- Daily - CERT.at

Tageszusammenfassung - 04.11.2020
by Daily end-of-shift report 04 Nov '20

04 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 03-11-2020 18:00 − Mittwoch 04-11-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ 49.500 Euro gewonnen? Vorsicht, BetrügerInnen geben sich am Telefon als EuroMillionen aus! ∗∗∗ --------------------------------------------- „Herzlichen Glückwünsch. Sie haben 49.500 Euro gewonnen“. BetrügerInnen rufen im Namen von EuroMillionen an und übermitteln ihren Opfern diese gute Nachricht. Doch tatsächlich handelt es sich um Vorschussbetrug: Bevor der Betrag überwiesen werden kann, müssen die vermeintlichen GewinnerInnen 1.500 Euro für eine Versicherung bezahlen. Der Gewinn wird trotzdem nicht überwiesen, die 1.500 Euro sind also verloren. --------------------------------------------- https://www.watchlist-internet.at/news/49500-euro-gewonnen-vorsicht-betrueg… ∗∗∗ Exchange-Lücke: Immer noch viele Server offen ∗∗∗ --------------------------------------------- Einen Monat nachdem heise Security über die dramatische Zahl an verwundbaren Systemen berichtete, hat sich die Situation zwar verbessert, aber nicht entspannt. --------------------------------------------- https://heise.de/-4947221 ∗∗∗ Google: Android-Lücke kann Geräte "dauerhaft" lahmlegen ∗∗∗ --------------------------------------------- Google schließt mit dem November-Update für Android mehrere kritische Sicherheitslücken. Geräte können lahmgelegt oder auch übernommen werden. --------------------------------------------- https://www.golem.de/news/google-android-luecke-kann-geraete-dauerhaft-lahm… ∗∗∗ New RegretLocker ransomware targets Windows virtual machines ∗∗∗ --------------------------------------------- A new ransomware called RegretLocker uses a variety of advanced features that allows it to encrypt virtual hard drives and close open files for encryption. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-regretlocker-ransomware-… ∗∗∗ Sneaky Office 365 phishing inverts images to evade detection ∗∗∗ --------------------------------------------- A creative Office 365 phishing campaign has been inverting images used as backgrounds for landing pages to avoid getting flagged as malicious by crawlers designed to spot phishing sites. --------------------------------------------- https://www.bleepingcomputer.com/news/security/sneaky-office-365-phishing-i… ∗∗∗ Attackers Exploiting WebLogic Servers via CVE-2020-14882 to install Cobalt Strike, (Tue, Nov 3rd) ∗∗∗ --------------------------------------------- Starting late last week, we observed a large number of scans against our WebLogic honeypots to detect if they are vulnerable to CVE-2020-14882. CVE-2020-14882 was patched about two weeks ago as part of Oracle's quarterly critical patch update. In addition to scans simply enumerating vulnerable servers, we saw a small number of scans starting on Friday (Oct. 30th) attempting to install crypto-mining tools [1]. --------------------------------------------- https://isc.sans.edu/diary/rss/26752 ===================== = Vulnerabilities = ===================== ∗∗∗ SaltStack: Security-Packages beseitigen drei teils kritische Sicherheitslücken ∗∗∗ --------------------------------------------- Für viele SaltStack-Versionen stehen Aktualisierungen bereit; die Entwickler raten angesichts der von drei Lücken ausgehenden Gefahren zum zeitnahen Update. --------------------------------------------- https://heise.de/-4947393 ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Arch Linux (chromium and firefox), Fedora (nss), openSUSE (pacemaker), Red Hat (bind, binutils, bluez, cloud-init, container-tools:rhel8, cryptsetup, cups, curl, cyrus-imapd, cyrus-sasl, dovecot, dpdk, edk2, evolution, expat, file-roller, fontforge, freeradius:3.0, freerdp and vinagre, freetype, frr, gd, glibc, GNOME, gnome-software and fwupd, gnupg2, grafana, httpd:2.4, idm:DL1 and idm:client, kernel, kernel-rt, libarchive, libexif, libgcrypt, libldb, [...] --------------------------------------------- https://lwn.net/Articles/836137/ ∗∗∗ Cisco Security Advisories ∗∗∗ --------------------------------------------- Cisco hat für mehrere Produkte insgesamt 35 Security Advisories mit folgenden Security Impact Ratings veröffentlicht: High: 12 Medium: 23 --------------------------------------------- https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&first… ∗∗∗ Patch for Critical VMware ESXi Vulnerability Incomplete ∗∗∗ --------------------------------------------- VMware on Wednesday informed customers that it has released new patches for ESXi after learning that a fix made available last month for a critical vulnerability was incomplete. --------------------------------------------- https://www.securityweek.com/patch-critical-vmware-esxi-vulnerability-incom… ∗∗∗ Joomla Publisher V 3.0.19 Stored XSS ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020110017 ∗∗∗ Joomla JomSocial 4.7.6 Stored XSS ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020110016 ∗∗∗ Security Advisory - Insecure Encryption Algorithm Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- https://www.huawei.com/en/psirt/security-advisories/2019/huawei-sa-20201104… ∗∗∗ Vulnerabilities in Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/vulnerabilities-in-trend-micro… ∗∗∗ Red Hat Enterprise Linux: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1076 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 03.11.2020
by Daily end-of-shift report 03 Nov '20

03 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Montag 02-11-2020 18:00 − Dienstag 03-11-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Emotet -> Qakbot -> more Emotet, (Tue, Nov 3rd) ∗∗∗ --------------------------------------------- On Friday 2020-10-30, I generated an Emotet infection in my lab and saw Qakbot as the follow-up malware. I let the activity run for a while, then another Emotet infection appeared on the same host after Qakbot started. --------------------------------------------- https://isc.sans.edu/diary/rss/26750 ∗∗∗ Live off the Land? How About Bringing Your Own Island? An Overview of UNC1945 ∗∗∗ --------------------------------------------- Through Mandiant investigation of intrusions between February 2018 and September 2020, the FLARE Advanced Practices team observed a group we track as UNC1945 compromise telecommunications companies and operate against a tailored set of targets within the financial and professional consulting industries by leveraging access to third-party networks (see this blog post for an in-depth description of “UNC” groups). UNC1945 targeted Oracle Solaris operating systems, utilized several [...] --------------------------------------------- https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-o… ∗∗∗ JavaScript-Paketmanager: Twilio-Brandjacking-Paket öffnet Hintertür ∗∗∗ --------------------------------------------- Vergangenes Wochenende haben Angreifer ein Paket namens twilio-npm veröffentlicht, das eine Reverse Shell auf dem Entwicklersystem startet. --------------------------------------------- https://heise.de/-4945861 ∗∗∗ Schubladen für Schwachstellen: Das CVE-System im Überblick ∗∗∗ --------------------------------------------- MITREs Common Vulnerabilities and Exposures System (CVE) ist der gängige Standard zur Verwaltung von Schwachstellen. Wir erklären, was es damit auf sich hat. --------------------------------------------- https://heise.de/-4940478 ∗∗∗ Hundewelpen im Internet kaufen? - Lieber nicht! ∗∗∗ --------------------------------------------- Bei der Recherche nach Züchtern im Internet, stoßen Sie möglicherweise auf Websites, die wunderschöne Rasse-Hundewelpen verkaufen - meist zu einem sehr günstigen Preis. TierliebhaberInnen werden vor allem mit liebevollen Fotos und Beschreibung verlockt, sich mit dem vermeintlichen Züchter in Verbindung zu setzen. Doch Vorsicht: Der Handel von Hunden und Katzen über das Internet ist in Österreich verboten. --------------------------------------------- https://www.watchlist-internet.at/news/hundewelpen-im-internet-kaufen-liebe… ∗∗∗ These software bugs are years old. But businesses still arent patching them ∗∗∗ --------------------------------------------- Many organisations still havent applied security patches issued years ago, putting them at risk from common cyber attacks. --------------------------------------------- https://www.zdnet.com/article/these-software-bugs-are-years-old-but-busines… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Alert CVE-2020-14750 Released ∗∗∗ --------------------------------------------- Oracle has just released Security Alert CVE-2020-14750. This vulnerability affects a number of versions of Oracle WebLogic Server and has a CVSS Base Score of 9.8. WebLogic Server customers should refer to the Security Alert Advisory for information on affected versions and how to obtain the required patches. This vulnerability is related to CVE-2020-14882, which was addressed in the October 2020 Critical Patch Update. Vulnerability CVE-2020-14750 is remotely exploitable without authentication, [...] --------------------------------------------- https://blogs.oracle.com/security/security-alert-cve-2020-14750-released ∗∗∗ Security Updates Available for Adobe Acrobat and Reader (APSB20-67) ∗∗∗ --------------------------------------------- Adobe has published a security bulletin for Adobe Acrobat and Reader (APSB20-67). The updates referenced in the bulletin address critical, important and moderate vulnerabilities and Adobe recommends users update their product installations to the latest versions using the instructions referenced in the bulletin. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1939 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (blueman and wordpress), Fedora (fastd, kernel, and samba), Gentoo (bluez, fossil, kpmcore, libssh, and opendmarc), openSUSE (claws-mail and icinga2), and Ubuntu (blueman). --------------------------------------------- https://lwn.net/Articles/835952/ ∗∗∗ Googles Project Zero deckt Sicherheitslücke bei GitHub auf ∗∗∗ --------------------------------------------- Das Sicherheitsteam hat das Risiko der gefundenen Schwachstelle für Entwickler als hoch eingestuft. Eine schnelle Lösung des Problems gibt es bisher nicht. --------------------------------------------- https://heise.de/-4946535 ∗∗∗ Android Security Bulletin - November 2020 ∗∗∗ --------------------------------------------- [...] The most severe of these issues is a critical security vulnerability in the System component that could enable a proximal attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process. --------------------------------------------- https://source.android.com/security/bulletin/2020-11-01 ∗∗∗ Google Patches Actively Exploited Chrome Vulnerabilities ∗∗∗ --------------------------------------------- Google has released updates to address multiple vulnerabilities in the Chrome browser, including two that are actively exploited in attacks. Chrome 86.0.4240.183 for Windows, macOS, and Linux was pushed to the stable channel with patches for a total of seven vulnerabilities, all of which feature a severity rating of high. --------------------------------------------- https://www.securityweek.com/google-patches-actively-exploited-chrome-vulne… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.11.2020
by Daily end-of-shift report 02 Nov '20

02 Nov '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 30-10-2020 18:00 − Montag 02-11-2020 18:00 Handler: Dimitri Robl Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sicherheitslücke: Zero Day im Windows-Kernel veröffentlicht ∗∗∗ --------------------------------------------- Google hat die Sicherheitslücke nach nur 7 Tagen veröffentlicht, weil sie bereits aktiv ausgenutzt wurde. Patches gibt es nicht. --------------------------------------------- https://www.golem.de/news/sicherheitsluecke-zero-day-im-windows-kernel-vero… ∗∗∗ More File Selection Gaffes, (Sat, Oct 31st) ∗∗∗ --------------------------------------------- A reader submitted a file, that turned out to be a mass mailer project file used by malicious actors. --------------------------------------------- https://isc.sans.edu/diary/rss/26722 ∗∗∗ CSS-JS Steganography in Fake Flash Player Update Malware ∗∗∗ --------------------------------------------- This summer, MalwareBytes researcher Jérôme Segura wrote an article about how criminals use image files (.ico) to hide JavaScript credit card stealers on compromised e-commerce sites. In a tweet, Affable Kraut also reported another similar obfuscation technique using .ico files to conceal JavaScript skimmers. Just something I’ve noticed more recently with digital skimmers/#magecart. --------------------------------------------- https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-u… ∗∗∗ How to Protect Yourself From Pwned and Password Reuse Attacks ∗∗∗ --------------------------------------------- Many businesses are currently looking at how to bolster security across their organization as the pandemic and remote work situation continues to progress towards the end of the year. As organizations continue to implement security measures to protect business-critical data, there is an extremely important area of security that often gets overlooked - passwords. --------------------------------------------- https://thehackernews.com/2020/11/how-to-protect-yourself-from-pwned-and.ht… ∗∗∗ NAT Slipstreaming ∗∗∗ --------------------------------------------- NAT Slipstreaming allows an attacker to remotely access any TCP/UDP service bound to a victim machine, bypassing the victims NAT/firewall (arbitrary firewall pinhole control), just by the victim visiting a website. --------------------------------------------- https://samy.pl/slipstream/ ∗∗∗ Ransomware Protection and Containment Strategies: Practical Guidance forEndpoint Protection, Hardening, and Containment ∗∗∗ --------------------------------------------- UPDATE (Oct. 30, 2020): We have updated the report to include additional protection and containment strategies based on front-line visibility and response efforts in combating ransomware. While the full scope of recommendations included within the initial report remain unchanged, the following strategies have been added into the report: [...] --------------------------------------------- https://www.fireeye.com/blog/threat-research/2019/09/ransomware-protection-… ∗∗∗ Cisco Talos Advisory on Adversaries Targeting the Healthcare and Public Health Sector ∗∗∗ --------------------------------------------- Cisco Talos has become aware that an adversary is leveraging Trickbot banking trojan and Ryuk ransomware to target U.S. hospitals and healthcare providers at an increasing rate. Security journalists reported on October 28, 2020 that the adversary was preparing to encrypt systems at “potentially hundreds” of medical centers and hospitals, based on a tip from a researcher who had been monitoring communications for the threat actor. --------------------------------------------- https://blog.talosintelligence.com/2020/10/healthcare-advisory.html ∗∗∗ RiskIQ Has Released Its Corpus of Infrastructure and IOCs Related to Ryuk Ransomware ∗∗∗ --------------------------------------------- Ryuk Ransomware has flooded US hospitals, threatening to shut down their operations when theyre needed most. Ryuk now accounts for a third of all ransomware attacks in 2020, with its operators finding success while many healthcare organizations are most vulnerable. However, the cybersecurity community is coming together to combat this rash of attacks, combining resources to provide network defenders with alerts and intelligence to protect our healthcare institutions. --------------------------------------------- https://www.riskiq.com/blog/external-threat-management/ryuk-ransoware-indic… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Monday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (cimg, junit4, kernel, openldap, qtsvg-opensource-src, spice, spice-gtk, tzdata, and wireshark), Fedora (firefox, java-1.8.0-openjdk, java-11-openjdk, and thunderbird), openSUSE (apache2, binutils, libvirt, lout, pacemaker, pagure, phpMyAdmin, samba, sane-backends, singularity, spice, spice-gtk, thunderbird, nspr, tomcat, virt-bootstrap, and xen), SUSE (graphviz, liblouis, and samba), and Ubuntu (samba). --------------------------------------------- https://lwn.net/Articles/835838/ ∗∗∗ Oracle Security Alert for CVE-2020-14750 - 01 November 2020 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/alert-cve-2020-14750.html ∗∗∗ Hormann BiSecur Gateway and Home Server multiple vulnerabilities ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/hormann-bisecur-gateway-and-ho… ∗∗∗ WordPress: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1058 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 30.10.2020
by Daily end-of-shift report 30 Oct '20

30 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 29-10-2020 18:00 − Freitag 30-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ „2. Lockdown! Krise! Was jetzt?“ – SMS bewirbt betrügerische Investment-Plattform ∗∗∗ --------------------------------------------- Eine Verschärfung der Corona-Maßnahmen bedeutet für viele Menschen weniger Einkommen. Das wissen auch BetrügerInnen. Sie nutzen diese Notsituation bewusst aus. So kursiert derzeit eine betrügerische SMS, in der eine scheinbar einfache Lösung angeboten wird: Das Investieren in Bitcoins – allerdings auf einer unseriösen Plattform. Die Schadenssummen, die dabei entstehen, reichen von 200 Euro bis weit über 100.000 Euro. Löschen Sie daher die SMS! --------------------------------------------- https://www.watchlist-internet.at/news/2-lockdown-krise-was-jetzt-sms-bewir… ∗∗∗ [SANS ISC] Quick Status of the CAA DNS Record Adoption ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “Quick Status of the CAA DNS Record Adoption“: In 2017, we already published a guest diary about “CAA” or “Certification Authority Authorization”. I was curious about the status of this technique and the adoption level in 2020. Has it been adopted massively sinceThe post [SANS ISC] Quick Status of the CAA DNS Record Adoption appeared first on /dev/random. --------------------------------------------- https://blog.rootshell.be/2020/10/30/sans-isc-quick-status-of-the-caa-dns-r… ∗∗∗ BEC Attacks Targeting Energy and Infrastructure Rise by 93% ∗∗∗ --------------------------------------------- Business email compromise attacks (BEC) have continued to grow in Q3 of 2020, rising by 15% overall compared to Q2, according to Abnormal Security’s Quarterly BEC Report. The average weekly volume of BEC attacks increased quarter-by-quarter in six out of eight industries, with the biggest rise observed in the energy/infrastructure sector, at 93%. --------------------------------------------- https://www.infosecurity-magazine.com/news/bec-attacks-energy-infrastructur… ∗∗∗ Pktvisor: Open source tool for network visibility ∗∗∗ --------------------------------------------- NS1 announced that pktvisor, a lightweight, open source tool for real-time network visibility, is available on GitHub. The importance of applications and digital services has skyrocketed in 2020. Connectivity and resilience are imperative to keeping people connected and business moving forward. Visibility into network traffic, especially in distributed edge environments and with malicious attacks on the rise, is a critical part of ensuring uptime and performance. --------------------------------------------- https://www.helpnetsecurity.com/2020/10/30/pktvisor-open-source-tool/ ∗∗∗ Oh ... Ransomware hat auch meine Backups verschlüsselt ... Was nun? ∗∗∗ --------------------------------------------- Das Thema Ransomware verfolgt Unternehmen weltweit nun schon ein bis zwei Jahrzehnte [1]. Es ist auch kein Trend zu erkennen, dass sich das bald ändern sollte. Es muss leider vom Gegenteil ausgegangen werden. Die Anzahl an Vorfällen ist besonders in den letzten Jahren gestiegen [2]. Angreifer setzten inzwischen nicht nur auf Verschlüsselung, sondern drohen mit der Veröffentlichung von Unternehmensdaten, welche vor dem Unbrauchbarmachen exfiltriert wurden, um die [...] --------------------------------------------- https://cert.at/de/blog/2020/10/oh-ransomware-hat-auch-meine-backups-versch… ===================== = Vulnerabilities = ===================== ∗∗∗ Attacks exploiting Netlogon vulnerability (CVE-2020-1472) ∗∗∗ --------------------------------------------- Microsoft has received a small number of reports from customers and others about continued activity exploiting a vulnerability affecting the Netlogon protocol (CVE-2020-1472) which was previously addressed in security updates starting on August 11, 2020. If the original guidance is not applied, the vulnerability could allow an attacker to spoof a domain controller account that could be [...] --------------------------------------------- https://msrc-blog.microsoft.com:443/2020/10/29/attacks-exploiting-netlogon-… ∗∗∗ Sicherheitslücken: Nvidia veröffentlicht BMC-Firmware-Updates für DGX-Server ∗∗∗ --------------------------------------------- Aus der AMI BMC-Firmware für Nvidias Deep-Learning-Server DGX-1, DGX-2 und DGX A100 wurden neun Sicherheitslücken entfernt, von denen eine als kritisch gilt. --------------------------------------------- https://heise.de/-4943948 ∗∗∗ Vulnerability Spotlight: Multiple vulnerabilities in Synology SRM (Synology Router Manager) ∗∗∗ --------------------------------------------- Cisco Talos recently discovered multiple remote vulnerabilities in software that helps power Synology routers. The bugs exist in Synology Router Manager (SRM) - a Linux-based operating system for Synology routers - and QuickConnect, a feature inside SRM that allows users to remotely connect to their routers. An adversary could use these vulnerabilities to carry out a range of [...] --------------------------------------------- https://blog.talosintelligence.com/2020/10/vulnerability-spotlight-multiple… ∗∗∗ October 29, 2020 TNS-2020-07 [R1] Nessus Agent 8.2.0 Fixes One Vulnerability ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2020-07 ∗∗∗ October 29, 2020 TNS-2020-08 [R1] Nessus 8.12.1 Fixes One Vulnerability ∗∗∗ --------------------------------------------- http://www.tenable.com/security/tns-2020-08 ∗∗∗ Wireshark: Mehrere Schwachstellen ermöglichen Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1054 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 29.10.2020
by Daily end-of-shift report 29 Oct '20

29 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 28-10-2020 18:00 − Donnerstag 29-10-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Upcoming Security Updates for Adobe Acrobat and Reader (APSB20-67) ∗∗∗ --------------------------------------------- A prenotification security advisory (APSB20-67) has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, November 03, 2020. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well as the Adobe PSIRT Blog. This posting is provided “AS IS” with no warranties and [...] --------------------------------------------- https://blogs.adobe.com/psirt/?p=1936 ∗∗∗ CPU: ME-Hacker knacken Intel-Microcode-Updates ∗∗∗ --------------------------------------------- Sicherheitsforscher können die Microcode-Updates für Intel-CPUs entschlüsseln und untersuchen. Eine Übernahme ist damit noch nicht möglich. --------------------------------------------- https://www.golem.de/news/cpu-me-hacker-knacken-intel-microcode-updates-201… ∗∗∗ 5 Places Where You’d Never Expect to Get Hacked ∗∗∗ --------------------------------------------- For every gleaming new IoT device that hits the market, a hacker somewhere is figuring out how to compromise it. Today, even routine activities can land you in the sights of a bad actor. --------------------------------------------- https://blog.sucuri.net/2020/10/5-places-where-youd-never-expect-to-get-hac… ∗∗∗ Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser ∗∗∗ --------------------------------------------- Throughout 2020, ransomware activity has become increasingly prolific, relying on an ecosystem of distinct but co-enabling operations to gain access to targets of interest before conducting extortion. Mandiant Threat Intelligence has tracked several loader and backdoor campaigns that lead to the post-compromise deployment of ransomware, sometimes within 24 hours of initial compromise. Effective and fast detection of these campaigns is key to mitigating this threat. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-w… ∗∗∗ Jetzt patchen! Angreifer scannen nach verwundbaren Oracle-WebLogic-Servern ∗∗∗ --------------------------------------------- Admins sollten ihre WebLogic-Server aus Sicherheitsgründen auf den aktuellen Stand bringen. --------------------------------------------- https://heise.de/-4942360 ∗∗∗ Erpressungstrojaner: Maze hört wohl auf, REvil macht 100 Millionen US-Dollar ∗∗∗ --------------------------------------------- Ransomware ist nach wie vor der Star der Malware-Szene. Die Drahtzieher bauen ihr "Geschäftsmodell" stetig aus und ernten damit Umsätze in Millionenhöhe. --------------------------------------------- https://heise.de/-4942549 ∗∗∗ ESET Threat Report für das 3. Quartal 2020 ∗∗∗ --------------------------------------------- Die Bedrohungslage im zweiten Quartal 2020 aus Sicht der ESET-Telemetrie und der ESET-Sicherheitsforscher. --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/10/28/eset-threat-report-fuer-d… ∗∗∗ Domain Parking: A Gateway to Attackers Spreading Emotet and Impersonating McAfee ∗∗∗ --------------------------------------------- Domain parking might appear harmless at first glance, but parked domains can redirect visitors to unwanted landing pages or turn entirely malicious. --------------------------------------------- https://unit42.paloaltonetworks.com/domain-parking/ ===================== = Vulnerabilities = ===================== ∗∗∗ Code vulnerabilities put health records at risk ∗∗∗ --------------------------------------------- OpenEMR is the most popular open source software for electronic health record and medical practice management. It is used world-wide to manage sensitive patient data, including information about medications, laboratory values, and diseases. [...] During our security research of popular web applications, we discovered several code vulnerabilities in OpenEMR 5.0.2.1. A combination of these vulnerabilities allowed remote attackers to execute arbitrary system commands on any OpenEMR server that [...] --------------------------------------------- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability ∗∗∗ Samba: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Samba ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen. --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1051 ∗∗∗ F5 BIG-IP: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in F5 BIG-IP ausnutzen, um einen Denial of Service Angriff durchzuführen, Informationen offenzulegen oder einen Cross Site Scripting Angriff durchzuführen. --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1052 ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (linux-4.19), Fedora (tcpreplay, xen, and yubihsm-shell), SUSE (pacemaker), and Ubuntu (gosa and pam-python). --------------------------------------------- https://lwn.net/Articles/835552/ ∗∗∗ Security Bulletin: IBM Security Directory Suite is affected by security vulnerability(CVE-2018-4441) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-directory-su… ∗∗∗ Security Bulletin: Multiple security vulnerabilities have been identified in IBM® Java SDK that affect IBM Security Directory Suite – October 2019 CPU ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: IBM i2 Analyst's Notebook Memory Corruption Vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-i2-analysts-notebook-… ∗∗∗ Security Bulletin: IBM Resilient OnPrem could allow an attacker on a restricted internal network to provide the server with a spoofed source IP address. (CVE-2020-4864) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-onprem-coul… ∗∗∗ Security Bulletin: Embedded WebSphere Application Server is vulnerable to an information disclosure vulnerability affects Content Collector for Email ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-embedded-websphere-applic… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data – Golang (CVE-2020-16845) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Embedded WebSphere Application Server is vulnerable to an information disclosure vulnerability affects Content Collector for Email ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-embedded-websphere-applic… ∗∗∗ Security Bulletin: Apache Struts (Publicly disclosed vulnerability) affects Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-struts-publicly-di… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 28.10.2020
by Daily end-of-shift report 28 Oct '20

28 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 27-10-2020 18:00 − Mittwoch 28-10-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ So schützen Sie sich im Webbrowser vor Phishing-Attacken ∗∗∗ --------------------------------------------- Derzeit werden der Watchlist Internet sehr viele Phishing-Versuche gemeldet. Die BetrügerInnen werden dabei immer raffinierter. Damit Sie sich besser vor den betrügerischen Phishing-Seiten schützen können, zeigen wir Ihnen Schritt für Schritt wie Sie Phishing-Warnungen in Google Chrome und Firefox einschalten können. --------------------------------------------- https://www.watchlist-internet.at/news/so-schuetzen-sie-sich-im-webbrowser-… ∗∗∗ LokiBot Malware: What it is and how to respond to it ∗∗∗ --------------------------------------------- The Cybersecurity and Infrastructure Agency (CISA) of the U.S. Department of Homeland Security recently announced that activity in LokiBot, a form of aggressive malware, has increased dramatically over the last two months. The activity increase was discovered by an automated intrusion detection system referred to as EINSTEIN, which the Department of Homeland Security uses for collecting and analyzing security information across numerous [...] --------------------------------------------- https://cybersecurity.att.com/blogs/security-essentials/lokibot-malware-wha… ∗∗∗ Microsoft Defender ATP scars admins with false Cobalt Strike alerts ∗∗∗ --------------------------------------------- Administrators woke up to a scary surprise today after false positives in Microsoft Defender ATP showed network devices infected with Cobalt Strike. --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-atp-scar… ∗∗∗ Facebook "copyright violation" tries to get past 2FA - don’t fall for it! ∗∗∗ --------------------------------------------- Watch out for "Facebook copyright violation" emails - even if they link straight back to Facebook.com --------------------------------------------- https://nakedsecurity.sophos.com/2020/10/27/facebook-copyright-violation-tr… ∗∗∗ SMBGhost - the critical vulnerability many seem to have forgotten to patch, (Wed, Oct 28th) ∗∗∗ --------------------------------------------- You probably remember that back in March, Microsoft released a patch for a vulnerability in SMBv3 dubbed SMBGhost (CVE-2020-0796), since at that time, it received as much media attention as was reasonable for a critical (CVSS 10.0) vulnerability in Windows, which might lead to remote code execution[1]. --------------------------------------------- https://isc.sans.edu/diary/rss/26732 ∗∗∗ Hörmann - Tag der offenen Tür für alle... ∗∗∗ --------------------------------------------- Die Erkennung potenzieller Schwachstellen durch SEC Consult erwies sich als hilfreich, um das gesamte BiSecur-System zu verbessern. --------------------------------------------- https://www.sec-consult.com/./blog/2020/10/hoermann-tag-der-offenen-tuer-fu… ∗∗∗ TrickBot Linux Variants Active in the Wild Despite Recent Takedown ∗∗∗ --------------------------------------------- Efforts to disrupt TrickBot may have shut down most of its critical infrastructure, but the operators behind the notorious malware arent sitting idle. According to new findings shared by cybersecurity firm Netscout, TrickBots authors have moved portions of their code to Linux in an attempt to widen the scope of victims that could be targeted. --------------------------------------------- https://thehackernews.com/2020/10/trickbot-linux-variants-active-in-wild.ht… ∗∗∗ Welcome to ThreatPursuit VM: A Threat Intelligence and Hunting Virtual Machine ∗∗∗ --------------------------------------------- Skilled adversaries can deceive detection and often employ new measures in their tradecraft. Keeping a stringent focus on the lifecycle and evolution of adversaries allows analysts to devise new detection mechanisms and response processes. Access to the appropriate tooling and resources is critical to discover these threats within a timely and accurate manner. Therefore, we are actively compiling the most essential software packages into a Windows-based distribution: ThreatPursuit VM. --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/10/threatpursuit-vm-threat… ===================== = Vulnerabilities = ===================== ∗∗∗ Security updates for Wednesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (blueman), Fedora (nodejs), Gentoo (firefox), openSUSE (kleopatra), Oracle (java-1.8.0-openjdk), SUSE (apache2, binutils, firefox, pacemaker, sane-backends, spice, spice-gtk, tomcat, virt-bootstrap, xen, and zeromq), and Ubuntu (ca-certificates, mariadb-10.1, mariadb-10.3, netty, openjdk-8, openjdk-lts, perl, and tomcat6). --------------------------------------------- https://lwn.net/Articles/835497/ ∗∗∗ Sicherheitsupdate: Angreifer könnten eigene Befehle auf Qnap NAS ausführen ∗∗∗ --------------------------------------------- Netzwerkspeicher von Qnap sind über zwei Lücken attackierbar. Ein Patch schafft Abhilfe. --------------------------------------------- https://heise.de/-4941315 ∗∗∗ MediaWiki: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1048 ∗∗∗ Red Hat OpenShift: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1049 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Jul 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in IBM Java SDK affect IBM Tivoli System Automation Application Manager Jul 2020 (CVE-2020-2590) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect ITCAM for SOA (July 2020) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js serialize-javascript affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: Security vulnerability in Java SE affects Rational Build Forge (CVE-2020-2601) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerability-in… ∗∗∗ Security Bulletin: Vulnerability in Network Time Protocol (NTP) affects IBM Virtualization Engine TS7700 (CVE-2020-11868) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-network-… ∗∗∗ Security Bulletin: Security vulnerabilities in Java SE affects Rational Build Forge ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js jison affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: IBM WebSphere Cast Iron Solution & App Connect Professional is affected by Apache Tomcat vulnerabilities. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-websphere-cast-iron-s… ∗∗∗ Security Bulletin: A Remote Vulnerability Affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2020-4767) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-remote-vulnerability-af… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 27.10.2020
by Daily end-of-shift report 27 Oct '20

27 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 23-10-2020 18:00 − Dienstag 27-10-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Vorsicht: Betrügerisches FinanzOnline-E-Mail im Umlauf ∗∗∗ --------------------------------------------- Aktuell sind gefälschte E-Mails im Namen des Finanzamtes unterwegs. In der E-Mail werden Sie über Ihre Steuerrückerstattung informiert und aufgefordert, die Transaktion zu genehmigen. Klicken Sie aber keinesfalls auf den Link, Sie landen auf einer gefälschten FinanzOnline-Website, die es Kriminellen ermöglicht, persönliche Daten sowie Kreditkartendaten abzugreifen! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-betruegerisches-finanzonlin… ∗∗∗ Industrieanlagen mit OPC UA systematisch schlecht konfiguriert ∗∗∗ --------------------------------------------- Forscher des Fraunhofer FKIE und der RWTH Aachen haben das Internet nach Steuerungen auf Basis des Standards OPC UA durchsucht. 92% waren unsicher eingerichtet. --------------------------------------------- https://heise.de/-4939199 ∗∗∗ Sicherheitsupdate: Angreifer attackieren Microsofts Webbrowser Edge ∗∗∗ --------------------------------------------- Die Entwickler von Microsoft haben im Webbrowser Edge mehrere Sicherheitslücken geschlossen. --------------------------------------------- https://heise.de/-4940091 ∗∗∗ Malware Emotet versteckt sich hinter gefälschtem Upgrade für Microsoft Word ∗∗∗ --------------------------------------------- Eine neue Kampagne gaukelt Opfern vor, sie benötigen ein Upgrade mit neuen Funktionen für Microsoft Word. Tatsächlich sollen sie die Sicherheitsvorkehrungen zum Schutz vor gefährlichen Makros deaktivieren. Die schädlichen Dokumente verteilen die Hintermänner weiterhin per E-Mail. --------------------------------------------- https://www.zdnet.de/88389137/malware-emotet-versteckt-sich-hinter-gefaelsc… ∗∗∗ KashmirBlack: Botnet attackiert WordPress, Joomla und Drupal ∗∗∗ --------------------------------------------- Die Hintermänner nutzen bekannte Schwachstellen in CMS-Plattformen und Plug-ins. Darüber schleusen sie einen Cryptominer ein. Laut Imperva verfügt das Botnet inzwischen über eine "massive Infrastruktur". --------------------------------------------- https://www.zdnet.de/88389169/kashmirblack-botnet-attackiert-wordpress-joom… ∗∗∗ New RAT malware gets commands via Discord, has ransomware feature ∗∗∗ --------------------------------------------- The new Abaddon remote access trojan may be the first to use Discord as a full-fledged command and control server that instructs the malware on what tasks to perform on an infected PC. Even worse, a ransomware feature is being developed for the malware. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-command… ∗∗∗ Massive Nitro data breach impacts Microsoft, Google, Apple, more ∗∗∗ --------------------------------------------- A massive data breach suffered by the Nitro PDF service impacts many well-known organizations, including Google, Apple, Microsoft, Chase, and Citibank. --------------------------------------------- https://www.bleepingcomputer.com/news/security/massive-nitro-data-breach-im… ∗∗∗ Study of the ShadowPad APT backdoor and its relation to PlugX ∗∗∗ --------------------------------------------- In July 2020, we released a study of targeted attacks on state institutions in Kazakhstan and Kyrgyzstan with a detailed analysis of malware found in compromised networks. During the investigation, Doctor Web specialists analyzed and described several groups of trojan programs, including new samples of trojan families already encountered by our virus analysts, as well as previously unknown trojans. --------------------------------------------- https://news.drweb.com/show/?i=14048&lng=en&c=9 ∗∗∗ Majority of Microsoft 365 Admins Don’t Enable MFA ∗∗∗ --------------------------------------------- Beyond admins, researchers say that 97 percent of all total Microsoft 365 users do not use multi-factor authentication. --------------------------------------------- https://threatpost.com/microsoft-365-admins-mfa/160592/ ∗∗∗ LinkedIn, Instagram Vulnerable to Preview-Link RCE Security Woes ∗∗∗ --------------------------------------------- Popular chat apps, including LINE, Slack, Twitter DMs and others, can also leak location data and share private info with third-party servers. --------------------------------------------- https://threatpost.com/linkedin-instagram-preview-link-rce-security/160600/ ∗∗∗ Excel 4 Macros: "Abnormal Sheet Visibility", (Mon, Oct 26th) ∗∗∗ --------------------------------------------- Excel 4 macros are composed of formulas (commands) and values stored inside a sheet. --------------------------------------------- https://isc.sans.edu/diary/rss/26726 ∗∗∗ Password Security & Password Managers ∗∗∗ --------------------------------------------- In the spirit of National Cyber Security Awareness Month (NCSAM), let’s talk about a security basic that many people overlook: passwords. These are one of the most fundamental aspects of website security, yet we too often see webmasters taking a lax approach to secure passwords. In fact, the online security provider TeamPassword found that last year the most commonly leaked password was 123456. That edges out some real gems including qwerty and the always-popular password. --------------------------------------------- https://blog.sucuri.net/2020/10/password-security-password-managers.html ∗∗∗ P.A.S. Fork v. 1.0 — A Web Shell Revival ∗∗∗ --------------------------------------------- A PHP shell containing multiple functions can easily consist of thousands of lines of code, so it’s no surprise that attackers often reuse the code from some of the most popular PHP web shells, like WSO or b374k. After all, if these popular (and readily available) PHP web shells do the job, there’s no need to code an entirely new tool. --------------------------------------------- https://blog.sucuri.net/2020/10/p-a-s-fork-v-1-0-a-web-shell-revival.html ===================== = Vulnerabilities = ===================== ∗∗∗ VU#760767: Macrium Reflect is vulnerable to privilege escalation due to OPENSSLDIR location ∗∗∗ --------------------------------------------- Overview Macrium Reflect contains a privilege escalation vulnerability due to the use of an OPENSSLDIR variable that specifies a location where an unprivileged Windows user can create files. Description CVE-2020-10143 Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\openssl\. Macrium Reflect contains a privileged service that uses this OpenSSL component. Because unprivileged Windows users can create subdirectories off of the system root, a user can create [...] --------------------------------------------- https://kb.cert.org/vuls/id/760767 ∗∗∗ Security updates for Tuesday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (thunderbird), Fedora (createrepo_c, dnf-plugins-core, dnf-plugins-extras, librepo, livecd-tools, and pdns-recursor), openSUSE (firefox and mailman), Oracle (firefox), Red Hat (chromium-browser, java-1.8.0-openjdk, and Satellite 6.8), Scientific Linux (java-1.8.0-openjdk), SUSE (libvirt), and Ubuntu (blueman, firefox, mysql-5.7, mysql-8.0, php7.4, and ruby-kramdown). --------------------------------------------- https://lwn.net/Articles/835401 ∗∗∗ HPE/Aruba: Kritische Lücken in SSMC, AirWave Glass und weiteren Produkten ∗∗∗ --------------------------------------------- Jetzt updaten: Unter anderem kann eine Lücke mit Höchstwertung in der StoreServ Management Console Angreifern unbefugte Remote-Zugriffe leicht machen. --------------------------------------------- https://heise.de/-4938532 ∗∗∗ NVIDIA Patches Code Execution Flaws in GeForce Experience ∗∗∗ --------------------------------------------- Patches released by NVIDIA last week for the GeForce Experience software address two arbitrary code execution bugs assessed with a severity rating of high. --------------------------------------------- https://www.securityweek.com/nvidia-patches-code-execution-flaws-geforce-ex… ∗∗∗ Trend Micro AntiVirus for Mac: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1047 ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-1045 ∗∗∗ Security Bulletin: IBM API Connect's Developer Portal is vulnerable to social engineering attacks (CVE-2020-4337) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connects-develope… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Platform Symphony and IBM Spectrum Symphony ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2020-8169, CVE-2020-8177) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-curl-a… ∗∗∗ Security Bulletin: Vulnerabilities in NTPv4 affect AIX (CVE-2020-11868, CVE-2020-13817, and CVE-2020-15025) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ntpv4-… ∗∗∗ Security Bulletin: CVE-2020-15190 for Tensorflow in Watson Machine Learning Community Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cve-2020-15190-for-tensor… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 23.10.2020
by Daily end-of-shift report 23 Oct '20

23 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 22-10-2020 18:00 − Freitag 23-10-2020 18:00 Handler: Dimitri Robl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ R_Evil WordPress Hacktool & Malicious JavaScript Injections ∗∗∗ --------------------------------------------- We often see hackers reusing the same malware, with only a few new adjustments to obfuscate the code so that it is more difficult for scanning tools to detect. However, sometimes entirely new attack tools are created and deployed by threat actors who don’t want to rely on obfuscating existing malware. --------------------------------------------- https://blog.sucuri.net/2020/10/r_evil-wordpress-hacktool-malicious-javascr… ∗∗∗ Zahlreiche neue Fake-Shops locken mit günstigen Angeboten und gutem Kundendienst ∗∗∗ --------------------------------------------- Derzeit melden uns LeserInnen der Watchlist Internet zahlreiche neu registrierte Fake-Shops, die alle ähnlich aufgebaut sind und die gleichen Texte verwenden. Versprochen werden hochwertige Produkte, ein starkes Kundendienstteam und einfache Rückgabemöglichkeiten. Doch tatsächlich stecken hinter diesen vermeintlichen Online-Shops, Kriminelle. --------------------------------------------- https://www.watchlist-internet.at/news/zahlreiche-neue-fake-shops-locken-mi… ∗∗∗ Securing medical devices: Can a hacker break your heart? ∗∗∗ --------------------------------------------- Why are connected medical devices vulnerable to attack and how likely are they to get hacked? Here are five digital chinks in the armor. --------------------------------------------- https://www.welivesecurity.com/2020/10/23/securing-medical-devices-hack-hea… ∗∗∗ Practical example of fuzzing OPC UA applications ∗∗∗ --------------------------------------------- We continue to describe our approaches to searching for vulnerabilities in industrial systems based on the OPC UA protocol. In this article, we examine new techniques that can be used to search for memory corruption vulnerabilities if the source code is available. We also discuss an example of fuzzing using libfuzzer. --------------------------------------------- https://ics-cert.kaspersky.com/reports/2020/10/19/practical-example-of-fuzz… ===================== = Vulnerabilities = ===================== ∗∗∗ VMware Horizon Server and VMware Horizon Client updates address multiple security vulnerabilities (CVE-2020-3997, CVE-2020-3998) ∗∗∗ --------------------------------------------- VMware Horizon Server does not correctly validate user input. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.1. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0024.html ∗∗∗ Sicherheitsupdate: Nvidia Geforce Experience macht PCs vielfältig angreifbar ∗∗∗ --------------------------------------------- Nvidias Entwickler haben drei Sicherheitslücken im Grafikkarten-Tool Geforce Experience geschlossen. --------------------------------------------- https://heise.de/-4937481 ∗∗∗ Cisco Adaptive Security Appliance Software SSL/TLS Denial of Service Vulnerability ∗∗∗ --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms Jul 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect z/TPF ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application and IHS server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager Jul 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-manage… ∗∗∗ Multiple Vulnerabilities in PubliXone ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/multiple-vulnerabilities-in-pu… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.10.2020
by Daily end-of-shift report 22 Oct '20

22 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 21-10-2020 18:00 − Donnerstag 22-10-2020 18:00 Handler: Dimitri Robl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Das sind die Gewinner von Österreichs größtem Hacker-Wettbewerb ∗∗∗ --------------------------------------------- Das Finale der Austria Cyber Security Challenge 2020 wurde virtuell ausgetragen. Die Sieger stehen fest. --------------------------------------------- https://futurezone.at/digital-life/das-sind-die-gewinner-von-oesterreichs-g… ∗∗∗ BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon, (Thu, Oct 22nd) ∗∗∗ --------------------------------------------- Phishing messages distributing BazarLoader have come to be commonplace in the past six months, but in the last couple of weeks Ive been seeing more and more e-mails spreading this malware caught in my quarantine. Although contents of these messages differ, their appearance is usually similar [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26710 ∗∗∗ XSS to TSS: tech support scam campaign abuses cross-site scripting vulnerability ∗∗∗ --------------------------------------------- This tech support scam is being spread via Facebook links and uses several redirection mechanisms to avoid detection. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2020/10/xss-to-tss-tech-support-sc… ∗∗∗ Abusing RDP’s Remote Credential Guard with Rubeus PTT ∗∗∗ --------------------------------------------- TL;DR Microsoft’s Remote Credential Guard (RCG) for RDP protects creds if an RDP server is compromised. It leaves little scope for password or NTLM credential dumping when a user connects [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/abusing-rdps-remote-credentia… ===================== = Vulnerabilities = ===================== ∗∗∗ VU#208577: Chocolatey Boxstarter vulnerable to privilege escalation due to weak ACLs ∗∗∗ --------------------------------------------- Chocolatey Boxstarter fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. --------------------------------------------- https://kb.cert.org/vuls/id/208577 ∗∗∗ Gefährliche Lücken in Cisco-Software für Netzwerkschutz und -Management ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat wichtige Sicherheitsupdates für verschiedene Netzwerk-Software veröffentlicht. Keine Lücke gilt als kritisch. --------------------------------------------- https://heise.de/-4936512 ∗∗∗ Vulnerability Spotlight: A deep dive into WAGO’s cloud connectivity and the vulnerabilities that arise ∗∗∗ --------------------------------------------- WAGO makes several programmable automation controllers that are used in many industries including automotive, rail, power engineering, manufacturing and building management. Cisco Talos discovered 41 vulnerabilities in their PFC200 and PFC100 controllers. --------------------------------------------- https://blog.talosintelligence.com/2020/10/vulnerability-spotlight-deep-div… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM InfoSphere Information Server ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Publicly disclosed vulnerability from Kernel affects IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: A security vulnerability in Node.js node-fetch module affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Infrastructure Management. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 22.10.2020
by Daily end-of-shift report 22 Oct '20

22 Oct '20

-- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 21.10.2020
by Daily end-of-shift report 21 Oct '20

21 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 20-10-2020 18:00 − Mittwoch 21-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ TrickBot malware under siege from all sides, and its working ∗∗∗ --------------------------------------------- The Trickbot malware operation is on the brink of going down completely following efforts from an alliance of cybersecurity and hosting providers targeting the botnets command and control servers. --------------------------------------------- https://www.bleepingcomputer.com/news/security/trickbot-malware-under-siege… ∗∗∗ LockBit ransomware moves quietly on the network, strikes fast ∗∗∗ --------------------------------------------- LockBit ransomware takes as little as five minutes to deploy the encryption routine on target systems once it lands on the victim network. --------------------------------------------- https://www.bleepingcomputer.com/news/security/lockbit-ransomware-moves-qui… ∗∗∗ Shipping dangerous goods, (Wed, Oct 21st) ∗∗∗ --------------------------------------------- For the past several months, I've been tracking a campaign that sends rather odd-looking emails like this. --------------------------------------------- https://isc.sans.edu/diary/rss/26702 ∗∗∗ Securing Your Online Store for the Holidays ∗∗∗ --------------------------------------------- Shopping season is here, and so is the opportunity for ecommerce site owners to grow their business and generate revenue. In lieu of the changing global ecommerce climate that this pandemic has produced, comes the importance of securing your website to protect your users — and your revenue streams. --------------------------------------------- https://blog.sucuri.net/2020/10/securing-your-online-store-for-the-holidays… ∗∗∗ Studie: Mehr als die Häfte aller Windows-Server ist Security-Schrott ∗∗∗ --------------------------------------------- Rund 58 Prozent aller Windows Server im Internet werden nicht mehr regelmäßig mit Sicherheits-Updates versorgt und sind damit tickende Zeitbomben. --------------------------------------------- https://heise.de/-4933295 ∗∗∗ How safe is your USB drive? ∗∗∗ --------------------------------------------- What are some of the key security risks to be aware of when using USB flash drives and how can you mitigate the threats? --------------------------------------------- https://www.welivesecurity.com/2020/10/20/how-safe-is-your-usb-drive/ ∗∗∗ Video: So entlarven Sie betrügerische Werbung im Internet ∗∗∗ --------------------------------------------- Ob auf Google, in Sozialen Medien oder in Apps – überall lauert Werbung, die uns dazu bringen will, ein bestimmtes Produkt zu kaufen oder eine Dienstleistung in Anspruch zu nehmen. Doch nicht jede Werbung ist seriös. --------------------------------------------- https://www.watchlist-internet.at/news/video-so-entlarven-sie-betruegerisch… ∗∗∗ IP Spoofing inbound verhindern ∗∗∗ --------------------------------------------- Die Brigham Young University schickt gerade Empfehlungsschreiben an Internet Provider aus, in denen darauf hingewiesen wird, dass es beidiesen möglich ist, eingehende IP Pakete mit Source-Adressen aus dem Netz des Internet Providers zu empfangen. --------------------------------------------- https://cert.at/de/blog/2020/10/ip-spoofing-inbound-verhindern ===================== = Vulnerabilities = ===================== ∗∗∗ Big Blue Button: Das große blaue Sicherheitsrisiko ∗∗∗ --------------------------------------------- Kritische Sicherheitslücken, die Golem.de dem Entwickler der Videochat-Software Big Blue Button meldete, sind erst nach Monaten geschlossen worden. --------------------------------------------- https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisik… ∗∗∗ Chrome zero-day in the wild – patch now! ∗∗∗ --------------------------------------------- https://nakedsecurity.sophos.com/2020/10/21/chrome-zero-day-in-the-wild-pat… ∗∗∗ Oracle Critical Patch Update Advisory - October 2020 ∗∗∗ --------------------------------------------- https://www.oracle.com/security-alerts/cpuoct2020.html ∗∗∗ Security Bulletin: A security vulnerability in angular.js affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where an unprivileged local user may cause a denial of service ( CVE-2020-4411) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-… ∗∗∗ Security Bulletin: A security vulnerability in Node.js acorn and bootstrap-select affects IBM Cloud Pak for Multicloud Management Infrastructure Management and Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: A security vulnerability in GO affects IBM Cloud Pak for Multicloud Management Managed Service. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-security-vulnerability-… ∗∗∗ Security Bulletin: BIND for IBM i is affected by CVE-2020-8622 and CVE-2020-8624 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-bind-for-ibm-i-is-affecte… ∗∗∗ Security Bulletin: A vulnerability in IBM Spectrum Scale packaged in IBM Elastic Storage System could cause a denial of service (CVE-2020-4756) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-sp… ∗∗∗ Security Bulletin: IBM MQ could allow leak sensitive information due to an error within the pre-v7 pubsub logic (CVE-2020-4319) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-could-allow-leak-s… ∗∗∗ Security Bulletin: Multiple vulnerabilities in GNU Binutils affect IBM Netezza Platform Software clients. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 20.10.2020
by Daily end-of-shift report 20 Oct '20

20 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Montag 19-10-2020 18:00 − Dienstag 20-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Ryuk Ransomware Gang Uses Zerologon Bug for Lightning-Fast Attack ∗∗∗ --------------------------------------------- Researchers said the group was able to move from initial phish to full domain-wide encryption in just five hours. --------------------------------------------- https://threatpost.com/ryuk-ransomware-gang-zerologon-lightning-attack/1602… ∗∗∗ Mirai-alike Python Scanner, (Tue, Oct 20th) ∗∗∗ --------------------------------------------- Last week, I found an interesting Python script that behaves like a Mirai bot. It scans for vulnerable devices exposing their telnet (TCP/23) interface in the wild, then tries to connect using a dictionary of credentials. --------------------------------------------- https://isc.sans.edu/diary/rss/26698 ∗∗∗ Advanced Ransomware Attacks ∗∗∗ --------------------------------------------- SI-CERT, the national CSIRT of Slovenia has been handling reports of ransomware attacks on a regular basis since April 2012. Until 2019, attack victims were selected randomly as part of a mass-volume campaign aiming to spread the virus. However, since 2019 the attacks have been more targeted. --------------------------------------------- https://connect.geant.org/2020/10/19/advanced-ransomware-attacks ∗∗∗ Beim Kauf auf Kleinanzeigen-Plattformen: Zahlung nicht via PayPal-Funktion „Geld an Freunde oder Familie senden“ durchführen ∗∗∗ --------------------------------------------- Auf den beliebten Kleinanzeigen-Plattformen wie willhaben, shpock oder ebay Kleinanzeigen treiben auch Kriminelle ihr Unwesen. Neben Vorkasse- und Treuhand-Betrug ist auch der PayPal-Trick eine beliebte Masche, um KäuferInnen abzuzocken. --------------------------------------------- https://www.watchlist-internet.at/news/beim-kauf-auf-kleinanzeigen-plattfor… ===================== = Vulnerabilities = ===================== ∗∗∗ Security Bulletins Posted ∗∗∗ --------------------------------------------- Adobe has published security bulletins for Adobe Illustrator (APSB20-53), Adobe Dreamweaver (APSB20-55), Marketo(APSB20-60), Adobe Animate (APSB20-61), Adobe After Effects (APSB20-62), Adobe Photoshop (APSB20-63), Adobe Premiere Pro (APSB20-64), Adobe Media Encoder (APSB20-65), Adobe InDesign (APSB20-66) and Adobe Creative Cloud Desktop Application (APSB20-68). --------------------------------------------- https://blogs.adobe.com/psirt/?p=1930 ∗∗∗ QNAP: Sicherheitsupdates für QTS wehren "Zerologon"-Angriffe auf NAS ab ∗∗∗ --------------------------------------------- Je nach Konfiguration können Netzwerkspeicher von QNAP über die Sicherheitslücke "Zerologon" aus der Ferne angreifbar sein. Updates für QTS stehen bereit. --------------------------------------------- https://heise.de/-4932748 ∗∗∗ Seven mobile browsers vulnerable to address bar spoofing attacks ∗∗∗ --------------------------------------------- Vulnerabilities allow attackers to trick users into accessing malicious sites while showing the incorrect URL in the address bar. --------------------------------------------- https://www.zdnet.com/article/seven-mobile-browsers-vulnerable-to-address-b… ∗∗∗ Security Bulletin: Cross-Site Scripting Security Vulnerability Affects IBM Sterling B2B Integrator Standard Edition ( CVE-2020-4564) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-secu… ∗∗∗ Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where an unprivileged local user may cause a denial of service ( CVE-2020-4411) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-has-been-… ∗∗∗ Security Bulletin: IBM Elastic Storage System 3000 is affected by weak cryptographic algorithm (CVE-2020-4350) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-elastic-storage-syste… ∗∗∗ Security Bulletin: SQL Injection Vulnerability Affects the Graphic Process Modeler in IBM Sterling B2B Integrator (CVE-2019-4680) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-sql-injection-vulnerabili… ∗∗∗ Security Bulletin: There are multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-there-are-multiple-vulner… ∗∗∗ Security Bulletin: A vulnerability in IBM Spectrum Scale packaged in IBM Elastic Storage System could cause a denial of service (CVE-2020-4756) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-sp… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MessageGateway ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Cross-Site Scripting Vulnerability Affects IBM Sterling File Gateway (CVE-2020-4564) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities affect the IBM Spectrum Scale GUI. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the Linux Kernel used in IBM Elastic Storage System ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ XSA-347 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-347.html ∗∗∗ XSA-346 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-346.html ∗∗∗ XSA-345 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-345.html ∗∗∗ XSA-332 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-332.html ∗∗∗ XSA-331 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-331.html ∗∗∗ XSA-286 ∗∗∗ --------------------------------------------- https://xenbits.xen.org/xsa/advisory-286.html ∗∗∗ Security Vulnerabilities fixed in Firefox 82 ∗∗∗ --------------------------------------------- https://www.mozilla.org/en-US/security/advisories/mfsa2020-45/ ∗∗∗ Synology-SA-20:24 Media Server ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_24 ∗∗∗ Synology-SA-20:23 Download Station ∗∗∗ --------------------------------------------- https://www.synology.com/en-global/support/security/Synology_SA_20_23 ∗∗∗ VMware ESXi: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1003 ∗∗∗ Nagios Enterprises Nagios XI: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1005 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 19.10.2020
by Daily end-of-shift report 19 Oct '20

19 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 16-10-2020 18:00 − Montag 19-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ Hackers now abuse BaseCamp for free malware hosting ∗∗∗ --------------------------------------------- Phishing campaigns have started to use Basecamp as part of malicious phishing campaigns that distribute malware or steal your login credentials. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hackers-now-abuse-basecamp-f… ∗∗∗ Enumerate AWS API Permissions Without Logging to CloudTrail ∗∗∗ --------------------------------------------- The following is a technical writeup for a bug I found in the AWS API that allows you to enumerate certain permissions for a role without logging to CloudTrail. It affects 645 different API actions across 40 different AWS services. This would be beneficial for a Penetration Tester or a Red Teamer to enumerate what permissions the role or user they’ve compromised has access to without alerting the blue team as no logs are generated in CloudTrail. --------------------------------------------- https://frichetten.com/blog/aws-api-enum-vuln/ ∗∗∗ Secret fragments: Remote code execution on Symfony based websites ∗∗∗ --------------------------------------------- This configuration value, secret, is also used, for instance, to build CSRF tokens and remember-me tokens. Given its importance, this value must obviously be very random. Unfortunately, we discovered that oftentimes, the secret either has a default value, or there exist ways to obtain the value, bruteforce it offline, or to purely and simply bypass the security check that it is involved with. It most notably affects Bolt, eZPlatform, and eZPublish. --------------------------------------------- https://www.ambionics.io/blog/symfony-secret-fragment ===================== = Vulnerabilities = ===================== ∗∗∗ Magento, Visual Studio Code users: You need to patch! ∗∗∗ --------------------------------------------- * Microsoft has fixed CVE-2020-17023, a remote code execution vulnerability in Visual Studio Code, its free and extremely popular source-code editor that’s available for Windows, macOS and Linux. * Microsoft has also fixed a RCE (CVE-2020-17022) in the way that Microsoft Windows Codecs Library handles objects in memory, which could be triggered by a program processing a specially crafted image file. It only affects Windows 10 users, and only if they installed the optional HEVC or “HEVC from Device Manufacturer” media codecs from Microsoft Store. * After fixing just one Adobe Flash Player flaw on October 2020 Patch Tuesday, Adobe has followed up with security updates for several Magento Commerce and Magento Open Source versions. --------------------------------------------- https://www.helpnetsecurity.com/2020/10/19/magento-visual-studio-code-users… ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen (CVE-2020-14185) ∗∗∗ --------------------------------------------- Ein entfernter, anonymer Angreifer kann eine Schwachstelle in der Atlassian Jira Software ausnutzen, um Sicherheitsvorkehrungen zu umgehen. --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-1002 ∗∗∗ Discord desktop app vulnerability chain triggered remote code execution attacks ∗∗∗ --------------------------------------------- Discord has patched a critical issue in the desktop version of the messaging app which left users vulnerable to remote code execution (RCE) attacks. --------------------------------------------- https://www.zdnet.com/article/discord-desktop-app-vulnerable-to-remote-code… ∗∗∗ FRITZ!Box DNS Rebinding Protection Bypass ∗∗∗ --------------------------------------------- RedTeam Pentesting discovered a vulnerability in FRITZ!Box router devices which allows to resolve DNS answers that point to IP addresses in the private local network, despite the DNS rebinding protection mechanism. --------------------------------------------- https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-003/ ∗∗∗ ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5602.php ∗∗∗ ReQuest Serious Play F3 Media Server 7.0.3 Remote Denial of Service ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5601.php ∗∗∗ ReQuest Serious Play F3 Media Server 7.0.3 Debug Log Disclosure ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5600.php ∗∗∗ ReQuest Serious Play Media Player 3.0 Directory Traversal File Disclosure Vulnerability ∗∗∗ --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5599.php ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Supplier Lifecycle Mgmt ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in the IBM SDK, Java Technology Edition affects IBM Performance Management products Q3 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Program Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Sourcing ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Contract Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: Multiple Oracle Database Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-oracle-database-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a DB2 jar vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 16.10.2020
by Daily end-of-shift report 16 Oct '20

16 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 15-10-2020 18:00 − Freitag 16-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ NPM nukes NodeJS malware opening Windows, Linux reverse shells ∗∗∗ --------------------------------------------- NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data. These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday. --------------------------------------------- https://www.bleepingcomputer.com/news/security/npm-nukes-nodejs-malware-ope… ∗∗∗ CVE-2020-16898: Windows ICMPv6 Router Advertisement RRDNS Option Remote Code Execution Vulnerability, (Thu, Oct 15th) ∗∗∗ --------------------------------------------- Highlights - Do not disable IPv6 entirely unless you want to break Windows in interesting ways. - This can only be exploited from the local subnet. - But it may lead to remote code execution / BSOD - PoC exploit is easy, but actual RCE is hard. - Patch For more details, see also the YouTube video I just published: [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26684 ∗∗∗ Traffic Analysis Quiz: Ugly-Wolf.net, (Fri, Oct 16th) ∗∗∗ --------------------------------------------- It's that time of the month again... Time for another traffic analysis quiz! This one is from a Windows 10 client logged into an Active Directory (AD) environment. --------------------------------------------- https://isc.sans.edu/diary/rss/26688 ∗∗∗ CVE-2020-15157 "ContainerDrip" Write-up ∗∗∗ --------------------------------------------- CVE-2020-15157: If an attacker publishes a public image with a crafted manifest that directs one of the image layers to be fetched from a web server they control and they trick a user or system into pulling the image, they can obtain the credentials used by ctr/containerd to access that registry. In some cases, this may be the user’s username and password for the registry. In other cases, this may be the credentials attached to the cloud virtual instance which can grant access to other [...] --------------------------------------------- https://darkbit.io/blog/cve-2020-15157-containerdrip ∗∗∗ CMS Drupal: OAuth Server-Modul anfällig für SQL-Injection-Angriffe ∗∗∗ --------------------------------------------- Das OAuth Server-Modul für Drupal 8 benötigt ein Update auf 8.x-1.1. Die neue Version schließt eine "moderat kritische" Lücke. --------------------------------------------- https://heise.de/-4930778 ===================== = Vulnerabilities = ===================== ∗∗∗ VMware Horizon Client update addresses a denial-of-service vulnerability (CVE-2020-3991) ∗∗∗ --------------------------------------------- VMware Horizon Client for Windows contains a denial-of-service vulnerability due to a file system access control issue during install time. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.9. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2020-0022.html ∗∗∗ Kritische Lücke in SonicWall Firewall für Denial-of-Service-Angriffe ausnutzbar ∗∗∗ --------------------------------------------- Es stehen Updates für mehrere Versionen von SonicOS bereit, die eine kritische sowie zehn weitere Sicherheitslücken von "Medium" bis "High" beseitigen. --------------------------------------------- https://heise.de/-4930351 ∗∗∗ CVE-2020-17022 | Microsoft Windows Codecs Library Remote Code Execution Vulnerability ∗∗∗ --------------------------------------------- A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code. --------------------------------------------- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020… ∗∗∗ Adobe patches Magento bugs that lead to code execution, customer list tampering ∗∗∗ --------------------------------------------- The out-of-band security update tackles eight critical and important vulnerabilities. --------------------------------------------- https://www.zdnet.com/article/adobe-patches-magento-bugs-that-lead-to-code-… ∗∗∗ BlackBerry Powered by Android Security Bulletin - September 2020 ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Security Bulletin: Multiple Vulnerabilities in Jackson Core affect IBM Maximo Asset Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium Big Data Intelligence (SonarG) is affected by a 3RD PARTY Cryptographc vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-big… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Authentication Bypass (CVE-2020-4493) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Vulnerabilities in Apache ActiveMQ affect IBM Operations Analytics Predictive Insights (CVE-2020-11998, CVE-2020-13920) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache… ∗∗∗ Security Bulletin: IBM Resilient SOAR could allow a privileged user to inject malicious commands through Python3 scripting (CVE-2020-4636). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-resilient-soar-could-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 15.10.2020
by Daily end-of-shift report 15 Oct '20

15 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 14-10-2020 18:00 − Donnerstag 15-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Bleedingtooth: Google und Intel warnen vor neuen Bluetooth-Lücken ∗∗∗ --------------------------------------------- Laut Google lässt sich über die Sicherheitslücken Code aus der Ferne ausführen. Intel hat sie veröffentlicht, bevor Patches ausgeliefert wurden. --------------------------------------------- https://www.golem.de/news/bleedingtooth-google-und-intel-warnen-vor-neuen-b… ∗∗∗ Security Analysis of CHERI ISA ∗∗∗ --------------------------------------------- Is it possible to get to a state where memory safety issues would be deterministically mitigated? Our quest to mitigate memory corruption vulnerabilities led us to examine CHERI (Capability Hardware Enhanced RISC Instructions), which provides memory protection features against many exploited vulnerabilities, or in other words, an architectural solution that breaks exploits. --------------------------------------------- https://msrc-blog.microsoft.com:443/2020/10/14/security-analysis-of-cheri-i… ∗∗∗ Magento Phishing Leverages JavaScript For Exfiltration ∗∗∗ --------------------------------------------- During a recent investigation, a Magento admin login phishing page was found on a compromised website using the file name wp-order.php. This is an odd file name choice for a Magento phishing page, but nevertheless it successfully loads a legitimate looking Magento 1.x login page. --------------------------------------------- https://blog.sucuri.net/2020/10/magento-phishing-leverages-javascript-for-e… ∗∗∗ [SANS ISC] Nicely Obfuscated Python RAT ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “Nicely Obfuscated Python RAT“: While hunting, I found an interesting Python script. It matched one of my YARA rules due to the interesting list of imports but the content itself was nicely obfuscated. --------------------------------------------- https://blog.rootshell.be/2020/10/15/sans-isc-nicely-obfuscated-python-rat/ ∗∗∗ Dockerfile Security Best Practices ∗∗∗ --------------------------------------------- Container security is a broad problem space and there are many low hanging fruits one can harvest to mitigate risks. A good starting point is to follow some rules when writing Dockerfiles. --------------------------------------------- https://cloudberry.engineering/article/dockerfile-security-best-practices/ ∗∗∗ QR code scams are making a comeback ∗∗∗ --------------------------------------------- With QR codes being used more as a means to help create a COVID-19 proof environment, were also seeing a comeback of QR codes scams. --------------------------------------------- https://blog.malwarebytes.com/scams/2020/10/qr-code-scams-are-making-a-come… ∗∗∗ This major criminal hacking group just switched to ransomware attacks ∗∗∗ --------------------------------------------- A newly detailed financial cybercrime group has been conducting attacks around the world since 2016 - but now theyve switched to ransomware because its the biggest and easiest pay day. --------------------------------------------- https://www.zdnet.com/article/this-major-criminal-hacking-group-just-switch… ∗∗∗ New Emotet attacks use fake Windows Update lures ∗∗∗ --------------------------------------------- Emotet diversifies arsenal with new lures to trick users into infecting themselves. --------------------------------------------- https://www.zdnet.com/article/new-emotet-attacks-use-fake-windows-update-lu… ===================== = Vulnerabilities = ===================== ∗∗∗ Drupal OAuth Server ( OAuth Provider) - Single Sign On ( SSO ) - Moderately critical - SQL Injection - SA-CONTRIB-2020-034 ∗∗∗ --------------------------------------------- Project: Drupal OAuth Server ( OAuth Provider) - Single Sign On ( SSO ) Date: 2020-October-14 Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default Vulnerability: SQL Injection Description: This module enables you login into any OAuth 2.0 compliant application using Drupal credentials. The 8.x branch of the module is vulnerable to SQL injection. Solution: Install the latest version: If you use the Drupal OAuth Server module for Drupal 8.x, upgrade to 8.x-1.1 --------------------------------------------- https://www.drupal.org/sa-contrib-2020-034 ∗∗∗ Juniper Security Bulletins 2020-10 ∗∗∗ --------------------------------------------- JSA11045 - 2020-10 Security Bulletin: JSA Series: Intel CPUs could allow a local authenticated attacker to obtain sensitive information (CVE-2019-11135) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11045 JSA11046 - 2020-10 Security Bulletin: Junos OS: FreeBSD-SA-20:03.thrmisc: kernel stack data disclosure (CVE-2019-15875) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11046 JSA11047 - 2020-10 Security Bulletin: FreeBSD-SA-19:20.bsnmp : Insufficient message length validation in bsnmp library (CVE-2019-5610) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11047 JSA11048 - 2020-10 Security Bulletin: Junos Space and Junos Space Security Director: Zombie POODLE and GOLDENDOODLE resolved in 20.2R1 release https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11048 JSA11049 - 2020-10 Security Bulletin: Junos OS: When a DHCPv6 Relay-Agent is configured upon receipt of a specific DHCPv6 client message, Remote Code Execution may occur. (CVE-2020-1656) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11049 JSA11050 - 2020-10 Security Bulletin: Junos OS: SRX Series: An attacker sending spoofed packets to IPSec peers may cause a Denial of Service. (CVE-2020-1657) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11050 JSA11053 - 2020-10 Security Bulletin: Junos OS: NFX Series: Multiple vulnerabilities resolved in 20.2R1 release https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11053 JSA11054 - 2020-10 Security Bulletin: Junos OS: MX Series: Receipt of specific packets can cause services card to restart when DNS filtering is configured. (CVE-2020-1660) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11054 JSA11055 - 2020-10 Security Bulletin: Junos OS: Multiple SQLite vulnerabilities resolved. https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11055 JSA11056 - 2020-10 Security Bulletin: Junos OS: jdhcpd process crash when forwarding a malformed DHCP packet. (CVE-2020-1661) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11056 JSA11062 - 2020-10 Security Bulletin: Junos OS: MX series/EX9200 Series: IPv6 DDoS protection does not work as expected. (CVE-2020-1665) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11062 JSA11076 - 2020-10 Security Bulletin: Junos OS: PTX/QFX Series: Kernel Routing Table (KRT) queue stuck after packet sampling a malformed packet when the tunnel-observation mpls-over-udp configuration is enabled. (CVE-2020-1679) https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11076 JSA11079 - 2020-10 Security Bulletin: Junos OS: SRX1500, vSRX, SRX4K, NFX150: Denial of service vulnerability executing local CLI command (CVE-2020-1682) --------------------------------------------- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11079 ∗∗∗ Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0992 ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Netcool Agile Service Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerability in Hibernate Validator affects WebSphere Application Server Liberty (CVE-2020-10693) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-hibernat… ∗∗∗ Security Bulletin: Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14195 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Operational Decision Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Security Vulnerabilities in IBM WebSphere Liberty fixed in IBM Security Access Manager Appliance ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Netcool Operations Insight component IBM Network Performance Insight 1.3.1 affected by CVE-2020-14062 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: Security Vulnerabilities have been identified in IBM Java Runtime as shipped with Tivoli Federated Identity Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Vulnerabilities in Apache Struts affect IBM Tivoli Application Dependency Discovery Manager. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-apache… ∗∗∗ Security Bulletin: Netcool Operations Insight – Cloud Native Event Analytics is affected by an Apache Commons Codec vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-netcool-operations-insigh… ∗∗∗ Security Bulletin: Security vulnerabilities have been fixed in the IBM Security Access Manager and IBM Security Verify Access products ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 14.10.2020
by Daily end-of-shift report 14 Oct '20

14 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 13-10-2020 18:00 − Mittwoch 14-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Patchday: Aktuelle Updates von Microsoft beugen Angriffen aus der Ferne vor ∗∗∗ --------------------------------------------- Aktive Angriffe auf die zum Patch Tuesday beseitigten, teils kritischen Sicherheitslücken wurden bislang nicht beobachtet. Zügig updaten sollte man dennoch. --------------------------------------------- https://heise.de/-4928145 ∗∗∗ Apples Sicherheitschip T2: Exploit in Aktion gezeigt ∗∗∗ --------------------------------------------- Ein Hackerteam hat demonstriert, wie sich der aktuelle Sicherheitschip im Mac knacken lässt – mit einem simplen manipulierten USB-C-Kabel. --------------------------------------------- https://heise.de/-4928042 ∗∗∗ Vorsicht vor Phishing-Anrufen im Namen von Magenta ∗∗∗ --------------------------------------------- Immer häufiger nutzen Kriminelle das Telefon, um an persönliche Daten zu kommen. Derzeit geben sich BetrügerInnen als Magenta aus und versuchen per Anruf an das Kundenpasswort der Opfer und weitere persönliche Daten zu gelangen. Heben Sie daher bei Anrufen von der Telefonnummer 0800799742 nicht ab! --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-phishing-anrufen-im-nam… ===================== = Vulnerabilities = ===================== ∗∗∗ For Foxits sake: Windows and Mac users alike urged to patch PhantomPDF over use-after-free vulns ∗∗∗ --------------------------------------------- CISA points spotlight at PDF reader n creator suite Windows and Mac users running Foxits popular PhantomPDF reader should update their installations to the latest version after the US CISA cybersecurity agency warned of a handful of high-severity product vulnerabilities. --------------------------------------------- https://go.theregister.com/feed/www.theregister.com/2020/10/13/foxit_phanto… ∗∗∗ October 2020 Patch Tuesday: Microsoft fixes potentially wormable Windows TCP/IP RCE flaw ∗∗∗ --------------------------------------------- On this October 2020 Patch Tuesday: Microsoft has plugged 87 security holes, including critical ones in the Windows TCP/IP stack and Microsoft Outlook and Microsoft 365 Apps for Enterprise Adobe has delivered security updates for Adobe Flash Player Intel warns about flaws in BlueZ, the official Linux Bluetooth protocol stack SAP has released 15 security notes and updates to 6 previously released ones. --------------------------------------------- https://www.helpnetsecurity.com/2020/10/13/october-2020-patch-tuesday/ ∗∗∗ SAP-Patchday: Lücke mit Höchstwertung in CA Introscope Enterprise Manager gefixt ∗∗∗ --------------------------------------------- SAP-Admins sollten die verfügbaren Sicherheitsupdates zeitnah unter die Lupe nehmen und wo nötig einspielen. Die Risikoeinstufung "High" ist mehrfach vertreten. --------------------------------------------- https://heise.de/-4928265 ∗∗∗ Vulnerability Spotlight: Information leak vulnerability in Google Chrome WebGL ∗∗∗ --------------------------------------------- Marcin Towalski of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. The Google Chrome web browser contains a vulnerability that could be exploited by an adversary to carry out a range of malicious actions. Chrome is one of the most popular web browsers currently available to users. Cisco Talos researchers recently discovered a bug in WebGL, which is a Chrome API responsible for displaying 3-D graphics. --------------------------------------------- https://blog.talosintelligence.com/2020/10/vuln-spotlight-chrome-web-gl-inf… ∗∗∗ SonicWall VPN Portal Critical Flaw (CVE-2020-5135) ∗∗∗ --------------------------------------------- Tripwire VERT has identified a stack-based buffer overflow in SonicWall Network Security Appliance (NSA). The flaw can be triggered by an unauthenticated HTTP request involving a custom protocol handler. The vulnerability exists within the HTTP/HTTPS service used for product management as well as SSL VPN remote access. --------------------------------------------- https://www.tripwire.com/state-of-security/vert/sonicwall-vpn-portal-critic… ∗∗∗ Kubernetes AWS IAM Integration Issues ∗∗∗ --------------------------------------------- https://cxsecurity.com/issue/WLB-2020100083 ∗∗∗ Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0975 ∗∗∗ Trend Micro AntiVirus for Mac: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0977 ∗∗∗ Security Advisory - Denial of Service Vulnerability in Some Huawei Products ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201014-… ∗∗∗ Security Advisory - Buffer Overflow Vulnerability in the Bluetooth Module of Some Huawei Mobile Phones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201014-… ∗∗∗ Security Advisory - Privilege Escalation Vulnerability in Some Huawei Smartphones ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201014-… ∗∗∗ Security Advisory - JavaScript Injection Vulnerability in Huawei Smartphone ∗∗∗ --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20201014-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by a jackson-databind vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Apache Derby as used by IBM QRadar SIEM is vulnerable to Improper Input Validation (CVE-2018-1313) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-apache-derby-as-used-by-i… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Security Vulnerabilities have been fixed in IBM Security Access Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Unzip as used by IBM QRadar SIEM is vulnerable to denial of service (CVE-2019-13232) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-unzip-as-used-by-ibm-qrad… ∗∗∗ Security Bulletin: IBM MQ Appliance is affected by an information disclosure vulnerability (CVE-2020-4528) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affec… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 13.10.2020
by Daily end-of-shift report 13 Oct '20

13 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Montag 12-10-2020 18:00 − Dienstag 13-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Windows Update can be abused to execute malicious programs ∗∗∗ --------------------------------------------- The Windows Update client has just been added to the list of living-off-the-land binaries (LoLBins) attackers can use to execute malicious code on Windows systems. --------------------------------------------- https://www.bleepingcomputer.com/news/security/windows-update-can-be-abused… ∗∗∗ Angreifer auf US-Regierungsnetzwerke kombinieren "Zerologon" mit weiteren Lücken ∗∗∗ --------------------------------------------- Sicherheitslücken in FortiOS und MobileIron Core & Connector werden mit Zerologon zu einer Exploit-Chain verwoben, warnen CISA und FBI. --------------------------------------------- https://heise.de/-4927692 ∗∗∗ 55 Sicherheitslücken bei Apple‑Diensten entdeckt ∗∗∗ --------------------------------------------- Fünf Hacker haben in einem Zeitraum von nur 3 Monaten fast 300.000 US-Dollar an Bug-Bounty-Belohnungen erhalten --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/10/13/55-sicherheitsluecken-bei… ∗∗∗ Anatomy of Ryuk Attack: 29 Hours From Initial Email to Full Compromise ∗∗∗ --------------------------------------------- An attack involving the Ryuk ransomware required 29 hours from an email being sent to the target to full environment compromise and the encryption of systems, according to the DFIR Report, a project that provides threat intelligence from real attacks observed by its honeypots. --------------------------------------------- https://www.securityweek.com/anatomy-ryuk-attack-29-hours-initial-email-ful… ∗∗∗ Study Finds 400,000 Vulnerabilities Across 2,200 Virtual Appliances ∗∗∗ --------------------------------------------- Virtual appliances, even if they are provided by major software or cybersecurity vendors, can pose a serious risk to organizations, according to a report published on Tuesday by cloud visibility firm Orca Security. --------------------------------------------- https://www.securityweek.com/study-finds-400000-vulnerabilities-across-2200… ∗∗∗ Diese Scamming-Maschen sollten Sie kennen ∗∗∗ --------------------------------------------- Scamming, ein Sammelbegriff für zahlreiche Betrugsmaschen. Aber was ist Scamming? Mit Sicherheit kamen auch Sie bereits mit dieser Betrugsmasche in Berührung oder haben zumindest bereits davon gehört! Hier erfahren Sie mehr über die gängigsten Vorschussbetrugsmaschen und wie Sie sich davor schützen! --------------------------------------------- https://www.watchlist-internet.at/news/diese-scamming-maschen-sollten-sie-k… ∗∗∗ Red Team deckt IAM-Schwächen auf ∗∗∗ --------------------------------------------- Ein Red Team von Palo Alto Networks hat aufgezeigt, wie Angreifer gezielt Lücken und Fehlkonfigurationen im Identity und Access Management (IAM) in der Cloud ausnutzen, um an kritische Informationen zu gelangen. --------------------------------------------- https://www.zdnet.de/88388335/red-team-deckt-iam-schwaechen-auf/ ===================== = Vulnerabilities = ===================== ∗∗∗ Security Updates Available for Adobe Flash Player (APSB20-58) ∗∗∗ --------------------------------------------- Adobe has released security updates for Adobe Flash Player (APSB20-58) for Windows, macOS, Linux and Chrome OS. These updates address a vulnerability rated Critical in Adobe Flash Player. Successful exploitation could lead to an exploitable crash, potentially resulting in arbitrary code execution in the context of the current user. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1925 ∗∗∗ SSA-384879 (Last Update: 2020-10-13): Authentication Bypass Vulnerability in SIPORT MP ∗∗∗ --------------------------------------------- SIPORT MP version 3.2.1 fixes an authentication bypass vulnerability which could enable an attacker to impersonate other users of the system and perform administrative actions. Siemens recommends to apply the update. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-384879.txt ∗∗∗ SSA-226339 (Last Update: 2020-10-13): Multiple Web Application Vulnerabilities in Desigo Insight ∗∗∗ --------------------------------------------- The latest hotfix for Desigo Insight fixes three vulnerabilities that have been identified in the web server, including SQL injection (CVE-2020-15792), clickjacking (CVE-2020-15793), and full path disclosure (CVE-2020-15794). Siemens recommends updating to the latest version of Desigo Insight and to apply the hotfix. --------------------------------------------- https://cert-portal.siemens.com/productcert/txt/ssa-226339.txt ∗∗∗ Acronis Patches Privilege Escalation Flaws in Backup, Security Solutions ∗∗∗ --------------------------------------------- Acronis has released patches for its True Image, Cyber Backup, and Cyber Protect products to address vulnerabilities that could lead to elevation of privileges. The flaws could allow unprivileged Windows users to run code with SYSTEM privileges, a vulnerability note from the CERT Coordination Center (CERT/CC) reveals. --------------------------------------------- https://www.securityweek.com/acronis-patches-privilege-escalation-flaws-bac… ∗∗∗ SAP Patchday Oktober 2020 ∗∗∗ --------------------------------------------- Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in SAP Produkten und Anwendungskomponenten ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden. --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0972 ∗∗∗ Citrix Gateway Plug-in for Windows Security Update ∗∗∗ --------------------------------------------- Vulnerabilities have been identified in Citrix Gateway Plug-in for Windows that, if exploited, could result in a local user escalating their privilege level to SYSTEM. --------------------------------------------- https://support.citrix.com/article/CTX282684 ∗∗∗ IPAS: Security Advisories for October 2020 ∗∗∗ --------------------------------------------- Hi everyone, For October 2020, we are releasing just one security advisory addressing two vulnerabilities in the BlueZ open-source Bluetooth stack. Affected Linux users are encouraged to update to Linux kernel version 5.9 or later. More information can be found in INTEL-SA-00435 and at www.bluez.org. --------------------------------------------- https://blogs.intel.com/technology/2020/10/ipas-security-advisories-for-oct… ∗∗∗ Remote Desktop Services Remote Code Execution Vulnerability in Rexroth Industrial PCs ∗∗∗ --------------------------------------------- BOSCH-SA-856281: Microsoft has published information [1] for several versions of Microsoft Windows XP Microsoft Windows XP embedded Microsoft Windows 7 and Microsoft Windows 7 Embedded Standard regarding a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network. Rexroth Industrial PCs on these operating systems are affected by this vulnerability. --------------------------------------------- https://psirt.bosch.com/security-advisories/bosch-sa-856281.html ∗∗∗ Webmin: Schwachstellen ermöglichen Cross-Site Scripting ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0973 ∗∗∗ BSRT-2020-003 Vulnerability in UEM Core Impacts BlackBerry UEM ∗∗∗ --------------------------------------------- http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber… ∗∗∗ Security Bulletin: Cross-Site Scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4557 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Cross-site scripting vulnerability affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-4698 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Functional Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Publicly disclosed vulnerability from Kernel affects IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… ∗∗∗ Security Bulletin: Cross Site Scripting vulnerabilities in jQuery might affect IBM Business Automation Workflow and IBM Business Process Manager (BPM) – CVE-2020-7656, CVE-2020-11022, CVE-2020-11023 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-vuln… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK affecting Rational Functional Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-ja… ∗∗∗ Security Bulletin: Vulnerability in Docker affects Cloud Pak Sytem (CVE-2020-13401) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-docker-a… ∗∗∗ Security Bulletin: Publicly disclosed vulnerability from Qemu affects IBM Netezza Host Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-publicly-disclosed-vulner… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 12.10.2020
by Daily end-of-shift report 12 Oct '20

12 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 09-10-2020 18:00 − Montag 12-10-2020 18:00 Handler: Thomas Pribitzer Co-Handler: Stephan Richter ===================== = News = ===================== ∗∗∗ Sophisticated Android Ransomware Executes with the Home Button ∗∗∗ --------------------------------------------- The malware also has a unique machine-learning module. --------------------------------------------- https://threatpost.com/android-ransomware-home-button/160001/ ∗∗∗ Open Packaging Conventions, (Sat, Oct 10th) ∗∗∗ --------------------------------------------- Office files like .docx, .xlsm, ... are Office Open XML (OOXML) files: a ZIP container containing XML files and possibly other file types. --------------------------------------------- https://isc.sans.edu/diary/rss/26662 ∗∗∗ Operation TrickBot – ein globaler Schlag gegen das Botnetz ∗∗∗ --------------------------------------------- ESET Forscher unterstützten den erfolgreichen Schlag gegen eines der größten Botnetze und Schadcode-Verbreiter. --------------------------------------------- https://www.welivesecurity.com/deutsch/2020/10/12/operation-trickbot-eset-i… ∗∗∗ Deepfake Voice Technology Iterates on Old Phishing Strategies ∗∗∗ --------------------------------------------- As the world of AI and deepfake technology grows more complex, the risk that deepfakes pose to firms and individuals grows increasingly potent. This growing sophistication of the latest software and algorithms has allowed malicious hackers, scammers and cyber criminals who work tirelessly behind the scenes to stay one step ahead of the authorities, making [...] --------------------------------------------- https://www.tripwire.com/state-of-security/featured/deepfake-voice-technolo… ∗∗∗ Vorsicht vor dem Fake-Shop sport-monkey.de! ∗∗∗ --------------------------------------------- Über das Wochenende erreichten die Watchlist Internet unzählige Meldungen zu dem Online-Shop sport-monkey.de. Dieser bietet ein breites Sortiment an Sportausrüstung zu schier unglaublichen Preisen an. Die Preise sind aus einem einzigen Grund so niedrig: Es handelt sich um einen Fake-Shop, der trotz Zahlung per Vorkasse keine Waren liefert. --------------------------------------------- https://www.watchlist-internet.at/news/vorsicht-vor-dem-fake-shop-sport-mon… ∗∗∗ Event Report - A convenient mechanism to edit, visualize and share reports ∗∗∗ --------------------------------------------- MISP is widely known as a powerful tool to gather, correlate and share information. As a response to the growing information-sharing maturity of the community, more features have been introduced over the past few years to meet analyst skills and requirements. --------------------------------------------- https://www.misp-project.org/2020/10/08/Event-Reports.html ∗∗∗ Hacker nutzen Bugs in VPN und Windows Netlogon ∗∗∗ --------------------------------------------- Angreifer verschaffen sich Zugang zu Behördennetzwerken, indem sie gezielt Schwachstellen in VPN-Systemen und Windows Netlogon ausnutzen. --------------------------------------------- https://www.zdnet.de/88383319/hacker-nutzen-bugs-in-vpn-und-windows-netlogo… ===================== = Vulnerabilities = ===================== ∗∗∗ Citrix Hypervisor Security Update ∗∗∗ --------------------------------------------- A previous version of this bulletin had links to hotfixes that addressed the security issues but caused stability issues for some deployments that were using the Hypervisor Introspection (HVI) functionality of Citrix Hypervisor. Customers who are not using HVI functionality and who have already applied the earlier updates need take no further action. --------------------------------------------- https://support.citrix.com/article/CTX282314 ∗∗∗ Atlassian Jira Software: Schwachstelle ermöglicht Cross-Site Scripting ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0970 ∗∗∗ phpMyAdmin: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- https://www.cert-bund.de/advisoryshort/CB-K20-0969 ∗∗∗ Reflected Cross-Site Scripting and Unauthenticated Malicious File Upload in Sage DPW ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/reflected-cross-site-scripting… ∗∗∗ Security Bulletin: IBM InfoSphere Information Server is vulnerable to HTML injection. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-informatio… ∗∗∗ Security Bulletin: IBM QRadar SIEM is vulnerable to deserialization of untrusted data ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulner… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure. (CVE-2020-4386) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM InfoSphere Metadata Asset Manager is vulnerable to stored cross-site scripting. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-metadata-a… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an SQLite vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to buffer overflow leading to a privileged escalation (CVE-2020-4363) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure and denial of service (CVE-2020-4414) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to an information disclosure. (CVE-2020-4387) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: IBM® Db2® is vulnerable to a denial of service attack (CVE-2020-4420) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-is-vulnerable-to-… ∗∗∗ Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 09.10.2020
by Daily end-of-shift report 09 Oct '20

09 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 08-10-2020 18:00 − Freitag 09-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Phishing kits as far as the eye can see, (Fri, Oct 9th) ∗∗∗ --------------------------------------------- If you've never delved too deep into the topic of phishing kits, you might quite reasonably expect that they would be the sort of tools, which are traded almost exclusively on dark web marketplaces. This is however not the case. --------------------------------------------- https://isc.sans.edu/diary/rss/26660 ∗∗∗ Firebase: Google Cloud’s Evil Twin - Excerpt ∗∗∗ --------------------------------------------- Firebase is the most popular developer tool that security has never heard of. We will bring its numerous flaws to light. --------------------------------------------- https://www.sans.org/blog/firebase-google-cloud-s-evil-twin-condensed ∗∗∗ BSI-Team räumt bei CHES-Challenge alle Preise ab ∗∗∗ --------------------------------------------- Vom 14. bis 18. September 2020 veranstaltete die International Association for Cryptologic Research (IACR) die Conference on Cryptographic Hardware and Embedded Systems (CHES). Die CHES ist die weltweit größte und renommierteste hardwarenahe Kryptographietagung. --------------------------------------------- https://www.bsi.bund.de/DE/Presse/Pressemitteilungen/Presse2020/CHES-Challe… ∗∗∗ verbraucherclub.de: Warnung vor unseriösen Werbeschaltungen! ∗∗∗ --------------------------------------------- Haben Sie bereits von der Smartwatch „KoreTrak“ gehört, die ein Lebensretter für SeniorInnen sein soll? Oder von der LiveWave Antenna, die Ihnen gratis Fernsehen ins Wohnzimmer zaubert? Wenn ja, dann sind Sie wohl auf eine unseriöse Werbeschaltung von verbraucherclub.de gestoßen. --------------------------------------------- https://www.watchlist-internet.at/news/verbraucherclubde-warnung-vor-unseri… ∗∗∗ Microsoft Exchange CVE-2020-0688 Revisited -- in zwei Akten ∗∗∗ --------------------------------------------- Im April veröffentlichten wir einen Blogpost über Microsoft Exchange Server, die für die bereits im Februar 2020 gepatchte Lücke CVE-2020-0688 anfällig waren. --------------------------------------------- https://cert.at/de/aktuelles/2020/10/microsoft-exchange-cve-2020-0688-revis… ===================== = Vulnerabilities = ===================== ∗∗∗ Apples T2: Wenn der Sicherheitschip zum Keylogger wird ∗∗∗ --------------------------------------------- Eigentlich soll Apples T2-Chip für Sicherheit sorgen, ein Forscherteam könnte ihn jedoch in einen Keylogger umwandeln. --------------------------------------------- https://www.golem.de/news/apples-t2-wenn-der-sicherheitschip-zum-keylogger-… ∗∗∗ We Hacked Apple for 3 Months: Here’s What We Found ∗∗∗ --------------------------------------------- During our engagement, we found a variety of vulnerabilities in core portions of their infrastructure that would've allowed an attacker to fully compromise both customer and employee applications, launch a worm capable of automatically taking over a victims iCloud account, retrieve source code for internal Apple projects, [...] --------------------------------------------- https://samcurry.net/hacking-apple/ ∗∗∗ Credit card skimmer targets virtual conference platform ∗∗∗ --------------------------------------------- Criminals have gone after an online conference platform to steal credit card data from virtual attendees. --------------------------------------------- https://blog.malwarebytes.com/malwarebytes-news/2020/10/credit-card-skimmer… ∗∗∗ Security Bulletin: An XPath vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4774) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-an-xpath-vulnerability-ma… ∗∗∗ Security Bulletin: IBM Cúram Social Program Management uses MD5 algorithm (CVE-2020-4778) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cram-social-program-m… ∗∗∗ Security Bulletin: A cross-site scripting (XSS) vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4775) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-cross-site-scripting-xs… ∗∗∗ Security Bulletin: IBM Kenexa LCMS Premier On Premise – IBM SDK, Java Technology Edition Quarterly CPU – Jul 2020 – Includes Oracle Jul 2020 CPU plus one additional vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-kenexa-lcms-premier-o… ∗∗∗ Security Bulletin: An improper input validation vulnerability may impact IBM Cúram Social Program Management (CVE-2020-4781) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-an-improper-input-validat… ∗∗∗ Security Bulletin: API Connect is vulnerable to denial of service via Kubernetes (CVE-2020-8557, CVE-2020-8559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-api-connect-is-vulnerable… ∗∗∗ Security Bulletin: Security vulnerabilities have been fixed in IBM Security Access Manager and IBM Security Verify Access (CVE-2020-4661, CVE-2020-4699, CVE-2020-4660) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: API Connect is vulnerable to denial of service (CVE-2020-16845) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-api-connect-is-vulnerable… ∗∗∗ Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus & IBM App Connect Enterprise V11 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-node-j… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and IBM App Connect Enterpise v11. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 08.10.2020
by Daily end-of-shift report 08 Oct '20

08 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 07-10-2020 18:00 − Donnerstag 08-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Robert Waldner ===================== = News = ===================== ∗∗∗ SiteCheck Malware Report: September Summary ∗∗∗ --------------------------------------------- In September alone, a total of 17,138,086 website scans were performed using SiteCheck. Of those scans, 178,299 infected sites were detected. --------------------------------------------- https://blog.sucuri.net/2020/10/sitecheck-malware-report-september-summary.… ∗∗∗ Researchers Find Vulnerabilities in Microsoft Azure Cloud Service ∗∗∗ --------------------------------------------- Now according to the latest research, two security flaws in Microsoft's Azure App Services could have enabled a bad actor to carry out server-side request forgery (SSRF) attacks or execute arbitrary code and take over the administration server. ... Discovered by Paul Litvak of Intezer Labs, the flaws were reported to Microsoft in June, after which the company subsequently addressed them. --------------------------------------------- https://thehackernews.com/2020/10/microsoft-azure-vulnerability.html ===================== = Vulnerabilities = ===================== ∗∗∗ QNAP NAS: Neue Version der Helpdesk-App beseitigt zwei kritische Lücken ∗∗∗ --------------------------------------------- Die Helpdesk-App für Netzwerkspeicher von QNAP wies zwei Sicherheitslücken auf, über die Angreifer die Kontrolle über die Geräte hätten erlangen können. --------------------------------------------- https://heise.de/-4923916 ∗∗∗ Multiple Cross-Site Scripting Vulnerabilities in Confluence Marketplace Plugins ∗∗∗ --------------------------------------------- Multiple Confluence Plugins from different vendors are affected by stored cross-site scripting vulnerabilities which allow attackers to inject malicious JavaScript code into Confluence pages. PlantUML, Refined Toolkit for Confluence, Linking for Confluence, Countdown Timer, Server Status Business recommendation: Update to the latest versions of the plugins. --------------------------------------------- https://sec-consult.com/./en/blog/advisories/multiple-cross-site-scripting-… ∗∗∗ Vulnerability Exposes Over 4 Million Sites Using WPBakery ∗∗∗ --------------------------------------------- On July 27th, our Threat Intelligence team discovered a vulnerability in WPBakery, a WordPress plugin installed on over 4.3 million sites. This flaw made it possible for authenticated attackers with contributor-level or above permissions to inject malicious JavaScript in posts. [...] a final sufficient patch was released on September 24, 2020. We highly recommend updating to the latest version, 6.4.1 as of today, immediately. --------------------------------------------- https://www.wordfence.com/blog/2020/10/vulnerability-exposes-over-4-million… ∗∗∗ IBM Security Bulletins ∗∗∗ --------------------------------------------- IBM hat eine Reihe von Security Bulletins veröffentlicht: * https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… * https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… * https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… --------------------------------------------- https://www.ibm.com/blogs/psirt/ ∗∗∗ Sicherheitsupdates: Angreifer könnten Videoüberwachung von Cisco deaktivieren ∗∗∗ --------------------------------------------- Der Netzwerkausrüster Cisco hat wichtige Patches für unter anderem Überwachungskameras und die Online-Meeting-Software Webex veröffentlicht. Liste nach Bedrohungsgrad absteigend sortiert: * Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Remote Code Execution and Denial of Service * Webex Teams Client for Windows DLL Hijacking * Identity Services Engine Authorization Bypass * Industrial Network Director Denial of Service * Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Memory Leak * Vision Dynamic Signage Director Missing Authentication * SD-WAN vManage Cross-Site Scripting * StarOS Privilege Escalation * Expressway Series and TelePresence Video Communication Server Denial of Service * Email Security Appliance URL Filtering Bypass * Nexus Data Broker Software Path Traversal * Firepower Management Center Cross-Site Scripting * Identity Services Engine Cross-Site Scripting * StarOS Privilege Escalation --------------------------------------------- https://heise.de/-4924026 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 07.10.2020
by Daily end-of-shift report 07 Oct '20

07 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Dienstag 06-10-2020 18:00 − Mittwoch 07-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ Backdoor Shell Dropper Deploys CMS-Specific Malware ∗∗∗ --------------------------------------------- A large majority of the malware we find on compromised websites are backdoors that allow an attacker to maintain unauthorized access to the site and execute whatever commands they want. --------------------------------------------- https://blog.sucuri.net/2020/10/backdoor-shell-dropper-deploys-cms-specific… ∗∗∗ Alert (AA20-280A): Emotet Malware ∗∗∗ --------------------------------------------- Emotet—a sophisticated Trojan commonly functioning as a downloader or dropper of other malware—resurged in July 2020, after a dormant period that began in February. --------------------------------------------- https://us-cert.cisa.gov/ncas/alerts/aa20-280a ∗∗∗ New HEH botnet can wipe routers and IoT devices ∗∗∗ --------------------------------------------- The disk-wiping feature is present in the code but has not been used yet. --------------------------------------------- https://www.zdnet.com/article/new-heh-botnet-can-wipe-routers-and-iot-devic… ∗∗∗ Betrügerische Post-Mail verbreitet Schadsoftware ∗∗∗ --------------------------------------------- Derzeit werden betrügerische E-Mails im Namen der Post willkürlich an zahlreiche EmpfängerInnen versendet. Die Kriminellen drohen den Opfern mit einer Geldstrafe, da bestimmte Kosten noch nicht bezahlt wurden. --------------------------------------------- https://www.watchlist-internet.at/news/betruegerische-post-mail-verbreitet-… ===================== = Vulnerabilities = ===================== ∗∗∗ Enter the Vault: Authentication Issues in HashiCorp Vault ∗∗∗ --------------------------------------------- Posted by Felix Wilhelm, Project Zero: In this blog post I'll discuss two vulnerabilities in HashiCorp Vault and its integration with Amazon Web Services (AWS) and Google Cloud Platform (GCP). --------------------------------------------- https://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-… ∗∗∗ 90 days, 16 bugs, and an Azure Sphere Challenge ∗∗∗ --------------------------------------------- Cisco Talos reports 16 vulnerabilities in Microsoft Azure Spheres sponsored research challenge. --------------------------------------------- https://blog.talosintelligence.com/2020/10/Azure-Sphere-Challenge.html ∗∗∗ Security Bulletin: Security vulnerabilities in OpenSSH and OpenSSL shipped with IBM Security Access Manager Appliance (CVE-2018-15473, CVE-2019-1559) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data – Node.js (CVE-2019-15606, CVE-2019-15604, CVE-2019-15605) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by kernel vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Apache commons beanutils 1.9.2 library vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM API Connect's Developer Portal is impacted by vulnerabilities in MySQL. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-api-connects-develope… ∗∗∗ Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to a denial of service (CVE-2020-4590) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-liberty-for-java-for-ibm-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an OpenSSL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Apache Commons vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 06.10.2020
by Daily end-of-shift report 06 Oct '20

06 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Montag 05-10-2020 18:00 − Dienstag 06-10-2020 18:00 Handler: Dimitri Robl Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Hacker group compromises mobile provider to steal credit cards ∗∗∗ --------------------------------------------- Credit card skimming group Fullz House has compromised and injected the website of US mobile virtual network operator (MVNO) Boom! Mobile with a credit card stealer script. --------------------------------------------- https://www.bleepingcomputer.com/news/security/hacker-group-compromises-mob… ∗∗∗ Ransomware threat surge, Ryuk attacks about 20 orgs per week ∗∗∗ --------------------------------------------- Malware researchers monitoring ransomware threats noticed a sharp increase in these attacks over the past months compared to the first six months of 2020. --------------------------------------------- https://www.bleepingcomputer.com/news/security/ransomware-threat-surge-ryuk… ∗∗∗ Obfuscation and Repetition, (Mon, Oct 5th) ∗∗∗ --------------------------------------------- The obfuscated payload of a maldoc submitted by a reader can be quickly extracted with the "strings method" I explained in diary entry "Quickie: String Analysis is Still Useful". --------------------------------------------- https://isc.sans.edu/diary/rss/26648 ∗∗∗ Release the Kraken: Fileless APT attack abuses Windows Error Reporting service ∗∗∗ --------------------------------------------- We discovered a new attack that injected its payload—dubbed "Kraken" into the Windows Error Reporting (WER) service as a defense evasion mechanism. --------------------------------------------- https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuse… ∗∗∗ Betrug auf Amazon erkennen: So geht‘s ∗∗∗ --------------------------------------------- Auch auf Amazon können Sie auf betrügerische Angebote stoßen. Das Positive jedoch vorweg: Ein betrügerisches Angebot kann schnell entlarvt werden, indem Sie sich das Profil der Marketplace-HändlerInnen genauer ansehen. Werden Sie dort aufgefordert, sich vor einer Bestellung per E-Mail an den Verkäufer/ die Verkäuferin zu wenden, handelt es sich um Betrug! --------------------------------------------- https://www.watchlist-internet.at/news/betrug-auf-amazon-erkennen-so-gehts/ ∗∗∗ 5 steps to secure your connected devices ∗∗∗ --------------------------------------------- As we steadily adopt smart devices into our lives, we shouldn’t forget about keeping them secured and our data protected. --------------------------------------------- https://www.welivesecurity.com/2020/10/05/5-steps-secure-connected-devices/ ===================== = Vulnerabilities = ===================== ∗∗∗ Smart male chastity lock cock-up ∗∗∗ --------------------------------------------- TL;DR Smart Bluetooth male chastity lock, designed for user to give remote control to a trusted 3rd party using mobile app [...] --------------------------------------------- https://www.pentestpartners.com/security-blog/smart-male-chastity-lock-cock… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Multiple Jackson-Databind CVEs – February 2020 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: IBM DataPower Gateway is potentially vulnerable to a Denial of Service (CVE-2020-14147) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-is-… ∗∗∗ Security Bulletin: IBM DataPower Gateway can expose remote credentials to local users (CVE-2020-4528) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-can… ∗∗∗ Security Bulletin: Multiple Security Vulnerabilities fixed in IBM WebSphere Liberty as shipped in IBM Security Access Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnera… ∗∗∗ Security Bulletin: Cross-Site Scripting (XSS) fixed in IBM Security Access Manager 9.0.7.2 (CVE-2019-4725) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-cross-site-scripting-xss-… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerability ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: IBM DataPower Gateway may allow a potential DoS when importing malicious ZIP files (CVE-2019-13232) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-may… ∗∗∗ Security Bulletin: IBM Security Guardium is affected by Python vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Performance Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Service Tester ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-… ∗∗∗ October 2020 ∗∗∗ --------------------------------------------- https://source.android.com/security/bulletin/2020-10-01 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 05.10.2020
by Daily end-of-shift report 05 Oct '20

05 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Freitag 02-10-2020 18:00 − Montag 05-10-2020 18:00 Handler: Dimitri Robl Co-Handler: Thomas Pribitzer ===================== = News = ===================== ∗∗∗ MosaicRegressor: Lurking in the Shadows of UEFI ∗∗∗ --------------------------------------------- We found a compromised UEFI firmware image that contained a malicious implant. To the best of our knowledge, this is the second known public case where malicious UEFI firmware in use by a threat actor was found in the wild. --------------------------------------------- https://securelist.com/mosaicregressor/98849/ ∗∗∗ Egregor Ransomware Threatens ‘Mass-Media’ Release of Corporate Data ∗∗∗ --------------------------------------------- The newly discovered ransomware is hitting companies worldwide, including the GEFCO global logistics company. --------------------------------------------- https://threatpost.com/egregor-ransomware-mass-media-corporate-data/159816/ ∗∗∗ Scanning for SOHO Routers, (Sat, Oct 3rd) ∗∗∗ --------------------------------------------- In the past 30 days lots of scanning activity looking for small office and home office (SOHO) routers targeting Netgear. --------------------------------------------- https://isc.sans.edu/diary/rss/26638 ∗∗∗ Raccine-Tool soll Schattenkopien von Windows vor Ransomware schützen ∗∗∗ --------------------------------------------- Erpressungstrojaner verschlüsseln Dateien und löschen Daten, die Opfer zur Wiederherstellung nutzen könnten. Das Gratis-Tool Raccine will Hilfe anbieten. --------------------------------------------- https://heise.de/-4920206 ∗∗∗ Attacks Aimed at Disrupting the Trickbot Botnet ∗∗∗ --------------------------------------------- Over the past 10 days, someone has been launching a series of coordinated attacks designed to disrupt Trickbot, an enormous collection of more than two million malware-infected Windows PCs that are constantly being harvested for financial data and are often used as the entry point for deploying ransomware within compromised organizations. --------------------------------------------- https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbo… ∗∗∗ Black-T: New Cryptojacking Variant from TeamTnT ∗∗∗ --------------------------------------------- Code within the Black-T malware sample gives evidence of a shift in tactics, techniques and procedures for TeamTnT operations. --------------------------------------------- https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/ ∗∗∗ Shodan Verified Vulns 2020-10-05 ∗∗∗ --------------------------------------------- Wie in unserem Blogpost vom September angekündigt, wollen wir monatlich einen Überblick zu Shodans "Verified Vulnerablilities" in Österreich bieten. --------------------------------------------- https://cert.at/de/aktuelles/2020/10/shodan-verified-vulns-2020-10-05 ===================== = Vulnerabilities = ===================== ∗∗∗ Tenda Router Zero-Days Emerge in Spyware Botnet Campaign ∗∗∗ --------------------------------------------- A variant of the Mirai botnet, called Ttint, has added espionage capabilities to complement its denial-of-service functions. --------------------------------------------- https://threatpost.com/tenda-router-zero-days-spyware-botnet/159834/ ∗∗∗ Dringend patchen: Rund eine viertel Million Exchange-Server angreifbar ∗∗∗ --------------------------------------------- Kriminelle nutzen eine Lücke in Microsoft Exchange, um Server zu übernehmen. Dabei gibt es seit Februar einen Patch. --------------------------------------------- https://heise.de/-4920095 ∗∗∗ Security Bulletin: IBM Cloud Pak for Integration Operators affected by multiple vulnerabilities ∗∗∗ --------------------------------------------- Operators for BM Cloud Pak for Integration (CP4I) version 2020.2 are affected by vulnerabilities in Go prior to Go version 1.14.7. --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-for-integra… ∗∗∗ Multiple critical vulnerabilities in RocketLinx Series ∗∗∗ --------------------------------------------- https://sec-consult.com/en/blog/advisories/multiple-critical-vulnerabilitie… ∗∗∗ WAGO: XSS vulnerability in Web-UI in WAGO 750-88X and WAGO 750-89X ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-029 ∗∗∗ WAGO: Vulnerability in web-based authentication in WAGO 750-8XX Version <= FW07 ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-027 ∗∗∗ WAGO: Authentication Bypass Vulnerability in WAGO 750-36X and WAGO 750-8XX Versions <= FW03 ∗∗∗ --------------------------------------------- https://cert.vde.com/de-de/advisories/vde-2020-028 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 02.10.2020
by Daily end-of-shift report 02 Oct '20

02 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Donnerstag 01-10-2020 18:00 − Freitag 02-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Sichere Software entwickeln mit OWASP SAMM ∗∗∗ --------------------------------------------- Sicherheit ist im gesamten Entwicklungsprozess wichtig, und OWASP SAMM bietet ein flexibles Rahmenwerk zur Umsetzung. --------------------------------------------- https://heise.de/-4918292 ∗∗∗ Common Ways Attackers Are Stealing Credentials ∗∗∗ --------------------------------------------- A few weeks ago, we reviewed some of the worst website hacks we’ve ever seen. Every one of them started with poor password choices and escalated into a disastrous event for the site owner. Strong passwords and good password hygiene are often the first line of defense. --------------------------------------------- https://www.wordfence.com/blog/2020/10/common-ways-attackers-are-stealing-c… ∗∗∗ Massenhaft gefälschte Post-Mails: So entlarven Sie den Betrug! ∗∗∗ --------------------------------------------- Derzeit versenden BetrügerInnen zahlreiche E-Mails im Namen der Post. Die Kriminellen täuschen darin vor, dass Versandkosten fehlen und ein Paket daher nicht zugestellt werden könne. Tatsächlich handelt es sich um einen sogenannten „Phishing-Versuch“. Die Kriminellen versuchen so an Ihre Zugangsdaten zu kommen. Wir erklären Ihnen, wie Sie den Betrug entlarven! --------------------------------------------- https://www.watchlist-internet.at/news/massenhaft-gefaelschte-post-mails-so… ∗∗∗ New service checks if your email was used in Emotet attacks ∗∗∗ --------------------------------------------- A new service has been launched that allows you to check if an email domain or address was in an Emotet spam campaign. --------------------------------------------- https://www.bleepingcomputer.com/news/security/new-service-checks-if-your-e… ∗∗∗ QR Codes: A Sneaky Security Threat ∗∗∗ --------------------------------------------- What to watch out for, and how to protect yourself from malicious versions of these mobile shortcuts. --------------------------------------------- https://threatpost.com/qr-codes-sneaky-security-threat/159757/ ∗∗∗ Serious Security: Phishing without links - when phishers bring along their own web pages ∗∗∗ --------------------------------------------- How do you "check the URL before you click" if the web page youre visiting is already on your own computer? --------------------------------------------- https://nakedsecurity.sophos.com/2020/10/02/serious-security-phishing-witho… ∗∗∗ GFX Xsender Hack Tool: A Spam Mailer ∗∗∗ --------------------------------------------- PHP hack tools are created and used by attackers to help automate frequent or tedious tasks. During a recent investigation, we came across a hack tool used to simplify the process of sending predefined HTML emails to a list of email addresses. The tool runs on top of PHPMailer’s library, which handles the connection and sending of the malicious emails. The hack tool also grants the ability to authenticate to an email address on a remote server. --------------------------------------------- https://blog.sucuri.net/2020/10/gfx-xsender-hack-tool-a-spam-mailer.html ∗∗∗ [SANS ISC] Analysis of a Phishing Kit ∗∗∗ --------------------------------------------- I published the following diary on isc.sans.edu: “Analysis of a Phishing Kit“: Sometimes, attackers make mistakes and allow security researchers to access interesting resources. This time, it’s another phishing kit that was left in the wild on the compromised server. --------------------------------------------- https://blog.rootshell.be/2020/10/02/sans-isc-analysis-of-a-phishing-kit/ ===================== = Vulnerabilities = ===================== ∗∗∗ macOS 10.14.6 Supplemental Update ∗∗∗ --------------------------------------------- macOS 10.14.6 Supplemental Update for macOS Mojave includes the security content of Safari 14.0. --------------------------------------------- https://support.apple.com/kb/HT211872 ∗∗∗ Security updates for Friday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (jruby and ruby2.3), Fedora (crun, pdns, and podman), openSUSE (go1.14 and kernel), Oracle (qemu-kvm and virt:ol), Red Hat (qemu-kvm-ma and thunderbird), SUSE (nodejs10, nodejs12, perl-DBI, permissions, and xen), and Ubuntu (ntp). --------------------------------------------- https://lwn.net/Articles/833343/ ∗∗∗ Security Bulletin: Vulnerabilities in Ruby on Rails affect IBM License Metric Tool v9. ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ruby-o… ∗∗∗ Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8166). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ruby-o… ∗∗∗ Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8164). ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ruby-o… ∗∗∗ Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data – Node.js (CVE-2020-8203) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-security-vulnerabilities-… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container is vulnerable to CVE-2019-11324 ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: Multiple IBM DB2 Server Security Vulnerabilities Affect IBM Emptoris Strategic Supply Management Platform ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-ibm-db2-server-s… ∗∗∗ Security Bulletin: IBM Maximo Asset Management is vulnerable to Authentication Bypass (CVE-2020-4493) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-manageme… ∗∗∗ Security Bulletin: Vulnerability in Apache Commons Codec affects IBM Cúram Social Program Management (177835) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… ∗∗∗ Security Bulletin: Multiple IBM DB2 Server Security Vulnerabilities Affect IBM Emptoris Contract Management ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-multiple-ibm-db2-server-s… ∗∗∗ Security Bulletin: Vulnerability in WebSphere Application Server Liberty affect IBM Operations Analytics – Log Analysis (CVE-2020-4590) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-webspher… ∗∗∗ Multiple Vulnerabilities in SevOne Network Management System (NMS) ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/multiple-vulnerabilities-in-se… ∗∗∗ PHP: Mehrere Schwachstellen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0949 ∗∗∗ Trend Micro AntiVirus for Mac: Schwachstelle ermöglicht Privilegieneskalation ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0948 ∗∗∗ Bitdefender Produkte: Schwachstelle ermöglicht Denial of Service ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0947 -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

Tageszusammenfassung - 01.10.2020
by Daily end-of-shift report 01 Oct '20

01 Oct '20

===================== = End-of-Day report = ===================== Timeframe: Mittwoch 30-09-2020 18:00 − Donnerstag 01-10-2020 18:00 Handler: Stephan Richter Co-Handler: n/a ===================== = News = ===================== ∗∗∗ Über die Verantwortung, die mit guter JavaScript-Unterstützung einhergeht ∗∗∗ --------------------------------------------- Warum Websites und Apps nicht zwangsläufig "ohne JavaScript funktionieren" müssen - aber sie und wir JavaScript verantwortungsvoller verwenden könnten. --------------------------------------------- https://heise.de/-4907606 ∗∗∗ Keine WhatsApp-Nachrichten für Emojis und Smileys teilen! ∗∗∗ --------------------------------------------- Gehäuft werden WhatsApp-Nachrichten von Kriminellen verschickt, die kostenlose Angebote bewerben und zur weiteren Verbreitung auffordern. Derzeit kursiert eine Betrugsnachricht, die neue Emojis für WhatsApp verspricht, wenn sie 20 mal geteilt wird. Die Nachricht ist fake und führt zu weiteren unseriösen Angeboten. --------------------------------------------- https://www.watchlist-internet.at/news/keine-whatsapp-nachrichten-fuer-emoj… ∗∗∗ Phishing mit Captchas ∗∗∗ --------------------------------------------- Eine Flut von Phishing-E-Mails mit dem Ziel Microsoft Office 365 setzt Captchas ein, um die Opfer in ein Gefühl der Sicherheit zu wiegen. --------------------------------------------- https://www.zdnet.de/88383103/phishing-mit-captchas/ ∗∗∗ IOCs turning into IOOIs, (Thu, Oct 1st) ∗∗∗ --------------------------------------------- Remember, back in the days, when the anti-virus vendors looked with derision at some of their competition, exclaiming "But they are using just SIGNATURES. Our tool detects BEHAVIOURS". That was like 15 years ago. Fast forward to today, with many of the same vendors now selling "threat intelligence feeds" for good money, and the most frequent attributes pushed over these feeds are MD5/SHA1 hashes and IP addresses. The main thing that changed is that we now call these items [...] --------------------------------------------- https://isc.sans.edu/diary/rss/26624 ∗∗∗ Network Detection for ZeroLogon (CVE-2020-1472) ∗∗∗ --------------------------------------------- ZeroLogon has quickly become popular and well known because of multiple proofs of concept and exploits implemented in Python, .NET, Powershell, and Mimikatz implemented a module for it. So if you are an attacker or need to test your environment then you have plenty of options. As defenders, we also have options for detection on the network. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/network-det… ∗∗∗ Evasive URLs in Spam: Part 2 ∗∗∗ --------------------------------------------- A URL can be completely valid, yet still misleading. In this blog, we will present another technique with URLs that we observed in a recent malicious spam campaign. This is the continuation of an earlier blog that discussed how valid URL formats can be used in evading detection. --------------------------------------------- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-url… ∗∗∗ Detecting Microsoft 365 and Azure Active Directory Backdoors ∗∗∗ --------------------------------------------- Mandiant has seen an uptick in incidents involving Microsoft 365 (M365) and Azure Active Directory (Azure AD). Most of these incidents are the result of a phishing email coercing a user to enter their credentials used for accessing M365 into a phishing site. Other incidents have been a result of password spraying, password stuffing, or simple brute force attempts against M365 tenants. In almost all of these incidents, the user or account was not protected by multi-factor authentication (MFA). --------------------------------------------- http://www.fireeye.com/blog/threat-research/2020/09/detecting-microsoft-365… ∗∗∗ Three immediate steps to take to protect your APIs from security risks ∗∗∗ --------------------------------------------- In one form or another, APIs have been around for years, bringing the benefits of ease of use, efficiency and flexibility to the developer community. The advantage of using APIs for mobile and web apps is that developers can build and deploy functionality and data integrations quickly. API security posture But there is a huge downside to this approach. --------------------------------------------- https://www.helpnetsecurity.com/2020/10/01/api-security-posture/ ∗∗∗ A complete stranger controlled this woman’s home security system, but they’re not the one she’s angry with ∗∗∗ --------------------------------------------- Imagine being contacted by a complete stranger via Facebook, and them telling you that they have complete control over the security system in your new home. --------------------------------------------- https://www.bitdefender.com/box/blog/iot-news/complete-stranger-controlled-… ∗∗∗ IPStorm botnet expands from Windows to Android, Mac, and Linux ∗∗∗ --------------------------------------------- IPStorm botnet quadruples in size to reach 13,500 infected systems. --------------------------------------------- https://www.zdnet.com/article/ipstorm-botnet-expands-from-windows-to-androi… ===================== = Vulnerabilities = ===================== ∗∗∗ Critical Flaws Discovered in Popular Industrial Remote Access Systems ∗∗∗ --------------------------------------------- Cybersecurity researchers have found critical security flaws in two popular industrial remote access systems that can be exploited to ban access to industrial production floors, hack into company networks, tamper with data, and even steal sensitive business secrets. The flaws, discovered by Tel Aviv-based OTORIO, were identified in B&R Automations SiteManager and GateManager, and MB Connect [...] --------------------------------------------- https://thehackernews.com/2020/10/industrial-remote-access.html ∗∗∗ Sony IPELA Network Camera (ftpclient.cgi) Remote Stack Buffer Overflow ∗∗∗ --------------------------------------------- The vulnerability is caused due to a boundary error in the processing of received FTP traffic through the FTP client functionality (ftpclient.cgi), which can be exploited to cause a stack-based buffer overflow when a user issues a POST request to connect to a malicious FTP server. Successful exploitation could allow execution of arbitrary code on the affected device or cause denial of service scenario. --------------------------------------------- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5596.php ∗∗∗ Vulnerability Spotlight: Remote code execution bugs in NVIDIA D3D10 driver ∗∗∗ --------------------------------------------- Cisco Talos recently discovered multiple remote code execution vulnerabilities in the NVIDIA D3D10 driver. This driver supports multiple GPUs that NVIDIA produces. An adversary could exploit these vulnerabilities by supplying the user with a malformed shader, eventually allowing them to execute code on the victim machine. These bugs could also allow the attacker to perform a guest-to-host escape through Hyper-V [...] --------------------------------------------- https://blog.talosintelligence.com/2020/09/vuln-spotlight-nvidia-d3d10-.html ∗∗∗ Security updates for Thursday ∗∗∗ --------------------------------------------- Security updates have been issued by Debian (ruby-json-jwt and ruby-rack-cors), Fedora (xen), SUSE (aspell and tar), and Ubuntu (ruby-gon, ruby-kramdown, and ruby-rack). --------------------------------------------- https://lwn.net/Articles/833191/ ∗∗∗ Broken access control in Platinum Mobile ∗∗∗ --------------------------------------------- https://sec-consult.com/./en/blog/advisories/broken-access-control-in-plati… ∗∗∗ Red Hat OpenShift: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen ∗∗∗ --------------------------------------------- http://www.cert-bund.de/advisoryshort/CB-K20-0946 ∗∗∗ Security Bulletin: Open Source Apache Tomcat vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (CVE-2020-13935) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-open-source-apache-tomcat… ∗∗∗ Security Bulletin: IBM Cloud Pak System is affected by a vulnerability in VMware component ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-ibm-cloud-pak-system-is-a… ∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Netcool Agile Service Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java… ∗∗∗ Security Bulletin: App Connect Enterprise Certified Container is affected by multiple Node.js vulnerabilities ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-app-connect-enterprise-ce… ∗∗∗ Security Bulletin: A vulnerability in Netty affects IBM Netcool Agile Service Manager ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-netty-… ∗∗∗ Security Bulletin: WebSphere Application Server is vulnerable to an information disclosure vulnerability (CVE-2020-4576) ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-websphere-application-ser… ∗∗∗ Security Bulletin: Vulnerability in Apache Commons Codec Affects IBM Sterling Secure Proxy ∗∗∗ --------------------------------------------- https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-apache-c… -- CERT.at Daily mailing list Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily