- https://research.nccgroup.com/2023/11/07/post-exploiting-a-compromised-etcd… ∗∗∗ Generating IDA Type Information Libraries from Windows Type Libraries ∗∗∗ --------------------------------------------- In this quick-post, well explore how to convert Windows type libraries (TLB) into IDA type information libraries (TIL). --------------------------------------------- https://blog.nviso.eu/2023/11/07/generating-ida-type-information-libraries-… ∗∗∗ CISA Published When to Issue VEX Information ∗∗∗ --------------------------------------------- This guide explains the circumstances and events that could lead an entity to issue VEX information and describes the entities that create or consume VEX information. Whether, and when, to issue VEX information is a business decision for most suppliers and possibly a more individual decision for independent open source developers. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/11/06/cisa-published-when-issu… ===================== = Vulnerabilities = ===================== ∗∗∗ Sicherheitsupdates: Zwei kritische Lücken bedrohen Monitoringtool Veeam One ∗∗∗ --------------------------------------------- Die Entwickler haben in Veeam One unter anderem zwei kritische Schwachstellen geschlossen. Im schlimmsten Fall kann Schadcode auf Systeme gelangen. --------------------------------------------- https://www.heise.de/-9354987 ∗∗∗ WS_FTP Server Arbitrary File Upload CVE-2023-42659 - (CRITICAL) ∗∗∗ --------------------------------------------- In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the ability to craft an API call which allows them to upload a file to a specified location on the underlying operating system hosting the WS_FTP Server application. --------------------------------------------- https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-Novembe… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (trapperkeeper-webserver-jetty9-clojure), Mageia (libsndfile, packages, thunderbird, and x11-server), Oracle (.NET 6.0), SUSE (kernel, kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools- container, virt-operator-container, redis, and squid), and Ubuntu (gsl). --------------------------------------------- https://lwn.net/Articles/950523/ ∗∗∗ 37 Vulnerabilities Patched in Android With November 2023 Security Updates ∗∗∗ --------------------------------------------- The Android security updates released this week resolve 37 vulnerabilities, including a critical information disclosure bug. --------------------------------------------- https://www.securityweek.com/37-vulnerabilities-patched-in-android-with-nov… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ GE MiCOM S1 Agile ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-311-23 ∗∗∗ Zyxel security advisory for improper privilege management vulnerability in GS1900 series switches ∗∗∗ --------------------------------------------- https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.11.2023
by Daily end-of-shift report 06 Nov '23

06 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 03-11-2023 18:00 − Montag 06-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Microsoft Exchange: Vier 0-day-Schwachstellen ermöglichen RCE-Angriffe und Datenklau ∗∗∗ --------------------------------------------- Die Zero Day Initiative (ZDI) von Trend Micro hat gerade vier ungepatchte Schwachstellen (sogenannte 0-Days) in Microsoft Exchange öffentlich gemacht. Diese wurden im September 2023 an Microsoft gemeldet und ZDI stuft die mit CVSS-Scores von 7.1 bis 7.5 ein. Microsofts Sicherheitsexperten sehen die Schwachstellen als nicht so schwerwiegend an, dass diese ein sofortiges Handeln erfordern (zur Ausnutzung sei eine Authentifizierung erforderlich). Die Microsoft-Entwickler haben Fixes "für später" angekündigt. Daher ist die Zero Day Initiative an die Öffentlichkeit gegangen, da man trotzdem die Möglichkeit für RCE-Angriffe und Datenklau sieht. --------------------------------------------- https://www.borncity.com/blog/2023/11/04/microsoft-exchange-vier-0-day-schw… ∗∗∗ Sicherheitsupdates QNAP: Angreifer können eigene Befehle auf NAS ausführen ∗∗∗ --------------------------------------------- Wichtige Sicherheitspatches sichern Netzwerkspeicher von QNAP ab. Unbefugte können Daten einsehen. --------------------------------------------- https://www.heise.de/-9354109.html ∗∗∗ E-Mail von A1 mit einer Rechnung über € 289,60 ist Fake ∗∗∗ --------------------------------------------- Aktuell werden A1-Kund:innen mit einer gefälschten Rechnung über € 289,60 verunsichert. Im E-Mail – angeblich von A1 – steht, dass der Rechnungsbetrag „heute“ von Ihrem Bankkonto bzw. Ihrer Kreditkarte abgebucht wird. Im Anhang finden Sie die Infos zu Ihrer Rechnung. Wenn Sie auf den Anhang klicken, werden Sie auf eine gefälschte Login-Seite geführt. Kriminelle stehlen damit Ihre Zugangs- und Bankdaten! --------------------------------------------- https://www.watchlist-internet.at/news/e-mail-von-a1-mit-einer-rechnung-ueb… ∗∗∗ Socks5Systemz proxy service infects 10,000 systems worldwide ∗∗∗ --------------------------------------------- A proxy botnet called Socks5Systemz has been infecting computers worldwide via the PrivateLoader and Amadey malware loaders, currently counting 10,000 infected devices. --------------------------------------------- https://www.bleepingcomputer.com/news/security/socks5systemz-proxy-service-… ∗∗∗ Cybercrime service bypasses Android security to install malware ∗∗∗ --------------------------------------------- A new dropper-as-a-service (DaaS) named SecuriDropper has emerged, using a method that bypasses Android 13s Restricted Settings to install malware on devices and grant them access to the Accessibility Services. --------------------------------------------- https://www.bleepingcomputer.com/news/security/cybercrime-service-bypasses-… ∗∗∗ TellYouThePass ransomware joins Apache ActiveMQ RCE attacks ∗∗∗ --------------------------------------------- Internet-exposed Apache ActiveMQ servers are also targeted in TellYouThePass ransomware attacks targeting a critical remote code execution (RCE) vulnerability previously exploited as a zero-day. --------------------------------------------- https://www.bleepingcomputer.com/news/security/tellyouthepass-ransomware-jo… ∗∗∗ Gaming-related cyberthreats in 2023: Minecrafters targeted the most ∗∗∗ --------------------------------------------- Gaming-related threat landscape in 2023: desktop and mobile malware disguised as Minecraft, Roblox and other popular games, and the most widespread phishing schemes. --------------------------------------------- https://securelist.com/game-related-threat-report-2023/110960/ ∗∗∗ Google Warns How Hackers Could Abuse Calendar Service as a Covert C2 Channel ∗∗∗ --------------------------------------------- Google is warning of multiple threat actors sharing a public proof-of-concept (PoC) exploit that leverages its Calendar service to host command-and-control (C2) infrastructure. The tool, called Google Calendar RAT (GCR), employs Google Calendar Events for C2 using a Gmail account. It was first published to GitHub in June 2023. --------------------------------------------- https://thehackernews.com/2023/11/google-warns-of-hackers-absing-calendar.h… ∗∗∗ Persistence – Windows Telemetry ∗∗∗ --------------------------------------------- Microsoft has introduced the compatibility telemetry in order to collect usage and performance data about Windows systems [...] TrustedSec has identified that it is feasible to abuse the Windows telemetry mechanism for persistence during red team operations if elevated access has been achieved. --------------------------------------------- https://pentestlab.blog/2023/11/06/persistence-windows-telemetry/ ∗∗∗ What is Classiscam Scam-as-a-Service? ∗∗∗ --------------------------------------------- "The Classiscam scam-as-a-service operation has broadened its reach worldwide, targeting many more brands, countries, and industries, causing more significant financial damage than before,” touts Bleeping Computer. So just what is it? What is Classiscam? It’s a bird. It’s a plane. It’s - a pyramid? Classiscam is an enterprising criminal operation that uses a division of labor to organize low-level phishers into classified site scammers and takes a cut off the top. --------------------------------------------- https://www.tripwire.com/state-of-security/what-classiscam-scam-service ∗∗∗ Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 ∗∗∗ --------------------------------------------- As of November 5, 2023, Rapid7 Managed Detection and Response (MDR) is observing exploitation of Atlassian Confluence in multiple customer environments, including for ransomware deployment. We have confirmed that at least some of the exploits are targeting CVE-2023-22518. --------------------------------------------- https://www.rapid7.com/blog/post/2023/11/06/etr-rapid7-observed-exploitatio… ∗∗∗ Your printer is not your printer ! - Hacking Printers at Pwn2Own Part II ∗∗∗ --------------------------------------------- Based on our previous research, we also discovered Pre-auth RCE vulnerabilities((CVE-2023-0853、CVE-2023-0854) in other models of Canon printers. For the HP vulnerability, we had a collision with another team. In this section, we will detail the Canon and HP vulnerabilities we exploited during Pwn2own Toronto. --------------------------------------------- https://devco.re/blog/2023/11/06/your-printer-is-not-your-printer-hacking-p… ∗∗∗ Provocative Facebook Ads Leveraged to Deliver NodeStealer Malware ∗∗∗ --------------------------------------------- Beware of Provocative Facebook Ads, Warn Researchers! --------------------------------------------- https://www.hackread.com/provocative-facebook-ads-nodestealer-malware/ ∗∗∗ Scanning KBOM for Vulnerabilities with Trivy ∗∗∗ --------------------------------------------- Early this summer we announced the release of Kubernetes Bills of Material (KBOM) as part of Trivy, our all in one, popular open source security scanner. In the blog we discussed how KBOM is the manifest of all the important components that make up your Kubernetes cluster: Control plane components, Node Components, and Addons, including their versions and images. --------------------------------------------- https://blog.aquasec.com/scanning-kbom-for-vulnerabilities-with-trivy ∗∗∗ Security updates 1.6.5 and 1.5.6 released ∗∗∗ --------------------------------------------- We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They all contain a fix for recently reported security vulnerability. [...] We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions. --------------------------------------------- https://roundcube.net/news/2023/11/05/security-updates-1.6.5-and-1.5.6 ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium, open-vm-tools, openjdk-17, pmix, and trafficserver), Fedora (netconsd, podman, suricata, and usd), Oracle (.NET 6.0, .NET 7.0, binutils, ghostscript, java-1.8.0-openjdk, kernel, and squid), SUSE (apache-ivy, gstreamer-plugins-bad, kernel, nodejs12, opera, poppler, rubygem-activesupport-5.2, tiff, util-linux, and virtualbox), and Ubuntu (krb5). --------------------------------------------- https://lwn.net/Articles/950413/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.11.2023
by Daily end-of-shift report 03 Nov '23

03 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 02-11-2023 18:00 − Freitag 03-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ New macOS KandyKorn malware targets cryptocurrency engineers ∗∗∗ --------------------------------------------- A new macOS malware dubbed KandyKorn has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-macos-kandykorn-malware-… ∗∗∗ Atlassian warns of exploit for Confluence data wiping bug, get patching ∗∗∗ --------------------------------------------- Atlassian warned admins that a public exploit is now available for a critical Confluence security flaw that can be used in data destruction attacks targeting Internet-exposed and unpatched instances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/atlassian-warns-of-exploit-f… ∗∗∗ Spyware Designed for Telegram Mods Also Targets WhatsApp Add-Ons ∗∗∗ --------------------------------------------- Researchers discovered spyware designed to steal from Android devices and from Telegram mods can also reach WhatsApp users. --------------------------------------------- https://www.darkreading.com/dr-global/spyware-designed-for-telegram-mods-al… ∗∗∗ Kinsing Actors Exploiting Recent Linux Flaw to Breach Cloud Environments ∗∗∗ --------------------------------------------- The threat actors linked to Kinsing have been observed attempting to exploit the recently disclosed Linux privilege escalation flaw called Looney Tunables as part of a "new experimental campaign" designed to breach cloud environments. --------------------------------------------- https://thehackernews.com/2023/11/kinsing-actors-exploit-linux-flaw-to.html ∗∗∗ 48 Malicious npm Packages Found Deploying Reverse Shells on Developer Systems ∗∗∗ --------------------------------------------- A new set of 48 malicious npm packages have been discovered in the npm repository with capabilities to deploy a reverse shell on compromised systems. "These packages, deceptively named to appear legitimate, contained obfuscated JavaScript designed to initiate a reverse shell on package install," software supply chain security firm Phylum said. --------------------------------------------- https://thehackernews.com/2023/11/48-malicious-npm-packages-found.html ∗∗∗ Prioritising Vulnerabilities Remedial Actions at Scale with EPSS ∗∗∗ --------------------------------------------- In this article, I’m presenting the Exploit Prediction Scoring System and its practical use cases in tandem with Common Vulnerability Scoring System. --------------------------------------------- https://itnext.io/prioritising-vulnerabilities-remedial-actions-at-scale-wi… ∗∗∗ Einstufung von Sicherheitslücken: Der CVSS-4.0-Standard ist da ∗∗∗ --------------------------------------------- Von niedrig bis kritisch: Das Common Vulnerability Scoring System (CVSS) hat einen Versionssprung vollzogen. --------------------------------------------- https://www.heise.de/-9352555 ∗∗∗ Apples "Wo ist": Keylogger-Tastatur nutzt Ortungsnetz zum Passwortversand ∗∗∗ --------------------------------------------- Eigentlich soll es helfen, verlorene Dinge aufzuspüren. Unsere Keylogger-Tastatur nutzt Apples "Wo ist"-Ortungsnetz jedoch zum Ausschleusen von Daten. --------------------------------------------- https://www.heise.de/-9342791 ∗∗∗ Lücke in VMware ONE UEM ermöglicht Login-Klau ∗∗∗ --------------------------------------------- Durch eine unsichere Weiterleitung können Angreifer SAML-Tokens angemeldeter Nutzer klauen und deren Zugänge übernehmen. VMware stellt Updates bereit. --------------------------------------------- https://www.heise.de/-9352599 ∗∗∗ Should you allow your browser to remember your passwords? ∗∗∗ --------------------------------------------- It’s very convenient to store your passwords in your browser. But is it a good idea? --------------------------------------------- https://www.malwarebytes.com/blog/news/2023/11/should-you-allow-your-browse… ∗∗∗ You’d be surprised to know what devices are still using Windows CE ∗∗∗ --------------------------------------------- Windows CE — an operating system that, despite being out for 27 years, never had an official explanation for why it was called “CE” — finally reached its official end-of-life period this week. This was Microsoft’s first operating system for embedded and pocket devices, making an appearance on personal pocket assistants, some of the first BlackBerry-likes, laptops and more during its lifetime. --------------------------------------------- https://blog.talosintelligence.com/threat-source-newsletter-nov-2-2023/ ===================== = Vulnerabilities = ===================== ∗∗∗ QNAP Security Advisories 2023-11-04 ∗∗∗ --------------------------------------------- QNAP released 4 new security advisories (2x Critical, 2x Medium). Music Station, QTS, QuTS hero, QuTScloud, Multimedia Console and Media Streaming add-on. --------------------------------------------- https://www.qnap.com/en-us/security-advisories ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (phppgadmin and vlc), Fedora (attract-mode, chromium, and netconsd), Red Hat (.NET 7.0, c-ares, curl, ghostscript, insights-client, python, squid, and squid:4), SUSE (kernel and roundcubemail), and Ubuntu (libsndfile). --------------------------------------------- https://lwn.net/Articles/950061/ ∗∗∗ Vulnerability in IBM SDK, Java Technology Edition may affect IBM Operations Analytics Predictive Insights ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7066311 ∗∗∗ Multiple security vulnerabilities in Go may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7066400 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.11.2023
by Daily end-of-shift report 02 Nov '23

02 Nov '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 31-10-2023 18:00 − Donnerstag 02-11-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ New CVSS 4.0 vulnerability severity rating standard released ∗∗∗ --------------------------------------------- The Forum of Incident Response and Security Teams (FIRST) has officially released CVSS v4.0, the next generation of its Common Vulnerability Scoring System standard, eight years after CVSS v3.0, the previous major version. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-cvss-40-vulnerability-se… ∗∗∗ Nur zwei wurden gepatcht: Schwachstellen in 34 Treibern gefährden Windows-Systeme ∗∗∗ --------------------------------------------- Sicherheitsforscher der VMware Threat Analysis Unit (Tau) haben Schwachstellen in insgesamt 34 verschiedenen Windows-Gerätetreibern identifiziert. Böswillige Akteure können Firmwares gezielt manipulieren und sich auf Zielsystemen höhere Rechte verschaffen. "Alle Treiber geben Nicht-Admin-Benutzern volle Kontrolle über die Geräte", erklären die Forscher in ihrem Bericht. --------------------------------------------- https://www.golem.de/news/nur-zwei-wurden-gepatcht-schwachstellen-in-34-tre… ∗∗∗ Windows 11, version 23H2 security baseline ∗∗∗ --------------------------------------------- This release includes several changes to further assist in the security of enterprise customers. Changes have been made to provide additional protections to the local admin account, Microsoft Defender Antivirus updates, and a new setting in response to an MSRC bulletin. --------------------------------------------- https://techcommunity.microsoft.com/t5/microsoft-security-baselines/windows… ∗∗∗ Moderne Telefonbetrüger: Wie Betrüger Geld mit nur einem Telefonanruf stehlen ∗∗∗ --------------------------------------------- In diesem Blogbeitrag wird eine Schwachstelle in einer Bankanwendung beschrieben, die es Angreifern ermöglicht, unbemerkt Geldtransaktionen von bis zu 5.000 € im Namen anderer Benutzer durchzuführen. Darüber hinaus werden weitere mögliche Angriffsszenarien beschrieben, mit denen persönliche Informationen abgegriffen werden können. --------------------------------------------- https://sec-consult.com/de/blog/detail/moderne-telefonbetrueger-wie-betrueg… ∗∗∗ Jetzt patchen! Attacken auf BIG-IP-Appliances beobachtet ∗∗∗ --------------------------------------------- F5 warnt vor Angriffen auf BIG-IP-Appliances. Sicherheitspatches stehen bereit. Eine Lücke gilt als kritisch. --------------------------------------------- https://www.heise.de/-9350108 ∗∗∗ Sicherheitslücken: Angreifer können Cisco-Firewalls manipulieren ∗∗∗ --------------------------------------------- Mehrere Schwachstellen gefährden unter anderem Cisco Firepower und Identity Services Engine. Patches sind verfügbar. --------------------------------------------- https://www.heise.de/-9351087 ∗∗∗ MITRE ATT&CK v14 released ∗∗∗ --------------------------------------------- MITRE has released MITRE ATT&CK v14, the newest iteration of its popular investigation framework / knowledge base of tactics and techniques employed by cyber attackers. MITRE ATT&CK v14 ATT&CK’s goal is to catalog and categorize behaviors of cyber adversaries in real-world attacks. --------------------------------------------- https://www.helpnetsecurity.com/2023/11/02/mitre-attck-v14/ ∗∗∗ Unveiling the Dark Side: A Deep Dive into Active Ransomware Families ∗∗∗ --------------------------------------------- This series will focus on TTP’s deployed by four ransomware families recently observed during NCC Group’s incident response engagements. --------------------------------------------- https://research.nccgroup.com/2023/10/31/unveiling-the-dark-side-a-deep-div… ∗∗∗ Wer hat Mozi getötet? IoT-Zombie-Botnetz wurde endlich zu Grabe tragen ∗∗∗ --------------------------------------------- Wie ESET Research einen Kill-Switch gefunden hat, der dazu benutzt wurde, eines der am weitesten verbreiteten Botnets auszuschalten. --------------------------------------------- https://www.welivesecurity.com/de/eset-research/wer-hat-mozi-getotet-iot-zo… ∗∗∗ Kostenlose Webinar-Reihe „Schutz im Internet“ ∗∗∗ --------------------------------------------- In Kooperation mit der Arbeiterkammer Oberösterreich veranstaltet das ÖIAT (Österreichisches Institut für angewandte Telekommunikation) eine kostenlose Webinar-Reihe zu Themen wie Online-Shopping, Internet-Betrug und Identitätsdiebstahl! --------------------------------------------- https://www.watchlist-internet.at/news/kostenlose-webinar-reihe-schutz-im-i… ∗∗∗ Drupal 9 is end of life - PSA-2023-11-01 ∗∗∗ --------------------------------------------- Drupal 9 relies on several other software projects, including Symfony, CKEditor, and Twig. With Symfony 4's end of life, CKEditor 4's end of life, and Twig 2's end of life all coming up soon, Drupal 9 went end of life on November 1st, 2023. There will be no further releases of Drupal 9. --------------------------------------------- https://www.drupal.org/psa-2023-11-01 ∗∗∗ Warning Against Infostealer Infections Upon Executing Legitimate EXE Files (DLL Hijacking) ∗∗∗ --------------------------------------------- Caution is advised as an Infostealer that prompts the execution of legitimate EXE files is actively being distributed. The threat actor is distributing a legitimate EXE file with a valid signature and a malicious DLL compressed in the same directory. The EXE file itself is legitimate, but when executed in the same directory as the malicious DLL, it automatically runs that malicious DLL. This technique is called DLL hijacking and is often used in the distribution of malware. --------------------------------------------- https://asec.ahnlab.com/en/58319/ ∗∗∗ Attackers use JavaScript URLs, API forms and more to scam users in popular online game “Roblox” ∗∗∗ --------------------------------------------- Where there is a potential for profit there are also people trying to scam others. “Roblox” users can be targeted by scammers (known as “beamers” by “Roblox” players) who attempt to steal valuable items or Robux from other players. This can sometimes be made easier for the scammers because of “Roblox's” young user base. Nearly half of the game’s 65 million users are under the age of 13 who may not be as adept at spotting scams. --------------------------------------------- https://blog.talosintelligence.com/roblox-scam-overview/ ∗∗∗ Suspected Exploitation of Apache ActiveMQ CVE-2023-46604 ∗∗∗ --------------------------------------------- Beginning Friday, October 27, Rapid7 Managed Detection and Response (MDR) identified suspected exploitation of Apache ActiveMQ CVE-2023-46604 in two different customer environments. In both instances, the adversary attempted to deploy ransomware binaries on target systems in an effort to ransom the victim organizations. Based on the ransom note and available evidence, we attribute the activity to the HelloKitty ransomware family, whose source code was leaked on a forum in early October. Rapid7 observed similar indicators of compromise across the affected customer environments, both of which were running outdated versions of Apache ActiveMQ. --------------------------------------------- https://www.rapid7.com/blog/post/2023/11/01/etr-suspected-exploitation-of-a… ===================== = Vulnerabilities = ===================== ∗∗∗ Unpatched Powerful SSRF in Exchange OWA – Getting Response Through Attachments ∗∗∗ --------------------------------------------- As the attacker can abuse this SSRF to retrieve the content of the response, I thought it was a good finding. However, Microsoft did not agree [...] In short: this may get fixed or it may not. If they decide to fix it, the patch may appear in 1 year or in 3 years. In general, we know nothing. Accordingly, we informed Microsoft of our intention to publish this vulnerability as a 0-day advisory and a blog post. As we consider this issue potentially dangerous, we want organizations to be aware of the threat. For this reason, we are providing a PoC HTTP Request to be used for filtering and/or monitoring. --------------------------------------------- https://www.thezdi.com/blog/2023/11/1/unpatched-powerful-ssrf-in-exchange-o… ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- Cisco has released 24 new and 4 updated Security Advisories (2x Critical, 11x High, 15x Medium) --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/Search.x?publicationTypeIDs… ∗∗∗ Critical PHPFox RCE Vulnerability Risked Social Networks ∗∗∗ --------------------------------------------- Heads up, phpFox users! A critical remote code execution vulnerability existed in the phpFox service that allowed community takeovers [...] The researcher urged all phpFox users to update to the latest phpFox release (version 4.8.14 or later) to receive the security fix. --------------------------------------------- https://latesthackingnews.com/2023/10/30/critical-phpfox-rce-vulnerability-… ∗∗∗ Webbrowser: Google Chrome bessert 15 Schwachstellen aus und kann HTTPS-Upgrades ∗∗∗ --------------------------------------------- Google hat den Webbrowser Chrome in Version 119 veröffentlicht. Sie schließt 15 Sicherheitslücken und etabliert den HTTPS-Upgrade-Mechanismus. --------------------------------------------- https://www.heise.de/-9349956 ∗∗∗ Sicherheitsupdates Nvidia: GeForce-Treiberlücken gefährden PCs ∗∗∗ --------------------------------------------- Nvidias Entwickler haben im Grafikkartentreiber und der VGPU-Software mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://www.heise.de/-9351600 ∗∗∗ Solarwinds Platform 2023.4 schließt Codeschmuggel-Lücken ∗∗∗ --------------------------------------------- Solarwinds hat das Platform-Update auf Version 2023.4 veröffentlicht. Neben diversen Fehlerkorrekturen schließt es auch Sicherheitslücken. --------------------------------------------- https://www.heise.de/-9351584 ∗∗∗ VMSA-2023-0025 ∗∗∗ --------------------------------------------- An open redirect vulnerability in VMware Workspace ONE UEM console was responsibly reported to VMware. Updates are available to remediate this vulnerability in affected VMware products. (CVE-2023-20886) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0025.html ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (h2o, open-vm-tools, pmix, and zookeeper), Gentoo (GitPython), Oracle (firefox, java-11-openjdk, java-17-openjdk, libguestfs-winsupport, nginx:1.22, and thunderbird), Red Hat (samba), SUSE (container-suseconnect, libsndfile, and slurm), and Ubuntu (krb5, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive, linux-laptop, linux-nvidia-6.2, linux-oem-6.1, linux-raspi, open-vm-tools, and xorg-server). --------------------------------------------- https://lwn.net/Articles/949612/ ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Gentoo (Netatalk), Oracle (firefox), Red Hat (.NET 6.0, .NET 6.0, .NET 7.0, binutils, and qemu-kvm), SUSE (gcc13, tomcat, and xorg-x11-server), and Ubuntu (axis, libvpx, linux-starfive, thunderbird, and xrdp). --------------------------------------------- https://lwn.net/Articles/949820/ ∗∗∗ [R1] Nessus Version 10.5.6 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-36 ∗∗∗ [R1] Nessus Agent Version 10.4.3 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-38 ∗∗∗ [R1] Nessus Version 10.6.2 Fixes Multiple Vulnerabilities ∗∗∗ --------------------------------------------- https://www.tenable.com/security/tns-2023-37 ∗∗∗ Drupal: Paragraphs admin - Moderately critical - - SA-CONTRIB-2023-049 ∗∗∗ --------------------------------------------- https://www.drupal.org/sa-contrib-2023-049 ∗∗∗ Open Exchange: 2023-08-01: OXAS-ADV-2023-0004 ∗∗∗ --------------------------------------------- https://documentation.open-xchange.com/security/advisories/txt/oxas-adv-202… ∗∗∗ IBM Security Bulletin ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Weintek EasyBuilder Pro ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-05 ∗∗∗ Schneider Electric SpaceLogic C-Bus Toolkit ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-06 ∗∗∗ Franklin Fueling System TS-550 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-04 ∗∗∗ Red Lion Crimson ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-01 ∗∗∗ Mitsubishi Electric MELSEC iQ-F Series CPU Module ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02 ∗∗∗ Mitsubishi Electric MELSEC Series ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 31.10.2023
by Daily end-of-shift report 31 Oct '23

31 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Montag 30-10-2023 18:00 − Dienstag 31-10-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ CVE-2023-4966 in Citrix NetScaler ADC und NetScaler Gateway wurde bereits als 0-day ausgenutzt ∗∗∗ --------------------------------------------- Uns wurde inzwischen von drei Organisationen in Österreich berichtet, dass Angreifer aufgrund der Sicherheitslücke im Citrix Server in ihren Systemen aktiv geworden sind, bevor Patches von Citrix verfügbar waren. Es wurden Befehle zur Erkundung des Systems und erste Schritte in Richtung lateral Movement beobachtet. Wir gehen inzwischen von einer weitläufigen Ausnutzung dieses 0-days aus. --------------------------------------------- https://cert.at/de/aktuelles/2023/10/cve-2023-4966-0day ∗∗∗ Exploit für Cisco IOS XE veröffentlicht, Infektionszahlen weiter hoch ∗∗∗ --------------------------------------------- Sicherheitsforscher haben den Exploit für Cisco IOS XE untersucht und seinen simplen Trick aufgedeckt. Hunderte Geräte mit Hintertür sind noch online. --------------------------------------------- https://www.heise.de/-9349296 ∗∗∗ Multiple Layers of Anti-Sandboxing Techniques, (Tue, Oct 31st) ∗∗∗ --------------------------------------------- It has been a while that I did not find an interesting malicious Python script. All the scripts that I recently spotted were always the same: a classic intostealer using Discord as C2 channel. Today I found one that contains a lot of anti-sanboxing techniques. Let's review them. For malware, it's key to detect the environment where they are executed. When detonated inside a sandbox (automatically or, manually, by an Analyst), they will be able to change their behaviour (most likely, do nothing). --------------------------------------------- https://isc.sans.edu/diary/rss/30362 ∗∗∗ Malicious NuGet Packages Caught Distributing SeroXen RAT Malware ∗∗∗ --------------------------------------------- Cybersecurity researchers have uncovered a new set of malicious packages published to the NuGet package manager using a lesser-known method for malware deployment. --------------------------------------------- https://thehackernews.com/2023/10/malicious-nuget-packages-caught.html ∗∗∗ LDAP authentication in Active Directory environments ∗∗∗ --------------------------------------------- Understanding the different types of LDAP authentication methods is fundamental to apprehend subjects such as relay attacks or countermeasures. This post introduces them through the lens of Python libraries. --------------------------------------------- https://offsec.almond.consulting/ldap-authentication-in-active-directory-en… ∗∗∗ Programmiersprache: End of Life für PHP 8.0 und Neues für PHP 8.3 ∗∗∗ --------------------------------------------- Die kommende Version 8.3 der Programmiersprache PHP hält einige Neuerungen bereit, und PHP 8.0 nähert sich dem Supportende. --------------------------------------------- https://www.heise.de/-9348772 ∗∗∗ Verkaufen auf etsy: Vorsicht vor betrügerischen Anfragen ∗∗∗ --------------------------------------------- Auf allen gängigen Verkaufsplattformen tummeln sich Kriminelle. Sie nehmen vor allem neue Nutzer:innen ins Visier, die die Abläufe noch nicht kennen. Wir zeigen Ihnen, wie Sie betrügerische Anfragen erkennen und sicher verkaufen! --------------------------------------------- https://www.watchlist-internet.at/news/verkaufen-auf-etsy-vorsicht-vor-betr… ∗∗∗ Lateral Movement: Abuse the Power of DCOM Excel Application ∗∗∗ --------------------------------------------- In this post, we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the distributed component object model (DCOM) Excel application. This technique is built upon Matt Nelson’s initial research on “Lateral Movement using Excel.Application and DCOM”. --------------------------------------------- https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-… ∗∗∗ Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla) ∗∗∗ --------------------------------------------- While tracking the evolution of Pensive Ursa (aka Turla, Uroburos), Unit 42 researchers came across a new, upgraded variant of Kazuar. Not only is Kazuar another name for the enormous and dangerous cassowary bird, Kazuar is an advanced and stealthy .NET backdoor that Pensive Ursa usually uses as a second stage payload. --------------------------------------------- https://unit42.paloaltonetworks.com/pensive-ursa-uses-upgraded-kazuar-backd… ===================== = Vulnerabilities = ===================== ∗∗∗ Kritische Sicherheitslücke in Confluence Data Center und Confluence Server ∗∗∗ --------------------------------------------- In allen Versionen von Confluence Data Center und Confluence Server existiert eine kritische Sicherheitslücke (CVE-2023-22518 CVSS: 9.1). Das Ausnutzen der Sicherheitslücke auf betroffenen Geräten ermöglicht nicht authentifizierten Angreifern den Zugriff auf interne Daten des Systems. Obwohl Atlassian bislang keine Informationen zur aktiven Ausnutzung der Lücke hat, wird das zeitnahe Einspielen der verfügbaren Patches empfohlen. --------------------------------------------- https://cert.at/de/warnungen/2023/10/confluence-cve-2023-22518 ∗∗∗ RCE exploit for Wyze Cam v3 publicly released, patch now ∗∗∗ --------------------------------------------- A security researcher has published a proof-of-concept (PoC) exploit for Wyze Cam v3 devices that opens a reverse shell and allows the takeover of vulnerable devices [...] Wyze released firmware update version 4.36.11.7071, which addresses the identified issues, on October 22, 2023, so users are recommended to apply the security update as soon as possible. --------------------------------------------- https://www.bleepingcomputer.com/news/security/rce-exploit-for-wyze-cam-v3-… ∗∗∗ Unpatched NGINX ingress controller bugs can be abused to steal Kubernetes cluster secrets ∗∗∗ --------------------------------------------- Three unpatched high-severity bugs in the NGINX ingress controller can be abused by miscreants to steal credentials and other secrets from Kubernetes clusters. The vulnerabilities, tracked as CVE-2023-5043, CVE-2023-5044 and CVE-2022-4886, were disclosed on October 27, and are listed as currently awaiting triage. It's unclear if any of the flaws have been exploited. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2023/10/30/unpatched_ng… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jetty9, node-browserify-sign, request-tracker4, and request-tracker5), Fedora (golang-github-altree-bigfloat, golang-github-seancfoley-bintree, golang-github-seancfoley-ipaddress, kitty, slurm, and thunderbird), Gentoo (ConnMan, libxslt, and Salt), Mageia (chromium-browser-stable), Red Hat (firefox, libguestfs-winsupport, and thunderbird), SUSE (clamav, gcc13, gstreamer-plugins-bad, icu73_2, java-17-openjdk, nodejs10, poppler, python-Werkzeug, redis, thunderbird, webkit2gtk3, xorg-x11-server, and xwayland), and Ubuntu (kernel, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-iot, linux-raspi, linux-raspi-5.4, and mysql-8.0). --------------------------------------------- https://lwn.net/Articles/949391/ ∗∗∗ FujiFilm printer credentials encryption issue fixed ∗∗∗ --------------------------------------------- Many multi-function printers made by FujiFilm Business Innovation Corporation (Fujifilm) which includes Apeos, ApeosPro, PrimeLink and RevoriaPress brands as well as Xerox Corporation (Xerox) which includes VersaLink, PrimeLink, and WorkCentre brands, allow administrators to store credentials on them to allow users to upload scans and other files to FTP and SMB file servers. With the default configuration of these printers, it’s possible to retrieve these credentials in an encrypted format without authenticating to the printer. A vulnerability in the encryption process of these credentials means that you can decrypt them with responses from the web interface. This has been given the ID CVE-2023-46327. --------------------------------------------- https://www.pentestpartners.com/security-blog/fujifilm-printer-credentials-… ∗∗∗ [R1] Stand-alone Security Patch Available for Tenable Security Center versions 5.23.1, 6.0.0, 6.1.0, 6.1.1, and 6.2.0: SC-202310.1 ∗∗∗ --------------------------------------------- TNS-2023-35 / Critical 9.8 / 8.8 (CVE-2023-38545), 3.7 / 3.4 (CVE-2023-38546) --------------------------------------------- https://www.tenable.com/security/tns-2023-35 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ INEA ME RTU ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02 ∗∗∗ Zavio IP Camera ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-03 ∗∗∗ Sonicwall: TunnelCrack Vulnerabilities ∗∗∗ --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.10.2023
by Daily end-of-shift report 30 Oct '23

30 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 27-10-2023 18:00 − Montag 30-10-2023 18:00 Handler: Michael Schlagenhaufer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Flying under the Radar: The Privacy Impact of multicast DNS, (Mon, Oct 30th) ∗∗∗ --------------------------------------------- The recent patch to iOS/macOS for CVE-2023-42846 made me think it is probably time to write up a reminder about the privacy impact of UPNP and multicast DNS. This is not a new issue, but it appears to have been forgotten a bit [vuln]. In particular, Apple devices are well-known for their verbose multicast DNS messages. --------------------------------------------- https://isc.sans.edu/diary/rss/30358 ∗∗∗ Hackers Using MSIX App Packages to Infect Windows PCs with GHOSTPULSE Malware ∗∗∗ --------------------------------------------- A new cyber attack campaign has been observed using spurious MSIX Windows app package files for popular software such as Google Chrome, Microsoft Edge, Brave, Grammarly, and Cisco Webex to distribute a novel malware loader dubbed GHOSTPULSE. --------------------------------------------- https://thehackernews.com/2023/10/hackers-using-msix-app-packages-to.html ∗∗∗ Turning a boring file move into a privilege escalation on Mac ∗∗∗ --------------------------------------------- Hopefully other people find this trick useful, beyond just Parallels. You can find the code for this exploit on my GitHub [...] 2023-07-06 - fix released in version 18.3.2. --------------------------------------------- https://pwn.win/2023/10/28/file-move-privesc-mac.html ∗∗∗ citrix-logchecker - Parse citrix netscaler logs to check for signs of CVE-2023-4966 exploitation ∗∗∗ --------------------------------------------- CERT.at stellt via Github ein Skript zur Verfügung, welches genutzt werden kann, um Citrix-Logs nach potenziell übernommenen Sessions zu durchsuchen. Sollten auffällige Sessions gefunden werden, wird eine tiefergehende Analyse empfohlen. --------------------------------------------- https://github.com/certat/citrix-logchecker ∗∗∗ NATO und Behörden von kritischer Lücke in Lernplattform ILIAS betroffen ∗∗∗ --------------------------------------------- Gleich drei Sicherheitslücken in der Open-Source-Lernplattform ILIAS erlauben Codeschmuggel. Der Hersteller stellt eine aktualisierte Version bereit. --------------------------------------------- https://www.heise.de/-9344057.html ∗∗∗ Forscher: Sicherheitslücken beim Roaming bleiben auch bei 5G eine große Gefahr ∗∗∗ --------------------------------------------- Mobilfunker und Regulierer unternehmen laut einem Bericht des Citizen Lab zu wenig, um Sicherheitsschwächen der Roaming- und Abrechnungsprotokolle auszumerzen. --------------------------------------------- https://www.heise.de/-9347577.html ∗∗∗ F5 fixes critical BIG-IP vulnerability, PoC is public (CVE-2023-46747) ∗∗∗ --------------------------------------------- F5 Networks has released hotfixes for three vulnerabilities affecting its BIG-IP multi-purpose networking devices/modules, including a critical authentication bypass vulnerability (CVE-2023-46747) that could lead to unauthenticated remote code execution (RCE). About CVE-2023-46747 Discovered and reported by Thomas Hendrickson and Michael Weber of Praetorian Security, CVE-2023-46747 is a request smuggling bug in the Apache JServ Protocol (AJP) used by the vulnerable devices. [...] Praetorian has updated their blog post to include all the technical details, since Project Discovery has created a Nuclei template with the full CVE-2023-46747 attack chain. --------------------------------------------- https://www.helpnetsecurity.com/2023/10/30/cve-2023-46747/ ∗∗∗ Attackers Can Use Modified Wikipedia Pages to Mount Redirection Attacks on Slack ∗∗∗ --------------------------------------------- Researchers document the Wiki-Slack attack, a new technique that uses modified Wikipedia pages to target end users on Slack. --------------------------------------------- https://www.securityweek.com/attackers-can-use-modified-wikipedia-pages-to-… ∗∗∗ Vorsicht vor Fake-Shops mit günstigen Lebensmitteln ∗∗∗ --------------------------------------------- Mittlerweile können Sie auch Lebensmittel online bestellen. Bedenken Sie aber: Auch hier gibt es betrügerische Angebote. Kriminelle bieten stark vergünstigte Lebensmittel in Fake-Shops wie leckerwurzede.com an. Wenn Sie dort bestellen, verlieren Sie Ihr Geld! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-fake-shops-mit-guenstig… ∗∗∗ CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys ∗∗∗ --------------------------------------------- We analyze an attack path starting with GitHub IAM exposure and leading to creation of AWS Elastic Compute instances — which TAs used to perform cryptojacking. --------------------------------------------- https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-key… ∗∗∗ NetSupport Intrusion Results in Domain Compromise ∗∗∗ --------------------------------------------- NetSupport Manager is one of the oldest third-party remote access tools still currently on the market with over 33 years of history. This is the first time we will report on a NetSupport RAT intrusion, but malicious use of this tool dates back to at least 2016. During this report, we will analyze a case from January 2023 where a NetSupport RAT was utilized to infiltrate a network. The RAT was then used for persistence and command & control, resulting in a full domain compromise. --------------------------------------------- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature ∗∗∗ --------------------------------------------- Version 2.4: Updated summary to indicate additional fixed releases and updated fixed release table. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (distro-info, distro-info-data, gst-plugins-bad1.0, node-browserify-sign, nss, openjdk-11, and thunderbird), Fedora (chromium, curl, nghttp2, and xorg-x11-server-Xwayland), Gentoo (Dovecot, Rack, rxvt-unicode, and UnZip), Mageia (apache, bind, and vim), Red Hat (varnish:6), SUSE (nodejs12, opera, python-bugzilla, python-Django, and vorbis-tools), and Ubuntu (exim4, firefox, nodejs, and slurm-llnl, slurm-wlm). --------------------------------------------- https://lwn.net/Articles/949238/ ∗∗∗ Mattermost security updates 9.1.1 / 9.0.2 / 8.1.4 (ESR) / 7.8.13 (ESR) released ∗∗∗ --------------------------------------------- We’re informing you about a Mattermost security update, which addresses low- to medium-level severity vulnerabilities. We highly recommend that you apply the update. The security update is available for Mattermost dot releases 9.1.1, 9.0.2, 8.1.4 (Extended Support Release), and 7.8.13 (Extended Support Release), for both Team Edition and Enterprise Edition. --------------------------------------------- https://mattermost.com/blog/mattermost-security-updates-9-1-1-9-0-2-8-1-4-e… ∗∗∗ Inkdrop vulnerable to code injection ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN48057522/ ∗∗∗ 2023-10-30: Cyber Security Advisory - ABB COM600 CODESYS Vulnerabilities ∗∗∗ --------------------------------------------- https://search.abb.com/library/Download.aspx?DocumentID=2NGA001822&Language… ∗∗∗ Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7061278 ∗∗∗ IBM i is vulnerable to a local privilege escalation due to flaws in Management Central (CVE-2023-40685, CVE-2023-40686). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7060686 ∗∗∗ Due to use of Java 8.0.7.11 version, InfoSphere Data Replication is vulnerable to crypto attacks. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7061888 ∗∗∗ IBM Storage Ceph is vulnerable to a stack overflow attack in Golang (CVE-2022-24675) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7061939 ∗∗∗ Multiple vulnerabilities exist in the IBM SDK, Java Technology Edition affect IBM Tivoli Network Manager. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7062331 ∗∗∗ A vulnerability exists in the IBM SDK, Java Technology Edition affecting IBM Tivoli Network Manager (CVE-2023-22045, CVE-2023-22049). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7062330 ∗∗∗ IBM Automation Decision Services October 2023 - Multiple CVEs addressed ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7062348 ∗∗∗ Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7062415 ∗∗∗ Due to the use of OpenSSL IBM Tivoli Netcool System Service Monitors/Application Service Monitors is vulnerable to a denial of service and security bypass restrictions. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7062426 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.10.2023
by Daily end-of-shift report 27 Oct '23

27 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 25-10-2023 18:00 − Freitag 27-10-2023 18:00 Handler: Stephan Richter Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ StripedFly malware framework infects 1 million Windows, Linux hosts ∗∗∗ --------------------------------------------- A sophisticated cross-platform malware platform named StripedFly flew under the radar of cybersecurity researchers for five years, infecting over a million Windows and Linux systems during that time. --------------------------------------------- https://www.bleepingcomputer.com/news/security/stripedfly-malware-framework… ∗∗∗ How to catch a wild triangle ∗∗∗ --------------------------------------------- How Kaspersky researchers obtained all stages of the Operation Triangulation campaign targeting iPhones and iPads, including zero-day exploits, validators, TriangleDB implant and additional modules. --------------------------------------------- https://securelist.com/operation-triangulation-catching-wild-triangle/11091… ∗∗∗ Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction ∗∗∗ --------------------------------------------- Microsoft has been tracking activity related to the financially motivated threat actor Octo Tempest, whose evolving campaigns represent a growing concern for organizations across multiple industries. Octo Tempest leverages broad social engineering campaigns to compromise organizations across the globe with the goal of financial extortion. With their extensive range of tactics, techniques, and procedures (TTPs), the threat actor, from our perspective, is one of the most dangerous financial criminal groups. --------------------------------------------- https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-cross… ∗∗∗ iLeakage: Safari unzureichend vor Spectre-Seitenkanalangriff geschützt ∗∗∗ --------------------------------------------- Sicherheitsforscher sagen, dass Apples Browser nicht ausreichend vor CPU-Seitenkanalangriffen schützt. Angreifer können Daten lesen. Es gibt Schutzmaßnahmen. --------------------------------------------- https://www.heise.de/-9344659 ∗∗∗ CISA, HHS Release Cybersecurity Healthcare Toolkit ∗∗∗ --------------------------------------------- CISA and the HHS have released resources for healthcare and public health organizations to improve their security. --------------------------------------------- https://www.securityweek.com/cisa-hhs-release-cybersecurity-healthcare-tool… ∗∗∗ CVE-2023–4632: Local Privilege Escalation in Lenovo System Updater ∗∗∗ --------------------------------------------- The Lenovo System Update application is designed to allow non-administrators to check for and apply updates to their workstation. During the process of checking for updates, the privileged Lenovo Update application attempts to utilize C:\SSClientCommon\HelloLevel_9_58_00.xml, which doesn’t exist on the filesystem [...] This vulnerability has been fixed in the latest version of the Lenovo System Updater application. --------------------------------------------- https://posts.specterops.io/cve-2023-4632-local-privilege-escalation-in-len… ∗∗∗ ESET APT Activity Report Q2–Q3 2023 ∗∗∗ --------------------------------------------- An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 and Q3 2023 --------------------------------------------- https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2… ∗∗∗ Most common Active Directory misconfigurations and default settings that put your organization at risk ∗∗∗ --------------------------------------------- Introduction In this blog post, we will go over the most recurring (and critical) findings that we discovered when auditing the Active Directory environment of different companies, explain why these configurations can be dangerous, how they can be abused by attackers and how they can be mitigated or remediated. --------------------------------------------- https://blog.nviso.eu/2023/10/26/most-common-active-directory-misconfigurat… ∗∗∗ CVE-2023-4966 Helps Usher In A Baker’s Dozen Of Citrix Tags To Further Help Organizations Mitigate Harm ∗∗∗ --------------------------------------------- Citrixs NetScaler ADC and NetScaler Gateway have, once more, been found to have multiple vulnerabilities, tracked as CVE-2023-4966 and CVE-2023-4967 [...] As of this post’s publish time, GreyNoise has observed just under seventy IP addresses attempting to exploit this vulnerability. --------------------------------------------- https://www.greynoise.io/blog/cve-2023-4966-helps-usher-in-a-bakers-dozen-o… ∗∗∗ CISA Announces Launch of Logging Made Easy ∗∗∗ --------------------------------------------- Today, CISA announces the launch of a new version of Logging Made Easy (LME), a straightforward log management solution for Windows-based devices that can be downloaded and self-installed for free. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/10/27/cisa-announces-launch-lo… ∗∗∗ Rhysida Ransomware Technical Analysis ∗∗∗ --------------------------------------------- Technical analysis of Rhysida Ransomware family that emerged in the Q2 of 2023 --------------------------------------------- https://decoded.avast.io/threatresearch/rhysida-ransomware-technical-analys… ===================== = Vulnerabilities = ===================== ∗∗∗ CISA Releases Nine Industrial Control Systems Advisories ∗∗∗ --------------------------------------------- ICSA-23-299-01 Dingtian DT-R002 ICSA-23-299-02 Centralite Pearl Thermostat ICSA-23-299-03 Ashlar-Vellum Cobalt, Graphite, Xenon, Argon, Lithium ICSA-23-299-04 Rockwell Automation Arena ICSA-23-299-05 Rockwell Automation FactoryTalk View Site Edition ICSA-23-299-06 Rockwell Automation FactoryTalk Services Platform ICSA-23-299-07 Sielco PolyEco FM Transmitter ICSA-23-299-08 Sielco Radio Link and Analog FM Transmitters ICSMA-23-194-01 BD Alaris System with Guardrails Suite MX (Update A) --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/10/26/cisa-releases-nine-indus… ∗∗∗ Cisco Update: HTTP/2 Rapid Reset Attack Affecting Cisco Products: October 2023 ∗∗∗ --------------------------------------------- Version 1.5: Updated the lists of vulnerable products and products confirmed not vulnerable. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco Update: Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature ∗∗∗ --------------------------------------------- Version 2.3: Updated summary to indicate additional fixed releases. Updated fixed release table and SMU table. Updated recommendations to add link to technical FAQ. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Juniper Update: 2023-10 Security Bulletin: Junos OS: jkdsd crash due to multiple telemetry requests (CVE-2023-44188) ∗∗∗ --------------------------------------------- 2023-10-25: Added note that SRX Series devices are not vulnerable to this issue --------------------------------------------- https://supportportal.juniper.net/s/article/2023-10-Security-Bulletin-Junos… ∗∗∗ HPE Aruba Networking Product Security Advisory ∗∗∗ --------------------------------------------- HPE Aruba Networking has released updates to ClearPass Policy Manager that address multiple security vulnerabilities. --------------------------------------------- https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-016.txt ∗∗∗ Sicherheitsupdates: Jenkins-Plug-ins als Einfallstor für Angreifer ∗∗∗ --------------------------------------------- Jenkins kann bei der Softwareentwicklung helfen. Einige Plug-ins weisen Sicherheitslücken auf. Ein paar Updates stehen noch aus. --------------------------------------------- https://www.heise.de/-9344802 ∗∗∗ Sicherheitslücken im X.Org X-Server und Xwayland erlauben Rechteausweitung ∗∗∗ --------------------------------------------- Aktualisierte Fassung des X.Org X-Servers und von Xwayland schließen Sicherheitslücken. Die erlauben die Rechteausweitung oder einen Denial-of-Service. --------------------------------------------- https://www.heise.de/-9345096 ∗∗∗ Rechteausweitung durch Lücke in HP Print and Scan Doctor ∗∗∗ --------------------------------------------- Aktualisierte Software korrigiert einen Fehler im Support-Tool HP Print and Scan Doctor, der die Ausweitung der Rechte im System ermöglicht. --------------------------------------------- https://www.heise.de/-9345192 ∗∗∗ Konfigurationsprogramm von BIG-IP-Appliances als Sprungbrett für Angreifer ∗∗∗ --------------------------------------------- F5 hat wichtige Sicherheitsupdates für BIG-IP-Produkte veröffentlicht. Angreifer können Geräte kompromittieren. --------------------------------------------- https://www.heise.de/-9346460 ∗∗∗ Lücken in Nessus Network Monitor ermöglichen Rechteerhöhung ∗∗∗ --------------------------------------------- Eine neue Version vom Nessus Network Monitor schließt Sicherheitslücken, durch die Angreifer etwa ihre Rechte erhöhen können. --------------------------------------------- https://www.heise.de/news/-9346392 ∗∗∗ VMWare Tools: Schwachstellen erlauben Rechteausweitung ∗∗∗ --------------------------------------------- Die VMware Tools unter Linux, Windows und macOS erlauben Angreifern unter bestimmten Umständen, unbefugt Kommandos abzusetzen. Noch sind nicht alle Updates da. --------------------------------------------- https://www.heise.de/-9346863 ∗∗∗ Wordfence Intelligence Weekly WordPress Vulnerability Report (October 16, 2023 to October 22, 2023) ∗∗∗ --------------------------------------------- Last week, there were 109 vulnerabilities disclosed in 95 WordPress Plugins and 1 WordPress theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 39 Vulnerability Researchers that contributed to WordPress Security last week. --------------------------------------------- https://www.wordfence.com/blog/2023/10/wordfence-intelligence-weekly-wordpr… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (firefox-esr and xorg-server), Fedora (firefox, mbedtls, nodejs18, nodejs20, and xen), Gentoo (libinput, unifi, and USBView), Mageia (python-nltk), Oracle (linux-firmware), Red Hat (nginx:1.22), SUSE (chromium, firefox, java-11-openjdk, jetty-minimal, nghttp2, nodejs18, webkit2gtk3, and zlib), and Ubuntu (linux, linux-lowlatency, linux-oracle-5.15, vim, and xorg-server, xwayland). --------------------------------------------- https://lwn.net/Articles/948930/ ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (chromium and firefox-esr), Fedora (firefox, redis, samba, and xen), Oracle (python39:3.9, python39-devel:3.9), Slackware (mozilla and xorg), and SUSE (libnbd, open-vm-tools, python, sox, vorbis-tools, and zchunk). --------------------------------------------- https://lwn.net/Articles/949057/ ∗∗∗ Critical Mirth Connect Vulnerability Could Expose Sensitive Healthcare Data ∗∗∗ --------------------------------------------- Mirth Connect versions prior to 4.4.1 are vulnerable to CVE-2023-43208, a bypass for an RCE vulnerability. --------------------------------------------- https://www.securityweek.com/critical-mirth-connect-vulnerability-could-exp… ∗∗∗ Apple Releases Security Advisories for Multiple Products ∗∗∗ --------------------------------------------- Apple has released security updates to address vulnerabilities in multiple products. --------------------------------------------- https://www.cisa.gov/news-events/alerts/2023/10/26/apple-releases-security-… ∗∗∗ Schwachstelle CVE-2023-5363 in OpenSSL ∗∗∗ --------------------------------------------- In der Software OpenSSL wurde eine Schwachstelle CVE-2023-5363 gefunden. Die Initialisierung der Verschlüsselungsschlüssellänge und des Initialisierungsvektors in OpenSLL ist fehlerhaft. Für die Linux-Distributionen Debian und Ubuntu ist ein Fix aber bereits verfügbar. --------------------------------------------- https://www.borncity.com/blog/2023/10/27/schwachstelle-cve-2023-5363-in-ope… ∗∗∗ ServiceNow fixt stillschweigend Bug aus 2015 der Datenlecks ermöglichte ∗∗∗ --------------------------------------------- Das US-Unternehmen ServiceNow Inc. bietet eine Cloud-Plattform an, in deren Software wohl seit 2015 ein Bug klaffte, über den Dritte ohne Authentifizierung Informationen abziehen konnten. Nachdem ein Sicherheitsforscher auf die Schwachstelle gestoßen ist, wurde diese stillschweigend in der Cloud-Lösung beseitigt. --------------------------------------------- https://www.borncity.com/blog/2023/10/27/servicenow-fixt-stillschweigend-bu… ∗∗∗ 9 vulnerabilities found in VPN software, including 1 critical issue that could lead to remote code execution ∗∗∗ --------------------------------------------- Attackers could exploit these vulnerabilities in the SoftEther VPN solution for individual and enterprise users to force users to drop their connections or execute arbitrary code on the targeted machine. --------------------------------------------- https://blog.talosintelligence.com/vulnerability-roundup-oct-25-2023/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ VMSA-2023-0024 ∗∗∗ --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0024.html ∗∗∗ SonicWall SSO Agent - Directory Services Connector MSI Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0016 ∗∗∗ SonicWall NetExtender Windows Client DLL Search Order Hijacking Vulnerability ∗∗∗ --------------------------------------------- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0017 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 25.10.2023
by Daily end-of-shift report 25 Oct '23

25 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 24-10-2023 18:00 − Mittwoch 25-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Citrix Bleed exploit lets hackers hijack NetScaler accounts ∗∗∗ --------------------------------------------- A proof-of-concept (PoC) exploit is released for the Citrix Bleed vulnerability, tracked as CVE-2023-4966, that allows attackers to retrieve authentication session cookies from vulnerable Citrix NetScaler ADC and NetScaler Gateway appliances. --------------------------------------------- https://www.bleepingcomputer.com/news/security/citrix-bleed-exploit-lets-ha… ∗∗∗ Phishing-Masche: Klarstellung wegen Viren-Versands gefordert ∗∗∗ --------------------------------------------- Die Verbraucherzentralen warnen vor Betrugsmails, die Empfänger zu einer Klarstellung auffordern. Es seien Beschwerden wegen Malware-Versands eingegangen. --------------------------------------------- https://www.heise.de/news/Phishing-Masche-Klarstellung-wegen-Viren-Versands… ∗∗∗ Exploitcode für Root-Lücke in VMware Aria Operations for Logs in Umlauf ∗∗∗ --------------------------------------------- In Umlauf befindlicher Exploitcode gefährdet VMwares Management-Plattform für Cloudumgebungen. Admins sollten jetzt Sicherheitsupdates installieren. --------------------------------------------- https://www.heise.de/news/Exploitcode-fuer-Root-Luecke-in-VMware-Aria-Opera… ∗∗∗ Webmailer Roundcube: Attacken auf Zero-Day-Lücke ∗∗∗ --------------------------------------------- Im Webmailer Roundcube missbrauchen Cyberkriminelle eine Sicherheitslücke, um verwundbare Einrichtungen anzugreifen. Ein Update schließt das Leck. --------------------------------------------- https://www.heise.de/news/Webmailer-Roundcube-Attacken-auf-Zero-Day-Luecke-… ∗∗∗ Teils kritische Lücken in VMware vCenter Server und Cloud Foundation geschlossen ∗∗∗ --------------------------------------------- VMware hat aktualisierte Softwarepakete veröffentlicht, die mehrere Lücken in vCenter Server und Cloud Foundation abdichten. Eine gilt als kritisch. --------------------------------------------- https://www.heise.de/news/Update-stopft-kritische-Luecke-in-VMware-vCenter-… ∗∗∗ Nusuccess: Seriöse Marketingagentur oder unseriöses Schneeballsystem? ∗∗∗ --------------------------------------------- Die Nusuccess FZCO mit Sitz in Dubai – vormals mit Sitz in Kärnten – bezeichnet sich selbst als „weltweit renommierte Werbeagentur“. Welche Leistungen diese Firma tatsächlich erbringt, bleibt aber im besten Fall vage. Erfahrungsberichte deuten darauf hin, dass sie ihren Gewinn hauptsächlich durch den Verkauf von teuren „Franchise-Paketen“ erzielt. Was genau Inhalt dieser Franchise-Pakete sein soll, bleibt unklar. --------------------------------------------- https://www.watchlist-internet.at/news/nusuccess-serioese-marketingagentur-… ∗∗∗ Social engineering: Hacking minds over bytes ∗∗∗ --------------------------------------------- In this blog, lets focus on the intersection of psychology and technology, where cybercriminals manipulate human psychology through digital means to achieve their objectives. --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/social-engineering-… ∗∗∗ How to Secure the WordPress Login Page ∗∗∗ --------------------------------------------- Given that WordPress powers millions of websites worldwide, it’s no surprise that it’s a prime target for malicious activities ranging from brute force attacks and hacking attempts to unauthorized access — all of which can wreak havoc on your site’s functionality, damage reputation, or even result in lost revenue and sales. A common entry point often exploited by hackers is the WordPress login page, [...] --------------------------------------------- https://blog.sucuri.net/2023/10/how-to-secure-the-wordpress-login-page.html ∗∗∗ The Rise of S3 Ransomware: How to Identify and Combat It ∗∗∗ --------------------------------------------- In todays digital landscape, around 60% of corporate data now resides in the cloud, with Amazon S3 standing as the backbone of data storage for many major corporations. Despite S3 being a secure service from a reputable provider, its pivotal role in handling vast amounts of sensitive data (customer personal information, financial data, intellectual property, etc.), provides a juicy target for threat actors. It remains susceptible to ransomware attacks which are often initiated using leaked access keys that have accidentally been exposed by human error and have access to the organization's buckets. --------------------------------------------- https://thehackernews.com/2023/10/the-rise-of-s3-ransomware-how-to.html ∗∗∗ RT 5.0.5 and 4.4.7 Now Available ∗∗∗ --------------------------------------------- RT versions 5.0.5 and 4.4.7 are now available. In addition to some new features and bug fixes, these releases contain important security updates and are recommended for all RT users. --------------------------------------------- https://bestpractical.com/blog/2023/10/rt-505-and-447-now-available ===================== = Vulnerabilities = ===================== ∗∗∗ Lücke in Cisco IOS XE: Auch Rockwell-Industrieswitches betroffen ∗∗∗ --------------------------------------------- Neben Cisco-eigenen Geräten sind auch Rockwell-Switches der Stratix-Serie für den Industrieeinsatz betroffen. Eine Fehlerbehebung steht noch aus. --------------------------------------------- https://www.heise.de/news/Luecke-in-Cisco-IOS-XE-Auch-Rockwell-Industrieswi… ∗∗∗ VMSA-2023-0023 ∗∗∗ --------------------------------------------- Synopsis: VMware vCenter Server updates address out-of-bounds write and information disclosure vulnerabilities (CVE-2023-34048, CVE-2023-34056) 1. Impacted Products * VMware vCenter Server * VMware Cloud Foundation --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0023.html ∗∗∗ Several Critical Vulnerabilities Patched in AI ChatBot Plugin for WordPress ∗∗∗ --------------------------------------------- On September 28, 2023, the Wordfence Threat Intelligence team initiated the responsible disclosure process for multiple vulnerabilities in AI ChatBot, a WordPress plugin with over 4,000 active installations. After making our initial contact attempt on September 28th, 2023, we received a response on September 29, 2023 and sent over our full disclosure details. --------------------------------------------- https://www.wordfence.com/blog/2023/10/several-critical-vulnerabilities-pat… ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (gst-plugins-bad1.0, openssl, roundcube, and xorg-server), Fedora (dotnet6.0, dotnet7.0, roundcubemail, and wordpress), Mageia (redis), Oracle (dnsmasq, python27:2.7, python3, tomcat, and varnish), Red Hat (python39:3.9, python39-devel:3.9), Slackware (mozilla and vim), SUSE (openssl-3, poppler, ruby2.5, and xen), and Ubuntu (.Net, linux-gcp-5.15, linux-gkeop-5.15, linux-intel-iotg-5.15, linux-starfive-6.2, mysql-5.7, ncurses, and openssl). --------------------------------------------- https://lwn.net/Articles/948814/ ∗∗∗ Movable Type vulnerable to cross-site scripting ∗∗∗ --------------------------------------------- https://jvn.jp/en/jp/JVN39139884/ ∗∗∗ TEM Opera Plus FM Family Transmitter 35.45 XSRF ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5800.php ∗∗∗ TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5799.php ∗∗∗ VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5798.php ∗∗∗ AIX is vulnerable to sensitive information exposure due to Perl (CVE-2023-31484 and CVE-2023-31486) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7047272 ∗∗∗ IBM QRadar SIEM includes components with known vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7049133 ∗∗∗ IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is vulnerable to weaker than expected security (CVE-2023-46158) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7058540 ∗∗∗ IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is vulnerable to weaker than expected security (CVE-2023-46158) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7058536 ∗∗∗ A vulnerability in IBM Java SDK and IBM Java Runtime affect Rational Business Developer. ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7059262 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 24.10.2023
by Daily end-of-shift report 24 Oct '23

24 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Montag 23-10-2023 18:00 − Dienstag 24-10-2023 18:00 Handler: Stephan Richter Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Log in With... Feature Allows Full Online Account Takeover for Millions ∗∗∗ --------------------------------------------- Hundreds of millions of users of Grammarly, Vidio, and the Indonesian e-commerce giant Bukalapak are at risk for financial fraud and credential theft due to OAuth misfires — and other online services likely have the same problems. --------------------------------------------- https://www.darkreading.com/remote-workforce/oauth-log-in-full-account-take… ∗∗∗ Hostile Takeover: Malicious Ads via Facebook ∗∗∗ --------------------------------------------- Criminals hijack business accounts on Facebook and run their own advertising campaigns in someone elses name and at the expense of those affected. --------------------------------------------- https://www.gdatasoftware.com/blog/2023/10/37814-meta-hijacked-malicious-ads ∗∗∗ Stealer for PIX payment system, new Lumar stealer and Rhysida ransomware ∗∗∗ --------------------------------------------- In this report, we share our latest crimeware findings: GoPIX targeting PIX payment system; Lumar stealing files and passwords; Rhysida ransomware supporting old Windows. --------------------------------------------- https://securelist.com/crimeware-report-gopix-lumar-rhysida/110871/ ∗∗∗ Quasar RAT Leverages DLL Side-Loading to Fly Under the Radar ∗∗∗ --------------------------------------------- The open-source remote access trojan known as Quasar RAT has been observed leveraging DLL side-loading to fly under the radar and stealthily siphon data from compromised Windows hosts. --------------------------------------------- https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html ∗∗∗ Citrix Bleed: Leaking Session Tokens with CVE-2023-4966 ∗∗∗ --------------------------------------------- We were interested in CVE-2023-4966, which was described as "sensitive information disclosure" and had a CVSS score of 9.4. The high score for an information disclosure vulnerability and the mention of "buffer-related vulnerabilities" piqued our interest. --------------------------------------------- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-to… ∗∗∗ Best Practices for Writing Quality Vulnerability Reports ∗∗∗ --------------------------------------------- How to write great vulnerability reports? If you’re a security consultant, penetration tester or a bug bounty hunter, these tips are for you! --------------------------------------------- https://itnext.io/best-practices-for-writing-quality-vulnerability-reports-… ∗∗∗ Kriminelle verbreiten falsche Ryanair-Telefonnummern ∗∗∗ --------------------------------------------- Vorsicht, wenn Sie im Internet nach einer Telefonnummer von Ryanair suchen. Kriminelle stellen Webseiten mit falschen Nummern ins Netz. Wenn Sie bei der falschen Ryanair-Servicehotline anrufen, stehlen Kriminelle Ihnen sensible Daten und Geld. --------------------------------------------- https://www.watchlist-internet.at/news/kriminelle-verbreiten-falsche-ryanai… ∗∗∗ LOLBin mit WorkFolders.exe unter Windows ∗∗∗ --------------------------------------------- Die legitime Windows-Anwendung WorkFolders.exe lässt sich verwenden, um andere .exe-Programme im Windows-Ordner System32 oder im aktuellen Ordner zu starten. Dies ermöglicht Malware sogenannte LOLBin-Angriffe, bei der legitime Betriebssystemdateien zur Ausführung von Schadprogrammen missbraucht werden. --------------------------------------------- https://www.borncity.com/blog/2023/10/24/lolbin-mit-workfolders-exe-unter-w… ∗∗∗ The Great CVSS Bake Off: Testing How CVSS v4 Performs Versus v3 ∗∗∗ --------------------------------------------- The highly anticipated Common Vulnerability Scoring System (CVSS) version 4 is planned to be released on October 31st by the Forum of Incident Response and Security Teams (FIRST). --------------------------------------------- https://orca.security/resources/blog/cvss-version-4-versus-version-3/ ===================== = Vulnerabilities = ===================== ∗∗∗ VMware warns admins of public exploit for vRealize RCE flaw ∗∗∗ --------------------------------------------- VMware warned customers on Monday that proof-of-concept (PoC) exploit code is now available for an authentication bypass flaw in vRealize Log Insight (now known as VMware Aria Operations for Logs). --------------------------------------------- https://www.bleepingcomputer.com/news/security/vmware-warns-admins-of-publi… ∗∗∗ Viele Systeme längst kompromittiert: Cisco stellt Patches für IOS XE bereit ∗∗∗ --------------------------------------------- Durch Schwachstellen in der Betriebssoftware IOS XE sind weltweit Zehntausende von Cisco-Geräten infiltriert worden. Jetzt gibt es erste Patches. --------------------------------------------- https://www.golem.de/news/viele-systeme-laengst-kompromittiert-cisco-stellt… ∗∗∗ CVE-2023-33466 - Exploiting Healthcare Servers with Polyglot Files ∗∗∗ --------------------------------------------- Orthanc is an open source software to manage, exchange and visualize medical imaging data. In versions < 1.12.0, it is affected by an arbitrary file overwrite vulnerability (CVE-2023-33466) that might allow an authenticated attacker to obtain RCE on the system. --------------------------------------------- https://www.shielder.com/blog/2023/10/cve-2023-33466-exploiting-healthcare-… ∗∗∗ Proxy: Squid-Entwickler dichten teils kritische Lecks in Version 6.4 ab ∗∗∗ --------------------------------------------- Mit Squid 6.4 haben die Entwickler eine um vier Sicherheitslücken bereinigte Version des Proxy-Servers vorgelegt. Es klaffen jedoch weitere Lücken darin. --------------------------------------------- https://www.heise.de/news/Proxy-Squid-6-4-schliesst-teils-kritische-Sicherh… ∗∗∗ Lücke in LiteSpeed-Cache-Plug-in gefährdet 4 Millionen WordPress-Websites ∗∗∗ --------------------------------------------- Angreifer können WordPress-Websites mit Schadcode-Skripten verseuchen. Ein Sicherheitsupdate repariert das LiteSpeed-Cache-Plug-in. --------------------------------------------- https://www.heise.de/news/Luecke-in-LiteSpeed-Cache-Plug-in-gefaehrdet-4-Mi… ∗∗∗ Sicherheitsupdates: Firefox-Browser anfällig für Clickjacking-Attacken ∗∗∗ --------------------------------------------- Mozilla hat in aktuellen Versionen von Firefox und Firefox ESR mehrere Sicherheitsprobleme gelöst. --------------------------------------------- https://www.heise.de/news/Sicherheitsupdates-Firefox-Browser-anfaellig-fuer… ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ceph and dbus), Fedora (cachelib, fb303, fbthrift, fizz, folly, matrix-synapse, mcrouter, mvfst, nats-server, nodejs18, proxygen, wangle, watchman, and wdt), Mageia (libcue), Oracle (18, grafana, kernel, nodejs, nodejs:16, nodejs:18, php, php:8.0, and tomcat), Red Hat (python27:2.7, python3, python39:3.9, python39-devel:3.9, toolbox, varnish, and varnish:6), SUSE (fwupdate, gcc13, icu73_2, netty, netty-tcnative, and xen), and Ubuntu [...] --------------------------------------------- https://lwn.net/Articles/948688/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ ∗∗∗ Vulnerability in SICK Flexi Soft Gateway ∗∗∗ --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-164691.html ∗∗∗ Rockwell Automation Stratix 5800 and Stratix 5200 ∗∗∗ --------------------------------------------- https://www.cisa.gov/news-events/ics-advisories/icsa-23-297-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.10.2023
by Daily end-of-shift report 23 Oct '23

23 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Freitag 20-10-2023 18:00 − Montag 23-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sessioncookies: Hacker erbeuten Zugangscodes bei Identitätsdienst Okta ∗∗∗ --------------------------------------------- Der Identitätsdienst Okta ist ein weiteres Mal das Einfallstor für Hacker gewesen. Dieses Mal betraf es Daten des Kundensupports. --------------------------------------------- https://www.golem.de/news/sessioncookies-hacker-erbeuten-zugangscodes-bei-i… ∗∗∗ Erst nach 3 Jahren gefixt: Zeiterfassungssystem ermöglichte OAuth-Token-Diebstahl ∗∗∗ --------------------------------------------- Harvest ermöglichte es Angreifern, OAuth-Token von Nutzern zu stehlen, die die Zeiterfassungssoftware mit Outlook verbinden wollten. --------------------------------------------- https://www.golem.de/news/erst-nach-3-jahren-gefixt-zeiterfassungssystem-er… ∗∗∗ Die MOVEit-Sicherheitslücke – eine Zwischenbilanz ∗∗∗ --------------------------------------------- Selbst wer die Software nicht verwendet, kann ein Opfer sein. Schätzungen gehen bisher von rund 68 Millionen Personen aus, deren Daten abgeflossen sind. --------------------------------------------- https://www.heise.de/-9318038.html ∗∗∗ Internationalen Ermittlungsbehörden gelingt Schlag gegen Ragnar Locker ∗∗∗ --------------------------------------------- Internationalen Ermittlern ist es gelungen, die Infrastruktur der bekannten Ransomware-Gruppierung Ragnar Locker zu zerschlagen. --------------------------------------------- https://www.heise.de/-9340480.html ∗∗∗ Cisco IOS XE und die verschwundenen Hintertüren ∗∗∗ --------------------------------------------- Die Anzahl der offensichtlich kompromittierten Geräte ist auch in Deutschland schlagartig gefallen, was wohl kaum an den gerade erschienenen Patches liegt. --------------------------------------------- https://www.heise.de/-9341205.html ∗∗∗ New TetrisPhantom hackers steal data from secure USB drives on govt systems ∗∗∗ --------------------------------------------- A new sophisticated threat tracked as TetrisPhantom has been using compromised secure USB drives to target government systems in the Asia-Pacific region. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-tetrisphantom-hackers-st… ∗∗∗ The outstanding stealth of Operation Triangulation ∗∗∗ --------------------------------------------- In this report Kaspersky shares insights into the validation components used in Operation Triangulation, TriangleDB implant post-compromise activity, as well as details of some additional modules. --------------------------------------------- https://securelist.com/triangulation-validators-modules/110847/ ∗∗∗ base64dump.py Handles More Encodings Than Just BASE64, (Sun, Oct 22nd) ∗∗∗ --------------------------------------------- My tool base64dump.py takes any input and searches for encoded data. By default, it searches for base64 encoding, but I implemented several encodings (like vaious hexadecimal formats) --------------------------------------------- https://isc.sans.edu/diary/rss/30332 ∗∗∗ How an AppleTV may take down your (#IPv6) network, (Mon, Oct 23rd) ∗∗∗ --------------------------------------------- I recently ran into an odd issue with IPv6 connectivity in my home network. During a lengthy outage, I decided to redo some of my network configurations. As part of this change, I also reorganized my IPv6 setup, relying more on DHCPv6 and less on router advertisements to configure IPv6 addresses. Overall, this worked well. My Macs had no issues connecting to IPv6. However, the Linux host I use to alert me of network connectivity issues could not "ping" the test host via IPv6. --------------------------------------------- https://isc.sans.edu/diary/rss/30336 ∗∗∗ Tampered OpenCart Authentication Aids Credit Card Skimming Attack ∗∗∗ --------------------------------------------- Using out of date software is the leading cause of website compromise, so keeping your environment patched and up to date is one of the most important responsibilities of a website administrator. It’s not uncommon to employ the use of custom code on websites, and spend small fortunes on software developers to tailor their website just the way they want it. However, the usage of customised code can sometimes inadvertently lock a website administrator into using an out of date CMS installation long after its expiry date, particularly if they no longer have access to their old developer (or sufficient funds to hire a new one). --------------------------------------------- https://blog.sucuri.net/2023/10/tampered-opencart-authentication-aids-credi… ∗∗∗ Abusing gdb Features for Data Ingress & Egress ∗∗∗ --------------------------------------------- As of November 2019, elfutils supports debuginfod, a client/server protocol that enables debuggers (gdb) to fetch debugging symbols via HTTP/HTTPs from a user-specified remote server. This blog post will demonstrate how this feature of gdb can be abused to create data communication paths for data exfiltration and tool ingress. --------------------------------------------- https://www.archcloudlabs.com/projects/debuginfod/ ∗∗∗ Vorsicht vor Jobangeboten auf WhatsApp oder Telegram ∗∗∗ --------------------------------------------- Sie suchen gerade einen Job? Praktisch, wenn Sie gar nicht suchen müssen und Sie direkt auf WhatsApp oder Telegram einen Job angeboten bekommen. Dahinter stecken aber Kriminelle, die Ihnen z. B. einen „Datenoptimierungsjob mit möglichen Provisionen“ anbieten. Auf Plattformen wie privko.live oder depopnr.com verlieren Sie dann Ihr Geld! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-jobangeboten-auf-whatsa… ∗∗∗ Important security update ∗∗∗ --------------------------------------------- Autodesk recently determined that an unauthorized third-party obtained access to portions of internal systems. Our findings show that sensitive data about our customers and their projects or products have not been compromised. We immediately took steps to contain the incident. Forensic analysis conducted by an independent, third party indicates that no customer operations or Autodesk products were disrupted due to this incident. --------------------------------------------- https://www.autodesk.com/trust/security-advisories/adsk-sa-2023-0020 ∗∗∗ Kritische Sicherheitslücke in Cisco IOS XE - aktiv ausgenützt ∗∗∗ --------------------------------------------- Update: 23. Oktober 2023 Cisco hat für einige der von der Schwachstelle betroffenen Geräte Aktualisierungen veröffentlicht, und weitere Updates angekündigt. Das Unternehmen aktualisiert die Liste an verfügbaren Patches auf einer dedizierten Seite laufend. Wenn das Management-WebInterface eines Cisco XE Gerätes vor dem Einspielen des Updates offen im Netz erreichbar war, ist davon auszugehen, dass ein Angreifer dies ausgenutzt hat und zumindest neue Admin-Accounts angelegt hat. Damit ist die Installation von weiteren Hintertüren möglich, die - aus heutiger Sicht - nur mit einem Factory Reset / Neuinstallation von IOS XE umfassend entfernt werden können --------------------------------------------- https://cert.at/de/warnungen/2023/10/kritische-sicherheitslucke-in-cisco-io… ===================== = Vulnerabilities = ===================== ∗∗∗ Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature ∗∗∗ --------------------------------------------- Version 1.4: Updated the summary to indicate the first fixes are available. Added specific fixed release information. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (krb5, redis, roundcube, ruby-rack, ruby-rmagick, zabbix, and zookeeper), Fedora (ansible-core, chromium, libvpx, mingw-xerces-c, python-asgiref, python-django, and vim), Mageia (cadence, kernel, kernel-linus, libxml2, nodejs, and shadow-utils), Oracle (nghttp2), Slackware (LibRaw), and SUSE (chromium, java-11-openjdk, nodejs18, python-Django, python-urllib3, and suse-module-tools). --------------------------------------------- https://lwn.net/Articles/948522/ ∗∗∗ Vulnerability in QUSBCam2 ∗∗∗ --------------------------------------------- An OS command injection vulnerability has been reported to affect QUSBCam2. If exploited, the vulnerability could allow users to execute arbitrary commands via a network. --------------------------------------------- https://www.qnap.com/en-us/security-advisory/QSA-23-43 ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.10.2023
by Daily end-of-shift report 20 Oct '23

20 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 19-10-2023 18:00 − Freitag 20-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Malvertising: Angreifer nutzen Punycode für gefälschte Webseiten ∗∗∗ --------------------------------------------- Cyberkriminelle werben über Google Ads etwa mit gefälschten KeePass-URLs mit Punycode-Zeichen. Die beworbene Seite liefert Malware aus. --------------------------------------------- https://www.heise.de/-9339448.html ∗∗∗ SolarWinds behebt Codeschmuggel in Access Rights Manager ∗∗∗ --------------------------------------------- Die Software zur Verwaltung von Zugriffsberechtigungen hat unter anderem Fehler, die eine Rechteausweitung ermöglichten. Admins sollten zügig handeln. --------------------------------------------- https://www.heise.de/-9339437.html ∗∗∗ VMware dichtet hochriskante Lecks in Aria, Fusion und Workstation ab ∗∗∗ --------------------------------------------- VMware hat Updates für VMNware Aria Operations for Logs, VMware Fusion sowie VMware Workstation veröffentlicht. Sie schließen teils hochriskante Lücken. --------------------------------------------- https://www.heise.de/-9339932.html ∗∗∗ IT-Sicherheitsbehörden geben Tipps für sichere Software und Phishing-Prävention ∗∗∗ --------------------------------------------- Die US-Sicherheitsbehörde CISA veröffentlicht mit internationalen Partnern je eine Handreichung zu sicherem Software-Entwurf und zur Phishing-Prävention. --------------------------------------------- https://www.heise.de/-9339899.html ∗∗∗ Cybersicherheit ermöglichen – BSI veröffentlicht Checklisten für Kommunen ∗∗∗ --------------------------------------------- Das BSI bietet Kommunen nun einen unkomplizierten und ressourcenschonenden Einstieg in den etablierten IT-Grundschutz des BSI. --------------------------------------------- https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse202… ∗∗∗ Fake Corsair job offers on LinkedIn push DarkGate malware ∗∗∗ --------------------------------------------- A threat actor is using fake LinkedIn posts and direct messages about a Facebook Ads specialist position at hardware maker Corsair to lure people into downloading info-stealing malware like DarkGate and RedLine. --------------------------------------------- https://www.bleepingcomputer.com/news/security/fake-corsair-job-offers-on-l… ∗∗∗ ExelaStealer: A New Low-Cost Cybercrime Weapon Emerges ∗∗∗ --------------------------------------------- A new information stealer named ExelaStealer has become the latest entrant to an already crowded landscape filled with various off-the-shelf malware designed to capture sensitive data from compromised Windows systems. "ExelaStealer is a largely open-source infostealer with paid customizations available from the threat actor," Fortinet FortiGuard Labs researcher James Slaughter said [...] --------------------------------------------- https://thehackernews.com/2023/10/exelastealer-new-low-cost-cybercrime.html ∗∗∗ Ghost In The Wire, Sonic In The Wall - Adventures With SonicWall ∗∗∗ --------------------------------------------- Here at watchTowr, we just love attacking high-privilege devices [...]. A good example of these is the device class of ‘next generation’ firewalls, which usually include VPN termination functionality (meaning they’re Internet-accessible by network design). These devices patrol the border between the untrusted Internet and an organisation’s softer internal network, and so are a great place for attackers to elevate their status from ‘outsiders’ to ‘trusted users’. --------------------------------------------- https://labs.watchtowr.com/ghost-in-the-wire-sonic-in-the-wall/ ∗∗∗ VMware Aria Operations for Logs CVE-2023-34051 Technical Deep Dive and IOCs ∗∗∗ --------------------------------------------- Earlier this year we reported the technical details for VMSA-2023-0001 affecting VMware Aria Operations for Logs (formerly VMware vRealize Log Insight). [...] During the course of that investigation, we noticed the fix provided by VMware was not sufficient to stop a motivated attacker. We reported this new issue to VMware and it was fixed in VMSA-2023-0021. This post will discuss the technical details of CVE-2023-34051, an authentication bypass that allows remote code execution as root. --------------------------------------------- https://www.horizon3.ai/vmware-aria-operations-for-logs-cve-2023-34051-tech… ∗∗∗ Concerns grow as LockBit knockoffs increasingly target popular vulnerabilities ∗∗∗ --------------------------------------------- Hackers are using a leaked toolkit used to create do-it-yourself versions of the popular LockBit ransomware, making it easy for even amateur cybercriminals to target common vulnerabilities. The LockBit ransomware gang, which has attacked thousands of organizations across the world, had the toolkit leaked in September 2022 by a disgruntled affiliate. --------------------------------------------- https://therecord.media/lockbit-knockoffs-proliferate-leaked-toolkit ∗∗∗ Attacks on 5G Infrastructure From User Devices: ASN.1 Vulnerabilities in 5G Cores ∗∗∗ --------------------------------------------- In the second part of this series, we will examine how attackers can trigger vulnerabilities by sending control messages masquerading as user traffic to cross over from user plane to control plane. --------------------------------------------- https://www.trendmicro.com/en_us/research/23/j/asn1-vulnerabilities-in-5g-c… ===================== = Vulnerabilities = ===================== ∗∗∗ Cisco IOS XE Software Web UI Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- Version 1.2: Added access list mitigation. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Cisco IOS XE Software Web UI Command Injection Vulnerability ∗∗∗ --------------------------------------------- Version 1.1: Added information about active exploitation attempts. --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ RT 5.0.5 Release Notes ∗∗∗ --------------------------------------------- RT 5.0.5 is now available for general use. The list of changes included with this release is below. In addition to a batch of updates, new features, and fixes, there are several important security updates provided in this release. See below for details. --------------------------------------------- https://docs.bestpractical.com/release-notes/rt/5.0.5 ∗∗∗ RT 4.4.7 Release Notes ∗∗∗ --------------------------------------------- RT 4.4.7 is now available for general use. The list of changes included with this release is below. In addition to a batch of updates, new features, and fixes, there are several important security updates provided in this release. See below for details. --------------------------------------------- https://docs.bestpractical.com/release-notes/rt/4.4.7 ∗∗∗ VMSA-2023-0022 ∗∗∗ --------------------------------------------- VMware Fusion and Workstation updates address privilege escalation and information disclosure vulnerabilities (CVE-2023-34044, CVE-2023-34045, CVE-2023-34046) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0022.html ∗∗∗ VMSA-2023-0021 ∗∗∗ --------------------------------------------- VMware Aria Operations for Logs updates address multiple vulnerabilities. (CVE-2023-34051, CVE-2023-34052) --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2023-0021.html ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (linux-5.10 and webkit2gtk), Fedora (matrix-synapse and trafficserver), Mageia (chromium-browser-stable, ghostscript, libxpm, and ruby-RedCloth), Oracle (.NET 7.0, curl, dotnet7.0, galera, mariadb, go-toolset, golang, java-1.8.0-openjdk, and python-reportlab), Red Hat (php, php:8.0, tomcat, and varnish), Slackware (httpd), SUSE (bluetuith, grub2, kernel, rxvt-unicode, and suse-module-tools), and Ubuntu (dotnet6, dotnet7, dotnet8, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15,linux-nvidia, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2, linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi, linux-starfive, linux, linux-aws, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-azure, linux-bluefield, linux-intel-iotg, linux-oem-6.1, linux-raspi, and mutt). --------------------------------------------- https://lwn.net/Articles/948368/ ∗∗∗ Kritische Sicherheitslücke in Citrix NetScaler ADC und NetScaler Gateway - aktiv ausgenutzt - Updates verfügbar ∗∗∗ --------------------------------------------- Eine kritische Schwachstelle in Citrix/Netscaler ADC und Citrix Gateway erlaubt es unauthentifizierten Angreifer:innen, bestehende, authentifizierte Sessions zu übernehmen. Diese Schwachstelle wird zumindest seit Ende August 2023 bei Angriffen gegen Ziele in verschiedenen Sektoren aktiv ausgenutzt. --------------------------------------------- https://cert.at/de/warnungen/2023/10/kritische-sicherheitslucke-in-citrix-n… ∗∗∗ Multiple vulnerabilities in ctrlX WR21 HMI ∗∗∗ --------------------------------------------- BOSCH-SA-175607: The operating system of the ctrlX WR21 HMI has several vulnerabilities when the Kiosk mode is used in conjunction with Google Chrome. In worst case, an attacker with physical access to the device might gain full root access without prior authentication by combining the exploitation of those vulnerabilities. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-175607.html ∗∗∗ CVE-2023-38041 New client side release to address a privilege escalation on Windows user machines ∗∗∗ --------------------------------------------- A vulnerability exists on all versions of the Ivanti Secure Access Client Below 22.6R1 that would allow an unprivileged local user to gain unauthorized elevated privileges on the affected system. --------------------------------------------- https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-… ∗∗∗ Decision Optimization in IBM Cloud Pak for Data is affected by a vulnerability in Node.js semver package (CVE-2022-25883) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056400 ∗∗∗ Multiple vulnerabilities in IBM Semeru Runtime affect IBM ILOG CPLEX Optimization Studio (CVE-2023-21968, CVE-2023-21937, CVE-2023-21938) ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056397 ∗∗∗ Improper input validation may lead to a Denial of Service attack in web services with IBM CICS TX Standard and IBM CICS TX Advanced ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056433 ∗∗∗ IBM App Connect Enterprise is vulnerable to a heap-based buffer overflow due to electron ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056425 ∗∗∗ Improper input validation may lead to a Denial of Service attack in web services with IBM TXSeries for Multiplatforms ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056429 ∗∗∗ IBM Integration Bus is vulnerable to a denial of service due to Eclipse Mosquitto ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056456 ∗∗∗ IBM App Connect Enterprise Toolkit and IBM Integration Bus Toolkit are vulnerable to a denial of service due to Okio GzipSource (CVE-2023-3635). ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/node/7056518 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.10.2023
by Daily end-of-shift report 19 Oct '23

19 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 18-10-2023 18:00 − Donnerstag 19-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Money-making scripts attack organizations ∗∗∗ --------------------------------------------- Cybercriminals attack government, law enforcement, non-profit organizations, agricultural and commercial companies by slipping a cryptominer, keylogger, and backdoor into their systems. --------------------------------------------- https://securelist.com/miner-keylogger-backdoor-attack-b2b/110761/ ∗∗∗ HasMySecretLeaked findet auf GitHub veröffentlichte Secrets ∗∗∗ --------------------------------------------- Wer prüfen möchte, ob seine Secrets auf GitHub geleakt sind, kann das kostenfreie Toolset von GitGuardian nutzen. Es soll dabei private Daten schützen. --------------------------------------------- https://www.heise.de/news/Security-Toolset-HasMySecretLeaked-sucht-auf-GitH… ∗∗∗ Public Report – Caliptra Security Assessment ∗∗∗ --------------------------------------------- During August and September of 2023, Microsoft engaged NCC Group to conduct a security assessment of Caliptra v0.9. Caliptra is an open-source silicon IP block for datacenter-focused server-class ASICs. --------------------------------------------- https://research.nccgroup.com/2023/10/18/public-report-caliptra-security-as… ∗∗∗ Number of Cisco Devices Hacked via Unpatched Vulnerability Increases to 40,000 ∗∗∗ --------------------------------------------- The number of Cisco devices hacked via the CVE-2023-20198 zero-day has reached 40,000, including many in the US. --------------------------------------------- https://www.securityweek.com/number-of-cisco-devices-hacked-via-unpatched-v… ∗∗∗ Ein PayPal-Tonband ruft an? Drücken Sie nicht die 1! ∗∗∗ --------------------------------------------- Eine unbekannte Nummer erscheint am Smartphone-Bildschirm. Sie heben ab und eine Roboterstimme meldet sich im Namen PayPals. Angeblich soll Geld von Ihrem PayPal-Konto behoben werden. Um das zu verhindern, sollen Sie die Taste „1“ drücken. Tun Sie dies nicht – Kriminelle versuchen, Ihnen dadurch Geld und Daten zu stehlen. --------------------------------------------- https://www.watchlist-internet.at/news/ein-paypal-tonband-ruft-an-druecken-… ∗∗∗ Es cyberwart wieder. Oder so. ∗∗∗ --------------------------------------------- Wie schon zu Beginn des Krieges in der Ukraine vor inzwischen eineinhalb Jahren kam es auch kurz nach den Ereignissen, die am 07.10.2023 Israel erschüttert haben, relativ schnell zu Berichten über die mögliche Rolle von Cyberangriffen in diesem Konflikt. --------------------------------------------- https://cert.at/de/blog/2023/10/es-cyberwart-wieder-oder-so ∗∗∗ Hackers Exploit QR Codes with QRLJacking for Malware Distribution ∗∗∗ --------------------------------------------- Researchers report a surge in QR code-related cyberattacks exploiting phishing and malware distribution, especially QRLJacking and Quishing attacks. --------------------------------------------- https://www.hackread.com/hackers-exploit-qr-codes-qrljacking-malware/ ∗∗∗ CISA, NSA, FBI, MS-ISAC Publish Guide on Preventing Phishing Intrusions ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI) and Multi-State Information Sharing and Analysis Center (MS-ISAC) today published “Phishing Guidance, Stopping the Attack Cycle at Phase One” to help organizations reduce likelihood and impact of successful phishing attacks. --------------------------------------------- https://www.cisa.gov/news-events/news/cisa-nsa-fbi-ms-isac-publish-guide-pr… ∗∗∗ Exploited SSH Servers Offered in the Dark web as Proxy Pools ∗∗∗ --------------------------------------------- Aqua Nautilus researchers have shed brighter light on a long-standing threat to SSH in the context of the cloud. More specifically, the threat actor harnessed our SSH server to be a slave proxy and pass traffic through it. --------------------------------------------- https://blog.aquasec.com/threat-alert-exploited-ssh-servers-offered-in-the-… ===================== = Vulnerabilities = ===================== ∗∗∗ Casio discloses data breach impacting customers in 149 countries ∗∗∗ --------------------------------------------- Japanese electronics manufacturer Casio disclosed a data breach impacting customers from 149 countries after hackers gained to the servers of its ClassPad education platform. --------------------------------------------- https://www.bleepingcomputer.com/news/security/casio-discloses-data-breach-… ∗∗∗ Sophos Firewall: PDF-Passwortschutz der SPX-Funktion umgehbar ∗∗∗ --------------------------------------------- Sophos verteilt aktualisierte Firmware für die Firewalls. Im Secure PDF eXchange können Angreifer den Schutz umgehen und unbefugt PDF-Dateien entschlüsseln. --------------------------------------------- https://www.heise.de/news/Sophos-Firewall-PDF-Passwortschutz-der-SPX-Funkti… ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (node-babel), Fedora (moodle), Gentoo (mailutils), Oracle (go-toolset:ol8 and java-11-openjdk), Red Hat (ghostscript, grafana, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, nghttp2, nodejs:16, nodejs:18, and rhc-worker-script), SUSE (cni, cni-plugins, container-suseconnect, containerd, cups, exim, grub2, helm, libeconf, nodejs18, python3, runc, slurm, supportutils, and tomcat), and Ubuntu (glib2.0, openssl, and vips). --------------------------------------------- https://lwn.net/Articles/948246/ ∗∗∗ ZDI-23-1568: NI Measurement & Automation Explorer Stack-based Buffer Overflow Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1568/ ∗∗∗ ZDI-23-1567: SolarWinds Access Rights Manager OpenClientUpdateFile Directory Traversal Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1567/ ∗∗∗ ZDI-23-1566: SolarWinds Access Rights Manager GetParameterFormTemplateWithSelectionState Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1566/ ∗∗∗ ZDI-23-1565: SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1565/ ∗∗∗ ZDI-23-1564: SolarWinds Access Rights Manager createGlobalServerChannelInternal Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1564/ ∗∗∗ ZDI-23-1563: SolarWinds Access Rights Manager ExecuteAction Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1563/ ∗∗∗ ZDI-23-1562: SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1562/ ∗∗∗ ZDI-23-1561: SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1561/ ∗∗∗ ZDI-23-1560: SolarWinds Access Rights Manager IFormTemplate Deserialization of Untrusted Data Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-23-1560/ ∗∗∗ Cisco Catalyst SD-WAN Manager Local File Inclusion Vulnerability ∗∗∗ --------------------------------------------- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdviso… ∗∗∗ Technical Advisory – Multiple Vulnerabilities in Connectize G6 AC2100 Dual Band Gigabit WiFi Router (CVE-2023-24046, CVE-2023-24047, CVE-2023-24048, CVE-2023-24049, CVE-2023-24050, CVE-2023-24051, CVE-2023-24052) ∗∗∗ --------------------------------------------- https://research.nccgroup.com/2023/10/19/technical-advisory-multiple-vulner… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 18.10.2023
by Daily end-of-shift report 18 Oct '23

18 Oct '23

===================== = End-of-Day report = ===================== Timeframe: Dienstag 17-10-2023 18:00 − Mittwoch 18-10-2023 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer ===================== = News = ===================== ∗∗∗ Malicious Notepad++ Google ads evade detection for months ∗∗∗ --------------------------------------------- A new Google Search malvertizing campaign targets users looking to download the popular Notepad++ text editor, employing advanced techniques to evade detection and analysis. --------------------------------------------- https://www.bleepingcomputer.com/news/security/malicious-notepad-plus-plus-… ∗∗∗ Over 40,000 admin portal accounts use admin as a password ∗∗∗ --------------------------------------------- Security researchers found that IT administrators are using tens of thousands of weak passwords to protect access to portals, leaving the door open to cyberattacks on enterprise networks. --------------------------------------------- https://www.bleepingcomputer.com/news/security/over-40-000-admin-portal-acc… ∗∗∗ Recently patched Citrix NetScaler bug exploited as zero-day since August ∗∗∗ --------------------------------------------- A critical vulnerability tracked as CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices has been actively exploited as a zero-day since late August, security researchers announced. --------------------------------------------- https://www.bleepingcomputer.com/news/security/recently-patched-citrix-nets… ∗∗∗ Hiding in Hex, (Wed, Oct 18th) ∗∗∗ --------------------------------------------- There are a variety of attacks seen from DShield honeypots [1]. Most of the time these commands are human readable. but every now and again they are obfuscated using base64 or hex encoding. A quick look for commands containing the "/x" delimiter give a lot of results encoded in hexadecimal. --------------------------------------------- https://isc.sans.edu/diary/rss/30322 ∗∗∗ Qubitstrike Targets Jupyter Notebooks with Crypto Mining and Rootkit Campaign ∗∗∗ --------------------------------------------- Dubbed Qubitstrike by Cado, the intrusion set utilizes Telegram API to exfiltrate cloud service provider credentials following a successful compromise. "The payloads for the Qubitstrike campaign are all hosted on codeberg.org – an alternative Git hosting platform, providing much of the same functionality as GitHub," security researchers Matt Muir and Nate Bill said in a Wednesday write-up. --------------------------------------------- https://thehackernews.com/2023/10/qubitstrike-targets-jupyter-notebooks.html ∗∗∗ BlackCat Climbs the Summit With a New Tactic ∗∗∗ --------------------------------------------- BlackCat ransomware gang has released a utility called Munchkin, allowing attackers to propagate their payload to remote machines. We analyze this new tool. --------------------------------------------- https://unit42.paloaltonetworks.com/blackcat-ransomware-releases-new-utilit… ∗∗∗ Updated MATA attacks industrial companies in Eastern Europe ∗∗∗ --------------------------------------------- Kaspersky experts discovered several detections of malware from the MATA cluster, previously attributed to the Lazarus group, compromising defense contractor companies in Eastern Europe. --------------------------------------------- https://ics-cert.kaspersky.com/publications/updated-mata-attacks-industrial… ∗∗∗ Where Has the MS Office Document Malware Gone? ∗∗∗ --------------------------------------------- Infostealers, which steal user account credentials saved in web browsers or email clients, constitute the majority of attacks targeting general or corporate users. Related information was shared through the ASEC Blog in December of last year. [1] While the distribution method for the named malware differs slightly depending on their main features, Infostealer-type malware typically uses malicious sites disguised as pages for downloading legitimate programs as their distribution route. --------------------------------------------- https://asec.ahnlab.com/en/57883/ ∗∗∗ CISA Updates Toolkit to Promote Public Safety Communications and Cyber Resiliency ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Security Agency (CISA) collaborates with public safety, national security, and emergency preparedness communities to enhance seamless and secure communications to keep America safe, secure, and resilient. Any interruption in communications can have a cascading effect, impacting a public safety agency’s ability to deliver critical lifesaving services to the community. --------------------------------------------- https://www.cisa.gov/news-events/news/cisa-updates-toolkit-promote-public-s… ===================== = Vulnerabilities = ===================== ∗∗∗ Patchday: Oracle veröffentlicht 387 Sicherheits-Patches ∗∗∗ --------------------------------------------- Der vierteljährliche Patchday von Oracle hat stattgefunden. Er bringt im Oktober 387 Updates für mehr als 120 Produkte. --------------------------------------------- https://www.heise.de/-9337238 ∗∗∗ AMD-Grafiktreiber: Codeschmuggel durch Sicherheitslücke möglich ∗∗∗ --------------------------------------------- AMD warnt vor einer Sicherheitslücke in den eigenen Grafiktreibern. Angreifer könnten Code einschleusen und mit erhöhten Rechten ausführen. --------------------------------------------- https://www.heise.de/-9337480 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (slurm-wlm), Fedora (icecat and python-configobj), Oracle (dotnet6.0, kernel-container, nginx, nginx:1.20, nginx:1.22, and python3.9), Red Hat (bind9.16, curl, dotnet6.0, kernel-rt, kpatch-patch, nghttp2, nodejs, python-reportlab, and virt:rhel), Slackware (util), SUSE (buildah, conmon, erlang, glibc, kernel, nghttp2, opensc, python-urllib3, samba, slurm, and suse-module-tools), and Ubuntu (frr, linux-azure, and pmix). --------------------------------------------- https://lwn.net/Articles/948097/ ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- https://www.ibm.com/support/pages/bulletin/ -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily