- Daily - CERT.at

Tageszusammenfassung - Donnerstag 13-10-2016
by Daily end-of-shift report 13 Oct '16

13 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-10-2016 18:00 − Donnerstag 13-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Gefälschte Finanzministerium-Phishingmail im Umlauf *** --------------------------------------------- In E-Mailpostfächern findet sich eine vermeintliche Benachrichtigung des Bundesministerium für Finanzen. In dem Schreiben heißt es, dass das BMF Empfänger/innen die Überzahlung von 716,43 Euro zurückerstatte. Dafür sei es notwendig, dass diese ein "Steuer formular" im Anhang der E-Mail ausfüllen. Es handelt sich um einen Phishingversuch von Kriminellen. --------------------------------------------- https://www.watchlist-internet.at/phishing/gefaelschte-finanzministerium-ph… *** Gratulation an unser milCERT *** --------------------------------------------- Gestern war der monatliche Patchday von Microsoft und mitten in den Bugs, die Remote Code Execution erlauben findet sich auch folgendes: Acknowledgments - 2016 MS16-121 Microsoft Office Memory Corruption Vulnerability CVE-2016-7193 Austrian MilCERT | Wir gratulieren unseren Kollegen aus der Stiftskaserne zu dem Fund und erwarten die Details dazu demnächst über dem einen oder anderen Bier. Autor: Otmar Lendl --------------------------------------------- http://www.cert.at/services/blog/20161012185042-1798.html *** Everyone Loves Selfies, Including Malware! *** --------------------------------------------- I was talking with some of my coworkers the other day about why I wanted to jump to the larger iPhone 7 Plus. For me it came down to the camera. I travel a lot for work and even though photography is something of a hobby of mine, I don't always have my "good camera"... --------------------------------------------- https://blogs.mcafee.com/consumer/everyone-loves-selfies-including-malware/ *** A Look at the BIND Vulnerability: CVE-2016-2776 *** --------------------------------------------- On September 27, the Internet Systems Consortium (ICS) announced the release of patches for a critical vulnerability that would allow attackers to launch denial-of-service (DoS) attacks using the Berkeley Internet Name Domain (BIND) exploits. The critical error was discovered during internal testing by the ISC. BIND is a very popular open-source software component that implements DNS protocols. It is also known as the de facto standard for Linux and other Unix-based systems, which means a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/78QqkPE96mw/ *** WSF attachments are the latest malware delivery vehicle *** --------------------------------------------- Most users have by now learned not to open executable (.EXE), various MS Office, RTF and PDF files delivered via unsolicited emails, but malware peddlers are always trying out new ways to trick users, email filters and AV software. Number of blocked emails containing malicious WSF attachments by month According to Symantec, Windows Script Files (WSFs) are the latest file types to be exploited to deliver malware via email. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/13/wsf-attachments-malware-delivery/ *** CryPy: ransomware behind Israeli lines *** --------------------------------------------- A Tweet posted recently by AVG researcher, Jakub Kroustek, suggested that a new ransomware, written entirely in Python, had been found in the wild, joining the emerging trend for Pysomwares such as the latest HolyCrypt, Fs0ciety Locker and others. --------------------------------------------- http://securelist.com/blog/research/76318/crypy-ransomware-behind-israeli-l… *** IoT Devices as Proxies for Cybercrime *** --------------------------------------------- Multiple stories published here over the past few weeks have examined the disruptive power of hacked "Internet of Things" (IoT) devices such as routers, IP cameras and digital video recorders. This post looks at how crooks are using hacked IoT devices as proxies to hide their true location online as they engage in a variety of other types of cybercriminal activity -- from frequenting underground forums to credit card and tax refund fraud. --------------------------------------------- https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/ *** 6000 Online-Shops angeblich mit Kreditkarten-Skimmern verseucht - Tendenz steigend *** --------------------------------------------- Online-Kriminelle greifen derzeit vermehrt Kreditkarten-Daten auf Webseiten von Online-Shops ab, berichtet ein Sicherheitsforscher. --------------------------------------------- https://heise.de/-3349185 *** What is MANRS and does your network have it? *** --------------------------------------------- While the internet itself was first envisioned as a way of enabling robust, fault-tolerant communication, the global routing infrastructure that underlies it is relatively fragile. A simple error like the misconfiguration of routing information in one of the 7,000 to 10,000 networks central to global routing can lead to a widespread outage, and deliberate actions, like preventing traffic with spoofed source IP addresses, can lead to distributed denial of service (DDoS) attacks. --------------------------------------------- http://www.cio.com/article/3130707/internet/what-is-manrs-and-does-your-net… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco cBR-8 Converged Broadband Router vty Integrity Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Wide Area Application Services Central Manager Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Communications Manager iFrame Data Clickjacking Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Prime Infrastructure and Evolved Programmable Network Manager Database Interface SQL Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Meeting Server Client Authentication Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Finesse Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Juniper Security Bulletins *** --------------------------------------------- *** JSA10763 - 2016-10 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2016-4922) *** http://kb.juniper.net/index?page=content&id=JSA10763&actp=RSS --------------------------------------------- *** JSA10766 - 2016-10 Security Bulletin: vMX: Information leak vulnerability (CVE-2016-4924) *** http://kb.juniper.net/index?page=content&id=JSA10766&actp=RSS --------------------------------------------- *** JSA10767 - 2016-10 Security Bulletin: JUNOSe: Line Card Reset: processor exception 0x68616c74 (halt) task: scheduler, upon receipt of crafted IPv6 packet (CVE-2016-4925) *** http://kb.juniper.net/index?page=content&id=JSA10767&actp=RSS --------------------------------------------- *** JSA10764 - 2016-10 Security Bulletin: Junos J-Web: Cross Site Scripting Vulnerability (CVE-2016-4923) *** http://kb.juniper.net/index?page=content&id=JSA10764&actp=RSS --------------------------------------------- *** JSA10762 - 2016-10 Security Bulletin: Junos: IPv6 denial of service vulnerability due to resource exhaustion (CVE-2016-4921) *** http://kb.juniper.net/index?page=content&id=JSA10762&actp=RSS --------------------------------------------- *** JSA10761 - 2016-10 Security Bulletin: CTPView: Multiple vulnerabilities in CTPView *** http://kb.juniper.net/index?page=content&id=JSA10761&actp=RSS --------------------------------------------- *** JSA10760 - 2016-10 Security Bulletin: Junos Space: Multiple vulnerabilities *** http://kb.juniper.net/index?page=content&id=JSA10760&actp=RSS --------------------------------------------- *** JSA10759 - 2016-10 Security Bulletin: OpenSSL security updates *** http://kb.juniper.net/index?page=content&id=JSA10759&actp=RSS --------------------------------------------- *** Security Advisory: PCRE vulnerability CVE-2016-3191 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/51/sol51440224.html?… *** Brocade NetIron MLX Line Card IPSec Processing Bug Lets Remote Users Cause the Target Line Card to Reset *** --------------------------------------------- http://www.securitytracker.com/id/1037010 *** Fortinet FortiManager Input Validation Flaw in Advanced Settings Page Lets Remote Authenticated Administrative Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036982 *** Fortinet FortiAnalyzer Input Validation Flaw in Advanced Settings Page Lets Remote Authenticated Administrative Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036981 *** Palo Alto PAN-OS Range Header Null Pointer Dereference Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- http://www.securitytracker.com/id/1037007 *** DFN-CERT-2016-1689: Ghostscript: Mehrere Schwachstellen ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1689/ *** Vuln: SAP NetWeaver ABAP ST-PI Component SQL Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93506 *** Vuln: SAP BusinessObjects Unspecified Cross Site Request Forgery Vulnerability *** -------------------------------------------- http://www.securityfocus.com/bid/93508 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM BigFix Remote Control (CVE-2016-2183, CVE-2016-6304, CVE-2016-2177, CVE-2016-2178, CVE-2016-6306) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991896 --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Information Server is vulnerable to information disclosure (CVE-2016-5994) *** http://www-01.ibm.com/support/docview.wss?uid=swg21992171 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM BigFix Remote Control (CVE-2016-2183) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991894 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects IBM Websphere that is used by IBM BigFix Remote Control. (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991866 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Websphere Application Server affects IBM BigFix Remote Control (CVE-2016-5983) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991902 --------------------------------------------- *** IBM Security Bulletin: IBM Kenexa LCMS Premier on Cloud has addressed (CVE-2016-5949) *** http://www.ibm.com/support/docview.wss?uid=swg21992276 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Campaign, IBM Interact, IBM Distributed Marketing, IBM Marketing Operations (CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg21991786 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat , Commons FileUpload Vulnerabilities IBM Algorithmics Algo Risk Application *** http://www.ibm.com/support/docview.wss?uid=swg21990262 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integrated Management Module (IMM) for System x & BladeCenter (CVE-2016-2177, CVE-2016-2178) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099492 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Struts affect IBM BigFix Remote Control (CVE-2016-1181, CVE-2016-1182) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991903 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 12-10-2016
by Daily end-of-shift report 12 Oct '16

12 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-10-2016 18:00 − Mittwoch 12-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** VU#396440: MatrixSSL contains multiple vulnerabilities *** --------------------------------------------- Heap-based Buffer Overflow - CVE-2016-6890The Subject Alt Name field of X.509 certificates is not properly parsed. A specially crafted certificate may result in a heap-based buffer overflow .. --------------------------------------------- http://www.kb.cert.org/vuls/id/396440 *** October 2016 security update release *** --------------------------------------------- Today we released security updates to provide additional protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are released. More information about this month’s security .. --------------------------------------------- https://blogs.technet.microsoft.com/msrc/2016/10/11/october-2016-security-u… *** Security Advisory: Expat XML library vulnerability CVE-2015-1283 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/15/sol15104541.html *** Top of the Junk Pile (Shady TLD research part 16) *** --------------------------------------------- [Sorry about neglecting the external blog during all of the Symantec excitement this summer, but we had a lot going on... This post is from our internal blog, back in July (7/08/2016), and we wanted to get it out on the site when we resumed blogging, since a lot of people have been .. --------------------------------------------- https://www.bluecoat.com/2016-10-04/top-junk-pile-shady-tld-research-part-16 *** MSRT October 2016 release: Adding more unwanted software detections *** --------------------------------------------- Unwanted software often piggy-backs on program downloads, delivered by software bundlers. These bundles, which you might have downloaded, can include software .. --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/10/11/msrt-october-2016-relea… *** Four vulnerabilities found in Dell SonicWALL Email Security virtual appliance application *** --------------------------------------------- Digital Defense (DDI) disclosed the discovery of four security vulnerabilities found in the Dell SonicWALL Email Security virtual appliance application. The appliance is frequently deployed as a perimeter device. Further, .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/12/sonicwall-email-security-vulnera… *** Scan Ruby-based apps for security issues with Dawnscanner *** --------------------------------------------- Dawnscanner is an open source static analysis scanner designed to review the security of web applications written in Ruby. Dawnscanner’s genesis Its developer, Paolo Perego, says that he was motivated to create it back in spring .. --------------------------------------------- https://www.helpnetsecurity.com/2016/10/12/scan-ruby-based-apps-dawnscanner/ *** WiFi Still Remains a Good Attack Vector *** --------------------------------------------- WiFi networks areeverywhere! When we plan to visit a place or reserve ahotel for our holidays, we always check first if free WiFi is available (be honest, you do!). Oncewe connected our beloved devices to an external wireless .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21583 *** Security Advisory - Multiple Security Vulnerabilities in Driver of Huawei Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20161012-… *** List of 2016 OWASP London Talks & Videos *** --------------------------------------------- https://www.youtube.com/owasplondon *** VMware vRealize Operations Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1036999 *** Several Exploit Kits Now Deliver Cerber 4.0 *** --------------------------------------------- We have tracked three malvertising campaigns and one compromised site campaign using Cerber ransomware after version 4.0 (detected as as Ransom_CERBER.DLGE) was .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/several-exploit-…

1 0

Tageszusammenfassung - Dienstag 11-10-2016
by Daily end-of-shift report 11 Oct '16

11 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-10-2016 18:00 − Dienstag 11-10-2016 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Denial of Service Vulnerability in Citrix License Server *** --------------------------------------------- A vulnerability has been identified in the Citrix License Server for Windows and Citrix License Server VPX that could allow a remote ... --------------------------------------------- http://support.citrix.com/article/CTX217430 *** [2016-10-11] XXE vulnerability in RSA ECAT Client *** --------------------------------------------- By exploiting the XXE vulnerability, an attacker can get read access to the filesystem of the users system using RSA ECAT client and thus obtain sensitive information from the system. It is also possible to scan ports of the internal hosts and cause DoS on the affected host. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** Erpressungs-Trojaner DXXD nimmt Windows-Server ins Visier *** --------------------------------------------- Die Hintermänner der Ransomware haben ihren Schädling optimiert und das kostenlose Entschlüsselungs-Tool unbrauchbar gemacht. Zudem verspotten Sie Sicherheitsforscher öffentlich. --------------------------------------------- https://heise.de/-3344979 *** Bugtraq: [SEARCH-LAB advisory] AVTECH IP Camera, NVR, DVR multiple vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539567 *** Nymaim: Deep Technical Dive - Adventures in Evasive Malware *** --------------------------------------------- Nymaim is mostly known worldwide as a downloader, although it seems they evolved from former versions, now having new functionalities to obtain data on the machine with no need to download a new payload. Some of the exported .. --------------------------------------------- http://www.seculert.com/blogs/nymaim-deep-technical-dive-adventures-in-evas… *** Zertifizierungsstellen: Bei WoSign und StartCom rollen Köpfe *** --------------------------------------------- Die beiden Kostenlos-CAs bekommen jeweils eine neue Firmenspitze und sollen komplett voneinander getrennt werden. Damit soll das verlorene Vertrauen zurückgewonnen werden. --------------------------------------------- https://heise.de/-3344229 *** APT 28: Wie ein französischer Fernsehsender gehackt wurde *** --------------------------------------------- Im Jahr 2015 ist der französische Fernsehsender TV5 nach einem Angriff auf die IT-Infrastruktur für Stunden lahmgelegt worden. Eine Untersuchung der französischen Polizei zeigt nun, wie planvoll die Angreifer vorgegangen sind. --------------------------------------------- http://www.golem.de/news/apt-28-wie-ein-franzoesischer-fernsehsender-gehack… *** Security Bulletins Posted *** --------------------------------------------- Adobe has published security bulletins for Adobe Flash Player (APSB16-32), Adobe Acrobat and Reader (APSB16-33), and Adobe Creative Cloud Desktop Application (APSB16-34). Adobe recommends users update their product installations .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1409 *** DDOS: Was Cloudflare vom Mirai-Botnetz sieht *** --------------------------------------------- Cloudflare hat sich die aktuellen DDoS-Angriffe genauer angeschaut - und berichtet, dass einige Angriffe 1,75 Millionen HTTP-Anfragen pro Sekunde erzeugen. --------------------------------------------- http://www.golem.de/news/ddos-was-cloudflare-vom-mirai-botnetz-sieht-1610-1…

1 0

Tageszusammenfassung - Montag 10-10-2016
by Daily end-of-shift report 10 Oct '16

10 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-10-2016 18:00 − Montag 10-10-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Europe to Push New Security Rules Amid IoT Mess *** --------------------------------------------- The European Commission is drafting new cybersecurity requirements to beef up security around so-called Internet of Things (IoT) devices such as Web-connected security cameras, routers and digital video recorders (DVRs). News of the expected proposal comes as security firms are warning that a great many IoT devices are equipped with little or no security protections. --------------------------------------------- https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-… *** Mehr Sicherheit für das Internet der Dinge *** --------------------------------------------- Die vernetzten Geräte des Internet of Things (IoT) sammeln und verarbeiten immer mehr Daten, versagen jedoch häufig beim Schutz dieser Daten. Ein ausführlicher Leitfaden will bei der Entwicklung sicherer Geräte helfen. --------------------------------------------- https://heise.de/-3343482 *** Security Economics of the Internet of Things *** --------------------------------------------- Brian Krebs is a popular reporter on the cybersecurity beat. He regularly exposes cybercriminals and their tactics, and consequently is regularly a target of their ire. Last month, he wrote about an online attack-for-hire service that resulted in the arrest of the two proprietors. In the aftermath, his site was taken down by a massive DDoS attack.In many ways, this is nothing new. Distributed denial-of-service attacks are a family of attacks that cause websites and other Internet-connected... --------------------------------------------- https://www.schneier.com/blog/archives/2016/10/security_econom_1.html *** Mirai: DDoS per IoT *** --------------------------------------------- In den letzten Wochen wurde mal wieder ein neuer Rekord für den bisher stärksten gemessenen Distributed Denial of Service (DDoS) Angriff aufgestellt. Das ist soweit nicht überraschend, die verfügbare Bandbreite im Internet wächst immer noch stark, da ist klar, dass damit auch die Angriffsstärke zunehmen kann. Überraschend war aber, dass der Rekord nicht über einen "reflected DDoS" erreicht wurde. Diese Methode... --------------------------------------------- http://www.cert.at/services/blog/20161010095630-1789.html *** Strange Loop - IP Spoofing *** --------------------------------------------- I recently gave a talk at the Strange Loop conference in St Louis. The recording and slides are available, but for easier consumption heres a transcript. --------------------------------------------- https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ *** VMware stopft Informationsleck in Horizon View *** --------------------------------------------- Wichtige Sicherheits-Updates sollen VMware Horizon View unter Windows sicherer machen. --------------------------------------------- https://heise.de/-3343678 *** Radare2: rahash2, (Mon, Oct 10th) *** --------------------------------------------- Radare2 is an open-source reverse-engineering framework. Some time ago I wrote about recovering ransomed pictures. By calculating the entropy of the ransomed files with my byte-stats tool, I could see that the file was not completely encrypted. rahash2 is one of the tools in the Radare2 framework. As it names implies, it calculates (cryptographic) hashes, but it is quite versatile. For example, it will also calculate entropy: And like my byte-stats.py tool, it can also split the file in blocks... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21577&rss *** Remove ransomware infections from your PC using these free tools *** --------------------------------------------- A how-to on finding out what ransomware is squatting in your PC -- and how to get rid of it. --------------------------------------------- http://www.zdnet.com/article/remove-ransomware-infections-from-your-pc-usin… *** Open-Source-Router: 1000 Turris Omnia ausgeliefert *** --------------------------------------------- Nachdem es ursprünglich im Sommer losgehen sollte, lieferte der Hersteller cz.nic doch erst Ende September die ersten Turris-Omnia-Router aus. Vor ein paar Tagen wurde bereits das tausendste Exemplar verschickt. --------------------------------------------- https://heise.de/-3344417 *** VU#338624: U by BB and T iOS banking application fails to properly validate SSL certificates *** --------------------------------------------- Vulnerability Note VU#338624 U by BB&T iOS banking application fails to properly validate SSL certificates Original Release date: 30 Sep 2016 | Last revised: 06 Oct 2016 Overview U by BB&T for iOS, version 1.5.4 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks. Description CWE-295: Improper Certificate Validation - CVE-2016-6550U by BB&T is a banking application. On iOS... --------------------------------------------- http://www.kb.cert.org/vuls/id/338624 *** Vuln: GraphicsMagick CVE-2016-7997 NULL Pointer Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93467 *** DSA-3689 php5 - security update *** --------------------------------------------- Several vulnerabilities were found in PHP, a general-purpose scriptinglanguage commonly used for web application development. --------------------------------------------- https://www.debian.org/security/2016/dsa-3689 *** Toshiba FlashAir does not require authentication in "Internet pass-thru Mode" *** --------------------------------------------- FlashAir provided by Toshiba Corporation does not require authentication on accepting a connection from STA side LAN when "Internet pass-thru Mode" is enabled. --------------------------------------------- http://jvn.jp/en/jp/JVN39619137/ *** IBM Security Bulletin: Financial Transaction Manager for Corporate Payment Services: Clickjacking (CVE-2016-3060) *** --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21992051 *** IBM Security Bulletin: HTTP Response Splitting in Liberty affects IBM MessageSight (CVE-2016-0359) *** --------------------------------------------- http://www-01.ibm.com/support/docview.wss?uid=swg21991096 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1024350 *** IBM Security Bulletin: A security vulnerability in IBM Java Runtime affects IBM Systems Director Storage Control ( CVE-2015-4872) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1024349

1 0

Tageszusammenfassung - Freitag 7-10-2016
by Daily end-of-shift report 07 Oct '16

07 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-10-2016 18:00 − Freitag 07-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Gefälschtes Bank Austria-Sicherheitszertifikat ist Schadsoftware *** --------------------------------------------- In einer gefälschten Bank Austria-Nachricht mit dem Betreff "Sicherheitszertifikat" behaupten Kriminelle, dass Empfänger/innen ein Programm für ihr Smartphone installieren müssen. Das ist angeblich notwendig, damit sie ihr OnlineBanking-Konto nützen können. In Wahrheit handelt es sich bei dem Programm um Schadsoftware. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/gefaelschtes-bank-austria-s… *** Upcoming Security Updates for Adobe Acrobat and Reader (APSB16-33) *** --------------------------------------------- A prenotification Security Advisory (APSB16-33) has been posted regarding upcoming releases for Adobe Acrobat and Reader scheduled for Tuesday, October 11, 2016. We will continue to provide updates on the upcoming releases via the Security Advisory as well as the Adobe... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1405 *** 100+ online shops compromised with payment data-stealing code *** --------------------------------------------- Since March 2016 (and possibly even earlier), someone has been compromising a variety of online shops and injecting them with malicious JavaScript code that exfiltrates payment card and other kinds of information users entered to pay for their shopping. According to RiskIQ and ClearSky researchers, the campaign - which they dubbed Magecart - is still ongoing, albeit at a reduced scope and pace. Since March, the threat actor behind it has compromised more than 100... --------------------------------------------- https://www.helpnetsecurity.com/2016/10/07/payment-data-stealing-code/ *** Hintergrund: Analysiert: Werbekeule statt Glitzersteine - Android-Malware CallJam seziert *** --------------------------------------------- Trotz verschiedener Sicherheits-Checks schleicht sich immer wieder Malware in Googles App Store. Eine davon gibt sich als vermeintliches Helferlein für das unfassbar erfolgreiche Spiel "Clash Royale" aus. --------------------------------------------- https://heise.de/-3340267 *** Lovoo: Sicherheitslücke ermüglicht Erstellung von Bewegungsprofilen *** --------------------------------------------- Über die Web-API des Dating-Dienstes ließen sich bis vor kurzem Informationen über Nutzer abrufen - auch ohne Login. Per Skript-Automatisierung können damit Bewegungsprofile erstellt werden. --------------------------------------------- http://www.golem.de/news/lovoo-sicherheitsluecke-ermoeglicht-erstellung-von… *** Positive Technologies: Security Trends & Vulnerabilities Review Industrial Control Systems (PDF) *** --------------------------------------------- This study examines components of ICS from different vendors. In the period from 2012 to 2015, a total of 743 vulnerabilities were discovered in ICS components; most of them were detected in products from well-known companies: Siemens, Schneider Electric, and Advantech. Most vulnerabilities are of either high or medium risk (47% high, 47% medium). ... Summary: The study shows that the number of vulnerable ICS components is not reducing from year to year. Nearly half of identified... --------------------------------------------- https://www.ptsecurity.com/upload/iblock/6bd/ics_vulnerability_2016_eng.pdf *** An attachment that wasn't there *** --------------------------------------------- By Slavo Greminger and Oli Schacher | On a daily basis we collect tons of Spam emails, which we analyze for malicious content. Of course, this is not done manually by our thousands of minions, but automated using some Python-fu. Python... --------------------------------------------- https://securityblog.switch.ch/2016/10/07/an-attachment-that-wasnt-there/ *** Sicherheits-Updates: Angreifer können Cisco-Switches kapern *** --------------------------------------------- Der Netzwerkausrüster kümmert sich um zwei als kritisch eingestufte Sicherheitslücken in Switches der Nexus-Serie und verteilt Sicherheits-Patches für 15 weitere Schwachstellen in verschiedenen Produkten. --------------------------------------------- https://heise.de/-3342846 *** OS X El Capitan: Warten auf das große Sicherheitsupdate *** --------------------------------------------- Mit Apples neuem Betriebssystem macOS Sierra werden zahlreiche Lücken gestopft, die in der Vorversion stecken. Doch ein eigenes Update für OS X El Capitan hat der Hersteller noch nicht publiziert. --------------------------------------------- https://heise.de/-3342343 *** Malware könnte Video und Audio vom Mac aufzeichnen *** --------------------------------------------- Der Sicherheitsforscher Patrick Wardle hat einen Demo-Exploit entwickelt, der Kamera- und Mikrofondaten mitschneiden kann, während Chats laufen. --------------------------------------------- https://heise.de/-3342336 *** VMSA-2016-0015 VMware Horizon View updates address directory traversal vulnerability (CVE-2016-7087) *** --------------------------------------------- Severity: Important VMware Horizon View contains a vulnerability that may allow for a directory traversal on the Horizon View Connection Server. Exploitation of this issue may lead to a partial information disclosure. --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0015.html *** IDM 4.5 One SSO Provider (OSP) 6.0.0.5 *** --------------------------------------------- Abstract: This hotfix provides enhancements and software fixes for the One SSO Provider for Identity Manager. For more information about these updates, see the hotfix details.Document ID: 5256490Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:IDM45-OSP60-HF-5.zip (23.28 MB)Products:Identity Manager 4.5Access Review 1.1Access Review 1.5Superceded Patches:IDM 4.5 One SSO Provider (OSP) --------------------------------------------- https://download.novell.com/Download?buildid=Z0jKqCEDM7k~ *** Atlassian HipChat Secret Key Disclosure *** --------------------------------------------- Topic: Atlassian HipChat Secret Key Disclosure Risk: Medium Text:This email refers to the following advisory pages: * Bitbucket Server - https://confluence.atlassian.com/x/0QkcMg * Conflue... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100066 *** DFN-CERT-2016-1653: KDE: Mehrere Schwachstellen in KMail ermöglichen u.a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1653/ *** GE Bently Nevada 3500/22M Improper Authorization Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on September 8, 2016, and is being released to the NCCIC/ICS-CERT web site. This advisory contains mitigation details for an improper authorization vulnerability in the GE Bently Nevada 3500/22M monitoring system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-252-01 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Dashboard Framework is affected by a security vulnerability in Apache POI (CVE-2016-5000) *** http://www.ibm.com/support/docview.wss?uid=swg21991850 --------------------------------------------- *** IBM Security Bulletin: IBM Web Experience Factory is affected by a security vulnerability in Apache POI (CVE-2016-5000) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991851 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Dashboard Framework is affected by multiple security vulnerabilities in Apache POI *** http://www-01.ibm.com/support/docview.wss?uid=swg21991839 --------------------------------------------- *** IBM Security Bulletin: IBM Web Experience Factory is affected by multiple security vulnerabilities in Apache POI *** http://www-01.ibm.com/support/docview.wss?uid=swg21991845------------------… --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991877 --------------------------------------------- *** IBM Security Bulletin: : Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991879 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-4463) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991111 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Libxml2 vulnerabilities (CVE-2016-4447, CVE-2016-4448, CVE-2016-4449) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991061 --------------------------------------------- *** IBM Security Bulletin: IBM Streams may be impacted by a vulnerability in WebSphere Liberty (CVE-2016-2923) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991058 --------------------------------------------- *** IBM Security Bulletin: IBM Streams is affected by Open Source Apache Xerces-C XML parser Vulnerabilities (CVE-2016-0729) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991112 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 6-10-2016
by Daily end-of-shift report 06 Oct '16

06 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-10-2016 18:00 − Donnerstag 06-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Symantec Web Gateway Management Console Interface Command Injection *** --------------------------------------------- Symantec has released an update to address a Symantec Web Gateway (SWG) Management Console Interface command injection issue bypassing validation restrictions to add an unauthorized whitelist entry. Highest severity issue: Medium --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** NIST: People have given up on cybersecurity - its too much hassle *** --------------------------------------------- To help change peoples mental models so that they will participate in cybersecurity, Theofanos said technology professionals have to do more work for the people using their products, so that people dont need to make too many decisions. "We need to make it easy for them to do the right thing," she said. "We need to make these things habits, so they dont really have to think about it." --------------------------------------------- http://www.theregister.co.uk/2016/10/06/go_ahead_steal_my_muffin_recipe/ *** Spotify: Gratis-Version lieferte Schadsoftware für Windows und Mac aus *** --------------------------------------------- Offensichtlich über Werbung von Dritten eingeschleust - Spotify bestätigt und entschuldigt sich bei Nutzern --------------------------------------------- http://derstandard.at/2000045458665 *** Malicious actions not necessarily focused on causing disruptions in TELECOM, but system failures still are *** --------------------------------------------- ENISA publishes its Annual Incidents report which gives the aggregated analysis of the security incidents causing severe outages in 2015. --------------------------------------------- https://www.enisa.europa.eu/news/malicious-actions-not-necessarily-focused-… *** Vorsicht vor Verteilung von Malware via Steam-Chat *** --------------------------------------------- Aktuell häufen sich Hinweise, dass Kriminelle verstärkt über gekaperte Steam-Accounts Links zu Webseiten mit Trojanern verschicken. --------------------------------------------- https://heise.de/-3342136 *** Denial of Service Vulnerability in Citrix License Server *** --------------------------------------------- A vulnerability has been identified in the Citrix License Server for Windows and Citrix License Server VPX that could allow a remote, unauthenticated attacker to crash the License Server. This vulnerability affects all versions of Citrix License Server for Windows and Citrix License Server VPX earlier than version 11.14.0.1. This vulnerability has been assigned the following CVE number: CVE-2016-6273 --------------------------------------------- http://support.citrix.com/article/CTX217430 *** Vulnerability in Citrix Linux VDA (formerly known as Linux Virtual Desktop) Could Result in Privilege Escalation *** --------------------------------------------- A vulnerability has been identified in the Linux Virtual Delivery Agent (VDA) component of Citrix XenDesktop that could allow a local user to execute commands as root on the Linux VDA. The vulnerability affects all versions of the Citrix Linux VDA earlier than version 1.4.0. This vulnerability has been assigned the following CVE number: CVE-2016-6276 --------------------------------------------- http://support.citrix.com/article/CTX216628 *** Sicherheits-Patches: Foxit beugt Angriffen auf Reader und PhantomPDF vor *** --------------------------------------------- Die Entwickler schließen mehrere kritische Lücken in den Linux-, OS-X- und Windows-Versionen. --------------------------------------------- https://heise.de/-3341878 *** Wave your false flags! *** --------------------------------------------- Targeted attackers are using an increasingly wide range of deception techniques to muddy the waters of attribution, planting "False Flag" timestamps, language strings, malware, among other things, and operating under the cover of non-existent groups. --------------------------------------------- http://securelist.com/analysis/publications/76273/wave-your-false-flags/ *** Announcing CERT Basic Fuzzing Framework Version 2.8 *** --------------------------------------------- Today we are announcing the release of the CERT Basic Fuzzing Framework Version 2.8 (BFF 2.8). Its been about three years since we released BFF 2.7. In this post, I highlight some of the changes weve made. --------------------------------------------- https://insights.sei.cmu.edu/cert/2016/10/announcing-cert-basic-fuzzing-fra… *** Palo Alto PAN-OS GlobalProtect Portal Web Interface Lets Remote Users Obtain Potentially Sensitive Information on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036968 *** Erpressungs-Trojaner Cerber lernt dazu und verschlüsselt noch mehr *** --------------------------------------------- Sicherheitsforscher warnen vor einer neuen Version der Ransomware, die nun unter anderem auch bestimmte laufende Prozesse beenden kann, um so Datenbanken in ihre Fänge zu bekommen. --------------------------------------------- https://heise.de/-3341992 *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASA Software DHCP Relay Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Unauthenticated User Account Creation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Unified Intelligence Center (CUIC) Software Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Nexus 7000 and 7700 Series Switches Overlay Transport Virtualization Buffer Overflow Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software-Based Products Authentication, Authorization, and Accounting Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Nexus 9000 Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS XR Software Command-Line Interface Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE IKEv2 Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Management Center Console Local File Inclusion Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Management Center Console Authentication Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Threat Management Console Remote Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Software Crafted DHCPv4 Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Host Scan Package Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS Software for Cisco Catalyst 6500 Series Switches and 7600 Series Routers ACL Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco NX-OS Border Gateway Protocol Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A vulnerability in crypto++ affects PowerKVM (CVE-2016-3995) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024263 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Python affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024236 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in PHP affects PowerKVM (CVE-2016-5385) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024261 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in the Linux kernel affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024270 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects WebSphere Application Server July 2016 CPU (CVE-2016-3485) that is bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud. *** http://www-01.ibm.com/support/docview.wss?uid=swg21991149 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects SAN Volume Controller and Storwize Family (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009284 --------------------------------------------- *** IBM Security Bulletin: Vulnerability affects multiple IBM Rational products based on IBM Jazz technology (CVE-2016-2947) *** http://www.ibm.com/support/docview.wss?uid=swg21991477 --------------------------------------------- *** IBM Security Bulletin: XStream XML information discloure vulnerability affects IBM Rational Quality Manager (CVE-2016-3674) *** http://www.ibm.com/support/docview.wss?uid=swg21991406 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2016-0359, CVE-2016-3092, CVE-2016-3485) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990062 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in Open Source BeanShell has been addressed by IBM Kenexa LMS (CVE-2016-2510) *** http://www-01.ibm.com/support/docview.wss?uid=swg21987703 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in qemu affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024322 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in nagios affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024264 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in nginx affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024237 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in NRPE affects PowerKVM (CVE-2014-2913) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024235 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in lighttpd affects PowerKVM (CVE-2016-1000212) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024260 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in pigz affects PowerKVM (CVE-2015-1191) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024213 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in ganglia affects PowerKVM (CVE-2015-6816) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024262 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 5-10-2016
by Daily end-of-shift report 05 Oct '16

05 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-10-2016 18:00 − Mittwoch 05-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security Advisory: XSS vulnerability in the BIG-IP and Enterprise Manager Configuration utilities CVE-2015-1470 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16838.htm… *** Android Security Bulletin October 2016 *** --------------------------------------------- The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. --------------------------------------------- https://source.android.com/security/bulletin/2016-10-01.html *** Security Advisory: OpenSSL vulnerability CVE-2016-2183 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/13/sol13167034.html?… *** WordPress Hack Modifies Core Files to Share Spam *** --------------------------------------------- One of the worst feelings a website owner can experience is discovering that your site has been hacked. Without proper security measures in place, even website owners with the best intentions can lose control of their website. When hackers gain access to your site, they can use it to host phishing content, distribute malware, steal sensitive information and more. In this analysis, we look at a website that was unintentionally sharing spam content in the form of Windows keys. --------------------------------------------- https://blog.sucuri.net/2016/10/wordpress-hack-shares-spam-when-core-modifi… *** Researchers spot remote code execution flaw in FreeImage *** --------------------------------------------- Cisco Talos researchers spotted a remote code execution vulnerability in the FreeImage Library XMP Image Handling affecting version 3.17.0. --------------------------------------------- http://www.scmagazine.com/remote-code-execution-flaw-spotted-in-freeimage-l… *** Security Advisory: OpenSSL vulnerability CVE-2016-6303 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/35/sol35543324.html?… *** INDAS Web SCADA Path Traversal Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a path traversal vulnerability in the INDAS Web SCADA application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-278-01 *** Beckhoff Embedded PC Images and TwinCAT Components Vulnerabilities *** --------------------------------------------- This advisory contains mitigation details for vulnerabilities in Beckhoff's Embedded PC Images and TwinCAT Components. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-278-02 *** Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities (Update B) *** --------------------------------------------- This updated advisory is a follow-up to the advisory update titled ICSA-16-208-01A Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities that was published August 16, 2016, on the NCCIC/ICS-CERT web site. This advisory contains mitigation details for two vulnerabilities in the Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-208-01 *** Lets not meet up with JPEG 2000 - researchers find security hole in image codec *** --------------------------------------------- Wont it be strange when were all fully pwned? Researchers are warning about a newly discovered security vulnerability in a popular open-source JPEG 2000 parser that could let corrupted image files trigger remote code execution. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/jpeg_2000_s… *** DressCode-Malware: 400 Trojaner-Apps infiltrieren Google Play *** --------------------------------------------- Sicherheitsforscher warnen vor getarnten Android-Spionage-Apps, die aus Firmen-Netzwerken Informationen absaugen sollen. --------------------------------------------- https://heise.de/-3340921 *** Xen Security Advisory CVE-2016-7777 / XSA-190 version 5: CR0.TS and CR0.EM not always honored for x86 HVM guests *** --------------------------------------------- A malicious unprivileged guest user may be able to obtain or corrupt sensitive information (including cryptographic material) in other programs in the same guest. --------------------------------------------- http://xenbits.xen.org/xsa/advisory-190.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Financial Transaction Manager for Corporate Payment Services (CVE-2016-5920) *** http://www.ibm.com/support/docview.wss?uid=swg21989062 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Directory Server (Tivoli) and Rational Directory Administrator *** http://www.ibm.com/support/docview.wss?uid=swg21989495 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3705) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990231 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-3627) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991063 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Open Source GNU glibc affect IBM Workload Deployer (CVE-2014-9761, CVE-2015-8778, CVE-2015-8779) *** http://www.ibm.com/support/docview.wss?uid=swg21991777 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Open Source GNU glibc affects IBM Workload Deployer. (CVE-2015-8776) *** http://www.ibm.com/support/docview.wss?uid=swg21991465 --------------------------------------------- *** IBM Security Bulletin: Cross-Site Scripting Vulnerability (CVE-2016-0243) Affects IBM Connections Mail *** http://www.ibm.com/support/docview.wss?uid=swg21991265 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Cross-Site Scripting vulnerability (CVE-2016-0246) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990377 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 4-10-2016
by Daily end-of-shift report 04 Oct '16

04 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-10-2016 18:00 − Dienstag 04-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cisco IOS and Cisco IOS XE Software TCP Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the handling of remote TCP connections in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition due to low memory.The vulnerability is due to the handling of out-of-order, or otherwise invalid, TCP packets on a remote connection to an affected device. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vuln: SAP Security Audit Log CVE-2016-4551 Security Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93288 *** Security Advisory: Nginx vulnerability CVE-2016-4450 *** --------------------------------------------- os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file. (CVE-2016-4450) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/08/sol08250500.html?… *** Researchers gut EMCs VMAX, vApp with five god mode hack holes *** --------------------------------------------- Complete compromise: DIY admin, or DoS your victim Researchers with Digital Defence have reported six dangerous vulnerabilities in EMCs VMAX product line that can grant remote attackers arbitrary command execution with root privileges. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/researchers… *** SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_REFRESH_EXPORT_TAB_COMP Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-041: SAP OS Command Injection in SCTC_REFRESH_EXPORT_TAB_COMP 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100025 *** SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_REFRESH_CHECK_ENV Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-042: SAP OS Command Injection in SCTC_REFRESH_CHECK_ENV 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100024 *** SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection *** --------------------------------------------- Topic: SAP Netweaver 7.40 SP 12 SCTC_TMS_MAINTAIN_ALOG Command Injection Risk: High Text:Onapsis Security Advisory ONAPSIS-2016-043: SAP OS Command Injection in SCTC_TMS_MAINTAIN_ALOG 1. Impact on Business ... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100023 *** NCCIC/ICS-CERT 2015 Assessment Report [PDF] *** --------------------------------------------- This report provides a year-end summary of the NCCIC/ICS-CERT security assessment activities. --------------------------------------------- https://ics-cert.us-cert.gov/sites/default/files/Annual_Reports/FY2015_Indu… *** Major security flaw in Samsung Knox could give hackers full control of your phone *** --------------------------------------------- Israeli researchers found three vulnerabilities in Samsung Knox - they have since been patched but out-of-date devices may still be at risk --------------------------------------------- http://www.wired.co.uk/article/samsung-knox-security-vulnerabilities *** Industrial control kit hackable, warn researchers *** --------------------------------------------- Plus: Ethernet I/O devices web app fails to sanitise user input Multiple vulnerabilities in MOXA ioLogik controllers placed industrial facilities at risk if they do not apply patches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/10/04/ios_10_flaw/ *** Samsung Knox flaws open unpatched devices to compromise *** --------------------------------------------- Researchers from Viral Security Group have discovered three vulnerabilities in Samsung Knox, a security platform that allows users to maintain separate identities for work and personal use, and is built into some of the company's Android smartphones and tablets. Knox is meant to protect the integrity of the entire device - both hardware and software - but apparently there are ways to bypass some of those protections, specifically those offered by the Real-time Kernel --------------------------------------------- https://www.helpnetsecurity.com/2016/10/04/samsung-knox-flaws/ *** HPE KeyView SDK File Processing Flaw Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- Several vulnerabilities were reported in HPE KeyView SDK. A remote user can cause arbitrary code to be executed on the target system. A remote user can create a specially crafted file that, when processed by the target application using the HPE KeyView SDK, will execute arbitrary code on the target system. The code will run with the privileges of the target application. The specific impact depends on the application using the SDK. --------------------------------------------- http://www.securitytracker.com/id/1036935 *** Sicherheitspatches für VMAX-Storage-Systeme von Dell EMC *** --------------------------------------------- Die Enterprise-Storage-Systeme sind anfällig für Angriffe aus dem eigenen Netzwerk. Angreifer können die Kommunikation des Unisphere-Managers manipulieren und sich so vollen Zugriff zu den Netzwerkspeichern verschaffen. --------------------------------------------- https://heise.de/-3340322 *** Bugtraq: Serimux SSH Console Switch v2.4 - Multiple Cross Site Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539524 *** Bugtraq: ESA-2016-121: EMC Unisphere for VMAX and Solutions Enabler Virtual Appliances Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539526 *** Bugtraq: ESA-2016-063: EMC Replication Manager and Network Module for Microsoft Remote Code Execution Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539525 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM Notes HarfBuzz is vulnerable to a denial of service information disclosure (CVE-2015-8947) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990410 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities affect IBM Sterling Secure Proxy Configuration Manager *** http://www.ibm.com/support/docview.wss?uid=swg21991278 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache POI affect Asset and Service Management *** http://www-01.ibm.com/support/docview.wss?uid=swg21989525 --------------------------------------------- *** IBM Security Bulletin: IBM Tivoli Monitoring (CVE-2016-4472, CVE-2016-0718) *** http://www.ibm.com/support/docview.wss?uid=swg21990634 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java Runtime affects: WebSphere Dashboard Framework (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21990404 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM MQ Light (CVE-2016-3426) *** http://www.ibm.com/support/docview.wss?uid=swg21988437 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-3426) *** http://www.ibm.com/support/docview.wss?uid=swg21990945 --------------------------------------------- *** IBM Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by multiple vulnerabilities. *** http://www-01.ibm.com/support/docview.wss?uid=nas8N1021649 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by SQL Injection vulnerability (CVE-2016-0249) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990363 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Password in Clear Text vulnerability (CVE-2016-0247) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990368 --------------------------------------------- *** IBM Security Bulletin: FileNet Workplace XT and FileNet Workplace (Application Engine), can be affected by Cross Site Scripting vulnerabilities (CVE-2016-5981) *** http://www.ibm.com/support/docview.wss?uid=swg21990899 --------------------------------------------- *** IBM Security Bulletin: Cross Site Scripting vulnerability in IBM Business Process Manager (CVE-2016-5901) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990852 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Connect:Direct Browser User Interface (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991387 --------------------------------------------- *** IBM Security Bulletin: HTML injection vulnerability in Business Space might affect IBM Business Process Manager (CVE-2016-3056) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990850 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2014-9748, CVE-2016-1669) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990841 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities in Apache Struts might affect IBM Business Process Manager and WebSphere Lombardi Edition (CVE-2016-1181, CVE-2016-1182, CVE-2015-0899) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990834 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling Secure Proxy (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991287 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Sterling External Authentication Server (CVE-2016-3426, CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21991289 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Execution with Unnecessary Privileges vulnerability (CVE-2016-0328) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990226 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Application Error vulnerability (CVE-2016-0242) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990229 --------------------------------------------- *** IBM Security Bulletin: IBM Expeditor HarfBuzz is vulnerable to a denial of service information disclosure (CVE-2015-8947) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990412 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 3-10-2016
by Daily end-of-shift report 03 Oct '16

03 Oct '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 30-09-2016 18:00 − Montag 03-10-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Security Advisory: NAT64 vulnerability CVE-2016-5745 *** --------------------------------------------- BIG-IP devices using NAT64 are vulnerable to an unauthenticated remote attack that may allow modification of the BIG-IP system configuration. (CVE-2016-5745) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/64/sol64743453.html?… *** imagemagick mogrify global buffer overflow *** --------------------------------------------- Topic: imagemagick mogrify global buffer overflow Risk: High Text:Hi, imagemagick identify suffers of a global buffer overflow issue, which I reported and has been patched... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100007 *** Ubiquiti UniFi Critical Vulnerability *** --------------------------------------------- Vulnerability Details: You are able to connect to the access points database, because of an broken authentication (OWASP TOP10). So you are able to modify the database and read the data. An possible scenario you'll find in PoC section. Risk: An attacker gets access to the database and for e.g. is able to change the admins password, like you see in PoC below. --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100006 *** Bundeskriminalamt plant Mobilversion des Bundestrojaners *** --------------------------------------------- Das BKA will den Einsatz des Bundestrojaners auf Smartphones und Tablets ausweiten. Das geht aus Haushaltsunterlagen des Bundestages hervor, die Süddeutsche Zeitung, NDR und WDR einsehen konnten. --------------------------------------------- https://heise.de/-3339512 *** Source Code for IoT Botnet 'Mirai' Released *** --------------------------------------------- The source code that powers the "Internet of Things" (IoT) botnet responsible for launching the historically large distributed denial-of-service (DDoS) attack against KrebsOnSecurity last month has been publicly released, virtually guaranteeing that the Internet will soon be flooded with attacks from many new botnets powered by insecure routers, IP cameras, DVRs and other easily hackable IoT devices. --------------------------------------------- https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-releas… *** cJSON buffer out of bound read *** --------------------------------------------- I would like to report a buffer out of bound read problem in cJSON, which is a embeddable JSON parser, used (I imagine) in embedded devices, or even bigger stuff like the ps4... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016100013 *** Default Credentials Considered Harmful *** --------------------------------------------- The use of default credentials by vendors is an outdated, dangerous throwback to 20th century practices that has no business being used in todays world. It is this specific antique practice that is directly responsible for the existence of the record-breaking denial-of-service botnet recently used to censor Brian Krebs and the similar attack on OVH - these botnets only exist because default credentials were implemented on devices, in flagrant violation of best-practices ... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/default-credentials-co… *** The Short Life of a Vulnerable DVR Connected to the Internet, (Sun, Oct 2nd) *** --------------------------------------------- Most devices connected to the Internet these days arent maintained and monitored personal computers. Instead, they are devices who are often not understood as computers but as things, giving rise to the term Internet of Things or IoT. Over two years ago, we reported about how exploited DVRs are used to attack other devices across the internet. Back then, like today, the vulnerability was an open telnet server with a trivial default password. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21543&rss *** Researchers Break MarsJoke Ransomware Encryption *** --------------------------------------------- Victims infected with the MarsJoke ransomware can now decrypt their files; researchers cracked the encryption in the CTB-Locker lookalike last week. --------------------------------------------- http://threatpost.com/researchers-break-marsjoke-ransomware-encryption/1210… *** Security Design: Stop Trying to Fix the User *** --------------------------------------------- Every few years, a researcher replicates a security study by littering USB sticks around an organizations grounds and waiting to see how many people pick them up and plug them in, causing the autorun function to install innocuous malware on their computers. These studies are great for making security professionals feel superior. The researchers get to demonstrate their security expertise and use the results as "teachable moments" for others. "If only everyone was more security --------------------------------------------- https://www.schneier.com/blog/archives/2016/10/security_design.html *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in OpenSSL affect IBM i *** http://www.ibm.com/support/docview.wss?uid=nas8N1021643 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Application Developer for WebSphere Software (CVE-2016-3508, CVE-2016-3500, CVE-2016-3458, CVE-2016-3485) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991383 --------------------------------------------- *** IBM Security Bulletin: A vulnerability in IBM Java SDK and IBM Java Runtime affects Web Experience Factory (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21990405 --------------------------------------------- *** IBM Security Bulletin: IBM B2B Advanced Communications is vulnerable to cross-site scripting due to the vulnerability of 10x (CVE-2016-5892) *** http://www-01.ibm.com/support/docview.wss?uid=swg21991148 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons affects IBM B2B Advanced Communications (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990424 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple libxml2 vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=isg3T1024318 --------------------------------------------- *** IBM Security Bulletin: IBM Flex System Manager (FSM) is affected by multiple openssl vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=isg3T1024319 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Runtime Environments Java Technology Edition, Versions 6, 7, 8 affect Transformation Extender Design Studio (CVE-2016-3426) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990356 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring embedded WebSphere Application Server *** http://www.ibm.com/support/docview.wss?uid=swg21990451 --------------------------------------------- *** IBM Security Bulletin: OpenStack Glance vulnerabilities affect IBM Cloud Manager with OpenStack (CVE-2016-0757) *** http://www.ibm.com/support/docview.wss?uid=isg3T1024348 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 30-09-2016
by Daily end-of-shift report 30 Sep '16

30 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 29-09-2016 18:00 − Freitag 30-09-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** The Equation Groups Firewall Exploit Chain *** --------------------------------------------- There has been plenty of research on pieces of this exploit kit, but very little on the full exploit chain. We were interested in studying some of the command and control traffic used by this exploit kit for emulation in BreakingPoint. On the way, we figured out how a lot of the puzzle pieces fit together. What follows are our findings on how this kit gains persistent control of a Cisco firewall. We also identify some of the missing pieces that were not previously available. --------------------------------------------- https://www.ixiacom.com/company/blog/equation-groups-firewall-exploit-chain *** European Cyber Security Month: get in the driving seat of your own online security *** --------------------------------------------- October 2016 is European Cyber Security Month and this year October will bring plenty of opportunities for people to discover how to stay safe online and play an active role in their own security. Throughout European Cyber Security Month – which kicks-off today in Brussels - over 300 activities, including events, training sessions, tips and an online quiz, will take place across 27 countries. This year's Cyber Security Month will focus on security in banking, cyber safety, cyber training and mobile malware. --------------------------------------------- https://www.enisa.europa.eu/news/ecsm *** Lesser known tricks of spoofing extensions *** --------------------------------------------- It is a well-known fact that malware using social engineering tricks is designed to hide itself from being an obvious executable. In this short article, we will present two other less common tricks used to deceive users. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/2016/09/lesser-known-tricks-of-spo… *** Backdoored D-Link Router Should be Trashed, Researcher Says *** --------------------------------------------- A researcher who found a slew of vulnerabilities in a popular router says it's so hopelessly broken that consumers who own them should throw them away. --------------------------------------------- http://threatpost.com/backdoored-d-link-router-should-be-trashed-researcher… *** Sentinel 7.4 SP3 (Sentinel 7.4.3.0) Build 2805 *** --------------------------------------------- This service pack resolves the following security vulnerabilities: Sentinel 7.4 SP3 resolves a Java deserialization (CVE-2016-1000031) vulnerability. --------------------------------------------- https://download.novell.com/Download?buildid=HXXzqDiAPd0~ *** [SANS ISC Diary] Another Day, Another Malicious Behaviour *** --------------------------------------------- I published the following diary on isc.sans.org: "Another Day, Another Malicious Behaviour". Every day, we are spammed with thousands of malicious emails and attackers always try to find new ways to bypass the security controls. Yesterday, I detected a suspicious HTTP GET request... --------------------------------------------- https://blog.rootshell.be/2016/09/30/sans-isc-diary-another-day-another-mal… *** Patch für Street Fighter V: Anti-Cheat-Tool als Rootkit missbrauchar *** --------------------------------------------- Ein aktueller Patch für die Windows-Version von Street Fighter V bringt Maßnahmen gegen Cheater mit, deaktiviert dafür aber einen essentiellen Sicherheits-Mechanismus von Computern. Mittlerweile soll ein Fix des Sicherheits-Problem aus der Welt schaffen. --------------------------------------------- https://heise.de/-3338614 *** Bugtraq *** --------------------------------------------- *** Bugtraq: Multiple exposures in Sophos UTM *** http://www.securityfocus.com/archive/1/539518 --------------------------------------------- *** Bugtraq: [SYSS-2016-060] Logitech M520 - Insufficient Verification of Data Authenticity (CWE-345) *** http://www.securityfocus.com/archive/1/539517 --------------------------------------------- *** Bugtraq: Persistent XSS in Abus Security Center - CVSS 8.0 *** http://www.securityfocus.com/archive/1/539514 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 29-09-2016
by Daily end-of-shift report 29 Sep '16

29 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 28-09-2016 18:00 − Donnerstag 29-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Dangerous Linux Trojan family investigated by Doctor Web *** --------------------------------------------- September 27, 2016 Doctor Web’s security researchers have examined a Trojan named Linux.Mirai which is used by criminals to carry out DDoS attacks. Because virus specialists were familiar with earlier versions of this Trojan, they were able to find many features of the previous versions in this latest one, .. --------------------------------------------- http://news.drweb.com/show/?i=10218&lng=en&c=9 *** SSH Brute Force Compromises Leading to DDoS *** --------------------------------------------- A few weeks ago we ran an experiment to see how long it would take for some IPv4-only and IPv6-only servers to be compromised via SSH brute force attacks. We configured five cloud servers on Linode and Digital Ocean with the root password .. --------------------------------------------- https://blog.sucuri.net/2016/09/ssh-brute-force-compromises-leading-to-ddos… *** Introducing Her Royal Highness, the Princess Locker Ransomware *** --------------------------------------------- Today we bring you Princess Locker; the ransomware only royalty could love. First discovered by Michael Gillespie, Princess Locker encrypts a victims data and then demands a hefty ransom .. --------------------------------------------- http://www.bleepingcomputer.com/news/security/introducing-her-royal-highnes… *** Sicherheitsrisiko Baustellenampeln: Grüne Welle auf Knopfdruck *** --------------------------------------------- Es klingt wie ein Computerspiel oder ein Hackerfilm, ist aber leider Realität: Die Ampelanlagen eines deutschen Herstellers lassen sich fernsteuern. Obwohl das Unternehmen seit Monaten Kenntnis davon hat, ist bislang nichts geschehen. --------------------------------------------- http://www.golem.de/news/sicherheitsrisiko-baustellenampeln-gruene-welle-au… *** ManageEngine ServiceDesk Plus vulnerable to cross-site scripting *** --------------------------------------------- http://jvn.jp/en/jp/JVN50347324/ *** Rekord-DDoS-Attacke mit 1,1 Terabit pro Sekunde gesichtet *** --------------------------------------------- Höher, schneller, weiter: Ein stetig wachsendes Botnet soll die Server eines französischen Web-Hosters mit gewaltigen Datenmengen bombardiert haben. Dabei handelt es sich offensichtlich um den bisher größten dokumentierten DDoS-Angriff. --------------------------------------------- http://heise.de/-3336494 *** 500-Millionen-Hack: Yahoo sparte an der Sicherheit *** --------------------------------------------- Marissa Mayer verteilte bei Yahoo kostenfreie iPhones und teures Catering - an der Sicherheit wurde aber offenbar gespart. Außerdem bezweifelt eine Sicherheitsfirma, dass Yahoo wirklich von einem staatlichen Akteur gehackt wurde. --------------------------------------------- http://www.golem.de/news/500-millionen-hack-yahoo-sparte-an-der-sicherheit-… *** Multiple vulnerabilities in extension "phpMyAdmin" *** --------------------------------------------- https://typo3.org/news/article/multiple-vulnerabilities-in-extension-phpmya… *** Cisco patcht Hintertür weg und schließt weitere Lücken *** --------------------------------------------- Unter bestimmten Voraussetzungen sollen Angreifer ohne viel Aufwand Email Security Appliances kapern können. Cisco stuft die Sicherheitslücke mit dem höchsten Bedrohungsgrad ein. --------------------------------------------- http://heise.de/-3337464 *** Bundeskriminalamt: Bewusstsein für Cyberbedrohungen immer noch mangelhaft *** --------------------------------------------- Bundesheer und Bundeskriminalamt setzen auf Aufklärung und suchen technikaffine Kräfte --------------------------------------------- http://derstandard.at/2000045143087

1 0

Tageszusammenfassung - Mittwoch 28-09-2016
by Daily end-of-shift report 28 Sep '16

28 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 27-09-2016 18:00 − Mittwoch 28-09-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** Warnung vor Rechnungen der "Austria Domain Hosting" *** --------------------------------------------- Aktuell erhalten zahlreiche InternetnutzerInnen per E-Mail vermeintliche Rechnungen der "Austria Domain Hosting". Zu zahlen sind 179,40 Euro für eine nie bestellte Registrierung einer Domain. In Wirklichkeit handelt es sich um einen Betrugsversuch! --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/warnung-vor-rechnu… *** Datenschützer decken schwere Mängel im Internet der Dinge auf *** --------------------------------------------- Das Global Privacy Network (GPEN) hat 314 vernetzte Geräte von Fitness-Trackern über Blutzuckermessgeräte bis zu Smart-TVs geprüft und ist auf große Lücken beim Datenschutz gestoßen. Selbst sensible Informationen würden kaum verschlüsselt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Datenschuetzer-decken-schwere-Maenge… *** Back in Time Memory Forensics, (Tue, Sep 27th) *** --------------------------------------------- You might get into a case where you have only the disk image without having the memory image. Or even if you have the memory image but you wish If you have something back in time.With hibernation file (hiberfil.sys) ,PageFile (pageand crash dump that might be possible. And if you are lucky enough you might be able to recover them from volume shadow copy which is enabled by default in most of modern Windows OS . --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21527&rss *** Bugtraq: ESA-2016-127: EMC ViPR SRM Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539492 *** Vuln: libgd gd_webp.c Integer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93184 *** Security Advisory: BIND vulnerability CVE-2016-2776 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/18/sol18829561.html?… *** Vuln: Symantec Messaging Gateway CVE-2016-5312 Directory Traversal Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93148 *** Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: September 2016 *** --------------------------------------------- On September 22, 2016, the OpenSSL Software Foundation released an advisory that describes 14 vulnerabilities. Of these 14 vulnerabilities, the OpenSSL Software Foundation classifies one as "Critical Severity" one as "Moderate Severity" and the other 12 as "Low Severity". Subsequently, on September 26, the OpenSSL Software Foundation released an additional advisory that describes two new vulnerabilities. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Vuln: Apache Axis2 Document Type Declaration Processing Security Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/40976 *** Vuln: Apache Xerces-C CVE-2016-4463 Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/91501 *** BIND Bug in buffer.c Constructing Query Responses Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- BIND Bug in buffer.c Constructing Query Responses Lets Remote Users Cause the Target Service to Crash --------------------------------------------- http://www.securitytracker.com/id/1036903 *** Security Advisory: libssh vulnerability CVE-2016-0739 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/57/sol57255643.html?… *** Security Advisory: TMM SSL/TLS virtual server vulnerability CVE-2016-6907 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/39/sol39508724.html?… *** EMC ViPR SRM Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- EMC ViPR SRM Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks --------------------------------------------- http://www.securitytracker.com/id/1036904 *** Security Advisory - Path Traversal Vulnerability in Multiple Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160928-… *** SSA-378531 (Last Update 2016-09-27): Vulnerabilities in SIMATIC WinCC, PCS 7 and WinCC Runtime Professional *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-378531… *** TP-Link Archer CR-700 Cross Site Scripting *** --------------------------------------------- n running the command above, it send a DHCP request to the router. On a DHCP request, the host name is sent to which we have forcibly set it to an XSS script <script>alert(5)</script> --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090203 *** Bugtraq: Multiple vulnerabilities found in the Dlink DWR-932B (backdoor, backdoor accounts, weak WPS, RCE ...) *** --------------------------------------------- Multiple vulnerabilities found in the Dlink DWR-932B (backdoor, backdoor accounts, weak WPS, RCE ...) --------------------------------------------- http://www.securityfocus.com/archive/1/539502 *** ICS-CERT releases new tools for securing industrial control systems *** --------------------------------------------- The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has published newer versions of two tools that can help administrators with securing industrial control systems: the Cyber Security Evaluation Tool (CSET), and a whitepaper on recommended practices for improving ICS cybersecurity with defense-in-depth strategies. While the former has received many update through the years (this newer version is v8.0), the whitepaper is a 'modernized' version of a document .. --------------------------------------------- https://www.helpnetsecurity.com/2016/09/28/tools-securing-industrial-contro… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A security vulnerability has been identified in WebSphere Liberty Profile shipped with IBM License Metric Tool v9 and IBM BigFix Inventory v9 (CVE-2016-3485) *** http://www.ibm.com/support/docview.wss?uid=swg21990448 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in Oracle Outside In Technology affect IBM Rational DOORS Next Generation (CVE-2016-3574, CVE-2016-3575, etc) *** http://www.ibm.com/support/docview.wss?uid=swg21988718 --------------------------------------------- *** IBM Security Bulletin: Security Vulnerability in Apache Commons FileUpload affects IBM WebSphere Dashboard Framework (CVE-2016-3092 ) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990386 --------------------------------------------- *** IBM Security Bulletin: Security Vulnerability in Apache Commons FileUpload affects IBM Web Experience Factory (CVE-2016-3092 ) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990394 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo Credit Limits (CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg21988584 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational BuildForge (CVE-2016-2107, CVE-2016-2176) *** http://www.ibm.com/support/docview.wss?uid=swg21988081 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in sblim-sfcb affects IBM Integrated Management Module (IMM) for System x & BladeCenter (CVE-2015-5185) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099487 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in libxml2 affects IBM Integrated Management Module (IMM) for System x & BladeCenter (CVE-2015-8710) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099488 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 27-09-2016
by Daily end-of-shift report 27 Sep '16

27 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 26-09-2016 18:00 − Dienstag 27-09-2016 18:00 Handler: Robert Waldner Co-Handler: n/a *** Sofacy APT Targeting OS X Machines with Komplex Trojan *** --------------------------------------------- APT gang Sofacy is targeting Mac OS X users with a Trojan that allows an attacker to execute remote commands on infected systems. --------------------------------------------- http://threatpost.com/sofacy-apt-targeting-os-x-machines-with-komplex-troja… *** Java-Deserialization-Cheat-Sheet *** --------------------------------------------- A cheat sheet for pentesters about Java Native Binary Deserialization vulnerabilities --------------------------------------------- https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet *** Sicherheitsupdate für Django 1.8 und 1.9 veröffentlicht *** --------------------------------------------- Grund für das Update des Webframeworks ist eine Schwachstelle, die im Zusammenspiel mit Google Analytics Djangos CSRF-Schutz angreifbar macht. Das aktuelle Django 1.10 ist nicht betroffen, und ältere Varianten als 1.8 erhalten keine Security-Patches mehr. --------------------------------------------- http://heise.de/-3332611 *** Rotten Potato - Privilege Escalation from Service Accounts to SYSTEM *** --------------------------------------------- The idea behind this vulnerability is simple to describe at a high level: - Trick the 'NT AUTHORITY\SYSTEM' account into authenticating via NTLM to a TCP endpoint we control. - Man-in-the-middle this authentication attempt (NTLM relay) to locally negotiate a security token for the 'NT AUTHORITY\SYSTEM' account. This is done through a series of Windows API calls. - Impersonate the token we have just negotiated --------------------------------------------- https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-… *** Unsafe at any clock speed: Linux kernel security needs a rethink *** --------------------------------------------- Ars reports from the Linux Security Summit - and finds much work that needs to be done. --------------------------------------------- http://arstechnica.com/security/2016/09/linux-kernel-security-needs-fixing/ *** No wonder were being hit by Internet of Things botnets. Ever tried patching a Thing? *** --------------------------------------------- Akamai CSO laments pisspoor security design practices Internet of Things devices are starting to pose a real threat to security for the sensible part of the web, Akamais chief security officer Andy Ellis has told The Register. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/09/27/akamai_chie… *** CVE-2016-7543 -- bash SHELLOPTS+PS4 *** --------------------------------------------- The recent bash 4.4 patched an old attack vector regarding specially crafted SHELLOPTS+PS4 environment variables against bogus setuid binaries using system()/popen(). --------------------------------------------- http://seclists.org/oss-sec/2016/q3/617 *** Siemens SCALANCE M-800/S615 Web Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a web security vulnerability in Siemens SCALANCE M-800 and S615 modules. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-271-01 *** IBM Security Bulletin: Vulnerabilities in OpenSSH affect AIX (CVE-2015-8325, CVE-2016-6210, CVE-2016-6515) *** --------------------------------------------- http://aix.software.ibm.com/aix/efixes/security/java_july2016_advisory.asc

1 0

Tageszusammenfassung - Montag 26-09-2016
by Daily end-of-shift report 26 Sep '16

26 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 23-09-2016 18:00 − Montag 26-09-2016 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Kein Erste Bank-Sicherheitszertifikat installieren *** --------------------------------------------- In einer gefälschten Erste Bank-Nachricht verlangen Kriminelle von Empfängern, dass diese ein Sicherheitszertifikat für ihr mobiles Endgerät installieren. Tun Adressaten das nicht, führt das angeblich zur Kontensperrung. Die Installation des Sicherheitszertifikats infiziert das Smartphone mit Schadsoftware. Mit dieser haben Kriminelle Zugriff auf das fremde Konto. Opfer verlieren Geld. --------------------------------------------- https://www.watchlist-internet.at/schadsoftware/kein-erste-bank-sicherheits… *** Geschwächte iTunes-Backup-Verschlüsselung: Apple stellt Fix in Aussicht *** --------------------------------------------- Eine Schwachstelle macht Brute-Force-Angriffe auf verschlüsselte iTunes-Backups von iOS-10-Geräten weniger zeitintensiv. Apple ist das Problem bekannt - und betont, dass iCloud-Backups davon nicht betroffen sind. --------------------------------------------- http://heise.de/-3331346 *** VBA and P-code, (Mon, Sep 26th) *** --------------------------------------------- I want to draw your attention to some great work Dr. Bontchev did. pcodedmp.py is a VBA P-code disassembler. Microsoft Office documents contain VBA macros in several forms. They contain the source code, but also compiled P-code. Dr. Bontchev created a proof-of-concept document that executes P-code and does not contain the corresponding source code. Here is the output from his pcodedmp.py tool for his PoC document: python pcodedmp.py -d poc2b.docProcessing file:... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21521&rss *** Leaking Beeps: Here's A Reason to Kick Pagers out of Hospitals *** --------------------------------------------- Today, Trend's FTR team released the paper Leaking Beeps: Unencrypted Pager Messages in the Healthcare Industry, on our research into pager technology. If are concerned about keeping your health information private, I would highly recommend you read through it. I, for one, was not expecting the findings we made. Pagers are secure, right? We've used them for decades, they are hard to monitor, and that's why some of our most trusted industries use them, including the healthcare... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/o-H15bX77W8/ *** OpenSSL Fixes Critical Bug Introduced by Latest Update *** --------------------------------------------- OpenSSL's most recent update introduced a critical vulnerability in the crypto library, forcing an emergency update today. --------------------------------------------- http://threatpost.com/openssl-fixes-critical-bug-introduced-by-latest-updat… *** OpenSSL Security Advisory [26 Sep 2016] *** --------------------------------------------- This security update addresses issues that were caused by patches included in our previous security update, released on 22nd September 2016. Given the Critical severity of one of these flaws we have chosen to release this advisory immediately to prevent upgrades to the affected version, rather than delaying in order to provide our usual public pre-notification. --------------------------------------------- https://www.openssl.org/news/secadv/20160926.txt *** Security Advisory: NodeJS vulnerability CVE-2016-2086 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/k/15/sol15311661.html?… *** Security Notice - Statement on Elevation of Privilege Vulnerability in Huawei HG8247H Product Disclosed on THEZEDT Website *** --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2016/huawei-sn-20160924-01-… *** Security Notice - Statement on Elevation of Privilege Vulnerability in Huawei HG8247H Product Disclosed on TheZedt Website *** --------------------------------------------- http://www.huawei.com/en/psirt/security-notices/2016/huawei-sn-20160924-01-… *** Security Advisory - Heap Overflow Vulnerability in the HIFI Driver of Huawei Smart Phone *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2015/hw-460347 *** Security Advisory - Privilege Escalation Vulnerability in Huawei Multiple Smart Phones *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160926-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple Expat XML Parser vulnerabilities in Prospect *** http://www-01.ibm.com/support/docview.wss?uid=swg21988817 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager for Web is affected by security vulnerabilities in libxml2 *** http://www.ibm.com/support/docview.wss?uid=swg21990838 --------------------------------------------- *** IBM Security Bulletin: IBM Security Access Manager for Mobile is affected by security vulnerabilities in libxml2 *** http://www.ibm.com/support/docview.wss?uid=swg21990837 --------------------------------------------- *** IBM Security Bulletin: Multiple libarchive vulnerabilities affect Watson Explorer *** http://www-01.ibm.com/support/docview.wss?uid=swg21988311 --------------------------------------------- *** IBM Security Bulletin: A command injection vulnerability has been identified in IBM Security Access Manager for Web appliances (CVE-2016-3028) *** http://www.ibm.com/support/docview.wss?uid=swg21990317 --------------------------------------------- *** IBM Security Bulletin: A vulnerability associated with the default account lockout settings in IBM Security Access Manager for Web has been identified (CVE-2016-3025) *** http://www.ibm.com/support/docview.wss?uid=swg21990318 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in Apache Struts affect SAN Volume Controller and Storwize Family *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009282 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in Apache Struts and Apache Commons FileUpload affects IBM WebSphere Service Registry and Repository (CVE-2016-1181, CVE-2016-1182, CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg21988198 --------------------------------------------- *** IBM Security Bulletin: Multiple Vulnerabilities in Struts v2 affect IBM Opportunity Detect *** http://www.ibm.com/support/docview.wss?uid=swg21987854 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect SAN Volume Controller and Storwize Family (CVE-2016-2107 CVE-2016-2108) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1009281 ---------------------------------------------

1 0

Tageszusammenfassung - Freitag 23-09-2016
by Daily end-of-shift report 23 Sep '16

23 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 22-09-2016 18:00 − Freitag 23-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** The era of big DDOS?, (Thu, Sep 22nd) *** --------------------------------------------- I have been tracking DDOSs for a number of years, and quite frankly, it has become boring. Dont get me wrong, I am not complaining, just stating a fact. A number of factors seem tohave contributed to its fall from mainstream consciousness. somewhat better filtering practices, more awareness of timely patching, and probably the most significant being the novelty has worn off. Occasionally I will still see a multi-Gbps DDOS, but mostly it has been relegated to booter traffic which is not even a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21511&rss *** LGPO.exe v2.0 PRE-RELEASE: support for MLGPO and REG_QWORD *** --------------------------------------------- LGPO.exe is a command-line utility to automate the management of local group policy objects (LGPO). Version 1.0 was released last January. The PRE-RELEASE LGPO.exe v2.0 is attached to this blog post, and adds support for Multiple Local Group Policy Objects (MLGPO) and 64-bit REG_QWORD registry values. Full details are in the LGPO.pdf in the download. For more... --------------------------------------------- https://blogs.technet.microsoft.com/secguide/2016/09/23/lgpo-exe-v2-0-pre-r… *** Gefälschte Sendungsverfolgungen der Post *** --------------------------------------------- Internet-Nutzer/innen erhalten eine angebliche Sendungsverfolgung der Österreichischen Post. Darin heißt es, dass das Unternehmen ein Paket zurückerhalten habe. Damit es Empfänger/innen erhalten können, sollen sie einen Link aufrufen und eine Datei ausführen. Sie beinhaltet Schadsoftware. Wer diese öffnet, erleidet einen Datenverlust. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/gefaelschte-sendun… *** Nach DDoS-Attacken: Akamai nimmt Sicherheitsforscher Krebs vom Netz *** --------------------------------------------- Nach der Enttarnung eines israelischen DDoS-Anbieters ist der Sicherheitsexperte Krebs selbst Opfer eines ungewöhnlichen Angriffs geworden. Seine Website ist vom Netz genommen worden. --------------------------------------------- http://www.golem.de/news/nach-ddos-attacken-akamai-nimmt-sicherheitsforsche… *** A week to go for the European Cyber Security Month launch! *** --------------------------------------------- ENISA together with the European Commission, the European Baking Federation (EBF), Europol's European Cybercrime Centre (EC3), and its partners, are getting ready for the launch event of the European Cyber Security Month (ECSM), the EU advocacy campaign on cybersecurity which runs throughout October. --------------------------------------------- https://www.enisa.europa.eu/news/enisa-news/a-week-to-go-for-the-european-c… *** Security Update for Microsoft Office (3185852) *** --------------------------------------------- V.2.0(September 22, 2016): Bulletin revised to announce the availability of the 14.6.8 update for Microsoft Office for Mac 2011 (3186805) and the 15.25 update for Microsoft Office 2016 for Mac (3186807). Customers running affected Mac software should install the appropriate update for their product to be protected from the vulnerabilities discussed in this bulletin. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS16-107 *** Cisco Email Security Appliance Internal Testing Interface Vulnerability *** --------------------------------------------- A vulnerability in Cisco IronPort AsyncOS for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to obtain complete control of an affected device.The vulnerability is due to the presence of a Cisco internal testing and debugging interface (intended for use during product manufacturing only) on customer-available software releases. An attacker could exploit this vulnerability by connecting to this testing and debugging interface. An exploit could allow an... --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IDM 4.5 Notes Driver Version 4.0.1.0 *** --------------------------------------------- Abstract: This patch is for Identity Manger Notes Driver. It can be installed on IDM 4.5. This patch will take the version of the Notes Driver to version 4.0.1.0.Document ID: 5255110Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:IDM45_Notes_4010.zip (1.12 MB)Products:Identity Manager 4.5Superceded Patches:IDM 4.5 Notes Driver Version 4.0.0.4 --------------------------------------------- https://download.novell.com/Download?buildid=aLUafJcAJps~ *** DSA-3674 firefox-esr - security update *** --------------------------------------------- Multiple security issues have been found in the Mozilla Firefox webbrowser: Multiple memory safety errors, buffer overflows and otherimplementation errors may lead to the execution of arbitrary code orinformation disclosure. --------------------------------------------- https://www.debian.org/security/2016/dsa-3674 *** Microsoft Internet Explorer 11 CORS Disrespect *** --------------------------------------------- Topic: Microsoft Internet Explorer 11 CORS Disrespect Risk: Low Text:IE11 is not following CORS specification for local files like Chrome and Firefox. Ive contacted Microsoft and they say this i... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090165 *** DFN-CERT-2016-1560/">LibreSSL: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2016-1560/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Code execution vulnerability in WebSphere Application Server (CVE-2016-5983). *** http://www-01.ibm.com/support/docview.wss?uid=swg21990060 --------------------------------------------- *** IBM Security Bulletin: Security vulnerability has been identified in IBM WebSphere Portal (CVE-2016-5954) *** http://www-01.ibm.com/support/docview.wss?uid=swg21989993 --------------------------------------------- *** IBM Security Bulletin: IBM DB2 LUW on AIX and Linux Affected by Multiple Vulnerabilities in GPFS (CVE-2016-2984, CVE-2016-2985). *** http://www-01.ibm.com/support/docview.wss?uid=swg21989842 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium Database Activity Monitor is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-4483) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990364 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Commons FileUpload affects IBM Algo Credit Manager (CVE-2016-3092) *** http://www-01.ibm.com/support/docview.wss?uid=swg21988586 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Tomcat affects IBM Algo Credit Administrator (CVE-2016-3092) *** http://www.ibm.com/support/docview.wss?uid=swg21988585 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Struts affects FileNet Content Manager and IBM Content Foundation (CVE-2016-1181, CVE-2016-1182) *** http://www.ibm.com/support/docview.wss?uid=swg21987189 --------------------------------------------- *** IBM Security Bulletin: IBM Security Guardium is affected by Open Source XMLsoft Libxml2 Vulnerabilities (CVE-2016-4447 CVE-2016-4448 CVE-2016-4449) *** http://www-01.ibm.com/support/docview.wss?uid=swg21986710 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Network Security (NSS) affects IBM SAN Volume Controller and Storwize Family (CVE-2016-1978) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009280 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed (CVE-2016-0377) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990525 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Tivoli LWI impacts pConsole and WebSM for AIX (CVE-2016-6038) *** http://http://aix.software.ibm.com/aix/efixes/security/pconsole_mitigation.… --------------------------------------------- *** IBM Security Bulletin: The Elastic Storage Server and the GPFS Storage Server are affected by a vulnerability in IBM Spectrum Scale (CVE-2016-2985 and CVE-2016-2984) *** http://www-01.ibm.com/support/docview.wss?uid=isg3T1024336 --------------------------------------------- *** IBM Security Bulletin: Multiple security vulnerabilities affect Liberty for Java for IBM Bluemix *** http://www.ibm.com/support/docview.wss?uid=swg21990527 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in libpng affect NVIDIA Linux device drivers for System x, Flex and BladeCenter Systems (CVE-2015-8472, CVE-2015-7981, CVE-2015-8126) *** https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5099471 ---------------------------------------------

1 0

Tageszusammenfassung - Donnerstag 22-09-2016
by Daily end-of-shift report 22 Sep '16

22 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 21-09-2016 18:00 − Donnerstag 22-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake-Abmahnung von RA Jörg Schmidt im Umlauf *** --------------------------------------------- Haushalte erhalten eine Abmahnung der Rechtsanwaltskanzlei Jörg Schmidt. Darin heißt es, dass es zu einer Verletzung von Urheberrechten der abbywinters.com BV gekommen sei, weil Empfänger/innen den Erotikfilm "Girl & Girl Pee Marigold & Christiana" verwertet haben. Aus diesem Grund sollen sie 950.00 Euro zahlen. Es handelt sich um einen Betrugsversuch. --------------------------------------------- https://www.watchlist-internet.at/sonstiges/fake-abmahnung-von-ra-joerg-sch… *** More than 840,000 Cisco devices are vulnerable to NSA-related exploit *** --------------------------------------------- More than 840,000 Cisco networking devices from around the world are exposed to a vulnerability thats similar to one exploited by a hacking group believed to be linked to the U.S. National Security Agency.The vulnerability was announced by Cisco last week and it affects the IOS, IOS XE, and IOS XR software that powers many of its networking devices. The flaw allows hackers to remotely extract the contents of a devices memory, which can lead to the exposure of sensitive information. --------------------------------------------- http://www.cio.com/article/3122868/more-than-840000-cisco-devices-are-vulne… *** Bug that hit Firefox and Tor browsers was hard to spot - now we know why *** --------------------------------------------- The curious case of Firefoxs (now fixed) certificate pinning failure. --------------------------------------------- http://arstechnica.com/security/2016/09/bug-that-hit-firefox-and-tor-browse… *** Hacked Website Report - 2016/Q2 *** --------------------------------------------- Today we're releasing our quarterly Hacked Website Report for 2016/Q2. The data in this report is based on compromised websites we worked on, with insights and analysis performed by our Incident Response Team (IRT) and Malware Research Team (MRT). CMS Analysis Our analysis consisted of over 9,000 infected websites. The graphs below show a side-by-side... --------------------------------------------- https://blog.sucuri.net/2016/09/hacked-website-report-2016q2.html *** KrebsOnSecurity Hit With Record DDoS *** --------------------------------------------- On Tuesday evening, KrebsOnSecurity.com was the target of an extremely large and unusual distributed denial-of-service (DDoS) attack designed to knock the site offline. The attack did not succeed thanks to the hard work of the engineers at Akamai, the company that protects my site from such digital sieges. But according to Akamai, it was nearly double the size of the largest attack theyve seen previously, and was among the biggest assaults the Internet has ever witnessed. --------------------------------------------- http://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/ *** Controlling Kerio Control - When your firewall turns against you. *** --------------------------------------------- IntroductionThis blog post describes two different attacks which can be used to compromise companies which use Kerio Control in their network. Kerio Control is a hardware appliance which can be used as network firewall, router and VPN gateway. Both attacks spawn a reverse shell on Kerio Control. Since both attack payloads are delivered via CSRF (cross site request forgery) or XSS (cross site scripting) no ports must be open from the Internet. --------------------------------------------- http://blog.sec-consult.com/2016/09/controlling-kerio-control-when-your.html *** Future attack scenarios against ATM authentication systems *** --------------------------------------------- The report comprises two papers in which we analyze all existing methods of authentication used in ATMs and those expected to be used in the near future, including: contactless authentication through NFC, one-time password authentication and biometric authentication systems, as well as potential vectors of attacks using malware, through to network attacks and attacks on hardware components. --------------------------------------------- http://securelist.com/analysis/publications/76099/future-attack-scenarios-a… *** Cisco plugs two Cloud Services Platform system compromise flaws *** --------------------------------------------- Cisco has patched two serious vulnerabilities in Cisco Cloud Services Platform 2100, both of which could allow a remote attacker to execute arbitrary code on a targeted system. Both vulnerabilities affect version 2.0 of the platform and there are no workarounds to address them, so administrators are advised to update to release 2.1.0 and later to plug the holes. What's the problem? Cisco Cloud Services Platform 2100 is a popular Linux Kernel-based Virtual Machine software... --------------------------------------------- https://www.helpnetsecurity.com/2016/09/22/cisco-plugs-cloud-services-platf… *** Fixing the mixed content problem with Automatic HTTPS Rewrites *** --------------------------------------------- CloudFlare aims to put an end to the unencrypted Internet. But the web has a chicken and egg problem moving to HTTPS. Long ago it was difficult, expensive, and slow to set up an HTTPS capable web site. Then along came services like CloudFlare's Universal SSL that made switching... --------------------------------------------- https://blog.cloudflare.com/fixing-the-mixed-content-problem-with-automatic… *** OpenSSL Update Released, (Thu, Sep 22nd) *** --------------------------------------------- As announced earlier this week,OpenSSLreleased an update today for all currently supported versions (1.0.1, 1.0.2, 1.1.0). The update fixes 14 different vulnerabilities. Only one vulnerability is rated High. This vulnerability,CVE-2016-6304, can lead to memory exhaustion and a denial of service if the client sends multiple largeOCSP">OCSP">">">SWEET32">">OOB write in">">MalformedSHA512">">">">Pointer... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21509&rss *** OpenSSL Security Advisory [22 Sep 2016] *** --------------------------------------------- OCSP Status Request extension unbounded memory growth (CVE-2016-6304) SSL_peek() hang on empty record (CVE-2016-6305) SWEET32 Mitigation (CVE-2016-2183) OOB write in MDC2_Update() (CVE-2016-6303) Malformed SHA512 ticket DoS (CVE-2016-6302) OOB write in BN_bn2dec() (CVE-2016-2182) OOB read in TS_OBJ_print_bio() (CVE-2016-2180) Pointer arithmetic undefined behaviour (CVE-2016-2177) Constant time flag not preserved in DSA signing (CVE-2016-2178) DTLS buffered message DoS (CVE-2016-2179) DTLS... --------------------------------------------- https://www.openssl.org/news/secadv/20160922.txt *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004 *** --------------------------------------------- Description Users who have rights to edit a node, can set the visibility on comments for that node. Advisory ID: DRUPAL-SA-CORE-2016-004Project: Drupal core Version:li 8.xDate: 2016-September-21Security risk: 18/25 ( Critical) AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:DefaultVulnerability: DescriptionUsers without "Administer comments" can set comment visibility on nodes they can edit. (Less critical) Users who have rights to edit a node, can set the visibility on comments for that --------------------------------------------- https://www.drupal.org/SA-CORE-2016-004 *** ZDI-16-526: (0Day) Google Chrome Protocol Handler Logic Error Restrictions Bypass Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to bypass restrictions on vulnerable installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-526/ *** ZDI-16-525: (0Day) Fatek Automation PM Designer Heap Memory Corruption Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Fatek Automation PM Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-525/ *** [2016-09-22] Potential backdoor access through multiple vulnerabilities in in Kerio Control Unified Threat Management *** --------------------------------------------- Kerio Control contains multiple vulnerabilities which can be used by an attacker to obtain a reverse root shell to the internal firewall system of a network. An attacker can use this reverse root shell to further compromise the victims local network, sniff VPN traffic (including VPN credentials) or just backdoor the firewall/VPN gateway. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2016… *** HPSBGN03649 rev.1 - HPE Network Automation using Java Deserialization, Remote Code Execution *** --------------------------------------------- A vulnerability in Apache Commons-Collections and Commons-BeanUtils library used for handling Java object deserialization was addressed by HPE Network Automation. The vulnerability could be exploited remotely to allow remote code execution. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098 *** SSA-342135 (Last Update 2016-09-22): Web Vulnerability in SCALANCE M-800 / S615 *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-342135… *** SSA-301706 (Last Update 2016-09-22): GNU C Library Vulnerability in Industrial Products *** --------------------------------------------- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-301706… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco Application Policy Infrastructure Controller Binary Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE iox Command Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Firepower Management Center and FireSIGHT System Software SSLIinspection Bypass Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE Software Data in Motion Component Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Cloud Services Platform 2100 Remote Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Cloud Services Platform 2100 Command Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Prime Home Web-Based User Interface XML External Entity Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco Application-Hosting Framework HTTP Header Injection Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- *** Cisco IOS and IOS XE Software Application-Hosting Framework Unauthorized File Access Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 21-09-2016
by Daily end-of-shift report 21 Sep '16

21 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 20-09-2016 18:00 − Mittwoch 21-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** Spear Phishing: Deutsche Politiker mit Malware-Mails angegriffen *** --------------------------------------------- Politiker aller Parteien waren im August Ziel von Spear-Phishing-Angriffen. Angebliche Nato-Informationen zum Putsch in der Türkei und zum Erdbeben in Italien sollten zum Klicken auf Malware verleiten. --------------------------------------------- http://www.golem.de/news/spear-phishing-deutsche-politiker-mit-malware-mail… *** Windows Events log for IR/Forensics ,Part 2, (Tue, Sep 20th) *** --------------------------------------------- In a previous diary[i] I talked about Windows Events and I gave some examples about some of the most useful events for Forensics/IR. In this diary I will talk about how to use Windows PowerShell to search for events Get-WinEvent The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs, and the event logs that are generated by the Windows Event Log technology introduced in Windows Vista. It also gets events in log files generated by... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21501&rss *** ISAKMP Scanning and Potential Vulnerabilities *** --------------------------------------------- Introduction As many of you are aware, we scan the Internet on a daily basis for many different protocols. We have added several new ones over time mostly depending on our own time available to engineer a scan for that protocol. Occasionally, we add one that is more topical and addresses a recent vulnerability or... --------------------------------------------- http://blog.shadowserver.org/2016/09/20/isakmp-scanning-and-potential-vulne… *** Mamba Ransomware Encrypts Hard Drives Rather Than Files *** --------------------------------------------- A new ransomware strain called Mamba opts to encrypts hard drives rather than individual files and folders stored on the local disk. --------------------------------------------- http://threatpost.com/mamba-ransomware-encrypts-hard-drives-rather-than-fil… *** Should you trust your security software? *** --------------------------------------------- The complaint that security is broken isn't new and even industry insiders are joining the chorus. Companies spent an estimated $75 billion last year on security products and yet cyber attacks and data breaches are still a common occurrence. Now, we're finding that security tools themselves have vulnerabilities that are putting organizations at risk. Given that vulnerabilities in software are the root cause of most attacks and security tools are inherently intrusive in order to... --------------------------------------------- https://www.helpnetsecurity.com/2016/09/21/security-software/ *** macOS Sierra beseitigt fast 70 Sicherheitslücken *** --------------------------------------------- Mit der neuen Version 10.12 hat Apple 68 Schwachstellen in macOS respektive OS X behoben, darunter kritische. Für ältere OS-X-Versionen liegt derzeit kein Sicherheits-Update vor. --------------------------------------------- http://heise.de/-3328701 *** Considerations on the Traffic Light Protocol *** --------------------------------------------- The Traffic Light Protocol (TLP) is a means for someone sharing information to inform their audience about any limitations in further spreading this information. It is used in almost all CSIRT communities and some Information Analysis and Sharing Centres (ISACs). The TLP can be used in all forms of communication, whether written or oral. This Glossary Entry presents the TLP and its possible variants, and proposes some considerations on its use and its limitations. --------------------------------------------- https://www.enisa.europa.eu/topics/national-csirt-network/glossary/consider… *** Did You Really Lock that Door? *** --------------------------------------------- One of my favorite books about information security is Ghost in the Wires, by Kevin Mitnick. Kevin, of course is one of the notorious early hackers whose exploits are brilliant and quite entertaining. If you have not already done so, add that book to your reading list. This post however is not a book review. I was reminded of Kevin's book the other evening when my son went dashing to the door in the middle of the night to make sure that he locked it. Normally, like all teenagers, he just... --------------------------------------------- https://feeds.feedblitz.com/~/200516044/0/alienvault-blogs~Did-You-Really-L… *** InfoArmor Uncovers Malicious Torrent Distribution Network *** --------------------------------------------- InfoArmor has identified a special tool used by cybercriminals to distribute malware by packaging it with the most popular torrent files on the Internet. The bad actors have analyzed trends on video, audio, software and other digital content downloads from around the globe and have created seeds on famous torrent trackers using weaponized torrents packaged with malicious code. --------------------------------------------- https://www.infoarmor.com/infoarmor-uncovers-malicious-torrent-distribution… *** Opportunistic Encryption: Bringing HTTP/2 to the unencrypted web *** --------------------------------------------- Encrypting the web is not an easy task. Various complexities prevent websites from migrating from HTTP to HTTPS, including mixed content, which can prevent sites from functioning with HTTPS. Opportunistic Encryption provides an additional level of security to websites that have not yet moved to HTTPS and the performance benefits... --------------------------------------------- https://blog.cloudflare.com/opportunistic-encryption-bringing-http-2-to-the… *** Bugtraq: ESA-2016-093: RSA Adaptive Authentication (On-Premise) Cross-Site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539432 *** DSA-3671 wireshark - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in the dissectors for H.225,Catapult DCT2000, UMTS FP and IPMI, which could result in denial ofservice or the execution of arbitrary code. --------------------------------------------- https://www.debian.org/security/2016/dsa-3671 *** Filr 2.0 - Hot Patch 3 *** --------------------------------------------- Abstract: This patch provides a number of general bug fixes and security updates for Novell Filr, Search and MySQL 2.0.0 appliances including an updated Filr 2.0 Desktop client.Document ID: 5255170Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:preinstall-Search-20HP3.zip (24.95 MB)preinstall-MySQL-20HP3.zip (24.18 MB)preinstall-Filr-20HP3.zip (34.59 MB)Filr-2.0.0.474.HP.zip (155.89 MB)Search-2.0.0.417.HP.zip (10.67 MB)MySQL-2.0.0.197.HP.zip (1.44 kB)Products:Filr... --------------------------------------------- https://download.novell.com/Download?buildid=LMP8JAI5Lrc~ *** Security Advisory - DoS Vulnerability in Multiple Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160921-… *** Security Advisory - DoS Vulnerability in Multiple Huawei Products *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160921-… *** Security Advisory - DOS Vulnerability in Video Driver of Huawei Smart Phone *** --------------------------------------------- http://www.huawei.com/en/psirt/security-advisories/2016/huawei-sa-20160921-… *** Apple Security Updates *** --------------------------------------------- *** Safari 10 *** https://support.apple.com/kb/HT207157 --------------------------------------------- *** macOS Sierra 10.12 *** https://support.apple.com/kb/HT207170 --------------------------------------------- *** tvOS 10 *** https://support.apple.com/kb/HT207142 --------------------------------------------- *** iTunes 12.5.1 for Windows *** https://support.apple.com/kb/HT207158 --------------------------------------------- *** macOS Server 5.2 *** https://support.apple.com/kb/HT207171 --------------------------------------------- *** iCloud for Windows 6.0 *** https://support.apple.com/kb/HT207147 --------------------------------------------- *** Vuln: OpenStack Nova Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93068 *** ShoreTel Connect ONSITE Blind SQL Injection Vulnerability *** --------------------------------------------- Topic: ShoreTel Connect ONSITE Blind SQL Injection Vulnerability Risk: Medium Text:ShoreTel Connect ONSITE Blind SQL Injection Vulnerability == vulnerability type: Unauthenticated Blin... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090154 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Rational Software Architect, Rational Software Architect for WebSphere Software and Rational Software Architect RealTime Edition *** http://www-01.ibm.com/support/docview.wss?uid=swg21990374 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Samba affects IBM Spectrum Scale SMB protocol access method (CVE-2016-2119) *** http://www-01.ibm.com/support/docview.wss?uid=ssg1S1009255 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in XML processing affect IBM DataPower Gateways *** http://www-01.ibm.com/support/docview.wss?uid=swg21990046 --------------------------------------------- *** IBM Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server for Bluemix *** http://www.ibm.com/support/docview.wss?uid=swg21990236 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere MQ Invalid client protocol flows could cause denial of service (CVE-2016-0379) *** http://www-01.ibm.com/support/docview.wss?uid=swg21984565 --------------------------------------------- *** IBM Security Bulletin: IBM WebSphere Cast Iron Solution is affected by Apache Tomcat vulnerability CVE-2015-5174 *** http://www-01.ibm.com/support/docview.wss?uid=swg21988742 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 20-09-2016
by Daily end-of-shift report 20 Sep '16

20 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 19-09-2016 18:00 − Dienstag 20-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** European Cyber Security Month - NIS Quiz *** --------------------------------------------- This tool is designed to help you update your internet security knowledge, begin whenever you feel ready. It will take max 10 minutes and we hope youll enjoy the quiz and learn something useful! --------------------------------------------- https://cybersecuritymonth.eu/references/quiz-demonstration/intro *** The banker that can steal anything *** --------------------------------------------- The use of root privileges is not typical for banking malware attacks, because money can be stolen in numerous other ways that dont require exclusive rights. However, in early February 2016, Kaspersky Lab discovered Trojan-Banker.AndroidOS.Tordow.a, whose creators decided that root privileges would come in handy. --------------------------------------------- http://securelist.com/blog/mobile/76101/the-banker-that-can-steal-anything/ *** Erpressungs-Trojaner HDDCryptor soll Computer von Opfern abriegeln *** --------------------------------------------- HDDCryptor verschlüsselt nicht nur Daten, sondern überschreibt offensichtlich auch den MBR von Windows-Computern und gibt infizierte Rechner erst nach einer Lösegeld-Zahlung wieder frei, warnen Sicherheitsforscher. --------------------------------------------- http://heise.de/-3327880 *** Encryption Week *** --------------------------------------------- Since CloudFlare's inception, we have worked tirelessly to make encryption as simple and as accessible as possible. Over the last two years, we've made CloudFlare the easiest way to enable encryption for web properties and internet services. From the launch of Universal SSL, which gives HTTPS to millions --------------------------------------------- https://blog.cloudflare.com/encryption-week/ *** Mozilla und Tor schließen Certificate-Pinning-Lücke *** --------------------------------------------- Durch einen Fehler beim Bau neuer Versionen von Firefox und des Tor Browsers waren diese anfällig gegen Man-in-the-Middle-Angriffe, über die Schadcode eingeschleust werden konnte. --------------------------------------------- http://heise.de/-3328039 *** Hacking WordPress Sites on Shared Servers *** --------------------------------------------- A website is only as safe as the weakest link on its shared server. Once a hacker gains access to one site on the server, they can easily infect other sites that share the same server permissions. This is called cross-site contamination. When it comes to WordPress websites, the core structure is well known by... --------------------------------------------- https://blog.sucuri.net/2016/09/hacking-wordpress-sites-shared-servers.html *** Steganography... what is that? *** --------------------------------------------- When people think about Information Security the first word that generally comes mind is "Hacking", but there are many disciplines in security and one of them is called "Steganography", an offshoot of encryption and "data hiding". The word "steganography" can... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Steganography----what-i… *** Vulnerability Patched in WordPress Theme That Allows Unrestricted Uploads *** --------------------------------------------- A vulnerability has been patched in a popular WordPress theme called Neosense that allows an attacker to upload code without authentication. --------------------------------------------- http://threatpost.com/vulnerability-patched-in-wordpress-theme-that-allows-… *** High-Tech Bridge releases a new version of its free SSL testing service *** --------------------------------------------- The new version of the service enables companies to easily test any SSL/TLS-based services for compliance with PCI DSS, HIPAA and NIST, while the new API provides much more flexibility for software developers. --------------------------------------------- https://www.htbridge.com/news/ssl-testing-service-api-hipaa-compliance.html *** Bugtraq: ESA-2016-096: EMC Celerra, VNX1, VNX2 and VNXe SMB NTLM Authentication Weak Nonce Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/539424 *** Bugtraq: ESA-2016-065: EMC Avamar Data Store and Avamar Virtual Edition Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/539423 *** VMSA-2016-0014 *** --------------------------------------------- VMware ESXi, Workstation, Fusion, and Tools updates address multiple security issues --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0014.html *** VMSA-2016-0010.1 *** --------------------------------------------- VMware product updates address multiple important security issues --------------------------------------------- https://www.vmware.com/security/advisories/VMSA-2016-0010.html *** ZDI-16-517: AlienVault Unified Security Management Remote Authentication Bypass Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to bypass authentication requirements on vulnerable installations of AlienVault Unified Security Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-517/ *** ZDI-16-518: Rockwell Automation RSLogix Micro Starter Lite Project File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Rockwell Automation RSLogix Micro Starter Lite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-518/ *** Vuln: QEMU hw/usb/hcd-xhci.c Information Disclosure Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/93029 *** Security Advisories Relating to Symantec Products - Symantec Decomposer Engine Security Update *** --------------------------------------------- Symantec has released an update to address two issues in the RAR file parser component of the antivirus decomposer engine used by multiple Symantec products. Parsing of maliciously formatted RAR container files may cause an application-level denial of service condition. --------------------------------------------- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=s… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Rational DOORS Next Generation with potential for Cross-Site Scripting attack (CVE-2016-5955) *** http://www.ibm.com/support/docview.wss?uid=swg21990054 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in libtiff affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024132 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in libxml2 affect PowerKVM *** http://www.ibm.com/support/docview.wss?uid=isg3T1024088 --------------------------------------------- *** IBM Security Bulletin: Rational Asset Analyzer (CVE-2016-5967) *** http://www-01.ibm.com/support/docview.wss?uid=swg21990215 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in node.js processing affect IBM DataPower Gateways *** http://www-01.ibm.com/support/docview.wss?uid=swg21990050 --------------------------------------------- *** IBM Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM License Metric Tool and IBM Tivoli Asset Discovery for Distributed (CVE-2016-1181 and CVE-2016-1182) *** http://www.ibm.com/support/docview.wss?uid=swg21989496 --------------------------------------------- *** IBM Security Bulletin: IBM Connections Security Update for Multiple Vulnerabilities *** http://www-01.ibm.com/support/docview.wss?uid=swg21989067 --------------------------------------------- *** IBM Security Bulletin: Information Disclosure in IBM WebSphere Application Server Liberty (CVE-2016-0378) *** http://www-01.ibm.com/support/docview.wss?uid=swg21981529 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 19-09-2016
by Daily end-of-shift report 19 Sep '16

19 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 16-09-2016 18:00 − Montag 19-09-2016 18:00 Handler: Stephan Richter Co-Handler: n/a *** The Week in Ransomware - September 16 2016 - Stampado, Locky, Atom, and More *** --------------------------------------------- Thankfully, it was a slow week this week when it comes to ransomware. For this week we had 3 new variants of existing ransomware, 2 new ransomware infections, and an updated decryptor. [...] --------------------------------------------- http://www.bleepingcomputer.com/news/security/the-week-in-ransomware-septem… *** Windows Events log for IR/Forensics ,Part 1, (Sun, Sep 18th) *** --------------------------------------------- In the time of incidents, Windows Event logs provide a plenty of useful information for the Incident responder.As you know Windows can generate thousands of events in few minutes ,in this diary I will talk about some of the most useful events and in the next diary I would discuss how to use PowerShell to search for them . Here is of the most useful events for Forensics/Incident response: Event ID Description Log Name 4624 Successful Logon Security 4625 Failed Login... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21493&rss *** Mozilla will patch zero-day Firefox bug to fiddle man-in-the-middle diddle *** --------------------------------------------- Researcher revealed Tor flaw after initially being ignored Mozilla will patch a flaw in its Firefox browser that could allow well-resourced attackers to launch man-in-the-middle impersonation attacks that also affects the Tor anonymity network. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2016/09/18/mozilla_tor… *** Untangling the Ripper ATM Malware *** --------------------------------------------- Last August , security researchers released a blog discussing a new ATM malware family called Ripper which they believe was involved in the recent ATM attacks in Thailand. Large numbers of ATMs were also temporarily shut down as a precautionary measure.During our analysis we noticed some additional details that where not called out, or which appear to contradict this earlier analysis. We highlight these differences in this blog post. We have also included technical indicators such as code... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/ddt8SN3uzhs/ *** Periscope ATM Skimmers *** --------------------------------------------- "Periscope skimmers" are the most sophisticated kind of ATM skimmers. They are entirely inside the ATM, meaning theyre impossible to notice.Theyre been found in the US. --------------------------------------------- https://www.schneier.com/blog/archives/2016/09/periscope_atm_s.html *** 324,000 payment cards breached, CVVs included, source still unknown! *** --------------------------------------------- When you decide to add debugging logs to your payment application, the PCI DSS rules about what you are allowed to store DO NOT CHANGE! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/NpR-rDlVOj0/ *** Does it Matter If You Cover Your Webcam?, (Mon, Sep 19th) *** --------------------------------------------- During security conferences, laptops with tape covering the webcam has certainly been a common sight. But recently, covering webcams has become somewhat of a main-stream phenomenon, after Mark Zuckerberg was sighted with a covered webcam [1], and even the FBI director suggests people covering their cameras [2]. Laptops are often used in private spaces, and an attacker, with access to the camera, is expected to be able to spy on the user of the laptop. Attacks like this have happened, and even... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21497&rss *** Reverse Engineering Cisco ASA for EXTRABACON Offsets *** --------------------------------------------- [...] One of the zero-day vulnerabilities released was a remote code execution in the Cisco Adaptive Security Appliance (ASA) device. The Equation Groups exploit for this was named EXTRABACON. [...] At RiskSense we had spare ASAs lying around in our red team lab, and my colleague Zachary Harding was extremely interested in exploiting this vulnerability. I told him if he got the ASAs properly configured for remote debugging I would help in the exploitation process. --------------------------------------------- https://zerosum0x0.blogspot.cz/2016/09/reverse-engineering-cisco-asa-for.ht… *** BENIGNCERTAIN-like flaw affects various Cisco networking devices *** --------------------------------------------- The leaking of BENIGNCERTAIN, an NSA exploit targeting a vulnerability in legacy Cisco PIX firewalls that allows attackers to eavesdrop on VPN traffic, has spurred Cisco to search for similar flaws in other products - and they found one. CVE-2016-6415 arises from insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. The IKE protocol is used in the Internet Protocol Security (IPsec) protocol suite to negotiate cryptographic... --------------------------------------------- https://www.helpnetsecurity.com/2016/09/19/beningcertain-cisco-networking-d… *** IKEv1 Information Disclosure Vulnerability in Multiple Cisco Products *** --------------------------------------------- A vulnerability in IKEv1 packet processing code in Cisco IOS, Cisco IOS XE and Cisco IOS XR Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information.The vulnerability is due to insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept... --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** iPrint Appliance 2.1 Hot Patch 2 *** --------------------------------------------- Abstract: iPrint Appliance 2.1 Hot Patch 2 is the first patch set for the iPrint Appliance version 2.1. Document ID: 5254950Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:iPrint-2.1.0.68.HP.zip (755.2 MB)Products:iPrint Appliance 2.1Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=AJTQmn_Q1yk~ *** iPrint Appliance 2.0 Hot Patch 2 *** --------------------------------------------- Abstract: Hot Patch 2 includes bug fixes, security fixes and a consolidation of previously released patches, including iPrint Appliance 2.0 Patch 2. Document ID: 5254970Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:iPrint-2.0.0.533.HP.zip (881.14 MB)Products:iPrint Appliance 2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=C1Xh-X9MGcc~ *** Forthcoming OpenSSL releases *** --------------------------------------------- The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.1.0a, 1.0.2i, 1.0.1u. These releases will be made available on 22nd September 2016 at approximately 0800 UTC. They will fix several security defects: one classfied as severity "high", one as "moderate", and the rest "low". --------------------------------------------- https://mta.openssl.org/pipermail/openssl-announce/2016-September/000076.ht… *** IBM Security Bulletin: Spice-server vulnerabilities affect IBM SmartCloud Entry (CVE-2016-0749 CVE-2016-2150 ) *** --------------------------------------------- SmartCloud Entry is vulerable to Spice-server vulnerabilities. Attackers could exploit them to cause improper bounds checking by smartcard interaction or bypass security restrictions CVE(s): CVE-2016-0749, CVE-2016-2150 Affected product(s) and affected version(s): IBM SmartCloud Entry 3.2 through Appliance fix pack 21 Refer to the following reference URLs for remediation and additional vulnerability details:Source Bulletin: http://www.ibm.com/support/docview.wss?uid=isg3T1024006X-Force... --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=isg3T1024006 *** IBM Security Bulletin: Vulnerability in openssl affects IBM System Networking Switch products (CVE-2016-2108) *** --------------------------------------------- IBM System Networking Switch products have addressed the following vulnerability in openssl. CVE(s): CVE-2016-2108 Affected product(s) and affected version(s): Product Affected Version IBM Flex System Fabric EN4093R 10Gb Scalable Switch 7.8.14.0 IBM Flex System Fabric CN4093 10Gb Converged Scalable Switch 7.8.14.0 IBM Flex System Fabric SI4093 System Interconnect Module 7.8.14.0 IBM Flex System EN2092 1Gb... --------------------------------------------- https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5099464 *** BINOM3 Electric Power Quality Meter Vulnerabilities *** --------------------------------------------- Topic: BINOM3 Electric Power Quality Meter Vulnerabilities Risk: Medium Text:*Universal multifunctional Electric Power Quality Meter BINOM3 - Multiple Vulnerabilities* *About* The meters are designed... --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090122 *** MyBB 1.8.6 Improper validation of data passed to eval *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090124 *** MyBB 1.8.6 CSRF Weak Hashing, Plaintext Passwords *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090126 *** MyBB 1.8.6 SQL Injection *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2016090125

1 0

Tageszusammenfassung - Freitag 16-09-2016
by Daily end-of-shift report 16 Sep '16

16 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 15-09-2016 18:00 − Freitag 16-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DSA-3668 mailman - security update *** --------------------------------------------- It was discovered that there was a CSRF vulnerability in mailman, aweb-based mailing list manager, which could allow an attacker to obtaina users password. --------------------------------------------- https://www.debian.org/security/2016/dsa-3668 *** Yokogawa STARDOM Authentication Bypass Vulnerability *** --------------------------------------------- This advisory contains mitigation details for an authentication bypass vulnerability in the Yokogawa STARDOM controller. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-259-01 *** ABB DataManagerPro Credential Management Vulnerability *** --------------------------------------------- This advisory contains mitigation details for a credential management vulnerability in ABB’s DataManagerPro application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-259-02 *** Trane Tracer SC Sensitive Information Exposure Vulnerability *** --------------------------------------------- This advisory contains mitigation details for an information exposure vulnerability in Trane U.S. Inc.’s Tracer SC field panel. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-16-259-03 *** Attack Leverages Windows Safe Mode *** --------------------------------------------- Researchers say a proof-of-concept attack using Windows Safe Mode can lead to credential theft and allow hackers to move laterally within a corporate network. --------------------------------------------- http://threatpost.com/attack-leverages-windows-safe-mode/120622/ *** Ransomware Getting More Targeted, Expensive *** --------------------------------------------- I shared a meal not long ago with a source who works at a financial services company. The subject of ransomware came up and he told me that a server in his .. --------------------------------------------- http://krebsonsecurity.com/2016/09/ransomware-getting-more-targeted-expensi… *** DSA-3670 tomcat8 - security update *** --------------------------------------------- Dawid Golunski of LegalHackers discovered that the Tomcat init scriptperformed unsafe file handling, which could result in local privilegeescalation. --------------------------------------------- https://www.debian.org/security/2016/dsa-3670 *** DSA-3669 tomcat7 - security update *** --------------------------------------------- Dawid Golunski of LegalHackers discovered that the Tomcat init scriptperformed unsafe file handling, which could result in local privilegeescalation. --------------------------------------------- https://www.debian.org/security/2016/dsa-3669 *** Necurs – the Heavyweight Malware Spammer *** --------------------------------------------- Today we want to dwell upon a pesky botnet that goes by the name of Necurs, and in particular its spamming activities. The botnet has been responsible for a massive .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Necurs-%e2%80%93-the-Heavywe… *** Trend Micro Internet Security vulnerability where files may be excluded as scan targets *** --------------------------------------------- Trend Micro Internet Security provided by Trend Micro Incorporated contains a vulnerability where arbitrary files or folders may be excluded as scan targets. --------------------------------------------- http://jvn.jp/en/jp/JVN98126322/ *** Splunk Enterprise and Splunk Lite vulnerable to cross-site scripting *** --------------------------------------------- Splunk Enterprise and Splunk Lite contain a cross-site scripting vulnerability.Note that this vulnerability is different from JVN#74244518. --------------------------------------------- http://jvn.jp/en/jp/JVN71462075/ *** Gefährliche Inhalte effektiver erkennen: Google baut Webseiten-Scan aus *** --------------------------------------------- Webmaster können ihre Seiten nun noch tiefgehender nach unter anderem Malware-Verweisen und gefährlichen Downloads durchsuchen lassen. --------------------------------------------- http://heise.de/-3325042 *** Erste Sicherheitslücken im Krypto-Messenger Signal entdeckt *** --------------------------------------------- Ein Programmierfehler in Signal erlaubt die Manipulation von Dateianhängen. Über einen zweiten hätten Angreifer Schadcode aus der Ferne einschleusen können, hätte ein dritter Bug diesen Angriff nicht verhindert. --------------------------------------------- http://heise.de/-3325242 *** Erpressungstrojaner: Stampado verschlüsselt von Ransomware verschlüsselte Dateien *** --------------------------------------------- Ein neuer Erpressungstrojaner hat eine besonders gemeine Taktik: Verschlüsselt werden Dateien, die bereits von anderer Ransomware verschlüsselt wurden. Zum Glück gibt es Abhilfe. --------------------------------------------- http://www.golem.de/news/erpressungstrojaner-stampado-verschluesselt-von-ra…

1 0

Tageszusammenfassung - Donnerstag 15-09-2016
by Daily end-of-shift report 15 Sep '16

15 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 14-09-2016 18:00 − Donnerstag 15-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco IOS and IOS XE Software IOx Local Manager Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web framework code of the Cisco Local Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco WebEx Meetings Server Remote Command Execution Vulnerability *** --------------------------------------------- A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to bypass security restrictions on a host located in a DMZ and inject arbitrary commands on a targeted system.The vulnerability is due .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified Computing System Command Line Interface Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the command-line interface (CLI) of the Cisco Unified Computing System (UCS) Manager and UCS 6200 Series Fabric Interconnects could allow an authenticated, local attacker to access the underlying operating system .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Fog Director for IOx Arbitrary File Write Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Fog Director for IOx could allow an authenticated, remote attacker to write a file to arbitrary locations. The vulnerability is due to insufficient input validation. An attacker could exploit this .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** iOS 10 schließt Sicherheitslücken in Tastatur und Sandbox *** --------------------------------------------- Das Update auf iOS 10.0.1 räumt sieben Schwachpunkte aus, darunter eine mögliche Preisgabe 'sensibler Informationen' durch die Autokorrektur des Keyboards. watchOS 3 stopft eine Lücke. --------------------------------------------- http://heise.de/-3323066 *** DSA-3666 mysql-5.5 - security update *** --------------------------------------------- Dawid Golunski discovered that the mysqld_safe wrapper provided by theMySQL database server insufficiently restricted the load path for custommalloc implementations, which could result in privilege escalation. --------------------------------------------- https://www.debian.org/security/2016/dsa-3666 *** Science press site hacked; hackers release .. random crap *** --------------------------------------------- http://arstechnica.com/science/2016/09/science-press-site-hacked-hackers-re… *** Cryptocurrencies a Target for Cybercriminals, Part 1: the Risks of Innovation *** --------------------------------------------- All cryptocurrencies are a target for cybercriminals. Anywhere there is value, criminals, fraudsters, and charlatans will soon follow. Call it the Willie Sutton principle. Sutton, a famous bank robber in the 1920s–30s, was asked why he .. --------------------------------------------- https://blogs.mcafee.com/mcafee-labs/cryptocurrencies-a-target-for-cybercri… *** Russian Hackers Get Bolder in Anti-Doping Agency Attack *** --------------------------------------------- The attack on the World Anti-Doping Agency, following the DNC hack, signals Russian hackers emerging from the shadows to brazenly flaunt their work. --------------------------------------------- https://www.wired.com/2016/09/anti-doping-agency-attack-shows-russian-hacke… *** Virtueller Schiffsdiebstahl bei Star Citizen *** --------------------------------------------- Im bisher noch unfertigen Weltraumepos Star Citizen kann man für hunderte Euros virtuelle Raumschiffe kaufen. Nun häufen sich anscheinend Angriffe auf die Konten der Spieler, mit dem Ziel, diese Schiffe zu klauen. --------------------------------------------- http://heise.de/-3323060 *** DSA-3667 chromium-browser - security update *** --------------------------------------------- https://www.debian.org/security/2016/dsa-3667 *** Erpressungs-Trojaner Locky nun mit Autopilot *** --------------------------------------------- Sicherheitsforschern zufolge kann Locky sein Schadenswerk jetzt auch offline ohne Kontakt zum Command-and-Control-Server der Kriminellen verrichten. --------------------------------------------- http://heise.de/-3324553

1 0

Tageszusammenfassung - Mittwoch 14-09-2016
by Daily end-of-shift report 14 Sep '16

14 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 13-09-2016 18:00 − Mittwoch 14-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MS16-SEP - Microsoft Security Bulletin Summary for September 2016 - Version: 1.0 *** --------------------------------------------- This bulletin summary lists security bulletins released for September 2016. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS16-SEP *** Announcing the Project Zero Prize *** --------------------------------------------- Posted by Natalie Silvanovich, Exploit EnthusiastDespite the existence of vulnerability rewards programs at Google and other companies, many unique, high-quality security bugs have been discovered as a result of hacking contests. Hoping to continue the stream of great bugs, we've decided to start our own contest: The Project Zero Prize.The goal of this contest is to find a vulnerability or bug chain that achieves remote code execution on multiple Android devices knowing only the... --------------------------------------------- http://googleprojectzero.blogspot.com/2016/09/announcing-project-zero-prize… *** MSRT September 2016 release feature: Prifou *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the Microsoft Malicious Software Removal Tool (MSRT) release this September includes detections for: BrowserModifier:Win32/Prifou TrojanClicker:Win32/NightClick Trojan:Win32/Suweezy Trojan:Win32/Xadupi This blog discusses BrowserModifier:Win32/Prifou (Prifou). Windows Defender detects this threat because it limits your choice and control over your browser and operating system. The unwanted behaviors... --------------------------------------------- https://blogs.technet.microsoft.com/mmpc/2016/09/13/msrt-september-2016-rel… *** Angst vor Spam: Swisscom deaktiviert mehrere Tausend Mailaccounts *** --------------------------------------------- Weil die Kunden zu einfache E-Mail-Passwörter gewählt hatten, sperrte die Swisscom Tausende Accounts. Das Unternehmen fürchtet offenbar, sonst auf Spam-Blacklists von Google oder anderen Providern zu landen. Die Kunden müssen nun aktiv werden. --------------------------------------------- http://www.golem.de/news/angst-vor-spam-swisscom-deaktiviert-mehrere-tausen… *** Letzter klassischer Microsoft-Patchday bringt sieben kritische Updates *** --------------------------------------------- Heute können Windows-Admins zum letzten Mal auswählen, welche Windows-Updates sie am monatlichen Patchday installieren wollen. Ab nächsten Monat gibt es dann nur noch monolithische Rollup-Pakete. --------------------------------------------- http://heise.de/-3321310 *** Adobe-Patchday: Flash jetzt patchen! *** --------------------------------------------- Kritische Lücken im Flash Player erlauben das Kapern von Rechnern. Adobe hat Updates veröffentlicht, um diese zu stopfen. Ebenso erhalten die eBook-Software Digital Editions und die Entwicklungswerkzeuge von AIR Patches. --------------------------------------------- http://heise.de/-3321895 *** Rio 2016: Fancybear veröffentlicht medizinische Daten von US-Sportlern *** --------------------------------------------- Vertrauliche medizinische Daten von US-Sportlern stehen im Netz. Angeblich russische Hacker haben mehrere Datensätze veröffentlicht, die Unregelmäßigkeiten bei Dopingkontrollen beweisen sollen. Die Wada ist entsetzt - und spricht von legalen Ausnahmegenehmigungen. --------------------------------------------- http://www.golem.de/news/rio-2016-fancybear-veroeffentlicht-medizinische-da… *** Exploit Attempts for Drupal RESTWS .x Module Vulnerability, (Wed, Sep 14th) *** --------------------------------------------- Attackers usually dont have to worry much about Drupal administrators applying patches. The majority of exploit attempts I see in our honeypots use pretty ancient vulnerabilities. So I was happy to see a script kiddie go the extra mile and use a vulnerabilityreleased in July of this year [1] [2]. The vulnerability itself is very straight forward. The attacker can send arbitrary php code that will be executed on the server. No special encoding beyond URL encoding appears to be required. Here is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21481&rss *** Geldautomaten: Hintermann von Skimmingbande muss fünf Jahre in Haft *** --------------------------------------------- Eine Skimmingbande hat in Sachsen fast 270.000 Euro mit gefälschten Bankkarten erbeutet. Die Tat fand bereits im Jahr 2011 statt, nun wurde ein Hintermann der Gruppe zu einer Freiheitsstrafe verurteilt. --------------------------------------------- http://www.golem.de/news/geldautomaten-hintermann-von-skimmingbande-muss-fu…

1 0

Tageszusammenfassung - Dienstag 13-09-2016
by Daily end-of-shift report 13 Sep '16

13 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Montag 12-09-2016 18:00 − Dienstag 13-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** FortiClient Unencrypted Password Vulnerability *** --------------------------------------------- FOne of the processes in FortiClient stores VPN credentials unencrypted in memory. A malicious attacker who compromised the workstation could dump the credentials. --------------------------------------------- http://fortiguard.com/advisory/FG-IR-16-021 *** FortiClient DLL Hijacking vulnerability *** --------------------------------------------- When executed, the FortiClient installer (FortiClientOnlineInstaller.exe), if downloaded before August 11th, 2016 (build 0842), would attempt to load DLLs from the directory where it resides. --------------------------------------------- http://fortiguard.com/advisory/FG-IR-16-046 *** Türkische Hacker griffen offenbar österreichische Nationalbank an *** --------------------------------------------- Es handelt sich laut Kurier um dieselbe Gruppe, die schon den Flughafen Wien-Schwechat angegriffen hat --------------------------------------------- http://derstandard.at/2000044275176 *** Gefälschte A1 Online Rechnung im Postfach *** --------------------------------------------- Mit vermeintlichen papierlosen A1 Rechnungen wollen Kriminelle, dass Empfänger/innen eine Website aufrufen und dort die Datei „A1_rechnung.zip“ öffnen. Sie verbirgt Schadsoftware. Wer diese ausführt, installiert Programme, die den Computer unbrauchbar machen oder Bankdaten stehlen. Am sichersten ist es, wenn Sie die Nachrichten löschen. --------------------------------------------- https://www.watchlist-internet.at/gefaelschte-rechnungen/gefaelschte-a1-onl… *** Cache Flooding in TYPO3 Frontend *** --------------------------------------------- It has been discovered, that TYPO3 is vulnerable to Cache Flooding --------------------------------------------- https://typo3.org/news/article/cache-flooding-in-typo3-frontend/ *** DualToy: New Windows Trojan Sideloads Risky Apps to Android and iOS Devices *** --------------------------------------------- Over the past two years, we’ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices. This attack vector is increasingly .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2016/09/dualtoy-new-windows-troj… *** Sicherheits-Updates für Xen-Hypervisor *** --------------------------------------------- Insgesamt vier Sicherheitslücken erfordern Updates. Für Debian, Oracle VM und Fedora gibt es aktualisierte Pakete. --------------------------------------------- http://heise.de/-3319523 *** "Pokémon Go": Fake-App spioniert Millionen Smartphones aus *** --------------------------------------------- Spionieren Internet-Daten der User aus und installieren Adware auf dem Smartphone --------------------------------------------- http://derstandard.at/2000044305667 *** Antivirenentwickler: John McAfee soll Morde und Vergewaltigung begangen haben *** --------------------------------------------- Ein Dokumentarfilm erhebt schwere Anschuldigungen gegen John McAfee. Während seiner Zeit in Belize soll er zwei Männer getötet und eine Frau vergewaltigt haben. McAfee bestreitet alle Vorwürfe und unterstellt dem Filmteam Bestechung von Quellen. --------------------------------------------- http://www.golem.de/news/antiviren-entwickler-john-mcafee-soll-morde-und-ve… *** Neutrino EK’s Afraidgate pushed in malvertising attack *** --------------------------------------------- With a rise in malvertising attacks lately, we take a look at an ad server pushing the Afraidgate, traditionally found on compromised sites. --------------------------------------------- https://blog.malwarebytes.com/cybercrime/exploits/2016/09/neutrino-eks-afra… *** Security Bulletins Posted *** --------------------------------------------- Adobe has published security bulletins for Adobe Digital Editions (APSB16-28), Adobe Flash Player (APSB16-29) and Adobe AIR SDK & Compiler (APSB16-31). Adobe recommends users update their product installations to the latest versions using .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1399

1 0

Tageszusammenfassung - Montag 12-09-2016
by Daily end-of-shift report 12 Sep '16

12 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Freitag 09-09-2016 18:00 − Montag 12-09-2016 18:00 Handler: Alexander Riepl Co-Handler: n/a *** DSA-3664 pdns - security update *** --------------------------------------------- Multiple vulnerabilities have been discovered in pdns, an authoritativeDNS server. The Common Vulnerabilities and Exposures project identifies .. --------------------------------------------- https://www.debian.org/security/2016/dsa-3664 *** WordPress 4.6.1 stopft zwei Lücken *** --------------------------------------------- Die Hersteller des CMS WordPress empfehlen, das Update auf WordPress 4.6.1 schnellstmöglich einzuspielen, da es zwei gefährliche Sicherheitslücken schließt. Installationen mit Auto-Update haben die neue Version automatisch in den vorigen Tagen bekommen. --------------------------------------------- http://heise.de/-3317796 *** OSX.Mokes: Mächtige Mac-Malware entdeckt *** --------------------------------------------- Ermöglicht Angreifern weitreichende Überwachung – sucht zudem System nach Daten ab --------------------------------------------- http://derstandard.at/2000044172706 *** Android: Google-Sicherheitspatch vom September stopft erneute Stagefright-Lücke *** --------------------------------------------- Google behebt im Security Bulletin vom September mehrere Fehler in Android, darunter eine vom eigenen Team Zero gefundene Erweiterung des Stagefright-Bugs. Der Patch ist an die Hersteller ausgeliefert, einige haben schon Updates bereitgestellt. --------------------------------------------- http://heise.de/-3317825 *** Sicherheitsexperten finden IoT-Botnet *** --------------------------------------------- Eine Linux-Malware greift aktuell IoT-Geräte wie IP-Kameras mit veralteter Firmware an. Das Besondere an diesem Schädling: Nach der Infektion verwischt er seine Spuren und bleibt nur im Arbeitsspeicher der Geräte präsent. Das erschwert die Analyse. --------------------------------------------- http://heise.de/-3317830 *** WooCommerce <= 2.6.3 - Stored Cross Site Scripting (XSS) via REST API *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8619 *** l+f: Anti-ROP Mainframe-Style *** --------------------------------------------- Nach Intel, Microsoft, OpenBSD und diversen anderen stellt nun auch IBM seine eigene Anti-ROP-Technik vor. --------------------------------------------- http://heise.de/-3317746 *** USB Killer: 50-Dollar-Stick zerstört Computer beim Anstecken *** --------------------------------------------- Version 2.0 des Sticks veröffentlicht – Hochspannungsimpuls führt zu irreparablem Schaden --------------------------------------------- http://derstandard.at/2000044216572 *** Gugi: from an SMS Trojan to a Mobile-Banking Trojan *** --------------------------------------------- In the previous article, we described the mechanisms used by Trojan-Banker.AndroidOS.Gugi.c to bypass a number of new Android 6 security features. In this article, we review the entire Gugi mobile-banking Trojan family in more detail. --------------------------------------------- http://securelist.com/blog/mobile/76023/gugi-from-an-sms-trojan-to-a-mobile… *** Vdos: Betreiber des größten DDoS-Anbieters in Israel verhaftet *** --------------------------------------------- Der Hack eines DDoS-Anbieters zeigt: Die Vermietung von Angriffskapazitäten ist ein einträgliches Geschäft. Ironischerweise versuchen die Anbieter, sich hinter dem DDoS-Schutz Cloudflare zu verstecken. Die Betreiber wurden mittlerweile in Israel festgenommen. --------------------------------------------- http://www.golem.de/news/vdos-betreiber-des-groessten-ddos-anbieters-in-isr… *** Remote Root Code Execution / Privilege Escalation (0day) *** --------------------------------------------- An independent research has revealed multiple severe MySQL vulnerabilities. This advisory focuses on a critical vulnerability with a CVEID of CVE-2016-6662 which can allow attackers to (remotely) inject malicious settings into MySQL configuration files (my.cnf) leading to critical consequences. --------------------------------------------- http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution… *** DSA-3665 openjpeg2 - security update *** --------------------------------------------- Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression /decompression library, may result in denial of service or the executionof arbitrary code if a malformed JPEG 2000 file is processed. --------------------------------------------- https://www.debian.org/security/2016/dsa-3665 *** Linux Malware: Novelties in the Threat Landscape *** --------------------------------------------- In the last couple of years, security firms have observed an increasing number of malware specifically designed to target Linux-based systems. Linux, like .. --------------------------------------------- http://resources.infosecinstitute.com/linux-malware-novelties-threat-landsc… *** Payment Card Industry Council: Kreditkartenterminals bald mit Firmware-Update *** --------------------------------------------- Skimming, Kreditkartenbetrug und manipulierte Bezahlterminals: Der Sicherheitstandard für EC- und Kreditkartenterminals wird überarbeitet. Künftig sollen die Geräte signierte Updates erhalten und gegen Laser resistent werden. --------------------------------------------- http://www.golem.de/news/payment-card-industry-council-kreditkartenterminal… *** LuaBot: Malware targeting cable modems *** --------------------------------------------- CERT/CC released the Vulnerability Note VU#419568 and it got lots of media coverage. I did not provide any POCs during that time because I was pretty sure that those vulnerabilities were easily wormable... And guess what? Someone is actively exploiting those devices since May/2016. --------------------------------------------- https://w00tsec.blogspot.co.at/2016/09/luabot-malware-targeting-cable-modem…

1 0

Tageszusammenfassung - Freitag 9-09-2016
by Daily end-of-shift report 09 Sep '16

09 Sep '16

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 08-09-2016 18:00 − Freitag 09-09-2016 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Cisco ACE30 Application Control Engine Module and Cisco ACE 4710 Application Control Engine Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the SSL/TLS functions of the Cisco ACE30 Application Control Engine Module and the Cisco ACE 4700 Series Application Control Engine Appliances could allow an unauthenticated, remote attacker to cause a denial of .. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3662 inspircd - security update *** --------------------------------------------- It was discovered that incorrect SASL authentication in the InspircdIRC server may lead to users impersonating other users. --------------------------------------------- https://www.debian.org/security/2016/dsa-3662 *** ZDI-16-505: AlienVault Unified Security Management get_directive_kdb directive_id SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-505/ *** ZDI-16-504: AlienVault Unified Security Management Multiple PHP Scripts Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AlienVault Unified Security Management. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-16-504/ *** Multiple Security Vulnerabilities in Citrix NetScaler Platform IPMI Lights Out Management (LOM) firmware *** --------------------------------------------- A number of security vulnerabilities have been identified in firmware used in the Lights Out Management (LOM) component across all NetScaler .. --------------------------------------------- http://support.citrix.com/article/CTX216642 *** iPrint Appliance 2.0 Hot Patch 1 *** --------------------------------------------- https://download.novell.com/Download?buildid=S7GK9olwBDk~ *** iPrint Appliance 2.1 Hot Patch 1 *** --------------------------------------------- https://download.novell.com/Download?buildid=lVbNSynhgHU~ *** Asterisk RTP Session Management Bug Lets Remote Authenticated Users Consume Excessive Resources on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036750 *** Asterisk Error in Processing Unknown Endpoints Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- http://www.securitytracker.com/id/1036749 *** Collecting Users Credentials from Locked Devices, (Fri, Sep 9th) *** --------------------------------------------- Its a fact: When a device can be physically accessed, you may consider it as compromised. And if the device is properly hardened, its just a matter of time. The best .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21461 *** Samsung Android Security Updates *** --------------------------------------------- SMR-SEP-2016 - Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung. --------------------------------------------- http://security.samsungmobile.com/smrupdate.html *** Picture Perfect: CryLocker Ransomware Uploads User Information as PNG Files *** --------------------------------------------- Taking advantage of legitimate sites for command-and-control (C&C) purposes is typically done by most malware to avoid rousing suspicion from their targets. While .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/picture-perfect-… *** Your Seagate Central NAS could be hosting mining malware *** --------------------------------------------- If you have discovered cryptocurrency mining malware on your system, have removed it, and got compromised again without an idea about how it happened, it could be that the .. --------------------------------------------- https://www.helpnetsecurity.com/2016/09/09/seagate-central-nas-hosting-malw… *** Chrome soll vor nicht verschlüsselnden Webseiten warnen *** --------------------------------------------- Zunächst brandmarkt der Browser nur Seiten, die Passwörter oder Kreditkarteninformationen enthalten. Nach und nach soll die Warnung dann ausgeweitet werden. --------------------------------------------- http://heise.de/-3317393 *** Red Hat JBoss Enterprise Application Platform Input Validation Flaw Lets Remote Users Conduct HTTP Response Splitting and Content Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036758 *** HTTPS: Google Chrome will vor unverschlüsselten Webseiten warnen *** --------------------------------------------- Wie umgehen mit unverschlüsselten Webseiten? Google will in Chrome künftig warnen, wenn unverschlüsselte Webseiten Passwörter und Kreditkartendaten abfragen. Doch das ist nur der Beginn der Planungen. --------------------------------------------- http://www.golem.de/news/https-google-chrome-will-vor-unverschluesselten-we… *** Asterisk RTP Session Management Bug Lets Remote Authenticated Users Consume Excessive Resources on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1036750 *** Asterisk Error in Processing Unknown Endpoints Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- http://www.securitytracker.com/id/1036749 *** Collecting Users Credentials from Locked Devices, (Fri, Sep 9th) *** --------------------------------------------- Its a fact: When a device can be physically accessed, you may consider it as compromised. And if the device is properly hardened, its just a matter of time. The best .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=21461 *** Samsung Android Security Updates *** --------------------------------------------- SMR-SEP-2016 - Samsung Mobile is releasing a maintenance release for major flagship models as part of monthly Security Maintenance Release (SMR) process. This SMR package includes patches from Google and Samsung. --------------------------------------------- http://security.samsungmobile.com/smrupdate.html *** Picture Perfect: CryLocker Ransomware Uploads User Information as PNG Files *** --------------------------------------------- Taking advantage of legitimate sites for command-and-control (C&C) purposes is typically done by most malware to avoid rousing suspicion from their targets. While .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/picture-perfect-… *** Your Seagate Central NAS could be hosting mining malware *** --------------------------------------------- If you have discovered cryptocurrency mining malware on your system, have removed it, and got compromised again without an idea about how it happened, it could be that the .. --------------------------------------------- https://www.helpnetsecurity.com/2016/09/09/seagate-central-nas-hosting-malw… *** Chrome soll vor nicht verschlüsselnden Webseiten warnen *** --------------------------------------------- Zunächst brandmarkt der Browser nur Seiten, die Passwörter oder Kreditkarteninformationen enthalten. Nach und nach soll die Warnung dann ausgeweitet werden. --------------------------------------------- http://heise.de/-3317393 *** Red Hat JBoss Enterprise Application Platform Input Validation Flaw Lets Remote Users Conduct HTTP Response Splitting and Content Injection Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1036758

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily