- Daily - CERT.at

Tageszusammenfassung - Freitag 25-09-2015
by Daily end-of-shift report 25 Sep '15

25 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 24-09-2015 18:00 − Freitag 25-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Google's Three Tips for Sabotaging the Cybercrime Economy *** --------------------------------------------- In a broad study, a team of Googlers and academic researchers suggest attacking the cybercrime supply chain.The post Google's Three Tips for Sabotaging the Cybercrime Economy appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/google-offers-3-lessons-crippling-online-crime… *** Facebook-Betrüger locken mit Dislike-Button *** --------------------------------------------- Klicken Sie hier, wenn Sie als Erster den neuen Dislike-Knopf testen wollen: So funktioniert eine neue Betrugsmasche auf Facebook. Auf den Link sollten Sie aber nicht klicken. --------------------------------------------- http://futurezone.at/digital-life/facebook-betrueger-locken-mit-dislike-but… *** Multiple XSS vulnerabilities in FortiManager GUI *** --------------------------------------------- http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortiman… *** Microsoft puts a bullet in blundering D-Links leaked key that made malware VIPs on PCs *** --------------------------------------------- Private code-signing cert revoked at last Microsoft has finally revoked D-Links leaked code-signing key, which gave malware the red carpet treatment on millions of Windows PCs. --------------------------------------------- www.theregister.co.uk/2015/09/24/dlink_key_revoked/ *** SSL Malvertising Campaign Targets Top Adult Sites *** --------------------------------------------- A long running malvertising campaign hits major adult sites with a carefully crafted advert. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/ssl-malvertising-campa… *** Cryptowar: Hintertür für verschlüsselte Smartphone-Daten gesucht *** --------------------------------------------- Experten haben im Auftrag der US-Regierung darüber nachgedacht, wie Behörden Zugang zu verschlüsselten Daten auf Smartphones bekommen können - und vier Optionen entwickelt. Doch alle bringen große technische Probleme mit sich. --------------------------------------------- http://www.golem.de/news/cryptowar-hintertuer-fuer-verschluesselte-smartpho… *** Security: Cookies können Sicherheitslücke sein *** --------------------------------------------- Alle gängigen Browser sind über manipulierte Cookies angreifbar. Angreifer können mit einem Man-in-the-Middle-Angriff vertrauliche Nutzerdaten auslesen. --------------------------------------------- http://www.golem.de/news/security-cookies-sind-eine-sicherheitsluecke-1509-… *** Windows 10 IoT: Verschlüsselung für das Internet der Dinge *** --------------------------------------------- Nutzer von IoT-Core können ihre Daten künftig mit Bitlocker verschlüsseln und Elektromotoren steuern. Ausserdem kann das Betriebssystem jetzt im Paket mit dem Raspberry-Pi 2 bestellt werden. --------------------------------------------- http://www.golem.de/news/windows-10-iot-verschluesselung-fuer-das-internet-… *** Aktuelle Masche: Spam über Bande *** --------------------------------------------- Durch den Missbrauch von Beschwerde-Formularen oder Bug-Tracking-Systemen umgehen Spammer die Spam-Filter - auch die mühsam antrainierten der Anwender. --------------------------------------------- http://heise.de/-2826159 *** Endress+Hauser Fieldcare/CodeWrights HART Comm DTM XML Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities within the Endress+Hauser HART DTM software libraries. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-267-01 *** Belkin vergisst PGP-Schlüssel in Lichtschalter-Firmware *** --------------------------------------------- Ein Lichtschalter mit Linux-Firmware. Praktisch, dachte sich Linux-Kernelentwickler Matthew Garrett und warf einen Blick auf die Software. Was er fand, überraschte ihn allerdings sehr: Den PGP-Key, mit dem Belkin seine Firmware unterschreibt. --------------------------------------------- http://heise.de/-2826218 *** l+f: Ormandy auf Killing Spree *** --------------------------------------------- Nach NOD32 und Kaspersky ist nun Avast an der Reihe. --------------------------------------------- http://heise.de/-2826654

1 0

Tageszusammenfassung - Donnerstag 24-09-2015
by Daily end-of-shift report 24 Sep '15

24 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 23-09-2015 18:00 − Donnerstag 24-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco IOS and IOS XE Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability *** --------------------------------------------- A vulnerability in the SSH version 2 (SSHv2) protocol implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass user authentication. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco AnyConnect Secure Mobility Client for Linux and Mac OS X Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the code responsible for the self-updating feature of Cisco AnyConnect Secure Mobility Client for Linux and the Cisco AnyConnect Secure Mobility Client for Mac OS X could allow an authenticated, local .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41135 *** Bidding for Breaches, Redefining Targeted Attacks *** --------------------------------------------- A growing community of private and highly-vetted cybercrime forums is redefining the very meaning of "targeted attacks." These bid-and-ask forums match crooks who are looking for access to specific data, resources or systems within major corporations with hired muscle who are up to the task or who already have access to those resources. --------------------------------------------- http://krebsonsecurity.com/2015/09/bidding-for-breaches-redefining-targeted… *** Custom Sidebars 2.1.0.1 - XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8196 *** Multiple vulnerabilities in Kaseya Virtual System Administrator *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-450/ http://www.zerodayinitiative.com/advisories/ZDI-15-449/ http://www.zerodayinitiative.com/advisories/ZDI-15-448/ *** Healthcare Organizations Twice As Likely To Experience Data Theft *** --------------------------------------------- Bad guys very willing to invest in attacking medical data, but healthcare not very willing to invest in defending it. --------------------------------------------- http://www.darkreading.com/risk/healthcare-organizations-twice-as-likely-to… *** Chinese Actors Use '3102' Malware in Attacks on US Government and EU Media *** --------------------------------------------- On May 6 and May 11, 2015, Unit 42 observed two targeted attacks, the first against the U.S. government and the second on a European media company. Threat actors delivered the same document via .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/09/chinese-actors-use-3102-… *** An Update on Nuclear (Reverse) Engineering *** --------------------------------------------- Although Angler continues to be the leading exploit kit, Nuclear is a significant threat to web surfers and seems to have been very active lately. ThreatLabZ recently encountered a Nuclear campaign originating from a variety of compromised .. --------------------------------------------- http://research.zscaler.com/2015/09/an-update-on-nuclear-reverse-engineerin… *** Quaverse RAT: Remote-Access-as-a-Service *** --------------------------------------------- Quaverse RAT or QRAT is a fairly new Remote Access Tool (RAT) introduced in May 2015. This RAT is marketed as an undetectable Java RAT. As you might expect from a RAT, the tool is capable of grabbing passwords, .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Ac… *** UltraEdit 22.20 Buffer Overflow *** --------------------------------------------- https://cxsecurity.com/issue/WLB-2015090142 *** Fingerabdrücke von Millionen US-Bediensteten gestohlen *** --------------------------------------------- Eine China zugeschriebene Hacker-Attacke auf die US-Bundespersonalbehörde OPM war noch schwerer als ohnehin schon gedacht. Demnach verschafften sich die Cyber-Angreifer neben .. --------------------------------------------- http://derstandard.at/2000022711754 *** Tracking Administrator Sessions in Windows Environments *** --------------------------------------------- Tracking users with privileged access is a critical task in your security policy (SANS Critical Security Control #12). If the key point is to restrict the number of 'power users' to the lowest, it's not always easy. Most of them .. --------------------------------------------- https://blog.rootshell.be/2015/09/24/tracking-administrator-sessions-in-win… *** Exploiting Corporate Printers *** --------------------------------------------- Printer exploitation and vulnerability in printers are serious problems, similar to those faced with computers and other hard drive devices, since they are connected to the network like other devices. Nowadays, most corporate offices or organizations .. --------------------------------------------- http://resources.infosecinstitute.com/exploiting-corporate-printers/ *** General HTML5 Security *** --------------------------------------------- HTML5 is a living standard and new features are being added as we speak. New features will continue to arrive and browsers will keep becoming better and better at supporting them. However, those new features also bring with them new opportunities for .. --------------------------------------------- http://resources.infosecinstitute.com/general-html5-security/ *** XcodeGhost: Apple veröffentlicht "Top 25" der infizierten Apps *** --------------------------------------------- Apple hat die 25 populärsten unter den kompromittierten Apps genannt, für manche ist bereits ein Update erhältlich. Die Einschätzungen zur Gesamtzahl der durch XcodeGhost betroffenen iOS-Programme variieren weiterhin deutlich. --------------------------------------------- http://heise.de/-2824927 *** Kovter malware learns from Poweliks with persistent fileless registry update *** --------------------------------------------- A variant of the Kovter malware is the first to use Trojan.Poweliks' pioneering tricks by residing only in the registry to evade detection. --------------------------------------------- http://www.symantec.com/connect/blogs/kovter-malware-learns-poweliks-persis… *** One Year After Shellshock, Are Your Servers and Devices Safer? *** --------------------------------------------- Security researchers were the first to respond during the Shellshock attacks of 2014. After news of the fatal flaw in the prevalent Bash (Bourne Again Shell)- found in most versions of the Unix and Linux operating systems as well as in Mac OSX - was released, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/one-year-after-s…

1 0

Tageszusammenfassung - Mittwoch 23-09-2015
by Daily end-of-shift report 23 Sep '15

23 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 22-09-2015 18:00 − Mittwoch 23-09-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Cisco AnyConnect Secure Mobility Client for Windows Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41136 *** Bypass Developed for Microsoft Memory Protection, Control Flow Guard *** --------------------------------------------- A researcher at Bromium is expected at DerbyCon to disclose a memory corruption mitigation bypass of Microsoft Control Flow Guard. --------------------------------------------- http://threatpost.com/bypass-developed-for-microsoft-memory-protection-cont… *** Hack Brief: Mobile Manager's Security Hole Would Let Hackers Wipe Phones *** --------------------------------------------- The vulnerability in the SAP Afaria mobile management system affected all mobile phones used by 6,300 companies. --------------------------------------------- http://www.wired.com/2015/09/hack-brief-popular-mobile-phone-manager-open-l… *** Cisco TelePresence Video Communication Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41128 *** Making our users unlearn what we taught them, (Wed, Sep 23rd) *** --------------------------------------------- Remember back in the ancient days, when macro viruses were rampant, and we security geeks instructed our flock of virus scared users to never click on a .DOC attachment in an email, but that a .PDF was perfectly fine? Fast forward a couple .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20177 *** Hackers upload bot code to Imgur in 8Chan attack *** --------------------------------------------- A nasty vulnerability in Imgur was used by attackers to hide malicious code in images, commandeer visitors browsers, and hose the 4Chan and 8Chan image .. --------------------------------------------- www.theregister.co.uk/2015/09/23/imgur_attack/ *** New security features in HPs printers can detect rogue BIOS and firmware modifications *** --------------------------------------------- HP refers to this capability as "self-healing security," but its actually a set of code integrity checking mechanisms that security researchers have asked embedded .. --------------------------------------------- http://www.infoworld.com/article/2985389/printers/hp-adds-protection-agains… *** Kaspersky: Mo Unpackers, Mo Problems. *** --------------------------------------------- As well as fuzzing, I've been auditing and reviewing the design, resulting in identifying multiple major flaws that Kaspersky are actively working on resolving. These issues affect everything from network intrusion detection, ssl interception .. --------------------------------------------- http://googleprojectzero.blogspot.de/2015/09/kaspersky-mo-unpackers-mo-prob… *** PHP Malware Finder *** --------------------------------------------- PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. ... Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, its that simple! --------------------------------------------- https://github.com/nbs-system/php-malware-finder *** .htaccess Tricks in Global.asa Files *** --------------------------------------------- As you might know a lot of hacks use Apache configuration .htaccess files to override default web site behavior: add conditional redirects, create virtual paths (e.g mod_rewrite), auto-append code to PHP scripts, etc. In the world of IIS/ASP there is also an equivalent - Global.asa .. --------------------------------------------- https://blog.sucuri.net/2015/09/htaccess-tricks-in-global-asa-files.html *** XCodeGhost iOS app infection toll rises to FOUR THOUSAND *** --------------------------------------------- The number of XCodeGhost-infected iOS apps, initially pegged at 39, has exploded to more than 4,000. ... The Register has asked FireEye for the names of some of the prominent affected .. --------------------------------------------- http://www.theregister.co.uk/2015/09/23/xcodeghost_ios_app_infection_toll_r… *** iOS 9: Erneut Umgehung der Gerätesperre möglich *** --------------------------------------------- Neues Betriebssystem, neuer Trick: Erneut wurde ein Lockscreen-Bug entdeckt, mit dem der Zugriff auf Daten von iPhone & Co. auch ohne Eingabe von PIN-Code oder Fingerabdruckfreigabe möglich ist. --------------------------------------------- http://heise.de/-2824001 *** Security: Lenovo sammelt seit fast einem Jahr Nutzerdaten *** --------------------------------------------- Ein dritter Fall von fraglichem Umgang mit Nutzerdaten ist bei Lenovo bekanntgeworden. Auf Geräten der Thinkpad-, Thinkcentre- und Thinkstation-Modellreihen kann sich Lenovo-Software befinden, die seit fast einem Jahr das Nutzerverhalten beobachtet. --------------------------------------------- http://www.golem.de/news/security-lenovo-sammelt-nutzerdaten-seit-fast-eine… *** Firefox 41 ist da: Mehr Sicherheit und Instant Messaging *** --------------------------------------------- http://derstandard.at/2000022666280 *** Reflected Cross-Site Scripting (XSS) in iTop *** --------------------------------------------- High-Tech Bridge Security Research Lab discovered vulnerability in iTop, which can be exploited to perform Cross-Site Scripting (XSS) attacks against web application users. iTop is a critical application, which is used to cover the entire set of ITIL processes. Successful attack on this web .. --------------------------------------------- https://www.htbridge.com/advisory/HTB23268 *** ENISA Cyber Europe 2014 - After Action Report *** --------------------------------------------- ENISAs After Action Report of the pan-European cybersecurity exercise Cyber Europe 2014 (CE2014) was approved by the EU Member States and gives a high-level overview of the complex cybersecurity exercise that was carried out in 2014. The full after action report includes an engaging action plan which ENISA and Member States are committed to implement. --------------------------------------------- https://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-coo… *** Open-Xchange Security Advisory 2015-09-23 *** --------------------------------------------- Vulnerability Details: Dialogs for printing content were vulnerable to execute injected script code at object properties that get printed. Risk: Malicious script code can be executed within a users context. This can lead to session hijacking .. --------------------------------------------- http://www.securityfocus.com/archive/1/536523 *** Apple will betroffene Nutzer über XcodeGhost-Apps informieren *** --------------------------------------------- Der iPhone-Hersteller hat eine 'Top 25'-Liste der infizierten Apps angekündigt und will Angriffen in XcodeGhost-Manier die Grundlage entziehen. Nutzer sollen zudem in Kenntnis gesetzt werden, wenn sie kompromittierte Apps heruntergeladen haben. --------------------------------------------- http://heise.de/-2824328

1 0

Tageszusammenfassung - Dienstag 22-09-2015
by Daily end-of-shift report 22 Sep '15

22 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 21-09-2015 18:00 − Dienstag 22-09-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Leaked D-Link security key allows hackers to disguise malware as legit *** --------------------------------------------- A leak of a major technology companys security key has been discovered, allowing hackers to convince Windows that their malware is legit. ... While the key expired in early September, that still means that potential cyber-criminals had six months with which to sign their malware with D-Link's leaked key and bypass Microsoft Windows security measures by masquerading as a trusted piece of software. --------------------------------------------- http://www.scmagazine.com/leaked-d-link-security-key-allows-hackers-to-disg… *** Apple watchOS2 Includes Host of Code-Execution Patches *** --------------------------------------------- Apple watchOS2 arrived with a host of security patches, including fixes for more than a dozen code-execution bugs. --------------------------------------------- http://threatpost.com/apple-watchos2-includes-host-of-code-execution-patche… *** How Exploit Kit Operators are Misusing Diffie-Hellman Key Exchange *** --------------------------------------------- Feedback from the Trend Micro Smart Protection Network has allowed us to discover that the notorious Angler and Nuclear exploit kits have included the latest Flash vulnerability (CVE-2015-5560) in their regular update. This means that systems with Adobe Flash Player 18.0.0.209 and earlier are vulnerable; however users running the latest version of Flash (18.0.0.232) are not affected. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/XRj7PRLQnjU/ *** Swiss Advertising network compromised and distributing a Trojan *** --------------------------------------------- On September 11, 2015, MELANI / GovCERT.ch got informed by security researcher Kafeine about a popular advertising network in Switzerland that obviously got compromised by cybercriminals, leading to an exploit kit called Niteris. ... While investigating the incident, we noticed that the Exploit Kit that was injected into the Ad network was only serving malware when the visitor had a German or French User-Agent (HTTP Header Accept-Language). --------------------------------------------- http://www.govcert.admin.ch/blog/13/swiss-advertising-network-compromised-a… *** Xen Security Advisory 142 - libxl fails to honour readonly flag on disks with qemu-xen *** --------------------------------------------- Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen (the upstream-based qemu); and indeed there is no way in qemu to make a disk read-only. ... Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. --------------------------------------------- http://lists.xenproject.org/archives/html/xen-announce/2015-09/msg00003.html *** NCSC publishes revised ICT security guidelines for web applications *** --------------------------------------------- In February 2012 the National Cyber Security Centre (NCSC) published the ICT security guidelines for web applications, a guide to developing, administering and providing web applications and the associated infrastructure more securely. The guidelines are broadly applicable to ICT solutions based on web applications. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-revised-ict-… *** Cisco Spark Mobile Application Man-in-the-Middle Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Spark mobile application could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41127 *** HOW TO: Setting up Encrypted Communications Channels in Oracle Database *** --------------------------------------------- In this article, I will explain how to set up an encrypted communications channel in Oracle Database. This is the third in a series of blog posts Ive published about encryption as it relates to databases. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/HOW-TO--Setting-up-Encr… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Workload Scheduler (CVE-2015-0478 and others) *** http://www.ibm.com/support/docview.wss?uid=swg21966551 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Algorithmics One Core, Algo Risk Application, and Counterparty Credit Risk (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21965555 --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in NTP, Hivex, glibc, libuser, BIND affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance *** http://www.ibm.com/support/docview.wss?uid=swg21966274 --------------------------------------------- *** IBM Security Bulletin: Cross-Site Scripting vulnerabilities affect IBM Emptoris Strategic Supply Management Platform, Emptoris *** http://www.ibm.com/support/docview.wss?uid=swg21966754 --------------------------------------------- *** IBM Security Bulletin: OpenSSH vulnerability affects IBM WebSphere Cast Iron *** http://www.ibm.com/support/docview.wss?uid=swg21967077 --------------------------------------------- *** IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM Algorithmics One Core, Algo Risk Application, and Counterparty Credit Risk (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21965554 --------------------------------------------- *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005335 --------------------------------------------- *** Security Bulletin: Venom vulnerability affects IBM Flex System Manager (FSM) (CVE-2015-3456) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098681 --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java SDK affects IBM SAN Volume Controller and Storwize Family (CVE-2015-0488, CVE-2015-2808, CVE-2015-1916, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005334

1 0

Tageszusammenfassung - Montag 21-09-2015
by Daily end-of-shift report 21 Sep '15

21 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 18-09-2015 18:00 − Montag 21-09-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Unconventional Malvertising Attack Uses New Tricks *** --------------------------------------------- Cyber criminals are creative when using their creative, as seen in this malvertising campaign experimenting with new obfuscation tricks. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/unconventional-malvert… *** Cisco Unity Connection Web Interface SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in the web interface of Cisco Unity Connection (UC) could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41074 *** Cisco ASR 9000 Series Aggregation Services Routers Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the DHCP version 6 (DHCPv6) server implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41101 *** DSA-3361 qemu - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu, a fast processoremulator. --------------------------------------------- https://www.debian.org/security/2015/dsa-3361 *** Insistent router botnet *** --------------------------------------------- Not so long ago, monitoring attackers in our telnet honeypots helped reveal an interesting botnet composed of ASUS brand home routers. A botnet trying to log into our SSH honeypot running on Turris routers most frequently in the last two weeks is a botnet whose IP addresses, according to Shodan, often have one common characteristic: they respond with cookie AIROS_SESSIONID on port 80. This cookie points at AirOS running on Ubiquiti airRouter. --------------------------------------------- http://en.blog.nic.cz/2015/09/18/insistent-router-botnet/ *** Harman-Kardon Uconnect Vulnerability *** --------------------------------------------- This advisory is a follow-up to the ICS-ALERT titled ICS-ALERT-15-203-01 FCA Uconnect Vulnerability that was published July 22, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an unauthorized remote access to Fiat-Chrysler Automobile US (FCA US) LLC Uconnect telematics infotainment system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-260-01 *** Deutsche Cyber-Sicherheitsorganisation DCSO gegründet *** --------------------------------------------- Vier deutsche DAX-Konzerne wollen sich in Deutschland um die Cyber-Sicherheit kümmern. Volkswagen, Allianz, BASF und Bayer gründen einen eigenen Sicherheits-Dienstleister. --------------------------------------------- http://heise.de/-2821882 *** AVG Antivirus Plans to Collect & Sell Your Personal Data to Advertisers *** --------------------------------------------- We at The Hacker News are big fans of Security Software - The first thing we install while setting our Computers and Devices. Thanks to Free Security Software that protects Internet users without paying for their security. But, Remember: Nothing comes for FREE "Free" is just a relative term, as one of the worlds most popular anti-virus companies is now admitting. --------------------------------------------- http://thehackernews.com/2015/09/avg-antivirus.html *** Certificate Transparency: Symantec stellt falsches Google-Zertifikat aus *** --------------------------------------------- Offenbar zu Testzwecken ist von Symantec unberechtigterweise ein gültiges TLS-Zertifikat für Google.com ausgestellt worden. Entdeckt hat Google das über die Logs des Certificate-Transparency-Systems. --------------------------------------------- http://www.golem.de/news/certificate-transparency-symantec-stellt-falsches-… *** Brief survey on methods for attacking Tor hidden service *** --------------------------------------------- cently, MIT published an article for their recent work of identifying the hidden service of Tor by circuit fingerprinting with website fingerprinting to eventually trace down the hidden service users. This paper has been discussed on reddit and many other forums, and the question that whether Tor can be compromised becomes hot again. Here I want to have a brief overview of recent research on the methods and attempts for attacking Tor hidden services over the past years. --------------------------------------------- http://translate.wooyun.io/2015/09/19/Brief-survey-on-methods-for-attacking… *** SYNful Knock *** --------------------------------------------- Introduction On 15 September 2015, FireEye published information about potentially compromised Cisco routers under the name SYNful Knock. As soon as Shadowserver became aware of these potential compromises, Shadowserver and Cisco worked together and cooperated to scan the internet to detect this affected routers to allow a more accurate notification of the affected end-users. --------------------------------------------- http://blog.shadowserver.org/2015/09/21/synful-knock/ *** Inside Target Corp., Days After 2013 Breach *** --------------------------------------------- In December 2013, just days after a data breach exposed 40 million customer debit and credit card accounts, Target Corp. hired security experts at Verizon to probe its networks for weaknesses. The results of that confidential investigation -- until now never publicly revealed -- confirm what pundits have long suspected: Once inside Targets network, there was nothing stop attackers from gaining direct and complete access to every single cash register in every Target store. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/yLzOrODU9Vc/ *** BitPay Hacked, 5 000 Bitcoins Stolen *** --------------------------------------------- Bitcoin payments processor BitPay Inc. is the latest victim in a series of massive hacking scandals that have rocked the cryptocurrency community. The Atlanta-based Bitpay was hacked on three separate occasions in December of 2014. More than 5 000 bitcoins were stolen. Subsequent to this, BitPay sent a claim to its insurer Massachusetts Bay Insurance Company, and the latter declined to pay. The matter is now in court. --------------------------------------------- https://www.cryptocoinsnews.com/bitpay-hacked-5-000-bitcoins-stolen/ *** App Store: Apple bestätigt "XcodeGhost"-Infektionen *** --------------------------------------------- Der Konzern hat laut eigenen Angaben infizierte Apps aus einem Onlineladen entfernt. Ob es alle sind, weiß niemand. --------------------------------------------- http://heise.de/-2822207 *** Risiko Firmware *** --------------------------------------------- Firmware ist nur was für Profis? Von wegen: Heute hängen alltägliche Dinge im Internet und lassen sich darüber fernsteuern. Wenn die Heizungsanlage durchdreht und der DSL-Router für Angreifer offen steht, ist nicht selten veraltete Firmware schuld. --------------------------------------------- http://www.heise.de/newsticker/meldung/Risiko-Firmware-2822449.html?wt_mc=r… *** Typo3 über XSS-Lücke verwundbar *** --------------------------------------------- In Typo3 klafft eine Schwachstelle, über die Angreifer JavaScript in das Content Management System schmuggeln können. --------------------------------------------- http://www.heise.de/newsticker/meldung/Typo3-ueber-XSS-Luecke-verwundbar-28… *** Cisco Wireless LAN Controller RADIUS Packet of Disconnect Vulnerability *** --------------------------------------------- A vulnerability in the RADIUS implementation of the Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition by disconnecting user sessions. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41102 *** Security Updates Available for Adobe Flash Player (APSB15-23) *** --------------------------------------------- A security bulletin (APSB15-23) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1273

1 0

Tageszusammenfassung - Freitag 18-09-2015
by Daily end-of-shift report 18 Sep '15

18 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 17-09-2015 18:00 − Freitag 18-09-2015 17:55 Handler: Alexander Riepl Co-Handler: n/a *** Important security notice regarding signing key and distribution of Red Hat Ceph Storage on Ubuntu and CentOS *** --------------------------------------------- Last week, Red Hat investigated an intrusion on the sites of both the Ceph community project (ceph.com) and Inktank (download.inktank.com), which were hosted on a computer system outside of Red Hat infrastructure. download.inktank.com provided .. --------------------------------------------- https://securityblog.redhat.com/2015/09/17/important-security-notice-regard… *** Analyzing Proxy Based Spam Networks *** --------------------------------------------- We are no strangers to Blackhat SEO techniques, we've actually spent a great deal of time working and sharing various bits of information related to Blackhat SEO techniques over the years. What we haven't shared, however, is the idea of Proxy-based Spam Networks (PSN). It's not because it wasn't interesting, it's .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-proxy-based-spam-networks.html *** Cisco Prime Network Registrar Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the default configuration of the Cisco Prime Network Registrar (CPNR) virtual appliance (OVA) which could allow an authenticated, local attacker to gain root privileges. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=41041 *** WordPress Malware - Active VisitorTracker Campaign *** --------------------------------------------- We are seeing a large number of WordPress sites compromised with the 'visitorTracker_isMob' malware code. This campaign started 15 days ago, but only in the last few days have we started to see it gain traction; really affecting a large number of .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-cam… *** WP Shop <= 3.4.3.18 - Cross-Site Scripting (XSS) & CSRF *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8192 *** Researchers seek ransomware samples for their generic solution *** --------------------------------------------- VB2015 presentation to include demonstration of technique against recent samples.The scary hack thats on the rise is how Wireds Kim Zetter described ransomware in an overview article posted yesterday. Indeed, encrypting your files and demanding a ransom to decrypt them has become a very lucrative cybercriminal .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_18.xml *** Router Security / SYNful Knock *** --------------------------------------------- Wir bekamen Anfragen zum Thema SYNful Knock. Uns war das keine Warnung wert, daher fasst dieser Blogpost unseren Standpunkt zusammen:Management Summary Der SYNful Knock Angriff ist keine neue Kategorie von Bedrohungen. Es gibt .. --------------------------------------------- http://www.cert.at/services/blog/20150918112023-1598.html *** Sicherheitslücke: D-Link vergisst private Code-Signing-Schlüssel im Quellcode *** --------------------------------------------- Dem Hardwarehersteller D-Link ist ein peinlicher Fehler unterlaufen. Im Quellcode der Firmware für eine Überwachungskamera vergaßen die Entwickler private Code-Signing-Schlüssel. Der Hersteller hat bereits reagiert. --------------------------------------------- http://www.golem.de/news/peinlich-d-link-vergisst-private-code-signing-schl… *** Pwnage Per Port - 22/open/tcp//ssh *** --------------------------------------------- Hello and welcome to the first installment of Pwnage Per Port! Today we will be discussing the oh-so-important SSH service which runs (most commonly) on TCP port 22. Not sure what Pwnage Per Port is? Head on over here for a quick rundown on what you can expect! --------------------------------------------- http://l.avala.mp/blog/pwnage-per-port-22opentcpssh/ *** Triaging PowerShell Exploitation with Rekall *** --------------------------------------------- David recently published his article Spotting the Adversary so I figured Id continue the trend and focus on Blue Team tactics in this post. --------------------------------------------- http://www.redblue.team/2015/09/triaging-powershell-exploitation-with.html *** Cisco ASA Software Version Information Disclosure Vulnerability *** --------------------------------------------- A vulnerability in the SSL VPN code of Cisco ASA Software could allow an unauthenticated, remote attacker to obtain information about the Cisco ASA Software version. This information could be used for reconnaissance attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=35946 *** Kritische Sicherheitslücke: Bug in Bugzilla *** --------------------------------------------- Die Bugverwaltung von Firefox gibt schon zum zweiten Mal im September vertrauliche Daten preis - doch diesmal sind auch andere Projekte betroffen. Ein Patch steht bereit. --------------------------------------------- http://www.golem.de/news/kritische-sicherheitsluecke-bug-in-bugzilla-1509-1…

1 0

Tageszusammenfassung - Donnerstag 17-09-2015
by Daily end-of-shift report 17 Sep '15

17 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 16-09-2015 18:00 − Donnerstag 17-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** A Brief Introduction to #totalhash *** --------------------------------------------- #totalhash is Team Cymru's malware analysis database, providing static and dynamic analysis of malware samples free for non-commercial use. Haven't tried #totalhash yet? Here's a brief video with a few highlights on how to upload samples, search our database, and go down the rabbit hole .. --------------------------------------------- https://blog.team-cymru.org/2015/09/a-brief-introduction-to-totalhash/ *** Bugtraq: [security bulletin] HPSBGN03393 rev.2 - HP Operations Manager i, Remote Code Execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/536478 *** Stagefrightened? *** --------------------------------------------- There's been a lot of attention recently around a number of vulnerabilities in Android's libstagefright. There's been a lot of confusion about the remote exploitability of the issues, especially on modern devices. In this blog post we will demonstrate an exploit for one of the libstagefright vulnerabilities .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/stagefrightened.html *** ZDI-15-444: Symantec Web Gateway Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-444/ *** ZDI-15-443: Symantec Web Gateway Arbitrary PHP File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability, however it can be bypassed via reflected cross-site scripting. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-443/ *** ZDI-15-445: (0Day) Avira Management Console Update Manager Service HTTP Header Use-After-Free Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Avira Management Console. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-445/ *** CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150 *** --------------------------------------------- The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. --------------------------------------------- https://www.drupal.org/node/2569599 *** Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148 *** --------------------------------------------- Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. --------------------------------------------- https://www.drupal.org/node/2569577 *** Who's Behind Bluetooth Skimming in Mexico? *** --------------------------------------------- In the previous two stories, I documented the damage wrought by an organized crime gang in Mexico that has been systematically bribing ATM technicians to install Bluetooth skimming components that allow thieves to steal card and PIN data wirelessly. What follows is a look at a mysterious new ATM company in Mexico that sources say may be tied to the skimming activity. --------------------------------------------- http://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/ *** iTunes 12.3: Mehr Sicherheit, weniger Fehler und ein grosser Download *** --------------------------------------------- Zusammen mit iOS 9 hat Apple auch eine neue Version von iTunes freigegeben. Apple beseitigte insbesondere unter Windows Sicherheitslücken, die sogar das Abgreifen von verschlüsselten Zugangsdaten im Netzwerk erlaubten. Zudem erhöht Apple die Sicherheit bei der Verwendung von Apple IDs. --------------------------------------------- http://www.golem.de/news/itunes-12-3-mehr-sicherheit-weniger-fehler-und-ein… *** Behind the scenes at BruCON, a European hacker conference *** --------------------------------------------- Setting up a local conference seems to be a popular way for infosec pros that havent got the time or means to travel to bring the people they want to meet and the knowledge they want to attain .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18863 *** Seven years of malware linked to Russian state-backed cyber espionage *** --------------------------------------------- F-Secure report details "The Dukes" malware family and its Russian connections. For the past seven years, a cyber-espionage group operating out of Russia .. --------------------------------------------- http://arstechnica.com/security/2015/09/seven-years-of-malware-linked-to-ru… *** Throwback Thursday: Virus Writer and Distributors Attributable Viruses *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 1990, when VB looked at virus origins and some of the rare cases of attributable viruses.This week saw the confession of a former teenage virus writer: the author of the Leprosy .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_17.xml *** Studie: In den USA droht ein Wahlmaschinen-Debakel *** --------------------------------------------- on den 50 US-Staaten werden 43 im kommenden Jahr besonders fehleranfällige Wahlcomputer einsetzen, die mindestens zehn Jahre alt sind, heißt es in einer Analyse der New York University. Dies berge große Risiken. --------------------------------------------- http://heise.de/-2820268 *** MMD-0042-2015 - Polymorphic in ELF malware: Linux/Xor.DDOS *** --------------------------------------------- The threat of Linux/XOR.DDoS, a China-made ELF backdoor ddoser malware, its still on going. I received a good question from (I assumed from a victim of infection) asked about why the found malware is not the same as what was firstly executed ELF malware binary. This writing is short and covering .. --------------------------------------------- http://blog.malwaremustdie.org/2015/09/mmd-0042-2015-polymorphic-in-elf.html *** HTTP Evasions Explained - Part 2 - Deflate Compression *** --------------------------------------------- This is the second article in a series which will explain the evasions done by HTTP Evader. It covers the failure of several firewalls to support content some compressions supported by all or most browsers, notable the deflate compression. In short, it is possible to bypass the malware inspection of several firewalls by simply sending a response compressed by deflate: --------------------------------------------- http://noxxi.de/research/http-evader-explained-2-deflate.html

1 0

Tageszusammenfassung - Mittwoch 16-09-2015
by Daily end-of-shift report 16 Sep '15

16 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 15-09-2015 18:00 − Mittwoch 16-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** CoreBot Adds New Capabilities, Transitions to Banking Trojan *** --------------------------------------------- As many researchers expected it would, CoreBot, the credential-stealing malware that first surfaced last month, has added a bevy of new capabilities and reinvented itself as a robust banking Trojan. --------------------------------------------- http://threatpost.com/corebot-adds-new-capabilities-transitions-to-banking-… *** Hacking Team looks to hire hacker *** --------------------------------------------- Following the compromising of nearly all its databases and emails, and then the subsequent release of those company details, Hacking Team posted a job listing for a "hacker/developer." --------------------------------------------- http://www.scmagazine.com/hacking-team-looks-to-expand-team-after-breach/ar… *** WordPress Brute Force Attacks - 2015 Threat Landscape *** --------------------------------------------- One of the first server-level compromises I had to deal with in my life was around 15 years ago, and it was caused by an SSH brute force attack. A co-worker set up a test server and chose a very weak root password. A few days later, the box was compromised .. --------------------------------------------- https://blog.sucuri.net/2015/09/wordpress-brute-force-attacks-2015-threat-l… *** Malicious spam with zip attachments containing .js files, (Wed, Sep 16th) *** --------------------------------------------- On 2015-07-29, the ISC publisheda diary covering malicious spam (malspam) with zip archives of javascript (.js) files [1]. Since then, weve received notifications from others who have found this type of malspam. Lets revisit the spam filters, search for this type of email, and see if anything .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20153 *** "Unternehmen wollen Sicherheitslösungen aus Europa" *** --------------------------------------------- SBA Research hat den ersten österreichischen Inkubator für Cybersicherheits-Start-ups ins Leben gerufen. Die futurezone hat die Geschäftsführer des Kompetenzentrums befragt. --------------------------------------------- http://futurezone.at/thema/start-ups/unternehmen-wollen-sicherheitsloesunge… *** In Search of SYNful Routers *** --------------------------------------------- On Tuesday, September 15, 2015, Mandiant and FireEye disclosed SYNful Knock, a router implant discovered on fourteen Cisco routers in India, Mexico, the Philippines, and Ukraine. The implant consists a modified version of the Cisco firmware that provides attackers with unrestricted access to the router including the ability to load additional modules. The attack is .. --------------------------------------------- https://zmap.io/synful/ *** Can an inevitable evil be conquered? *** --------------------------------------------- Scanning an object (a file or web resource) with an Internet security program essentially comes down to making a binary decision: dangerous or safe? An antivirus engine puts forward the hypothesis that an object is malicious and then checks .. --------------------------------------------- http://securelist.com/blog/opinions/72180/can-an-inevitable-evil-be-conquer… *** Enthüllungsplattform Cryptome: PGP-Schlüssel kompromittiert *** --------------------------------------------- Mit Zugang zu den Schlüsseln der Plattform und des Gründers John Young könnten Angreifer verschlüsselte Mails lesen und sich als Betreiber der Webseite ausgeben. --------------------------------------------- http://heise.de/-2817797 *** Cyberkriminalität in Österreich: Fragen und Antworten *** --------------------------------------------- Das Bundeskriminalamt präsentiert gemeinsam mit der futurezone den Cybercrime-Report 2014. Wir laden am Montagabend zur Diskussion über Trends in der Cyberkriminalität. --------------------------------------------- http://futurezone.at/digital-life/cyberkriminalitaet-in-oesterreich-fragen-… *** Android-Passwortsperre lässt sich zum Teil leicht austricksen *** --------------------------------------------- Bei Nexus-Geräten demonstriert, unklar ob andere Geräte betroffen sind – Google liefert bereits Update --------------------------------------------- http://derstandard.at/2000022284907 *** Schneider Electric StruxureWare Building Expert Plaintext Credentials Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cleartext transmission vulnerability in Schneider Electric's StruxureWare Building Expert product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-01 *** 3S CODESYS Gateway Server Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a heap-based buffer overflow vulnerability in 3S-Smart Software Solutions GmbH's CODESYS Gateway Server. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-02 *** GE MDS PulseNET Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two vulnerabilities in GE's MDS PulseNET and MDS PulseNET Enterprise Network Management Software. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-03 *** Advantech WebAccess Stack-Based Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Advantech's WebAccess application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-258-04 *** Attacks over DNS *** --------------------------------------------- DNS is a naming system used for all devices connected to the Internet or a network. DNS is easy to remember instead of IP addresses for users. It is a method in which domain names are translated into an IP (Internet Protocol) addresses. The DNS works .. --------------------------------------------- http://resources.infosecinstitute.com/attacks-over-dns/ *** SYNful Knock - A Cisco router implant - Part II *** --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis0.h… *** Trojan.MWZLesson.a Trojan for POS terminals *** --------------------------------------------- For many years POS terminals remain one the most favorite targets for virus makers. Due to the fact that this technology is used by a large number of sales organizations around the world to process payments made using bank cards, cybercriminals just .. --------------------------------------------- http://news.drweb.com/show/?i=9615&lng=en&c=9 *** Einstweilige Verfügung: Fireeye geht juristisch gegen Sicherheitsforscher vor *** --------------------------------------------- Ein Team von Sicherheitsforschern wollte auf einer Konferenz über Sicherheitslücken in Fireeye-Produkten berichten. Fireeye sah durch die Präsentation Geschäftsgeheimnisse bedroht und hat eine einstweilige Verfügung erwirkt. --------------------------------------------- http://www.golem.de/news/einstweilige-verfuegung-fireeye-geht-juristisch-ge… *** TeslaCrypt 2.0: Cyber Crime Malware Behavior, Capabilities and Communications *** --------------------------------------------- As part of our normal course of operations as a cyber threat intelligence provider, we monitor the cyber crime underground and provide analysis to our clients on new and emerging threats. As you can imagine, we naturally run into large quantities of malware on a daily basis. From time to time, we .. --------------------------------------------- http://www.isightpartners.com/2015/09/teslacrypt-2-0-cyber-crime-malware-be… *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 2 *** --------------------------------------------- This is Part 2 of a How-To is an effort to compile a list of tools (free and commercial) that can help an IT administrator comply with the Security Controls. In Part 1 we looked at Inventory of Authorized and Unauthorized Devices. The controls (ordered 1-20) are in order of importance. In other words, completing .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to…

1 0

Tageszusammenfassung - Dienstag 15-09-2015
by Daily end-of-shift report 15 Sep '15

15 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 14-09-2015 18:00 − Dienstag 15-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroIn the previous series of posts (parts #1 #2 #3 #4), we discussed the exploitation process of a serious 'blend' vulnerability (CVE-2015-0093 / CVE-2015-3052), which was special .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/09/enabling-qr-codes-in-internet… *** Mapping How Tor's Anonymity Network Spread Around the World *** --------------------------------------------- Germany has overtaken the US in total nodes, with France, the Netherlands, and Russia coming close behind.The post Mapping How Tor's Anonymity Network Spread Around the World appeared first on WIRED. --------------------------------------------- http://www.wired.com/2015/09/mapping-tors-anonymity-network-spread-around-w… *** Large Malvertising Campaign Goes (Almost) Undetected *** --------------------------------------------- A very stealthy malvertising campaign has gone under everybodys noses and exposed a large amount of people to malware. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/09/large-malvertising-cam… *** Tracking Bluetooth Skimmers in Mexico, Part II *** --------------------------------------------- I spent four days last week in Mexico, tracking the damage wrought by an organized crime ring that is bribing ATM technicians to place Bluetooth skimmers inside of cash machines in and around the tourist areas of Cancun. Today's piece chronicles the work of this gang in coastal regions farther south, following a trail of hacked ATMs from Playa Del Camen down to the ancient Mayan ruins in Tulum. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-pa… *** SYNful Knock - A Cisco router implant - Part I *** --------------------------------------------- Router implants, from any vendor in the enterprise space, have been largely believed to be theoretical in nature and especially in use. However, recent vendor advisories indicate that these have been seen in the wild. Mandiant can confirm the existence of at least 14 such router implants spread across four different countries: Ukraine, Philippines, Mexico, and India. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.ht… *** Hey, Oracle, whats in that VirtualBox security update? *crickets* *** --------------------------------------------- Debian team bit miffed about secretive vuln fixes in hypervisor software Its not just Microsoft keeping schtum on exactly whats inside its software updates. --------------------------------------------- www.theregister.co.uk/2015/09/15/oracle_virtualbox_security_updates/ *** Von Flugzeugen bis Mars-Rovern: Lücke im Echtzeitbetriebssystem VxWorks *** --------------------------------------------- Das Echtzeitbetriebssystem VxWorks ist verwundbar und Angreifer können eigenen Code ausführen. Das System kommt in rund 1,5 Milliarden Geräten zum Einsatz - darunter auch im Mars-Rover Curiosity. --------------------------------------------- http://heise.de/-2812783 *** Another LinkedIn Sockpuppet *** --------------------------------------------- According to LinkedIn, 11 of my connections can introduce me to someone who 'knows' Anna. I'm not so sure about that. According to IMDb, Anna Sentina is really Anna Akana. Maybe LinkedIn should start charging to 'verify' recruiter .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/15/another-linkedin-sockpuppet/ *** Our First Certificate Is Now Live *** --------------------------------------------- Let's Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. --------------------------------------------- https://letsencrypt.org/2015/09/14/our-first-cert.html *** KCI Attacks against TLS *** --------------------------------------------- Protection of Internet communication is crucial in todays hyperconnected world. The industry standard for encrypting private and sensitive communication data over potentially adversarial controlled network cables and radio signals is TLS. ESSE, the security team of RISE GmbH, discovered a .. --------------------------------------------- https://kcitls.org/ *** Hunting Asynchronous Vulnerabilities *** --------------------------------------------- As the video of my 44Con presentation Hunting Asynchronous Vulnerabilities probably wont be available for a while, I thought Id provide a mildly abridged (and less vendor-neutral) writeup of the core technical content. You can download the slides here. --------------------------------------------- http://blog.portswigger.net/2015/09/hunting-asynchronous-vulnerabilities.ht… *** WordPress 4.3.1 Security and Maintenance Release *** --------------------------------------------- https://wordpress.org/news/2015/09/wordpress-4-3-1/ *** VB2015 last-minute papers announced *** --------------------------------------------- Ten talks covering hot research added to the VB2015 programme.There are just over two weeks to go until more than 400 security professionals descend on Prague for VB2015, the 25th Virus Bulletin International Conference.With the addition of ten last-minute papers, the conference programme is now almost complete: two keynotes (by Ross Anderson and Costin Raiu), seven Small Talks and 51 regular presentations mean the three conference days are packed with interesting talks and discussions on a --------------------------------------------- http://www.virusbtn.com/blog/2015/09_15.xml?rss *** Finding Vulnerabilities in Core WordPress: A Bug Hunter�s Trilogy, Part III - Ultimatum *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only 'Subscriber' user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web. --------------------------------------------- http://blog.checkpoint.com/2015/09/15/finding-vulnerabilities-in-core-wordp…

1 0

Tageszusammenfassung - Montag 14-09-2015
by Daily end-of-shift report 14 Sep '15

14 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 11-09-2015 18:00 − Montag 14-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** FireEye wegen Umgang mit Sicherheitsforschern in der Kritik *** --------------------------------------------- Ein deutscher Forscher, der Lücken in Sicherheits-Gateways der Firma FireEye entdeckt hat, wurde per einstweiliger Verfügung dazu gezwungen, seinen Vortrag zu zensieren. Sein Firmenchef spricht von unprofessionellem Verhalten seitens FireEye. --------------------------------------------- http://heise.de/-2811690 *** Tracking a Bluetooth Skimmer Gang in Mexico *** --------------------------------------------- -Sept. 9, 12:30 p.m. CT, Yucatan Peninsula, Mexico: Halfway down the southbound four-lane highway from Cancun to the ancient ruins in Tulum, traffic inexplicably slowed to a halt. There was some sort of checkpoint ahead by the Mexican Federal Police. I began to wonder whether it was a good idea to have .. --------------------------------------------- http://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mex… *** Neuer Android-Trojaner erpresst mit Lock-Screen-Sperre *** --------------------------------------------- Versucht über Trick Device-Admin-Rechte einzuholen – Nur jenseits des Play Stores verbreitet --------------------------------------------- http://derstandard.at/2000022182737 *** How Command and Control Servers Remain Resilient *** --------------------------------------------- One of the ways that malware activity on a network is spotted is via the activity of their network activity. However, in many cases this can be difficult to detect: there have been incidents where command-and-control (C&C) servers were able to stay .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/adapting-to-chan… *** "Die Gefahr ist real": Auto-Hacks schrecken Branche auf *** --------------------------------------------- IT-Forscher übernahmen mehrmals Kontrolle über Fahrzeuge --------------------------------------------- http://derstandard.at/2000022195679 *** Österreichische Forscher entdecken TLS-Schwachstelle *** --------------------------------------------- Facebook vergibt Bug Bounty-Award an Rise – "Sicherheits-Desaster" verhindert --------------------------------------------- http://derstandard.at/2000022197161 *** Bundestag-Hack war ein Phishing-Angriff über un.org *** --------------------------------------------- Die Angreifer auf den Bundestag haben wohl Mails mit gefälschter Absendeadresse verschickt, die einen Link auf Malware enthielten. Nicht nur der Bundestag, sondern mehrere internationale Organisationen seien gleichzeitig angegriffen worden. --------------------------------------------- http://heise.de/-2811847 *** The Wordpress Plugins Playground *** --------------------------------------------- This morning, I had a quick look at my web serverlog file and searched for malicious activity. Attacks like brute-force generate a lot of entries and thuscan be easily detected.Other scanners are working below the radar and search for very specific vulnerabilities. In this case, a single request is often .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20147 *** The Shade Encryptor: a Double Threat *** --------------------------------------------- A family of ransomware Trojans emerged in late 2014/early 2015, and quickly established itself among the top three most widespread encryptors. This threat has been assigned the verdict Trojan-Ransom.Win32.Shade according to Kaspersky Labs classification. The original name given to the encryptor by its creator is not known. --------------------------------------------- http://securelist.com/analysis/publications/72087/the-shade-encryptor-a-dou… *** HTTP Evasions Explained - Part 1 - Evading Using HTTP 0.9 *** --------------------------------------------- This is the first article in a series which will explain the evasions done by HTTP evader. It covers the case that most firewalls only block what they detected as explicitly bad and simply pass what they dont understand. The main technique used in this part is the old but still working HTTP 0.9 protocol. --------------------------------------------- http://noxxi.de/research/http-evader-explained-1-http09.html *** Exploiting CSRF against search with Lucene *** --------------------------------------------- Cross domain timing attacks can be used against Lucene to reliably extract information contained within its index. By repeatedly timing HTTP requests using JavaScript Lucene search boxes can be exploited in a similar way to time based blind-sql injection. --------------------------------------------- https://www.idontplaydarts.com/2015/09/cross-domain-timing-attacks-against-… *** Brief analysis of a SQL injection in Cacti 0.8.8b *** --------------------------------------------- Back in September 2013 I wanted to practice some code auditing and picked the latest version of Cacti (v0.8.8b at the time). I spent a few hours looking into the code and also assessing a running instance of Cacti and this exercise resulted in a few vulnerabilities. I was motivated to finally put together this .. --------------------------------------------- http://blog.whatever.io/2015/09/12/brief-analysis-of-a-sql-injection-in-cac… *** Addressing the Delayed Message Attack in Wireless IoT Environments *** --------------------------------------------- While many years have passed while we're waiting for IoT to take over the world, there are some recent signs that it might indeed eventually happen. With this in mind, issues related to IoT security tend to become more and more important. In this article, we won't be talking about current IoT security .. --------------------------------------------- http://ithare.com/addressing-the-delayed-message-attack-in-wireless-iot-env…

1 0

Tageszusammenfassung - Freitag 11-09-2015
by Daily end-of-shift report 11 Sep '15

11 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 10-09-2015 18:00 − Freitag 11-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bundeslagebild Cybercrime: Crime-as-a-Service wächst weiter *** --------------------------------------------- Das Bundeskriminalamt hat auf seiner Cybercrime-Konferenz C³ das Lagebild Cybercrime veröffentlicht. Demnach steigt die Bedrohung auf allen Gebieten der computerunterstützen Kriminalität. --------------------------------------------- http://heise.de/-2810254 *** VMSA-2015-0003.11 *** --------------------------------------------- Oracle JRE is updated in VMware products to address a critical security issue that existed in earlier releases of Oracle JRE. VMware products running JRE 1.7 Update 75 or newer and JRE 1.6 Update 91 or newer are not vulnerable to CVE-2014-6593, .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** OpenLDAP Bug in ber_get_next() Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A vulnerability was reported in OpenLDAP. A remote user can cause the target service to crash. A remote user can send a specially crafted packet to cause the target slapd service to crash. --------------------------------------------- http://www.securitytracker.com/id/1033534 *** Yokogawa Multiple Products Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for stack-based buffer overflow vulnerabilities in multiple Yokogawa products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-253-01 *** Von T-Systems: Der Bundestag bekommt eine neue IT-Infrastruktur *** --------------------------------------------- Als Reaktion auf den Hackerangriff werden im Bundestag nun mehr als 10.000 Webseiten dauerhaft gesperrt. Außerdem soll T-Systems ein neues Netzwerk aufbauen. Bundestags-Mitarbeiter müssen ihre USB-Sticks bald zu Hause lassen. --------------------------------------------- http://www.golem.de/news/von-t-systems-der-bundestag-bekommt-eine-neue-it-i… *** Google veröffentlicht erstes monatliches Sicherheitsupdate *** --------------------------------------------- Nach der Entdeckung der Stagefright-Sicherheitslücke hatte Google angekündigt, einen monatlichen Patchday mit Sicherheitsupdates einzuführen. Jetzt sind die ersten Builds veröffentlicht worden. --------------------------------------------- http://www.golem.de/news/android-google-veroeffentlicht-erstes-monatliches-… *** Simulation zeigte Millionen Hacker-Angriffe auf Zug-Steuersysteme *** --------------------------------------------- Falle "HoneyTrain": Wer würde tatsächlich versuchen, in die originalgetreue Nachbildung eines Zug-Steuerungssystems einzudringen? --------------------------------------------- http://derstandard.at/2000022056115 *** Cyber criminal crew DD4BC extorts businesses via DDoS *** --------------------------------------------- According to a report recently issued by Akamai, the DD4BC criminal group has been responsible for at least 114 DDoS attacks on its customers. According the Akamai firm, the criminal crews known as DD4BC has carried out at least 114 .. --------------------------------------------- http://securityaffairs.co/wordpress/40034/cyber-crime/dd4bc-group-extortion… *** Analysing a new eBanking Trojan called Fobber *** --------------------------------------------- Some weeks ago we read an interesting blog by Malwarebytes about Fobber, a new e-banking focussed malware in the arena that seems to be a Tinba spinoff. We decided to have a closer look at it to find out whether Swiss critical infrastructures are targeted by it. Wed like to share our findings with you, because it contains some interesting advanced techniques .. --------------------------------------------- http://www.govcert.admin.ch/blog/12/analysing-a-new-ebanking-trojan-called-… *** SUCEFUL: Next Generation ATM Malware *** --------------------------------------------- You dip your debit card in an automated teller machine (ATM) and suddenly realize it is stuck inside, what happened? --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/09/suceful_next_genera.ht… *** A Retrospective on Ashely Madison and the Value of Threat Modeling *** --------------------------------------------- One of my favourite authors in the field of computer security is Gary McGraw. If you are not familiar with him, I'd suggest you start by reading his book Software Security: Building Security In. One of the key points he makes is a distinction .. --------------------------------------------- https://littlemaninmyhead.wordpress.com/2015/09/08/a-retrospective-on-ashel… *** A Peek Inside an Affiliate's Malspam Operation: Kovter and Miuref/Boaxxe Infections *** --------------------------------------------- In March of this year, reports of malspam campaigns utilizing an email attached '.doc.js' files, which tied back to the Kovter and Boaxxe clickfraud trojans. The analysis of these malware families have already been well documented .. --------------------------------------------- http://phishme.com/a-peek-inside-an-affiliates-malspam-operation-kovter-and…

1 0

Tageszusammenfassung - Donnerstag 10-09-2015
by Daily end-of-shift report 10 Sep '15

10 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 09-09-2015 18:00 − Donnerstag 10-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The Security Risks of Third-Party Data *** --------------------------------------------- Most of us get to be thoroughly relieved that our e-mails werent in the Ashley Madison database. But dont get too comfortable. Whatever secrets you have, even the ones you dont think of as secret, are more likely than you think to get dumped on the Internet. Its .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/the_security_ri_4.html *** RESTful - Moderately Critical - Access bypass - SA-CONTRIB-2015-147 *** --------------------------------------------- This module enables you to expose your Drupal backend by generating a RESTful API.The module doesnt sufficiently account for cores page cache generation for anonymous users, when using non-cookie authentication providers. Authenticated users, .. --------------------------------------------- https://www.drupal.org/node/2565875 *** Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146 *** --------------------------------------------- This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter.The module doesnt sufficiently check for access when using the Twitter Post .. --------------------------------------------- https://www.drupal.org/node/2565827 *** A look through the spam filters - examining waves of Upatre malspam, (Thu, Sep 10th) *** --------------------------------------------- Any email filtering worth its cost should block numerous messages every day. however, Im always interested to see what exactly is being blocked. Perhaps the most common type of malicious spam (malspam) I see from the spam filters is Upatre-based malspam. Ive written diaries before about specific waves of Upatre malspam sending the Dyre banking Trojan [1, 2]. Ive only noticed emails with .zip .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20135 *** MSRT September 2015: Teerac *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, the September release of the Microsoft Malicious Software Removal Tool (MSRT) will include detection for the prevalent ransomware family Win32/Teerac. We first detected Teerac in early 2014. Since then, the family has joined Win32/Crowti .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/09/08/msrt-september-2015-teer… *** How Do You Solve A Problem Like Attribution? *** --------------------------------------------- There was an advert for weed-killer a while back, the tagline was something along the lines of 'Kill the root, kill the weed'. That's true of many problems, better to get to the heart of the issue and deal with it there, rather than .. --------------------------------------------- https://blog.team-cymru.org/2015/09/how-do-you-solve-a-problem-like-attribu… *** Obfuscated URLs, where is that link taking you? *** --------------------------------------------- We take a look at ways to obfuscate URL the way scammers do by using shortening services and encoded search engine URLs. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/09/obfuscated-urls-where-is-t… *** Ein Patch, zwei offene Lücken in Cisco-Gateways *** --------------------------------------------- In der Software von Ciscos Web Security Appliance (WSA) und der Email Security Appliance (ESA) der Firma klaffen Lücken, die es Angreifern aus der Ferne erlauben, die Gateways lahmzulegen. Nur für eine der drei Lücken gibt es Abhilfe. --------------------------------------------- http://heise.de/-2809896 *** Free and Commercial Tools to Implement the SANS Top 20 Security Controls, Part 1 *** --------------------------------------------- This is the first in a series about the tools available to implement the SANS Top 20 Security Controls. The SANS Top 20 Security Controls are not standards. If you want standards and procedures, check out the NIST 800 series Special Publications (SP). The controls are recommendations made by .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/free-and-commercial-to… *** The Latest on Stagefright: CVE-2015-1538 Exploit is Now Available for Testing Purposes *** --------------------------------------------- More than a month has passed since Zimperium first broke the news of zLabs' VP of Platform Research and Exploitation Joshua J. Drake's discovery of multiple critical vulnerabilities in Android's media library - libstagefright. In that time frame, the number and importance of the events that have unfolded is nothing short of amazing. Back in April and May we reported two sets of vulnerabilities to Google, both .. --------------------------------------------- https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-… *** Ashley Madison: Hacker knacken 11,2 Millionen Passwörter *** --------------------------------------------- Die Login-Dateien im Ashley-Madison-Fundus galten bislang als sicher, weil der Anbieter eine sichere Hashfunktion verwendet haben soll. Doch jetzt haben Hacker eine Schwachstelle gefunden, um einen Teil der Passwörter zu knacken. --------------------------------------------- http://www.golem.de/news/ashley-madison-hacker-knacken-11-2-millionen-passw…

1 0

Tageszusammenfassung - Mittwoch 9-09-2015
by Daily end-of-shift report 09 Sep '15

09 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 08-09-2015 18:00 − Mittwoch 09-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** PMASA-2015-4 *** --------------------------------------------- This vulnerability allows to complete the reCaptcha test and subsequently perform a brute force attack to guess user credentials without having to complete further reCaptcha tests. --------------------------------------------- https://www.phpmyadmin.net/security/PMASA-2015-4/ *** Cisco Application Visibility and Control FlexConnect UDP Vulnerability *** --------------------------------------------- A vulnerability in Cisco Application Visibility and Control (AVC) software for wireless networking could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40845 *** Cisco Security Management Appliance Log Rollover Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the web interface of the Cisco Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40847 *** [20150908] - Core - XSS Vulnerability *** --------------------------------------------- http://developer.joomla.org/security-centre/626-20150908-core-xss-vulnerabi… *** MS15-SEP - Microsoft Security Bulletin Summary for September 2015 - Version: 1.1 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-SEP *** Malicious Google Search Console Verifications *** --------------------------------------------- This past summer we noticed a trend of more and more Blackhat SEO hacks trying to verify additional accounts as owners of compromised sites in Google Search Console (formerly Webmaster Tools). Google Search Console provides really useful .. --------------------------------------------- https://blog.sucuri.net/2015/09/malicious-google-search-console-verificatio… *** Advantech WebAccess Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a stack-based overflow vulnerability in Advantech's WebAccess application to NCCIC/ICS-CERT. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-251-01 *** Patchday: Microsoft stopft 55 Lücken, Adobe nur zwei *** --------------------------------------------- Während Microsoft diesen Monat an der Sicherheit von mehreren Anwendungen schraubt, konzentriert sich Adobe ausschließlich auf den Shockwave Player. --------------------------------------------- http://heise.de/-2808452 *** Turla APT Group Abusing Satellite Internet Links *** --------------------------------------------- Researchers at Kaspersky Lab have revealed that the Turla APT gang is using satellite-based Internet links to hide command-and-control activities. --------------------------------------------- http://threatpost.com/turla-apt-group-abusing-satellite-internet-links/1145… *** A Brief Examination of Hacking Team's Crypter: core-packer. *** --------------------------------------------- In this blog entry we investigate how Italian malware vendor Hacking Team obfuscated their malware, specifically the custom software they developed for this task called core-packer2. This analysis was a joint project between Will Cummings and Ethan Heilman. --------------------------------------------- http://ethanheilman.tumblr.com/post/128708937890/a-brief-examination-of-hac…

1 0

Tageszusammenfassung - Dienstag 8-09-2015
by Daily end-of-shift report 08 Sep '15

08 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 07-09-2015 18:00 − Dienstag 08-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** The state of Ransomware in 2015 *** --------------------------------------------- Ransomware has been a threat for quite some years, although the ransomware as its currently known, encrypting files, has only been around a few years. This change started with the initial 2013 CryptoLocker infections authored by the .. --------------------------------------------- http://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/ *** Adult Player: Porno-App erpresst Android-Nutzer mit Selfies *** --------------------------------------------- Die Porno-App Adult Player schießt ein Selbstporträt des Nutzers, sperrt das Smartphone und fordert zur Zahlung von 500 US-Dollar auf. Nutzer können sich mit einfachen Mitteln schützen. --------------------------------------------- http://www.golem.de/news/adult-player-porno-app-erpresst-android-nutzer-mit… *** Sofacy Recycles Carberp and Metasploit Code *** --------------------------------------------- The Sofacy Group (also known as Pawn Storm or APT28) is well known for deploying zero-day exploits in their APT campaigns. For example, two recent zero-days used by the Sofacy Group were exploiting vulnerabilities in Microsoft .. --------------------------------------------- https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasp… *** Unauthenticated Path Disclosure *** --------------------------------------------- It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation. --------------------------------------------- http://www.typo3.org/news/article/unauthenticated-path-disclosure/ *** Jeep-Hack: Fiat Chrysler ruft weitere Modelle zurück *** --------------------------------------------- Aufgrund einer Sicherheitslücke im Infotainmentsystem ruft Fiat Chrysler in den USA 7810 SUV-Modelle zurück. Davon sollen sich rund die Hälfte noch bei Händlern befinden, die das Update vor dem Verkauf einspielen können. Nach Bekanntwerden .. --------------------------------------------- http://heise.de/-2807879 *** Ashley Madison, Why Do Our Honeypots Have Accounts On Your Website? *** --------------------------------------------- She is 33 years old, from Los Angeles, 6 feet tall, sexy, aggressive, and a 'woman who knows what she wants', according to her profile. She is intriguing. However, her intrigue doesn't end .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/ashley-madison-w… *** Cyber Security - Getting the Message *** --------------------------------------------- There is a concept in the health and safety industry known as 'sign blindness'. This occurs when safety notices become so numerous, or so familiar, that the human brain simply filters .. --------------------------------------------- https://blog.team-cymru.org/2015/09/cyber-security-getting-the-message/ *** FireEye untersucht Root-Lücken in Sicherheits-Appliances *** --------------------------------------------- Sicherheitsforscher hatten schwerwiegende Lücken in den Appliances der Firma entdeckt. Ihre Hinweise blieben nach eigenen Angaben 18 Monate lang unbeantwortet. FireEye sagt, man wisse erst seit Montag von den Lücken. --------------------------------------------- http://heise.de/-2807930 *** iOS 8.4.1 Kernel Vulnerabilities in AppleHDQGasGaugeControl *** --------------------------------------------- When auditing iOS kernel executable, we found that the code quality of com.apple.driver.AppleHDQGasGaugeControl is very bad. In this blog, we will disclose 3 vulnerabilities in this kernel extension on the latest public iOS (version 8.4.1). More .. --------------------------------------------- http://blog.pangu.io/ios-8-4-1-kernel-vulns/ *** WhatsApp 'MaliciousCard' Vulnerabilities Allowed Attackers to Compromise Hundreds of Millions of WhatsApp Users *** --------------------------------------------- WhatsApp Web is a web-based extension of the WhatsApp application on your phone. The web application mirrors all messages sent and received, and fully synchronize your phone and your desktop computer so that users can see all messages on both devices. --------------------------------------------- http://blog.checkpoint.com/2015/09/08/whatsapp-maliciouscard-vulnerabilitie… *** Security Update Available for Adobe Shockwave Player (APSB15-22) *** --------------------------------------------- A security bulletin (APSB15-22) has been published regarding a security update for Adobe Shockwave Player. This update addresses critical vulnerabilities that could potentially allow an attacker to take control of the affected system. Adobe .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1268

1 0

Tageszusammenfassung - Montag 7-09-2015
by Daily end-of-shift report 07 Sep '15

07 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 04-09-2015 18:00 − Montag 07-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Custom packer defeats multiple automation systems *** --------------------------------------------- Combination of anti-automation, anti-VM and anti-reverse engineering to make researchers lives harder.Ever since the number of new malware samples became so large we could no longer list them in Virus Bulletin magazine, security researchers .. --------------------------------------------- http://www.virusbtn.com/blog/2015/09_04.xml *** Neutrino exploit used to inject Teslascrypt into sites using outdated CMS tools *** --------------------------------------------- Heimdal Security reported an increase in malicious scripts infecting legitimate websites that then redirect the victim to the Neurtino exploit kit server that could potentially impact more than 400 million web users. --------------------------------------------- http://www.scmagazine.com/outdated-websites-deliver-teslacrypt-via-neutrino… *** Firefox-Sicherheitslücken: Angreifer hatte Zugriff auf Mozilla-Bugtracker *** --------------------------------------------- Ein priviligierter Account für den Mozilla-Bugtracker ist unter der Kontrolle eines Angreifers gewesen. Dadurch gelang es diesem, Informationen über noch nicht behobene Sicherheitslücken in Firefox zu erhalten. --------------------------------------------- http://www.golem.de/news/firefox-sicherheitsluecken-angreifer-hatte-zugriff… *** Extorting money from Ashley Madison customers is actually pretty easy *** --------------------------------------------- 1.05 bitcoins, or $243, is a low enough price to avoid further embarrassment. In the wake of the recent Ashley Madison e-mail dump, some customers have gotten demand e-mails like .. --------------------------------------------- http://arstechnica.com/business/2015/09/extorting-money-from-ashley-madison… *** Baby-Monitore sind leicht zu hacken *** --------------------------------------------- Wie ein Sicherheitsforscher herausfand, sind acht von neun Babyfons mit Internet-Verbindung relativ einfach als Spionage-Kameras einsetzbar. --------------------------------------------- http://futurezone.at/digital-life/baby-monitore-sind-leicht-zu-hacken/151.0… *** Auto-Hacking: Kritik an Sicherheitsupdates per Post *** --------------------------------------------- Wie stopft man kritische Sicherheitslücken in der Software von Autos? Nach Ansicht eines Sicherheitsexperten ist der von Fiat Chrysler gewählte Weg eine Einladung an Hacker. --------------------------------------------- http://www.golem.de/news/auto-hacking-kritik-an-sicherheitsupdates-per-post… *** Files on Seagate wireless disks can be poisoned, purloined *** --------------------------------------------- Download everything, seed with malware, move on to next sucker CERT.org has reported Seagate wireless hard drives include 'undocumented Telnet services' accessible with a hard-coded password and allowing unrestricted file .. --------------------------------------------- www.theregister.co.uk/2015/09/07/files_on_seagate_wireless_disks_can_be_poi… *** CryptDB: Angriff auf verschlüsselte Datenbanken *** --------------------------------------------- Ein Team von Microsoft-Wissenschaftlern hat einen Angriff auf die verschlüsselte Datenbank-Software CryptDB vorgestellt. Als Demonstrationsobjekt nutzte es US-Gesundheitsdatenbanken. Ein ehemaliger Entwickler kritisiert den Angriff jedoch als unrealistisch. --------------------------------------------- http://www.golem.de/news/cryptdb-angriff-auf-verschluesselte-datenbanken-15… *** Arrests Tied to Citadel, Dridex Malware *** --------------------------------------------- Authorities in Europe have arrested alleged key players behind the development and deployment of ultra-sophisticated banking malware, including Citadel and Dridex. The arrests involved a Russian national and a Moldovan man, both of whom were traveling .. --------------------------------------------- http://krebsonsecurity.com/2015/09/arrests-tied-to-citadel-dridex-malware/ *** Crypto-trouble in Poison Ivys C2 protocol *** --------------------------------------------- During the course of some research regarding the security of RAT C2 protocols and infrastructure i came across a stack buffer overflow disclosed in 2011 (OSVDB-83774) affecting the C2 server component of the Poison Ivy RAT. Poison Ivy (PIVY) is a golden oldie RAT probably everyone in infosec circles is familiar .. --------------------------------------------- https://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploit… *** Ghost Got Secrets - Ghostbins Guts Part 1 *** --------------------------------------------- Privacy and anonymity are critical tools for maintaining freedom in our growingly-digital world. Even so, privacy and anonymity are commonly used by individuals performing malicious activities. These two sides of the same coin are what .. --------------------------------------------- http://l.avala.mp/blog/ghost-got-secrets-ghostbins-guts-part-1/

1 0

Tageszusammenfassung - Freitag 4-09-2015
by Daily end-of-shift report 04 Sep '15

04 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 03-09-2015 18:00 − Freitag 04-09-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** More Adult Themed Android Ransomware *** --------------------------------------------- During the course of our daily malware hunt, we came across a new mobile ransomware variant that leverages pornography to lure victims into downloading and installing it. Wed previously .. --------------------------------------------- http://research.zscaler.com/2015/09/more-adult-themed-android-ransomware.ht… *** Analyzing Popular Layer 7 Application DDoS Attacks *** --------------------------------------------- Distributed Denial of Service (DDoS) attacks have been a major concern for website owners for a while. All types of sites, from small to big, have been taken down and kept offline because of them. Even over-provisioned servers can be .. --------------------------------------------- https://blog.sucuri.net/2015/09/analyzing-popular-layer-7-application-ddos-… *** Cogent DataHub Code Injection Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a code injection vulnerability affecting the Cogent DataHub application produced by Cogent Real-Time Systems, Inc. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-01 *** Schneider Electric Modicon PLC Vulnerabilities *** --------------------------------------------- This advisory is a follow-up to the alert titled ICS-ALERT-15-224-02 Schneider Electric Modicon M340 PLC Station P34 Module Vulnerabilities that was published August 12, 2015, to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for vulnerabilities in the Schneider Electric Modicon PLC. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02 *** Moxa Industrial Managed Switch Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Moxa EDS-405A/EDS-408A series managed Ethernet switches. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-246-03 *** SMA Solar Technology AG Sunny WebBox Hard-coded Account Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a hard-coded account vulnerability in the SMA Solar Technology AG Sunny WebBox product. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-181-02 *** APPLE-SA-2015-09-03-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- Due to security issues in older versions, Apple has updated the web plug-in blocking mechanism to disable all versions prior to Flash Player 18.0.0.232. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/Sep/msg00000.ht… *** Google, Mozilla, Microsoft to Sever RC4 Support in Early 2016 *** --------------------------------------------- Google and Mozilla today announced they've settled on a timeframe to permanently deprecate the shaky RC4 encryption algorithm. --------------------------------------------- http://threatpost.com/google-mozilla-microsoft-to-sever-rc4-support-in-earl… *** How to Kick-Out the Bad Guy? *** --------------------------------------------- A quick blog post about an issue I faced this morning. While drinking my morning coffee and reviewing what happened during the last night in my logs, I detected that one of my website (leakedin.com) was entirely mirrored by a guy from Brazil. I'm not against sharing information but in this case, it was consuming bandwidth and server resources for nothing. I was time to .. --------------------------------------------- https://blog.rootshell.be/2015/09/04/kick-bad-guy/ *** CVE-2014-7216: A Journey Through Yahoo's Bug Bounty Program *** --------------------------------------------- I have published another security advisory about a vulnerability, which I have 'recently' reported to Yahoo! via their Bug-Bounty program hosted by HackerOne. So this blog post is about the technical details of the CVE-2014-7216 (which is not very thrilling), but more about my experience with Yahoo's Bug Bounty program. --------------------------------------------- https://www.rcesecurity.com/2015/09/cve-2014-7216-a-journey-through-yahoos-… *** LinkedIn Sockpuppets Are Targeting Security Researchers *** --------------------------------------------- Multiple LinkedIn accounts recently targeted numerous security specialists in an attempt to map their social graphs. Several of our researchers received these LinkedIn invitations themselves and Daavid from our Threat Intelligence team decided to investigate. Here's an example of one so-called 'recruiter' account. --------------------------------------------- https://labsblog.f-secure.com/2015/09/03/linkedin-sockpuppets-targeting-sec… *** Office Malware: AGB gegen Spammer *** --------------------------------------------- Ein russischer Entwickler möchte nicht, dass seine Office Malware MWI von Spammern verwendet wird. Doch seine allgemeinen Geschäftsbedingungen zeigen nur begrenzt Wirkung. Ein kurioser Blick in den Malware-Markt. --------------------------------------------- http://www.golem.de/news/office-malware-agb-gegen-spammer-1509-116130.html *** Sleepy Puppy: Netflix-Tool jagt XXS-Lücken *** --------------------------------------------- Sicherheitsforscher können mit Sleepy Puppy tief in Netzwerken graben und an verschiedenen Stellen Schwachstellen für Cross-Site-Scripting ausfindig machen. --------------------------------------------- http://heise.de/-2805316 *** Nach Erpressungsversuch: Webhoster 1blu tauscht tausende SSL-Zertifikate *** --------------------------------------------- Vor zwei Monaten Erfuhr die Hosting-Firma, dass sich ein Angreifer weitreichenden Zugriff auf Kundendaten verschaffen konnte. Jetzt stellt sich heraus, dass offenbar auch die SSL-Zertifikate der Kunden betroffen sind. --------------------------------------------- http://heise.de/-2803573

1 0

Tageszusammenfassung - Donnerstag 3-09-2015
by Daily end-of-shift report 03 Sep '15

03 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 02-09-2015 18:00 − Donnerstag 03-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Neuer Banking-Trojaner taucht auch in Österreich auf *** --------------------------------------------- IBM-Forscher haben mit "Shifu" einen neuen Trojaner identifiziert, der es auf Banken aus Deutschland, Japan und Österreich abgesehen hat. --------------------------------------------- http://futurezone.at/digital-life/neuer-banking-trojaner-taucht-auch-in-oes… *** New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe *** --------------------------------------------- New variants of the notorious Carbanak Trojan has surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed. Carbanak has been in use for several years, and researchers at Kaspersky Lab earlier this year revealed the... --------------------------------------------- http://threatpost.com/new-versions-of-carbanak-banking-malware-seen-hitting… *** Cross-Site-Scripting: Netflix stellt Tool zum Auffinden von Sicherheitslücken vor *** --------------------------------------------- Der Streamingdienst Netflix erstellt nicht nur aufwendige Eigenproduktionen, sondern entwickelt auch Sicherheitstools. Jetzt hat das Unternehmen ein Werkzeug zum Auffinden von Schwächen von Cross-Site-Scripting vorgestellt. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-netflix-stellt-tool-zum-auffi… *** New Android Ransomware Communicates over XMPP *** --------------------------------------------- A new strain of Android ransomware disguised as a video player app uses an instant messaging protocol called XMPP to receive commands and communicate with the command and control server. --------------------------------------------- http://threatpost.com/new-android-ransomware-communicates-over-xmpp/114530 *** CVE-2015-5722: Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c *** --------------------------------------------- Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from a zone containing a deliberately malformed key. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5722-parsing-malformed-keys-may-cause-bi… *** CVE-2015-5986: An incorrect boundary check can trigger a REQUIRE assertion failure in openpgpkey_61.c *** --------------------------------------------- An incorrect boundary check in openpgpkey_61.c can cause named to terminate due to a REQUIRE assertion failure. This defect can be deliberately exploited by an attacker who can provide a maliciously constructed response in answer to a query. --------------------------------------------- https://www.isc.org/blogs/cve-2015-5986-an-incorrect-boundary-check-can-tri… *** Cisco Integrated Management Controller Supervisor and Cisco UCS Director Remote File Overwrite Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Symantec Ghost Explorer Utility Tool Out-of-Bounds Array Indexing *** --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** EMC Atmos XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033456 *** Bugtraq: [SYSS-2015-016] Avaya one-X Agent - Hard-coded Cryptographic Key *** --------------------------------------------- http://www.securityfocus.com/archive/1/536386 *** Bugtraq: Checkmarx CxQL Sandbox bypass (CVE-2014-8778) *** --------------------------------------------- http://www.securityfocus.com/archive/1/536387 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in IBM Java Runtime affect Watson Explorer, Watson Content Analytics, and OmniFind Enterprise Edition (CVE-2015-2613, CVE-2015-2601, CVE-2015-2625, CVE-2015-1931) *** http://www.ibm.com/support/docview.wss?uid=swg21965348 *** IBM Security Bulletin: Vulnerability in OpenSSL affects IBM Security Proventia Network Enterprise Scanner (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792, CVE-2015-3216) *** http://www.ibm.com/support/docview.wss?uid=swg21965845 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Network Controller (CVE-2015-1793) *** http://www.ibm.com/support/docview.wss?uid=swg21965725 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Security Network Controller (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21964035 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Connect:Direct Browser User Interface *** http://www.ibm.com/support/docview.wss?uid=swg21965448 *** IBM Security Bulletin: Multiple Security Issues in IBM Media Server Due to OpenSSL Issues *** http://www.ibm.com/support/docview.wss?uid=swg21963783 *** IBM Security Bulletin: Multiple security vulnerabilities have been identified in IBM Security Identity Manager Virtual Appliance (CVE-2015-1788 and CVE-2015-1885) *** http://www.ibm.com/support/docview.wss?uid=swg21964241 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Flex System Power Compute Node Firmware (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022656 *** ZDI-15-418: (0Day) Borland AccuRev Reprise License Server edit_lf_process Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Ejh3XZSEdr0/ *** ZDI-15-417: (0Day) Borland AccuRev Reprise License Server edit_lf_get_data Command lf Parameter Path Traversal Read Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/hC9GLRY4Jiw/ *** ZDI-15-416: (0Day) Borland AccuRev Reprise License Server service_setup_doit Command Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/BQougUpI_Ys/ *** ZDI-15-415: (0Day) Borland AccuRev Reprise License Management Server Path Traversal Remote Code Execution Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/WM0upaoUI1c/ *** ZDI-15-414: (0Day) Borland AccuRev Reprise License Server activate_doit Command actserver Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Nr36Je9oEJU/ *** ZDI-15-413: (0Day) Borland AccuRev Reprise License Server diagnostics_doit Command outputfile Parameter File Overwrite Denial of Service Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/fhh7V-Xsyjc/ *** ZDI-15-412: (0Day) Borland AccuRev Reprise License Server activate_doit Command akey Parameter Stack Buffer Overflow Vulnerability *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/q60XWhjbHKo/ *** ZDI-15-411: (0Day) Borland AccuRev SaveContentServiceImpl Servlet Path Traversal Remote File Read And Deletion Vulnerabilities *** --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/oMSmmw2PaFA/

1 0

Tageszusammenfassung - Mittwoch 2-09-2015
by Daily end-of-shift report 02 Sep '15

02 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 01-09-2015 18:00 − Mittwoch 02-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Demystifying File and Folder Permissions *** --------------------------------------------- If you have poked around a server before you have probably encountered file permissions. In fact, all computer file systems offer permissions based on the same core ideas. The file permissions in Linux, Mac, and Windows computers are very similar to the file and folder permissions in Apache, Nginx, and IIS servers. You can right-clickRead More The post Demystifying File and Folder Permissions appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/09/demystifying-file-and-folder-permissions.ht… *** Whats the situation this week for Neutrino and Angler EK?, (Wed, Sep 2nd) *** --------------------------------------------- Introduction Last month in mid-August 2015, an actor using Angler exploit kit (EK) switched to Neutrino EK [1]. A few days later, we found that actor using Angler again [2]. This week, were back to seeingNeutrino EK from the same actor. Neutrino EK from this actor is sending TeslaCrypt 2.0 as the payload. We also saw another actor use Angler EK to pushBedep during the same timeframe. Todays diary looks at two infection chains from Tuesday 2015-09-01, one for Angler EK and another for Neutrino. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20101&rss *** Verschlüsselung: Microsoft, Google und Mozilla schalten RC4 2016 ab *** --------------------------------------------- Es ist ein überfälliger Schritt: Microsoft, Google und Mozilla haben angekündigt, den unsicheren Verschlüsselungsalgorithmus RC4 ab 2016 in ihren Produkten endgültig nicht mehr zu verwenden. Ein konkretes Datum nennt bislang jedoch nur Mozilla. --------------------------------------------- http://www.golem.de/news/verschluesselung-microsoft-google-und-mozilla-scha… *** Per Web und USB-Stick: Smart-TVs vielfältig angreifbar *** --------------------------------------------- Mit vergleichsweise simplen Methoden haben Sicherheitsforscher App-Nutzerdaten von Medienabspielern und Smart TVs ausgelesen. Dabei konnten sie auch die Kamera aktivieren und bis auf die Root-Ebene vordringen. --------------------------------------------- http://heise.de/-2797227 *** Router-Lücken: Belkin N600 DB macht es den Hackern einfach *** --------------------------------------------- Die Beschreibung der Lücken in Belkins Heimrouter liest sich wie ein Handbuch mit Negativbeispielen der Firmware-Programmierung. Angreifer können die Nutzer des Routers unter anderem auf beliebige Webseiten umleiten. Abhilfe gibt es nicht. --------------------------------------------- http://heise.de/-2800853 *** IBM: CoreBot malware - simple but dangerous info stealer *** --------------------------------------------- IBMs X-Force research team has uncovered a new piece of data-swiping malware whose modular design allows it to be quickly altered and made even more dangerous. --------------------------------------------- http://www.scmagazine.com/x-force-team-uncovers-data-swiping-malware/articl… *** Factoring RSA Keys With TLS Perfect Forward Secrecy *** --------------------------------------------- What is being disclosed today? Back in 1996, Arjen Lenstra described an attack against an optimization (called the Chinese Remainder Theorem optimization, or RSA-CRT for short). If a fault happened during the computation of a signature (using the RSA-CRT optimization),... --------------------------------------------- https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perf… *** Adware-Installer erschleicht Zugriff auf den Mac-Schlüsselbund *** --------------------------------------------- Ein neuer Adware-Installer nutzt nach Angabe von Sicherheitsforschern einen simplen Trick, um sich ohne weiteres Zutun des Nutzers Zugang zum Schlüsselbund von OS X einzuräumen. --------------------------------------------- http://heise.de/-2802238 *** Cisco NX-OS Malformed ARP Header Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40748 *** VU#903500: Seagate 36C wireless hard-drive contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#903500 Seagate 36C wireless hard-drive contains multiple vulnerabilities Original Release date: 01 Sep 2015 | Last revised: 01 Sep 2015 Overview The Seagate 36C wireless hard-drive contains multiple vulnerabilities. Description CWE-798: Use of Hard-coded Credentials - CVE-2015-2874 The Seagate 36C wireless hard-drive provides undocumented Telnet services accessible by using the default credentials of root as username and the default password.CWE-425: Direct Request --------------------------------------------- http://www.kb.cert.org/vuls/id/903500 *** ZDI-15-408: Hewlett-Packard LoadRunner Controller Scenario File Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability could allow attackers to execute arbitrary code on vulnerable installations of HP LoadRunner. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-408/ *** Siemens RUGGEDCOM ROS IP Forwarding Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an IP forwarding vulnerability in older versions of Siemens RUGGEDCOM ROS. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-244-01 *** Edimax BR6228nS/BR6228nC - Multiple vulnerabilities *** --------------------------------------------- Topic: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities Risk: Medium Text:# Title: Edimax BR6228nS/BR6228nC - Multiple vulnerabilities # Date: 01.09.15 # Vendor: edimax.com # Firmware version: 1.22 ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090013 *** Security Advisory - No Authentication Vulnerability on the Serial Port of the UAP2105 *** --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23269]: Cross-Site Request Forgery in Cerb *** --------------------------------------------- Product: Cerb v7.0.3Vulnerability Type: Cross-Site Request Forgery [CWE-352]Risk level: Medium Creater: Webgroup Media LLCAdvisory Publication: August 12, 2015 [without technical details]Public Disclosure: September 2, 2015 CVE Reference: CVE-2015-6545 CVSSv2 Base Score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P) Vulnerability Details: High-Tech Bridge Security Research Lab discovered CSRF vulnerability in Cerb platform, which can be exploited to perform Cross-Site Request Forgery attacks against --------------------------------------------- https://www.htbridge.com/advisory/HTB23269 *** DFN-CERT-2015-1353: Xen: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1353/ *** Bugtraq: ESA-2015-137: EMC Atmos XML External Entity Injection Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536377 *** SiS Windows VGA Display Manager Multiple Privilege Escalation *** --------------------------------------------- Topic: SiS Windows VGA Display Manager Multiple Privilege Escalation Risk: Medium Text:KL-001-2015-003 : SiS Windows VGA Display Manager Multiple Privilege Escalation Title: SiS Windows VGA Display Manager Mult... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090019 *** XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation *** --------------------------------------------- Topic: XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Risk: Medium Text:KL-001-2015-004 : XGI Windows VGA Display Manager Arbitrary Write Privilege Escalation Title: XGI Windows VGA Display Manag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015090018 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM SONAS (CVE-2015-2613) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005343 *** IBM Security Bulletin: HTTP Request smuggling vulnerability may affect IBM HTTP Server (CVE-2015-3183) *** http://www.ibm.com/support/docview.wss?uid=swg21963361 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Tealeaf Customer Experience *** http://www.ibm.com/support/docview.wss?uid=swg21960713 *** IBM Security Bulletin: IBM WebSphere MQ 7.0.1 potential denial of service (CVE-2015-2013) *** http://www.ibm.com/support/docview.wss?uid=swg21962479 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects TS3100/TS3200 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005368&myns=s034&m… *** IBM Security Bulletin: IBM Maximo Asset Management could allow a local attacker to obtain information due to the autocomplete feature on password input fields (CVE-2015-1933) *** http://www.ibm.com/support/docview.wss?uid=swg21965080 *** IBM Security Bulletin: Default Password Requirements are weak on new installations of IBM Maximo Asset Management (CVE-2015-1934) *** http://www.ibm.com/support/docview.wss?uid=swg21964855 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098599

1 0

Tageszusammenfassung - Dienstag 1-09-2015
by Daily end-of-shift report 01 Sep '15

01 Sep '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 31-08-2015 18:00 − Dienstag 01-09-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How the SIEM Solution Can Help in Achieving PCI-DSS *** --------------------------------------------- We all know that PCI-DSS is one of the toughest compliances/certifications to hold, but organizations that seek to be PCI-DSS compliant can greatly benefit if they incorporate a SIEM solution around the Card Holder Data Environment (CDE). In this article, we will learn how the SIEM solution can be leveraged to satisfy a majority of... --------------------------------------------- http://resources.infosecinstitute.com/how-the-siem-solution-can-help-in-ach… *** Microsoft accused of adding spy features to Windows 7, 8 *** --------------------------------------------- The privacy impact of Windows telemetry features continues to be scrutinized. --------------------------------------------- http://arstechnica.com/information-technology/2015/08/microsoft-accused-of-… *** ORX Locker, the new Darknet Ransomware-as-a-service platform *** --------------------------------------------- Security experts at Sensecy have uncovered ORX-Locker, a Darknet Ransomware-as-a-service platform that could allow everyone to become a cyber criminal. It is becoming even easier to become a cyber-criminal thanks to the model of sale known as malware-as-a-service that offers off-the-shelf malware for rent or sale. Recently malware authors started to offer also Ransomware-as-a-Service (RaaS), in... --------------------------------------------- http://securityaffairs.co/wordpress/39753/cyber-crime/orx-locker-raas.html 3430 *** l+f: Simuliertes Firmennetz als Spielwiese für Hacker *** --------------------------------------------- Im simulierten Netzwerk des Penetration Test Lab kann man virtuellen Systemen mit echten Pentesting-Tools auf den Zahn fühlen. --------------------------------------------- http://heise.de/-2795897 *** Android: Mehr Smartphones mit vorinstallierter Malware *** --------------------------------------------- Zwischenhändler sollen immer mehr Modelle aus dem Android-Lager vor dem Verkauf manipulieren, indem sie beliebte Apps mit Malware-Komponenten ausstatten und auf den Geräten installieren. --------------------------------------------- http://heise.de/-2794608 *** MassVet finds unknown malicious apps in app stores in 10 Sec *** --------------------------------------------- A group of researchers have developed a method dubbed Mass Vetting (MassVet) to find unknown malicious apps in app stores in 10 Seconds. A group of University researchers has created a new method for detecting malicious apps running on an Android devices called MassVet. MassVet doesn't use the old method of signatures scanning, instead it compares... --------------------------------------------- http://securityaffairs.co/wordpress/39762/malware/massvet-android-scan.html *** iOS-Trojaner ermöglichte Einkauf im App Store mit gehackten Accounts *** --------------------------------------------- Palo Alto Networks hat Details zu der letzte Woche entdeckten Hintertür in mehreren in China verteilten Jailbreak-Apps und Tweaks genannt. Demnach arbeitet die Malware äußerst trickreich. Gestohlen wurden 225.000 iCloud-Accounts. --------------------------------------------- http://heise.de/-2795857 *** Tired of memorizing passwords? A Turing Award winner came up with this algorithmic trick *** --------------------------------------------- Passwords are a bane of life on the Internet, but one Turing Award winner has an algorithmic approach that he thinks can make them not only easier to manage but also more secure.The average user has some 20 passwords today, and in general the easier they are to remember, the less secure they are. When passwords are used across multiple websites, they become even weaker.Manuel Blum, a professor of computer science at Carnegie Mellon University who won the Turing Award in 1995, has been working... --------------------------------------------- http://www.csoonline.com/article/2978170/data-protection/tired-of-memorizin… *** What Can you Learn from Metadata? *** --------------------------------------------- An Australian reporter for the ABC, Will Ockenden published a bunch of his metadata, and asked people to derive various elements of his life. They did pretty well, even though they were amateurs, which should give you some idea what professionals can do.... --------------------------------------------- https://www.schneier.com/blog/archives/2015/09/what_can_you_le.html *** Cisco AsyncOS for Cisco Email Security Appliance and Cisco Web Security Appliance Cluster Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39785 *** Cisco ASR 1000 Series Aggregation Services Routers Data-Plane Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40708 *** DSA-3346 drupal7 - security update *** --------------------------------------------- Several vulnerabilities were discovered in Drupal, a content managementframework: --------------------------------------------- https://www.debian.org/security/2015/dsa-3346 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_gb *** Bugtraq: [security bulletin] HPSBMU03401 rev.1 - HP Operations Manager for UNIX and Linux, Remote Unauthorized Modification, Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536363 *** Bugtraq: [security bulletin] HPSBGN03403 rev.1 - HP Virtualization Performance Viewer, Remote Unauthorized Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/536364 *** DFN-CERT-2015-1329: MediaWiki: Mehrere Schwachstellen ermöglichen u.a. einen Denial-of-Service-Angriff *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1329/ *** Security Advisory: Apache HTTP server vulnerability CVE-2008-0455 *** --------------------------------------------- (SOL17201) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/200/sol17201.htm… *** USN-2727-1: GnuTLS vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2727-11st September, 2015gnutls28 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04SummaryGnuTLS could be made to crash or run programs if it processed a speciallycrafted certificate.Software description gnutls28 - GNU TLS library DetailsIt was discovered that GnuTLS incorrectly handled parsing CRL distributionpoints. A remote attacker could possibly use this issue to cause a denialof service, or execute arbitrary --------------------------------------------- http://www.ubuntu.com/usn/usn-2727-1/ *** USN-2726-1: Expat vulnerability *** --------------------------------------------- Ubuntu Security Notice USN-2726-131st August, 2015expat vulnerabilityA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryExpat could be made to crash or run programs as your login if it opened aspecially crafted file.Software description expat - XML parsing C library DetailsIt was discovered that Expat incorrectly handled malformed XML data. If auser or application linked against Expat were tricked into opening acrafted --------------------------------------------- http://www.ubuntu.com/usn/usn-2726-1/ *** VU#361684: Router devices do not implement sufficient UPnP authentication and security *** --------------------------------------------- Vulnerability Note VU#361684 Router devices do not implement sufficient UPnP authentication and security Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Home routers implementing the UPnP protocol do not sufficiently randomize UUIDs in UPnP control URLs, or implement other UPnP security measures. Description The UPnP protocol allows automatic device discovery and interaction with devices on a network. The UPnP protocol was originally designed with the threat model of --------------------------------------------- http://www.kb.cert.org/vuls/id/361684 *** VU#201168: Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#201168 Belkin N600 DB Wireless Dual Band N+ router contains multiple vulnerabilities Original Release date: 31 Aug 2015 | Last revised: 31 Aug 2015 Overview Belkin N600 DB Wireless Dual Band N+ router, model F9K1102 v2 with firmware version 2.10.17 and possibly earlier, contains multiple vulnerabilities. Description CWE-330: Use of Insufficiently Random Values - CVE-2015-5987DNS queries originating from the Belkin N600, such as those to resolve the names of firmware --------------------------------------------- http://www.kb.cert.org/vuls/id/201168

1 0

Tageszusammenfassung - Montag 31-08-2015
by Daily end-of-shift report 31 Aug '15

31 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 28-08-2015 18:00 − Montag 31-08-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** OWASP veröffentlicht Handbuch zum Schutz gegen automatisierte Angriffe *** --------------------------------------------- Als Hilfe für das Absichern von Webanwendungen hat die Non-Profit-Organisation OWASP ein Handbuch für Entwickler herausgebracht, das bislang wenig beachtete Angriffe beschreibt. --------------------------------------------- http://heise.de/-2794167 *** Spionage-Trojaner Regin: Symantec entdeckt 49 weitere Module *** --------------------------------------------- Das Sicherheitsunternehmen Symantec hatte Ende des vergangenen Jahres die Ausspähungssoftware "Regin" entdeckt. Nun warten die Experten mit neuen Einzelheiten auf. --------------------------------------------- http://heise.de/-2794176 *** Linux Foundation releases PARANOID internal infosec guide *** --------------------------------------------- Workstation security tips for system administrators. Linux Foundation project director Konstantin Ryabitsev has publicly-released the penguinistas internal hardening requirements to help sysadmins and other paranoid tech bods and system administrators secure their workstations. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/31/harden_like… *** Detecting file changes on Microsoft systems with FCIV, (Mon, Aug 31st) *** --------------------------------------------- Microsoft releases often interesting tools to help system administrators and incident handlers to investigate suspicious activities on Windows systems. In 2012, they released a free tool called FCIV(File Checksum Integrity Verifier)(1). It is a stand alone executable which does not require any DLL or other resources. Just launch it from any location.Its goal is to browse a file system or some directories recursively and to generate MD5/SHA1 hashes of all the files found. The results are saved in a... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20091&rss *** Schwachstellen in Kontrollsoftware von Kraftwerken und Raffinerien *** --------------------------------------------- Siemens und Schneider Electric haben eine Reihe von Lücken in SCADA-Systemen geschlossen. Zum Teil kommt die betroffene Software auch in deutschen Kraftwerken zum Einsatz. --------------------------------------------- http://heise.de/-2794724 *** Security: Standardpasswörter bei Heimroutern entdeckt *** --------------------------------------------- Mindestens fünf Router diverser Hersteller haben leicht zu erratene Standardpasswörter für den administrativen Zugang. Mit ihnen lassen sich die Geräte aus der Ferne manipulieren. --------------------------------------------- http://www.golem.de/news/security-standardpasswoerter-bei-heimroutern-entde… *** Contributor Conference: Owncloud führt Programm für Bug-Bounties ein *** --------------------------------------------- Hacker können nun auch mit der Sicherheitsprüfung von Owncloud Geld verdienen. Die Prämien können sich allerdings noch nicht mit denen von großen Unternehmen wie Google oder Microsoft messen. --------------------------------------------- http://www.golem.de/news/contributor-conference-owncloud-fuehrt-programm-fu… *** Whos afraid of shadow IT? *** --------------------------------------------- One of the biggest disruptions in the IT world is the quantity and quality of SaaS tools. From email and storage, to phone systems and infrastructure, it has never been easier to use top of the range ... --------------------------------------------- http://www.net-security.org/article.php?id=2373 *** KeyRaider Malware Steals Certificates, Keys and Account Data From Jailbroken iPhones *** --------------------------------------------- Researchers have discovered a new strain of iOS malware dubbed KeyRaider that targets jailbroken devices and has the ability to steal certificates, private keys, and Apple account information. The malware already has claimed the private Apple account data of more than 225,000 victims. The KeyRaider malware was discovered by researchers at Palo Alto Networks, who... --------------------------------------------- http://threatpost.com/keyraider-malware-steals-certificates-keys-and-accoun… *** SSD Advisory - AppLock Multiple Vulnerabilities *** --------------------------------------------- The following report describes three ( 3 ) different vulnerabilities found in the AppLock, an Android application, with over 10 Millions of downloads, used to secure pictures, videos and application with a PIN code. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2558 *** DRDoS, UDP-Based protocols and BitTorrent *** --------------------------------------------- On July 1st, 2015, the security team at BitTorrent received a report [1] from Florian Adamsky about Distributed Reflective Denial of Service (DRDoS) vulnerabilities affecting several BitTorrent products making use of UDP-based [2] protocols. uTorrent, BitTorrent and BitTorrent Sync use the Micro Transport Protocol (µTP) [3] implementation in libuTP [4] as the preferred transport backend running on top of UDP. While these vulnerabilities have been described before in other alerts [5] in... --------------------------------------------- http://engineering.bittorrent.com/2015/08/27/drdos-udp-based-protocols-and-… *** Patch für Schwachstelle in Hewlett Packard lt4112 LTE/HSPA+ Gobi 4G Module (Remote Execution of Arbitrary Code) *** --------------------------------------------- Hewlett Packard hat ein Security Bulletin zu einer Sicherheitslücke im HP lt4112 LTE/HSPA+ Gobi 4G Module veröffentlicht. Die Schwachstelle erlaubt einem entfernten Angreifer das Ausführen beliebigen Codes. Ein Firmware-Update, welches das Problem behebt, ist verfügbar. CVE-Nummern: CVE-2015-5367, CVE-2015-5367 CVSS2 Base Score: 6.9... --------------------------------------------- http://www.cert.at/services/blog/20150831172201-1588.html *** TA15-240A: Controlling Outbound DNS Access *** --------------------------------------------- Original release date: August 28, 2015 Systems Affected Networked systems Overview US-CERT has observed an increase in Domain Name System (DNS) traffic from client systems within internal networks to publically hosted DNS servers. Direct client access to Internet DNS servers, rather than controlled access through enterprise DNS servers, can expose an organization to unnecessary security risks and system inefficiencies. This Alert provides recommendations for improving security related to... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-240A *** NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 4.1.1.1-9 *** --------------------------------------------- Abstract: NetIQ Access Manager 4.1 Support Pack 1 Hot Fix 1 build (version 4.1.1.1-9). This file contains updates for services contained in the NetIQ Access Manager 4.1 product and requires 4.1 SP1 to be installed as a minimum. NetIQ recommends that all customers running Access Manager 4.1 release code apply this patch. The purpose of the patch is to provide a bundle of fixes for security issues that have surfaced since NetIQ Access Manager 4.1 SP1 was released. These fixes include updates to... --------------------------------------------- https://download.novell.com/Download?buildid=ceIVdhBEV2o~ *** Edimax PS-1206MF Web Admin Auth Bypass *** --------------------------------------------- Topic: Edimax PS-1206MF Web Admin Auth Bypass Risk: High Text:# Title: Edimax PS-1206MF - Web Admin Auth Bypass # Date: 30.08.15 # Vendor: edimax.com # Firmware version: 4.8.25 # Author... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080183 *** HPSBMU03416 rev.1 - HP Data Protector, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Data Protector. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" also known as "Poodle", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04776510 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Potential Information Disclosure vulnerability could expose user personal data in WebSphere Commerce (CVE-2015-4980) *** http://www.ibm.com/support/docview.wss?uid=swg21965013 *** IBM Security Bulletin: Java CVE-2015-2590 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020888 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Direct for HP NonStop (CVE-2015-1792, CVE-2015-1789, CVE-2015-1790) *** http://www.ibm.com/support/docview.wss?uid=swg21963603 *** IBM Security Bulletin: Apache Tomcat Vulnerability in Algo Audit and Compliance (CVE-2014-0230 ) *** http://www.ibm.com/support/docview.wss?uid=swg21963664 *** IBM Security Bulletin: Apache Tomcat vulnerability affects IBM Storwize V7000 Unified (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005258 *** IBM Security Bulletin: Vulnerability in Rational DOORS Next Generation and Rational Requirements Composer with potential for Cross Site Scripting attack (CVE-2015-1917) *** http://www.ibm.com/support/docview.wss?uid=swg21713610 *** IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Storwize V7000 Unified (CVE-2013-7423) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005316 *** Security Bulletin: Multiple vulnerabilities in libxml2 affect IBM Flex System Manger (FSM) (CVE-2013-2877, CVE-2014-0191, CVE-2014-3660) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098592 *** Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Flex System Manager (FSM) (Multiple CVEs) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098591 *** WordPress Responsive Thumbnail Slider 1.0 Shell Upload *** --------------------------------------------- Topic: WordPress Responsive Thumbnail Slider 1.0 Shell Upload Risk: High Text:<!-- # Exploit Title: Wordpress Responsive Thumbnail Slider Arbitrary File Upload # Date: 2015/8/29 # Exploit Author: Arash ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080170

1 0

Tageszusammenfassung - Freitag 28-08-2015
by Daily end-of-shift report 28 Aug '15

28 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 27-08-2015 18:00 − Freitag 28-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Update: Hotfix Available for ColdFusion (APSB15-21) *** --------------------------------------------- A Security Bulletin (APSB15-21) has been published regarding a hotfix for ColdFusion. This hotfix addresses an important vulnerability that could result in information disclosure. Adobe recommends users apply the hotfix using the instructions provided .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1262 *** DSA-3344 php5 - security update *** --------------------------------------------- https://www.debian.org/security/2015/dsa-3344 *** Cisco Identity Services Engine Guest Portal Unauthorized Access Vulnerability *** --------------------------------------------- A vulnerability in the Cisco Identity Services Engine (ISE) guest portal could allow an unauthenticated, remote attacker to view a customized page on the guest portal. The vulnerability is due to lack of access control for the uploaded HTML files. An attacker could exploit this vulnerability .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40691 *** BitTorrent kills bug that turns networks into a website-slaying weapon *** --------------------------------------------- Reflective technique would let attacker amplify traffic and flood targets BitTorrent has fixed a flaw in its technology that quietly turns file-sharing networks into weapons .. --------------------------------------------- www.theregister.co.uk/2015/08/28/bittorrent_blasts_bug/ *** Google makes it official: Chrome will freeze Flash ads on sight from Sept 1 *** --------------------------------------------- Browser to make most stuff click-to-play by default Google is making good on its promise to strangle Adobe Flashs ability to .. --------------------------------------------- www.theregister.co.uk/2015/08/28/google_says_flash_ads_out_september/ *** BSI warnt vor Risiko bei Intels Fernwartungstechnik AMT *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik rät dazu, die Konfiguration von Notebooks und Desktop-PCs mit Intels Active Management Technology zu prüfen: Bei manchen .. --------------------------------------------- http://heise.de/-2792791 *** Business Email Scams: A Growing Threat *** --------------------------------------------- Business Email Scams: is that email from the CEO asking for a wire transfer the real deal? Learn to spot .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/business-email-scams-… *** Moxa SoftCMS Buffer Overflow Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for buffer overflow vulnerabilities in the Moxa SoftCMS software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-01 *** Siemens SIMATIC S7-1200 CSRF Vulnerability *** --------------------------------------------- This advisory provides mitigation details for Cross-Site Request Forgery vulnerability in the SIMATIC S7 1200 CPUs. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-02 *** Innominate mGuard VPN Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a denial-of-service vulnerability in the Innominate mGuard device --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-239-03 *** This PUP Alerts You of a Zombie Invasion *** --------------------------------------------- Apps are constantly created to address certain needs. The more helpful an app claims to be, especially in times of crisis, the more users would likely take interest in .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/draft-this-pup-alerts… *** Fake EFF site serving espionage malware was likely active for 3+ weeks *** --------------------------------------------- A spear-phishing campaign some researchers say is linked to the Russian government masqueraded as the Electronic Frontier Foundation in an attempt to infect targets with malware .. --------------------------------------------- http://arstechnica.com/security/2015/08/fake-eff-site-serving-espionage-mal…

1 0

Tageszusammenfassung - Donnerstag 27-08-2015
by Daily end-of-shift report 27 Aug '15

27 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 26-08-2015 18:00 − Donnerstag 27-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Not a GAMe maKER *** --------------------------------------------- Raul Alvarez performs low-level analysis of information-stealing trojan.The Gamker information-stealing trojan (also known as Shiz) has been around for a few years. It made the news back in 2013 when it was found to target SAP .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_26.xml *** Patched Ins0mnia Vulnerability Keeps Malicious iOS Apps Hidden *** --------------------------------------------- Apple's monster security update of Aug. 13 included a patch for an iOS vulnerability that could beacon out location data and other personal information from a device, even if a .. --------------------------------------------- http://threatpost.com/patched-ins0mnia-vulnerability-keeps-malicious-ios-ap… *** Concerns new Tor weakness is being exploited prompt dark market shutdown *** --------------------------------------------- A dark market website that relies on the Tor privacy network to keep its operators anonymous is temporarily shutting down amid concerns attackers are exploiting a newly reported weakness .. --------------------------------------------- http://arstechnica.com/security/2015/08/concerns-new-tor-weakness-is-being-… *** Cisco ACE 4710 Application Control Engine CLI Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40666 *** PDF + maldoc1 = maldoc2 *** --------------------------------------------- I received another example of a PDF file that contains a malicious MS Office document. Sample (MD5 0c044fd59cc6ccc28a48937bc69cc0c4). This time I want to focus on the analysis of such a sample. First we run pdfid to identify the sample. It contains .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20079 *** Taking root *** --------------------------------------------- We analyzed the statistics we had collected from May to August 2015 and identified three main Trojan families that use root privileges on the device to achieve their goals. --------------------------------------------- http://securelist.com/blog/mobile/71981/taking-root/ *** Throwback Thursday: Safe Hex in the 21st Century *** --------------------------------------------- This Throwback Thursday, we turn the clock back to July 2000, when we were already being warned that virus scanners were no longer enough.How many times have we heard commentators claim that anti-virus is dead? After all, in the current .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_27.xml *** Phisher greifen iranische Aktivisten an, umgehen Googles Multifaktor-Anmeldung *** --------------------------------------------- Eine Serie von Phishing-Angriffen hat es anscheinend auf iranische Aktivisten und Dissidenten abgesehen. Auch eine hochrangige Mitarbeiterin der EFF wurde angegriffen. --------------------------------------------- http://heise.de/-2792580 *** Important Notice Regarding Public Availability of Stable Patches *** --------------------------------------------- Grsecurity has existed for over 14 years now. During this time it has been the premier solution for hardening Linux against security exploits and served as a role model for many mainstream commercial applications elsewhere. All modern OSes took our lead and implemented to varying degrees a number of security .. --------------------------------------------- https://grsecurity.net/announce.php *** Angler Exploit Kit Strikes on MSN.com via Malvertising Campaign *** --------------------------------------------- The same actors behind the recent Yahoo and Azure malvertising attacks went after MSN.com this time. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/08/angler-exploit-kit-str…

1 0

Tageszusammenfassung - Mittwoch 26-08-2015
by Daily end-of-shift report 26 Aug '15

26 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 25-08-2015 18:00 − Mittwoch 26-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Windows 10^H^H Symbolic Link Mitigations *** --------------------------------------------- For the past couple of years I've been researching Windows elevation of privilege attacks. This might be escaping sandboxing or gaining system privileges. One of the techniques I've used multiple times is abusing the symbolic link facilities of the Windows operating system to redirect privileged code to create .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mi… *** VB2015 preview: advanced persistent threats *** --------------------------------------------- There was a time when analyses of malware and viruses at the Virus Bulletin conference used the number of infections as a measure of the harm done. And while there are still many talks on what is now referred to as opportunistic malware, targeted .. --------------------------------------------- http://www.virusbtn.com/blog/2015/08_25.xml *** Dropbox Phishing via Compromised Wordpress Site, (Tue, Aug 25th) *** --------------------------------------------- I got a couple of emails today notifying me of a Compulsory Email Account Update for my Dropbox account. The e-mails do overall mimic the Dropbox look and feel, and use dropbox(a)smtp.com .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20073 *** Cisco TelePresence Video Communication Server Expressway TFTP Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40620 *** FunWebProducts UserAgent Bloating Traffic *** --------------------------------------------- Every once in a while we get a case that makes us dig deep to find answers. We have spoken before about the trouble with forensics and reasons why websites get hacked. Sometimes though, the answer is not clear and we can only gather clues to make .. --------------------------------------------- https://blog.sucuri.net/2015/08/funwebproducts-useragent-bloating-traffic.h… *** Actor that tried Neutrino exploit kit now back to Angler *** --------------------------------------------- Last week, we saw the group behind a significant amount of Angler exploit kit (EK) switch to Neutrino EK. We didnt know if the change was permanent, and I also noted that criminal groups using EKs have quickly changed tactics .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20075 *** l+f: https-fuer-Fortgeschrittene *** --------------------------------------------- Googles Chrome und die Open-Source-Basis Chromium laden eine Reihe von Web-Seiten immer via gesichertem HTTPS - darunter auch viele deutsche. --------------------------------------------- http://heise.de/-2790788 *** Endress+Hauser HART Device DTM Vulnerability *** --------------------------------------------- Alexander Bolshev and Svetlana Cherkasova of Digital Security have identified an improper input vulnerability in the CodeWrights GmbH HART Device Type Manager (DTM) library used in Endress+Hauser HART Device DTM. CodeWrights GmbH has addressed the vulnerability with a new library, which Endress+Hauser has begun to integrate. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-237-01 *** Dynamic DNS and You Part 2: Identifying the Threat *** --------------------------------------------- Greetings! You all really seemed to like my last post on Dynamic DNS, so Ive been invited to come back and talk more about it. In part 1 , we discussed the uses of Dynamic DNS, as well as the various providers of the service and how it all .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-and-you-pa… *** Netflix Is Dumping Anti-Virus, Presages Death Of An Industry *** --------------------------------------------- For years, nails have been hammering down on the coffin of anti-virus. But none have really put the beast to bed. An industry founded in the 1980s, a time when John McAfee was known as a pioneer rather than a tequila-downing rascal, .. --------------------------------------------- http://www.forbes.com/sites/thomasbrewster/2015/08/26/netflix-and-death-of-… *** CryptoGirl on StageFright: A Detailed Explanation *** --------------------------------------------- Detecting the PoCs published by Zimperium is not difficult: you can fingerprint the PoCs, for example. Detecting variants of the PoCs, i.e., MP4s that use one of the discovered vulnerabilities, is far more difficult. Ill explain why in a .. --------------------------------------------- http://blog.fortinet.com/post/cryptogirl-on-stagefright-a-detailed-explanat…

1 0

Tageszusammenfassung - Dienstag 25-08-2015
by Daily end-of-shift report 25 Aug '15

25 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 24-08-2015 18:00 − Dienstag 25-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Signed Dridex Campaign *** --------------------------------------------- Malware authors use various means to make their malware look similar to legitimate software. One such approach involves signing a malware sample with a digital certificate. Recently we saw Dridex malware authors using this technique while .. --------------------------------------------- http://research.zscaler.com/2015/08/signed-dridex-campaign.htm *** AlienSpy RAT Resurfaces as JSocket *** --------------------------------------------- The dismantled AlientSpy remote access Trojan, the same malware found on the phone of dead Argentine prosecutor Alberto Nisman, has resurfaced with new crypto and a new name. --------------------------------------------- http://threatpost.com/alienspy-rat-resurfaces-as-jsocket/114385 *** Cisco Prime Infrastructure Web Interface Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40652 *** RTF Exploit Installs Italian RAT: uWarrior *** --------------------------------------------- Unit 42 researchers have observed a new Remote Access Tool (RAT) constructed by an unknown actor of Italian origin. This RAT, referred to as uWarrior because of embedded PDB strings, has been previously described .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/rtf-exploit-installs-ita… *** Multiple vulnerabilities in Hewlett-Packard KeyView IDOL *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-405 http://www.zerodayinitiative.com/advisories/ZDI-15-404 http://www.zerodayinitiative.com/advisories/ZDI-15-403 http://www.zerodayinitiative.com/advisories/ZDI-15-402 http://www.zerodayinitiative.com/advisories/ZDI-15-401 http://www.zerodayinitiative.com/advisories/ZDI-15-400 http://www.zerodayinitiative.com/advisories/ZDI-15-399 http://www.zerodayinitiative.com/advisories/ZDI-15-398 http://www.zerodayinitiative.com/advisories/ZDI-15-397 *** Ask Sucuri: How Did My WordPress Website Get Hacked? *** --------------------------------------------- With the proliferation of Infrastructure and Platform as a Service providers, it is no surprise that a majority of today's websites are hosting in the proverbial cloud. This is great because it allows organizations and individuals alike to quickly deploy their websites, with relatively little overhead .. --------------------------------------------- https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get… *** What I learned from cracking 4000 Ashley Madison passwords *** --------------------------------------------- When the Ashley Madison database first got dumped, there was an interesting contingent of researchers talking about how pointless it would be to crack the passwords, .. --------------------------------------------- http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4000.html *** Browsefox variant High Stairs *** --------------------------------------------- https://blog.malwarebytes.org/security-threat/2015/08/browsefox-variant-hig… *** Datenschutz: Ashley Madison wusste von gravierenden Sicherheitsmängeln *** --------------------------------------------- Einige Wochen vor dem Angriff des Impact Teams warnten interne Sicherheitsexperten vor gravierenden Mängeln in der Infrastruktur der Webseite. --------------------------------------------- http://www.golem.de/news/datenschutz-ashley-madison-wusste-von-gravierenden… *** Ashley Madison: Gehackte Seitensprung-Site hackte eigene Konkurrenz *** --------------------------------------------- Die Dating-Webseite, die vor kurzem Opfer eines Hacker-Angriffs und Datenleck wurde, hat vor einigen Jahren selbst eine Konkurrenzplattform angegriffen. Dabei soll der Technikchef von Ashley Madison die Datenbank der Konkurrenz kopiert haben. --------------------------------------------- http://heise.de/-2790189 *** Are Data Breaches Getting Larger? *** --------------------------------------------- This research says that data breaches are not getting larger over time. "Hype and Heavy Tails: A Closer Look at Data Breaches," by Benjamin Edwards, Steven Hofmeyr, and Stephanie Forrest: Abstract: Recent widely publicized data breaches have .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/are_data_breach.html *** You are the weakest link - goodbye! *** --------------------------------------------- On my first visit to Team Cymru's HQ in Lake Mary, Florida, I found myself reading the wall hangings and looking at the pictures depicting specific times in history. Many of them depicting the inspiring words of leaders such as Churchill. It lead me to think about the many lessons that can we learn from .. --------------------------------------------- https://blog.team-cymru.org/2015/08/you-are-the-weakest-link-goodbye/ *** Github Mitigates DDoS Attack *** --------------------------------------------- Github said it turned back a distributed denial of service attack; it's unknown whether this attack is related to a similar attack this March. --------------------------------------------- http://threatpost.com/github-mitigates-ddos-attack/114403 *** Gehackter Samsung-Kühlschrank verrät Gmail-Anmeldedaten *** --------------------------------------------- Auf der Hackerkonferenz DEFCON wurde eine Methode präsentiert, mit der ein Kühlschrank-Modell von Samsung dazu gebracht werden kann, Gmail-Log-ins zu verraten. --------------------------------------------- http://futurezone.at/digital-life/gehackter-samsung-kuehlschrank-verraet-gm… *** Certifi-Gate: Missbräuchliche App im Google Play Store entdeckt *** --------------------------------------------- Sicherheitsforscher präsentierten vor wenigen Wochen eine Schwachstelle, die Fernverwaltungs-Software wie Teamviewer betrifft. Im Nachgang fanden die Forscher eine App in Googles Play Store, die genau diese Schwäche ausnutzt. --------------------------------------------- http://heise.de/-2790706

1 0

Tageszusammenfassung - Montag 24-08-2015
by Daily end-of-shift report 24 Aug '15

24 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 21-08-2015 18:00 − Montag 24-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Extortionists Target Ashley Madison Users *** --------------------------------------------- People who cheat on their partners are always open to extortion by the parties involved. But when the personal details of millions of cheaters gets posted online for anyone to download - as is the case with the recent hack of infidelity hookup .. --------------------------------------------- http://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-user… *** Exploring a 'Malwarebytes Anti-Malware for Windows 10 - website' *** --------------------------------------------- Here at Malwarebytes, we offer support for a wide variety of Windows Operating Systems - from XP right up to Windows 10. The latter OS is the starting point for this blog post, with a website located .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/exploring-an-mbam-for… *** One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation *** --------------------------------------------- This is the final part #4 of the 'One font vulnerability to rule them all' blog post series. In the previous posts, we introduced the 'blend' PostScript operator vulnerability and successfully used it to first exploit Adobe Reader, and later escape .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/08/one-font-vulnerability-to-rul… *** Cisco Wireless LAN Controller IPv6 IAPP WIPS Report Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40586 *** BSI: Richtlinie für sicheren Mail-Transport zeigt bereits Wirkung *** --------------------------------------------- Mit dem Erscheinen der Richtlinie wird leichter verständlich, weshalb Web.de und GMX nicht nur die PGP-Verschlüsselung für Mails eingeführt haben, sondern überraschend auch auf die Sicherheitstechniken DNSSEC und DANE setzen. --------------------------------------------- http://heise.de/-2788316 *** MMD-0039-2015 - ChinaZ made new malware: ELF Linux/BillGates.Lite *** --------------------------------------------- There are tweets I posted which is related to this topic, Our team spotted the sample a week ago. And this post is the promised details, I am sorry for the delay for limited resource that we have since for a week I focused to help .. --------------------------------------------- http://blog.malwaremustdie.org/2015/08/mmd-0039-2015-chinaz-made-new-malwar… *** Google Analyticator <= 6.4.9.4 - Multiple Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8159 *** Sending Windows Event Logs to Logstash *** --------------------------------------------- This topic is not brand new, there exists plenty of solutions to forward Windows event logs to Logstash (OSSEC, Snare or NXlog amongst many others). They perform a decent job to collect events on running systems .. --------------------------------------------- https://blog.rootshell.be/2015/08/24/sending-windows-event-logs-to-logstash/ *** Mass FTP Crawling *** --------------------------------------------- The combination of interesting files one can find on public FTP servers plus the technical expertise required to make a decent search engine motivated me to write Findex and ultimately this article. --------------------------------------------- http://findex.cedsys.nl/research/mass-ftp-crawling/ *** Bundestags-IT nach Reparatur wieder online *** --------------------------------------------- Das IT-System des Deutschen Bundestags ist nach mehrtägigen Reparaturarbeiten am Montag wieder hochgefahren worden. Nach Behebung der Folgen eines Hackerangriffs ging das System wieder ans Netz, wie eine Parlamentssprecherin bestätigte. Die Abgeordneten und Mitarbeiter wurden demnach per Lautsprecher am Montagvormittag über den Neustart des Systems informiert. --------------------------------------------- http://derstandard.at/2000021189218 *** Compromising a honeypot network through the Kippo password when logstash exec is used *** --------------------------------------------- We have been playing with Honeypots lately (shoutout to Theo and Sebastian for adding their honeypots to the network), collecting and visualizing the data from the honeypots is done .. --------------------------------------------- https://forsec.nl/2015/08/compromising-a-honeypot-network-through-the-kippo… *** Exploiting the Mercury Browser for Android *** --------------------------------------------- The Mercury Browser for Android suffers from an insecure Intent URI scheme implementation and a path traversal vulnerability within a custom web server used to support its WiFi Transfer feature. Chaining these vulnerabilities together can allow a .. --------------------------------------------- http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/ *** Username Enumeration against OpenSSH/SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM versions prior to 1.2.1 which allows attackers to conduct username enumeration and denial of service attacks. The purpose of this post is to provide more technical details around this vulnerability. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag…

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily