- Daily - CERT.at

Tageszusammenfassung - Donnerstag 9-03-2017
by Daily end-of-shift report 09 Mar '17

09 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-03-2017 18:00 − Donnerstag 09-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Jetzt patchen! Apache Struts 2 im Visier von Hackern *** --------------------------------------------- Derzeit nutzen Angreifer gehäuft eine kritische Sicherheitslücke in dem Framework aus und versuchen so Web-Server zu übernehmen. Neue Versionen und Workarounds schaffen Abhilfe. --------------------------------------------- https://heise.de/-3648065 *** Uncovering cross-process injection with Windows Defender ATP *** --------------------------------------------- Windows Defender Advanced Threat Protection (Windows Defender ATP) is a post-breach solution that alerts security operations (SecOps) personnel about hostile activity. As the nature of attacks evolve, Windows Defender ATP must advance so that it continues to help SecOps personnel uncover and address the attacks. With increasing security investments from Microsoft... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/03/08/uncovering-cross-proces… *** #APF17: Call for Papers *** --------------------------------------------- ENISA's Annual Privacy Forum (APF) is to be held in Vienna on the 7th and 8th June 2017, in collaboration with the Law Faculty of the University of Vienna. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/apf17-call-for-papers *** 185.000 unsichere Webcams könnten Hackern private Einblicke gewähren *** --------------------------------------------- Ein Sicherheitsforscher stieß auf kritische Sicherheitslücken in einer chinesischen Webcam. Das Problem ist, viele Hersteller setzen auf die verwendete Software und verkaufen angreifbare Kameras unter ihrer Marke. --------------------------------------------- https://heise.de/-3648458 *** Emsisoft Releases a Decryptor for the CryptON Ransomware *** --------------------------------------------- Yesterday, Emsisofts CTO and malware researcher Fabian Wosar? released a decryptor for the CryptON Ransomware. This ransomware has been around since the end of February and has had a few variants released. It was named CryptON based on a string found within the executable. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/emsisoft-releases-a-decrypto… *** SECURITY BULLETIN: Multiple Vulnerabilities in Trend Micro Deep Discovery Email Inspector 2.5.1 *** --------------------------------------------- Trend Micro has released a Critical Patch for Deep Discovery Email Inspector (DDEI) 2.5.1. This Critical Patch resolves multiple vulnerabilities related to the user interface (UI) and authentication. --------------------------------------------- https://success.trendmicro.com/solution/1116750 *** Security Notice - Statement on Security Researcher Revealing XSS Security Vulnerability in Huawei HG658 V2 on Packet Storm Website *** --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2017/huawei-sn-20170308-01-… *** VU#305448: D-Link DIR-850L web admin interface contains a stack-based buffer overflow vulnerability *** --------------------------------------------- D-Link DIR-850L, firmware versions 1.14B07, 2.07.B05, and possibly others, contains a stack-based buffer overflow vulnerability in the web administration interface HNAP service. Other models may also be affected. --------------------------------------------- http://www.kb.cert.org/vuls/id/305448 *** Bugtraq: [security bulletin] HPESBHF03713 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Deserialization of Untrusted Data, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/540239 *** Bugtraq: [security bulletin] HPESBHF03714 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Local Arbitrary File Download *** --------------------------------------------- http://www.securityfocus.com/archive/1/540241 *** Services - Highly Critical - Arbitrary Code Execution - SA-CONTRIB-2017-029 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2016-029Project: Services (third-party module)Version: 7.xDate: 2017-March-08Security risk: 21/25 ( Highly Critical) AC:None/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescriptionThis module provides a standardized solution for building APIs so that external clients can communicate with Drupal.The module accepts user submitted data in PHPs serialization format ("Content-Type: application/vnd.php.serialized") --------------------------------------------- https://www.drupal.org/node/2858847 *** PRLP - Critical - Access Bypass and Privilege Escalation - SA-CONTRIB-2017-030 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2017-030Project: Password Reset Landing Page (PRLP) (third-party module)Version: 8.xDate: 2017-March-08Security risk: 16/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass, Privilege escalationDescriptionThis module adds a form on the password-reset-landing page to allow changing the password of the user during the log in process.The module does not sufficiently validate all access tokens, which allows an attacker to... --------------------------------------------- https://www.drupal.org/node/2858880 *** Vuln: Apache NiFi CVE-2017-5636 Remote Code Injection Vulnerability *** -------------------------------------------- http://www.securityfocus.com/bid/96731 *** Vuln: Apache NiFi CVE-2017-5635 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96730 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities affect Rational Rhapsody Design Manager with potential for security attacks *** http://www.ibm.com/support/docview.wss?uid=swg21999960 --------------------------------------------- *** IBM Security Bulletin: Information disclosure vulnerability affects IBM Sterling B2B Integrator (CVE-2016-5986) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998463 --------------------------------------------- *** IBM Security Bulletin: IBM Sterling Order Management is affected by Apache Struts 2 security vulnerabilities (CVE-2016-3093 , CVE-2016-4436) *** http://www.ibm.com/support/docview.wss?uid=swg21999781 --------------------------------------------- *** IBM Security Bulletin: Potential security vulnerability in WebSphere Application Server MQ JCA Resource adapter (CVE-2016-0360) *** http://www-01.ibm.com/support/docview.wss?uid=swg21996748 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 8-03-2017
by Daily end-of-shift report 08 Mar '17

08 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-03-2017 18:00 − Mittwoch 08-03-2017 18:00 Handler: Olaf Schwarz Co-Handler: Petr Sikuta Co-Handler: Stephan Richter *** Little Monsters: Nutzerdaten aus Lady Gagas Social Network sollen geleakt sein *** --------------------------------------------- Bei Lady Gagas App Little Monsters scheinen Nutzerdaten abhanden gekommen zu sein. Im Netz kursiert eine Datenbank mit privaten Daten von knapp einer Million Nutzer. --------------------------------------------- https://heise.de/-3646447 *** Payments Giant Verifone Investigating Breach *** --------------------------------------------- Credit and debit card payments giant Verifone [NYSE: PAY] is investigating a breach of its corporate computer networks that could impact companies running its point-of-sale solutions, according to multiple sources. Verifone says the extent of the breach was "limited" and that its payment services network was not impacted. San Jose, Calif.-based Verifone is the largest maker of credit card terminals used in the United States. It sells point-of-sale terminals and services to support the... --------------------------------------------- https://krebsonsecurity.com/2017/03/payments-giant-verifone-investigating-b… *** The HTTPS interception dilemma: Pros and cons *** --------------------------------------------- HTTPS is the bread-and-butter of online security. Strong cryptography that works on all devices without complicating things for users. Thanks to innovative projects like Let's Encrypt, adoption of HTTPS is rising steadily: in mid-2015 it was at 39%, now it's at 51% of HTTPS requests. Recent research shows however that HTTPS interception happens quite often. In fact, about 10% of connections to CloudFlare are intercepted, and the main culprits are enterprise network monitoring... --------------------------------------------- https://www.helpnetsecurity.com/2017/03/08/https-interception-dilemma/ *** Start of the Android Security Symposium 2017 *** --------------------------------------------- Today starts the Android Security Symposium at the Technical University of Vienna, courtesy of the Josef Ressel Center u'smile. The upcoming three days are packed with presentations surrounding the entire Android security ecosystem, ranging from presentations about the security architecture of Android by Google and AT&T right this morning, to secure app development, novel attacks,... --------------------------------------------- https://www.sba-research.org/2017/03/08/start-of-the-android-security-sympo… *** 21% of websites still use insecure SHA-1 certificates *** --------------------------------------------- New research from Venafi Labs shows that 21 percent of the world's websites are still using certificates signed with the vulnerable Secure Hash Algorithm, SHA-1. On February 23, 2017, Google affiliated security researchers announced they cracked the SHA-1 security standard using a collision attack. The incident proved that the deprecated cryptographic secure hash algorithm still used to sign many website digital certificates can be manipulated. Newly issued certificates using the SHA-2... --------------------------------------------- https://www.helpnetsecurity.com/2017/03/08/insecure-sha-1-certificates-usag… *** NetIQ Access Manager Directory Traversal Flaw Lets Remote Authenticated Admin Users Download Arbitrary Files on the Target Admin Console System *** --------------------------------------------- http://www.securitytracker.com/id/1037935 *** Bugtraq: Multiple vulnerabilities found in Wireless IP Camera (P2P) WIFICAM cameras and vulnerabilities in GoAhead *** --------------------------------------------- http://www.securityfocus.com/archive/1/540234 *** Bugtraq: [security bulletin] HPESBHF03710 rev.1 - HPE Intelligent Management Center (IMC) PLAT, Multiple Remote Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/540233 *** [2017-03-08] Multiple vulnerabilities in Navetti PricePoint *** --------------------------------------------- Navetti PricePoint is vulnerable against a broad range of typical application based vulnerabilities. On one hand an attacker is able to execute arbitrary JavaScript code in the context of an arbitrary user. On the other hand, an attacker is able to read out the contents of the applications database due to missing input validation. Furthermore an attacker can use cross-site request forgery to perform arbitrary web requests with the identity of the victim without being noticed by the victim. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** BlackBerry powered by Android Security Bulletin - March 2017 *** --------------------------------------------- BlackBerry has released a security update to address multiple vulnerabilities in BlackBerry powered by Android smartphones. We recommend users update to the latest available software build. --------------------------------------------- http://support.blackberry.com/kb/articleDetail?articleNumber=000039151 *** DFN-CERT-2017-0404: Red Hat JBoss Enterprise Web Server: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0404/ *** Vuln: Mozilla Firefox and Thunderbird Multiple Security Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/96693 https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/ *** Bugtraq: [security bulletin] HPESBGN03712 rev.1 - HPE LoadRunner and Performance Center, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/540238 *** [R1] Tenable Appliance 4.5.0 Fixes Multiple Vulnerabilities *** --------------------------------------------- http://www.tenable.com/security/tns-2017-07 *** Schneider Electric Wonderware Intelligence *** --------------------------------------------- This advisory contains mitigation details for a credentials management vulnerability in Schneider Electrics Wonderware Intelligence software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-066-01 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7975, CVE-2016-7986, and CVE-2017-5341 *** https://support.f5.com:443/kb/en-us/solutions/public/k/55/sol55129614.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2017-5202, CVE-2017-5203, CVE-2017-5204, CVE-2017-5205, and CVE-2017-5342 *** https://support.f5.com:443/kb/en-us/solutions/public/k/04/sol04225025.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7928, CVE-2016-7929, CVE-2016-7930, CVE-2016-7931, and CVE-2016-7933 *** https://support.f5.com:443/kb/en-us/solutions/public/k/39/sol39512927.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2017-5482, CVE-2017-5483, CVE-2017-5484, CVE-2017-5485, and CVE-2017-5486 *** https://support.f5.com:443/kb/en-us/solutions/public/k/31/sol31997425.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937, and CVE-2016-7939 *** https://support.f5.com:443/kb/en-us/solutions/public/k/49/sol49144112.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7926, CVE-2016-7932, and CVE-2016-7938 *** https://support.f5.com:443/kb/en-us/solutions/public/k/72/sol72403108.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925, and CVE-2016-7927 *** https://support.f5.com:443/kb/en-us/solutions/public/k/77/sol77384526.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7940, CVE-2016-7973, CVE-2016-7974, CVE-2016-7983, and CVE-2016-7984 *** https://support.f5.com:443/kb/en-us/solutions/public/k/94/sol94010578.html?… --------------------------------------------- *** Security Advisory: tcpdump vulnerabilities CVE-2016-7985, CVE-2016-7992, CVE-2016-7993, CVE-2016-8574, and CVE-2016-8575 *** https://support.f5.com:443/kb/en-us/solutions/public/k/94/sol94778122.html?… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in BIND impact AIX (CVE-2016-9131) *** http://aix.software.ibm.com/aix/efixes/security/bind_advisory15.asc --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ proliferation of channel agents causes denial of service (CVE-2017-1145) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999672 --------------------------------------------- *** IBM Security Bulletin: IBM Content Navigator Cross Site Scripting Vulnerability *** http://www-01.ibm.com/support/docview.wss?uid=swg21999736 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Asset Analyzer *** http://www-01.ibm.com/support/docview.wss?uid=swg21999881 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM MessageSight (CVE-2016-6303, CVE-2016-2182, CVE-2016-2178, CVE-2016-6306, CVE-2016-2183, CVE-2016-2177, CVE-2016-7052) *** http://www.ibm.com/support/docview.wss?uid=swg21999451 --------------------------------------------- *** IBM Security Bulletin: A security vulnerability has been identified in IBM Reliable Scalable Cluster Technology shipped with IBM Tivoli System Automation for Multiplatforms (CVE-2017-1134). *** http://www.ibm.com/support/docview.wss?uid=swg21998459 --------------------------------------------- *** IBM Security Bulletin: IBM MessageSight affected by GSKit Sweet32 Birthday attacks (CVE-2016-2183) *** http://www.ibm.com/support/docview.wss?uid=swg21999452 --------------------------------------------- *** IBM Security Bulletin: OpenNTF project Social Business SDK CVE-2016-3092 *** http://www.ibm.com/support/docview.wss?uid=swg21999337 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 7-03-2017
by Daily end-of-shift report 07 Mar '17

07 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-03-2017 18:00 − Dienstag 07-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Sicherheitsupdate härtet WordPress gegen XSS-Angriffe *** --------------------------------------------- Wer das CMS WordPress nutzt sollte sicherstellen, dass die aktuelle Version 4.7.3 installiert ist. Ansonsten könnten Angreifer Sicherheitslücken in vorigen Versionen ausnutzen. --------------------------------------------- https://heise.de/-3645684 *** River City Media: Spammer vergessen 1,4 Milliarden Mailadressen im Netz *** --------------------------------------------- Ein Backup-Fehler dürfte das Aus für ein großes Spamnetzwerk aus den USA bedeuten. River City Media verdiente Geld mit Spam-Nachrichten, SMS-Kampagnen und Affiliate-Marketing - inklusive gefälschter Suchmaschinen. --------------------------------------------- https://www.golem.de/news/river-city-media-spammer-vergessen-1-4-milliarden… *** SAP Security for Beginners part 7: SAP ABAP Platform Security *** --------------------------------------------- >From the previous articles of SAP Security for CISO series (especially SAP Risks), you reviewed many examples of potential attacks on these systems. Now it is time to learn how these attacks can be conducted via vulnerabilities discovered in SAP systems. First, let's look at patching process in SAP. When the vendor fixes vulnerabilities in... --------------------------------------------- http://resources.infosecinstitute.com/sap-security-beginners-part-7-sap-aba… *** TU Wien-Team auf drittem Platz bei internationalem Hacker-Wettbewerb *** --------------------------------------------- International Capture The Flag-Bewerb mit Internet-Sicherheits-Teams von 78 Universitäten --------------------------------------------- http://derstandard.at/2000053747853 *** A tcpdump Tutorial and Primer with Examples *** --------------------------------------------- Mar 6, 2017 - I just performed a major update to this tutorial after over 10 years. The update includes a fully functional table of contents and a number of additional explanations. Enjoy! --------------------------------------------- https://danielmiessler.com/study/tcpdump/ *** WikiLeaks Releases CIA Hacking Tools *** --------------------------------------------- WikiLeaks just released a cache of 8,761 classified CIA documents from 2012 to 2016, including details of its offensive Internet operations.I have not read through any of them yet. If you see something interesting, tell us in the comments. --------------------------------------------- https://www.schneier.com/blog/archives/2017/03/wikileaks_relea.html *** DFN-CERT-2017-0394: Google Android Operating System: Mehrere Schwachstellen ermöglichen u.a. die komplette Systemübernahme *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0394/ *** WordPress Multiple Plugins - Remote File Upload *** --------------------------------------------- Topic: WordPress Multiple Plugins - Remote File Upload Risk: High Text:Id like to report multiple remote file upload vulnerabilities on five plugins, attached is the PoC exploit and screenshot ; It... --------------------------------------------- https://cxsecurity.com/issue/WLB-2017030065 *** [2017-03-07] Unauthenticated OS command injection & arbitrary file upload in Western Digital WD My Cloud *** --------------------------------------------- Multiple critical vulnerabilities, such as unauthenticated OS command injection or arbitrary file upload, within the WD My Cloud devices allow an attacker to gain access on the device. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** Sicherheitsupdate für Symantec Endpoint Protection *** --------------------------------------------- Symantec Endpoint Protection ist ein Softwarepaket zum Schutz vor Viren und Malware.In Symantec Endpoint Protection 12.1 existiert eine Sicherheitslücke, die es einem Angreifer mit Zugriff auf Ihren Computer unter bestimmten Umständen ermöglicht, diesen zu übernehmen und massiv zu schädigen. Eine weitere Sicherheitslücke in Symantec Endpoint Protection 12.1 und 14.0 ermöglicht es dem Angreifer, beliebige Befehle auf Ihrem Computer auszuführen. --------------------------------------------- https://www.bsi-fuer-buerger.de/SharedDocs/Warnmeldungen/DE/TW/warnmeldung_… *** VU#355151: ACTi cameras models from the D, B, I, and E series contain multiple security vulnerabilities *** --------------------------------------------- Vulnerability Note VU#355151 ACTi cameras models from the D, B, I, and E series contain multiple security vulnerabilities Original Release date: 07 Mar 2017 | Last revised: 07 Mar 2017 Overview According to the reporter, ACTi devices including D, B, I, and E series models using firmware version A1D-500-V6.11.31-AC are vulnerable to several issues. Description According to the reporter, multiple ACTi devices, including the D, B, I, and E series models, that use firmware version... --------------------------------------------- http://www.kb.cert.org/vuls/id/355151 *** Security Advisory: The BIG-IP system may respond with the NXDOMAIN status when it receives a DNS query of a certain type on a CNAME wide IP *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/23/sol23022557.html?… *** Vuln: WePresent WiPG-1500 Device CVE-2017-6351 Hardcoded Password Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96588 *** Vuln: TeX Live CVE-2016-10243 Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96593 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Information Disclosure vulnerability affects IBM DB2 LUW (CVE-2017-1150) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999515 --------------------------------------------- *** IBM Security Bulletin: IBM i is affected by networking BIND vulnerabilities (CVE-2016-9131, CVE-2016-9444, CVE-2016-9147, CVE-2016-9778 and CVE-2017-3135) *** http://www-01.ibm.com/support/docview.wss?uid=nas8N1021889 --------------------------------------------- *** IBM Security Bulletin: Multiple cross-site scripting vulnerabilities found in IBM UrbanCode Deploy (CVE-2016-9006) *** http://www-01.ibm.com/support/docview.wss?uid=swg2C1000264 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Tomcat affect IBM Cognos Metrics Manager (CVE-2016-0762, CVE-2016-6816) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999723 --------------------------------------------- *** IBM Security Bulletin: IBM Cognos Business Intelligence Server 2017Q1 Security Updater : IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities. *** http://www-01.ibm.com/support/docview.wss?uid=swg21999671 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Websphere Application Server affects IBM Cognos Metrics Manager (CVE-2016-5983) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999722 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring Basic Services Vulnerability (CVE-2016-5933) *** http://www.ibm.com/support/docview.wss?uid=swg21997223 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 6-03-2017
by Daily end-of-shift report 06 Mar '17

06 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-03-2017 18:00 − Montag 06-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** 25 Jahre Michelangelo: Der Tag der großen Virenpanik *** --------------------------------------------- Am 6. März 1992 hielt die Welt den Atem an. An diesem Tag sollte der Michelangelo-Virus Tausende, wenn nicht gar Millionen Festplatten löschen. Zum 25. Jahrestag beleuchtet c't die Geschichte des berüchtigten Virus. --------------------------------------------- https://heise.de/-3643630 *** Attacking machine learning with adversarial examples *** --------------------------------------------- Conclusion Adversarial examples show that many modern machine learning algorithms can be broken in surprising ways. These failures of machine learning demonstrate that even simple algorithms can behave very differently from what their designers intend. We encourage machine learning researchers to get involved and design methods for preventing adversarial examples, in order to close this gap between what designers intend and how algorithms behave. If youre interested in working on adversarial... --------------------------------------------- https://openai.com/blog/adversarial-example-research/ *** Lets Act Now to Prevent Hacking of the Power Grid *** --------------------------------------------- Standards, guidelines and exercises have bolstered the security of high-voltage networks but little has been done to protect the low-voltage systems that power our homes and workplaces. --------------------------------------------- http://europe.newsweek.com/lets-act-now-prevent-hacking-power-grid-563609 *** DFIR Tools *** --------------------------------------------- Over 600 DFIR tools in an online searchable database. --------------------------------------------- http://www.dfir.training/index.php/tools/advanced-search *** Uber Uses Ubiquitous Surveillance to Identify and Block Regulators *** --------------------------------------------- The New York Times reports that Uber developed apps that identified and blocked government regulators using the app to find evidence of illegal behavior:Yet using its app to identify and sidestep authorities in places where regulators said the company was breaking the law goes further in skirting ethical lines -- and potentially legal ones, too. Inside Uber, some of those who knew about the VTOS program and how the Greyball tool was being used were troubled by it.[...]One method involved... --------------------------------------------- https://www.schneier.com/blog/archives/2017/03/uber_uses_ubiqu.html *** Western Digital My Cloud: NAS-Gerät macht jeden zum Admin *** --------------------------------------------- Western Digital hat in der Hackerszene nicht den Ruf, Schwachstellen schnell zu beheben. Sicherheitslücken, die den Login-Vorgang und die Ausführung von Code betreffen, wurden daher ohne Responsible Disclosure veröffentlicht - damit die Nutzer handeln können. --------------------------------------------- https://www.golem.de/news/western-digital-my-cloud-nas-geraet-macht-jeden-z… *** Nextcloud-Scan: Security-Prüfung für Cloud-Speicher *** --------------------------------------------- Zwei Drittel der öffentlich erreichbaren Installation von ownCloud oder dessen Fork Nextcloud sind angreifbar. Ob die eigene Instanz betroffen ist, können Anwender auf einer Website überprüfen. --------------------------------------------- https://heise.de/-3645045 *** MMD-0062-2017 - Credential harvesting by SSH Direct TCP Forward attack via IoT botnet *** --------------------------------------------- In this post there is no malicious software/malware analyzed, but this is one of the impact of the malware infected IoT devices caused by weak credentials are described indirectly. The only malicious aspect written in the post is the individual(s) involved and participate to these attacks, and, well, I personally do not think the tool used is also malicious too since. in a way, it is very useful for UNIX networking and development. --------------------------------------------- http://blog.malwaremustdie.org/2017/02/mmd-0062-2017-ssh-direct-tcp-forward… *** Security Advisory - Arbitrary Memory Read Write Vulnerability in Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170306-… *** Vuln: EPSON TMNet WebConfig CVE-2017-6443 Multiple HTML Injection Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/96556 *** Vuln: FreeIPA CVE-2017-2590 Multiple Security Bypass Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/96557 *** [R3] SecurityCenter 5.4.4 Fixes File Upload unserialize() Function PHP Object Handling Remote File Deletion *** --------------------------------------------- Advisory Timeline 2017-02-17 - [R1] Initial Release 2017-02-28 - [R2] Adjust CVSS for worst-case scenario (AV:A -> AV:N) 2017-03-03 - [R3] Add SC upgrade information --------------------------------------------- https://www.tenable.com/security/tns-2017-05 *** Vuln: Piwik Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96567 *** keepassxc / zxcvbn-c One byte stack buffer overflow *** --------------------------------------------- Topic: keepassxc / zxcvbn-c One byte stack buffer overflow Risk: High Text:Hi, I recently reported a one byte buffer overflow in keepassxc [1] [2]. Its a pretty typical C bug: An array supposed to ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2017030044 *** DSA-3802 zabbix - security update *** --------------------------------------------- An SQL injection vulnerability has been discovered in the Latest datapage of the web frontend of the Zabbix network monitoring system --------------------------------------------- https://www.debian.org/security/2017/dsa-3802 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSource GNU C library affects IBM Netezza Host Management (CVE-2015-8776) *** http://www-01.ibm.com/support/docview.wss?uid=swg21997242 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in the libgcrypt library (CVE-2016-6313) *** http://www.ibm.com/support/docview.wss?uid=swg21999613 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2016-2177, CVE-2016-6306, CVE-2016-2183) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999357 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in OpenLDAP (CVE-2015-6908) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999615 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in IBM WebSphere Application Server (CVE-2016-5986) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999614 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Commerce admin utilities could lead to disclosure of user personal data (CVE-2016-5894) *** http://www.ibm.com/support/docview.wss?uid=swg21997408 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 3-03-2017
by Daily end-of-shift report 03 Mar '17

03 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-03-2017 18:00 − Freitag 03-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** WhatsApp - Unsicher trotz Verschlüsselung *** --------------------------------------------- Die Einführung der Ende-zu-Ende-Verschlüsselung wurde von WhatsApp-Nutzern und Datenschützern sehr begrüßt. Dass es hierbei aber dennoch zu erheblichen Sicherheitsproblemen kommt, haben nun Forscher des Fraunhofer-Instituts für Angewandte und Integrierte Sicherheit AISEC herausgefunden. Betroffen sind vor allem Android-Nutzer. --------------------------------------------- https://www.aisec.fraunhofer.de/de/presse-und-veranstaltungen/presse/presse… *** Undocumented Backdoor Account in DBLTek GoIP *** --------------------------------------------- Trustwave recently reported a remotely exploitable issue in the Telnet administrative interface of numerous DblTek branded devices. The issue permits a remote attacker to gain a shell with root privileges on the affected device due to a vendor backdoor in... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Undocumented-Backdoor-A… *** Command Input Typo Caused Massive AWS S3 Outage *** --------------------------------------------- In a postmortem status report, Amazon blamed a command input typo for the massive AWS S3 outage that took out a large chunk of the Internet three days ago. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/hardware/command-input-typo-caused-ma… *** Malware Retrieves PowerShell Scripts from DNS Records *** --------------------------------------------- Malware researchers have come across a new Remote Access Trojan (RAT) that uses a novel technique to evade detection on corporate networks by fetching malicious PowerShell commands stored inside a domains DNS TXT records. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/malware-retrieves-powershell… *** January-February 2017 *** --------------------------------------------- The NCCIC/ICS-CERT Monitor for January/February 2017 is a summary of ICS-CERT activities for the previous two months. --------------------------------------------- https://ics-cert.us-cert.gov/monitors/ICS-MM201702 *** Lernkurve mit neuem Feed *** --------------------------------------------- Wir sammeln aus vielen Quellen Informationen zu Infektionen und anderen Sicherheitsproblemen im österreichischen Internet und geben diese an die Netzbetreiber weiter. Details dazu stehen in unserem Jahresbericht. Kürzlich haben wir eine neuen Anbieter in unser Portfolio aufgenommen, der unser Lagebild zu Infektionen verbessern sollte. Seit vorgestern verteilen wir Daten aus dieser Quelle. Wir bekamen von einigen Seiten Feedback, dass hier was... --------------------------------------------- http://www.cert.at/services/blog/20170303152402-1946.html *** IDM 4.5 SAP HR Driver Version 4.0.1.0 *** --------------------------------------------- Abstract: Patch update for the Identity Manager SAP HR driver with the SAP JCO version 3. This patch will take the driver version to 4.0.1.0. You must have IDM 4.5 with SP2 or later to use this driver. You should only use this if you are using SAP JCO3. It will not work with SAP JCO2. NetIQ/MicroFocus recommends that users of SAP JCO2 transition to SAP JCO3 and use the IDM SAP HR driver for JCO3. Beginning with IDM 4.0 JCO2 is no longer supported.Document ID: 5258492Security Alert: --------------------------------------------- https://download.novell.com/Download?buildid=KbKm3O1mw4M~ *** VMSA-2017-0002 *** --------------------------------------------- Horizon DaaS update addresses an insecure data validation issue --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2017-0002.html *** Vuln: Rapid7 Insight Collector CVE-2017-5234 DLL Loading Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96545 *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by vulnerabilities in Network Security Services (NSS) (CVE-2016-2834, CVE-2016-5285, CVE-2016-8635) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21998918 *** Eaton xComfort Ethernet Communication Interface *** --------------------------------------------- This advisory contains mitigation details for an improper access controls vulnerability in the Eaton xComfort Ethernet Communication Interface. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-061-01 *** Schneider Electric Conext ComBox *** --------------------------------------------- This advisory contains mitigation details for a resource exhaustion vulnerability in Schneider Electric's Conext ComBox solar battery monitor. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-061-02

1 0

Tageszusammenfassung - Donnerstag 2-03-2017
by Daily end-of-shift report 02 Mar '17

02 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-03-2017 18:00 − Donnerstag 02-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Kaspersky Releases Decryptor for the Dharma Ransomware *** --------------------------------------------- Kaspersky has tested a set of Dharma master decryption keys posted to BleepingComputer and has confirmed they are legitimate. These keys have been included in their RakhniDecryptor, which I have tested against a Dharma infection. The decryptor worked flawlessly! [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor… *** The Story of an Expired WHOIS Server *** --------------------------------------------- We write quite often about SEO spam injections on compromised websites, but this is the first time we have seen this blackhat tactic spreading into the WHOIS results for a domain name. If you are not familiar with "WHOIS", it is a protocol used to check who owns a specific domain name. These simple text records are publicly available and usually contain contact details for the website owner, i.e. their name, address, and phone number (unless the website owner purchased a WHOIS... --------------------------------------------- https://blog.sucuri.net/2017/03/story-expired-whois-server.html *** Infected Apps in Google Play Store (its not what you think), (Thu, Mar 2nd) *** --------------------------------------------- Xavier pointed me towards a new issue posted on Palo Altos Unit 42 blog - the folks at PA found apps in the Google Play store infected with hidden-iframe type malware. 132 apps (so far) are affected, with the most popular one seeing roughly 10,000 downloads. But were not at the end of the trail of breadcrumbs yet .. these apps were traced back to just 7 developers, who arent in the same company, but all have a connection to Indonesia (the smoking gun here was the code signing certificate). But... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22139&rss *** Researcher Breaks reCAPTCHA Using Googles Speech Recognition API *** --------------------------------------------- A researcher has discovered what he calls a "logic vulnerability" that allowed him to create a Python script that is fully capable of bypassing Googles reCAPTCHA fields using another Google service, the Speech Recognition API. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/researcher-breaks-recaptcha-… *** Crypt0L0cker Ransomware is Back with Campaigns Targeting Europe *** --------------------------------------------- Crypt0L0cker, otherwise known as TorrentLocker, has started to make resurgence as it performs targeted campaigns at European countries. These attacks are also now using Italys PEC system to digitaly sign SPAM emails in order to make them look more official. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/crypt0l0cker-ransomware-is-b… *** Security Advisory - Buffer Overflow Vulnerability in the Boot Loaders of Huawei Mobile Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170302-… *** DSA-3799 imagemagick - security update *** --------------------------------------------- This update fixes several vulnerabilities in imagemagick: Variousmemory handling problems and cases of missing or incomplete inputsanitising may result in denial of service or the execution of arbitrarycode if malformed TIFF, WPG, IPL, MPC or PSB files are processed. --------------------------------------------- https://www.debian.org/security/2017/dsa-3799 *** AES - Critical - Unsupported - SA-CONTRIB-2017-027 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2017-027Project: AES encryption (third-party module)Version: 7.x, 8.xDate: 2017-March-01DescriptionThis module provides an API that allows other modules to encrypt and decrypt data using the AES encryption algorithm.The module does not follow requirements for encrypting data safely. An attacker who gains access to data encrypted with this module could decrypt it more easily than should be possible. The maintainer has opted not to fix these weaknesses. See solution... --------------------------------------------- https://www.drupal.org/node/2857028 *** Remember Me - Critical - Unsupported - SA-CONTRIB-2017-025 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2017-025Project: Remember Me (third-party module)Version: 7.xDate: 2017-March-01Description Remember me is a module that allows users to check "Remember me" when logging in. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466CVE identifier(s) issuedA CVE identifier will... --------------------------------------------- https://www.drupal.org/node/2857015 *** Breakpoint Panels - Critical - Unsupported - SA-CONTRIB-2017-028 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2017-028Project: breakpoint panels (third-party module)Version: 7.xDate: 2017-March-01Description Breakpoint panels adds a button to the Panels In-Place Editor for each pane. When selected, it will display checkboxes next to all of the breakpoints specified in that modules UI. Unchecking any of these will hide it from that breakpoint. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by... --------------------------------------------- https://www.drupal.org/node/2857073 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM is vulnerable to missing authentication checks (CVE-2016-9729) *** http://www.ibm.com/support/docview.wss?uid=swg21999545 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM is vulnerable to SQL injection (CVE-2016-9728) *** http://www.ibm.com/support/docview.wss?uid=swg21999543 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM and QRadar Incident Forensics are vulnerable to cross site scripting (CVE-2016-9723, CVE-2017-1133) *** http://www.ibm.com/support/docview.wss?uid=swg21999534 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM and QRadar Incident Forensics are vulnerable to cross-site request forgery (CVE-2016-9730) *** http://www.ibm.com/support/docview.wss?uid=swg21999549 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM is vulnerable to XML Entity Injection (CVE-2016-9724) *** http://www.ibm.com/support/docview.wss?uid=swg21999537 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM and QRadar Incident Forensics are vulnerable to OS command injection (CVE-2016-9726, CVE-2016-9727) *** http://www.ibm.com/support/docview.wss?uid=swg21999542 --------------------------------------------- *** IBM Security Bulletin: Malicious File Download vulnerability in IBM Business Process Manager (BPM) and WebSphere Lombardi Edition (WLE) CVE-2016-9693 *** https://www-01.ibm.com/support/docview.wss?uid=swg21998655 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM MessageSight (CVE-2016-7053, CVE-2016-7054, CVE-2016-7055) *** http://www.ibm.com/support/docview.wss?uid=swg21998755 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ administration command could cause denial of service (CVE-2016-8971) *** https://www-01.ibm.com/support/docview.wss?uid=swg21998663 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in dependent component shipped in IBM Development Package for Apache Spark (CVE-2016-4970) *** http://www.ibm.com/support/docview.wss?uid=swg21999185 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Express for UNIX (CVE-2016-7055, CVE-2017-3731 and CVE-2017-3732) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999470 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Development Package for Apache Spark *** http://www.ibm.com/support/docview.wss?uid=swg21999561 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM ILOG CPLEX Optimization Studio *** http://www-01.ibm.com/support/docview.wss?uid=swg21999668 --------------------------------------------- *** IBM Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain sensitive information using HTTP Header Injection (CVE-2017-1124) *** http://www.ibm.com/support/docview.wss?uid=swg21998053 --------------------------------------------- *** IBM Security Bulletin: Mozilla NSS as used in IBM QRadar SIEM is vulnerable to arbitrary code execution (CVE-2016-2834) *** http://www.ibm.com/support/docview.wss?uid=swg21999532 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM is vulnerable to a denial of service (CVE-2016-9740) *** http://www.ibm.com/support/docview.wss?uid=swg21999556 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM and QRadar Incident Forensics are vulnerable to information exposure (CVE-2016-9720) *** http://www.ibm.com/support/docview.wss?uid=swg21999533 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar Incident Forensics is vulnerable to overly permissive CORS access policies (CVE-2016-9725) *** http://www.ibm.com/support/docview.wss?uid=swg21999539 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 1-03-2017
by Daily end-of-shift report 01 Mar '17

01 Mar '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-02-2017 18:00 − Mittwoch 01-03-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Dridex Becomes First Malware Family to Integrate AtomBombing Technique *** --------------------------------------------- Bad news from malware-land after security researchers from IBM reported today theyd discovered the first samples of version 4.0 of the infamous and highly-active Dridex banking trojan. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/dridex-becomes-first-malware… *** Android: Passwort-Manager mit Sicherheitslücken *** --------------------------------------------- Passwort-Manager verwalten auf Smartphones diverse Zugangsdaten. Das ist zwar praktisch - doch nicht immer sind die Daten auch sicher verwahrt, wie das Frauenhofer SIT herausfand. Einige der untersuchten Apps wiesen gravierende Mängel auf. --------------------------------------------- https://heise.de/-3640040 *** Botnets *** --------------------------------------------- Botnets have existed for at least a decade. As early as 2000, hackers were breaking into computers over the Internet and controlling them en masse from centralized systems. Among other things, the hackers used the combined computing power of these botnets to launch distributed denial-of-service attacks, which flood websites with traffic to take them down.But now the problem is getting worse, thanks to a flood of cheap webcams, digital video recorders, and other gadgets in the "Internet of... --------------------------------------------- https://www.schneier.com/blog/archives/2017/03/botnets.html *** BSI legt Grundstein für Prüfungen gemäß IT-Sicherheitsgesetz *** --------------------------------------------- Betreiber kritischer Infrastruktur müssen sich zukünftig regelmäßig prüfen lassen und dabei nachweisen, Sicherheitsvorkehrungen gemäß dem Stand der Technik vorgenommen zu haben. Die ersten Schulungen für Prüfer machen klar, was das konkret bedeutet. --------------------------------------------- https://heise.de/-3632463 *** Wir werden alle an der Cloud verbluten .. oder so *** --------------------------------------------- http://www.cert.at/services/blog/20170301112306-1918.html *** [2017-03-01] XXE and XSS vulnerabilities in Aruba AirWave *** --------------------------------------------- The authenticated XXE and reflected XSS vulnerabilities were found in Aruba AirWave versions prior to 8.2.3.1. The XXE flaw can be exploited by either a low-privileged user or a social engineering attack which could allow an attacker to read sensitive files on the system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** DFN-CERT-2017-0362: Foxit Reader, Foxit PhantomPDF: Mehrere Schwachstellen ermöglichen u.a. die Ausführung beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0362/ *** SSA-934525 (Last Update 2017-03-01): Vulnerability in SINUMERIK Integrate *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-934525… *** SSA-701708 (Last Update 2017-03-01): Local Privilege Escalation in Industrial Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-701708… *** SECURITY BULLETIN: Multiple Vulnerabilities in Trend Micro SafeSync for Enterprise (SSFE) 3.2 *** --------------------------------------------- Trend Micro has released a new build for Trend Micro SafeSync for Enterprise (SSFE) 3.2. This fix resolves multiple vulnerabilities in the product that could potentially allow a remote attacker to execute arbitrary code on vulnerable installations. --------------------------------------------- https://success.trendmicro.com/solution/1116749 *** Cisco Prime Infrastructure Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system.The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this vulnerability by convincing a user to click a specific link. There are no workarounds that address this vulnerability. --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** Cisco NetFlow Generation Appliance Stream Control Transmission Protocol Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, causing a denial of service (DoS) condition.The vulnerability is due to incomplete validation of SCTP packets being monitored on the NGA data ports. An attacker could exploit this vulnerability by sending malformed SCTP packets on a network that is monitored by an NGA data... --------------------------------------------- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in the Expat XML parser (CVE-2016-0718) *** --------------------------------------------- A vulnerability has been identified in the Expat XML parser, which affects IBM Security Access Manager appliances. CVE(s): CVE-2016-0718 Affected product(s) and affected version(s): IBM Security Access Manager for Web 7.0 appliances, all firmware versions. IBM Security Access Manager for Web 8.0 appliances, all firmware versions. IBM Security Access Manager for Mobile 8.0 appliances, all... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21998991 *** IBM Security Bulletin: Tivoli Storage Manger (IBM Spectrum Protect) SQL interface vulnerable to unauthorized access (CVE-2016-8940) *** --------------------------------------------- Tivoli Storage Manager (IBM Spectrum Protect) SQL interface is vulnerable to unauthorized access to user credentials and product sensitive information. CVE(s): CVE-2016-8940 Affected product(s) and affected version(s): This vulnerability affects the following IBM Tivoli Storage Manager (IBM Spectrum Protect) Server levels: 7.1.0.0 through 7.1.7.0 6.3.0.0 through 6.3.6.0 6.2, 6.1, and 5.5 all levels (these releases... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21998946 *** Novell Patches *** --------------------------------------------- *** iManager 3.0.2.1 *** https://download.novell.com/Download?buildid=z_UnDt0kYyM~ --------------------------------------------- *** eDirectory 8.8 SP8 Patch 9 HotFix 2 *** https://download.novell.com/Download?buildid=KcXKGUw7GSg~ --------------------------------------------- *** eDirectory 9.0.2 Hot Fix 2 *** https://download.novell.com/Download?buildid=dRl85TKqwOE~ --------------------------------------------- *** iManager 2.7 Support Pack 7 - Patch 9 *** https://download.novell.com/Download?buildid=v_njeFs4biE~ ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 28-02-2017
by Daily end-of-shift report 28 Feb '17

28 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-02-2017 18:00 − Dienstag 28-02-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Mac-AV-Software ermöglichte Einschleusen von Schadcode *** --------------------------------------------- Eine unzureichende Absicherung bei der Lizenzprüfung von Eset Endpoint Antivirus für macOS ermöglichte es einem Angreifer, beliebigen Code mit Root-Rechten auszuführen. Die als kritisch eingestufte Sicherheitslücke wurde inzwischen behoben. --------------------------------------------- https://heise.de/-3638786 *** MongoDB: Sprechender Teddy teilte alle Daten mit dem Internet *** --------------------------------------------- Spielzeug aus der Cloudpets-Reihe zeichnet die Stimmen der Kinder auf. Wem das nicht schon zu creepy ist, der dürfte sich spätestens über die offene MongoDB-Datenbank aufregen. 800.000 Nutzer mit über 2 Millionen Sprachsamples sind betroffen. (Spielzeug, Datenschutz) --------------------------------------------- https://www.golem.de/news/mongodb-sprechender-teddy-teilte-alle-daten-mit-d… *** Severe SQL Injection Flaw Discovered in WordPress Plugin with Over 1 Million Installs *** --------------------------------------------- A WordPress plugin installed on over one million sites has just fixed a severe SQL injection vulnerability that can allow attackers to steal data from a websites database. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/severe-sql-injection-flaw-di… *** Decrypting after a Findzip ransomware infection *** --------------------------------------------- The Findzip ransomware was discovered on February 22, 2017. At that time, it was thought that files would be irreversibly encrypted by this ransomware, with no chance of decryption. Turns out, thats not quite true. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2017/02/decrypting-after-a-findzip… *** Guidelines on Incident Notification for Digital Service Providers *** --------------------------------------------- ENISA publishes a comprehensive guideline on how to implement incident notification requirements for Digital Service Providers, in the context of the NIS Directive. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/guidelines-on-incident-notifica… *** DFN-CERT-2017-0355: TYPO3: Zwei Schwachstellen ermöglichen Cross-Site-Scripting-Angriffe und das Umgehen von Sichherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0355/ *** DFN-CERT-2017-0340: Red Hat Package Manager (RPM): Mehrere Schwachstellen ermöglichen verschiedene Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0340/ *** SAP BusinessObjects Financial Consolidation Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1037910 *** VU#742632: Sage XRT Treasury database fails to properly restrict access to authorized users *** --------------------------------------------- Vulnerability Note VU#742632 Sage XRT Treasury database fails to properly restrict access to authorized users Original Release date: 28 Feb 2017 | Last revised: 28 Feb 2017 Overview Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Description CWE-639: Authorization Bypass Through User-Controlled Key - CVE-2017-3183Sage XRT Treasury is a business finance... --------------------------------------------- http://www.kb.cert.org/vuls/id/742632 *** DFN-CERT-2017-0356: ktnef: Eine Schwachstelle ermöglicht u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0356/ *** Bugtraq: Advisory X41-2017-001: Multiple Vulnerabilities in X.org *** --------------------------------------------- http://www.securityfocus.com/archive/1/540180 *** VTS17-003: Multiple Vulnerabilities in Veritas NetBackup and NetBackup Appliance *** --------------------------------------------- https://www.veritas.com/content/support/en_US/security/VTS17-003.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server January 2017 CPU *** http://www-01.ibm.com/support/docview.wss?uid=swg21998379 --------------------------------------------- *** IBM Security Bulletin: DB2 local escalation of privilege vulnerability affects Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-5995) *** http://www.ibm.com/support/docview.wss?uid=swg21998885 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Jazz for Service Management affects IBM Performance Management products (CVE-2016-9975) *** http://www-01.ibm.com/support/docview.wss?uid=swg21993846&myns=swgtiv&mynp=… --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM Cognos Controller *** http://www-01.ibm.com/support/docview.wss?uid=swg21983083 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java Runtime affect IBM Cognos Controller (CVE-2016-3427) *** http://www-01.ibm.com/support/docview.wss?uid=swg21983082 --------------------------------------------- *** IBM Security Bulletin: vulnerabilities in IBM WebSphere Application Server Liberty affects IBM Performance Management products *** http://www.ibm.com/support/docview.wss?uid=swg21993794 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Controller. *** http://www-01.ibm.com/support/docview.wss?uid=swg21977636 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Cognos Controller (CVE-2015-3195) *** http://www-01.ibm.com/support/docview.wss?uid=swg21976531 --------------------------------------------- *** IBM Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to various CVEs *** http://www.ibm.com/support/docview.wss?uid=swg21999478 --------------------------------------------- *** IBM Security Bulletin: Pivotal Spring Framework as used in IBM QRadar SIEM is vulnerable to various CVEs *** http://www.ibm.com/support/docview.wss?uid=swg21999395 --------------------------------------------- *** IBM Security Bulletin: Apache Solr as used in IBM QRadar SIEM and Incident Forensics is vulnerable to a denial of service (CVE-2014-0050) *** http://www.ibm.com/support/docview.wss?uid=swg21999474 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM uses broken or risky cryptographic algorithms (CVE-2016-2879) *** http://www.ibm.com/support/docview.wss?uid=swg21997341 --------------------------------------------- *** IBM Security Bulletin: IBM QRadar SIEM contains hard-coded credentials (CVE-2016-2880) *** http://www.ibm.com/support/docview.wss?uid=swg21997340 --------------------------------------------- *** IBM Security Bulletin: Apache Tomcat as used in IBM QRadar SIEM is vulnerable to various CVEs *** http://www.ibm.com/support/docview.wss?uid=swg21999488 --------------------------------------------- *** IBM Security Bulletin: IBM Java as used in IBM QRadar SIEM and Incident Forensics is vulnerable to various CVEs *** http://www.ibm.com/support/docview.wss?uid=swg21999479 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 27-02-2017
by Daily end-of-shift report 27 Feb '17

27 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-02-2017 18:00 − Montag 27-02-2017 18:00 Handler: Stephan Richter Co-Handler: n/a *** Project Zero: Erneut ungepatchter Microsoft-Bug veröffentlicht *** --------------------------------------------- Project Zero meint es ernst: Zum dritten Mal innerhalb weniger Monate gibt es einen Bugreport ohne Patch von Microsoft. Dieses Mal handelt es sich um einen Type-Confusion-Fehler in Internet Explorer und Edge. --------------------------------------------- https://www.golem.de/news/project-zero-erneut-ungepatchter-microsoft-bug-ve… *** DFN-CERT-2017-0348: Microsoft Internet Explorer, Microsoft Edge: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- Ein entfernter, nicht authentifizierter Angreifer, welcher einen Benutzer zum Besuch einer bösartig manipulierten Webseite verleiten kann, kann die Schwachstelle ausnutzen, um einen Denial-of-Service (DoS)-Zustand zu bewirken oder beliebigen Programmcode zur Ausführung zu bringen. Diese Schwachstelle wird von dem Google Projekt Zero veröffentlicht, da der Zeitraum, der dem Hersteller zum Beheben der Schwachstelle eingeräumt wurde (90 Tage), abgelaufen ist. Ein Sicherheitsupdate steht derzeit noch nicht zur Verfügung. Ein Proof-of-Concept zur Ausnutzung der Schwachstelle ist ebenfalls verfügbar. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0348/ *** Cloudflare data leak...what does it mean to me?, (Fri, Feb 24th) *** --------------------------------------------- The ISC has received several requests asking us to weigh in on the ramifications of the Cloudflare data leak, also being referred to by some as CloudBleed. The short version of the vulnerability is that in raresituations, a bug in Cloudflares edge servers could be triggered, which would cause a buffer overrun to occur. When these buffer overruns occurred, random data would be returned in the replies from the Cloudflare servers. This data would be data from any of Cloudflares customer... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22113&rss *** Zahlungsverkehr: Swift verlangt bessere Cyberabwehr *** --------------------------------------------- Im Kampf gegen Cyberkriminelle verlangt das Zahlungsverkehrssystem Swift größere Anstrengungen seitens der angeschlossenen Banken. --------------------------------------------- https://futurezone.at/b2b/zahlungsverkehr-swift-verlangt-bessere-cyberabweh… *** DSA-3795 bind9 - security update *** --------------------------------------------- It was discovered that a maliciously crafted query can cause ISCsBIND DNS server (named) to crash if both Response Policy Zones (RPZ)and DNS64 (a bridge between IPv4 and IPv6 networks) are enabled. Itis uncommon for both of these options to be used in combination, sovery few systems will be affected by this problem in practice. --------------------------------------------- https://www.debian.org/security/2017/dsa-3795 *** SHA1 Collision Attack Makes Its First Victim: Subversion Repositories *** --------------------------------------------- It took only one day for the SHA1 collision attack revealed by Google on Thursday to make its first victims after developers of the WebKit browser engine broke their Subversion (SVN) source code repository on Friday. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/sha1-collision-attack-makes-… *** DSA-3796 apache2 - security update *** --------------------------------------------- Several vulnerabilities were discovered in the Apache2 HTTP server. --------------------------------------------- https://www.debian.org/security/2017/dsa-3796 *** More on Bluetooth Ingenico Overlay Skimmers *** --------------------------------------------- This blog has featured several stories about "overlay" card and PIN skimmers made to be placed atop Ingenico-brand card readers at store checkout lanes. Im revisiting the topic again because a security technician at a U.S.-based retailer recently shared a few photos of several of these devices pulled from compromised card terminals, and the images and his story offer a fair bit more detail than in previous articles on Ingenico overlay skimmers. --------------------------------------------- https://krebsonsecurity.com/2017/02/more-on-bluetooth-ingenico-overlay-skim… *** Gefälschte Oberbank-Nachricht: Konto gesperrt! *** --------------------------------------------- Kund/innen erhalten scheinbar eine E-Mail der Oberbank. Darin heißt es, dass es zu einem nicht autorisierten Zugriff auf ihr Konto gekommen sei. [...] Es handelt sich um einen Phishingversuch! --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschte-oberbank-nachricht-k… *** Cyber extortionists hold MySQL databases for ransom *** --------------------------------------------- Ransomware has become cyber crooks' favorite attack methodology for hitting businesses, but not all cyber extortion attempts are effected with this particular type of malware. Since the beginning of the year, we have witnessed attackers compromising databases, exfiltrating data from them, wiping them and then asking for money (0.2 BTC) in order to return the data. They ransacked MongoDB, CouchDB and Hadoop databases, and now they've set MySQL databases in their sights. According to... --------------------------------------------- https://www.helpnetsecurity.com/2017/02/27/mysql-databases-ransom/ *** Security products and HTTPS: lets do it better *** --------------------------------------------- A recent paper showed that many HTTPS-intercepting security solutions have implemented TLS rather poorly. Does that mean we should avoid such solutions altogether? --------------------------------------------- https://www.virusbulletin.com:443/blog/2017/02/security-products-and-https-… *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Slowloris denial-of-service attack vulnerability CVE-2007-6750 *** https://support.f5.com:443/kb/en-us/solutions/public/12000/600/sol12636.htm… --------------------------------------------- *** Security Advisory: Linux kernel vulnerability CVE-2016-9555 *** https://support.f5.com:443/kb/en-us/solutions/public/k/54/sol54095660.html?… --------------------------------------------- *** Security Advisory: Expat XML library vulnerability CVE-2015-2716 *** https://support.f5.com:443/kb/en-us/solutions/public/k/50/sol50459349.html?… --------------------------------------------- *** Security Advisory: libarchive vulnerability CVE-2016-8688 *** https://support.f5.com:443/kb/en-us/solutions/public/k/35/sol35263486.html?… --------------------------------------------- *** Security Advisory: libarchive vulnerability CVE-2016-8689 *** https://support.f5.com:443/kb/en-us/solutions/public/k/52/sol52697522.html?… --------------------------------------------- *** Security Advisory: libarchive vulnerability CVE-2016-8687 *** https://support.f5.com:443/kb/en-us/solutions/public/k/13/sol13074505.html?… --------------------------------------------- *** Security Advisory: Linux kernel vulnerability CVE-2016-4998 *** https://support.f5.com:443/kb/en-us/solutions/public/k/74/sol74171196.html?… --------------------------------------------- *** Security Advisory: OpenSSL vulnerability CVE-2017-3732 *** https://support.f5.com:443/kb/en-us/solutions/public/k/44/sol44512851.html?… --------------------------------------------- *** Security Advisory: F5 TLS vulnerability CVE-2016-9244 *** https://support.f5.com:443/kb/en-us/solutions/public/k/05/sol05121675.html?… --------------------------------------------- *** Security Advisory: PHPMailer vulnerability CVE-2016-10045 *** https://support.f5.com:443/kb/en-us/solutions/public/k/73/sol73926196.html?… --------------------------------------------- *** Security Advisory: BIG-IP REST vulnerability CVE-2016-6249 *** https://support.f5.com:443/kb/en-us/solutions/public/k/12/sol12685114.html?… --------------------------------------------- *** Security Advisory: GnuTLS vulnerabilities CVE-2017-5335, CVE-2017-5336, and CVE-2017-5337 *** https://support.f5.com:443/kb/en-us/solutions/public/k/59/sol59836191.html?… --------------------------------------------- *** Security Advisory: perl-XML-Twig vulnerability CVE-2016-9180 *** https://support.f5.com:443/kb/en-us/solutions/public/k/08/sol08383757.html?… --------------------------------------------- *** Security Advisory: OpenSSL vulnerability CVE-2017-3731 *** https://support.f5.com:443/kb/en-us/solutions/public/k/37/sol37526132.html?… --------------------------------------------- *** Security Advisory: BIND vulnerability CVE-2017-3135 *** https://support.f5.com:443/kb/en-us/solutions/public/k/80/sol80533167.html?… --------------------------------------------- *** Security Advisory: libxml2 vulnerability CVE-2015-8806 *** https://support.f5.com:443/kb/en-us/solutions/public/k/04/sol04450715.html?… --------------------------------------------- *** Security Advisory: GnuTLS vulnerability CVE-2017-5334 *** https://support.f5.com:443/kb/en-us/solutions/public/k/31/sol31336596.html?… --------------------------------------------- *** Security Advisory: iControl vulnerability CVE-2016-9256 *** https://support.f5.com:443/kb/en-us/solutions/public/k/47/sol47284724.html?… --------------------------------------------- *** Security Advisory: TMM vulnerability CVE-2016-9245 *** https://support.f5.com:443/kb/en-us/solutions/public/k/22/sol22216037.html?… ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 24-02-2017
by Daily end-of-shift report 24 Feb '17

24 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-02-2017 18:00 − Freitag 24-02-2017 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Kriminelle versenden gefälschte BAWAK P.S.K.-SMS *** --------------------------------------------- In einer gefälschten BAWAG P.S.K.-SMS heißt es, dass die Bank das Konto von Kund/innen gesperrt habe. Damit diese ihr Konto wieder aktivieren können, sollen sie eine Website aufurfen und ihre Zugangsdaten bekannt geben. Achtung: Es handelt sich um einen Phishingversuch. Am besten ist es, wenn Sie die SMS löschen. --------------------------------------------- https://www.watchlist-internet.at/phishing/kriminelle-versenden-gefaelschte… *** Worlds Largest Spam Botnet Adds DDoS Feature *** --------------------------------------------- Necurs, the worlds largest spam botnet with nearly 5 million infected bots, of which one million active each day, has added a new module that can be used for launching DDoS attacks. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-a… *** Removing User Admin Rights Mitigates 94% of All Critical Microsoft Vulnerabilities *** --------------------------------------------- Just by preventing access to admin accounts, a system administrator could safeguard all the computers under his watch and prevent attackers from exploiting 94% of all the critical vulnerabilities Microsoft patched during the past year. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/microsoft/removing-user-admin-rights-… *** Bleeding clouds: Cloudflare server errors blamed for leaked customer data *** --------------------------------------------- While working on something completely unrelated, Google security researcher, Tavis Ormandy, recently discovered that Cloudflare was leaking a wide range of sensitive information, which could have included everything from cookies and tokens, to credentials.Cloudflare moved quickly to fix things, but their postmortem downplays the risk to customers, Ormandy said.The problem on Cloudflares side, which impacted big brands like Uber, Fitbit, 1Password, and OKCupid, was a memory leak. The flaw --------------------------------------------- http://www.csoonline.com/article/3173639/security/bleeding-clouds-cloudflar… *** Leaked Android Banking Trojan Spotted in Disguise on the Google Play Store *** --------------------------------------------- Just as security experts have predicted, the source code of a potent Android banking trojan that was leaked online in mid-December 2016, is now being seen in live attacks on a regular basis. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/leaked-android-banking-troja… *** LibreOffice Calc and Writer Embedded Object Preview Flaw Lets Remote Users Obtain Potentially Sensitive Information on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1037893 *** [Xen-announce] Xen Security Advisory 209 (CVE-2017-2620) - cirrus_bitblt_cputovideo does not check if memory region is safe *** --------------------------------------------- A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation. --------------------------------------------- https://lists.xen.org/archives/html/xen-announce/2017-02/msg00004.html *** [Xen-announce] Xen Security Advisory 210 - arm: memory corruption when freeing p2m pages *** --------------------------------------------- A malicious or buggy guest may corrupt hypervisor state, commonly leading to a host crash (Denial of Service). Privilege escalation or information leaks cannot be excluded. --------------------------------------------- https://lists.xen.org/archives/html/xen-announce/2017-02/msg00005.html *** Novell: NetIQ Access Manager 4.3 Support Pack 1 4.3.1.0-53 *** --------------------------------------------- The purpose of the patch is to provide a bundle of fixes for issues that have surfaced since NetIQ Access Manager 4.3 was released. These fixes include updates to the Access Gateway Appliance, Access Gateway Service, Identity Server, Analytics Server and Admin Console. CVE - 20145183 --------------------------------------------- https://download.novell.com/Download?buildid=30pOHdA3ETQ~ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities may affect IBM WebSphere Real Time *** https://www.ibm.com/support/docview.wss?uid=swg21997192 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities may affect IBM SDK, Java Technology Edition *** https://www.ibm.com/support/docview.wss?uid=swg21997194 --------------------------------------------- *** IBM Security Bulletin: IBM Business Process Manager (BPM) document store is affected by clickjacking vulnerability in administrative tool for BPM document store (CVE-2013-5462) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998385 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities in Apache Tomcat affect multiple IBM Rational products based on IBM's Jazz technology *** http://www-01.ibm.com/support/docview.wss?uid=swg21999362 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in Busybox (CVE-2014-9645) *** http://www.ibm.com/support/docview.wss?uid=swg21998196 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager appliances are affected by a vulnerability in IBM WebSphere Application Server (CVE-2016-5983) *** http://www.ibm.com/support/docview.wss?uid=swg21996871 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilites in IBM Algorithmics Algo One Algo Risk Application (ARA) related to IBM WebSphere Application Server Liberty *** http://www.ibm.com/support/docview.wss?uid=swg21999209 --------------------------------------------- *** IBM Security Bulletin: IBM Connections Security Refresh (CVE-2016-5932) *** http://www.ibm.com/support/docview.wss?uid=swg21998294 --------------------------------------------- *** IBM Security Bulletin: An XML parser vulnerability affects IBM Tivoli Access Manager for e-business and IBM Security Access Manager for Web 7.0 software releases (CVE-2016-4463) *** http://www.ibm.com/support/docview.wss?uid=swg21996869 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilites in IBM Algorithmics Algo One Algo Risk Application (ARA) Stack trace may be thrown if no default error page was set up and exception occurred *** http://www.ibm.com/support/docview.wss?uid=swg21997638 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 23-02-2017
by Daily end-of-shift report 23 Feb '17

23 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-02-2017 18:00 − Donnerstag 23-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Criminals Monetizing Attacks Against Unpatched WordPress Sites *** --------------------------------------------- Sites still vulnerable to a REST API endpoint flaw in WordPress are now being targeted by attackers trying to turn a profit. --------------------------------------------- http://threatpost.com/criminals-monetizing-attacks-against-unpatched-wordpr… *** MSRT February 2017: Chuckenit detection completes MSRT solution for one malware suite *** --------------------------------------------- In September 2016, we started adding to Microsoft Malicious Software Removal Tool (MSRT) a malware suite of browser modifiers and other Trojans installed by software bundlers. We documented how the malware in this group install other malware or applications silently, without your consent. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/02/22/msrt-february-2017-chuc… *** Top 8 Reverse Engineering Tools for Cyber Security Professionals *** --------------------------------------------- Whether it is rebuilding a car engine or diagramming a sentence, people can learn about many things simply by taking them apart and putting them back together again. This process of breaking something down to understand it, build a copy to improve it, is known as reverse engineering. --------------------------------------------- http://resources.infosecinstitute.com/top-8-reverse-engineering-tools-cyber… *** Impact of New Linux Kernel DCCP Vulnerability Limited *** --------------------------------------------- Existing mitigations and limitations around a newly disclosed Linux kernel vulnerability in the DCCP module mute the potential impact of local attacks. --------------------------------------------- http://threatpost.com/impact-of-new-linux-kernel-dccp-vulnerability-limited… *** Java, Python FTP Injection Attacks Bypass Firewalls *** --------------------------------------------- Newly disclosed FTP injection vulnerabilities in Java and Python that are fueled by rather common XML External Entity (XXE) flaws allow for firewall bypasses. --------------------------------------------- http://threatpost.com/java-python-ftp-injection-attacks-bypass-firewalls/12… *** Kollissionsangriff: Hashfunktion SHA-1 gebrochen *** --------------------------------------------- Forscher von Google und der Universität Amsterdam ist es gelungen, zwei unterschiedliche PDF-Dateien mit demselben SHA-1-Hash zu erzeugen. Dass SHA-1 unsicher ist, war bereits seit 2005 bekannt. (SHA-1, Google) --------------------------------------------- https://www.golem.de/news/kollissionsangriff-hashfunktion-sha-1-gebrochen-1… *** Putty 0.68 released *** --------------------------------------------- http://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Buffer Overflow from improperly formatted SELECT command in IBM Tivoli Storage Manager (IBM Spectrum Protect) Server (CVE-2016-8998) *** http://www.ibm.com/support/docview.wss?uid=swg21998747 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ cluster channel definition causes denial of service to cluster (CVE-2016-9009) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998647 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM Netezza PureData System for Analytics (CVE-2016-8610) *** http://www-01.ibm.com/support/docview.wss?uid=swg21997472 --------------------------------------------- *** IBM Security Bulletin: IBM MQ and IBM MQ Appliance are vulnerable to SWEET32 Birthday attack (CVE-2016-2183) *** http://www-01.ibm.com/support/docview.wss?uid=swg21995099 --------------------------------------------- *** IBM Security Bulletin: Information disclosure CVE-2016-9975 affects IBM Dashboard Application Services Hub (DASH) *** http://www.ibm.com/support/docview.wss?uid=swg21998714 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM WebSphere MQ (CVE-2016-2106, CVE-2016-2109) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998797 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 22-02-2017
by Daily end-of-shift report 22 Feb '17

22 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-02-2017 18:00 − Mittwoch 22-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Avast Releases a Decryptor for Offline Versions of the CryptoMix Ransomware *** --------------------------------------------- Today, Avast released a decryptor for CryptoMix victims that were encrypted while in offline mode. Offline mode is when the ransomware runs and encrypts a victims computer while there is no Internet connection or the computer cannot connect to the ransomwares Command & Control server. [...] --------------------------------------------- https://www.bleepingcomputer.com/news/security/avast-releases-a-decryptor-f… *** [R1] Nessus 6.10.2 Fixes One Vulnerability *** --------------------------------------------- Nessus was found to contain a flaw that allowed a remote, authenticated attacker to upload a crafted file that could be written to anywhere on the system. This could be used to subsequently gain elevated privileges on the system (e.g. after a reboot). This issue only affects installations on Windows. --------------------------------------------- http://www.tenable.com/security/tns-2017-06 *** Financial cyberthreats in 2016 *** --------------------------------------------- In 2016 we continued our in-depth research into the financial cyberthreat landscape. Weve noticed over the last few years that large financial cybercriminal groups have started to concentrate their efforts on targeting large organizations - such as banks, payment processing systems, retailers, hotels and other businesses where POS terminals are widely used. --------------------------------------------- http://securelist.com/analysis/publications/77623/financial-cyberthreats-in… *** Microsoft patcht Flash Player unter Windows außer der Reihe *** --------------------------------------------- Diesen Monat ist der Patchday trotz bekannter Sicherheitslücken in Windows ausgefallen. Nun liefert Microsoft zumindest Patches für kritische Lücken im Flash Player nach. --------------------------------------------- https://heise.de/-3632329 *** Security Advisory - Privilege Elevation Vulnerability Caused by Arbitrary File Upload in Huawei Themes *** --------------------------------------------- The Huawei Themes APP in some Huawei products has a privilege elevation vulnerability due to the lack of theme pack check. An attacker could exploit this vulnerability to upload theme packs containing malicious files and trick users into installing the theme packets, resulting in the execution of arbitrary code. (Vulnerability ID: HWPSIRT-2016-11073) This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-2699. --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170222-… *** Website Uses "Add Extension to Leave" Popups to Infect Chrome Users *** --------------------------------------------- A malvertising campaign has specifically targeted and redirected Chrome users to a website they couldnt leave unless they agreed to install a rogue Chrome extension. --------------------------------------------- https://www.bleepingcomputer.com/news/security/website-uses-add-extension-t… *** Apple: Logic Pro X 10.3.1 *** --------------------------------------------- Impact: Opening a maliciously crafted GarageBand project file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. --------------------------------------------- https://support.apple.com/en-us/HT207519 *** Sysinternals Updates *** --------------------------------------------- Sysmon v6, Autoruns v13.7, AccessChk v6.1, Process Monitor v3.32, Process Explorer v16.2, LiveKd v5.61, and BgInfo v4.21 --------------------------------------------- https://blogs.technet.microsoft.com/sysinternals/2017/02/17/update-sysmon-v… *** RSA Conference 2017 Playlist *** --------------------------------------------- https://www.youtube.com/playlist?list=PLeUGLKUYzh_j1Q75yeae8upX-T1FLmZWf *** Gefälschte A1-Rechnung verbreitet Schadsoftware *** --------------------------------------------- Kriminelle wollen mit einer scheinbar echten A1-Rechnung Schadsoftware auf fremden Computern hinterlegen. Damit sie das Ziel erreichen, fordern sie Empfänger/innen dazu auf, dass sie die angebliche Rechnung auf einer gefälschten A1-Website herunterladen. Wer die gefälschte Zahlungsaufstellung öffnet, installiert einen Trojaner. Er verschlüsselt Dateien und macht sie unbrauchbar. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/gefaelschte-a1-rec… *** Mobile Devices und Softwareupdates *** --------------------------------------------- Mobile Devices bestimmen in unserer modernen Gesellschaft zunehmend den Alltag. Das Lesen von Emails oder das Online-Banking: alltägliche Anwendungen werden immer öfter mit einem mobilen Endgerät umgesetzt, privat oder beruflich. Waren es bis vor kurzem nur Smartphones, welche das Handy abgelöst haben, oder Tablet-Computer, die ursprünglich als Bücher-Ersatz gedacht waren, so folgen heute beispielsweise die Uhr, die Brille, das Auto und viele mehr. --------------------------------------------- https://www.dfn-cert.de/aktuell/mobile_devices_software_updates.html *** SSA-363881 (Last Update 2017-02-22): Web Vulnerabilities in RUGGEDCOM NMS *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-363881… *** SSA-623229 (Last Update 2017-02-22): DROWN Vulnerability in Industrial Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-623229… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Mutiple vulnerabilities in zlib affect IBM ILOG CPLEX Optimization Studio *** http://www.ibm.com/support/docview.wss?uid=swg21997946 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Brocade Network Advisor affect IBM PureApplication System. *** http://www.ibm.com/support/docview.wss?uid=swg21998725 --------------------------------------------- *** IBM Security Bulletin: Potential cross-site scripting in the Admin Console for WebSphere Application Server (CVE-2016-8934) *** http://www-01.ibm.com/support/docview.wss?uid=swg21992315 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSource Spring Source/Pivotal Spring Framework affect IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2013-7315, CVE-2013-4152, CVE-2014-0054) *** http://www-01.ibm.com/support/docview.wss?uid=swg21992651 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 21-02-2017
by Daily end-of-shift report 21 Feb '17

21 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-02-2017 18:00 − Dienstag 21-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Joomla Security - Pornography Spam Campaign in the Wild *** --------------------------------------------- One of the worst experiences for a website owner is finding out that the search results for your site have turned into a pharmacy, a fashion outlet, or even a porn dump. Those unwanted keywords are a result of Search Engine Poisoning (SEP) attacks. This blackhat SEO technique is used by attackers to take advantage of your rankings on Search Engine Result Pages (SERPs). --------------------------------------------- https://blog.sucuri.net/2017/02/joomla-security-pornography-spam-campaign-i… *** Hardening Postfix Against FTP Relay Attacks, (Mon, Feb 20th) *** --------------------------------------------- Yesterday, I read an interesting blog post about exploiting XXE (XML eXternal Entity) flaws to send e-mails. In short: It is possible to trick the application to connect to an FTP server, but since mail servers tend to be forgiving enough, they will just accept e-mail if you use the FTP client to connect to port 25 on a mail server. The mail server will of course initially see the USER and PASS commands, but it will ignore them. Initially, I considered thisa lesser issue. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22086&rss *** New(ish) Mirai Spreader Poses New Risks *** --------------------------------------------- A cross-platform win32-based Mirai spreader and botnet is in the wild and previously discussed publicly. However, there is much information confused together, as if an entirely new IoT bot is spreading to and from Windows devices. This is not the case. Instead, an accurate assessment is that a previously active Windows botnet is spreading a Mirai bot variant. So let's make a level-headed assessment of what is really out there. --------------------------------------------- https://securelist.com/blog/research/77621/newish-mirai-spreader-poses-new-… *** Vulnerability in Citrix NetScaler Application Delivery Controller and NetScaler Gateway GCM nonce generation *** --------------------------------------------- A flaw in NetScaler ADC and Gateway causes GCM nonces to be randomly generated, making it marginally easier for remote attackers to obtain ... --------------------------------------------- https://support.citrix.com/article/CTX220329 *** DFN-CERT-2017-0317: Xen, QEMU: Eine Schwachstelle ermöglicht u.a. die Ausführung beliebigen Programmcodes *** --------------------------------------------- Ein einfach authentifizierter Angreifer im benachbarten Netzwerk mit erweiterten Privilegien (Guest Administator) kann auf Speicher außerhalb von Speichergrenzen zugreifen (Out-of-Bounds Access) und dadurch einen Denial-of-Service (DoS)-Angriff durchführen oder möglicherweise beliebigen Programmcode zur Ausführung bringen. Die Schwachstelle betrifft QEMU in allen Versionen von Xen. Es stehen Sicherheitsupdates zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0317/ *** Unstoppable JavaScript Attack Helps Ad Fraud, Tech Support Scams, 0-Day Attacks *** --------------------------------------------- There are multiple issues and attack scenarios that Caballero discovered, but fortunately, they only affect Internet Explorer 11, but not Edge, or browsers from other vendors. --------------------------------------------- https://www.bleepingcomputer.com/news/security/unstoppable-javascript-attac… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ invalid requests cause denial of service to MQXR listener (CVE-2016-8986) *** http://www.ibm.com/support/docview.wss?uid=swg21998648 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ Invalid channel protocol flows cause denial of service on HP-UX (CVE-2016-8915) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998649 --------------------------------------------- *** IBM Security Bulletin: Pivotal Spring Framework vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) *** http://www-01.ibm.com/support/docview.wss?uid=swg21999040 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Application Server Liberty Profile vulnerabilities affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2016-3092, CVE-2016-5986) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998590 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ Java clients might send a password in clear text (CVE-2016-3052) *** http://www.ibm.com/support/docview.wss?uid=swg21998660 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ Channel data conversion denial of service (CVE-2016-3013) *** http://www-01.ibm.com/support/docview.wss?uid=swg21998661 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 20-02-2017
by Daily end-of-shift report 20 Feb '17

20 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-02-2017 18:00 − Montag 20-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Android for Work Security Containers Bypassed with Relative Ease *** --------------------------------------------- Mobile security experts from Skycure have found two methods for bypassing the security containers put around "Android for Work," allowing attackers to access business data saved in this seemingly secure environment. --------------------------------------------- https://www.bleepingcomputer.com/news/mobile/android-for-work-security-cont… *** Users Continue to Install Malware on Their Phone 5 Years After Adobe Discontinued Flash for Android *** --------------------------------------------- It is unbelievable that almost five years after Adobe announced it would stop developing Flash Player for Android, users are still installing a non-existent piece of software, which in almost all cases is just malware in disguise. --------------------------------------------- https://www.bleepingcomputer.com/news/security/users-continue-to-install-ma… *** Google bellows bug news after Microsoft sails past fix deadline *** --------------------------------------------- Mess in Windows graphics library can give bad hombres access to memory Googles Project Zero has again revealed a Windows bug before Microsoft fixed it. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/02/20/google_proj… *** Mongoaudit Helps You Secure MongoDB Databases *** --------------------------------------------- A new tool developed by engineers at Stampery can help database administrators audit the security features of their current MongoDB installations, and take precautionary measures to prevent future exploitation. --------------------------------------------- https://www.bleepingcomputer.com/news/security/mongoaudit-helps-you-secure-… *** BIOS/UEFI mit Ransomware infiziert *** --------------------------------------------- Sicherheitsforscher haben gezeigt, dass sich das BIOS/UEFI eines Computers trotz aktuellem Windows 10 und diversen aktivierten Sicherheitsmechanismen mit einem Erpressungstrojaner infizieren lässt. --------------------------------------------- https://heise.de/-3630662 *** Spam and phishing in 2016 *** --------------------------------------------- 2016 saw a variety of changes in spam flows, with the increase in the number of malicious mass mailings containing ransomware being the most significant. These programs are readily available on the black market, and in 2017 the volume of malicious spam is unlikely to fall. --------------------------------------------- http://securelist.com/analysis/kaspersky-security-bulletin/77483/kaspersky-… *** SAP Security for Beginners. Part 6: SAP Risks Fraud *** --------------------------------------------- Welcome to the latest part of SAP Risks. After we finished with Espionage and Sabotage, let's eat the last piece of this "sweet cake" dubbed Fraud. In my opinion, fraud is the most common issue in ERP System and other business applications. --------------------------------------------- http://resources.infosecinstitute.com/sap-security-beginners-part-6-sap-ris… *** DFN-CERT-2017-0302: Suricata: Mehrere Schwachstellen ermöglichen verschiedene Denial-of-Service-Angriffe *** --------------------------------------------- Mehrere nicht näher spezifizierte Schwachstellen in Suricata ermöglichen einem entfernten, nicht authentisierten Angreifer die Durchführung verschiedener Denial-of-Service (DoS)-Angriffe aufgrund von Speicherlecks und Lesezugriffen außerhalb zugewiesenen Speichers. Der Hersteller informiert über die Schwachstellen und stellt Suricata 3.2.1 zur Behebung dieser Schwachstellen bereit. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0302/ *** tenable: [R1] SecurityCenter 5.4.3 File Upload unserialize() Function PHP Object Handling Remote File Deletion *** --------------------------------------------- SecurityCenter was found to use the PHP unserialize() function in several places in such a way that may allow a remote authenticated attacker to upload a crafted PHP object that resulted in the deletion of arbitrary files. --------------------------------------------- http://www.tenable.com/security/tns-2017-05 *** WordPress Security - Fake TrafficAnalytics Website Infection *** --------------------------------------------- Several months ago, our research team identified a fake analytics infection, known as RealStatistics. The malicious Javascript injection looks a lot like tracking code for a legitimate analytics service. ... Recently, a new variation of this type of infection has emerged. The new campaign uses trafficanalytics[.]online as the source for the injected script. --------------------------------------------- https://blog.sucuri.net/2017/02/fake-trafficanalytics-website-infection.html *** Penetration Testing Tools Cheat Sheet *** --------------------------------------------- Penetration testing tools cheat sheet, a quick reference high level overview for typical penetration testing engagements. Designed as a quick reference cheat sheet providing a high level overview of the typical commands you would run when performing a penetration test. --------------------------------------------- https://highon.coffee/blog/penetration-testing-tools-cheat-sheet/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: DOM-based cross-site scripting vulnerability affects IBM Advanced Management Module (AMM) for BladeCenter Systems *** http://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=migr-50… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect AIX (CVE-2017-3731) *** http://aix.software.ibm.com/aix/efixes/security/openssl_advisory23.asc ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 17-02-2017
by Daily end-of-shift report 17 Feb '17

17 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-02-2017 18:00 − Freitag 17-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Divide Between Work, Personal Data on Android Breached *** --------------------------------------------- Researchers demonstrate how malicious apps can break into secure Android work containers on EMM managed phones. --------------------------------------------- http://threatpost.com/divide-between-work-personal-data-on-android-breached… *** Don’t panic over cyber-terrorism: Daesh-bags still at script kiddie level *** --------------------------------------------- Medieval terror bastards not great at hacking says ex-top NSA lawyer RSA USA There’s no need to panic about the threat of a major online terrorist attack, since ISIS and their allies are all talk and no .. --------------------------------------------- www.theregister.co.uk/2017/02/16/online_terrorism_isnt/ *** Mobile apps and stealing a connected car *** --------------------------------------------- The concept of a connected car, or a car equipped with Internet access, has been gaining popularity for the last several years. By using proprietary mobile .. --------------------------------------------- http://securelist.com/analysis/publications/77576/mobile-apps-and-stealing-… *** DSA-3790 spice - security update *** --------------------------------------------- https://www.debian.org/security/2017/dsa-3790 *** MQTT-Protokoll: IoT-Kommunikation von etwa Reaktoren und Gefängnissen öffentlich einsehbar *** --------------------------------------------- Über das Telemetrie-Protokoll MQTT spricht eine unüberschaubare Zahl an IoT-Sensoren in etwa Autos und Flugzeugen mit ihren Servern – unverschlüsselt, ohne Frage nach Passwörtern. Hacker könnten nicht nur mitlesen, sondern Daten auch manipulieren. --------------------------------------------- https://heise.de/-3629650 *** Darknet-Drogenring in Braunau aufgeflogen *** --------------------------------------------- Die Hinweise auf den Suchtgifthandel kamen von Zollfahndung Frankfurt. Der Kopf der Bande befindet sich in Haft. --------------------------------------------- https://futurezone.at/digital-life/darknet-drogenring-in-braunau-aufgefloge… *** My Friend Cayla: Eltern müssen Puppen ihrer Kinder zerstören *** --------------------------------------------- Smartes Spielzeug wird vor allem von Datenschützern immer wieder kritisiert. In einem Fall greift die .. --------------------------------------------- https://www.golem.de/news/my-friend-cayla-eltern-muessen-puppen-ihrer-kinde… *** MQTT-Protokoll: IoT-Kommunikation von Reaktoren und Gefängnissen öffentlich einsehbar *** --------------------------------------------- Über das Telemetrie-Protokoll MQTT spricht eine unüberschaubare Zahl an IoT-Sensoren in etwa Autos und Flugzeugen .. --------------------------------------------- https://heise.de/-3629650 *** Gag Order: Riseup belebt den Kanarienvogel wieder *** --------------------------------------------- Nachdem Riseup seinen Warrant Canary im vergangenen Jahr nicht aktualisiert hatte, gab es viel Aufregung in der Szene. Jetzt gibt das Kollektiv bekannt: "Wir haben Nutzerdaten herausgegeben." Künftig soll das dank Verschlüsselung nicht mehr möglich sein. --------------------------------------------- https://www.golem.de/news/gag-order-riseup-belebt-den-kanarienvogel-wieder-… *** USB Killer now lets you fry most Lightning and USB-C devices for $55 *** --------------------------------------------- Plus a new, stealthy "anonymous" stick, because thats what the world really needed. --------------------------------------------- https://arstechnica.com/gadgets/2017/02/usb-killer-fry-lightning-usb-c-devi… *** Planning for an InfoSec Conference *** --------------------------------------------- I wasted many an early year going to InfoSec conferences and security events only to find them useless. Well, they werent totally useless, Id often come back with a bag full of goodies that more often than not included stress .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/planning-for-an-infose… *** SMTP Strict Transport Security Coming Soon to Gmail, Other Webmail Providers *** --------------------------------------------- SMTP Strict Transport Security is coming to major webmail providers this year, a Google engineer said at RSA Conference --------------------------------------------- http://threatpost.com/smtp-strict-transport-security-coming-soon-to-gmail-o… *** VB2016 paper: APT reports and OPSEC evolution, or: these are not the APT reports you are looking for *** --------------------------------------------- APT reports are great for gaining an understanding of how advanced attack groups operate - however, they can also .. --------------------------------------------- https://www.virusbulletin.com:443/blog/2017/02/vb2016-paper-apt-reports-and…

1 0

Tageszusammenfassung - Donnerstag 16-02-2017
by Daily end-of-shift report 16 Feb '17

16 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-02-2017 18:00 − Donnerstag 16-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Metatag -Moderately Critical - Information disclosure - SA-CONTRIB-2017-019 *** --------------------------------------------- https://www.drupal.org/node/2852937 *** Search API Sorts - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-016 *** --------------------------------------------- https://www.drupal.org/node/2852922 *** Who Ran Leakedsource.com? *** --------------------------------------------- Late last month, multiple news outlets reported that unspecified law enforcement officials had seized the servers for Leakedsource.com, perhaps the largest online collection .. --------------------------------------------- https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/ *** Yahoo reveals more breachiness to users victimized by forged cookies *** --------------------------------------------- Some accounts may have been accessed with forged cookies as recently as 2016. --------------------------------------------- https://arstechnica.com/information-technology/2017/02/yahoo-reveals-more-b… *** DSA-3789 libevent - security update *** --------------------------------------------- Several vulnerabilities were discovered in libevent, an asynchronousevent notification library. They would lead to Denial Of Service via application crash, or remote code execution. --------------------------------------------- https://www.debian.org/security/2017/dsa-3789 *** Ukraine verzeichnet 2016 Rekordzahl von Cyberangriffen *** --------------------------------------------- Chef des Inlandsgeheimdienstes vermeidet direkte Nennung Russlands --------------------------------------------- http://derstandard.at/2000052700282 *** Microsoft verschiebt Februar-Patches in den März *** --------------------------------------------- Diesen Monat gibt es keine Sicherheitspatches von Microsoft. Die eigentlich geplanten Updates will das .. --------------------------------------------- https://heise.de/-3627965 *** Blackberry liefert monatliche Sicherheitsupdates für alle Geräte *** --------------------------------------------- Im November war Blackberry aus dem Tritt geraten, versprochene Sicherheitsupdates für das DTEK50 kamen erst im Dezember. Nun hat sich die Versorgung wieder stabilisiert. --------------------------------------------- https://heise.de/-3627937 *** OpenSSL advisory 20170216 *** --------------------------------------------- During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected. --------------------------------------------- https://openssl.org/news/secadv/20170216.txt *** Google was aware of Russian APT28 group years before others *** --------------------------------------------- Lorenzo Bicchierai from MotherBoard shared an interesting private report about Russian cyber espionage operations conducted by APT28, the document was leaked online by Google. The .. --------------------------------------------- http://securityaffairs.co/wordpress/56336/apt/apt28-leaked-report.html *** Xen-Entwickler wollen weniger Sicherheitslücken offenlegen *** --------------------------------------------- Die Entwickler des Virtualisierungssystems Xen wollen weniger Sicherheitslücken öffentlich machen. Damit wollen sie vor allem Arbeit sparen, sorgen aber auch für eine klarere Linie im Umgang mit Schwachstellen. --------------------------------------------- https://heise.de/-3628690

1 0

Tageszusammenfassung - Mittwoch 15-02-2017
by Daily end-of-shift report 15 Feb '17

15 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-02-2017 18:00 − Mittwoch 15-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Amnesty International uncovers phishing campaign against human rights activists *** --------------------------------------------- Attacker targeted groups in Qatar, Nepal using extensive fake social media profile. --------------------------------------------- https://arstechnica.com/security/2017/02/amnesty-international-uncovers-phi… *** Siemens SIMATIC Authentication Bypass *** --------------------------------------------- This advisory contains mitigation details for an authentication bypass in Siemens SIMATIC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-045-03 *** Attacking the Windows NVIDIA Driver *** --------------------------------------------- Modern graphic drivers are complicated and provide a large promising attack surface for EoPs and sandbox escapes from processes that have access to the GPU (e.g. the Chrome GPU process). In this blog post we’ll take a look at attacking the .. --------------------------------------------- http://googleprojectzero.blogspot.com/2017/02/attacking-windows-nvidia-driv… *** Ransomware: a declining nuisance or an evolving menace? *** --------------------------------------------- The volume of ransomware encounters is on a downward trend. Are we seeing the beginning of the end of this vicious threat? Unfortunately, a look at the attack vectors, the number of .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/02/14/ransomware-2016-threat-… *** New ASLR-busting JavaScript is about to make drive-by exploits much nastier *** --------------------------------------------- A property found in virtually all modern CPUs neuters decade-old security protection. --------------------------------------------- https://arstechnica.com/security/2017/02/new-aslr-busting-javascript-is-abo… *** Adobe-Patchday: Flash Player wie üblich in kritischem Zustand *** --------------------------------------------- Im Flash Player und Adobe Digital Editions klaffen kritische Lücken. Aktuell sind vor allem Windows-Nutzer von den Flash-Lücken bedroht. Adobe Campaign erhält ebenfalls Sicherheitsupdates. --------------------------------------------- https://heise.de/-3626386 *** Researchers Discover Self-Healing Malware That Targets Magento Stores *** --------------------------------------------- Dutch malware experts have found a new malware strain that targets online shops running on the Magento platform, .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/researchers-discover-self-he… *** Cisco: Zwei VPN-Lücken und eine Schwachstelle, die offiziell keine ist *** --------------------------------------------- Cisco hat Sicherheitslücken im AnyConnect-VPN und auf seinen ASA-Firewalls gestopft. Ein Sicherheitsproblem mit dem SMI-Protokoll, welches es aus der Ferne erlaubt, neue Betriebssystem-Images auf Switches zu laden, sieht die Firma allerdings nicht. --------------------------------------------- https://heise.de/-3627330 *** Are Windows Registry Fixers Safe? *** --------------------------------------------- Before I got into cybersecurity, I spent years as a technical support agent for Windows end users of Windstream, an American ISP. Although Windstream is an ISP, they also offered a general Windows client OS remote support service for their predominantly .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/should-windows-users-b… *** Xagent: Russische Hackergruppe setzt auch auf Mac-Spionage-Software *** --------------------------------------------- Eine auf macOS abzielende Version der Malware Xagent stammt offenbar von der Hackergruppe APT28, die mit dem Angriff auf die Demokratische Partei im US-Wahlkampf in Verbindung gebracht wird. Xagent soll unter anderem iPhone-Backups entwenden. --------------------------------------------- https://heise.de/-3627630 *** Researchers trick CEO email scammer into giving up identity *** --------------------------------------------- Businesses targeted in email scams don’t always have to play the victim. They can actually fight back.Researchers at Dell SecureWorks have documented how they identified a .. --------------------------------------------- http://www.cio.com/article/3170117/security/researchers-trick-ceo-email-sca…

1 0

Tageszusammenfassung - Dienstag 14-02-2017
by Daily end-of-shift report 14 Feb '17

14 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-02-2017 18:00 − Dienstag 14-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Shirebrook man arrested in connection to Sports Direct breach *** --------------------------------------------- A 27-year-old man has been arrested in connection with the hack of Sports .. --------------------------------------------- www.theregister.co.uk/2017/02/13/sports_direct_arrest/ *** A look into the Russian-speaking ransomware ecosystem *** --------------------------------------------- In other words, crypto ransomware is a fine tuned, user friendly and constantly developing ecosystem. In the last few years we, at Kaspersky Lab, have been monitoring the development of this ecosystem. This is what we’ve learned. --------------------------------------------- http://securelist.com/analysis/publications/77544/a-look-into-the-russian-s… *** Top phishing targets in 2016? Google, Yahoo, and Apple *** --------------------------------------------- For every new phishing URL impersonating a financial institution, there were more than seven impersonating technology companies. Comparison of most impersonated companies .. --------------------------------------------- https://www.helpnetsecurity.com/2017/02/14/top-phishing-targets/ *** Metadata: The secret data trail *** --------------------------------------------- Every phone call, text message, even activated cell phones, leaves a trail of data across a network. In many cases this data is aggregated with other data and metadata including .. --------------------------------------------- https://www.helpnetsecurity.com/2017/02/14/metadata-secret-data-trail/ *** Worried about hacks, senators want info on Trump’s personal phone *** --------------------------------------------- Two senators have written to the U.S. Department of Defense about reports that President Donald Trump may still be using an old unsecured Android phone, including to communicate .. --------------------------------------------- http://www.cio.com/article/3169577/security/worried-about-hacks-senators-wa… *** 25% of web apps still vulnerable to eight of the OWASP Top Ten *** --------------------------------------------- 69 percent of web applications are plagued by vulnerabilities that could lead to sensitive data exposure, and 55 percent by cross-site request forgery flaws, the results .. --------------------------------------------- https://www.helpnetsecurity.com/2017/02/14/web-application-vulnerabilities/ *** Sicherheitslücke in GarageBand für den Mac *** --------------------------------------------- Apple hat einen potenziell problematischen Fehler in seiner populären Audioanwendung geschlossen. Angreifer hätten wohl Code ausführen können. --------------------------------------------- https://heise.de/-3624160 *** University DDoSed by Its Own IoT Devices *** --------------------------------------------- An unnamed university has suffered a DDoS attack at the hand of its own IoT devices, according to a sneak preview of Verizons upcoming yearly data breach report. --------------------------------------------- https://www.bleepingcomputer.com/news/security/university-ddosed-by-its-own… *** DSA-3788 tomcat8 - security update *** --------------------------------------------- It was discovered that a programming error in the processing of HTTPSrequests in the Apache Tomcat servlet and JSP engine may result indenial of service via an infinite loop. --------------------------------------------- https://www.debian.org/security/2017/dsa-3788 *** DSA-3787 tomcat7 - security update *** --------------------------------------------- It was discovered that a programming error in the processing of HTTPSrequests in the Apache Tomcat servlet and JSP engine may result indenial of service via an infinite loop. --------------------------------------------- https://www.debian.org/security/2017/dsa-3787 *** DSA-3786 vim - security update *** --------------------------------------------- Editor spell files passed to the vim (Vi IMproved) editormay result in an integer overflow in memory allocationand a resulting buffer overflow which potentiallycould result in the execution of arbitrary code or denial ofservice. --------------------------------------------- https://www.debian.org/security/2017/dsa-3786 *** Jetzt patchen! Angriffe auf WordPress-Seiten nehmen zu und werden gefährlicher *** --------------------------------------------- Nach der Verunstaltung von verwundbaren WordPress-Webseiten versuchen Angreifer nun Schadcode auszuführen, warnen Sicherheitsforscher. --------------------------------------------- https://heise.de/-3624301 *** Staying safe online on Valentine’s Day *** --------------------------------------------- We give some advice on how to steer clear of scams and other bad things on Valentines Day. Everything from .. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2017/02/staying-safe-online-on-val… *** Chrome: Google zahlt 20 Millionen US-Dollar für Anti-Malware-Patente *** --------------------------------------------- Auch für Google sind 20 Millionen Dollar nicht wenig Geld. Ein US-Gericht verurteilte das Unternehmen zur Zahlung dieser Summe, weil es Patente zur Sicherung vor Malware im .. --------------------------------------------- https://www.golem.de/news/chrome-google-zahlt-20-millionen-us-dollar-fuer-a… *** Tracking the Decline of Top Exploit Kits *** --------------------------------------------- The latter half of 2016 saw a major shift in the exploit kit landscape, with many established kits suddenly dropping operations or switching business models. Angler, which has .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/tracking-decline… *** Gefälschte Post.at-Sendungsverfolgung im Umlauf *** --------------------------------------------- Mit einer gefälschten Post.at-Sendungsverfolgung wollen Kriminelle Schadsoftware auf fremden Computern hinterlegen. Dazu fordern sie Empfänger/innen auf, Informationen .. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/gefaelschte-postat-sendungs… *** Security Bulletins posted for Flash Player, Digital Editions and Adobe Campaign *** --------------------------------------------- Adobe has published security bulletins for Adobe Flash Player (APSB17-04), Adobe Digital Editions (APSB17-05) and Adobe Campaign (APSB17-06). Adobe recommends users update their .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1444 *** Nation States Distancing Themselves from APTs *** --------------------------------------------- Increasingly, governments are outsourcing state-sponsored attacks to mitigate risk and maximize intelligence. --------------------------------------------- http://threatpost.com/nation-states-distancing-themselves-from-apts/123711/ *** February 2017 security update release *** --------------------------------------------- Our top priority is to provide the best possible experience for customers in maintaining and protecting their .. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2017/02/14/february-2017-security-…

1 0

Tageszusammenfassung - Montag 13-02-2017
by Daily end-of-shift report 13 Feb '17

13 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-02-2017 18:00 − Montag 13-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** State-sponsored Hackers Targeting Prominent Journalists, Google Warns *** --------------------------------------------- State-sponsored hackers are attempting to steal email passwords of a number of prominent journalists, Google has warned. The hackers are suspected to be Russians, reports POLITICO. Some of the journalists who have received such warnings from Google as .. --------------------------------------------- https://politics.slashdot.org/story/17/02/10/1726206/state-sponsored-hacker… *** Unique Office Loader Deploying Multiple Malware Families *** --------------------------------------------- http://researchcenter.paloaltonetworks.com/2017/02/unit42-unique-office-loa… *** Sports Direct hacked but it still hasn't disclosed the breach to its staff *** --------------------------------------------- Sports Direct, the UK's largest sports retail business, was hacked last year, and still hasn't disclosed the incident to its staff. The Register confirmed that the Sports Direct, the UK's largest sports retail business, was hacked last .. --------------------------------------------- http://securityaffairs.co/wordpress/56187/data-breach/sports-direct-data-br… *** Think Twice before Posting Data on Pastebin! *** --------------------------------------------- Pastebin.com is one of my favourite playground. I'm monitoring the content of all pasties posted on this website. My goal is to find juicy data like configurations, database .. --------------------------------------------- https://blog.rootshell.be/2017/02/12/think-twice-posting-data-pastebin/ *** Lazarus & Watering-hole attacks *** --------------------------------------------- On 3rd February 2017, researchers at badcyber.com released an article that detailed a series of .. --------------------------------------------- http://baesystemsai.blogspot.com/2017/02/lazarus-watering-hole-attacks.html *** Do You Use VirusTotal? Give PacketTotal a Spin!, (Mon, Feb 13th) *** --------------------------------------------- Packettotal ( http://www.packettotal.com ) is a new site that does some nifty analysis of Packet Captures for you if youre not so familiar with Wireshark or other analysis tools Out of the gate, this site maps out connections, certificates, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22061 *** Firefox für Android kann sich an Schadcode verschlucken *** --------------------------------------------- In der Version 51.0.3 haben die Firefox-Entwickler eine kritische Sicherheitslücke geschlossen. Von der Schwachstelle ist ausschliesslich die Android-Version betroffen. --------------------------------------------- https://heise.de/-3623027 *** Mirai Widens Distribution with New Trojan that Scans More Ports *** --------------------------------------------- Late last year, in several high-profile and potent DDoS attacks, Linux-targeting Mirai (identified by Trend Micro as ELF_MIRAI family) revealed just how broken the Internet .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/mirai-widens-dis… *** Project Zero: NTFS-Treiber ermöglicht Linux-Rootzugriff *** --------------------------------------------- Eine fehlerhafte Konfiguration des Userspace-Treibers für NTFS unter Linux ermöglicht einfachen Root-Zugriff. Davon betroffen waren Standardinstallationen von Debian .. --------------------------------------------- https://www.golem.de/news/project-zero-ntfs-treiber-ermoeglicht-linux-rootz… *** Mexiko soll Gegner von Softdrinks mit Spyware ausgespäht haben *** --------------------------------------------- Aktivisten, die für eine höhere Besteuerung von zuckerhaltigen Getränken und fettreichen Speisen kämpften, wurden ausgehorcht --------------------------------------------- http://derstandard.at/2000052555921 *** Dateilose Infektion: Einbruch ohne Spuren *** --------------------------------------------- Sicherheitsforscher warnen, dass vermutlich die Carbanak-Gang einen neuen Trick verwendet, der viele Schutz- und Analyse-Programme ins Leere laufen lässt. Sie brechen in Computer und Netze ein, ohne dass dabei verdächtige Dateien auf der Platte landen. --------------------------------------------- https://heise.de/-3623084

1 0

Tageszusammenfassung - Freitag 10-02-2017
by Daily end-of-shift report 10 Feb '17

10 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-02-2017 18:00 − Freitag 10-02-2017 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** ENISA study on the security aspects of virtualization *** --------------------------------------------- The report provides an analysis on the current status of security of virtualization, by presenting current technologies affected, risks, efforts, gaps, and the impact the latter have on environments based on virtualization technologies. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/enisa-study-on-the-security-asp… *** A Feeding Frenzy to Deface WordPress Sites *** --------------------------------------------- In this report we share data on the ongoing flood of WordPress REST-API exploits we are seeing in the wild. We include data on 20 different site defacement campaigns we are currently tracking. --------------------------------------------- https://www.wordfence.com/blog/2017/02/rest-api-exploit-feeding-frenzy-defa… *** RCE Attempts Against the Latest WordPress REST API Vulnerability *** --------------------------------------------- We are starting to see remote command execution (RCE) attempts trying to exploit the latest WordPress REST API Vulnerability. These RCE attempts started today after a few days of attackers (mostly defacers) rushing to vandalize as many pages as they could. The RCE attempts we are seeing in the wild do not affect every WordPress sites, only the ones using plugins that allow for PHP execution from within posts and pages. --------------------------------------------- https://blog.sucuri.net/2017/02/rce-attempts-against-the-latest-wordpress-r… *** De-Anonymizing Browser History Using Social-Network Data *** --------------------------------------------- Interesting research: "De-anonymizing Web Browsing Data with Social Networks":Abstract: Can online trackers and network adversaries de-anonymize web browsing data readily available to them? We show -- theoretically, via simulation, and through experiments on real user data -- that de-identified web browsing histories can\ be linked to social media profiles using only publicly available data. Our approach is based on a simple observation: each person has a distinctive social network,... --------------------------------------------- https://www.schneier.com/blog/archives/2017/02/de-anonymizing_1.html *** CERT updates insider threat guidebook *** --------------------------------------------- The CERT Division of the Software Engineering Institute (SEI) at Carnegie Mellon University released the fifth edition of the Common Sense Guide to Mitigating Insider Threats. The guide describes 20 practices that organizations should implement across the enterprise to prevent and detect insider threats, as well as case studies of organizations that failed to do so. --------------------------------------------- https://www.helpnetsecurity.com/2017/02/10/insider-threat-guidebook/ *** ENISA issues Smartphone Development Guidelines *** --------------------------------------------- ENISA publishes an update of the Smartphone Development Guidelines. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/enisa-issues-smartphone-develop… *** Hacking Guatemala's DNS - Spying on Active Directory Users By Exploiting a TLD Misconfiguration *** --------------------------------------------- In search of new interesting high-impact DNS vulnerabilities I decided to take a look at the various top-level domains (TLDs) and analyze their configurations for errors. Upon some initial searching it turns out there is a nice open source service which helps DNS administrators scan their domains for misconfigurations called DNSCheck written by The Internet Foundation in Sweden. This tool helps highlight all sorts of odd DNS misconfigurations such as having an... --------------------------------------------- https://thehackerblog.com/hacking-guatemalas-dns-spying-on-active-directory… *** Unpatched (0day) jQuery Mobile XSS *** --------------------------------------------- TL;DR - Any website that uses jQuery Mobile and has an open redirect is now vulnerable to XSS - and theres nothing you can do about it, theres not even patch --------------------------------------------- http://sirdarckcat.blogspot.co.at/2017/02/unpatched-0day-jquery-mobile-xss.… *** Multiple cross-site scripting vulnerabilities in Webmin *** --------------------------------------------- Webmin contains multiple cross-site scripting vulnerabilities. --------------------------------------------- http://jvn.jp/en/jp/JVN34207650/ *** Western Digital My Cloud 2.21.119 Authentication Bypass *** --------------------------------------------- Topic: Western Digital My Cloud 2.21.119 Authentication Bypass Risk: High Text: Authentication bypass vulnerability in Western Digital My Cloud Remco Verm... --------------------------------------------- https://cxsecurity.com/issue/WLB-2017020093 *** Hanwha Techwin Smart Security Manager *** --------------------------------------------- This advisory contains mitigation detail for remote code execution vulnerabilities in Hanwha Techwins Smart Security Manager. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-040-01 *** DFN-CERT-2017-0251: Xen, QEMU: Eine Schwachstelle ermöglicht das Ausspähen von Informationen und die Eskalation von Privilegien *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0251/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Potential Cross-site scripting vulnerability in WebSphere Application Server (CVE-2017-1121) *** http://www-01.ibm.com/support/docview.wss?uid=swg21997743 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple php5 vulnerabilities (CVE-2016-6911, CVE-2016-8670) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024834 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by a kernel vulnerability *** http://www.ibm.com/support/docview.wss?uid=isg3T1024807 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple cURL/libcURL vulnerabilities (CVE-2016-5419, CVE-2016-5420, CVE-2016-7141) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024808 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by a libgcrypt vulnerability (CVE-2016-6313) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024832 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affect Rational Tau (CVE-2016-2180) *** http://www-01.ibm.com/support/docview.wss?uid=swg21994132 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affect Rational Tau (CVE-2016-2177) *** http://www-01.ibm.com/support/docview.wss?uid=swg21993836 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple glibc vulnerabilities (CVE-2016-1234, CVE-2016-3706, CVE-2016-4429) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024831 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 9-02-2017
by Daily end-of-shift report 09 Feb '17

09 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-02-2017 18:00 − Donnerstag 09-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Lifting the (Hyper) Visor: Bypassing Samsung's Real-Time Kernel Protection *** --------------------------------------------- Posted by Gal Beniamini, Project ZeroTraditionally, the operating system's kernel is the last security boundary standing between an attacker and full control over a target system. As such, additional care must be taken in order to ensure the integrity of the kernel. --------------------------------------------- http://googleprojectzero.blogspot.com/2017/02/lifting-hyper-visor-bypassing… *** FortiManager TLS certificate validation failure *** --------------------------------------------- FortiManager does not properly validate TLS certificates when probing for devices to administer. This leads to potential pre-shared secret exposure. --------------------------------------------- http://fortiguard.com/advisory/FG-IR-16-055 *** Gefälschte iTunes-Rechnung: Danke für Ihren Einkauf *** --------------------------------------------- Mit einer gefälschten iTunes-Rechnug wollen Kriminelle Empfänger/innen dazu bewegen, dass sie eine Website aufrufen. Auf dieser sollen Besucher/innen Kreditkarteninformationen bekannt geben, damit sie einen nicht gewollten Einkauf stornieren können. Es handelt sich um einen Datendiebstahlsversuch. Sie dürfen die Daten nicht bekannt geben. --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschte-itunes-rechnung-dank… *** Security Advisory - Privilege Escalation Vulnerability in Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170209-… *** Analysis of security measures deployed by e-communication providers *** --------------------------------------------- ENISA's new report provides a collection of good practices, implemented security measures and approaches by e-communication providers in the EU, to mitigate the main types of incidents in the telecommunication sector. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/analysis-of-security-measures-d… *** Security and Privacy Guidelines for the Internet of Things *** --------------------------------------------- Lately, I have been collecting IoT security and privacy guidelines. Heres everything Ive found: --------------------------------------------- https://www.schneier.com/blog/archives/2017/02/security_and_pr.html *** iCloud schlampt offenbar beim Löschen des Browser-Verlaufs *** --------------------------------------------- Aus dem Verlauf von Apples Browser Safari gelöschte Webseiten-Besuche verschwinden zwar von den synchronisierten Geräten, lassen sich aber noch rund ein Jahr später aus iCloud rekonstruieren, warnt der Hersteller eines Forensik-Tools. --------------------------------------------- https://heise.de/-3621063 *** Brute Force RDP Attacks Plant CRYSIS Ransomware *** --------------------------------------------- ... brute force RDP attacks are still ongoing, affecting both SMEs and large enterprises across the globe. In fact, the volume of these attacks doubled in January 2017 from a comparable period in late 2016. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/brute-force-rdp-… *** DFN-CERT-2017-0237: ISC BIND: Eine Schwachstellen ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- Das Internet Systems Consortium (ISC) ... veröffentlicht die neuen Programmversionen BIND 9.9.9-P6, 9.10.4-P6, 9.11.0-P3 und 9.9.9-S8 (letztere nur für ISC Support Kunden), in denen die Schwachstellen behoben sind. Die Schwachstelle kann durch Deaktivierung von DNS64 oder RPZ umgangen werden, bis das Sicherheitsupdate eingespielt werden kann. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0237/ *** GNU Bash code execution vulnerability in path completion *** --------------------------------------------- GNU Bash from version 4.4 contains two bugs in its path completion feature leading to a code execution vulnerability. An exploit can be realized by creating a file or directory with a specially crafted name. A user utilizing GNU Bash's built-in path completion by hitting the Tab button (f.e. to remove it with rm) triggers the exploit without executing a command itself. --------------------------------------------- https://cxsecurity.com/issue/WLB-2017020061 *** DFN-CERT-2017-0240: F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht das Ausspähen von Informationen *** --------------------------------------------- F5 Networks BIG-IP Protocol Security Module (PSM) >= 11.4.0, <= 11.4.1 Ein entfernter, einfach authentifizierter Angreifer kann durch Wiederaufnahme einer SSL-Verbindung zu einer betroffenen F5 BIG-IP-Appliance Informationen ausspähen, da der Server abhängig von der Größe des gesendeten Sitzungsidentifizierers (Session ID) als Antwort bis zu 31 Bytes aus nicht initialisiertem Speicher zurücksendet. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0240/ *** Erpressungs-Trojaner Erebus umgeht erfolgreich UAC-Abfrage von Windows *** --------------------------------------------- Sicherheitsforschern zufolge verbiegt Erebus die Windows-Registry dahingehend, sodass der Schädling schlimmstenfalls mit Admin-Rechten operieren kann. Dank einer Windows-Einstellung kann man das aber unterbinden. --------------------------------------------- https://heise.de/-3619820 *** BSI veröffentlicht Leitfaden für sicheres Android mit Samsung Knox *** --------------------------------------------- Administratoren können sich von der Website des BSI Empfehlungen für Samsungs Sicherheitsplattform laden. Zweck ist der Schutz von Android-Geräten. --------------------------------------------- https://heise.de/-3620713 *** Manipuliertes Word-Dokument: Makro-Malware geht den Mac an *** --------------------------------------------- Mit manipulierten Word-Dokumenten wollen Angreifer nun auch Schadcode auf Macs einschleusen. Damit wird die macOS-Schutzfunktion Gatekeeper umgangen. --------------------------------------------- https://heise.de/-3621092 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in GNU C Library affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch firmware (CVE-2016-1234) *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in NTP affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in NTP affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module for BladeCenter and QLogic Virtual Fabric Extension Module for IBM *** https://support.podc.sl.edst.ibm.com/support/home/docdisplay?lndocid=MIGR-5… ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 8-02-2017
by Daily end-of-shift report 08 Feb '17

08 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-02-2017 18:00 − Mittwoch 08-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** As Valve eradicates serious bug in Steam, here's what you need to know *** --------------------------------------------- Steam, an online game platform with more than 125 million active accounts, is in the process of fixing a serious security hole that opens users to hacks that could redirect them to attack sites, spend their market funds, or possibly make malicious changes to their user profiles. --------------------------------------------- https://arstechnica.com/security/2017/02/as-valve-eradicates-serious-bug-in… *** Fileless attacks against enterprise networks *** --------------------------------------------- This threat was originally discovered by a bank's security team, after detecting Meterpreter code inside the physical memory of a domain controller (DC). Kaspersky Lab participated in the forensic analysis, discovering the use of PowerShell scripts within the Windows registry. Additionally it was discovered that the NETSH utility as used for tunnelling traffic from the victim's host to the attacker's C2. --------------------------------------------- http://securelist.com/blog/research/77403/fileless-attacks-against-enterpri… *** Strategies to Mitigate Cyber Security Incidents *** --------------------------------------------- The Australian Signals Directorate (ASD) has developed prioritised mitigation strategies to help technical cyber security professionals in all organisations mitigate cyber security incidents. This guidance addresses targeted cyber intrusions, ransomware and external adversaries with destructive intent, malicious insiders, business email compromise and industrial control systems. --------------------------------------------- http://www.asd.gov.au/infosec/mitigationstrategies.htm *** ESA-2017-001: EMC Isilon InsightIQ Authentication Bypass Vulnerability *** --------------------------------------------- An attacker can exploit the vulnerability to bypass authentication and thereby gain administrator privileges. --------------------------------------------- http://www.securityfocus.com/archive/1/540100 *** When A Pony Walks Out Of A Pub *** --------------------------------------------- Talos has observed a small email campaign leveraging the use of Microsoft Publisher files. ... Unlike other applications within the Microsoft Office suite, Microsoft Publisher does not support a Protected View mode. ... The file used in this campaign was aimed at infecting the victim with the, well known, Pony malware --------------------------------------------- http://blog.talosintel.com/2017/02/pony-pub-files.html *** Multiple Vulnerabilities in Trend Micro Control Manager (TMCM) 6.0 *** --------------------------------------------- CVSS 2.0 Score(s): 4.0 - 6.8 Severity Rating(s): Medium Trend Micro has released a new build for Trend Micro Conrol Manager 6.0. This build resolves multiple vulnerabilities related to potential remote code execution, directory traversal, SQL injections, and unauthorized access to XML files. --------------------------------------------- https://success.trendmicro.com/solution/1116624 *** SAP Security for Beginners Part 5: SAP Risks - Sabotage *** --------------------------------------------- Sabotage attacks on SAP systems were promised as a today's topic, so, let's look at potential sabotage vectors. --------------------------------------------- http://resources.infosecinstitute.com/sap-security-beginners-part-5-sap-ris… *** Sielco Sistemi Winlog SCADA Software *** --------------------------------------------- This advisory contains mitigation details for an uncontrolled search path vulnerability in Sielco Sistemis Winlog SCADA Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-038-01 *** BD Alaris 8000 Insufficiently Protected Credentials Vulnerability *** --------------------------------------------- This advisory was originally posted to the NCCIC Portal on January 17, 2017, and is being released to the NCCIC/ICS-CERT web site. This advisory contains mitigation details for an insufficiently protected credentials vulnerability in BD's Alaris 8000 Point of Care unit, which provides a common user interface for programming intravenous infusions. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-01 *** BD Alaris 8015 Insufficiently Protected Credentials Vulnerabilities *** --------------------------------------------- This advisory was originally posted to the NCCIC Portal on January 17, 2017, and is being released to the NCCIC/ICS-CERT web site. This advisory contains mitigation details for protected credentials vulnerabilities in BD's Alaris 8015 Point of Care unit, which provides a common user interface for programming intravenous infusions. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSMA-17-017-02 *** BINOM3 Electric Power Quality Meter (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-17-031-01 BINOM3 Electric Power Quality Meter that was published January 31, 2017, on the NCCIC/ICS-CERT web site. This updated advisory contains mitigation details for vulnerabilities in BINOM3s electric power quality meter. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-17-031-01A *** Citrix NetScaler Nonce Generation Flaw Lets Remote Users Obtain Potentially Sensitive Information on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1037795 *** Huawei Security Advisories *** --------------------------------------------- *** Security Advisory - Buffer Overflow Vulnerability in Emergdata Driver of Huawei Smart Phones *** http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170208-… --------------------------------------------- *** Security Advisory - Buffer Overflow Vulnerability in Goldeneye Driver of Huawei Smart Phones *** http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170208-… --------------------------------------------- *** Security Advisory - MITM Vulnerability in Huawei Vmall APP *** http://www.huawei.com/en/psirt/security-advisories/2017/huawei-sa-20170208-… --------------------------------------------- *** Cisco Security Advisories *** --------------------------------------------- *** Cisco AnyConnect Secure Mobility Client for Windows SBL Privileges Escalation Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** Cisco ASA Clientless SSL VPN CIFS Heap Overflow Vulnerability *** https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server *** http://www-01.ibm.com/support/docview.wss?uid=swg21995427 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Rational DOORS Next Generation with potential for Cross-Site Scripting attack (CVE-2016-6055) *** http://www.ibm.com/support/docview.wss?uid=swg21995515 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Rational Rhapsody Design Manager with potential for Denial of Service attack *** http://www.ibm.com/support/docview.wss?uid=swg21997798 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime may affect IBM Mobile Connect as a product bundler *** http://www-01.ibm.com/support/docview.wss?uid=swg21989670 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in SSLv3 affects Multiple N series products (CVE-2014-3566) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009543 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2016-8858, CVE-2016-10009, CVE-2016-10011, CVE-2016-10012) *** http://aix.software.ibm.com/aix/efixes/security/openssh_advisory10.asc ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 7-02-2017
by Daily end-of-shift report 07 Feb '17

07 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-02-2017 18:00 − Dienstag 07-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Heute ist es soweit: Es ist Internationaler Safer Internet Day! *** --------------------------------------------- Der jährliche Aktionstag wurde 2004 von der Europäischen Kommission im Rahmen des Safer Internet-Programms ins Leben gerufen und findet seitdem jeden Februar statt. Mehr als 100 Länder beteiligen sich weltweit am Safer Internet Day, um über die sichere und verantwortungsvolle Internetnutzung aufzuklären. International organisiert das europäische Netzwerk Insafe den Safer Internet Day. --------------------------------------------- https://www.saferinternet.at/news/news-detail/article/heute-feiern-wir-es-i… *** DFN-CERT-2017-0216/">Google Android Operating System: Mehrere Schwachstellen ermöglichen u.a. die komplette Systemübernahme *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0216/ *** Got an OpenBSD Web server? Better patch it *** --------------------------------------------- DoS-able bugs splatted OpenBSD and two of its SSL libraries need patches against a pair of denial-of-service bugs that can crash Web-facing servers --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/02/07/got_an_open… *** Vuln: PEAR HTML_AJAX CVE-2017-5677 PHP Object Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96044 *** New Attack, Old Tricks *** --------------------------------------------- A Word document targets Mac users with malicious macros and an open-source payload. --------------------------------------------- https://objective-see.com/blog/blog_0x17.html *** Citrix License Server for Windows and License Server VPX CVE-2017-5571 Open Redirect Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96028/discuss *** DFN-CERT-2017-0217/">BlackBerry powered by Android: Mehrere Schwachstellen ermöglichen u.a. die komplette Systemübernahme *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2017-0217/ *** [2017-02-07] Multiple vulnerabilities in JUNG Smart Visu server *** --------------------------------------------- Attackers can dump password hashes and other available data from the operating system of the JUNG Smart Visu Server. An attacker is able to access and control all Smart Visu server installation if he is able to crack the hashes. The group address password can be removed by using a single PUT request. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2017… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i *** http://www-01.ibm.com/support/docview.wss?uid=nas8N1021845 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in Oracle Outside In Technology affect IBM Rational DOORS Next Generation *** http://www.ibm.com/support/docview.wss?uid=swg21997654 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities have been identified in IBM Flex System Manager (FSM) Storage Manager Install Anywhere (SMIA) Configuration tool *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024798 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSH affect IBM i *** http://www.ibm.com/support/docview.wss?uid=nas8N1021846 --------------------------------------------- *** IBM Security Bulletin: Security Vulnerability in OpenSSL affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) *** http://www.ibm.com/support/docview.wss?uid=swg21997056 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect AppScan Standard (CVE-2016-5597, CVE-2016-5542) *** http://www-01.ibm.com/support/docview.wss?uid=swg21997784 --------------------------------------------- *** IBM Security Bulletin: Fix Available for IBM iNotes Cross-site Scripting Vulnerability (CVE-2016-5883) *** http://www.ibm.com/support/docview.wss?uid=swg21997010 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Cisco Switches and Directors. *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009663 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Campaign, IBM Contact Optimization *** http://www.ibm.com/support/docview.wss?uid=swg21982291 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect multiple N series products *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009687 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 6-02-2017
by Daily end-of-shift report 06 Feb '17

06 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-02-2017 18:00 − Montag 06-02-2017 18:00 Handler: Robert Waldner Co-Handler: n/a *** Vuln: Barracuda NextGen Firewal F-Series Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/96000 *** Vuln: Multiple GStreamer Plug-ins Buffer Overflow and Denial Of Service Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/bid/96001 *** Honeywell SCADA Controllers Exposed Passwords in Clear Text *** --------------------------------------------- A series of remotely exploitable vulnerabilities - including clear text passwords - exist in a set of Honeywell SCADA systems. --------------------------------------------- http://threatpost.com/honeywell-scada-controllers-exposed-passwords-in-clea… *** [remote] - Netwave IP Camera - Password Disclosure *** --------------------------------------------- https://www.exploit-db.com/exploits/41236/?rss *** Security Advisory: Apache vulnerability CVE-2016-8743 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/00/sol00373024.html?… *** Security Advisory: OpenSSL vulnerability CVE-2016-7055 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/43/sol43570545.html?… *** [SANS ISC Diary] Detecting Undisclosed Vulnerabilities with Security Tools & Features *** --------------------------------------------- I published the following diary on isc.sans.org: "Detecting Undisclosed Vulnerabilities with Security Tools & Features". I'm a big fan of OSSEC. This tools is an open source HIDS and log management tool. Although often considered as the "SIEM of the poor", it integrates a lot of interesting features and is fully configurable ... --------------------------------------------- https://blog.rootshell.be/2017/02/04/sans-isc-diary-detecting-undisclosed-v… *** Kodi-Erweiterung machte Anwender zu Botnetz-Zellen *** --------------------------------------------- Anwender des Plug-ins "Exodus" für das Media-Center Kodi wurden zu unfreiwilligen Teilnehmern eines Botnets, das gezielte DDoS-Angriffe fuhr. Deren Ziel: Websites von Konkurrenten. --------------------------------------------- https://heise.de/-3617777 *** NATO presents the Tallinn Manual 2.0 on International Law Applicable to cyberspace *** --------------------------------------------- NATO's Cooperative Cyber Defense Centre of Excellence (CCDCOE) has published "Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations." Its world launch will be in Washington DC, February 8 at The Atlantic Council; followed by Europe at The Hague, February 13; and Tallinn, February 17. --------------------------------------------- http://securityaffairs.co/wordpress/56004/cyber-warfare-2/nato-tallinn-manu… *** Slammer worm slithers back online to attack ancient SQL servers *** --------------------------------------------- If you get taken down by this 13-year-old malware, you probably deserve it One of the worlds most famous net menaces, SQL Slammer, has resumed attacking servers some 13 years after it set records by infecting 75,000 servers in 10 minutes, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/02/05/sql_slammer… *** Microsofts DRM can expose Windows-on-Tor users IP address *** --------------------------------------------- Anonymity-lovers best not watch movies as .WMV files Windows users running the Tor browser can be tricked into uncloaking themselves, with a pretty straightforward trick based on Microsofts DRM system. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2017/02/06/microsoft_d… *** Bugtraq: ZoneMinder - multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/540093 *** Anbieter des WordPress-Plugin BlogVault gehackt *** --------------------------------------------- Hacker haben bei einem Server-Einbruch Daten von BlogVault-Nutzern abgezogen. Anschließend sollen einige Webseiten, die auf das Plugin setzen, mit Malware infiziert worden sein, warnt der Anbieter. --------------------------------------------- https://heise.de/-3618141 *** Lurk: Retracing the Group's Five-Year Campaign *** --------------------------------------------- Fileless infections are exactly what their namesake says: theyre infections that dont involve malicious files being downloaded or written to the system's disk. While fileless infections are not necessarily new or rare, it presents a serious threat to enterprises and end users given its capability to gain privileges and persist in the system of interest to an attacker - all while staying under the radar. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/kF9o3H2gLlM/ *** Überwachungsfirma Cellebrite: Hacker veröffentlicht iPhone-Cracking-Tools *** --------------------------------------------- Wenn Software zum Knacken von Smartphones existiert, dann gelangt diese auch in die Hände Dritter, erklärt der Hacker, der die angeblich von einer Überwachungsfirma stammenden Tools veröffentlicht hat. Ähnlich argumentierte zuletzt auch Apple. --------------------------------------------- https://heise.de/-3618462 *** Hacker hijacks thousands of publicly exposed printers to warn owners *** --------------------------------------------- Following recent research that showed many printer models are vulnerable to attacks, a hacker decided to prove the point and forced thousands of publicly exposed printers to spew out rogue messages. --------------------------------------------- http://www.cio.com/article/3166048/security/hacker-hijacks-thousands-of-pub… *** ENISA: Challenges of security certification in emerging ICT environments *** --------------------------------------------- ENISA issues today its report on the Challenges of security certification in emerging ICT environments. The report is targeted at EU Member States (MS), the Commission, certification bodies and the private sector, and provides a thorough description of the cyber security certification status concerning the most critical equipment in various critical business sectors. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/challenges-of-security-certific… *** Chrome 57 [...] will no longer trust any StartSSL/Wosign issued certificates [...] *** --------------------------------------------- Previous communication from Google (https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html) had read as though it would only be certificates issued since October 21, 2016 wouldnt be trusted. It then went onto say that it may not trust other certificates but didnt really say what that meant. --------------------------------------------- https://forums.whirlpool.net.au/forum-replies.cfm?t=2605051 *** Six Best Practices for Securing a Robust Domain Name System (DNS) Infrastructure *** --------------------------------------------- The Domain Name System (DNS) is an essential component of the Internet, a virtual phone book of names and numbers, but we rarely think about it until something goes wrong. --------------------------------------------- https://insights.sei.cmu.edu/sei_blog/2017/02/six-best-practices-for-securi… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Apache Tomcat affect Power Hardware Management Console (CVE-2016-6816, CVE-2016-6817, and CVE-2016-0762) *** http://www.ibm.com/support/docview.wss?uid=nas8N1021796 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Oracle Outside In Technology (OIT) affect FileNet Content Manager and IBM Content Foundation *** http://www.ibm.com/support/docview.wss?uid=swg21993091 --------------------------------------------- *** IBM Security Bulletin: IBM Sterling Order Management and IBM Sterling Configure Price Quote are vulnerable to cross-site request forgery. *** http://www-01.ibm.com/support/docview.wss?uid=swg21998167 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 3-02-2017
by Daily end-of-shift report 03 Feb '17

03 Feb '17

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-02-2017 18:00 − Freitag 03-02-2017 18:00 Handler: Alexander Riepl Co-Handler: n/a *** How Google fought back against a crippling IoT-powered botnet and won *** --------------------------------------------- Behind the scenes defending KrebsOnSecurity against record-setting DDoS attacks. --------------------------------------------- https://arstechnica.com/security/2017/02/how-google-fought-back-against-a-c… *** Improved scripts in .lnk files now deliver Kovter in addition to Locky *** --------------------------------------------- Cybercriminals are using a combination of improved script and well-maintained download sites in trying to install Locky and Kovter on more computers. A few .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2017/02/02/improved-scripts-in-lnk… *** Underground Scams: Cutting the Head Off a Snake *** --------------------------------------------- Shortly after publishing our post about Terror EK, "King Cobra" (a Twitter account that we mentioned .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Underground-Scams--Cutting-t… *** Cisco - Issue with Clock Signal Component *** --------------------------------------------- One of our readers, Dalibor Cerar, sent us an email about an issue impacting Cisco...at this point. While its a hardware issue, the result if it occurs is a self inflicted Denial of Service. Cisco released a notice on February 2 that some of .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=22033&rss *** G-Suite: Google bringt S/MIME für Enterprise-Gmail *** --------------------------------------------- Google hat ein umfangreiches Update für die Enterprise-Version seiner G-Suite angekündigt: Mit dabei sind verpflichtende Hardwareschlüssel, S/MIME für Gmail und erweiterte Funktionen, um Datenverlust zu verhindern. --------------------------------------------- https://www.golem.de/news/enterprise-die-google-suite-soll-sicherer-werden-… *** Hacker veröffentlichen gestohlene Cellebrite-Software *** --------------------------------------------- Programme, die von den israelischen Sicherheitsexperten von Cellebrite zum Knacken von Smartphones genutzt werden, wurden nun veröffentlicht. --------------------------------------------- https://futurezone.at/digital-life/hacker-veroeffentlichen-gestohlene-celle… *** Rechnung in ZIP-Datei ist Schadsoftware *** --------------------------------------------- In ihrem E-Mailpostfach finden Internet-Nutzer/innen eine Nachricht mit dem Betreff „Rechnung Nr. xxxxx“. Darin heißt es, dass die Empfänger/innen das beigefügte Dokument als .. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/rechnung-in-zip-da… *** The power of sharing: ENISA report on cyber security information sharing in the energy sector *** --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/the-power-of-sharing-enisa-repo… *** Someone Tried to Resurrect 14-Year-Old SQL Slammer Worm *** --------------------------------------------- For a week in November and December 2016, someone tried to resurrect the 14-year-old SQL Slammer worm, .. --------------------------------------------- https://www.bleepingcomputer.com/news/security/someone-tried-to-resurrect-1… *** Patch-Tag für Jenkins *** --------------------------------------------- Aktuelle Versionen beseitigen insgesamt 19 Security-Probleme in Jenkins, von denen eines als schwerwiegend eingestuft ist. --------------------------------------------- https://heise.de/-3617535 *** SQL-Injection-Lücke in McAfee ePolicy Orchestrator *** --------------------------------------------- McAfees Lösung für zentrales Security-Management in Firmen und Konzernen weist selbst ein schwerwiegendes Sicherheitsproblem auf. Ein Hotfix des Herstellers sorgt für Abhilfe. --------------------------------------------- https://heise.de/-3617503 *** Kritische Lücke in Microsoft Windows ermöglicht DoS / Remote Code Execution via SMB - noch keine Updates verfügbar *** --------------------------------------------- Im SMB-Code von Microsoft Windows wurde eine Schwachstelle entdeckt, die im harmlosesten Fall einen Absturz des Betriebsystems zur Folge haben kann, im schlimmsten Fall sogar Remote Code Execution erlaubt. --------------------------------------------- https://cert.at/warnings/all/20170203.html

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily