- Daily - CERT.at

Tageszusammenfassung - Donnerstag 13-08-2015
by Daily end-of-shift report 13 Aug '15

13 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 12-08-2015 18:00 − Donnerstag 13-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New SMiShing Campaign Targets T-Mobile Subscribers *** --------------------------------------------- Criminals after online credentials have homed in on T-Mobile users, luring them with a $20 discount in exchange for .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/08/new-smishing-campaign-targ… *** Android: Und noch eine schwere Sicherheitslücke *** --------------------------------------------- Forscher von IBM haben in Googles mobilem Betriebssystem eine Lücke entdeckt, die über die Hälfte aller Android-Geräte betrifft. Sie erlaubt das Übernehmen privilegierter Prozesse durch einen Angreifer. Google hat die Lücke bereits geschlossen. --------------------------------------------- http://heise.de/-2777648 *** Cisco ASA Unicast Reverse Path Forwarding (uRPF) Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40440 *** Cisco Warns Customers About Attacks Installing Malicious IOS Bootstrap Images *** --------------------------------------------- Cisco is warning enterprise customers about a spike in attacks in which hackers use valid credentials on IOS devices to log in as administrators and then upload malicious ROMMON images to take control of the devices. The ROM Monitor is the .. --------------------------------------------- http://threatpost.com/cisco-warns-customers-about-attacks-installing-malici… *** Cisco TelePresence Video Communication Server Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40433 *** Volkswagen-Hack nach langer Sperrverfügung veröffentlicht *** --------------------------------------------- Vor einigen Jahren haben Forscher entdeckt, dass sich Motorolas Megamos-Transponder, der in den Autoschlüsseln unter anderem von Volkswagen verwendet wird, angreifen lässt. VW ließ damals gerichtlich untersagen, Detailinformationen über die Lücke zu veröffentlichen. Jetzt ist dies gelungen. --------------------------------------------- http://www.golem.de/news/autoschluessel-volkswagen-hack-nach-langer-sperrve… *** Script injection vulnerability discovered in Salesforce *** --------------------------------------------- Elastica discovered an injection vulnerability in Salesforce which opened the door for attackers to use a trusted Salesforce application as a platform to conduct phishing attacks to steal end-users l... --------------------------------------------- http://www.net-security.org/secworld.php?id=18759 *** Spam and phishing in Q2 2015 *** --------------------------------------------- In Q2 2015, the percentage of spam in email traffic accounted for 53.4%. The USA (14.6%) and Russia (7.8%) remained the biggest sources of spam. China came third with 7.1%. The Anti-Phishing system was triggered 30,807,071 times on computers of Kaspersky Lab users. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/71759/spam-and-phishi… *** Berliner Internet-Provider 1blu Opfer einer Hacker-Attacke *** --------------------------------------------- Bislang unbekannte Angreifer haben sich Zugriff auf das interne System verschafft und erpressen den Berliner Internet-Provider nun. --------------------------------------------- http://futurezone.at/digital-life/berliner-internet-provider-1blu-opfer-ein… *** VoIP Fraud - Brute Force and Ignorance *** --------------------------------------------- The topic of VoIP fraud seems to ebb and flow within the IT-industry press, but struggle to break the surface of mainstream media. Specialist publications report flaws in commonly-used home routers and widespread campaigns against corporate VoIP PBXes while these stories are bypass .. --------------------------------------------- https://blog.team-cymru.org/2015/08/voip-fraud-brute-force-and-ignorance/ *** YARA: Simple and Effective Way of Dissecting Malware *** --------------------------------------------- In this article, we will learn about the YARA tool, which gives a very simple and highly effective way of identifying and classifying malware. We all know that Reverse Engineering is the highly recommended method for performing a complete post-mortem .. --------------------------------------------- http://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-… *** Erster Nexus Patch Day: Google schliesst 21 Sicherheitslücken *** --------------------------------------------- Acht davon "kritisch" - Neben Bugs in Stagefright noch zahlreiche andere Probleme bereinigt --------------------------------------------- http://derstandard.at/2000020697116 *** TOTOLINK Update - How to NOT handle security issues *** --------------------------------------------- This post is an an update to: Backdoor and RCE found in 8 TOTOLINK router models Backdoor credentials found in 4 TOTOLINK router models 4 TOTOLINK router models vulnerable to CSRF and XSS attacks 15 TOTOLINK router models vulnerable to multiple RCEs --------------------------------------------- https://pierrekim.github.io/blog/2015-08-13-TOTOLINK-how-to-NOT-handle-secu…

1 0

Tageszusammenfassung - Mittwoch 12-08-2015
by Daily end-of-shift report 12 Aug '15

12 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 11-08-2015 18:00 − Mittwoch 12-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MS15-AUG - Microsoft Security Bulletin Summary for August 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-AUG *** Adobe, MS Push Patches, Oracle Drops Drama *** --------------------------------------------- Adobe today pushed another update to seal nearly three dozen security holes in its Flash Player software. Microsoft also released 14 patch bundles, including a large number of fixes for computers running its new Windows 10 operating system. Not to be left out of Patch Tuesday, Oracles chief security officer lobbed something .. --------------------------------------------- http://krebsonsecurity.com/2015/08/adobe-ms-push-patches-oracle-drops-drama/ *** Defending against CVE-2015-1769: a logical issue exploited via a malicious USB stick *** --------------------------------------------- Today Microsoft released update MS15-085 to address CVE-2015-1769, an important severity security issue in Mount Manager. It affects both client and server versions, from Windows Vista to Windows 10. The goal of this blog post .. --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-201… *** MSRT August 2015: Vawtrak *** --------------------------------------------- As part of our ongoing effort to provide better malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Vawtrak Win32/Critroni Win32/Kasidet Critroni is a ransomware malware family that can lock your files and ask .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/11/msrt-august-2015-vawtrak… *** Emerging ransomware: Troldesh *** --------------------------------------------- Troldesh (detected as variants of Win32/Troldesh) started to show up in the early part of 2015 and became more prevalent in June this year. Overall detections have so far lessened in July - except for a notable spike around the 8th of the month, .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/08/09/emerging-ransomware-trol… *** OpenSSH 7.0 Released *** --------------------------------------------- An anonymous reader writes: Today the OpenSSH project maintainers announced the release of version 7.0. This release is focusing on deprecating weak and unsafe cryptographic methods, though some of the work wont be complete until 7.1. This release removes support for the following: the legacy SSH v1 protocol, .. --------------------------------------------- http://it.slashdot.org/story/15/08/11/2340247/openssh-70-released *** IoT security is RUBBISH says IoT vendor collective *** --------------------------------------------- Online Trust Alliance calls on gadget vendors to stop acting like clowns A vendor group whose membership includes Microsoft, Symantec, Verisign, ADT and TRUSTe reckons the Internet of Things (IoT) market is being pushed with no regard to either .. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/iot_security_is_rubbish_says_iot_ve… *** KCI-Angriff auf TLS missbraucht Clientzertifikate *** --------------------------------------------- Ein komplexer Angriff nutzt eine trickreiche Kombination aus Clientzertifikaten und einem statischen Diffie-Hellman-Schlüsselaustausch. Der Angriff ist nur in sehr speziellen Situationen relevant, doch es zeigt sich wieder einmal, dass das TLS-Protokoll selbst Sicherheitslücken hat. --------------------------------------------- http://www.golem.de/news/schluesselaustausch-kci-angriff-auf-tls-missbrauch… *** Hacker ermöglichen Börsen-Insidergeschäfte in Millionenhöhe *** --------------------------------------------- Pressemitteilungen beinhalten gelegentlich Informationen, die an der Börse viel Geld wert sind - vor allem, wenn sie vor ihrer Veröffentlichung in die Hände von Tätern gelangen, die damit Insidergeschäfte machen. In den USA wurde ein Verbrecherring zerschlagen, der über 100 Millionen US-Dollar damit verdient haben soll. --------------------------------------------- http://www.golem.de/news/pressemitteilungen-hacker-ermoeglichen-boersen-ins… *** Schneider Electric IMT25 DTM Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a memory corruption vulnerability in Schneider Electric IMT25 DTM component. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-223-01 *** Blacklists miss 90% of malware blogged IP love *** --------------------------------------------- Correlate all the things. Threat intelligence firm RecordedFuture says popular web blacklists are missing thousands of IP addresses linked to malware data theft. --------------------------------------------- http://www.theregister.co.uk/2015/08/12/two_shady_men_walk_into_a_bar_black… *** Security: Lenovos sanktioniertes Rootkit *** --------------------------------------------- Nach einer kompletten Neuinstallation von Windows auf einem Lenovo-Laptop wurde zur Überraschung eines Anwenders plötzlich auch ein Lenovo-Dienst gestartet. Er vermutete eine Art Bios-Rootkit und lag damit offenbar gar nicht so falsch. --------------------------------------------- http://www.golem.de/news/security-lenovos-sanktioniertes-rootkit-1508-11571… *** Windows Service Accounts - Why They're Evil and Why Pentesters Love them! *** --------------------------------------------- Windows Service Accounts have been one of those enterprise neccessary evils - things that you have to have, but nobody ever talks about or considers to be a problem. All too often, these service accounts are in the Domain Admins group, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20029 *** August 2015 Security Update Release Summary *** --------------------------------------------- Today we released security updates to provide protections against malicious attackers. As a best practice, we encourage customers to apply security updates as soon as they are .. --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/08/11/august-2015-security-upd… *** Thunderstrike 2: Mac firmware worm details *** --------------------------------------------- This is the annotated transcript of our DefCon 23 / BlackHat 2015 talk, which presented the full details of Thunderstrike 2, the first firmware worm for Apples Macs that can spread via both software or Thunderbolt hardware accessories and writes .. --------------------------------------------- https://trmm.net/Thunderstrike2_details *** Firefox Under Fire: Anatomy of latest 0-day attack *** --------------------------------------------- On the August 6th, the Mozilla Foundation released a security update for the Firefox web browser that fixes the CVE-2015-4495 vulnerability in Firefox's embedded PDF viewer, PDF.js. This vulnerability allows attackers to bypass the same-origin policy and execute JavaScript remotely that will be .. --------------------------------------------- http://www.welivesecurity.com/2015/08/11/firefox-under-fire-anatomy-of-late… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part II - Supremacy *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in .. --------------------------------------------- http://blog.checkpoint.com/2015/08/11/finding-vulnerabilities-in-core-wordp… *** SSD Advisory - ZendXml Multibyte Payloads XXE/XEE *** --------------------------------------------- The XML standard defines a concept of an external entites. XXE (XML eXternal Entity) attack is an attack on an application that parses XML input from untrusted sources using incorrectly configured XML parser. The application may be forced to open arbitrary files and/or network resources. Exploiting XXE issues on PHP applications may also lead to denial of service or in some cases (for example, when an 'expect' PHP module is installed) lead to command execution. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2550

1 0

Tageszusammenfassung - Dienstag 11-08-2015
by Daily end-of-shift report 11 Aug '15

11 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 10-08-2015 18:00 − Dienstag 11-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Beliebige SSL-Zertifikate durch Missbrauch der Uralt-Internettechnik BGP *** --------------------------------------------- Das für das globale Internet unabdingbare Border Gateway Protocol (BGP) lässt sich leicht manipulieren. Ein Hacker beschrieb auf der Black Hat, wie man darüber gültige SSL-Zertifikate für beliebige Domains ausstellen lassen kann. --------------------------------------------- http://heise.de/-2774454 *** Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36968 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=33996 *** CVE-2015-2419 - Internet Explorer Double-Free in Angler EK *** --------------------------------------------- The Angler Exploit Kit (EK) recently added support for an Internet Explorer (IE) vulnerability (CVE-2015-2419) that was patched in July 2015. Quickly exploiting recently patched vulnerabilities is standard for Angler EK authors, but the target has been Adobe Flash Player since the .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/08/cve-2015-2419_inte.html *** The Italian Connection: An analysis of exploit supply chains and digital quartermasters *** --------------------------------------------- On July 5, 2015 an unknown hacker publicly announced on Twitter that he had breached the internal network of Hacking Team - an Italian pentesting company known .. --------------------------------------------- http://blog.shadowserver.org/2015/08/10/the-italian-connection-an-analysis-… *** QNAP Turbo NAS Series Devices Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Traverse the Directory, Execute Arbitrary Code, and Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033224 *** QNAP Logging Error Lets Local Users Obtain Disk Encryption Keys *** --------------------------------------------- http://www.securitytracker.com/id/1033223 *** Internal modem can be exploited by malware to gain persistence *** --------------------------------------------- Two security experts at the last Def Con hacking conference have demonstrated how Internal LTE/3G modems can be hacked to help malware survive OS reinstalls Many users totally ignore that LTE/3G modems built into new business laptops and .. --------------------------------------------- http://securityaffairs.co/wordpress/39252/hacking/internal-modem-hacking.ht… *** Who's Behind Your Proxy? Uncovering Bunitu's Secrets *** --------------------------------------------- In our previous analysis we showed how the Bunitu Trojan was distributed via the Neutrino exploit kit in various malvertising campaigns. After spending more time analyzing .. --------------------------------------------- https://blog.malwarebytes.org/botnets/2015/08/whos-behind-your-proxy-uncove… *** Watch out for Costly Mobile Ads *** --------------------------------------------- There are lots of ways you can have a bad hair day with a mobile device - a rogue app from the Play Store, a dubious file from a non-official source or even a phish attack which takes advantage of a mobile's smaller screen size. A less annoying issue is pop-ups, adverts .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/08/watch-out-for-costly-… *** Tanksysteme ungeschützt im Netz: Leichte Beute für Hacker *** --------------------------------------------- Bankomatkassen an Zapfsäulen wurden bereits zum Ziel von Hackerangriffen, um Daten zu stehlen. Doch Tankstellen könnten von Kriminellen im Internet auch für weitaus gefährlichere Attacken ins Visier genommen werden. Das Forscherteam von Rapid7 fand laut "Wired" .. --------------------------------------------- http://derstandard.at/2000020547838 *** Vulnerabilities iframe <= 3.0 *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8150 https://wpvulndb.com/vulnerabilities/8149 *** Threat Group-3390 Targets Organizations for Cyberespionage *** --------------------------------------------- Dell SecureWorks Counter Threat Unit(TM) (CTU) researchers investigated activities associated with Threat Group-3390[1] (TG-3390). Analysis of TG-3390s operations, targeting, and tools led CTU researchers to assess with moderate confidence .. --------------------------------------------- http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3… *** Instant KARMA Might Still Get You *** --------------------------------------------- About a year ago, I started looking into Android applications that arent validating SSL certificates. Users of these applications could be at risk if they fall victim to a man-in-the-middle (MITM) attack. Earlier this year, I also wrote about .. --------------------------------------------- https://insights.sei.cmu.edu/cert/2015/08/instant-karma-might-still-get-you… *** Dynamic DNS Security and Potential Threats *** --------------------------------------------- Recently I began to notice a trend that Dynamic DNS providers have been repeatedly abused as a part of malware campaigns. How is dynamic DNS a threat to your enterprise? What can be done to mitigate this threat? Before we answer these questions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-a… *** Another Android hole: "OCtoRuTA" - One (Java) Class to Rule Them All *** --------------------------------------------- Yet another large-scale vulnerability has been revealed in Android. This one lets an otherwise innocent-looking app go rogue, and enjoy privileges normally limited to the trusted parts of Android. --------------------------------------------- https://nakedsecurity.sophos.com/2015/08/11/another-android-hole-octoruta-o… *** Kali Linux 2.0 Released *** --------------------------------------------- We're still buzzing and recovering from the Black Hat and DEF CON conferences where we finished presenting our new Kali Linux Dojo, which was a blast. With the help of a few good people, the Dojo rooms were set up ready for the masses - where many .. --------------------------------------------- https://www.kali.org/releases/kali-linux-20-released/ *** Security Updates Available for Adobe Flash Player (APSB15-19) *** --------------------------------------------- A security bulletin (APSB15-19) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially allow an .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1254 *** Mobilfunkdaten bei Facebook massenhaft auslesbar *** --------------------------------------------- Einem Entwickler ist es gelungen, mit einem kleinen Skript binnen weniger Minuten zahlreiche Mobilfunknummern von Nutzern über Facebook abzufragen. Sicherheitsexperten drängen auf eine andere Voreinstellung. --------------------------------------------- http://heise.de/-2776623

1 0

Tageszusammenfassung - Montag 10-08-2015
by Daily end-of-shift report 10 Aug '15

10 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 07-08-2015 18:00 − Montag 10-08-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Tech Firm Ubiquiti Suffers $46M Cyberheist *** --------------------------------------------- Networking firm Ubiquiti Networks Inc. disclosed this week that cyber thieves recently stole $46.7 million using an increasingly common scam in which crooks spoof communications from executives at the victim firm in a bid to initiate unauthorized international wire transfers. --------------------------------------------- http://krebsonsecurity.com/2015/08/tech-firm-ubiquiti-suffers-46m-cyberheis… *** Welcome to The Internet of Compromised Things *** --------------------------------------------- This post is a bit of a public service announcement, so Ill get right to the point: Every time you use WiFi, ask yourself: could I be connecting to the Internet through a compromised router with malware?Its becoming more and .. --------------------------------------------- http://blog.codinghorror.com/welcome-to-the-internet-of-compromised-things/ *** Black Hat: Schadsoftware per Windows-Update mit WSUS *** --------------------------------------------- Zwei Sicherheitsforscher demonstrierten auf der Black-Hat-Konferenz, wie sich die Windows Server Update Services (WSUS) zum Verteilen von gefälschten Windows-Updates in einem Unternehmensnetz benutzen lassen. Es gibt jedoch ein schlichtes Gegenmittel. --------------------------------------------- http://heise.de/-2775156 *** Black Hat: SMM weiterhin grosses Einfallstor *** --------------------------------------------- Ein Computerwissenschaftler zeigt ein Scheunentor, das schon zwanzig Jahre offen steht. --------------------------------------------- http://heise.de/-2775248 *** RIG Reloaded - Examining the Architecture of RIG Exploit Kit 3.0 *** --------------------------------------------- A few months ago the RIG exploit kit took quite a hit when its source code was leaked by a disgruntled reseller. At the time we wrote a blog post detailing the inner workings of RIGs infrastructure and business model,... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the… *** Stagefright: Online-Ganoven tarnen Android-Trojaner als Sicherheitsupdate *** --------------------------------------------- Während die meisten Hersteller keine oder wenige Firmware-Updates anbieten, die vor den gefährlichen Stagefright-Lücken schützen, können Online-Abzocker vermeintlich schon liefern. Es handelt sich dabei allerdings um einen Trojaner. --------------------------------------------- http://heise.de/-2775388 *** WP Statistics <= 9.5.1 - Referer Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8145 *** Stagefright: Motorola verspricht umfassende Updates *** --------------------------------------------- Auch wenn es bisher noch keine Hinweise auf entsprechende Angriffe gibt – die vor zwei Wochen bekannt gewordenen Sicherheitslücken im Media Framework Stagefright haben ordentlich Bewegung in die Android-Welt gebracht. Nach Google, LG und Samsung meldet sich mit Motorola nun der nächste Hersteller zu Wort – und verspricht umfassende Updates. --------------------------------------------- http://derstandard.at/2000020502273 *** Data, Technologies and Security - Part 1 *** --------------------------------------------- A lot of technologies present themselves as solutions for multiple challenges. At BinaryEdge, we are big adepts of analyzing all the different technologies until we see what correctly adapts and fits our environment. From a security .. --------------------------------------------- http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ *** What's Next in Malware After Kuluoz? *** --------------------------------------------- Regular readers of this blog have heard all about the infamous Kuluoz malware. This family was the latest evolution of the Asprox malware and at its peak in 2014 it accounted for 80% of .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/08/whats-next-in-malware-af… *** Getting in with the Proxmark 3 and ProxBrute *** --------------------------------------------- As a member of the Physical Security team here at SpiderLabs, some of my job responsibilities include getting into a facility by any (non-destructive) means necessary. When a client has decided once and for all that theyve trained their guards and fortified the gates, its time to test those defenses to measure just how resilient they actually are to an attack. And thats where we come in. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Getting-in-with-the-Pro… *** Google Analytics by Yoast <= 5.4.4 - Authenticated Stored Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8147 *** Mass Dark Web Scanning With PunkSPIDER *** --------------------------------------------- A while back we did some work in scanning Tor hidden services for vulnerabilities (read about it here - btw I love this article for its use of dark web and explaining that the term is highly disputed). Basically, if you dont want to read it, we did a massive scan of the Tor network for web app vulnerabilities as part of our .. --------------------------------------------- http://alex.hyperiongray.com/posts/289994-scanning-the-dark-web *** Stagefright Vulnerability Disclosure *** --------------------------------------------- StageFright which handles multiple media formats, is a system service for Android. This service is implemented by Native C++. The following diagram shows how media applications interact with .. --------------------------------------------- http://translate.wooyun.io/2015/08/08/Stagefright-Vulnerability-Disclosure.… *** Darkhotel APT Latest to Use Hacking Team Zero Day *** --------------------------------------------- The Darkhotel APT gang has extended its geographic reach to victims in a host of additional countries, and has added to its cache of zero days with its use of a HackingTeam exploit for a Flash zero-day vulnerability. --------------------------------------------- http://threatpost.com/darkhotel-apt-latest-to-use-hacking-team-zero-day/114…

1 0

Tageszusammenfassung - Freitag 7-08-2015
by Daily end-of-shift report 07 Aug '15

07 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 06-08-2015 18:00 − Freitag 07-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Updated DGA Changer Malware Generates Fake Domain Stream *** --------------------------------------------- Researchers at Seculert have discovered the latest twist to DGA Changer, which now is able to generate a fake stream of domains if it detects it's being executed in a virtual machine. --------------------------------------------- http://threatpost.com/updated-dga-changer-malware-generates-fake-domain-str… *** BLEKey Device Breaks RFID Physical Access Controls *** --------------------------------------------- A device called BEKey which is the size of a quarter and can be installed in 60 seconds on a proximity card reader could potentially be used to break physical access controls in 80 percent of deployments. --------------------------------------------- http://threatpost.com/blekey-device-breaks-rfid-physical-access-controls/11… *** BIND Denial of Service Vulnerability Blamed on Windows 2000 Compatibility Code *** --------------------------------------------- The BIND implementation of the Domain Name System (DNS) is a critical part of the infrastructure of the Internet. For example, almost all of the 13 root name servers use BIND. On July 28 a vulnerability was published in BIND that could be anonymously exploited by an attacker. To crash the server, all an attacker would have to... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/OQsKsP-w1DU/ *** Schwachstelle: Certifi-Gate erlaubt Zertifikatsmissbrauch unter Android *** --------------------------------------------- Bösartige Apps können in Android legitime Zertifikate nutzen, um erhöhte Rechte zu erhalten. Die Entdecker der Schwachstelle haben dieser den Namen Certifi-Gate gegeben. Google bestätigt die Lücke, betont aber, dass Apps im Play Store auf ein solches Missbrauchspotential überprüft würden. --------------------------------------------- http://www.golem.de/news/schwachstelle-certifi-gate-erlaubt-zertifikatsmiss… *** HTTPS: BGP-Angriff gefährdet TLS-Zertifikatssystem *** --------------------------------------------- Auf der Black Hat weisen Sicherheitsforscher auf ein Problem mit TLS-Zertifizierungsstellen hin: Die Prüfung, wem eine Domain gehört, findet über ein ungesichertes Netz statt. Dieser Weg ist angreifbar - beispielsweise mittels des Routingprotokolls BGP. --------------------------------------------- http://www.golem.de/news/https-bgp-angriff-gefaehrdet-tls-zertifikatssystem… *** Kryptographie: Rechenfehler mit großen Zahlen *** --------------------------------------------- Kryptographische Algorithmen benötigen oft Berechnungen mit großen Ganzzahlen. Immer wieder werden Fehler in den entsprechenden Bibliotheken gefunden. Diese können zu Sicherheitslücken werden. --------------------------------------------- http://www.golem.de/news/kryptographie-rechenfehler-mit-grossen-zahlen-1508… *** Zwölf Sicherheitslücken in PHP geschlossen, Support für Version 5.5 ausgelaufen *** --------------------------------------------- Das PHP-Entwickerteam hat seinen Interpreter sicherer gemacht und weist darauf hin, dass der Support für Version 5.5 vor kurzem abgelaufen ist. Wer kann, sollte auf Version 5.6 umsteigen. --------------------------------------------- http://heise.de/-2774343 *** The GasPot experiment: Hackers target gas tanks *** --------------------------------------------- Physically tampering with gasoline tanks is dangerous enough, given how volatile gas can be. Altering a fuel gauge can cause a tank to overflow, and a simple spark can set everything ablaze. But imagi... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/5bYYfndJK74/secworld.php *** Auto-Hacking: Gehackte Teslas lassen sich bei voller Fahrt ausschalten *** --------------------------------------------- Insgesamt sechs Lücken haben IT-Sicherheitsforscher in der Software der Automobile von Tesla entdeckt. Über sie gelang es ihnen, die Kontrolle über das Fahrzeug zu übernehmen. --------------------------------------------- http://www.golem.de/news/auto-hacking-gehackte-teslas-lassen-sich-bei-volle… *** Firefox exploit found in the wild *** --------------------------------------------- Yesterday morning, August 5, a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1. https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ --------------------------------------------- https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-w… *** CrackLord: Gratis-Tool zum Steuern von Cracking-Clustern *** --------------------------------------------- Forscher haben mit CrackLord eine Open-Source-Software vorgestellt, die CPU-/GPU-Cluster zum Cracken von Passwörtern ansteuert und Aufgaben verwaltet und verteilt. --------------------------------------------- http://heise.de/-2774582 *** Scada-Sicherheit: Siemens-PLC wird zum Einbruchswerkzeug *** --------------------------------------------- Über die oftmals frei aus dem Internet zugänglichen Programmable Logic Controller (PLC) zum Steuern von Scada-Systemen können Angreifer Scanner zum Spionieren in Industrie-Systeme schmuggeln. Die dafür nötige Software steht frei zum Download. --------------------------------------------- http://heise.de/-2774812 *** Citrix XenServer Security Update for CVE-2015-5154 *** --------------------------------------------- A security vulnerability has been identified in Citrix XenServer that may allow a malicious administrator of an HVM guest VM to compromise the host ... --------------------------------------------- http://support.citrix.com/article/CTX201593 *** USN-2706-1: OpenJDK 6 vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2706-16th August, 2015openjdk-6 vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security issues were fixed in OpenJDK 6.Software description openjdk-6 - Open Source Java implementation DetailsSeveral vulnerabilities were discovered in the OpenJDK JRE related toinformation disclosure, data integrity, and availability. An attackercould exploit these to cause a denial of service or expose sensitivedata... --------------------------------------------- http://www.ubuntu.com/usn/usn-2706-1/ *** Security Advisory: Java SE vulnerabilities CVE-2015-2590 and CVE-2015-4732 *** --------------------------------------------- (SOL17079) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/17000/000/sol17079.htm… *** DSA-3329 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernelthat may lead to a privilege escalation, denial of service orinformation leak. --------------------------------------------- https://www.debian.org/security/2015/dsa-3329 *** Apache Subversion Bugs Let Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1033215 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: A Security Vulnerability, exists in the Android platform used by the Cordova tools in Rational Application Developer for WebSphere Software (CVE-2015-1835) *** http://www.ibm.com/support/docview.wss?uid=swg21962128 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM Security Identity Governance *** http://www.ibm.com/support/docview.wss?rs=0&uid=swg21963438 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem V840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005344 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects the IBM FlashSystem 840 (CVE 2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005339 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960191 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Monitoring (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962739 *** IBM Security Bulletin: A vulnerability in Open Source Struts affects the IBM FlashSystem 840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005329 *** IBM Security Bulletin: Multiple vulnerabilities in Java affect the IBM FlashSystem V840 (CVEs 2015-0204, 2015-0488, and 2015-1916) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005328 *** IBM Security Bulletin: A vulnerability in Open Source Struts affect the IBM FlashSystem V840 (CVE 2015-1831) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005331 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect FileNet Content Manager, IBM Content Foundation and FileNet BPM (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21883959 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Mobile. *** http://www.ibm.com/support/docview.wss?uid=swg21963158 *** IBM Security Bulletin: Multiple vulnerability in Product IBM Tivoli Common Reporting(CVE-2015-0488, CVE-2015-0478, CVE-2015-2808, CVE-2015-1916, CVE-2014-0227, CVE-2015-0209 , CVE-2015-0286 , CVE-2015-0289) *** http://www.ibm.com/support/docview.wss?uid=swg21963024 *** IBM Security Bulletin: A vulnerability in Open Source OpenSSL affects the IBM FlashSystem 840 (CVE 2015-0286) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005341 *** IBM Security Bulletin: Vulnerability in Open Source Apache Tomcat affect the IBM FlashSystem V840, (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005204

1 0

Tageszusammenfassung - Donnerstag 6-08-2015
by Daily end-of-shift report 06 Aug '15

06 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 05-08-2015 18:00 − Donnerstag 06-08-2015 18:00 Handler: Stephan Richter Co-Handler: Robert Waldner *** Jetzt Android-Geräte auf Stagefright-Lücken testen! *** --------------------------------------------- Mit einer kostenlosen App kann man überprüfen, ob die eigenen Android-Geräte über die Stagefright-Lücken angreifbar sind. --------------------------------------------- http://heise.de/-2773801 *** Stagefright-Sicherheitslücke: Elf Wege, ein Android-System zu übernehmen *** --------------------------------------------- Auf der Black-Hat-Konferenz hat Joshua Drake die Hintergründe zu den Stagefright-Sicherheitslücken erläutert. Über mindestens elf verschiedene Wege lässt sich ein Android-System seinem Vortrag zufolge angreifen. Fortschritte gibt es bei den Android-Updates. (Android, Firefox) --------------------------------------------- http://www.golem.de/news/stagefright-sicherheitsluecke-elf-wege-ein-android… *** APT Group Gets Selective About Data it Steals *** --------------------------------------------- Dell SecureWorks researchers today at Black Hat released a new report on Emissary Panda, or TG-3390, a China-sponsored APT gang that has refined the types of data it covets. --------------------------------------------- http://threatpost.com/apt-group-gets-selective-about-data-it-steals/114103 *** Inside the $100M 'Business Club' Crime Gang *** --------------------------------------------- New research into a notorious Eastern European organized cybercrime gang accused of stealing than $100 million from banks and businesses worldwide provides an unprecedented, behind-the-scenes look at an exclusive "business club" that dabbled in cyber espionage and worked closely with phantom Chinese firms on Russias far eastern border. --------------------------------------------- http://www.krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-… *** Corporate networks can be compromised via Windows Updates *** --------------------------------------------- Yesterday at Black Hat USA 2015, researchers from UK-based Context Information Security demonstrated how Windows Update can be abused for internal attacks on corporate networks by exploiting insecurely configured enterprise implementations of Windows Server Update Services (WSUS). --------------------------------------------- http://www.net-security.org/secworld.php?id=18725 *** Exploit-Kit Rig: Verbrechen lohnt sich wieder *** --------------------------------------------- Vor einigen Monaten wurde der Quellcode des Exploit-Kits RIG 2.0 veröffentlicht; damit war der Shooting-Star der Crimeware-Szene erstmal aus dem Rennen. Jetzt sind die Entwickler mit einer Version 3.0 zurück - und verdienen besser denn je. --------------------------------------------- http://heise.de/-2772951 *** How Scammers Abuse Our Brains *** --------------------------------------------- Your brain is awesome. We're not just flattering you, it's true. It's also true of the guy sat next to you, the woman across the street, even your kid cousin who still thinks that flicking boogers is the height of hilarity. Each one of us is blessed with a brain that has unparalleled amounts of storage, and ferocious processing power. That said, our minds are still finite. The amount of information we can attend to at a given moment is limited. --------------------------------------------- https://blog.team-cymru.org/2015/08/how-scammers-abuse-our-brains/ *** Bugtraq: Vulnerable MSVC++ runtime distributed with LibreOffice 5.0.0 for Windows *** --------------------------------------------- the just released latest version 5.0.0.5 of LibreOffice.org for Windows distributes (once again) a completely outdated and vulnerable MSVC++ runtime. --------------------------------------------- http://www.securityfocus.com/archive/1/536144 *** Nicholas Weaver on iPhone Security *** --------------------------------------------- Excellent essay: Yes, an iPhone configured with a proper password has enough protection that, turned off, Id be willing to hand mine over to the DGSE, NSA, or Chinese. But many (perhaps most) users dont configure their phones right. Beyond just waiting for the suspect to unlock his phone, most people either use a weak 4-digit passcode ... --------------------------------------------- https://www.schneier.com/blog/archives/2015/08/nicholas_weaver_1.html *** Sigcheck and virustotal-search, (Thu, Aug 6th) *** --------------------------------------------- In my last diary entry I mentioned offline use of Sysinternal tools with my tool virustotal-search. So you want to use sigcheck but you cant connect the machine to the Internet. Then you can use sigchecks option -h to calculate cryptographic hashes of the files it checks, and option -c to produce a CSV output (-ct for CSV with a tab separator). If you want, you can limit sigcheck" /> To extract a unique list of MD5 hashes, you can use this pipe of awk, tail, sed and sort ... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20009&rss *** How Social Engineering Security Awareness Stops 3 Common Scams *** --------------------------------------------- Social engineering, in the context of information security, refers to the use of psychological manipulation to trick people into divulging sensitive information (information gathering) or performing actions (fraud/unauthorized system access). It is a non-technical confidence scam that resembles a very elaborate plan that consists of several stages (See the Typical Phases part). --------------------------------------------- http://resources.infosecinstitute.com/how-social-engineering-security-aware… *** Sick of Flash security holes? HTML5 has its own *** --------------------------------------------- HTML5 has been billed as the natural, standards-based successor to proprietary plug-ins such as Adobes Flash Player for providing rich multimedia services on the Web. But when it comes to security, one of Flashs major weaknesses, HTML5 is no panacea.In fact, HTML5 has security issues of its own. Julien Bellanger, CEO of application security monitoring firm Prevoty, says HTML5 makes security more complex, not simpler. HTML5 security has been a question mark for years, and it has not improved --------------------------------------------- http://www.csoonline.com/article/2960695/application-security/sick-of-flash… *** 'Funtenna' software hack turns a laser printer into a covert radio *** --------------------------------------------- Researcher demonstrates how attacker could exfiltrate data over airwaves. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/RCktE3iPj7M/ *** Black Hat: Sicherheitsforscher klonen verschlüsselte SIM-Karten *** --------------------------------------------- Die Verschlüsselung via AES 256 gilt auch langfristig als sicher. Im Zuge eines Angriffes über Bande wurden nun derartig verschlüsselte SIM-Karten in wenigen Minuten geknackt. --------------------------------------------- http://heise.de/-2773751 *** Bugtraq: [security bulletin] HPSBUX03388 SSRT102180 rev.1 - HP-UX running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running OpenSSL with SSL/TLS enabled. This is the TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as Logjam which could be exploited remotely resulting in disclosure of information. --------------------------------------------- http://www.securityfocus.com/archive/1/536142 *** FreeBSD patch(1) Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- A vulnerability was reported in FreeBSD patch(1). A remote user can cause arbitrary commands to be executed on the target system. The patch(1) utility does not properly sanitize the input patch stream. A remote user can create a specially crafted patch file that, when processed by the target user via patch(1), will run ed(1) commands (in addition to running valid version control system commands) with the privileges of the target user. --------------------------------------------- http://www.securitytracker.com/id/1033188 *** FreeBSD routed(8) RIP Query Processing Flaw Lets Remote Users Cause the Target Service to Crash *** --------------------------------------------- A remote user on a network that is not directly connected to the target system's network can send a specially crafted routing information protocol (RIP) query to trigger a flaw in the target routed(8) daemon and cause the daemon to crash. As a result, the target system's routing table will no longer be updated. Systems with the routed(8) daemon enabled are affected. --------------------------------------------- http://www.securitytracker.com/id/1033185 *** Security Notice - Statement on the UAP2015 Vulnerability Mentioned at the BlackHat USA Conference *** --------------------------------------------- The investigation is still ongoing. Huawei PSIRT will keep updating the SN and will give the related views as soon as possible. Please stay tuned. --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices…

1 0

Tageszusammenfassung - Mittwoch 5-08-2015
by Daily end-of-shift report 05 Aug '15

05 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 04-08-2015 18:00 − Mittwoch 05-08-2015 18:00 Handler: n/a Co-Handler: n/a *** Nuclear EK traffic patterns in August 2015, (Wed, Aug 5th) *** --------------------------------------------- Introduction About two weeks ago, Nuclear exploit kit (EK)changed its URL patterns. Now it looks a bit likeAngler EK. Kafeine originally announced the change on 2015-07-21 [1], and we collected examples the next day. Heres how Nuclear EK looked on" /> Here" /> Now that were into August 2015,URL patterns for Nuclear EK have altered again. These changes are similar to weve seen withAngler EK since June 2015 [3]. Theyre not the same URL patternsas Angler, but the changes are... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=20001&rss *** Wait, what? TrueCrypt decrypted by FBI to nail doc-stealing sysadmin *** --------------------------------------------- Do the Feds know something we dont about crypto-tool? Or did bloke squeal his password? Discontinued on-the-fly disk encryption utility TrueCrypt was unable to keep out the FBI in the case of a US government techie who stole copies of classified military documents. How the Feds broke into the IT bods encrypted TrueCrypt partition isnt clear. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/truecrypt_d… *** WordPress-Update schließt sechs Sicherheitslücken *** --------------------------------------------- Die Version 4.2.4 des Content-Management-Systems behebt unter anderem eine SQL-Injection-Lücke, durch die Angreifer die Installation übernehmen können. --------------------------------------------- http://heise.de/-2771541 *** Man-In-The-Cloud Owns Your DropBox, Google Drive -- Sans Malware *** --------------------------------------------- Using no malware or stolen passwords, new attack can compromise your cloud synch services and make your good files malicious. --------------------------------------------- http://www.darkreading.com/cloud/man-in-the-cloud-owns-your-dropbox-google-… *** Email Security Awareness: How To Get Quick Results *** --------------------------------------------- Phishing and Spear phishing attacks on the rise Phishing and spear phishing attacks are the most effective attack vectors. Despite the high level of awareness of the cyber threats, bad actors still consider email their privileged attack vector. According to the security experts at Trend Micro firm, spear phishing is the attack method used in... --------------------------------------------- http://resources.infosecinstitute.com/email-security-awareness-how-to-get-q… *** Finding Vulnerabilities in Core WordPress: A Bug Hunter's Trilogy, Part I *** --------------------------------------------- In this series of blog posts, Check Point vulnerability researcher Netanel Rubin tells a story in three acts - describing his long path of discovered flaws and vulnerabilities in core WordPress, leading him from a read-only "Subscriber" user, through creating, editing and deleting posts, and all the way to performing SQL injection and persistent XSS attacks on 20% of the popular web... --------------------------------------------- http://blog.checkpoint.com/2015/08/04/wordpress-vulnerabilities-1/ *** Android-Schwachstelle: Telekom schaltet wegen Stagefright-Exploits direktes MMS ab *** --------------------------------------------- MMS-Nutzer müssen wegen einer Android-Schwachstelle auf die direkte Zustellung verzichten. Die Telekom will so ihre Kunden schützen. --------------------------------------------- http://www.golem.de/news/android-schwachstelle-telekom-schaltet-wegen-stage… *** MVEL as an attack vector *** --------------------------------------------- Java-based expression languages provide significant flexibility when using middleware products such as Business Rules Management System (BRMS). This flexibility comes at a price as there are significant security concerns in their use. In this article MVEL is used in JBoss... --------------------------------------------- https://securityblog.redhat.com/2015/08/05/mvel-as-an-attack-vector/ *** Root-Exploit: Apple bereitet offenbar Patch mit MacOS 10.10.5 vor *** --------------------------------------------- Der Mac-Hersteller setzt einem Bericht zufolge zunächst auf verschiedene Maßnahmen, um die Ausnutzung einer Rechteausweitungslücke zur Malware-Installation zu erschweren. Das ausstehende Update auf OS X 10.10.5 soll die Schwachstelle dann beseitigen. --------------------------------------------- http://heise.de/-2772715 *** Bugtraq: [SECURITY] [DSA 3328-2] wordpress regression update *** --------------------------------------------- http://www.securityfocus.com/archive/1/536135 *** Apple OS X DYLD_PRINT_TO_FILE Environment Variable Validation Flaw Lets Local Users Obtain Root Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1033177 *** [2015-08-05] Websense Content Gateway stack buffer overflow in handle_debug_network *** --------------------------------------------- A stack-based buffer overflow was identified in the Websense Content Manager administrative interface, which allows execution of arbitrary code. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security Advisory - CF Card Information Leak Vulnerability on Multiple Huawei Products *** --------------------------------------------- The CF cards on some Huawei switches contain some sensitive information in plaintext. Once an attacker gets such a CF card, it may result in the leak of sensitive information (HWPSIRT-2015-07048). --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Security_Advisory-Two Security Vulnerabilities in the ME906 Wireless Module *** --------------------------------------------- The upgrade package of the ME906 wireless module contains the hash values of the root account and password. An attacker can obtain the password of the root account through reverse cracking, connect to the serial port of the wireless module, and enter the root account and password to log in to the operating system of the module. (HWPSIRT-2015-02009) | This module implements upgrade check using CRC16, which is insecure. Much study is done for reversely cracking this algorithm. (HWPSIRT-2015-06032) --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor…

1 0

Tageszusammenfassung - Dienstag 4-08-2015
by Daily end-of-shift report 04 Aug '15

04 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 03-08-2015 18:00 − Dienstag 04-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Thunderstrike 2: Mac-Firmware-Wurm soll sich über Thunderbolt-Adapter verbreiten *** --------------------------------------------- Weitere EFI-Schwachstellen ermöglichen nach Angabe von Sicherheitsforschern die Modifikation der Firmware mobiler Macs. Ein Angreifer könne dadurch einen Schädling einschleusen, der sich über Thunderbolt-Adapter und Peripherie fortpflanzt. --------------------------------------------- http://heise.de/-2767994 *** DYLD_PRINT_TO_FILE exploit found in the wild *** --------------------------------------------- Last month, Stefan Esser blogged about a zero-day vulnerability in OS X, without having informed Apple about the problem first. Unfortunately, today has brought the discovery of the first known exploit. (Read more...) --------------------------------------------- https://blog.malwarebytes.org/mac/2015/08/dyld_print_to_file-exploit-found-… *** Hackers use cartons with sticks, may be foiled by watermelons *** --------------------------------------------- Translation from Russian hack-slang: Credit card, PayPal and secure server Gaining an invite to the best of the nearly 60 websites powering the cybercrime underground is only half the fight for researchers; they also need to know that credit cards are called cartons, PayPal a stick, and bulletproof servers watermelons. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/russian_cyb… *** Android-Schwachstelle: Stagefright-Exploits wohl bald aktiv *** --------------------------------------------- Erste Nachweise, dass die wohl gravierende Sicherheitslücke in Android ausnutzbar ist, sind bereits im Umlauf. Patches gibt es bereits für Android und Cynanogenmod. Bis die Hersteller sie bereitstellen, könnte Stagefright aber millionenfach missbraucht worden sein. --------------------------------------------- http://www.golem.de/news/android-schwachstelle-stagefright-exploits-wohl-ba… *** Android MediaServer Bug Traps Phones in Endless Reboots *** --------------------------------------------- We have discovered a new vulnerability that allows attackers to perform denial of service (DoS) attacks on Android's mediaserver program. This causes a device's system to reboot and drain all its battery life. In more a severe case, where a related malicious app is set to auto-start, the device can be trapped in an endless reboot... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/w1VZWbnfA4c/ *** Your Password is Too Damn Short *** --------------------------------------------- Im a little tired of writing about passwords. But like taxes, email, and pinkeye, theyre not going away any time soon. Heres what I know to be true, and backed up by plenty of empirical data: --------------------------------------------- http://blog.codinghorror.com/your-password-is-too-damn-short/ *** Yahoo! ads! caught! spreading! CryptoWall! ransomware! AGAIN! *** --------------------------------------------- Unpatched Flash holes exploited to inject file-scrambling nasty Yahoo!s ad network is still being used to spread ransomware to Windows PCs a year after the last big outbreak. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/04/yahoo_malwa… *** Open source tool for deploying SSL public key pinning in iOS, OS X apps *** --------------------------------------------- At Black Hat USA 2015, Data Theorem and Yahoo! will be unveiling TrustKi, a new, open source security toolkit that helps developers easily include complex mobile security functionality, known as SSL p... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/jxmlYG4OZVA/secworld.php *** Cybersecurity Policy and Threat Assessment for the Energy Sector *** --------------------------------------------- INTRODUCTION: A wake-up call An HP Enterprise Security's 2014 Global Report on the Cost of Cyber Crime by the Ponemon Institute reveals some astounding aspects of the cyber-attacks on the energy utilities. First, these assets suffered the highest average annual losses from cybercrimes ($13, 2 million), closely followed by the losses caused by computer attacks... --------------------------------------------- http://resources.infosecinstitute.com/cybersecurity-policy-and-threat-asses… *** Symantec Endpoint Protection: Gefährlicher Sicherheitslücken-Cocktail *** --------------------------------------------- Über verschiedene Schwachstellen in Symantecs End Point Protection 12.1 können sich Angreifer in Netzwerke schleichen, beliebigen Code und Befehle ausführen und anschließend ganze Systemverbunde kapern. --------------------------------------------- http://heise.de/-2768461 *** MatrixSSL Tiny: A TLS software implementation for IoT devices *** --------------------------------------------- INSIDE Secure announced the availability of MatrixSSL Tiny, the world's smallest Transport Layer Security (TLS) software implementation, to allow companies to affordably secure IoT devices with string... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/mnlQoZJr0zU/secworld.php *** Bugtraq: Mozilla extensions: a security nightmare *** --------------------------------------------- http://www.securityfocus.com/archive/1/536133 *** WordPress 4.2.4 Security and Maintenance Release *** --------------------------------------------- August 4, 2015 | WordPress 4.2.4 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. This release addresses six issues, including three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise... --------------------------------------------- https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance… *** Security Advisory: Apache vulnerability CVE-2012-0053 *** --------------------------------------------- (SOL15273) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/200/sol15273.htm… *** DSA-3327 squid3 - security update *** --------------------------------------------- Alex Rousskov of The Measurement Factory discovered that Squid3, a fullyfeatured web proxy cache, does not correctly handle CONNECT method peerresponses when configured with cache_peer and operating on explicitproxy traffic. This could allow remote clients to gain unrestrictedaccess through a gateway proxy to its backend proxy. --------------------------------------------- https://www.debian.org/security/2015/dsa-3327 *** SSA-504631 (Last Update 2015-08-04): Incorrect Certificate Validation in COMPAS Mobile App *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM SDK, Java Technology Edition affected IBM Workflow for Bluemix July 2015 *** http://www.ibm.com/support/docview.wss?uid=swg21963428 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Rational ClearCase (CVE-2015-1788, CVE-2015-1789, CVE-2015-1791) *** http://www.ibm.com/support/docview.wss?uid=swg21960633 *** IBM Security Bulletin: IBM Security Identity Manager Virtual Appliance is affected by multiple vulnerabilities *** http://www.ibm.com/support/docview.wss?uid=swg21962726 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Rational ClearQuest(CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962816 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) *** http://www.ibm.com/support/docview.wss?uid=swg21902824 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect IBM MobileFirst Platform Foundation and IBM Worklight *** http://www.ibm.com/support/docview.wss?uid=swg21961179

1 0

Tageszusammenfassung - Montag 3-08-2015
by Daily end-of-shift report 03 Aug '15

03 Aug '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 31-07-2015 18:00 − Montag 03-08-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** One font vulnerability to rule them all #1: Introducing the BLEND vulnerability *** --------------------------------------------- Posted by Mateusz Jurczyk of Google Project ZeroLast month, I presented parts of my PostScript font security research at the REcon security conference in Montreal, in a talk titled "One font vulnerability to rule them all: A story of cross-software ownage, shared codebases and advanced exploitation". This talk discussed the exploitation process of a vulnerability found in the implementation of a BLEND Charstring instruction, discovered in a user-mode Adobe Reader's CoolType... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-font-vulnerability-to-rul… *** Schwachstellen: Fernzugriff öffnet Autotüren *** --------------------------------------------- Einem Hacker ist es gelungen, sich in die Software Onstar Remotelink des US-Autoherstellers General Motors einzuklinken. Damit lässt sich das Fahrzeug entriegeln und sogar starten. Wegfahren konnte er mit dem gehackten Fahrzeug aber nicht. --------------------------------------------- http://www.golem.de/news/schwachstellen-fernzugriff-oeffnet-autotueren-1508… *** Angriff auf Dell-Firmware nach Tiefschlaf *** --------------------------------------------- Nach dem Aufwachen aus dem Standby vergisst die Firmware einiger Dell-Rechner, sich selbst vor Schreibzugriffen zu schützen. So könnten Angreifer Schadcode in die Firmware schleusen. --------------------------------------------- http://heise.de/-2766940 *** Sicherheitslücken im Android-Multimedia-System eskalieren *** --------------------------------------------- Die Schwachstellen im Multimedia-System sind gefährlicher als zuerst vermutet: Mit manipulierten MP4-Videos könnten Angreifer Kontrolle übers Smartphone erlangen. --------------------------------------------- http://heise.de/-2766925 *** Your Security Policy Is So Lame, (Sun, Aug 2nd) *** --------------------------------------------- Every person should avoid lame security policies because of the lack of clarity they leave behind. Often times we find ourselves forced into creating security policies due to compliance requirements. Is there a way to lean into this requirement and get value beyond the checkbox? I certainly think so and would like to share some ideas on how you can do this as well. ">I personally avoided being the policy guy">">The following are several tips and tricks you can use to --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19991&rss *** Microsoft Windows 10 spies on you by default *** --------------------------------------------- While Microsoft is offering for free it new Windows 10 OS, security experts argue that the cost for user privacy is much higher. Microsoft Windows 10 is the new operating system of the IT giant, the newborn already reached more than 14 million downloads in just two days. The experts who have already analyzed Windows 10... --------------------------------------------- http://securityaffairs.co/wordpress/39042/digital-id/windows-10-privacy.html *** BIND9 - Denial of Service Exploit in the Wild *** --------------------------------------------- BIND is one of the most popular DNS servers in the world. It comes bundled with almost every cPanel, VPS and dedicated server installation and is used by most DNS providers. A week ago, the Internet Systems Consortium (ISC) team released a patch for a serious denial of service vulnerability (CVE-2015-5477) that allows a remote... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/RmxRTNcW95o/bind9-denial-of-s… *** Chrome extensions crocked with simple attack *** --------------------------------------------- Security-enhancer HTTPS Everywhere switched off with this one weird trick Detectify researcher Mathias Karlsson says attackers can remove Google Chrome extensions, including the popular HTTPS Everywhere extension, if users do nothing else but visit a web page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/08/03/detectify_d… *** Hijacking Satellite Communications with a $1,000 Device *** --------------------------------------------- A security researcher demonstrated how to hack a satellite tracking technology with a $1,000 device made of off the shelf components. Colby Moore, a security expert from security firm Synack, will present in a talk at the next Black Hat Conference how to hack satellite tracking technology by using a $1,000 device made of off... --------------------------------------------- http://securityaffairs.co/wordpress/39051/digital-id/hijacking-satellite-co… *** Researchers Create First Firmware Worm That Attacks Macs *** --------------------------------------------- The common wisdom is that Apple computers are more secure than PCs. It turns out this isnt true. --------------------------------------------- http://www.wired.com/2015/08/researchers-create-first-firmware-worm-attacks… *** Anonymisierung: Weiterer Angriff auf das Tor-Netzwerk beschrieben *** --------------------------------------------- Forscher haben eine weitere Möglichkeit entdeckt, Benutzerzugriffe auf Tors Hidden Services zu entlarven. Ihr Angriff benötige aber eine gehörige Portion Glück, schreiben sie. Auch die Tor-Betreiber wiegeln ab. --------------------------------------------- http://www.golem.de/news/anonymisierung-weiterer-angriff-auf-das-tor-netzwe… *** Your SSH Server On Port 8080 Is No Longer "Hidden" Or "Safe", (Mon, Aug 3rd) *** --------------------------------------------- I am seeing some scanning for SSH servers on port 8080 in web server logs for web servers that listen on this port. So far, I dont see any scans like this for web servers listening on port 80. In web server logs, the scan is reflected as an Invalid Method (error 501) as the web server only sees the banner provided by the SSHclient, and of course can not respond. For example: 222.186.21.180 - - [03/Aug/2015:08:31:55 +0000] SSH-2.0-libssh2_1.4.3 501 303 - - This IP address in this example is for... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19995&rss *** Designing the Perfect Security Awareness Newsletter *** --------------------------------------------- Even in smaller organizations, a regular security awareness newsletter can support effective, participative security. While your organization's editorial rules could be a creative break on a really great newsletter, the following tips can help you build up an effective one that will be welcomed by associates and be an asset to the organization's security. Do... --------------------------------------------- http://resources.infosecinstitute.com/designing-the-perfect-security-awaren… *** Windows 10 Upgrade Spam Carries CTB-Locker Ransomware *** --------------------------------------------- Spam messages spoofing Microsoft and promising a free Windows 10 upgrade instead drop the CTB-Locker crypto-ransomware on compromised machines. --------------------------------------------- http://threatpost.com/windows-10-upgrade-spam-carries-ctb-locker-ransomware… *** Google Android Buffer Overflows in DHCP Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1033124 *** D-Link DCS-2103 1.20 CSRF / Cross Site Scripting *** --------------------------------------------- Topic: D-Link DCS-2103 1.20 CSRF / Cross Site Scripting Risk: Medium Text:Hello list! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DCS-2103 (IP camera). ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080016 *** VU#360431: Chiyu Technology fingerprint access control contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#360431 Chiyu Technology fingerprint access control contains multiple vulnerabilities Original Release date: 31 Jul 2015 | Last revised: 31 Jul 2015 Overview Multiple models of Chiyu Technology fingerprint access control devices contain a cross-site scripting (XSS) vulnerability and an authentication bypass vulnerability. Description CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CVE-2015-2870According to the reporter, tags are... --------------------------------------------- http://www.kb.cert.org/vuls/id/360431 *** Juniper Pulse Secure TCP Hardware Acceleration Flaw Lets Remote Users Access Data on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033166 *** FortiSandbox WebUI Multiple XSS vulnerabilities *** --------------------------------------------- Topic: FortiSandbox WebUI Multiple XSS vulnerabilities Risk: Low Text:[+] Credits: John Page aka hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source: http://hyp3rlinx.altervista.org/a... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015080004 *** DSA-3322 ruby-rack - security update *** --------------------------------------------- Tomek Rabczak from the NCC Group discovered a flaw in thenormalize_params() method in Rack, a modular Ruby webserver interface.A remote attacker can use this flaw via specially crafted requests tocause a `SystemStackError` and potentially cause a denial of servicecondition for the service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3322 *** DSA-3326 ghostscript - security update *** --------------------------------------------- William Robinet and Stefan Cornelius discovered an integer overflow inGhostscript, the GPL PostScript/PDF interpreter, which may result indenial of service or potentially execution of arbitrary code if aspecially crafted file is opened. --------------------------------------------- https://www.debian.org/security/2015/dsa-3326 *** DSA-3325 apache2 - security update *** --------------------------------------------- Several vulnerabilities have been found in the Apache HTTPD server. --------------------------------------------- https://www.debian.org/security/2015/dsa-3325 *** DSA-3323 icu - security update *** --------------------------------------------- Several vulnerabilities were discovered in the International Componentsfor Unicode (ICU) library. --------------------------------------------- https://www.debian.org/security/2015/dsa-3323 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Application Dependency Discovery Manager (TADDM) - IBM Java SDK updates July 2015 *** http://www.ibm.com/support/docview.wss?uid=swg21963354 *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Network Intrusion Prevention System *** http://www.ibm.com/support/docview.wss?uid=swg21962039 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web *** http://www.ibm.com/support/docview.wss?uid=swg21963096 *** IBM Security Bulletin: A vulnerability in Diffie-Hellman ciphers affects IBM Security Network Intrusion Prevention System (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962045 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cloud Manager with OpenStack (CVE-2015-0486 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808 *** http://www.ibm.com/support/docview.wss?uid=isg3T1022548 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM SmartCloud Entry (CVE-2015-0486 CVE-2015-0491 CVE-2015-0459 CVE-2015-0469 CVE-2015-0458 CVE-2015-0480 CVE-2015-0488 CVE-2015-0478 CVE-2015-0477 CVE-2015-2808 *** http://www.ibm.com/support/docview.wss?uid=isg3T1022550 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security Access Manager for Web and IBM Tivoli Access Manager for e-business *** http://www.ibm.com/support/docview.wss?uid=swg21963126 *** IBM Security Bulletin: Multiple vulnerabilities in the unzip utility affect IBM Security Access Manager for Web *** http://www.ibm.com/support/docview.wss?uid=swg21963094 *** IBM Security Bulletin: Vulnerabilities in unzip affect IBM Security Network Intrusion Prevention System (CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, and CVE-2014-9636 ) *** http://www.ibm.com/support/docview.wss?uid=swg21962038

1 0

Tageszusammenfassung - Freitag 31-07-2015
by Daily end-of-shift report 31 Jul '15

31 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-07-2015 18:00 − Freitag 31-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Derelict TrueCrypt Russia portal is command hub for Ukraine spying op *** --------------------------------------------- Backdoored code slung at officials, journos etc Malware used to attack Ukrainian government, military, and major news agencies in the country, was distributed from the Russian portal of encryption utility TrueCrypt, new research has revealed. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/30/truecrypt_r… *** Username Enumeration against OpenSSH-SELinux with CVE-2015-3238 *** --------------------------------------------- I recently disclosed a low-risk vulnerability in Linux-PAM < 1.2.1 , which allows attackers to conduct username enumeration and denial of service attacks. Below I will provide more technical details about this vulnerability. The Past Time-based username enumeration is an... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-ag… *** Flash Threats: Not Just In The Browser *** --------------------------------------------- July has been a fairly poor month for Adobe Flash Player security, to say the least. Three separate zero-day vulnerabilities (all courtesy of the Hacking Team dump) have left many people concerned about Flash security, with many (including this blog) calling for it to go away. Some sort of reaction from Adobe to improve Flash... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/6YRcRVFMKYg/ *** Bundestags-Hack: Reparatur des Bundestagsnetzes soll vier Tage dauern *** --------------------------------------------- Das Netzwerk des Bundetages soll zwischen dem 13. und 17. August 2015 neu aufgesetzt werden. In dieser Zeit wird es komplett abgeschaltet. Auch E-Mails können dann nicht mehr empfangen oder versendet werden. --------------------------------------------- http://www.golem.de/news/bundestags-hack-reparatur-des-bundestagsnetzes-sol… *** Compromised site serves Nuclear exploit kit together with fake BSOD *** --------------------------------------------- Support scammers not lying about a malware infection for a change.During our work on the development of the VBWeb tests, which will be started soon, we came across an interesting case of an infected website that served not only the Nuclear exploit kit, but also a fake blue screen of death (BSOD) that attempted to trick the user into falling for a support scam.When a (legitimate) website includes (legitimate) advertisements, these ads themselves are rarely included in the HTML code. Rather, the... --------------------------------------------- http://www.virusbtn.com/blog/2015/07_31.xml?rss *** MMS Not the Only Attack Vector for "Stagefright" *** --------------------------------------------- Earlier this week Zimperium zLabs revealed an Android vulnerability which could be used to install malware on a device via a simple multimedia message. This vulnerability, now known as Stagefright, has gained a lot of attention for the potential attacks it can cause. Stagefright makes it possible, for example, for an attacker to install a spyware app... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/fiKsjboNusw/ *** Real World Ramifications of Cyber Attacks *** --------------------------------------------- Warning: the following blog contains gratuitous use of sarcasm and hyperbole from the start. Reader discretion is advised. And so, ladies and gentlemen, it has finally happened. The Internet-of-Things has risen up, Skynet style, and we are doomed. This much prophesied event finally came to pass with reports of hackers disabling cars from miles away, and altering rifle trajectories. At last, it seems, the crossover has been made from the digital world to the physical one; the end is nigh. Then... --------------------------------------------- https://blog.team-cymru.org/2015/07/real-world-ramifications-of-cyber-attac… *** Symantec Endpoint Protection Multiple Issues *** --------------------------------------------- Revisions None Severity CVSS2 Base Score ... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco ASR 1000 Series Aggregation Services Routers Fragmented Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Prime Central Hosted Collaboration Solution Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40214 *** Cisco IM and Presence Service Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40217 *** Cisco AnyConnect Secure Mobilty Client Directory Traversal Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40175 *** Cisco Unified Communications Manager Prime Collaboration Deployment Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=40223 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Password Storage Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a password storage vulnerability in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 *** ZDI-15-372: IBM Tivoli Storage Manager FastBack Server Opcode 4755 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/lONzWRepYUI/ *** ZDI-15-373: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Files Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Np2gm5rVOXQ/ *** ZDI-15-374: IBM Tivoli Storage Manager FastBack Server Opcode 1365 Volumes Restore Agents Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/zJI4EVNVvMM/ *** ZDI-15-375: IBM Tivoli Storage Manager FastBack Server Opcode 4115 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x0uVs7pbpJo/ *** ZDI-15-376: IBM Tivoli Storage Manager FastBack Server Opcode 8192 Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/L9RNtcsUYnU/ *** More IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 30-07-2015
by Daily end-of-shift report 30 Jul '15

30 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-07-2015 18:00 − Donnerstag 30-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Der Stagefright Bug *** --------------------------------------------- Bald ist die Blackhat Konferenz in Vegas und der Schwachstellen-Zirkus rundherum ist im vollen Gange. Aktuell sind eine Reihe von Verwundbarkeiten in der Stagefright Library von Android groß im Gespräch. Was steckt da .. --------------------------------------------- http://www.cert.at/services/blog/20150730175038-1560.html *** Anatomy of a Scamware Network - MultiPlug *** --------------------------------------------- While examining our cloud sandbox data recently, we uncovered a large MultiPlug network that caught our attention due to its use pattern of code signing certificates and the breadth of its hosting infrastructure. Overview of the Scamware .. --------------------------------------------- http://research.zscaler.com/2015/07/anatomy-of-scamware-network-multiplug.h… *** Tsar Team Microsoft Office Zero Day CVE-2015-2424 *** --------------------------------------------- After the publication of Flash and IE zero days following the Hacking Team leak, researchers have discovered the use of another zero-day vulnerability by the Tsar Team sometimes .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Tsar-Team-Microsoft-Off… *** Telefonanlage gehackt – 14.000 Euro Schaden für Firma in Oberwart *** --------------------------------------------- Der Fall einer Firma, deren Telefonanlage von Unbekannten gehackt worden ist, beschäftigt Kriminalisten in Oberwart: Dem Unternehmer flatterten Rechnungen über insgesamt 14.000 Euro ins Haus. Wie der Schaden entstehen konnte, sei noch Gegenstand von Ermittlungen, teilte die Landespolizeidirektion Burgenland mit. --------------------------------------------- http://derstandard.at/2000019966507 *** Android: Video-Attacke kann Geräte unbenutzbar machen *** --------------------------------------------- Die Sicherheit von Googles mobilem Betriebssystem Android kommt einmal mehr unter Beschuss: Nur wenige Tage nachdem Zimperium vor mehreren Lücken im Media Framework Stagefright gewarnt hat, meldet sich nun auch Trend Micro zu Wort. In einem Blog-Eintrag warnt der Sicherheitsdienstleister vor zwei weiteren Fehlern in Stagefright, durch die ein Android-Gerät vorübergehend keinen Laut mehr von sich gibt. Auch reagiert ein solcherart angegriffenes Geräte kaum bis gar nicht mehr. --------------------------------------------- http://derstandard.at/2000019966485 *** Windows 10 speichert Festplattenverschlüsselungs-Keys in der Cloud *** --------------------------------------------- Mit Windows 10 steht seit kurzem die neueste Betriebssystemgeneration von Microsoft zur Verfügung. Die ersten Tests kommen zu überwiegende positiven Urteilen, und doch steht der Softwarehersteller nun einmal mehr in der Kritik – und zwar von Sicherheitsexperten. --------------------------------------------- http://derstandard.at/2000019972950 *** Throwback Thursday: Riotous Assembly *** --------------------------------------------- This Throwback Thursday, we turn the clock back to January 1994, shortly after Cyber Riot had emerged as the first virus capable of infecting the Windows kernel.Today, malware that affects the Windows kernel is ubiquitous - the .. --------------------------------------------- http://www.virusbtn.com/blog/2015/07_30.xml *** Beginners Guide to "Use after free Exploits #IE 6 0-day #Exploit Development" *** --------------------------------------------- Last week a friend asked few queries regarding use after free vulnerabilities, . Its been a while I wrote a tutorial so taught of cooking a beginners guide this week end. I wanted a live target for the tutorial so my plans were to .. --------------------------------------------- http://garage4hackers.com/content.php?r=143-Beginners-Guide-to-Use-after-fr… *** Admin-Oberfläche Froxlor verrät Datenbank-Passwörter *** --------------------------------------------- Das Server-Management-Panel Froxlor ist verwundbar und Angreifer können unter Umständen das Datenbank-Passwort aus der Ferne auslesen. Eine gefixte Version ist aber noch nicht für alle Linux-Distributionen verfügbar. --------------------------------------------- http://heise.de/-2765508 *** OpenBSD patch Lets Remote Users Execute Arbitrary Commands on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033126 *** CVE-2015-0097 Exploited in the Wild *** --------------------------------------------- In March 2015, Microsoft patched a remote code execution (RCE) vulnerability (CVE-2015-0097) in Microsoft Office. In July 2015, Eduardo Prado released a Proof of Concept (PoC) exploit for this vulnerability here. It did not take long for attackers to repackage this PoC and use it in attacks .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-0097_exploi.h… *** l+f: Smarter Safe lässt sich clever ausrauben *** --------------------------------------------- Präparierten USB-Stick anstecken, 60 Sekunden warten und schon öffnen sich die Tresor-Türen: Mehr als 10.000 in den USA installierte vermeintlich smarte Tresore sollen sich so knacken lassen. Die Spuren lassen sich dabei restlos verwischen. --------------------------------------------- http://heise.de/-2765663 *** Why is Passive Mixed Content so serious? *** --------------------------------------------- One of the most important tools in web security is Transport Layer Security (TLS). It not only protects sensitive information during transit, but also verifies that .. --------------------------------------------- https://blog.whitehatsec.com/why-is-passive-mixed-content-so-serious/

1 0

Tageszusammenfassung - Mittwoch 29-07-2015
by Daily end-of-shift report 29 Jul '15

29 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-07-2015 18:00 − Mittwoch 29-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New RC4 Attack *** --------------------------------------------- New research: "All Your Biases Belong To Us: Breaking RC4 in WPA-TKIP and TLS," by Mathy Vanhoef and Frank Piessens: Abstract: We present new biases in RC4, break the Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP), and design a practical .. --------------------------------------------- https://www.schneier.com/blog/archives/2015/07/new_rc4_attack_1.html *** Cisco UCS Central Software File Access Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40151 *** Cisco AnyConnect Secure Mobility Client Local Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40176 *** SweetCAPTCHA Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the .. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** CVE-2015-5477: An error in handling TKEY queries can cause named to exit with a REQUIRE assertion failure *** --------------------------------------------- An error in the handling of TKEY queries can be exploited by an attacker for use as a denial-of-service vector, as a constructed packet can use the defect to trigger a REQUIRE assertion failure, causing BIND to exit. --------------------------------------------- https://kb.isc.org/article/AA-01272 *** Trend Micro Discovers Vulnerability That Renders Android Devices Silent *** --------------------------------------------- We have discovered a vulnerability in Android that can render a phone apparently dead - silent, unable to make calls, with a lifeless screen. This vulnerability is present from Android 4.3 (Jelly Bean) up to the current version, Android .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** Hackers Can Disable a Sniper Rifle - Or Change Its Target *** --------------------------------------------- If a hacker attacks your TrackingPoint smart gun over its Wi-Fi connection, you may find the weapon is aiming at a different target than you think. --------------------------------------------- http://www.wired.com/2015/07/hackers-can-disable-sniper-rifleor-change-targ… *** Eigene Keys zum Verschlüsseln der Google Cloud Platform *** --------------------------------------------- Nutzer der Google Cloud Platform können ihre Umgebung nun mit eigenen Keys verschlüsseln. So sollen weder Betreiber noch Externe Zugriff auf die Daten erhalten. --------------------------------------------- http://heise.de/-2764751 *** Phishing: Betrüger zocken Nutzer mit "WhatsApp Gold" ab *** --------------------------------------------- Fake-Angebot lockt mit "besserer Audioqualität" und größeren Gruppen – bringt aber nur Werbung --------------------------------------------- http://derstandard.at/2000019919056 *** A third of workers admit theyd leak sensitive biz data for peanuts *** --------------------------------------------- And three per cent of employees would consider offers as low as 100 pound. A third of employees would sell information on company patents, financial records and customer credit card details .. --------------------------------------------- www.theregister.co.uk/2015/07/29/third_workers_would_leak_data_cash/ *** Die Git-Stolperfalle: Viele Webseiten geben sensible Daten preis *** --------------------------------------------- Wenn Web-Admins beim Hochladen von Projekten nicht aufpassen, stellen sie unter Umständen ohne es mitzubekommen Passwort-Datenbanken und weitere schützenswerte Daten zum Abruf für jedermann bereit. --------------------------------------------- http://heise.de/-2764756 *** Remote code execution via serialized data *** --------------------------------------------- Most programming languages contain powerful features, that used correctly are incredibly powerful, but used incorrectly can be incredibly dangerous. Serialization (and deserialization) is one such feature available in most modern programming .. --------------------------------------------- https://securityblog.redhat.com/2015/07/29/remote-code-execution-via-serial… *** Analyzing VUPEN's CVE-2012-1856 *** --------------------------------------------- Quite some time ago (more than a year before the HackingTeam leaks) I came across a number of interesting exploit samples that make use of CVE-2012-1856. With the recent HackingTeam leaks a .. --------------------------------------------- http://blog.ropchain.com/2015/07/27/analyzing-vupens-cve-2012-1856/ *** Sicherheitsupdate von Chrysler gefährlicher als Hack *** --------------------------------------------- Zum Schließen einer Sicherheitslücke, die eine Fernsteuerung des Autos ermöglichen könnte, bot Chrysler den Download von ".exe"- und ".zip"-Dateien für die Autoelektronik an. --------------------------------------------- http://fm4.orf.at/stories/1761148/ *** Windows 10 Shares Your Wi-Fi With Contacts *** --------------------------------------------- Starting today, Microsoft is offering most Windows 7 and Windows 8 users a free upgrade to the software giants latest operating system -- Windows 10. But theres a very important security caveat that users should know about before transitioning to the .. --------------------------------------------- http://krebsonsecurity.com/2015/07/windows-10-shares-your-wi-fi-with-contac…

1 0

Tageszusammenfassung - Dienstag 28-07-2015
by Daily end-of-shift report 28 Jul '15

28 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-07-2015 18:00 − Dienstag 28-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Firepower 9000 Series Unauthenticated Web Page Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40136 *** Cisco Email Security Appliance AsyncOS Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40172 *** Angler Exploit Kit Used to Find and Infect PoS Systems *** --------------------------------------------- An attack aiming to infect PoS systems was found using the Angler Exploit Kit to push a PoS reconnaissance Trojan,This Trojan, detected as TROJ_RECOLOAD.A, checks for multiple conditions in the infected system like if it is a PoS machine or part of a PoS .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/angler-exploit-k… *** PHP File Manager hat gravierende Sicherheitslücken *** --------------------------------------------- Seit Jahren ungepatchte Schwachstellen im PHP File Manager gefährden zahlreiche Server, darunter auch von großen Unternehmen. Der Hersteller reagiert nicht auf Anfragen --------------------------------------------- http://www.golem.de/news/security-php-file-manager-hat-gravierende-sicherhe… *** 2. Konferenz zur Cyber Security Challenge: Das Programm steht *** --------------------------------------------- Die Gefahren und andererseits die Möglichkeiten zum Schutz und der Prävention vor Cyberangriffen sind das zentrale Thema der 2. Konferenz zur Cyber Security Challenge Germany Mitte September in Berlin. --------------------------------------------- http://heise.de/-2761878 *** [2015-07-28] McAfee Application Control multiple vulnerabilities *** --------------------------------------------- McAfee Application Control contains multiple vulnerabilities which can be used by an attacker to bypass the provided application whitelisting protection and attack availability of the system. Moreover, the identified vulnerabilities negatively affect the security of the underlying operating system. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** IMI 2015 - IT meets Industry 29.-30. September 2015 *** --------------------------------------------- Interconnecting IT and Automation offers great opportunities for the operation of industrial production sites. However, this may carry along some complex risks. With the title “IT meets Industry” IMI 2015 brings together the ICS- and IT-Community. The goal: make the most of opportunities – and minimise risks. --------------------------------------------- https://it-meets-industry.de/ *** Honeynet-Projekt analysiert Gefahren für Industrie 4.0 *** --------------------------------------------- Acht Monate lang beobachteten Experten des TÜV SÜD, welche Angriffe von wo aus auf ihr simuliertes Wasserwerk erfolgten. Ihre Erkenntnisse sollten arglose Unternehmen spätestens jetzt wachrütteln. --------------------------------------------- http://heise.de/-2763978 *** Aaron Zauner presented preliminary results on TLS usage in email *** --------------------------------------------- Aaron Zauner presented our preliminary results on the usage of TLS in the email ecosystem at the IETF meeting last week. As part of our project TLSiP we are actively scanning the Internet (/0) for TLS configurations as well as its problems with it. As .. --------------------------------------------- https://www.sba-research.org/2015/07/28/aaron-zauner-presented-preliminary-… *** The Russian Underground - Revamped *** --------------------------------------------- When big breaches happen and hundreds of millions of credit card numbers and SSNs get stolen, they resurface in other places. The underground now offers a vast landscape of shops, where criminals can buy credit cards and other things at irresistible prices. Million dollar breaches News and media coverage .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-russian-unde… *** Cisco 2015 Midyear Security Report [PDF] *** --------------------------------------------- http://www.cisco.com/web/offers/pdfs/cisco-msr-2015.pdf *** Security: Apples App Store als Einfallstor für Schadcode *** --------------------------------------------- Über eine Schwachstelle in der Verarbeitung von Belegen für Einkäufe in Apples App Store lässt sich Code auf fremden Rechnern einschleusen. --------------------------------------------- http://www.golem.de/news/security-apples-app-store-als-einfallstor-fuer-sch…

1 0

Tageszusammenfassung - Montag 27-07-2015
by Daily end-of-shift report 27 Jul '15

27 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-07-2015 18:00 − Montag 27-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Cisco Products LDAP Server SSL Certificate Validation Vulnerability *** --------------------------------------------- A vulnerability in SSL certificate validation of multiple Cisco products could allow an unauthenticated, remote attacker to stage a man-in-the-middle attack. The vulnerability is due to lack of SSL certificate validation for secure LDAP. An attacker could exploit this vulnerability to stage a man-in-the-middle attack when .. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40137 *** IT-Sicherheit bei smarten Autos "viel zu lange ignoriert" *** --------------------------------------------- Nach dem Hack eines Jeeps gibt es Einigung darüber, dass noch viel Nachholbedarf besteht --------------------------------------------- http://derstandard.at/2000019712190 *** DSA-3317 lxc - security update *** --------------------------------------------- Several vulnerabilities have been discovered in LXC, the LinuxContainers userspace tools. Roman Fiedler discovered a directory traversal flaw in LXC when creating lock files. A local attacker could exploit this flaw to create an arbitrary .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3317 *** Hacking Team: "Wir sind das Opfer" *** --------------------------------------------- Der Hersteller von aggressiver Überwachungs-Software sieht sich als einziges Opfer in der Affäre um die Veröffentlichung von Daten, die die Zusammenarbeit des Unternehmens mit autoritären Staaten belegen sollen. --------------------------------------------- http://heise.de/-2763077 *** WP Statistics <= 9.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8116 *** WP Slimstat <= 4.1.5.2 - Referer Header Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8117 *** Password Hashing Competition: Hashfunktion Argon2 gewinnt Wettbewerb *** --------------------------------------------- In einem Wettbewerb ist nach neuen Hashfunktionen gesucht worden, die sich für das Hashen von Passwörtern eignen. Jetzt steht der Gewinner fest: Argon2, entwickelt von einem Team an der Universität Luxemburg. --------------------------------------------- http://www.golem.de/news/password-hashing-competition-hashfunktion-argon2-g… *** Security: Zahlreiche Steam-Konten gehackt *** --------------------------------------------- Die Steam-Konten mehrerer Twitch-Streamer wurden offenbar von Unbekannten übernommen. Sie nutzen einen Fehler in der Anmeldefunktion aus. Valve hat bereits ein Update bereitgestellt. --------------------------------------------- http://www.golem.de/news/security-zahlreiche-steam-konten-gehackt-1507-1154… *** Advertising hijacking made by Invisible rogue mobile apps are wasting petabytes of data a day *** --------------------------------------------- Mobile Malware is growing and crooks are targeting the advertising industry to redirect users to ad pages in a sort of Advertising hijacking. Mobile Malware is growing and crooks are targeting the advertising industry with malicious .. --------------------------------------------- http://securityaffairs.co/wordpress/38885/cyber-crime/mobile-advertising-hi… *** Citrix XenServer Multiple Security Updates *** --------------------------------------------- A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host ... --------------------------------------------- http://support.citrix.com/article/CTX201145 *** ManageEngine Exchange Reporter Plus Auth Bypass / Arbitrary SQL Statement Execution *** --------------------------------------------- The ManageEngine Exchange Reporter product installs a JBoss server which listens on default port 8181 (tcp/http) for incoming requests. It offers an admin panel on that port. Without authorization/authentication it is possible to .. --------------------------------------------- https://blogs.securiteam.com/index.php/archives/2533 *** Experts Found a Unicorn in the Heart of Android *** --------------------------------------------- Gaining remote code execution privileges merely by having access to the mobile number? Enter Stagefright. The targets for this kind of attack can be anyone from Prime ministers, govt. officials, company executives, security officers to IT managers. --------------------------------------------- http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/

1 0

Tageszusammenfassung - Freitag 24-07-2015
by Daily end-of-shift report 24 Jul '15

24 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-07-2015 18:00 − Freitag 24-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Four Zero Days Disclosed in Internet Explorer Mobile *** --------------------------------------------- [...] The four vulnerabilities originally were reported to Microsoft as affecting IE on the desktop, and later on it was discovered that they also affected IE Mobile on Windows Phones. Microsoft has patched all of the vulnerabilities in the desktop version of the browser, but the bugs remain open on IE Mobile. ZDI’s original advisories on these flaws said that they were zero days on Internet Explorer, as well. The company updated the advisories late Thursday to reflect the fact that the bugs only affect IE Mobile. --------------------------------------------- http://threatpost.com/four-zero-days-disclosed-in-internet-explorer/113911 *** Fixing hundreds of websites in one day *** --------------------------------------------- Remedying Angler infections in Switzerland In recent weeks the Angler exploit kit has become the dominating tool for DriveBy attacks. Cleaning Angler compromised web servers is a challenge which has been well mastered in Switzerland, thanks to the close collaboration... --------------------------------------------- http://securityblog.switch.ch/2015/07/24/fixing-hundreds-of-websites-in-one… *** The OpenSSH Bug That Wasnt *** --------------------------------------------- Much has been written about a purported OpenSSH vulnerability. On closer inspection, the reports actually got most of their facts wrong. Read on for the full story.It all started with a blog post dated July 16, 2015, titled OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass), where the TL;DR is that its possible to get an almost infinite number of tries at authentication -- good for bruteforce password guessing, for example -- if you only tickle the... --------------------------------------------- http://bsdly.blogspot.com/2015/07/the-openssh-bug-that-wasnt.html *** Malicious Google Analytics Referral Spam *** --------------------------------------------- Robots (bots) have outnumbered people on the Internet for almost two years, and they browse much faster than your average visitor. Aside from spamming your comment systems and crawling for vulnerable websites to attack, bots can also cause a lot of confusion in your website traffic reporting systems. If you use analytics software on yourRead More The post Malicious Google Analytics Referral Spam appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/malicious-google-analytics-referral-spam.ht… *** libuser vulnerabilities *** --------------------------------------------- It was discovered that the libuser library contains two vulnerabilities which, in combination, allow unprivileged local users to gain root privileges. libuser is a library that provides read and write access to files like /etc/passwd, which constitute the system user... --------------------------------------------- https://securityblog.redhat.com/2015/07/23/libuser-vulnerabilities/ *** Emerging Web Infrastructure Threats *** --------------------------------------------- A secure cloud relies on some weak Internet infrastructure with some new BGP vulnerabilities that will be disclosed at Black Hat USA. --------------------------------------------- http://www.darkreading.com/cloud/emerging-web-infrastructure-threats/d/d-id… *** Boffins sting spooks with HORNET onion router *** --------------------------------------------- Spies eyss will water with effort as they try to slice into 93 Gb/s Tor cousin Five academics have developed a Tor alternative network that can handle up to 93 Gb/s of traffic while maintaining privacy. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/24/hornet_high… *** SANS ICS Amsterdam 2015 - 22-28 September, 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 remains open for registration. This dedicated event for those tasked with securing Industrial Control Systems will be led by SANS ICS/SCADA Instructors and subject-matter experts from across the globe. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** IT-Sicherheitsgesetz tritt in Kraft *** --------------------------------------------- Das "Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme" bringt zunächst verschärfte Anforderungen für Serveradmins und Meldepflichten für Provider sowie Kernkraftwerksbetreiber mit sich. --------------------------------------------- http://www.heise.de/newsticker/meldung/IT-Sicherheitsgesetz-tritt-in-Kraft-… *** How to manage PCI DSS 3.1 Requirement 6.6 for your web applications *** --------------------------------------------- One of the PCI DSS 3.1 requirements is Requirement 6.6 dedicated to web application security. In this blog post we will try to understand how to comply with the requirement in cost-efficient manner. --------------------------------------------- https://www.htbridge.com/blog/how-to-manage-pci-dss-3-1-requirement-6-6-for… *** SweetCaptcha Returns Hijacking Another Plugin *** --------------------------------------------- Yesterday we observed a strange short return of the SweetCaptcha plugin to WordPress.org repository. In June we reported that SweetCaptcha injected third-party ad code to their scripts which lead to malvertising problems on the sites that used this CAPTCHA service. After that incident, the SweetCaptcha WordPress plugin had been removed from the official plugin repository.Read More The post SweetCaptcha Returns Hijacking Another Plugin appeared first on Sucuri Blog. --------------------------------------------- https://blog.sucuri.net/2015/07/sweetcaptcha-returns-hijacking-another-plug… *** DSA-3314 typo3-src - end of life *** --------------------------------------------- Upstream security support for Typo3 4.5.x ended three months ago and thesame now applies to the Debian packages as well. --------------------------------------------- https://www.debian.org/security/2015/dsa-3314 *** userhelper/libuser Multiple vulns *** --------------------------------------------- Topic: userhelper/libuser Multiple vulns Risk: Medium Text:Qualys Security Advisory CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070115 *** Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability (UPDATE A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-202-03 Siemens RuggedCom ROS and ROX-based Devices TLS POODLE Vulnerability that was published July 22, 2015 on the ICS-CERT web site. This advisory provides mitigation details for a Transport Layer Security Padding Oracle On Downgraded Legacy Encryption vulnerability in the web interface of the Siemens RuggedCom ROS and ROX-based devices. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-202-03A

1 0

Tageszusammenfassung - Donnerstag 23-07-2015
by Daily end-of-shift report 23 Jul '15

23 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-07-2015 18:00 − Donnerstag 23-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Flash zero-day monster Angler dominates exploit kit crime market *** --------------------------------------------- If only you could buy shares SophosLabs researcher Fraser Howard says the Angler exploit kit is dominating the highly-competitive underground malware market, growing from exploding a quarter to 83 percent of market share within nine months . --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/23/sophos_angl… *** Hintergrund: Das Geschäft mit den Zero Days *** --------------------------------------------- Der Verkauf von bisher unbekannten Sicherheitslücken, sogenannten Zero Days, scheidet die Geister. Manche halten dieses Geschäft für unmoralisch, andere sagen, es sollte illegal sein. Vor allem ist es aber wohl sehr lukrativ. --------------------------------------------- http://heise.de/-2757303 *** Security: Schwachstelle erlaubt lokale Rechteausweitung in OS X 10.10 *** --------------------------------------------- Ein Fehler in Apples OS X 10.10.4 erlaubt es, sich administrative Privilegien zu verschaffen. Die Schwachstelle kann nur lokal ausgenutzt werden und wurde in der Beta von OS X 10.11 bereits behoben. --------------------------------------------- http://www.golem.de/news/security-schwachstelle-erlaubt-lokale-rechteauswei… *** 3 important questions raised by Wired's car hack *** --------------------------------------------- Wired.com broke a shocking but hardly surprising story on July 21st. The reporter was driving his Jeep on the highway when strange things started to happen. First the fan and radio went on and later the whole car came to a stop. On the highway! Andy Greenburg was not in control of the car anymore. --------------------------------------------- http://safeandsavvy.f-secure.com/2015/07/23/3-important-questions-raised-by… *** Löchrige VMs: Den PGP-Schlüssel des Nachbarn klauen *** --------------------------------------------- Teilt man sich auf einem virtuellen Server die gleiche Hardware mit anderen VMs, kann man diese ausspionieren. Dabei lassen sich auf überraschend vielen Wegen Side-Channel-Angriffe durchführen. --------------------------------------------- http://heise.de/-2760695 *** Hacking Team: a zero-day market case study *** --------------------------------------------- This article documents Hacking Teams third-party acquisition of zero-day (0day) vulnerabilities and exploits. The recent compromise of Hacking Teams email archive offers one of the first public case studies of the market for 0days. Because of its secretive nature, this market has been the source of endless debates on the ethics of its participants. The archive also offers insight into the capabilities and limits of offensive-intrusion software developers. Hacking Team was seriously exploit... --------------------------------------------- http://tsyrklevich.net/2015/07/22/hacking-team-0day-market/ *** Securing Cookies using HTTP Headers *** --------------------------------------------- In the previous articles in this series on defending against web attacks using HTTP headers, we have seen the usage of X-Frame-Options and X-XSS-Protection headers. In this article, we will see some HTTP headers to secure cookies. Introduction: Cookies are one of the most sensitive items during a user's session. An authentication cookie is as... --------------------------------------------- http://resources.infosecinstitute.com/defending-against-web-attacks-using-h… *** Another Day, Another Patch *** --------------------------------------------- FreeBSD users were treated this week to an interesting new denial of service attack vector. All supported versions of the OS are affected by the bug, which has now been patched. Junos OS, which is based on FreeBSD, is also affected. If you're a FreeBSD admin and you haven't patched, feel free to disappear now and do so. Don't worry, we'll be here when you're done - Right, now that's out of the way, we can peruse the vulnerability at our leisure. The bug... --------------------------------------------- https://blog.team-cymru.org/2015/07/another-day-another-patch/ *** SBA Afterworks Summer Special: Hacking Team Hacked? => Lessons Learned! *** --------------------------------------------- August 06, 2015 - 5:00 pm - 6:00 pm SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/security-afterworks-hacking-team-hacked… *** Sicherheitsupdate für WordPress *** --------------------------------------------- WordPress 4.2.3 stopft unter anderem ein Sicherheitsloch, durch die Nutzer mit bestimmten Rechten die gesamte Site kompromittieren können. --------------------------------------------- http://heise.de/-2761788 *** Microsofts Advanced Threat Analytics soll Firmennetze schützen *** --------------------------------------------- Microsoft will Firmennetze mit Advanced Threat Analytics gegen Angriffe und Eindringlinge wappnen. Die Software setzt am Active Directory an, soll lernfähig sein und präsentiert Verdächtiges in einer Zeitleiste. --------------------------------------------- http://heise.de/-2761360 *** Cisco IOS Software TFTP Server Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Unified MeetingPlace Unauthorized Password Change Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Application Policy Infrastructure Controller Access Control Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR LPTS Network Stack Remote Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40068 *** Security Advisory: PCRE library vulnerability CVE-2015-2325 *** --------------------------------------------- (SOL16983) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16983.htm… *** Security Advisory: Multiple PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026 *** --------------------------------------------- (SOL16993) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16993.htm… *** DSA-3312 cacti - security update *** --------------------------------------------- Multiple SQL injection vulnerabilities were discovered in cacti, a webinterface for graphing of monitoring systems. --------------------------------------------- https://www.debian.org/security/2015/dsa-3312 *** DSA-3313 linux - security update *** --------------------------------------------- Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a privilege escalation or denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3313 *** EMC Avamar Lets Remote Users Traverse the Directory to View Files on the Target System *** --------------------------------------------- http://www.securitytracker.com/id/1033026 *** USN-2676-1: NBD vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2676-122nd July, 2015nbd vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummarySeveral security issues were fixed in NBD.Software description nbd - Network Block Device protocol DetailsIt was discovered that NBD incorrectly handled IP address matching. Aremote attacker could use this issue with an IP address that has a partialmatch and bypass access restrictions. This... --------------------------------------------- http://www.ubuntu.com/usn/usn-2676-1/ *** Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-135Project: Time Tracker (third-party module)Version: 7.xDate: 2015-July-22Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Multiple vulnerabilitiesDescriptionThis module enables you to track time on entities and comments.The module doesnt sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by... --------------------------------------------- https://www.drupal.org/node/2537866 *** OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-134Project: OSF for Drupal (third-party module)Version: 7.xDate: 2015-July-22Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Scripting, Access bypass, Cross Site Request ForgeryDescriptionThe Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within... --------------------------------------------- https://www.drupal.org/node/2537860 *** FTC Uconnect Vulnerability *** --------------------------------------------- NCCIC/ICS-CERT is aware of a public report and video of researchers demonstrating remote exploits on a magazine reporter's automobile. The report and video focus on unauthorized remote access to the Fiat Chrysler Automobile (FCA) Connect automotive infotainment system. ICS-CERT is issuing this alert to provide notice of this report and video, and that a patch is available from the FCA. --------------------------------------------- https://ics-cert.us-cert.gov/alerts/ICS-ALERT-15-203-01 *** WordPress 4.2.3 Security and Maintenance Release *** --------------------------------------------- July 23, 2015 --------------------------------------------- https://wordpress.org/news/2015/07/wordpress-4-2-3/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21962496 *** IBM Security Bulletin: Current Release of IBM SDK for Node.js in IBM Bluemix is affected by CVE-2015-5380 *** http://www.ibm.com/support/docview.wss?uid=swg21962754 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Tealeaf Customer Experience (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21959030 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2015-4000, CVE-2015-0478, CVE-2015-1916). *** http://www.ibm.com/support/docview.wss?uid=swg21962216 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK (CVE-2015-0478, CVE-2015-0488, and CVE-2015-1916) and with Diffie-Hellman ciphers (CVE-2015-4000) may affect IBM Integration Designer (IID) and WebSphere Integration Developer (WID) *** http://www.ibm.com/support/docview.wss?uid=swg21961812 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron (CVE-2015-0478, CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21961728 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects IBM Workload Deployer (CVE-2015-0209, CVE-2015-0286, CVE-2015-0287, CVE-2015-0288, CVE-2015-0289, CVE-2015-0292, and CVE-2015-0293) *** http://www.ibm.com/support/docview.wss?uid=swg21962334 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Image Construction and Composition Tool (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962370

1 0

Tageszusammenfassung - Mittwoch 22-07-2015
by Daily end-of-shift report 22 Jul '15

22 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-07-2015 18:00 − Mittwoch 22-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** WP-CLI Guide: Secure WordPress Backup and Update *** --------------------------------------------- Welcome to our second post in the series on WP-CLI for WordPress management over SSH. In our previous post, we discussed how to get your SSH credentials and use WP-CLI to connect to your website over the command line. Before we get into changing anything, we'll show you how to back up your database and compress... --------------------------------------------- https://blog.sucuri.net/2015/07/wp-cli-guide-secure-wordpress-backup-update… *** Exclusive: Visa application portal closed following SC Magazine investigation *** --------------------------------------------- VFS Global closes visa application portal following SC Magazine investigation. Editable Schengen visa application forms accessed FOUR DAYS after operating company VFS Global said a vulnerability had been fixed. --------------------------------------------- http://www.scmagazine.com/exclusive-visa-application-portal-closed-followin… *** Free security tools help detect Hacking Team malware *** --------------------------------------------- Vulnerabilities and other threats exposed in the Hacking Team leaks has spurred Rook Security and Facebook to each release free security tools. --------------------------------------------- http://www.scmagazine.com/rook-security-facebook-release-free-security-tool… *** "Super-Spion": Android-Überwachungssoftware von Hacking Team nutzt allerhand schmutzige Tricks *** --------------------------------------------- Eine Analyse der Spionage-App RCSAndroid zeigt umfassende Ausspähfunktionen auf. Die Infektion erfolgt über Exploits - und möglicherweise auch Google Play. --------------------------------------------- http://heise.de/-2759365 *** Introduction to Alternate Data Streams *** --------------------------------------------- In this post, we defined what is an alternate data stream (ADS), showed how it can be created and read, and how one can remove unwanted ADS.Categories: All Things DevTags: adsalternate data streamsPieter Arntzpowershellstreams(Read more...) --------------------------------------------- https://blog.malwarebytes.org/development/2015/07/introduction-to-alternate… *** Think your website isn't worth anything to hackers? Think again *** --------------------------------------------- Have you ever thought about the cost of your website compromise? --------------------------------------------- https://www.htbridge.com/blog/think-your-website-isn-t-worth-anything-to-ha… *** l+f: Falsche Microsoft-Techniker simulieren falsche Bluescreens *** --------------------------------------------- Die Telefonabzocker, die sich als Microsoft-Techniker ausgeben, haben sich eine neue Masche überlegt - und sind jetzt auch telefonisch erreichbar. --------------------------------------------- http://heise.de/-2760509 *** DFN-CERT-2015-1107: FreeBSD, Transmission Control Protocol (TCP): Eine Schwachstelle erlaubt einen Denial-of-Service-Angriff *** --------------------------------------------- Eine Schwachstelle im Transmission Control Protocol (TCP) der TCP/IP Protocol Suite ermöglicht einem entfernten, nicht authentisierten Angreifer einen kompletten Denial-of-Service-Zustand zu bewirken. Von der Schwachstelle sind alle derzeit unterstützten FreeBSD-Versionen betroffen. Sicherheitsupdates stehen bereit. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1107/ *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco IOS XR Concurrent Data Management Replication Process BGP Process Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40067 *** Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40021 *** [R1] PHP < 5.4.43 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-09 *** Hospira Symbiq Infusion System Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides compensating measures for a vulnerability in the Hospira Symbiq Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-174-01 *** Counter-Strike 1.6 GameInfo Query Reflection DoS *** --------------------------------------------- Topic: Counter-Strike 1.6 GameInfo Query Reflection DoS Risk: Medium Text:#!/usr/bin/perl # # Counter-Strike 1.6 GameInfo Query Reflection DoS # Proof Of Concept # # Copyright 2015 (c) Todor ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070103

1 0

Tageszusammenfassung - Dienstag 21-07-2015
by Daily end-of-shift report 21 Jul '15

21 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-07-2015 18:00 − Dienstag 21-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl Co-Handler: Stephan Richter *** One Perfect Bug: Exploiting Type Confusion in Flash *** --------------------------------------------- Posted by Natalie Silvanovich, Dazed and (Type) ConfusedFor some attackers, it is important that an exploit be extremely reliable. That is to say, the exploit should consistently lead to code execution when it is run on a system with a known platform and Flash version. One way to create such an exploit is to use an especially high-quality bug. This post describes the exploitation of one such bug, and the factors that make it especially good for reliable exploitation.The BugCVE-2015-3077 is a... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/one-perfect-bug-exploiting-ty… *** Hackers Remotely Kill a Jeep on the Highway - With Me in It *** --------------------------------------------- I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold. --------------------------------------------- http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ *** Searching Through the VirusTotal Database, (Tue, Jul 21st) *** --------------------------------------------- Now that my overview of Sysinternals tools with VirusTotal support is complete (Process Explorer, Autoruns and Sigcheck), lets address a couple of remarks I received (BTW, if I missed a Sysinternals tools, let me know with a comment). 1) Upload of files. Some people are worried that the Sysinternals tools will upload (confidential) files to VirusTotal. That is a valid concern, but for each tool I described, I showed how to enable hash searching first. Configured like this, the Sysinternals... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19945&rss *** Finding XSS Vulnerabilities More Quickly with Dynamic Contextual Analysis *** --------------------------------------------- Cross-Site Scripting (XSS) has been around since the 1990s and countless scanners have been created to find this vulnerability class. Each scanner has its own set of payloads with some more extensive than others. However, almost all of these payloads... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Finding-XSS-Vulnerabili… *** Black Hat 2015: 32 SCADA, mobile zero-day vulns will drop *** --------------------------------------------- Pwn storm brews Gird your loins, admins; researchers are set to drop 32 zero-day vulnerabilities at the Black Hat hacking fest in Las Vegas in August. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/21/black_hat_2… *** x86 Exploitation 101: "House of Spirit" - Friendly stack overflow *** --------------------------------------------- The last technique from the "Malloc Maleficarum" is different from all the others because, among the requirements, there's a stack overflow. --------------------------------------------- https://gbmaster.wordpress.com/2015/07/21/x86-exploitation-101-house-of-spi… *** Cybercrime - Tipping the Balance *** --------------------------------------------- It's been said before (on this very blog) but it's worth saying again; if you work back far enough from any cybercrime, eventually you find a person. Someone, somewhere is writing the code and calling the shots. When this statement is presented to a non-technical audience, the question that typically follows is "so who are these people?", and hot on it's heels "why are they doing this?". Simple and reasonable queries, but as most of us know, the answers... --------------------------------------------- https://blog.team-cymru.org/2015/07/cybercrime-tipping-the-balance/ *** Key findings from the ENISA Workshop: Protection of Electronic Communications Infrastructure and Information Sharing *** --------------------------------------------- ENISA’s Workshop on the Protection of Electronic Communications Infrastructure and Information Sharing successfully concluded with the participation of more than forty-five (45) participants from twenty (20) Member States. Representatives included Ministries and National Regulatory Agencies, Electronic communication providers and infrastructure owners. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/key-findings-from-the-enisa-wor… *** Operation Shrouded Horizon: Darkode and its Ties to Bulletproof Hosting Services *** --------------------------------------------- One of the challenges in fighting cybercrime is that it is borderless; cybercriminals can conduct their malicious activities in countries that do not have strict implementation of cybercrime laws. However, no matter how difficult and perilous the task of arresting attackers and taking down cybercriminal operations is, it can be achieved through collaboration between security researchers... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/-S0neNV90as/ *** DFN-CERT-2015-1104: Microsoft Internet Explorer: Mehrere Schwachstellen ermöglichen das Ausführen beliebigen Programmcodes *** --------------------------------------------- ZDI-15-362-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CTreePos-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-361-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CCurrentStyle-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-360-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Behandlung von CAttrArray-Objekten, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu der Wiederverwendung eines Zeigers auf bereits freigegebenen Speicher führt ("Use-After-Free"). Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. ZDI-15-359-1: Schwachstelle im Internet Explorer ermöglicht das Ausführen beliebigen Programmcodes Eine Schwachstelle im Internet Explorer basiert auf der Verarbeitung von Arrays für die Repräsentation von HTML-Tabellen, die durch eine bestimmte Manipulation von Elementen eines Dokumentes zu einem Speicherüberlauf ("Out-Of-Bounds Memory Access") führt. Ein entfernter, nicht authentifizierter Angreifer kann diese Schwachstelle mit Hilfe einer speziell präparierten Website oder Datei ausnutzen, wenn er einen Benutzer zum Besuch der Webseite oder zum Öffnen der Datei verleiten kann, um beliebigen Programmcode zur Ausführung zu bringen. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1104/ *** MS15-078 - Critical: Vulnerability in Microsoft Font Driver Could Allow Remote Code Execution (3079904) - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-078 *** ZDI-15-358: BitTorrent/uTorrent URI Protocol Command Line Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent and uTorrent. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-358/ *** ZDI-15-363: (0Day) Hewlett-Packard Client Automation Agent Stack Based Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-363/ *** ZDI-15-364: (0Day) Hewlett-Packard Client Automation Agent Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard Client Automation. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-364/ *** ZDI-15-365: Apache Groovy Deserialization of Untrusted Data Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-365/ *** VU#912036: N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password *** --------------------------------------------- Vulnerability Note VU#912036 N-Able RSMWinService contains hard coded security constants allowing decryption of domain administrator password Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview SolarWinds N-Able N-Central is an agent-based enterprise support and management solution. N-Able N-Central contains several hard-coded encryption constants in the web interface that allow decryption of the password when combined. Description CWE-547: Use of Hard-coded,... --------------------------------------------- http://www.kb.cert.org/vuls/id/912036 *** Cisco WebEx Meetings Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39755 *** Cisco WebEx Training Center Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39753 *** Cisco WebEx Administration Site Stored Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39756 *** Cisco Videoscape Policy Resource Manager Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40050 *** [R1] OpenSSL secadv_20150709 Vulnerability Affects Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-08 *** SSA-267489 (Last Update 2015-07-21): Vulnerabilities in Android App Sm@rtClient *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-396873 (Last Update: 2015-07-21): TLS Vulnerability in Ruggedcom ROS- and ROX-based Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Active Super Shop 1.0 Cross Site Scripting *** --------------------------------------------- Topic: Active Super Shop 1.0 Cross Site Scripting Risk: Low Text:# Exploit Title:Active Super Shop Persistent XSS # Date: Fri July 17 2015 # Exploit Author: Angelo Ruwantha # Vendor Homepag... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070101 *** WordPress Mailcwp 1.99 Shell Upload *** --------------------------------------------- Topic: WordPress Mailcwp 1.99 Shell Upload Risk: High Text:Title: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin Author: Larry W. Cashdollar, @_larry0 Date: 2015-07... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070100

1 0

Tageszusammenfassung - Montag 20-07-2015
by Daily end-of-shift report 20 Jul '15

20 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-07-2015 18:00 − Montag 20-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Cyber-securitys dirty little secret: Its not as bad as you think *** --------------------------------------------- And as for botnets - on their way out A new research report from the Global Commission on Internet Governance has reached a surprising conclusion: cyberspace is actually getting safer. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/18/cybersecuri… *** Its the Data, Stupid! *** --------------------------------------------- At least with MySQL, PostgreSQL and much of the relational database software the defaults are fairly secure: listen on the local interface only and provide some form of authorization by default. This isnt the case with some of the newer NoSQL products that started entering mainstream fairly recently. For the purpose of this article I will talk about one of the more popular NoSQL products called MongoDB, though much of what is being said also applies to other software (Im looking at you Redis). --------------------------------------------- https://blog.shodan.io/its-the-data-stupid/ *** RedStar OS Watermarking *** --------------------------------------------- During the last few months information about one of North Koreas operating systems was leaked. It is a Linux based OS that tries to simulate the look and feel of a Mac. Some of it's features have already been discussed on various blog posts and news articles. We thought we would take a short look at the OS. This blog post contains some of the results. --------------------------------------------- http://www.insinuator.net/2015/07/redstar-os-watermarking/ *** Autoruns and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at autoruns. Autoruns is another fine Sysinternals tool that comes with VirusTotal integration. If you are not familiar with autoruns, it scans all auto-starting locations in Windows and provides a comprehensive report. This gives you an overview of all programs that start automatically on the scanned Windows machine. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19933 *** Sigcheck and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- Continuing my diary entries on Sysinternals tools with VirusTotal support, I'm taking a look at sigcheck. Sigcheck is a command-line utility to check the digital signature of files like PE files (EXEs). --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19935 *** Disabled Adobe Flash browser plugin? This might not be enough *** --------------------------------------------- I went to the Adobes Flash test page and opened it in IE (top left). As expected, the plugin couldnt run because (see the Manage Add-ons window in the bottom-left corner) it has been disabled. And yet when I opened the same test URL in HH - Flash was right there. And this is a problem. Yes, by disabling Flash in the main browsers we have significantly reduced the risk but we have not eliminated it. --------------------------------------------- http://blog.kulshitsky.com/2015/07/disabled-adobe-flash-browser-plugin.html *** Parlamentswebsite nur mehr mit aktuellen Browsern nutzbar *** --------------------------------------------- SSL-Verschlüsselungsprotokolle werden auf den neuesten Stand gebracht --------------------------------------------- http://derstandard.at/2000019420275 *** Ashley Madison hacked: Site for people who cant be trusted cant be trusted *** --------------------------------------------- Bin site or well spaff everything, say hax0rz Adulterers hookup website Ashley Madison has been hacked, with the miscreants threatening to release personal details, including users sexual fantasies, unless the site is shut down. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/20/ashley_madi… *** BSI warnt vor Sicherheitslücke in Blackberry-Link-App für Mac und PC *** --------------------------------------------- Das Bundesamt für Sicherheit in der Informationstechnik warnt vor einem Fehler in dem Synchronisationstool. Nutzer sollten aktualisieren. --------------------------------------------- http://heise.de/-2753660 *** Zero Days, the documentary *** --------------------------------------------- VPRO (the Dutch public broadcasting organisation) produced a 45-minute documentary about hacking and the trade of zero days. The documentary has now been released in English on Youtube. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002821.html *** BGP Security Alerts Coming to Twitter *** --------------------------------------------- At Black Hat, researchers from OpenDNS are expected to launch a new Twitter feed called BGP Stream that will send out alerts on possible BGP and DNS hijacking attacks. --------------------------------------------- http://threatpost.com/bgp-security-alerts-coming-to-twitter/113843 *** Maligno: An Open Source Pentesting Tool *** --------------------------------------------- Today I want show you a new tool that could help in your penetration testing activity. Maligno is an open source penetration-testing tool under the FreeBSD license, written in Python for maximum compatibility with Metasploit. It uses the Metasploit framework, in particular msfvenom, to generate the shellcode AES encrypted and encoded prior to transmission. Maligno... --------------------------------------------- http://resources.infosecinstitute.com/maligno-open-source-penetration-testi… *** Cyber savvy? Take a Quick Security Awareness Quiz to Find Out *** --------------------------------------------- So you think you are cyber-savvy knowledgeable in the cyber security risks you face every day in the digital world? Take this quick security quiz and find out. Just get record your answers as you take the quiz. There are 10 questions for this security awareness quiz. You can refer to the Answers Section to... --------------------------------------------- http://resources.infosecinstitute.com/cyber-savvy-take-a-quick-security-awa… *** Free Tool Looks for HackingTeam Malware *** --------------------------------------------- Researchers at Rook Security have released a new tool that looks for HackingTeam malware on target systems, and also have published a set of indicators of compromise to help organizations look for signs of an infection from the intrusion software. The HackingTeam Remote Control System is the company's flagship surveillance and intrusion platform. It sold... --------------------------------------------- http://threatpost.com/free-tool-looks-for-hackingteam-malware/113850 *** OpenSSH anfällig für Bruteforce-Angriffe *** --------------------------------------------- Die eingestellte Grenze der maximal möglichen Passwort-Angaben vor einem Verbindungsabbruch lässt sich in einigen Konfigurationen recht einfach austricksen. --------------------------------------------- http://heise.de/-2753501 *** OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) *** --------------------------------------------- Topic: OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass) Risk: Low Text:OpenSSH has a default value of six authentication tries before it will close the connection (the ssh client allows only three p... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070097 *** VU#813631: Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read *** --------------------------------------------- Vulnerability Note VU#813631 Total Commander File Info plugin vulnerable to denial of service via an out-of-bounds read Original Release date: 20 Jul 2015 | Last revised: 20 Jul 2015 Overview Total Commanders File Info plugin version 2.21 attempts an out-of-bounds read when reading a file carefully crafted by an attacker. Description CWE-125: Out-of-bounds Read - CVE-2015-2869An attacker that can control the contents of certain file types may be able to cause an out-of-bounds read error in --------------------------------------------- http://www.kb.cert.org/vuls/id/813631 *** DFN-CERT-2015-1093: JBoss Enterprise Portal Platform: Eine Schwachstelle ermöglicht das Umgehen von Sicherheitsmaßnahmen *** --------------------------------------------- Durch eine Schwachstelle in JBoss Portal Plattform ist es einem entfernten, einfach authentifizierten Angreifer möglich, Sicherheitsvorkehrungen zu umgehen. Red Hat stellt für die Komponente PortletBridge von Red Hat JBoss Portal 6.2.0 ein Sicherheitsupdate zur Verfügung. --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1093/ *** Security Advisory: PCRE library vulnerability CVE-2015-2326 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16984.htm… *** HPSBUX03379 SSRT101976 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS) *** --------------------------------------------- A potential security vulnerability has been identified with HP-UX running BIND. This vulnerability could be exploited remotely to create a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04745746 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Power Systems Firmware affected by Open Source - 2 issues for OpenSSL (CVE-2015-0286, CVE-2015-0287) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022521 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Analytic Server (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961993 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Virtualization Engine TS7700 (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005295 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Content Manager Enterprise Edition (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962455 *** IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Websphere Partner Gateway Enterprise/Advanced Editions (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21962162 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Publishing Engine (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961086 *** IBM Security Bulletin: DH key exchange protocol vulnerability ("Logjam") in IBM Java SDK affects IBM SPSS Statistics (CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21961214 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM SPSS Collaboration and Deployment Services (CVE-2015-0478, CVE-2015-0488, CVE-2015-2808, CVE-2015-4000) *** http://www.ibm.com/support/docview.wss?uid=swg21960528 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDKs affect IBM Virtualization Engine TS7700 - April 2015 *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005294 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0204) *** http://www.ibm.com/support/docview.wss?uid=swg21957734 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Publishing Engine (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21961080 *** IBM Security Bulletin: Security Vulnerability in IBM WebSphere Application Server affects IBM WebSphere Partner Gateway Advanced/Enterprise (CVE-2015-1920) *** http://www.ibm.com/support/docview.wss?uid=swg21957802 *** IBM Security Bulletin: Insufficient authorization in Service REST API and cross site scripting vulnerability in REST API affecting IBM Business Process Manager (CVE-2015-1905, CVE-2015-1906) *** http://www.ibm.com/support/docview.wss?uid=swg21700717 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM PureApplication System (CVE-2015-0410 and CVE-2014-6593) *** http://www.ibm.com/support/docview.wss?uid=swg21962372

1 0

Tageszusammenfassung - Freitag 17-07-2015
by Daily end-of-shift report 17 Jul '15

17 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-07-2015 18:00 − Freitag 17-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** MSRT July 2015: Crowti *** --------------------------------------------- In our ongoing effort to provide malware protection, we are adding the following detections to the Microsoft Malicious Software Removal Tool (MSRT) this month: Win32/Crowti Win32/Reveton Crowti, a file encryption threat, is one of the top prevalent ransomware families. We have recently seen it sent as a spam email attachment with formats similar to those shown below: Figure 1: Email spam samples delivering Crowti as an attachment As well as using spam emails as the entry point or infection... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/07/14/msrt-july-2015-crowti.as… *** Running SAP? Checked for patches lately? Nows a good time *** --------------------------------------------- New round of fixes includes one for security bypass flaw SAP has released its July pack of security fixes, including critical patches one researcher says demand your urgent attention. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/running_sap… *** Ad networks beware; Google raises Red Screen of malware Dearth *** --------------------------------------------- Chrome to take shine off dodgy ad networks. Watch out dodgy ad slingers and news sites; Google is expanding its last line of defence Chrome feature to brand all security-slacker ad networks as unsafe. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/17/google_safe… *** Fake News App in Hacking Team Dump Designed to Bypass Google Play *** --------------------------------------------- Looking into the app's routines, we believe the app can circumvent Google Play restrictions by using dynamic loading technology. Initially, it only asks for three permissions and can be deemed safe by Google's security standards as there are no exploit codes to be found in the app. However, dynamic loading technology allows the app to download and execute a partial of code from the Internet. It will not load the code while Google is verifying the app but will later push the code once... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/fake-news-app-in… *** Significant Flash exploit mitigations are live in v18.0.0.209 *** --------------------------------------------- Whilst Project Zero has gained a reputation for vulnerability and exploitation research, thats not all that we do. One of the main reasons we perform this research is to provide data to defenders; and one of the things that defenders can do with this data is to devise exploit mitigations. Sometimes, well take on exploit mitigations ourselves. Recently, weve been working with Adobe on Flash mitigations, and this post describes some significant mitigations have landed over the past couple of... --------------------------------------------- http://googleprojectzero.blogspot.co.at/2015/07/significant-flash-exploit-m… *** Save the Date: 2 November NCSRA-Symposium 2015 *** --------------------------------------------- For the second time the NCSC will be co-organizing the NCSRA Symposium, which will be held on 2 November during Alert Online (the Dutch national cyber security awareness campaign). This symposium offers possibilities for knowledge sharing and community building in cybersecurity research and innovation. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/save-the-date-2-november-nc… *** Process Explorer and VirusTotal, (Fri, Jul 17th) *** --------------------------------------------- About a year ago, Rob had a diary entry about checking a file from Process Explorer with VirusTotal. Did you know you can have all EXEs of running processes scanned with VirusTotal? In Process Explorer, add column VirusTotal: Enable VirusTotal checks: And accept the VirusTotal terms: And now you can see the VirusTotal scores: Process Explorer is not the only Sysinternals tool that comes with VirusTotal support. Ill showcase more tools in upcoming diary entries. Sysinternals:... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19931&rss *** SANS: Kostenloser Webcast: 5 Jahre nach Stuxnet: Was hat sich geändert, was nicht und was liegt vor uns *** --------------------------------------------- Wednesday, July 29, 2015 at 17:00 CEST Thomas Brandstetter | In der industriellen Welt war die Entdeckung der Stuxnet-Malware das markanteste Ereignis der letzten Jahre. Viele Präsentationen über Industrial Security haben seither mit dem Satz Seit Stuxnet ist alles anders begonnen. Anlässlich des 5-Jahres-Jubiläums der Entdeckung von Stuxnet lohnt es zu fragen: Stimmt das? Welche Auswirkungen hatte Stuxnet tatsächlich auf die industrielle Welt? Thomas Brandstetter war im... --------------------------------------------- https://www.sans.org/webcasts/5-years-stuxnet-changed-didnt-lies-100617 *** Flash-Updates für Linux und noch einmal für die Extended-Support-Version *** --------------------------------------------- Auch Linux-Nutzer, die nicht mit Chrome unterwegs sind, kommen nun in den Genuss des neuesten Flash-Updates. Außerdem müssen Extended-Support-Nutzer noch mal patchen. --------------------------------------------- http://heise.de/-2752440 *** Kommentar: Weg mit Flash! *** --------------------------------------------- Bei Adobes Plug-in stimmt die Balance aus Nutzen und Risiko nicht mehr. Es wird Zeit, dieses Relikt abzuschalten, meint Herbert Braun --------------------------------------------- http://heise.de/-2751583 *** TotoLink Routers Plagued By XSS, CSRF, RCE Bugs *** --------------------------------------------- A slew of routers manufactured in China are fraught with vulnerabilities, some which have existed in products for as long as six years. --------------------------------------------- http://threatpost.com/totolink-routers-plagued-by-xss-csrf-rce-bugs/113816 *** Bugtraq: Novell GroupWise 2014 WebAccess vulnerable to XSS attacks *** --------------------------------------------- http://www.securityfocus.com/archive/1/536023 *** Elasticsearch 1.6.0 Remote Code Execution *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Remote Code Execution Risk: High Text:Summary: Elasticsearch versions prior to 1.6.1 are vulnerable to an engineered attack on its transport protocol that enables r... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070089 *** Elasticsearch 1.6.0 Directory Traversal *** --------------------------------------------- Topic: Elasticsearch 1.6.0 Directory Traversal Risk: Medium Text:Summary: Elasticsearch versions from 1.0.0 to 1.6.0 are vulnerable to a directory traversal attack that allows an attacker to ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070090 *** WP Backitup <= 1.9.1 - Backup File Disclosure *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8105 *** Cisco Prime Collaboration Assurance Web Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=40003 *** EMC Documentum WebTop Lets Remote Users Redirect the Target User to an Arbitrary Site *** --------------------------------------------- http://www.securitytracker.com/id/1032965 *** EMC Documentum CenterStage Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032966 *** Eaton's Cooper Power Series Form 6 Control and Idea/IdeaPlus Relays with Ethernet Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on January 6, 2015, and is now being released to the ICS-CERT web site. This advisory provides mitigation details for a predictable TCP sequence vulnerability in Eaton's Cooper Power Systems Form 6 and Idea/IdeaPLUS relays with Ethernet application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-006-01 *** SSA-732541 (Last Update 2015-07-17): Denial-of-Service Vulnerability in SIPROTEC 4 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** IBM Security Bulletins *** --------------------------------------------- IBM Vulnerability in Apache Tomcat may affect IBM WebSphere Application Server Community Edition (CVE-2014-0230) IBM Security Bulletin: Open Source Apache Tomcat vulnerability and vulnerability in Diffie-Hellman ciphers affects IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2014-0230, CVE-2014-7810, CVE-2015-4000) IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Sterling Secure Proxy and Sterling External Authentication Server (CVE-2015-0488, CVE-2015-1916, CVE-2015-2808, CVE-2015-0478, CVE-2015-0204) IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Rational Application Developer for WebSphere Software (CVE-2015-4000, CVE-2015-1793) IBM Security Bulletin: Vulnerability in OpenSSL affects IBM SDK for Node.js (CVE-2015-1793) IBM Security Bulletin: Vulnerability in the Dojo Toolkit affects IBM Business Process Manager, which is shipped with IBM SmartCloud Orchestrator and IBM SmartCloud Orchestrator Enterprise (CVE-2014-8917) IBM Security Bulletin: Tivoli Workload Scheduler Distributed Potential Security vulnerabilities with IBM WebSphere Application Server (CVE-2015-1920) --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Donnerstag 16-07-2015
by Daily end-of-shift report 16 Jul '15

16 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-07-2015 18:00 − Donnerstag 16-07-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RC4 crypto: Get RID of it already, say boffins *** --------------------------------------------- This one simple attack busts WPA-TKIP in less than an hour ... As they explain here, the weakness of RC4 (inherited by systems using it) is based on biases in the RC4 keystream. The bias was already known, and is why vendors like Microsoft are working to deprecate it. Whats different in the new work is the acceleration of the cryptanalysis Vanhoef and Piessens carry out. --------------------------------------------- http://www.theregister.co.uk/2015/07/16/rc4_get_rid_of_it_already_say_boffi… *** RC4 in HTTPS & Verbreitung *** --------------------------------------------- RC4 gehört nicht zu den stärksten Verschlüsselungsmethoden, und sollte eigentlich nach RFC7465 (aktuell noch ein Draft) gar nicht mehr verwendet werden. Neue Angriffe ermöglichen im Nachhinein das entschlüsseln von sensitiven Informationen wie zum Beispiel Session cookies innerhalb von wenigen Tagen. In den letzten Wochen haben wir ca. 2 Millionen TLS Konfigurationen weltweit mittels dem Tool... --------------------------------------------- https://www.sba-research.org/2015/07/16/rc4-in-https-verbreitung/ *** Poodle-Nachspiel: Mace und weitere Lücken in TLS-Servern *** --------------------------------------------- Cisco, F5, Juniper, Fortinet: Ein Sicherheitsforscher hat eine Reihe von TLS-Servern entdeckt, die den sogenannten Message Authentication Code (MAC) von Verbindungen nicht prüfen. Andere Serverimplementierungen prüfen eine Checksumme am Ende des Handshakes nicht. --------------------------------------------- http://www.golem.de/news/poodle-nachspiel-mace-und-weitere-luecken-in-tls-s… *** Adobe's CVE-2015-5090 - Updating the Updater to become the bossman *** --------------------------------------------- Amongst the many bugs Adobe patched in July 2015, CVE-2015-5090 stands out as being worth a closer look. Adobe lists this vulnerability as a privilege escalation from low to medium integrity, but this doesn’t tell the whole story. In actuality, this bug can used to execute code with SYSTEM privileges, which could allow an attacker to completely take over a target. Since this affects the Adobe updater service, the bug exists in both Adobe Reader and Acrobat Pro. Both of these programs install the ARMSvc service (Updater) and both keep AdobeARM.exe/AdobeARMHelper.exe in c:\progra~1\common~1\Adobe\ARM\1.0. --------------------------------------------- http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Adobe-s-CVE-2015-509… *** Mozilla Winter of Security is back! *** --------------------------------------------- The first edition of MWoS was a success, and a lot of fun for students and mentors, so we decided to run it again this year. For the 2015 edition, we are proposing six projects that directly contribute to our most impactful security tools. Students will be able to work on digital forensics with MIG, SSL/TLS configurations with Menagerie, certificate management with LetsEncrypt, security visualization with MozDef, and web security scanning with OWASP ZAP. --------------------------------------------- https://blog.mozilla.org/security/2015/07/15/mozilla-winter-of-security-is-… *** Understanding PCI compliance fines: Who is in charge of enforcing PCI? *** --------------------------------------------- If your business stores, processes, or transmits data from payment cards, then you are subject to the requirements of the PCI DSS. This set of security controls is designed to help merchants combat da... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/--jT_s5xAyE/article.php *** Researchers prove HTML5 can be used to hide malware *** --------------------------------------------- A group of Italian researchers have come up with new obfuscation techniques that can be used to dupe malware detection systems and allow malicious actors to execute successful drive-by download attack... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/9k3wj_RIqQ8/malware_news.… *** Authentication Bypass Bug Hits Siemens Energy Automation Device *** --------------------------------------------- An authentication bypass vulnerability in a Siemens device that's used in energy automation systems could allow an attacker to gain control of the device. The vulnerability is in the Siemens SICAM MIC, a small telecontrol system that performs a number of functions and includes an integrated Web server and several other features. The devices consist of... --------------------------------------------- http://threatpost.com/authentication-bypass-bug-hits-siemens-energy-automat… *** Are smart infrastructures experts in cyber security? *** --------------------------------------------- [...] Prof. Helmbrecht said: “Currently there is no clear definition of cyber security for smart infrastructures at an EU level. It will be beneficial to increase information sharing and coordination for example on public transport. As new technologies and applications are developed, their security aspects also need to be developed from the design phase, allowing for improved services, user experience and safety in a connected online world”. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/are-smart-infrastructures-exper… *** Bugtraq: ESA-2015-122: EMC Documentum CenterStage Cross-site Scripting Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536014 *** Bugtraq: ESA-2015-123: EMC Documentum WebTop Open Redirect Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/536015 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco WebEx Meetings Server Remote Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39938 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39920 *** Cisco Email Security Appliance Malformed DMARC Policy Records File Modification Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39940 *** Oracle Critical Patch Update Advisory - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Oracle Critical Patch Update - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html *** Solaris Third Party Bulletin - July 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.h…

1 0

Tageszusammenfassung - Mittwoch 15-07-2015
by Daily end-of-shift report 15 Jul '15

15 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-07-2015 18:00 − Mittwoch 15-07-2015 18:00 Handler: Robert Waldner Co-Handler: Otmar Lendl *** July 2015 Security Updates *** --------------------------------------------- Today we released security updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, and Internet Explorer. As a best practice, we encourage customers to apply security updates as soon as they are released. For more information about this month's security updates and advisories visit the Security TechNet Library. You can also follow the Microsoft Security Response Center (MSRC) team on Twitter at @MSFTSecResponse MSRC Team --------------------------------------------- http://blogs.technet.com/b/msrc/archive/2015/07/14/july-2015-security-updat… https://technet.microsoft.com/en-us/library/security/MS15-JUL *** TA15-195A: Adobe Flash and Microsoft Windows Vulnerabilities *** --------------------------------------------- Original release date: July 14, 2015 Systems Affected Microsoft Windows systems with Adobe Flash Player installed. Overview Used in conjunction, recently disclosed vulnerabilities in Adobe Flash and Microsoft Windows may allow a remote attacker to execute arbitrary code with system privileges. Since attackers continue to target and find new vulnerabilities in popular, Internet-facing software, updating is not sufficient, and it is important to use exploit mitigation and other defensive --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-195A *** Microsoft Patch Tuesday July 2015 *** --------------------------------------------- Julys Patch Tuesday is here and brings with it a rather large 14 bulletins with 4 Critical and 10 Important rated patches. All combined this months release patches 59 vulnerabilities 29 of which are in the old stalwart Internet Explorer.... --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Microsoft-Patch-Tuesday-July… *** Adobe, MS, Oracle Push Critical Security Fixes *** --------------------------------------------- This being the second Tuesday of the month, its officially Patch Tuesday. But its not just Windows users who need to update today: Adobe has released fixes for several products, including a Flash Player bundle that patches two vulnerabilities for which exploit code is available online. Separately, Oracle issued a critical patch update that plugs more than two dozen security holes in Java. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/GZ70l-ulAqw/ *** Oracle Critical Patch Update dichtet 193 Lücken ab *** --------------------------------------------- Wie üblich bei Oracles quartalsweisen Updates stopft die Firma massenweise Lücken in fast allen ihrer Produkte. Sogar die Ghost-Lücke vom Januar feiert ein Comeback. Besonders die Updates für Java und MySQL sollten baldigst installiert werden. --------------------------------------------- http://heise.de/-2750641 *** Microsoft Ends Support for Windows Server 2003, Migration a Must *** --------------------------------------------- End-of-life fun times are coming to infosec departments everywhere again. Just a year after the announcement of Windows XP's end-of-life, we see another body in the OS graveyard: Windows Server 2003. After July 14th, servers running this venerable OS will no longer be receiving any more security updates. This would leave you out in the cold --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/sr3phsOSoFM/ *** Microsoft Security Essentials is no longer available for Windows XP *** --------------------------------------------- We strongly recommend that you complete your migration to a supported operating system as soon as possible so that you can receive regular security updates to help protect your computer from malicious attacks. --------------------------------------------- http://windows.microsoft.com/en-us/windows/security-essentials-download?os=… *** Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39907 *** Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39872 *** Unit 42 Technical Analysis: Seaduke *** --------------------------------------------- Earlier this week Symantec released a blog post detailing a new Trojan used by the "Duke" family of malware. Within this blog post, a payload containing a function named "forkmeiamfamous" was mentioned. While performing some ... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/y_CGsjS6Bio/ *** An In-Depth Look at How Pawn Storm's Java Zero-Day Was Used *** --------------------------------------------- Operation Pawn Storm is a campaign known to target military, embassy, and defense contractor personnel from the United States and its allies. The attackers behind Operation Pawn Storm have been active since at least 2007 and they continue to launch new campaigns. Over the past year or so, we have seen numerous techniques and tactics --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/gJtU9nel0NM/ *** Hideouts for Lease: The Silent Role of Bulletproof Hosting Services in Cybercriminal Operations *** --------------------------------------------- What do LeaseWeb, Galkahost, and Spamz have in common? All of them, at one point or another, have functioned as cybercriminal hideouts in the form of bulletproof hosting services (BPHS). Simply put, BPHS is any hosting facility that can store any type of malicious content like phishing sites, pornography, and command-and-control (C&C) infrastructure. --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ojxl_6lsUjU/ *** DFN-CERT-2015-1068/ BlackBerry Link: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1068/ *** Rootkits: User Mode *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Rootkits: Kernel Mode *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** Rootkits: User Mode & Kernel Mode-Part 2 *** --------------------------------------------- We have learned in part one of this series about the Rootkits and how they operate in User Mode, in this part of the series we will up the ante and look at the other part where rootkits operate, i.e. Kernel Mode. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-2/ *** FBI paid Hacking Team to identify Tor users *** --------------------------------------------- Documents leaked online after the Hacking Team data breach revealed that the company supported the FBI in the investigation on Tor users. While the security experts are continuing to analyze the impressive amount of data stolen from the Hacking Team, new revelation are circulating over the Internet. Among the clients of the Italian security firm, there ... --------------------------------------------- http://securityaffairs.co/wordpress/38601/cyber-crime/fbi-hacking-team-tor.… *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- We have our hands on the code repositories of HackingTeam, and inside of them we've found the source code for a cross-platform, highly-featured, government-grade RAT (Remote Access Trojan). It's rare that we get to do analysis of complex malware at the source-code level, so I couldn't wait to write a blog about it! --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Epic Games, Epic Fail: Forumers info blown into dust by hack *** --------------------------------------------- Company sorry for the inconvenience caused. Great Epic Games, known for its Unreal Engine and the Games of War series, sent a grovelling letter to its forum users this morning explaining that a hack "may have resulted in unauthorised access to your username, email address, password, and the date of birth you provided at registration." --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/15/epic_games_… *** Details on Internet-wide Scans from SBA *** --------------------------------------------- To clarify what we are scanning on the Internet, here are some details on the project and which tools we use. Most importantly: if you want your IP to be excluded from future scans, please send an email to abuse(a)sba-research.org. For quite some time now we scan Internet-wide for well-known ports that use TLS, most ... --------------------------------------------- https://www.sba-research.org/2015/07/15/details-on-internet-wide-scans-from…

1 0

Tageszusammenfassung - Dienstag 14-07-2015
by Daily end-of-shift report 14 Jul '15

14 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-07-2015 18:00 − Dienstag 14-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Been hacked? Now to decide if you chase the WHO or the HOW *** --------------------------------------------- Imagine a security researcher has plucked your customer invoice database from a command and control server. Youre nervous and angry. Your boss will soon be something worse and will probably want you to explain who pulled off the heist, and how. But only one of these questions, the how, is worth your precious resources; security experts say the who is an emotional distraction. --------------------------------------------- http://www.theregister.co.uk/2015/07/14/attribution_feature/ *** Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems *** --------------------------------------------- Hacking Team uses a UEFI BIOS rootkit to keep their Remote Control System (RCS) agent installed in their targets' systems. This means that even if the user formats the hard disk, reinstalls the OS, and even buys a new hard disk, the agents are implanted after Microsoft Windows is up and running. They have written a procedure specifically for Insyde BIOS (a very popular BIOS vendor for laptops). However, the code can very likely work on AMI BIOS as well. A Hacking Team slideshow... --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-use… *** Lowering Defenses to Increase Security *** --------------------------------------------- Starting at WhiteHat was a career change for me. I wasn't sure exactly what to expect, but I knew there was a lot of unfamiliar terminology: "MD5 signature", "base64", "cross-site request forgery", "'Referer' header", to name a few. When I started testing real websites, I was surprised that a lot of what I was doing... --------------------------------------------- https://blog.whitehatsec.com/lowering-defenses-to-increase-security/ *** Adobe Updates Flash Player, Shockwave and PDF Reader, (Tue, Jul 14th) *** --------------------------------------------- In a warm up to patch Tuesday, it looks like we have a new version for Adobe Flash Player, Shockwave Player and PDF Reader. Given that some of the exploits against the vulnerabilities patchedare public, you may want to expedite patching and review your Flash Player and browser configuration. the latest (patched) versions are (thanks Dave!): - FlashPlayer 18.0.0.209 - Flash Player EST 13.0.0.305 - Reader 10.1.15 - Reader 11.0.12 - Shockwave Player">12.1.9.159 Bulletins: --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19917&rss *** Adobe: Look, honestly, we really do take Flash security seriously *** *** Mozilla: Right, THATS IT. You, Flash, behind the shed with me. *snick snack* *** *** FLASH MUST DIE, says Facebook security chief *** --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/adobe_respo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/firefox_blo… http://go.theregister.com/feed/www.theregister.co.uk/2015/07/14/facebook_fl… *** Security Bulletins Posted *** --------------------------------------------- Security Bulletins for Adobe Acrobat and Reader (APSB15-15), Adobe Shockwave Player (APSB15-17) and Adobe Flash Player (APSB15-18) have been published. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using the instructions referenced... --------------------------------------------- https://blogs.adobe.com/psirt/?p=1247 *** SSA-632547 (Last Update 2015-07-14): Authentication Bypass Vulnerability in SICAM MIC *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** VU#919604: Kaseya Virtual System Administrator contains multiple vulnerabilities *** --------------------------------------------- Vulnerability Note VU#919604 Kaseya Virtual System Administrator contains multiple vulnerabilities Original Release date: 13 Jul 2015 | Last revised: 13 Jul 2015 Overview Kaseya Virtual System Administrator (VSA), versions R9 and possibly earlier, contains arbitrary file download and open redirect vulnerabilities. Description CWE-22: Improper Limitation of Pathname to a Restricted Directory (Path Traversal) - CVE-2015-2862Kaseya VSA is an IT management platform with a help desk ticketing --------------------------------------------- http://www.kb.cert.org/vuls/id/919604 *** Cisco Vulnerability Alerts *** --------------------------------------------- *** Cisco Identity Services Engine Cross-Frame Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39871 *** Cisco TelePresence Integrator C Series Multiple Request Parameter Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39880 *** Cisco Identity Services Engine Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39873 *** Cisco Unified Communications Manager Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39877 *** Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerabilities *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39879 *** Cisco Unified Communications Manager ccmivr Page Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39905 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Moodle Bugs Permit Cross-Site Scripting and Open Redirect Attacks and Let Remote Authenticated Users Modify Data *** --------------------------------------------- http://www.securitytracker.com/id/1032877 *** F5 Security Advisory: Multiple PHP CDF vulnerabilities CVE-2014-0237 and CVE-2014-0238 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16954.htm… *** DFN-CERT-2015-1009: Django: Mehrere Schwachstellen ermöglichen u.a. Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1009/

1 0

Tageszusammenfassung - Montag 13-07-2015
by Daily end-of-shift report 13 Jul '15

13 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-07-2015 18:00 − Montag 13-07-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Government Grade Malware: a Look at HackingTeam's RAT *** --------------------------------------------- Security researchers the world over have been digging through the massive HackingTeam dump for the past five days, and what we've found has been surprising. I've heard this situation called many things, and there's one description that I can definitely agree with: it's like Christmas for hackers. "On the fifth day of Christmas Bromium sent to... --------------------------------------------- http://labs.bromium.com/2015/07/10/government-grade-malware-a-look-at-hacki… *** Pawn Storm Update: Trend Micro Discovers New Java Zero-Day Exploit *** --------------------------------------------- Analysis and data by Brooks Li (Threats Analyst) and Feike Hacquebord (Senior Threat Researcher) Zero-day exploits continued to be used in targeted attacks because they are effective, given that software vendors have yet to create patches for them. Throughout our on-going investigation and monitoring of a targeted attack campaign, Operation Pawn Storm, we found suspicious URLs that... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/5OzXdZhhVhc/ *** New Zero-Day Vulnerability (CVE-2015-5123) in Adobe Flash Emerges from Hacking Team Leak *** --------------------------------------------- After two Adobe Flash player zero-days disclosed in a row from the leaked data of Hacking Team, we discovered another Adobe Flash Player zero-day (assigned with CVE number, CVE-2015-5123) that surfaced from the said leak. Adobe has already released a security advisory after we reported the said zero-day. This vulnerability is rated as critical and... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/rV5yri4x48E/ *** Mit Windows 10 kommen Updates automatisch *** --------------------------------------------- Windows 10-Kunden können sich künftig nur noch sehr begrenzt aussuchen, wann sie ein Update erhalten. --------------------------------------------- http://futurezone.at/produkte/mit-windows-10-kommen-updates-automatisch/141… *** Jump List Files Are OLE Files, (Sun, Jul 12th) *** --------------------------------------------- Jump List files are another type of files that are actually OLE files. They can contain useful data for forensic investigations. There are a couple of tools that can extract information from these files. Here you can see oledump analyzing an automatic Jump List file: The stream DestList contains the Jump List data: There are several sites on the Internet explaining the format of this data, like this one. I used this information to code a plugin for Jump List files: The plugin takes an option... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19911&rss *** Identifying the five principal methods of network attacks *** --------------------------------------------- Companies are underestimating the risk of failing to provide security training to non-technical staff. A new Intel Security study, which surveyed IT decision makers in European-based companies, fo... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/gSbxVIXvO94/secworld.php *** Mobile SSL failures: More common than they should be *** --------------------------------------------- Securing your mobile application traffic is apparently more difficult than it should be, as researchers Anthony Trummer and Tushar Dalvi discovered when looking into SSL/TLS usage on the Android opera... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/dY8mHp2RDC4/article.php *** Identifying and exploiting IBM WebSphere Application Server *** --------------------------------------------- IBM WebSphere is application server similar to Tomcat, JBoss and WebLogic. Therefore, it should be interesting to any penetration tester doing enterprise scale work where Websphere might be present. It should be also interesting to anyone who is working on securing enterprise environment since Websphere allows deploying own (malicious or not) code to the server. I have written NSE scripts to identify IBM Websphere consoles of application servers and to brute force any usernames and passwords. I... --------------------------------------------- https://k0st.wordpress.com/2015/07/13/identifying-and-exploiting-ibm-websph… *** Start Secure 2015 - Sicherheits-Start-ups gesucht *** --------------------------------------------- Der Wettbewerb "Start Secure 2015" wird gemeinsam vom Innenministerium und der futurezone veranstaltet. Als Organisationspartner fungieren SBA Research, das die Sieger-Start-ups auf Wunsch auch als Inkubator bei der Investorensuche berät, sowie das Kuratorium Sicheres Österreich. --------------------------------------------- http://futurezone.at/thema/start-ups/sicherheits-start-ups-gesucht/139.420.… *** Common Assessment Tool Cheatsheets *** --------------------------------------------- I have an unhealthy obsession for time savers when im doing pentest work. Since a lot of my time is spent on the command line I love cheatsheets. I thought id use this thread to post some of the more awesome cheat sheets I find... --------------------------------------------- https://forum.bugcrowd.com/t/common-assessment-tool-cheatsheets/502 *** Tunneling Data and Commands Over DNS to Bypass Firewalls *** --------------------------------------------- No matter how tightly you restrict outbound access from your network, you probably allow DNS queries to at least one server. Adversaries can abuse this "hole" in your firewall to exfiltrate data and establish stealthy Command and Control (C2) channels that are very difficult to block. ... I am struggling to come up with a solution to plug this firewall "hole", but I have a few risk mitigation recommendations:... --------------------------------------------- https://zeltser.com/c2-dns-tunneling/ *** Google Photo App Uploads Your Images To Cloud, Even After Uninstalling *** --------------------------------------------- Have you ever seen any mobile application working in the background silently even after you have uninstalled it completely? I have seen Google Photos app doing the same. Your Android smartphone continues to upload your phone photos to Google servers without your knowledge, even if you have already uninstalled the Google Photos app from your device. Nashville Business... --------------------------------------------- http://feedproxy.google.com/~r/TheHackersNews/~3/yxF2id-ZsHg/google-photo-a… *** "Forkmeiamfamous": Seaduke, latest weapon in the Duke armory *** --------------------------------------------- Low-profile information-stealing Trojan is used only against high-value targets --------------------------------------------- http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon… *** BGP Hijacking - why you need to care! *** --------------------------------------------- This came across our desk this morning when we were putting together Dragon News Bytes. There is lots of talk about what has been discovered in the recent reporting on the data dump from the Hacking Team incident. A lot of the reporting discusses the ethics of the company's services and whom they have been selling them to. Concentrating for a moment on the technology deployed in this activity, it is suggested that BGP hijacking was involved. This is described the article entitled... --------------------------------------------- https://blog.team-cymru.org/2015/07/bgp-hijacking-why-do-you-need-to-care/ *** Allerletzter Aufruf: Support fÜr Windows 2003 Server endet *** --------------------------------------------- Am 14. Juli ist endgÜltig Schluss. FÜr Windows 2003 Server liefert Microsoft keine Updates mehr aus, auch nicht bei Sicherheitsproblemen. Wobei auch hier zu gelten scheint: Ausnahmen bestÄtigen die Regel. --------------------------------------------- http://www.heise.de/newsticker/meldung/Allerletzter-Aufruf-Support-fuer-Win… *** Hacking Team 0-day Flash Wave with Exploit Kits *** --------------------------------------------- https://www.f-secure.com/weblog/archives/00002819.html *** New PHP Releases Fix BACRONYM MySQL Flaw *** --------------------------------------------- Several new versions of PHP have been released, all of which contain a number of bug fixes, most notably a patch for the so-called BACKRONYM vulnerability in MySQL. That bug in MySQL is caused by a problem with the way that the database software handles requests for secure connections. Researchers at Duo Security disclosed the... --------------------------------------------- http://threatpost.com/new-php-releases-fix-bacronym-mysql-flaw/113740 *** The Adobe Flash Conundrum: Old Habits Die Hard *** --------------------------------------------- Is it time to hop off the endless cycle of Flash vulnerabilities and updates? Last week has not been great for Adobe Flash. The 440GB of leaked Hacking Team emails has become a treasure trove for vulnerability hunters. Over the past 7 days, Flash was hit by three separate vulnerabilities: CVE-2015-5119 CVE-2015-5122 CVE-2015-5123 At this time, only the... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/AmkybOPif7Y/ *** Bugtraq: ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535981 *** Cisco Mobility Services Engine Control And Provisioning Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39825 *** Juniper Security Advisories *** --------------------------------------------- *** Juniper Junos IPv6 SEND Processing Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032849 *** Juniper Junos SRX Network Security Daemon Bug Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032848 *** Juniper Junos EX4600 and QFX Series Unspecified Flaw Lets Remote Users Deny Service *** http://www.securitytracker.com/id/1032847 *** Juniper Junos J-Web Bugs Let Remote Users Conduct Cross-Site Scripting and Denial of Service Attacks *** http://www.securitytracker.com/id/1032846 *** Bugtraq: [security bulletin] HPSBGN03373 rev.1 - HP Release Control running TLS, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535983 *** Cisco WebEx Meeting Center Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39782 *** F5 Security Advisories *** --------------------------------------------- *** Security Advisory: Boost memory allocator vulnerability CVE-2012-2677 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16946.htm… *** Security Advisory: Multiple SQLite vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16950.htm… *** Security Advisory: Mailx vulnerabilities CVE-2004-2771 and CVE-2014-7844 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16945.htm… *** Security Advisory: Expat vulnerabilities CVE-2012-0876 and CVE-2012-1148 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/900/sol16949.htm… *** Splunk Enterprise and Splunk Light Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032859 *** Squid CONNECT Method Peer Response Processing Flaw Lets Remote Users Bypass Security Controls *** --------------------------------------------- http://www.securitytracker.com/id/1032873 *** PHP 5.x Security Updates, (Sun, Jul 12th) *** --------------------------------------------- PHP 5.6.11, 5.5.27 and 5.4.43 were updated fixing numerous bugs in the various components of PHP including CVE-2015-3152. PHP recommend testing and upgrading to the current release. The binaries and packages are available here and the release notes here. [1] http://www.php.net/ChangeLog-5.php [2] http://windows.php.net/download/ ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19907&rss *** Joomla J2Store 3.1.6 SQL Injection *** --------------------------------------------- Topic: Joomla J2Store 3.1.6 SQL Injection Risk: Medium Text:J2Store v3.1.6, a Joomla! extension that adds basic store functionality to a Joomla! instance, suffered from two unauthenticate... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070053 *** DFN-CERT-2015-0907 FreeRADIUS: Eine Schwachstelle ermÖglicht das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0907/ *** DFN-CERT-2015-1030 strongSwan: Zwei Schwachstellen ermöglichen das Ausspähen von Informationen und Denial-of-Service-Angriffe *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-1030/

1 0

Tageszusammenfassung - Freitag 10-07-2015
by Daily end-of-shift report 10 Jul '15

10 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-07-2015 18:00 − Freitag 10-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco TelePresence products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39798 http://tools.cisco.com/security/center/viewAlert.x?alertId=39802 http://tools.cisco.com/security/center/viewAlert.x?alertId=39801 http://tools.cisco.com/security/center/viewAlert.x?alertId=39795 http://tools.cisco.com/security/center/viewAlert.x?alertId=39796 http://tools.cisco.com/security/center/viewAlert.x?alertId=39800 http://tools.cisco.com/security/center/viewAlert.x?alertId=39797 *** VMSA-2015-0005 *** --------------------------------------------- VMware Workstation, Player and Horizon View Client for Windows do not set a discretionary access control list (DACL) for one of their processes. This may allow a local attacker to elevate their privileges and execute code in the security context of the affected process. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0005.html *** The Massive OPM Hack Actually Hit 21 Million People *** --------------------------------------------- The massive hack that struck the US Office of Personnel Management affected some 21.5 million people, all of them people who had information stolen about them from a backgrounds investigation database used for evaluating people who sought classified clearances from the government. --------------------------------------------- http://www.wired.com/2015/07/massive-opm-hack-actually-affected-25-million/ *** Yubikeys Zwei-Faktor-Authentifizierung unter Linux nutzen *** --------------------------------------------- Mit Hilfe des Yubikeys lässt sich eine verschlüsselte Systempartition unter Linux zusätzlich per Zwei-Faktor-Authentifizierung absichern. In dieser Kombination kann auch ein bequemeres Kennwort genutzt werden. --------------------------------------------- http://www.golem.de/news/systemverschluesselung-yubikeys-zwei-faktor-authen… *** Magento-Patch: Update soll Kundendaten-Leck stopfen *** --------------------------------------------- Im Shop-System Magento klaffen Lücken, die es Angreifern erlauben, Admin-Konten zu kapern und Kundendaten auszulesen. Der Hersteller hat jetzt einen Patch veröffentlicht, der Abhilfe schaffen soll. --------------------------------------------- http://heise.de/-2747984 *** Hacking Team Shows the World How Not to Stockpile Exploits *** --------------------------------------------- Bank robber Willie Sutton’s famous line about why he robs banks—“because that’s where the money is”—was particularly apt this week after the Italian firm Hacking Team was hacked and at least two zero-day exploits the firm possessed were spilled to the public, along with about 400 gigabytes of company emails and other data. --------------------------------------------- http://www.wired.com/2015/07/hacking-team-shows-world-not-stockpile-exploit… *** Rootkits: User Mode & Kernel Mode - Part 1 *** --------------------------------------------- In this article, we will learn about what rootkits are and how they operate. The focus will be on two types of Rootkits exploits: User Mode & Kernel Mode, what are the various ways in which rootkits exploit in both modes. In this Part we will learn .. --------------------------------------------- http://resources.infosecinstitute.com/rootkits-user-mode-kernel-mode-part-1/ *** Programmier-Tipps für die BIOS-Backdoor *** --------------------------------------------- Der Hacker Cr4sh erklärt, wie er eine Hintertür in die UEFI-Firmware eines Intel-Mainboards einbaut. Dabei zeigen sich einmal mehr kritische Lücken in der x86-Plattform, vor allem beim System Management Mode. --------------------------------------------- http://heise.de/-2748219

1 0

Tageszusammenfassung - Donnerstag 9-07-2015
by Daily end-of-shift report 09 Jul '15

09 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-07-2015 18:00 − Donnerstag 09-07-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Hacking Team Flash Zero-Day Tied To Attacks In Korea and Japan... on July 1 *** --------------------------------------------- Earlier this week several vulnerabilities were disclosed as part of the leak of information from the Italian company Hacking Team. We've noted that this exploit is now in use by various exploit kits. However, feedback provided by the Smart Protection Network also indicates that this exploit was also used in limited attacks in Korea and Japan.... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Ys8noghmsHc/ *** Ding! Your RAT has been delivered *** --------------------------------------------- Talos is constantly observing malicious spam campaigns delivering various different types of payloads. Common payloads include things like Dridex, Upatre, and various versions of Ransomware. One less common payload that Talos analyzes periodically are Remote Access Trojans or RATs. A recently observed spam campaign was using freeware remote access trojan DarkKomet (a.k.a DarkComet). This isn't a novel approach since threat actors have been leveraging tools like DarkKomet or Hawkeye... --------------------------------------------- http://blogs.cisco.com/security/talos/darkkomet-rat-spam *** Finnland: 17-jähriger Botnetz-Betreiber verurteilt *** --------------------------------------------- Über 50.000 Rechner für ein Botnetz gekapert, DDoS-Attacken geritten und Kreditkartendaten geklaut: Ein 17-jähriger Finne, angeblich Mitglied der Hackergruppe Lizard Squad, wird zu zwei Jahren auf Bewährung verurteilt. --------------------------------------------- http://heise.de/-2745646 *** Detecting Random - Finding Algorithmically chosen DNS names (DGA), (Thu, Jul 9th) *** --------------------------------------------- Most normal user traffic communicates via a hostname and not an IP address. So looking at traffic communicating directly by IP with no associated DNS request is a good thing do to. Some attackers use DNS names for their communications. There is also malware such as Skybot and the Styx exploit kit that use algorithmically chosen host name rather than IP addresses for their command and control channels. This malware uses what has been called DGA or Domain Generation Algorithms to create random... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19893&rss *** Happy Video Game Day 2015 *** --------------------------------------------- Gamers are being targeted more and more by malware, trojans, and keyloggers, especially those that participate in pay-to-play games and MMORPGs (Massively Multiplayer Online Role-Playing Game). Your accounts, personal identity, banking information and even credit card numbers can be stolen if you are playing without a cyber-security solution. The PC gaming market is increasing rapidly and is expected to reach $30.9 Billion in 2016, and with that, the targets are getting bigger and more... --------------------------------------------- http://www.webroot.com/blog/2015/07/08/happy-video-game-day-2015 *** Cisco PSIRT reporting Customers affected by ASA VPN DoS attacks, (Thu, Jul 9th) *** --------------------------------------------- Patch your firewalls! 2015-July-08 UPDATE:">Cisco PSIRT is aware of disruption to some Cisco customers with Cisco ASA devices affected by CVE-2014-3383, the Cisco ASA VPN Denial of Service Vulnerability that was disclosed in this Security Advisory. Traffic causing the disruption was isolated to a specific source IPv4 address. Cisco has engaged the provider and owner of that device and determined that the traffic was sent with no malicious intent. Cisco strongly recommends that customers... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19895&rss *** Sicherheitslücke: OpenSSL akzeptiert falsche Zertifikate *** --------------------------------------------- Ein OpenSSL-Update behebt eine kritische Sicherheitslücke. Mittels einiger Tricks kann ein Angreifer damit ein gewöhnliches Zertifikat zu einer Zertifizierungsstelle machen. Betroffen sind vor allem Clients. --------------------------------------------- http://www.golem.de/news/sicherheitsluecke-openssl-akzeptiert-falsche-zerti… *** OpenSSL CVE-2015-1793: Man-in-the-Middle Attack *** --------------------------------------------- As announced at the beginning of this week, OpenSSL has released the fix for CVE-2015-1793. --------------------------------------------- https://ma.ttias.be/openssl-cve-2015-1793-man-middle-attack/ *** OpenSSL Security Advisory [9 Jul 2015] *** --------------------------------------------- An error in the implementation of the alternative certificate chain logic could allow an attacker to cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. (original advisory). Reported by Adam Langley and David Benjamin (Google/BoringSSL). --------------------------------------------- https://openssl.org/news/secadv_20150709.txt *** Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-132Project: Administration Views (third-party module)Version: 7.xDate: 2015-July-08Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Information DisclosureDescriptionAdministration Views module replaces overview/listing pages with actual views for superior usability.The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have --------------------------------------------- https://www.drupal.org/node/2529378

1 0

Tageszusammenfassung - Mittwoch 8-07-2015
by Daily end-of-shift report 08 Jul '15

08 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-07-2015 18:00 − Mittwoch 08-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory for Adobe Flash Player (APSA15-03) *** --------------------------------------------- A Security Advisory (APSA15-03) has been published regarding a critical vulnerability (CVE-2015-5119) in Adobe Flash Player 18.0.0.194 and earlier versions for Windows, .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1223 *** Security Updates Available for Adobe Flash Player (APSB15-16) *** --------------------------------------------- A security bulletin (APSB15-16) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities that could potentially .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1228 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39675 http://tools.cisco.com/security/center/viewAlert.x?alertId=39643 http://tools.cisco.com/security/center/viewAlert.x?alertId=39641 http://tools.cisco.com/security/center/viewAlert.x?alertId=39623 *** CVE-2015-5119 (HackingTeam 0d - Flash up to 18.0.0.194) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/hackingteam-flash-0d-cve-2015-xxx… *** When ‘int’ is the new ‘short’ *** --------------------------------------------- This is going to be a quick post, just describing a particularly interesting Chrome issue that I found last month; how I found it; and what is interesting about it�I was looking through some Chrome networking code; and I noticed an interesting API design .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/07/when-int-is-new-short.html *** Windows 10 kann WLAN-Passwörter an Kontakte verteilen *** --------------------------------------------- In Windows 10 lässt sich das WLAN-Passwort automatisch an Facebook-Freunde oder Skype-Kontakte verteilen. Das erspart das lästige Diktieren von Kennwörtern bei Besuch, bringt aber auch Risiken mit sich. --------------------------------------------- http://www.golem.de/news/it-sicherheit-windows-10-kann-wlan-passwoerter-an-… *** Schwachstelle in Nameserversoftware BIND 9 *** --------------------------------------------- Ein Angreifer, der einen Nameserver mit aktivierter DNSSEC-Validierung dazu bringen kann, eine Zone mit speziellem Inhalt abzufragen, kann den Nameserver zum Absturz bringen. --------------------------------------------- https://cert.at/warnings/all/20150708.html *** "Zero-Day"-Sicherheitslücke in Adobe Flash Player (aktiv ausgenützt) - Patches jetzt verfügbar *** --------------------------------------------- Durch Ausnutzen dieser Lücke kann ein Angreifer vermutlich vollständige Kontrolle über betroffene Systeme erlangen. Damit sind alle Daten auf diesen Systemen, sowie alle durch diese erreichbaren (etwa durch Login, VPN etc.) Daten und Systeme gefährdet. --------------------------------------------- https://cert.at/warnings/all/20150708-2.html *** Dyre Banking Trojan Exploits CVE-2015-0057 *** --------------------------------------------- CVE-2015-0057 is a Use-After-Free vulnerability that exists in the win32k.sys component of the Windows Kernel which can be exploited to perform local privilege escalation. The vulnerability was reported to Microsoft by Udi Yavo, and, after the patch .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/07/dyre_banking_trojan.ht… *** Prenotification: Upcoming Security Updates for Adobe Acrobat and Reader (APSB15-15) *** --------------------------------------------- A prenotification security advisory has been posted regarding upcoming Adobe Acrobat and Reader updates scheduled for Tuesday, July 14, 2015. We will continue to provide updates on the upcoming release via the Security Bulletins and Advisories page as well .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1232 *** Wild Neutron – Economic espionage threat actor returns with new tricks *** --------------------------------------------- A powerful threat actor known as “Wild Neutron” (also known as “Jripbot” and “Morpho”) has been active since at least 2011, infecting high profile companies for several years by using a combination of exploits, watering holes and multi-platform malware. --------------------------------------------- https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-…

1 0

Tageszusammenfassung - Dienstag 7-07-2015
by Daily end-of-shift report 07 Jul '15

07 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 06-07-2015 18:00 − Dienstag 07-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security Advisory: BIG-IQ remote authentication vulnerability CVE-2015-4637 *** --------------------------------------------- When remote authentication is configured on the BIG-IQ system for a LDAP server that allows anonymous BIND operations, a unauthenticated user may obtain an authentication token from the REST API for any known (or guessed) LDAP user account and will receive all the access and privileges of that user account for REST API calls. (CVE-2015-4637) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16861.htm… *** Fraudulent BatteryBot Pro App Yanked from Google Play *** --------------------------------------------- A malicious Android app spoofing the popular BatteryBot Pro app has been pulled from Google Play. Researchers at Zscaler reported the app, which had a package name of com.polaris.BatteryIndicatorPro. The app requested excessive permissions from the user in an attempt to get full control of an .. --------------------------------------------- http://threatpost.com/fraudulent-batterybot-pro-app-yanked-from-google-play… *** Malvertisement - A Nuclear EK Tale *** --------------------------------------------- Over the past couple of years delivering malware via advertisements, or "malvertisement," has become one of the most popular methods of distribution for exploit kits. Like most trends in the world of Internet security, the longer it endures - the .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Malvertisement-%e2%80%9… *** Social Engineering - A Case Study *** --------------------------------------------- In this article, I am going to illustrate a real life social engineering hack that I did it for my friend. My friend saw some property ads on internet. He filled the query form for that ad, and after a day he got a call fraudulent call .. --------------------------------------------- http://resources.infosecinstitute.com/social-engineering-a-case-study/ *** Two major IT-Security Myths debunked *** --------------------------------------------- There are two statements G DATA’s security experts hear and read time and again: “I do not surf on porn websites, my computer can’t get infected” as well as “my computer does not hold anything valuable and I have nothing to hide – why should I be a target?” It would be a pleasure to confirm this, but, unfortunately, we do not live in an ideal world. The company’s latest Malware Report underlines why such sentences should be regarded as myths and IT-Security is important for everyone. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/two-major-it-security-myths-deb… *** NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS) *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8081 *** NewStatPress <= 1.0.4 - SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8080 *** Safer Internet *** --------------------------------------------- Anna is the director of a small kindergarten in Zurich. To give the kindergarten a home on the Internet, she registered a domain name and put up a website where parents can get up-to-date information about the kindergarten. A friend .. --------------------------------------------- http://securityblog.switch.ch/2015/07/07/safer-internet/ *** Kritischer OpenSSL-Patch voraus *** --------------------------------------------- Mit einer kurzen Notiz verkündet Mark J. Cox, dass man Donnerstag, den 9. Juli, ein Sicherheits-Update für OpenSSL veröffentlichen wolle. Dies sei der höchsten Sicherheitsstufe zuzurechnen (high). Das bedeutet, dass gängige Konfigurationen betroffen sind und die Lücke sich wahrscheinlich ausnutzen lässt, um Denial-of-Service-Angriffe durchzuführen, Daten zu klauen oder sogar betroffene System zu kapern. --------------------------------------------- http://heise.de/-2739804 *** Landeskriminalamt Salzburg warnt vor gefälschten Paketdienst-E-Mails *** --------------------------------------------- In Salzburg sind derzeit verstärkt Internet-Betrüger aktiv. Die Polizei warnt akut vor gefälschten E-Mails im Namen bekannter Paketdienste, die vorgeben, dass eine Postsendung unterwegs sei. Über einen Link könne man den aktuellen Paketstatus abrufen. Ein Klick darauf installiert in Wirklichkeit aber die Schadsoftware "CryptoLocker", welche die auf der Festplatte gespeicherten Daten verschlüsselt. --------------------------------------------- http://derstandard.at/2000018700461 *** Fuzzing: Auf Fehlersuche mit American Fuzzy Lop *** --------------------------------------------- Programme testweise mit massenhaft fehlerhaften Daten zu füttern, ist eine effektive Methode, um Fehler zu finden. Das sogenannte Fuzzing ist schon seit Jahrzehnten bekannt, doch bessere Tools und einige spektakuläre Funde von Sicherheitslücken haben zuletzt das Interesse daran erneut geweckt. --------------------------------------------- http://www.golem.de/news/fuzzing-auf-fehlersuche-mit-american-fuzzy-lop-150… *** New Android Malware Family Evades Antivirus Detection by Using Popular Ad Libraries *** --------------------------------------------- Unit 42 discovered a new family of Android malware that successfully evaded all antivirus products on the VirusTotal web service. We named this malware family 'Gunpoder' based on the main malicious component name, .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/new-android-malware-fami… *** Hacked Hacking Team *** --------------------------------------------- Wie ja seit gestern gross durch die diversen Medien getrommelt wird (siehe etwa heise.de, derstandard.at), wurde das Unternehmen "Hacking Team" anscheinend selbst Opfer eines Angriffs. In den dabei geleakten Daten sind auch etliche Hinweise auf bislang unbekannte Exploits ("0-days") zu finden. Leider fehlt uns die Kapazität, die gesamten geleakten Daten (gut 160.000 Dateien mit insg. rund 400GB!) in endlicher Zeit selbst zu analysieren, daher müssen wir uns dabei auf die Community verlassen. --------------------------------------------- http://www.cert.at/services/blog/20150707141314-1556.html *** Attack of the Zombie Orkut Phishing Pages *** --------------------------------------------- Sometimes long dead websites are targeted by phishing pages. When those sites made use of single sign-on, the danger will never quite go away. Orkut may be gone, but the fake login pages persist .. --------------------------------------------- https://blog.malwarebytes.org/fraud-scam/2015/07/attack-of-the-zombie-orkut…

1 0

Tageszusammenfassung - Montag 6-07-2015
by Daily end-of-shift report 06 Jul '15

06 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-07-2015 18:00 − Montag 06-07-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** [20150602] - Core - CSRF Protection *** --------------------------------------------- http://developer.joomla.org/security-centre/618-20150602-core-remote-code-e… *** [20150601] - Core - Open Redirect *** --------------------------------------------- http://developer.joomla.org/security-centre/617-20150601-core-open-redirect… *** This 20-year-old Student Has Written 100 Malware Programs in Two Years *** --------------------------------------------- Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around .. --------------------------------------------- http://thehackernews.com/2015/07/student-hacker.html *** A .BUP File Is An OLE File *** --------------------------------------------- Yesterday I mentioned that McAfee quarantine files on Windows (.BUP extension) are actually OLE files. Im going to write a couple of diary entries highlighting some file types that are OLE files, and .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19869 *** MMD-0036-2015 - KINS (or ZeusVM) v2.0.0.0 tookit (builder & panel) leaked. *** --------------------------------------------- The background KINS (or ZeusVM to be precised) v2.0.0.0 tookit (builder & panel) was leaked and spread all over the internet. On Jun 26th 2015 we were informed about this and after several internal discussion, considering that: "so .. --------------------------------------------- http://blog.malwaremustdie.org/2015/07/mmd-0036-2015-kins-or-zeusvm-v2000.h… *** A fileless Ursnif doing some POS focused reco *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/a-fileless-ursnif-doing-some-pos.… *** BizCN gate actor changes from Fiesta to Nuclear exploit kit *** --------------------------------------------- Introduction An actor using gates registered through BizCN recently switched from Fiesta to Nuclear exploit kit (EK). This happened around last month, and we first noticed the change on 2015-06-15. I started writing about this actor in 2014 .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19875 *** Don't Be Fooled By Phony Online Reviews *** --------------------------------------------- The Internet is a fantastic resource for researching the reputation of companies with which you may wish to do business. Unfortunately, this same ease-of-use can lull the unwary into falling for marketing scams originally perfected .. --------------------------------------------- http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/ *** Spionagefirma Hacking Team: "Feind des Internets" selbst gehackt *** --------------------------------------------- Die italienische Überwachungsfirma Hacking Team wurde selbst Opfer eines massiven Hacks: Eindringlinge konnten rund 480 GB an internen Daten übernehmen und diese als Download bereitstellen. Auch der Twitter-Account des Unternehmens wurde übernommen und in "Hacked Team" umbenannt. Die veröffentlichten Informationen .. --------------------------------------------- http://derstandard.at/2000018630550 *** Blue-Pill-Lücke in Xen geschlossen *** --------------------------------------------- In der langen Liste der Sicherheits-Verbesserungen von Xen 4.5.1 finden sich auch eine Lücke, die den Ausbruch aus einer virtuellen Maschine erlaubt - und ein geheimnisvoller, noch undokumentierte Eintrag. --------------------------------------------- http://heise.de/-2736158 *** ManageEngine Password Manager Pro 8.1 SQL Injection *** --------------------------------------------- An authenticated user (even the guest user) is able to execute arbitrary SQL code using a forged request to the SQLAdvancedALSearchResult.cc. The SQL query is build manually and is not escaped properly in the AdvanceSearch.class of AdventNetPassTrix.jar. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015070020 *** Insider Threats Defined *** --------------------------------------------- According to the second annual SANS survey on the security of the financial services sector, the number one threat companies are concerned about doesn’t relate to nation-states, organised criminal gangs or ‘APTs’. Rather the main worry revolves around insider threats – but what exactly is an insider threat and what can be done to detect and respond to these threats? --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/insider-threats-defined *** How to Deal with Reverse Domain Name Hijacking *** --------------------------------------------- The fact that one owns a trademark which is identical or confusingly similar to a domain name does not necessarily mean that she is entitled to that domain name. For .. --------------------------------------------- http://resources.infosecinstitute.com/how-to-deal-with-reverse-domain-name-… *** Rätselaufgaben gegen DDoS-Angriffe auf TLS *** --------------------------------------------- Ein Akamai-Mitarbeiter beschreibt, wie mit einfachen Rechenaufgaben DDoS-Angriffe durch Clients auf TLS-Verbindungen minimiert werden könnten. Die Idee ist zwar noch ein Entwurf, könnte aber als Erweiterung für TLS 1.3 standardisiert werden. --------------------------------------------- http://www.golem.de/news/ietf-raetselaufgaben-gegen-ddos-angriffe-auf-tls-1… *** AWS Best Practices for DDoS Resiliency (PDF) *** --------------------------------------------- http://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf *** No one expect command execution ! *** --------------------------------------------- Unix is a beautiful world where your shell gives you the power of launching any command you like. But sometimes, command can be used to launch another commands, and thats sometimes unexpected. --------------------------------------------- http://0x90909090.blogspot.fr/2015/07/no-one-expect-command-execution.html

1 0

Tageszusammenfassung - Freitag 3-07-2015
by Daily end-of-shift report 03 Jul '15

03 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-07-2015 18:00 − Freitag 03-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Security Advisory: PHP vulnerability CVE-2015-4024 *** --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/800/sol16826.html *** Angler Exploit Kit Evasion Techniques Keep Cryptowall Thriving *** --------------------------------------------- Since the Angler Exploit Kit began pushing the latest version of Cryptowall ransomware, the kit has gone to great lengths to evade detection from IDS and other security technologies. The latest tactic is an almost-daily change to URL patterns used by the kit in HTTP GET requests for the Angler landing .. --------------------------------------------- http://it.slashdot.org/story/15/07/02/1829244/angler-exploit-kit-evasion-te… *** Plex: Foren des Media Servers gehackt *** --------------------------------------------- Unbekannten Angreifern ist es offenbar gelungen das zum Service gehörige Forum zu hacken, und Zugriff auf sensible Daten zu erhalten. Neben Mail-Adressen sollen dabei auch Passwort-Hashes, private Nachrichten und IP-Adressen abgegriffen worden sein. ... So wurden alle betroffenen User mittlerweile per .. --------------------------------------------- http://derstandard.at/2000018475799/Plex-Foren-des-Media-Servers-gehackt *** Cisco Adaptive Security Appliance Software OSPFv2 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39612 *** DSA-3299 stunnel4 - security update *** --------------------------------------------- Johan Olofsson discovered an authentication bypass vulnerability inStunnel, a program designed to work as an universal SSL tunnel fornetwork daemons. When Stunnel in .. --------------------------------------------- https://www.debian.org/security/2015/dsa-3299 *** REcon Recap: Here's What Caught My Eye *** --------------------------------------------- A few weeks ago I was fortunate enough to attend REcon in Montreal, Canada. This conference focuses on reverse engineering and exploitation techniques and has been .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/07/recon-recap/ *** WordPress File Upload <= 2.7.6 - Multiple Vulnerabilities *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8070 *** Sicherheitsrisiko: LGs Update-App für Smartphones ist anfällig *** --------------------------------------------- Smartphones von LG sind aufgrund einer schlecht umgesetzten SSL-Verschlüsselung anfällig für Man-in-the-Middle-Attacken. Offenbar weiß der Hersteller schon länger davon, ein Patch soll das Problem beheben - auf manchen Geräten ist dieser aber noch nicht angekommen. --------------------------------------------- http://www.golem.de/news/sicherheitsrisiko-lgs-update-app-fuer-smartphones-… *** Viele VPNs plaudern wahre Identität ihrer Nutzer aus *** --------------------------------------------- Forscher finden grobe Implementationsprobleme - IPv6 und DNS-Abfragen unterwandern Sicherheit --------------------------------------------- http://derstandard.at/2000018498920 *** Mozilla: Firefox 39 schmeisst alte Krypto raus *** --------------------------------------------- SSLv3 ist aus Firefox 39 endgültig entfernt worden, und RC4 ist nur noch temporär für einige wenige Seiten erlaubt. Das Mozilla-Team erweitert den Schutz des Browsers vor Malware, daneben gibt es noch viele kleinere Neuerungen. --------------------------------------------- http://www.golem.de/news/mozilla-firefox-39-schmeisst-alte-krypto-raus-1507… *** Kovter AdFraud is updating Flash Player (and Internet Explorer) *** --------------------------------------------- Checking my systems I noticed multiple VM trying to grab last version of Flash and thought they were not properly setup allowing Flash Player to auto-update (which we do not want obviously - we want to keep them exploitable and also avoid behavioural/network noise). --------------------------------------------- http://malware.dontneedcoffee.com/2015/07/kovter-adfraud-is-updating-flash-… *** l+f: Noch mehr Hintertüren bei Cisco *** --------------------------------------------- http://heise.de/-2734480 *** Apple: EFI-Sicherheits-Update nicht für ältere Macs *** --------------------------------------------- Das Sicherheits-Update, das eine mögliche Modifikation der Firmware verhindert, steht zwar für ältere OS-X-Versionen zur Verfügung – lässt sich jedoch nur auf jüngeren Macs installieren. --------------------------------------------- http://heise.de/-2735051

1 0

Tageszusammenfassung - Donnerstag 2-07-2015
by Daily end-of-shift report 02 Jul '15

02 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-07-2015 18:00 − Donnerstag 02-07-2015 18:00 Handler: Robert Waldner Co-Handler: Alexander Riepl *** Attackers Revive Deprecated RIPv1 Routing Protocol in DDoS Attacks *** --------------------------------------------- An advisory from Akamai warns of a recent reflection style DDoS attack in which the deprecated RIPv1 routing protocol was leveraged against targets. --------------------------------------------- http://threatpost.com/attackers-revive-deprecated-ripv1-routing-protocol-in… *** EMC Documentum D2 Input Validation Flaw Lets Remote Authenticated Users Obtain Potentially Sensitive Information *** --------------------------------------------- A remote authetnicated user can send specially crafted data to inject data query language (DQL) commands and obtain potentially sensitive information from the database on the target system. ... The D2CenterstageService.getComments method is affected [CVE-2015-0547]. ... The D2DownloadService.getDownloadUrls method is affected [CVE-2015-0548]. --------------------------------------------- http://www.securitytracker.com/id/1032769 *** Updated Point-to-Point Encryption standard now provides more flexibility *** --------------------------------------------- The Payment Card Industry Security Standards Council (PCI SSC) published an important update to one of its eight security standards, simplifying the development and use of Point-to-Point Encryption (P2PE) solutions that make payment card data unreadable and less valuable to criminals if stolen in a breach. --------------------------------------------- http://www.net-security.org/secworld.php?id=18581 *** Final Year Dissertation Paper Release: An Evaluation of the Effectiveness of EMET 5.1 *** --------------------------------------------- My paper covers three separate exploits that I converted to try bypass EMET 5.1s protections as best I could and the techniques that I used to do so as well as how successful EMET 5.1 was at preventing me from exploiting the vulnerable programs. --------------------------------------------- http://tekwizz123.blogspot.co.at/2015/07/final-year-dissertation-paper-rele… *** ENISA's Udo Helmbrecht at EPP Hearing on cybersecurity *** --------------------------------------------- ENISA's Udo Helmbrecht participated at the EPP Hearing on data driven security, which took place today 1st July 2015, at the European Parliament in Brussels. Topics discussed included: Session I: New trends in digital technology developments and cyber threats to security Session II: Fighting crime: use of new technologies and use of data Session III: Cyber Security: ensuring security and safety on state and individual levels --------------------------------------------- http://www.enisa.europa.eu/media/news-items/enisa2019s-udo-helmbrecht-at-ep… *** How safe is the Windows 10 Wi-Fi sharing feature? *** --------------------------------------------- ... what worries security experts is the fact that it allows users to share access to their password-protected Wi-Fi networks with their Outlook.com contacts, Skype contacts, and Facebook friends. ... While this feature can come very handy, it could also open users to security risks. --------------------------------------------- http://www.net-security.org/secworld.php?id=18584 *** Cisco Security Advisories/Vulnerability Alerts *** --------------------------------------------- Cisco Unified Communications Domain Manager Default Static Privileged Account Credentials http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… --------------------------------------------- Cisco Adaptive Security Appliance SNMP Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39611 --------------------------------------------- Cisco Nexus Operating System Devices Command Line Interface Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39583 --------------------------------------------- Cisco Digital Content Manager Message Processing Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39556 ---------------------------------------------

1 0

Tageszusammenfassung - Mittwoch 1-07-2015
by Daily end-of-shift report 01 Jul '15

01 Jul '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 30-06-2015 18:00 − Mittwoch 01-07-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** What is Wi-Fi Sense and Why Does It Want Your Facebook Account? *** --------------------------------------------- Wi-Fi Sense is a feature built into Windows 10. You may see a pop-up saying "Wi-Fi Sense needs permission to use your Facebook account." It also works with Outlook.com and Skype contacts. This feature allows you to share Wi-Fi login information - network names and passphrases - with your friends. It's designed to automatically connect Windows 10 devices to shared networks. ... Wi-Fi Sense was originally a Windows Phone 8.1 feature that made the jump to desktop PCs and tablets with Windows 10. --------------------------------------------- http://www.howtogeek.com/219700/what-is-wi-fi-sense-and-why-does-it-want-yo… *** EU-Kompromiss zu Meldepflichten bei Cyberangriffen steht *** --------------------------------------------- Betreiber "wesentlicher" Infrastrukturen und Dienste in der EU müssen bald Cyberangriffe melden, für Digitalplattformen wie soziale Netzwerke sollen abgestufte Regeln gelten. Darauf haben sich EU-Rat und Parlament geeinigt. --------------------------------------------- http://www.heise.de/newsticker/meldung/EU-Kompromiss-zu-Meldepflichten-bei-… *** Apple Patches Dozens of Flaws in iOS 8.4, OS X 10.10.4 *** --------------------------------------------- Apple has released new versions of iOS and OS X, both of which include a significant number of security patches, several for bugs that can lead to remote code execution and other serious issues. Version 8.4 of iOS contains fixes for more than 30 security vulnerabilities, including bugs in the iOS kernel, WebKit, and CoreText. --------------------------------------------- http://threatpost.com/apple-patches-dozens-of-flaws-in-ios-8-4-os-x-10-10-4… *** ZDI-15-275: (0Day) SolarWinds Storage Manager AuthenticationFilter Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SolarWinds Storage Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-275/ *** TYPO3 CMS 6.2.14 and 7.3.1 released *** --------------------------------------------- We are announcing the release of the following TYPO3 CMS updates: TYPO3 CMS 6.2.14 LTS TYPO3 CMS 7.3.1 Both versions are maintenance releases and contain bug and security fixes. --------------------------------------------- http://www.typo3.org/news/article/typo3-cms-6214-and-731-released/ *** Apple gets around to fixing those 77 security holes in OS X Yosemite *** --------------------------------------------- Your OS X box can still be owned by, well, just about everything Apple has released a series of security updates to address 77 CVE-listed security vulnerabilities in OS X Yosemite. --------------------------------------------- http://www.theregister.co.uk/2015/06/30/apple_finally_gets_around_to_fixing… *** A third of iThings open to VPN-hijacking, app-wrecking attacks *** --------------------------------------------- Masques off: Researchers detail five ways to wreck Apple stuff A trio of FireEye researchers have reported twin app-demolishing iOS vulnerabilities Apple has partially fixed in its latest update that could wreck core apps such as the App Store and Settings. --------------------------------------------- http://www.theregister.co.uk/2015/07/01/masque_attack_ios_fireeye/ *** June 2015 Android malware review from Doctor Web *** --------------------------------------------- PRINCIPAL TRENDS IN JUNE - Activity of banking Trojans - Emergence of new downloader - Trojans Emergence of new Android ransomware - Growing number of SMS Trojans --------------------------------------------- http://news.drweb.com/show/?i=9511&lng=en&c=9 *** Cisco Vulnerability Alerts *** --------------------------------------------- Cisco Nexus Devices NX-OS Software Command-Line Interpreter Local Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39569 --------------------------------------------- Cisco Nexus Devices Python Subsystem Local Privilege Escalation Vulnerabilities http://tools.cisco.com/security/center/viewAlert.x?alertId=39571 --------------------------------------------- Cisco Unified MeetingPlace SQL Injection Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39570 --------------------------------------------- Cisco Nexus 7000 Devices Virtual Device Context Privilege Escalation Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39568 --------------------------------------------- *** IBM Security Bulletins *** --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961048 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects PowerKVM (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=isg3T1022395 --------------------------------------------- IBM Security Bulletin: Vulnerability with Diffie-Hellman ciphers may affect IBM WebSphere Application Server that shipped with WebSphere Enterprise Service Bus Registry Edition (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21961049 --------------------------------------------- IBM Security Bulletin: CICS Transaction Gateway for Multiplatforms http://www.ibm.com/support/docview.wss?uid=swg21903636 --------------------------------------------- IBM Security Bulletin: A security vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web version 7.0 software installations and IBM Tivoli Access Manager for e-business (CVE-2015-1920) http://www.ibm.com/support/docview.wss?uid=swg21960450 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in the FreeType library affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960562 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in FreeType library affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958900 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Security Access Manager for Web http://www.ibm.com/support/docview.wss?uid=swg21960668 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Security Access Manager for Mobile. http://www.ibm.com/support/docview.wss?uid=swg21958903 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Web (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21960456 --------------------------------------------- Vulnerabilities in NTPv4 affect AIX http://www.ibm.com/support/ --------------------------------------------- IBM Security Bulletin: Multiple cross-site scripting (XSS) vulnerabilities in IBM Dojo Toolkit affects IBM Case Manager (CVE-2014-8917) http://www.ibm.com/support/docview.wss?uid=swg21883851 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a kexec-tools vulnerability (CVE-2015-0267) http://www.ibm.com/support/docview.wss?uid=isg3T1022407 --------------------------------------------- IBM Security Bulletin: Dual_EC_DRBG vulnerability and RC4 stream cipher vulnerability affect WebSphere Transformation Extender Secure Adapter Collection (CVE-2007-6755, CVE-2015-2808) http://www.ibm.com/support/docview.wss?uid=swg21959577 --------------------------------------------- IBM Security Bulletin: XSS vulnerability in Error dialog which can execute scripts injected into addressability and comments features that affects IBM Case Manager (CVE-2015-1979) http://www.ibm.com/support/docview.wss?uid=swg21959695 --------------------------------------------- IBM Security Bulletin: Vulnerabilities in OpenSSL including Logjam affect Sterling Connect:Express for UNIX (CVE-2015-4000, CVE-2014-8176, CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792) http://www.ibm.com/support/docview.wss?uid=swg21959308 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Cognos Command Center (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960508 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects the Enterprise Common Collector component of the IBM Tivoli zEnterprise Monitoring Agent (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21960019 --------------------------------------------- IBM Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM InfoSphere Optim Performance Manager (CVE-2015-4000) http://www.ibm.com/support/docview.wss?uid=swg21959591 --------------------------------------------- IBM Security Bulletin: JavaScript evaluation vulnerability in IBM Business Process Manager (CVE-2015-1961) http://www.ibm.com/support/docview.wss?uid=swg21959052 --------------------------------------------- IBM Security Bulletin: IBM Security Identity Manager Virtual Appliance affected by Java vulnerabilities (CVE-2015-0138 CVE-2015-0204 CVE-2015-1914 CVE-2015-2808 ) http://www.ibm.com/support/docview.wss?uid=swg21960515 --------------------------------------------- IBM Security Bulletin: Potential denial of service may affect IBM WebSphere Application Server shipped with IBM Tivoli Network Performance Manager (CVE-2015-1829) http://www.ibm.com/support/docview.wss?uid=swg21960364 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a bind vulnerability (CVE-2015-1349) http://www.ibm.com/support/docview.wss?uid=isg3T1022295 --------------------------------------------- IBM Security Bulletin: PowerKVM is affected by a qemu vulnerability (CVE-2014-9718) http://www.ibm.com/support/docview.wss?uid=isg3T1022294 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Security Access Manager for Mobile (CVE-2015-0488, CVE-2015-0478, CVE-2015-1916) http://www.ibm.com/support/docview.wss?uid=swg21959597 --------------------------------------------- IBM Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Access Manager for Mobile (CVE-2013-7423) http://www.ibm.com/support/docview.wss?uid=swg21959604 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by OpenStack Glance v2 API unrestricted path traversal (CVE-2014-9493, CVE-2015-1195) http://www.ibm.com/support/docview.wss?uid=nas8N1020785 --------------------------------------------- IBM Security Bulletin: IBM PowerVC is impacted by Apache Qpid security vulnerabilities (CVE-2015-0203, CVE-2015-0223, CVE-2015-0224) http://www.ibm.com/support/docview.wss?uid=nas8N1020787 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Security Access Manager for Mobile (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959068 --------------------------------------------- IBM Security Bulletin: A cross-site scripting vulnerability affects IBM Tivoli Federated Identity Manager and IBM Tivoli Federated Identity Manager Business Gateway (CVE-2015-1966) http://www.ibm.com/support/docview.wss?uid=swg21959071 --------------------------------------------- IBM Security Bulletin: XSS Vulnerability in IBM Jazz Foundation affects multiple IBM Rational products based on IBM Jazz technology (CVE-2015-0130) http://www.ibm.com/support/docview.wss?uid=swg21960407 ---------------------------------------------

1 0

Tageszusammenfassung - Dienstag 30-06-2015
by Daily end-of-shift report 30 Jun '15

30 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 29-06-2015 18:00 − Dienstag 30-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Windows kerberos ticket theft and exploitation on other platforms *** --------------------------------------------- I decided to take a look at how the kerberos tickets can be dumped from a Windows target and re-used on Linux. It was surprisingly easy to accomplish. --------------------------------------------- https://mikkolehtisalo.wordpress.com/2015/06/29/copying-windows-kerberos-ti… *** Why vulnerability disclosure shouldn't be a marketing tool *** --------------------------------------------- So now we have three approaches to vulnerability disclosure: full disclosure, responsible disclosure, and marketing disclosure. My concern with the latter is that by its very nature it will get more coverage in both the IT industry and mainstream media. ... In the cases where the vulnerability does affect the organization, the security team is called into action to remediate it, but this remediation may be based more on the impact the vulnerability has had on the news headlines rather than on the impact it actually may have on the environment, This results in already overstretched security teams being distracted from other core tasks. --------------------------------------------- http://www.net-security.org/article.php?id=2318 *** DSA-3297 unattended-upgrades - security update *** --------------------------------------------- It was discovered that unattended-upgrades, a script for automaticinstallation of security upgrades, did not properly authenticatedownloaded packages when the force-confold or force-confnew dpkg optionswere enabled via the DPkg::Options::* apt configuration. --------------------------------------------- https://www.debian.org/security/2015/dsa-3297 *** How Malware Campaigns Employ Google Redirects and Analytics, (Tue, Jun 30th) *** --------------------------------------------- The email message sent to the bank employee claimed that the sender received a wire transfer from the recipients organization and that the sender wanted to confirm that the payment went through without issues. The victim was encouraged to click a link that many people would considersafe, in part because it began with https://www.google.com/. How would you examine the nature of this email? Examining MSG and EML Files on Linux One way to analyze the suspicious message saved as an Outlook .msg file --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19843&rss *** Tearing Apart a Datto *** --------------------------------------------- Datto devices are becoming a popular backup solution for small to medium sized businesses. They are easy to use and well equipped out of the box. We recently found ourselves in an engagement where one of these devices was accessible via the LAN. Gaining access to backups is a bit of a goldmine during an assessment; unrestricted access to file shares, configuration information, extracting hashes from the NTDS.dit file, and a multitude of other things. --------------------------------------------- http://silentbreaksecurity.com/tearing-apart-a-datto/ *** Vulnerability in Citrix NetScaler Application Deliver Controller and NetScaler Gateway Management Interface Could Result in Arbitrary Command Injection *** --------------------------------------------- A vulnerability has been identified in Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway Management Interface that could allow an authenticated malicious user to execute shell commands on the appliance. CVE: CVE-2015-5080 --------------------------------------------- http://support.citrix.com/article/CTX201149 *** Viele Android-Geräte über Debugger angreifbar *** --------------------------------------------- Über eine Schwachstelle im Debugger können Angreifer den Inhalt des Hauptspeichers von über 90 Prozent aller Android-Geräte auslesen und so weitere Attacken fahren. --------------------------------------------- http://www.heise.de/newsticker/meldung/Viele-Android-Geraete-ueber-Debugger… *** Analyzing a Facebook Clickbait Worm *** --------------------------------------------- Here at Sucuri we suspect everything, especially when your friends start to share content written in another language with clickbait headlines. If you are not familiar with the term, clickbait is when web content is created in a way that psychologically exploits the reader's curiosity using compelling headlines. When someone clicks on the article to read it, the service promoting the article generates online advertisement revenue. --------------------------------------------- https://blog.sucuri.net/2015/06/analyzing-a-facebook-clickbait-worm.html *** Vulnerabilities in Cisco products*** --------------------------------------------- Cisco Unified IP Phones 9900 Series Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39554 --------------------------------------------- Cisco Unified Communications Domain Manager Information Disclosure Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39557 --------------------------------------------- *** Vulnerabilities in IBM products*** --------------------------------------------- Security Bulletin: Vulnerabilities in libxml2 affect System Networking Products (CVE-2014-0191, CVE-2013-2877, CVE-2014-3660) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098306 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098265 --------------------------------------------- Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM Flex System Manager (FSM) SMIA Configuration Tool (CVE-2015-4000) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403 --------------------------------------------- Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098314 --------------------------------------------- Security Bulletin: Vulnerability in RC4 stream cipher affects IBM System Networking RackSwitch (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098302 ---------------------------------------------Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter Switches (CVE-2015-2808) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098303 --------------------------------------------- Security Bulletin: Multiple vulnerabilities in xorg-x11-server affect IBM Flex System Manger (FSM) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098372 --------------------------------------------- Security Bulletin: GNU C library (glibc) vulnerability affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware (CVE-2015-0235) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098317 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru Firmware (CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0205, CVE-2015-0206) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098358 --------------------------------------------- Security Bulletin: Vulnerabilities in OpenSSL affect IBM System x, BladeCenter and Flex Systems Unified Extensible Firmware Interface (UEFI) (CVE-2014-3569, CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275) http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098339 --------------------------------------------- IBM Security Bulletin: IBM SmartCloud Analytics - Log Analysis is affected by Open Source Python Vulnerability (CVE-2014-9365) http://www.ibm.com/support/docview.wss?uid=swg21958936 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Endpoint Manager for Remote Control http://www.ibm.com/support/docview.wss?uid=swg21903374 --------------------------------------------- IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime, affect Tivoli Endpoint Manager for Remote Control. http://www.ibm.com/support/docview.wss?uid=swg21903373 --------------------------------------------- IBM Security Bulletin: A vulnerability in cURL libcURL affects IBM Tivoli Composite Application Manager for Transactions (CVE-2014-8150) http://www.ibm.com/support/docview.wss?uid=swg21697198 ---------------------------------------------

1 0

Tageszusammenfassung - Montag 29-06-2015
by Daily end-of-shift report 29 Jun '15

29 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 26-06-2015 18:00 − Montag 29-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** In eigener Sache: CERT.at sucht Verstärkung *** --------------------------------------------- Wir suchen aktuell eine/n ProgrammiererIn - vorerst als Karenzvertretung bis Jahresende. Details siehe https://cert.at/about/jobs/jobs.html --------------------------------------------- http://www.cert.at/services/blog/20150629141329-1553.html *** IETF Officially Deprecates SSLv3 *** --------------------------------------------- The IETF, in RFC7568, declared SSLv3 "not sufficiently secure" and prohibited its use. SSLv3 fallbacks were to blame for the POODLE and BEAST attacks. --------------------------------------------- http://threatpost.com/ietf-officially-deprecates-sslv3/113503 *** NIST Updates Random Number Generation Guidelines *** --------------------------------------------- An anonymous reader writes: Encryption weighs heavily on the public consciousness these days, as weve learned that government agencies are keeping an eye on us and a lot of our security tools arent as foolproof as weve thought. In response to this, the National Institute of Standards and Technology has issued a formal update to its document on how to properly generate a random number - crucial in many types of encryption. --------------------------------------------- http://rss.slashdot.org/~r/Slashdot/slashdot/~3/JJ7XjyjPA9c/nist-updates-ra… *** Lücke im Flash Player: Exploit Kit erhöht Angriffs-Risiko *** --------------------------------------------- Bisher haben Angreifer die in der letzten Woche bekanntgewordene Schwachstelle in Adobes Flash Player nur vereinzelt und gezielt attackiert. Aktuell nutzt jedoch auch das Magnitude Exploit Kit die Lücke aus und vergrößert den Angriffsradius. --------------------------------------------- http://heise.de/-2730795 *** The State of the ESILE/Lotus Blossom Campaign *** --------------------------------------------- As is generally the case with backdoors, ESILE contacts a command-and-control server in order to receive commands from its attacker. How it does this is also a fingerprint of the campaign as well. It uses a URL based on the MAC address of the infected machine's network interface, as well as the current time. ... This distinctive pattern can be used to help spot and block ESILE-related endpoints on an organization's network. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-state-of-the… *** Migrating from SHA-1 to SHA-2 *** --------------------------------------------- Heres a comprehensive document on migrating from SHA-1 to SHA-2 in Active Directory certificates.... --------------------------------------------- https://www.schneier.com/blog/archives/2015/06/migrating_from_.html *** Cyber Security Challenge: Bundesheer sucht Nachwuchs-Hacker *** --------------------------------------------- Qualifikation läuft bis August, Veranstaltung von Cyber Security Austria und Abwehramt organisiert --------------------------------------------- http://derstandard.at/2000018220253 *** Bugtraq: ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities *** --------------------------------------------- Summary: ESRS VE version 3.06 contains security fixes for multiple vulnerabilities that could potentially be exploited by malicious uses to compromise the affected system Insufficient Certificate Validation CVE-2015-0543: CVSSv2 Base Score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N) Cookie Generated with Insufficient Randomness CVE-2015-0544: CVSSv2 Base Score: 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) --------------------------------------------- http://www.securityfocus.com/archive/1/535851 *** The Powershell Diaries 2 - Software Inventory, (Mon, Jun 29th) *** --------------------------------------------- After last weeks story, hopefully youve got your problem users accounts identified. With that worked out, lets see about finding problem applications. We all need a handle on what applications are installed on workstations for a number of reasons to make sure that when upgrade time comes, that nobody gets left behind that older apps that have security vulnerabilities or have limited function get taken care of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19851&rss *** Critical vulnerabilities in Polycom RealPresence Resource Manager (RPRM) *** --------------------------------------------- Business recommendation: By combining all vulnerabilities documented in this advisory an unprivileged authenticated remote attacker can gain full system access (root) on the RPRM appliance. This has an impact on all conferences taking place via this RP Resource Manager. Attackers can steal all conference passcodes and join or record any conference. SEC Consult recommends not to use this system until a thorough security review has been performed by security professionals and all identified issues have been resolved. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** TYPO3-EXT-SA-2015-015: Cross-Site Scripting in extension "404 Page not found handling" (pagenotfoundhandling) *** --------------------------------------------- It has been discovered that the extension "404 Page not found handling" (pagenotfoundhandling) is susceptible to Cross-Site Scripting Suggested CVSS v2.0: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:O/RC:C Affected Versions: version 2.1.0 and below --------------------------------------------- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-e… *** Hacker-Angriff vermutet: Apache Build-Server offline *** --------------------------------------------- Bis jetzt wurde ein Angriff nicht offiziell bestätigt. Auch ist nicht bekannt, ob ein Eingriff in auf den Servern gebaute Software-Pakete stattgefunden hat. Die Build-Systeme der ASF werden unter anderem von OpenOffice, dem Tomcat-Projekt und dem Web-Framework Apache Wicket verwendet. Neben den Build-Servern und der Continuous-Integration-Webseite ist auch das CMS der Apache-Seiten betroffen. --------------------------------------------- http://heise.de/-2731265 *** Cisco Application Policy Infrastructure Controller Unauthorized Access Vulnerability *** --------------------------------------------- CVE: CVE-2015-4225, CVSS2 Base Score: 5.5 A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (Cisco APIC) could allow an authenticated, remote attacker to have read access to certain information stored in the affected system. The vulnerability is due to improper handling of RBAC for health scoring. An attacker could exploit this vulnerability to gain access to information on the affected system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39529

1 0

Tageszusammenfassung - Freitag 26-06-2015
by Daily end-of-shift report 26 Jun '15

26 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 25-06-2015 18:00 − Freitag 26-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Magento Platform Targeted By Credit Card Scrapers *** --------------------------------------------- We've been writing a lot about E-Commerce hacks and PCI Compliance recently. The more people buy things online, the more of an issue this will be come and the more important it will .. --------------------------------------------- https://blog.sucuri.net/2015/06/magento-platform-targeted-by-credit-card-sc… *** MMD-0034-2015 - New ELF Linux/DES.Downloader on Elasticsearch CVE-2015-1427 exploit *** --------------------------------------------- This is a tough writing, and will be many addition will be added after the initial release. We are pushed to release this as alert of an on going attack, it is a real malware incident .. --------------------------------------------- http://blog.malwaremustdie.org/2015/06/mmd-0034-2015-new-elf.html *** That shot you heard? SSLv3 is now DEAD *** --------------------------------------------- Its joined the choir invisible We really, really, really mean it this time: take SSL3 and bury .. --------------------------------------------- http://www.theregister.co.uk/2015/06/26/that_shot_you_heard_sslv3_is_now_de… *** EU-Ermittler zerschlagen Ring von Online-Banking-Betrügern *** --------------------------------------------- Verschiedenen Behörden aus Europa haben eine erfolgreiche Operation gegen Cyber-Kriminelle durchgeführt, die im großen Stil über alle Kontinente verteilt Banking-Trojaner eingesetzt haben. --------------------------------------------- http://heise.de/-2729777 *** Windows Server 2003 noch auf Drittel aller Server: Support-Ende im Juli *** --------------------------------------------- Am 14. Juli endet der Support von Windows Server 2003, Server 2003 R2 und Small Business Server 2003. Ab dann wird es für das zwölf Jahre alte System keine neuen Updates, Hotfixes oder Sicherheits-Aktualisierung mehr geben. --------------------------------------------- http://derstandard.at/2000018075592 *** Polycom RealPresence Resource Manager critical vulnerabilities allow surveillance on conferences *** --------------------------------------------- Multiple remote vulnerabilities (arbitrary file disclosure, path traversal, arbitrary file upload, privilege escalation in the web application) combined with local vulnerabilities (sudo misconfiguration, weak filesystem permissions) allow an .. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Siemens Climatix BACnet/IP Communication Module Cross-site Scripting Vulnerability *** --------------------------------------------- This advisory provides mitigation details for an identified cross-site scripting vulnerability in the Siemens Climatix BACnet/IP communication module. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-176-01 *** PACTware Exceptional Conditions Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a handling of exceptional conditions vulnerability in the PACTware Consortium PACTware application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02 *** Latest spam filter test sees significant drop in catch rates *** --------------------------------------------- Despite a drop in catch rates, 15 products earn a VBSpam award, with four earning a VBSpam+ award.Spam is notoriously volatile and thus, while we like to make the news headlines with our tests as much as anyone, we would warn against .. --------------------------------------------- http://www.virusbtn.com/blog/2015/06_26.xml *** ZDI-15-262: HP System Management Homepage Single Sign On Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett-Packard System Management Homepage. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-262/

1 0

Tageszusammenfassung - Donnerstag 25-06-2015
by Daily end-of-shift report 25 Jun '15

25 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 24-06-2015 18:00 − Donnerstag 25-06-2015 18:00 Handler: Robert Waldner Co-Handler: n/a *** Paper: Using .NET GUIDs to help hunt for malware *** --------------------------------------------- Tool to extract identifiers incorporated into VirusTotal. The large number of new malware samples found each day hasnt made malware analysis an easier task, and researchers could use anything that helps them automate this task. Today, we publish a paper by Cylance researcher Brian Wallace, who looks at two globally unique identifiers (GUIDs) found in malware created using .NET, which can help link multiple files to the same Visual Studio project. --------------------------------------------- http://www.virusbtn.com/blog/2015/06_24a.xml?rss *** The Powershell Diaries - Finding Problem User Accounts in AD, (Wed, Jun 24th) *** --------------------------------------------- Powershell has gotten a lot of attention lately as a pentesters tool of choice, since it has access to pretty much every low-level system function in the Microsoft ecosystem, and the AV industry isnt dealing well with that yet (aside from ignoring powershell completely that is). But what about day-to-day system administration? Really, the possibilities for admins are just as limitless as for pentesters - thats what Powershell was invented for after all ! --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19833&rss *** Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-129 Project: Shibboleth authentication (third-party module) Version: 6.x, 7.x Date: 2015-June-24 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All Vulnerability: Cross Site Scripting Description Shibboleth authentication module allows users to log in and get permissions based on federated (SAML2) authentication.The module didnt filter the text that is displayed as a login link. --------------------------------------------- https://www.drupal.org/node/2511518 *** HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-127 Project: HybridAuth Social Login (third-party module) Version: 7.x Date: 2015-June-24 Security risk: 8/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypass Description The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. --------------------------------------------- https://www.drupal.org/node/2511410 *** Web security subtleties and exploitation of combined vulnerabilities, (Thu, Jun 25th) *** --------------------------------------------- The goal of a penetration test is to report all identified vulnerabilities to the customer. Of course, every penetration tester puts most of his effort into finding critical security vulnerabilities: SQL injection, XSS and similar, which have the most impact for the tested web application (and, indeed, it does not hurt a penetration testers ego when such a vulnerability is identified :) However, I strongly push towards reporting of every single vulnerability, no matter how harmless it might appear ... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19837&rss *** Samsung deaktiviert keine Sicherheitsupdates von Windows *** --------------------------------------------- PR-Desaster im Eigenbau: Samsung veröffentlicht ein Tool namens "disable_Windowsupdate.exe". Doch das macht gar nicht das, was der Name vermuten lässt. --------------------------------------------- http://www.heise.de/newsticker/meldung/Samsung-deaktiviert-keine-Sicherheit… *** Von wegen Schutz: NOD32 erlaubt das Kapern von Rechnern *** --------------------------------------------- Statt die Nutzer zu schützen erlaubte NOD32 von Eset es Angreifern, die Rechner der Opfer komplett zu übernehmen. Das Update, welches die Lücke schließt, sollte schleunigst eingespielt werden. --------------------------------------------- http://heise.de/-2728967 *** SSA-142512 (Last Update 2015-06-25): Cross-Site Scripting Vulnerability in Climatix BACnet/IP Communication Module *** --------------------------------------------- SSA-142512 (Last Update 2015-06-25): Cross-Site Scripting Vulnerability in Climatix BACnet/IP Communication Module --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** Multiple vulnerabilities in Cisco products *** *** Cisco Wireless LAN Controller Command Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39517 *** Cisco IOS XR MPLS LDP Packet Processing Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39509 *** Cisco Unified Presence Server Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39504 *** Cisco IM and Presence Service Leaked Encrypted Passwords Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39505 *** Cisco IM and Presence Service SQL Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39506

1 0

Tageszusammenfassung - Mittwoch 24-06-2015
by Daily end-of-shift report 24 Jun '15

24 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 23-06-2015 18:00 − Mittwoch 24-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Operation Clandestine Wolf � Adobe Flash Zero-Day in APT3 PhishingCampaign *** --------------------------------------------- In June, FireEye�s FireEye as a Service team in Singapore uncovered a phishing campaign exploiting an Adobe Flash Player zero-day vulnerability (CVE-2015-3113). The attackers� emails included links to compromised web servers that served either benign content or a malicious Adobe Flash Player file that exploits CVE-2015-3113. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-… *** Digital Snake Oil *** --------------------------------------------- One of the most common complaints we see on our forums, and from our users, concerns a particular category of program called �Registry Optimizers� or �Registry Cleaners� or �Registry Defragmenters�. For this post, we will just refer to them as .. --------------------------------------------- https://blog.malwarebytes.org/social-engineering/2015/06/digital-snake-oil/ *** Websites Hacked Via Website Backups *** --------------------------------------------- The past few months we�ve been spending a good deal of time talking about backups. This is for good reason, they are often your safety net when things go wrong; interestingly enough though, they are often the forgotten pillar of security. It�s why we .. --------------------------------------------- https://blog.sucuri.net/2015/06/websites-hacked-via-website-backups.html *** Cisco AnyConnect Client for Windows Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to install and execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39466 *** MMD-0033-2015 - Linux/XorDDoS infection incident report (CNC: HOSTASA.ORG) *** --------------------------------------------- This post is an actual malware infection incident of the"Linux/XOR.DDoS" malware, see this previous post as reference, malware was in attempt to infect a real service. Incident details: Source of attack: An attack .. --------------------------------------------- http://blog.malwaremustdie.org/2015/06/mmd-0033-2015-linuxxorddos-infection… *** Analysis and Exploitation of an ESET Vulnerability *** --------------------------------------------- Many antivirus products include emulation capabilities that are intended to allow unpackers to run for a few cycles before signatures are applied. ESET NOD32 uses a minifilter or kext to intercept all disk I/O, which is analyzed and then emulated if .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/analysis-and-exploitation-of-… *** Of Privacy, Security, and the Art of Scanning *** --------------------------------------------- With all the recent news and attention on world events the concept and concern around privacy has increased over the last several years. This is an excellent progression of personal protection and should be pursued .. --------------------------------------------- http://blog.shadowserver.org/2015/06/23/of-privacy-security-and-the-art-of-… *** Attacking Ruby Gem Security with CVE-2015-3900 *** --------------------------------------------- A Ruby gem is a standard packaging format used for Ruby libraries and applications. This packaging format allows Ruby software developers a clearly defined format in which they can .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Secu… *** Samsung deliberately disabling Windows Update *** --------------------------------------------- On my home forum Sysnative, a user (wavly) was being assisted with a WU issue, which was going well, aside from the fact that wavlys WU kept getting disabled randomly. It was figured out eventually after using auditpol.exe and registry security .. --------------------------------------------- http://bsodanalysis.blogspot.de/2015/06/samsung-deliberately-disabling-wind… *** Kaspersky hilft Facebook User-PCs nach Viren zu scannen *** --------------------------------------------- Facebook will die Verbreitung von Malware über das soziale Netzwerk eindämmen. Dafür werden nicht nur Profile nach verdächtigen Aktivitäten gescannt. Das Unternehmen bietet Nutzern auch die Möglichkeit an, einen kostenlosen Scan ihres Computers durchzuführen. Seit einiger Zeit .. --------------------------------------------- http://derstandard.at/2000017946165 *** Identifying vulnerable code *** --------------------------------------------- No matter how much care you take during development of any software, security issues creep in. Hence, it is important to get the code reviewed for security loopholes. Code is the only advantage for organizations over the hackers and they need .. --------------------------------------------- http://resources.infosecinstitute.com/identifying-vulnerable-code/ *** Am 30. Juni ist DNSSEC-Day *** --------------------------------------------- Am 30. Juni 2015 veranstalten das BSI, der DENIC und heise online den DNSSEC-Day. Kern der Veranstaltung ist ein Livestreaming, bei dem Fachleute Nutzen und .. --------------------------------------------- http://heise.de/-2723932 *** Results of my recent PostScript Charstring security research unveiled *** --------------------------------------------- Some months ago, I started reverse engineering and investigating the security posture of the Adobe Type Manager Font Driver (ATMFD.DLL) module, which provides support for Type 1 and OpenType fonts in the Windows kernel since Windows NT 4.0, .. --------------------------------------------- http://j00ru.vexillium.org/?p=2520

1 0

Tageszusammenfassung - Dienstag 23-06-2015
by Daily end-of-shift report 23 Jun '15

23 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 22-06-2015 18:00 − Dienstag 23-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Security updates available for Adobe Flash Player (APSB15-14) *** --------------------------------------------- A Security Bulletin (APSB15-14) has been published regarding security updates for Adobe Flash Player. These updates address a critical vulnerability (CVE-2015-3113), and Adobe recommends users update their product installations to the latest .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1210 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39439 http://tools.cisco.com/security/center/viewAlert.x?alertId=39440 http://tools.cisco.com/security/center/viewAlert.x?alertId=39455 http://tools.cisco.com/security/center/viewAlert.x?alertId=39457 http://tools.cisco.com/security/center/viewAlert.x?alertId=39459 http://tools.cisco.com/security/center/viewAlert.x?alertId=39460 http://tools.cisco.com/security/center/viewAlert.x?alertId=39377 http://tools.cisco.com/security/center/viewAlert.x?alertId=39458 *** �Free� Proxies Aren�t Necessarily Free *** --------------------------------------------- Netflix, Hulu and a host of other content streaming services block non-U.S. users from viewing their content. As a result, many people residing in or traveling outside of the United States seek to circumvent such restrictions by using services that advertise "free" and "open" Web proxies capable of .. --------------------------------------------- http://krebsonsecurity.com/2015/06/free-proxies-arent-necessarily-free *** Security hole in MacKeeper used to shove malware onto Macs *** --------------------------------------------- According to researchers at BAE, a recent Mac malware infestation was carried out using a security hole in a utility called MacKeeper. --------------------------------------------- https://nakedsecurity.sophos.com/2015/06/22/security-hole-in-mackeeper-used… *** New Dridex infection vector identified - Banking Trojan�s authors use Microsoft Office trick and a legitimate service to infect systems *** --------------------------------------------- Malware authors can sometimes be creative in order to manipulate their human targets on the one hand and to circumvent security products, too. The experts of G DATA�s SecurityLabs analyzed a specially crafted Microsoft Word document .. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/new-dridex-infection-vector-ide… *** XOR DDOS Mitigation and Analysis, (Tue, Jun 23rd) *** --------------------------------------------- I have struggled over the past recent months with a clients environment becoming infected and reinfected with an XOR DDOS trojan. The disruption and reinfection rates were costly at times. The client in question .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19827 *** This Radio Bug Can Steal Laptop Crypto Keys, Fits Inside a Pita *** --------------------------------------------- The list of paranoia-inducing threats to your computer�s security grows daily: Keyloggers, trojans, infected USB sticks, ransomware�and now the rogue falafel sandwich. --------------------------------------------- http://www.wired.com/2015/06/radio-bug-can-steal-laptop-crypto-keys-fits-in… *** mTAN-Trojaner hat es erneut auf Android-Nutzer abgesehen *** --------------------------------------------- Gefälschte E-Mails im Namen der Postbank machen aktuell die Runde und fordern Nutzer dazu auf, eine SSL-Zertifikat-App zu installieren. Dahinter verbirgt sich jedoch ein Trojaner, der unter anderem mTANs für Online-Banking mitschneidet. --------------------------------------------- http://heise.de/-2721682 *** Moose Malware-Part 1 *** --------------------------------------------- In this article series, we will learn about a famous Linux family of malware known as MOOSE, which is used to steal unencrypted traffic over the wire and infect other devices automatically. This malware steals HTTP cookies and performs .. --------------------------------------------- http://resources.infosecinstitute.com/moose-malware-part-1/ *** Edges for file renames and process kills. *** --------------------------------------------- With build 47 ProcDOT introduced brand new edges to visualize situations where a file is being renamed or a process is being killed by some thread. While the latter was quite easy to implement it�s the renaming of files which stands out of the mass of typical frames/events in terms of ProcDOT�s animation capabilities. --------------------------------------------- http://procdot.com/blog_20150623.htm *** Support-Ende beim Windows Server 2003 am 14. Juli *** --------------------------------------------- Länger als Windows XP hat Microsoft sein Server-Betriebssystem derselben Generation mit Sicherheits-Updates versorgt. Aber am 14. Juli ist damit endgültig Schluss. --------------------------------------------- http://www.heise.de/newsticker/meldung/Support-Ende-beim-Windows-Server-200…

1 0

Tageszusammenfassung - Montag 22-06-2015
by Daily end-of-shift report 22 Jun '15

22 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 19-06-2015 18:00 − Montag 22-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Owning Internet Printing - A Case Study in Modern Software Exploitation *** --------------------------------------------- Modern exploit mitigations draw attackers into a game of diminishing marginal returns. With each additional mitigation added, a subset of software bugs become unexploitable, .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/owning-internet-printing-case… *** Cacti Input Validation Flaw Permits Cross-Site Scripting and SQL Injection Attacks *** --------------------------------------------- The software does not properly filter HTML code from user-supplied input before displaying the input [CVE-2015-2665]. A remote user can cause arbitrary scripting code to be executed by the target user's browser. The .. --------------------------------------------- http://www.securitytracker.com/id/1032672 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39432 http://tools.cisco.com/security/center/viewAlert.x?alertId=39431 http://tools.cisco.com/security/center/viewAlert.x?alertId=39422 http://tools.cisco.com/security/center/viewAlert.x?alertId=39424 http://tools.cisco.com/security/center/viewAlert.x?alertId=39423 *** Banking Trojan has targeted Bundestag *** --------------------------------------------- After the initial reports on the attacks on the Bundestag (German Federal Parliament), variants of the Swatbanker family are now putting the Bundestags intranet on a watch list. The operators of the botnet are apparently trying to steal access data and server responses associated with this .. --------------------------------------------- https://blog.gdatasoftware.com/blog/article/banking-trojan-has-targeted-bun… *** Microsoft website dedicated to online privacy gets hacked *** --------------------------------------------- Digital Constitution was running outdated of version of WordPress. --------------------------------------------- http://arstechnica.com/security/2015/06/microsoft-website-dedicated-to-onli… *** Microsoft: Meine Lücken schließ' ich nicht *** --------------------------------------------- Sicherheitsexperten geben Details zu Lücken in Internet Explorer heraus, weil Microsoft die Lücken nicht schließen will. --------------------------------------------- http://heise.de/-2718449 *** Standardschlüssel gefährdet SAPs Datenbank Hana *** --------------------------------------------- Bei der Installation wird die Benutzerdatenbank in SAPs Hana mit dem stets gleichen Standardschlüssel abgesichert. Weil dieser nur selten geändert wird, könnten sich Unberechtigte leicht Zugriff auf die dort gespeicherten Administratorkonten verschaffen. --------------------------------------------- http://www.golem.de/news/it-sicherheit-standardschluessel-gefaehrdet-saps-d… *** VMware Workstation: Der Einbruch �über Port COM1 *** --------------------------------------------- Über Schwachstellen in VMwares Workstation und Player ist ein vollständiger Zugriff auf das Wirtssystem aus einem Gastsystem heraus möglich. VMware hat bereits Updates veröffentlicht. --------------------------------------------- http://www.golem.de/news/vmware-workstation-der-einbruch-ueber-port-com1-15… *** Advertising: The Digital Turf War on your Desktop *** --------------------------------------------- https://blog.malwarebytes.org/privacy-2/2015/06/advertising-the-digital-tur… *** XARA-Lücke: Apple kündigt Fix für iOS und OS X an *** --------------------------------------------- Das Sicherheitsproblem, über das unter anderem Passwörter ausgelesen werden könnten, soll demnächst in der Software behoben werden. Zudem versucht sich der iPhone-Hersteller an anderen Lösungen. --------------------------------------------- http://heise.de/-2718624 *** The most common information security mistakes of e-commerces *** --------------------------------------------- Almost every month a new incident involving a big retailer, e-commerce or web platform makes the news headlines. Most retail fraud is now committed online, and in 2014 alone hackers managed to steal more than 61 million records from .. --------------------------------------------- https://www.htbridge.com/blog/the-most-common-information-security-mistakes… *** Adware for OS X distributes Trojans *** --------------------------------------------- Lately, reports about distribution of new malicious and potentially dangerous programs for OS X have been emerging with great frequency. Doctor Web security researches have registered a growing number of various adware and installers .. --------------------------------------------- http://news.drweb.com/show/?i=9502&lng=en&c=9 *** Steal That Car in 60 Seconds *** --------------------------------------------- Introduction Cars are everywhere and they are being upgraded with new technology as often as any other device we use. Taking some inspiration from the movie Knight and Day, .. --------------------------------------------- http://resources.infosecinstitute.com/the-car-in-60-seconds/ *** NSA spionierte österreichische Antiviren-Hersteller aus *** --------------------------------------------- Ikarus und Emsisoft genannt – NSA überwachte E-Mails an Firmen, um Entdeckung von Schadprogrammen mitzubekommen --------------------------------------------- http://derstandard.at/2000017842807 *** Magnitude EK: Traffic Analysis *** --------------------------------------------- Hello and welcome! Recently I have been skilling up in malware analysis. Specifically, my focus has been centred on client-side exploit kits, such common kits include: Angler, Nuclear, Magnitude, Neutrino, RIG... There are quite a few reasons for my new found .. --------------------------------------------- http://www.fuzzysecurity.com/tutorials/21.html *** Android Activtity Security *** --------------------------------------------- Each Android Application is made up of Activity, Service, Content Provider and Broadcast Receiver, which are the basic components of Android. Among those components, An Activity is .. --------------------------------------------- http://translate.wooyun.io/2015/06/22/android-activtity-security.html *** A month with BADONIONS *** --------------------------------------------- A few weeks ago I got the idea of testing how much sniffing is going on in the Tor network by setting up a phishing site where I login with unique password and then store them. I .. --------------------------------------------- https://chloe.re/2015/06/20/a-month-with-badonions/ *** Poseidon and Backoff POS � the links and similarities *** --------------------------------------------- Poseidon, also known as FindPOS, is a malware family designed for Windows point-of-sale systems. Poseidon scans the memory for running processes and employs keystroke logging .. --------------------------------------------- https://blog.team-cymru.org/2015/06/poseidon-and-the-backoff-pos-link *** Bypassing Microsoft EMET 5.2 - a neverending story? *** --------------------------------------------- The experts of the SEC Consult Vulnerability Lab managed to adapt the EMET 5.0 / 5.1 bypasses to additionally work against the latest Microsoft EMET version which is 5.2. Results of the research were already presented this year at .. --------------------------------------------- http://blog.sec-consult.com/2015/06/bypassing-microsoft-emet-52-neverending…

1 0

Tageszusammenfassung - Freitag 19-06-2015
by Daily end-of-shift report 19 Jun '15

19 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 18-06-2015 18:00 − Freitag 19-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** So Long, and Thanks for All the Domains *** --------------------------------------------- While Trojans like Dyre and Dridex are dominating malware-related news, we take the time to have a closer look at Tinba (Tiny Banker, Zusy, Illi), yet another Trojan which targets Windows users. In the first part of this post, we... --------------------------------------------- http://securityblog.switch.ch/2015/06/18/so-long-and-thanks-for-all-the-dom… *** Understanding type confusion vulnerabilities: CVE-2015-0336 *** --------------------------------------------- In March 2014, we observed a patched Adobe Flash vulnerability (CVE-2015-0336) being exploited in the wild. Adobe released the patch on March 12, 2014, and exploit code using this vulnerability first appeared about a week later. To help stay protected: Keep your Microsoft security software, such as Windows Defender for Windows 8.1 up-to-date. Keep your third-party software, such as Adobe Flash Player, up-to-date. Be cautious when browsing potentially malicious or compromised websites. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/18/understanding-type-confu… *** Tapatalk-Plug-in liest Daten von Forennutzern aus *** --------------------------------------------- Wie die Administratoren des HardwareLuxx-Forums entdeckten, liest das Plug-in der Mobil-App die E-Mail-Adressen ihrer 200.000 Nutzer auf Anfrage aus und schickt diese an eigene Server. Tapatalk hält das Ganze für ein Versehen. --------------------------------------------- http://heise.de/-2716662 *** Paper: Beta exploit pack: one more piece of crimeware for the infection road! *** --------------------------------------------- Exploit kit currently being tested focuses primarily on Flash Player exploits.Nuclear, Angler, Magnitude and Rig. Security researchers know were talking about exploit kits (or browser exploit packs), toolkits that automate the exploitation of client-side vulnerabilities and thus facilitate infection through drive-by downloads.Today, we publish an article by researchers Aditya K. Sood and Rohit Bansal, in which they look at a new exploit kit, Beta. Though it is still in a testing phase, Aditya... --------------------------------------------- http://www.virusbtn.com/blog/2015/06_19.xml?rss *** SAP Hana users warned of security vulnerability *** --------------------------------------------- Hard on the heels of the release of a newly updated version of SAP Hana, a security researcher has warned of a potentially serious vulnerability in the in-memory platform. "If an attacker can exploit this vulnerability, he can get access to all encrypted data stored in an SAP Hana database," said Alexander Polyakov, CTO with ERPScan, which presented the details Thursday at the Black Hat Sessions XIII conference in the Netherlands. --------------------------------------------- http://www.cio.com/article/2937953/sap-hana-users-warned-of-security-vulner… *** Identifying Your Prey *** --------------------------------------------- User hunting is one of my favorite phases of an engagement. Whether it's performed for lateral spread and escalation, or to demonstrate impact by tracking down incident responders and executives, we end up hunting for users on nearly every assessment we conduct. I presented this topic at the Shmoocon '15 Firetalks, and published the "I Hunt Sys Admins" post to help highlight some of the ways we track down where users are located in Windows domains. --------------------------------------------- http://www.verisgroup.com/2015/06/17/identifying-your-prey/ *** an awesome list of honeypot resources *** --------------------------------------------- A curated list of awesome honeypots, tools, components and much more. The list is divided into categories such as web, services, and others, focusing on open source projects. There is no pre-established order of items in each category, the order is for contribution. If you want to contribute, please read the guide. --------------------------------------------- https://github.com/paralax/awesome-honeypots *** The Samsung SwiftKey Vulnerability - What You Need To Know, And How To Protect Yourself *** --------------------------------------------- Recently, researchers announced that a vulnerability in Samsung Android devices had been found which allowed attackers to run malicious code on vulnerable devices if they became the targets of a man-in-the-middle attack. In this post we will explain how this vulnerability works, and what can users do to protect themselves. The Vulnerability The stock Android... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Y8_n4zFsafI/ *** Security CheatSheets - A collection of cheatsheets for various infosec tools and topics *** --------------------------------------------- These security cheatsheets are part of a project for the Ethical Hacking and Penetration Testing course offered at the University of Florida. Expanding on the default set of cheatsheets, the purpose of these cheatsheets are to aid penetration testers/CTF participants/security enthusiasts in remembering commands that are useful, but not frequently used. Most of the tools that will be covered have been included in our class and are available in Kali Linux. --------------------------------------------- http://www.kitploit.com/2015/06/security-cheatsheets-collection-of.html *** Bundestag: Linksfraktion veröffentlicht Malware-Analyse *** --------------------------------------------- Die Linksfraktion veröffentlicht im Zusammenhang mit dem Bundestags-Hack eine Analyse von Malware, die auf ihren Servern gefunden wurde. Darin wird eine Verbindung zur russischen Organisation APT28 nahegelegt. Doch wirklich überzeugend sind die Belege dafür nicht. --------------------------------------------- http://www.golem.de/news/bundestag-linksfraktion-veroeffentlicht-malware-an… *** Bugtraq: ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535797 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Content Manager Enterprise Edition (CVE-2015-0478, CVE-2015-0488, CVE-2015-1916, CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21960248 *** IBM Security Bulletin: A vulnerability in IBM Java SDK affects IBM InfoSphere Discovery (CVE-2015-0488) *** http://www.ibm.com/support/docview.wss?uid=swg21903544 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2014-0230) *** http://www.ibm.com/support/docview.wss?uid=swg21959294 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server uses an insecure hashing scheme for handling user passwords (CVE-2015-1913) *** http://www.ibm.com/support/docview.wss?uid=swg21959298 *** IBM Security Bulletin: Rational Test Control Panel component in Rational Test Workbench and Rational Test Virtualization Server affected by Apache Tomcat vulnerability (CVE-2014-0227) *** http://www.ibm.com/support/docview.wss?uid=swg21959291 *** IBM Security Bulletin: GNU C library (glibc) vulnerabilities affect IBM SmartCloud Entry (CVE-2014-6040 CVE-2014-7817) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022093 *** Wind River VXWorks TCP Predictability Vulnerability in ICS Devices *** --------------------------------------------- This advisory provides mitigation details for a TCP predictability vulnerability identified in Wind River's VxWorks. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01 *** Cisco WebEx Meeting Center Web-Based Administrative Interface User Enumeration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39420

1 0

Tageszusammenfassung - Donnerstag 18-06-2015
by Daily end-of-shift report 18 Jun '15

18 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 17-06-2015 18:00 − Donnerstag 18-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** OS X and iOS Unauthorized Cross Application Resource Access (XARA), (Thu, Jun 18th) *** --------------------------------------------- The last couple of days, a paper with details about XARA vulnerabilities in OS X and iOS is getting a lot of attention [1]. If you havent seen the term XARA before, then this is probably because cross-application-resource-access was normal in the past. Different applications has access to each others data as long as the same user ran them. But more recently, operating systems like OS X and iOS made attempts to sandbox applications and isolate applications from each other even if the same user... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19815&rss *** Apple OS X and iOS in the vulnerability spotlight - meet "CORED," also known as "XARA" *** --------------------------------------------- The security issue of the week has arrived in iOS and OS X, and its attracted a funky name already. The researchers called it XARA, but others had different ideas, and dubbed it "CORED." As in "Apple CORED." --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/Q4IwUfvQIVM/ *** IT-Sicherheitskonferenz FIRST: Ohne Vertrauen geht nichts, aber das Vertrauen geht *** --------------------------------------------- Die FIRST-Konferenz in Berlin beschäftigte sich damit, wie die Sicherheit von Computernetzen verbessert werden kann. Am Ende stand die Erkenntnis, dass die Arbeit komplizierter wird, weil Staaten zunehmend in IT-Sicherheit eingreifen. --------------------------------------------- http://heise.de/-2716841 *** Caching Out: The Value of Shimcache for Investigators *** --------------------------------------------- During a recent investigation, we found references to timestamps associated with probable malicious files that preceded the earliest known date of compromise. These Application Compatibility Cache (“Shimcache”) timestamps were the only evidence linked to this timeframe. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/06/caching_out_the_val.ht… *** Uncovering Tor users: where anonymity ends in the Darknet *** --------------------------------------------- Intelligence services have not disclosed any technical details of how they detained cybercriminals who created Tor sites to distribute illegal goods; in particular, they are not giving any clues how they identify cybercriminals who act anonymously. This may mean that the implementation of the Tor Darknet contains some vulnerabilities and/or configuration defects that make it possible to unmask any Tor user. In this research, we will present practical examples to demonstrate how Tor users may... --------------------------------------------- http://securelist.com/analysis/publications/70673/uncovering-tor-users-wher… *** Drupal-Lücken erlauben das Kapern von Admin-Konten *** --------------------------------------------- In Drupal 6 und 7 klaffen vier Sicherheitslücken. Die schwerwiegendste erlaubt es Angreifer, Admin-Konten des CMS über OpenID zu kapern. Updates, welche die Lücken schließen, stehen zum Download bereit. --------------------------------------------- http://heise.de/-2715975 *** Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CORE-2015-002Project: Drupal core Version: 6.x, 7.xDate: 2015-June-17Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass, Information Disclosure, Open Redirect, Multiple vulnerabilitiesDescriptionImpersonation (OpenID module - Drupal 6 and 7 - Critical)A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their --------------------------------------------- https://www.drupal.org/SA-CORE-2015-002 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- https://www.drupal.org/security/contrib *** Bugtraq: [security bulletin] HPSBGN03350 rev.1 - HP SiteScope Using RC4, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535785 *** Bugtraq: [security bulletin] HPSBGN03338 rev.1 - HP Service Manager running RC4, Remote Disclosure of Information *** --------------------------------------------- http://www.securityfocus.com/archive/1/535786 *** Cisco IOS XR IPv6 Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39383 *** Cisco IOS XR SSH Disconnect Error Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39402 *** Symantec Endpoint Protection Manager and Client Issues *** ---------------------------------------------  Revisions None Severity CVSS2Base ScoreImpactExploitabilityCVSS2 VectorSEPM Auth User Blind SQLi in PHP prepared state... --------------------------------------------- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=se… *** [R2] PHP < 5.4.41 Vulnerabilities Affect Tenable SecurityCenter *** --------------------------------------------- http://www.tenable.com/security/tns-2015-06 *** Rack denial of service *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103917 *** SQL Injection in EXT:sb_akronymmanager *** --------------------------------------------- It has been discovered that the extension "Akronymmanager" (sb_akronymmanager) is susceptible to SQL Injection --------------------------------------------- http://www.typo3.org/news/article/sql-injection-in-extsb-akronymmanager/ *** pure-ftpd 1.0.39 remote denial of service in glob_() *** --------------------------------------------- Topic: pure-ftpd 1.0.39 remote denial of service in glob_() Risk: Medium Text:Version 1.0.40 of pure-FTPd fixes a potential denial of service issue. From the NEWS file: - The process handling a user... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060101

1 0

Tageszusammenfassung - Mittwoch 17-06-2015
by Daily end-of-shift report 17 Jun '15

17 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 16-06-2015 18:00 − Mittwoch 17-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Unpatched OS X, iOS flaws allow password, token theft from keychain, apps *** --------------------------------------------- Six researchers from Indiana University Bloomington, Peking University and Georgia Tech have recently published a paper in which they detail the existence of critical security weaknesses in Apples OS... --------------------------------------------- http://www.net-security.org/secworld.php?id=18523 *** Security: Unverschlüsselte App-Updates gefährden Samsungs Smartphones *** --------------------------------------------- Wenn Apps ihre Aktualisierungen unverschlüsselt abholen, sind sie leicht zu manipulieren. Vor allem bei systemnahen Anwendungen ist das ein gravierendes Problem, wie ein aktueller Fall belegt, der vor allem die Galaxy-Reihe von Samsung betrifft. --------------------------------------------- http://www.golem.de/news/security-unverschluesselte-app-updates-gefaehrden-… *** CVE-2014-4114 and an Interesting AV Bypass Technique, (Tue, Jun 16th) *** --------------------------------------------- Citizenlabs recently reported on a CVE-2014-4114 campaign against pro-democracy / pro-Tibetian groups in Hong Kong. The attacks happening should not surprise anyone, nor that the attacks were sophisticated. The vulnerability itself was patched with MS14-060 and has been used by APT and crime groups for sometime. Trend Micro wrote a good write-up of the issue here. What is interesting is what, in effect, is an anti-virus bypass that was employed by the actors. This bypass was discussed in this... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19809&rss *** VU#155412: Samsung Galaxy S phones fail to properly validate Swiftkey language pack updates *** --------------------------------------------- Vulnerability Note VU#155412 Samsung Galaxy S phones fail to properly validate Swiftkey language pack updates Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, fail to properly validate Swiftkey language pack updates. Description CWE-345: Insufficient Verification of Data Authenticity - CVE-2015-2865Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, are pre-installed with a version of Swiftkey... --------------------------------------------- http://www.kb.cert.org/vuls/id/155412 *** EMC Unified Infrastructure Manager/Provisioning Authentication Flaw Lets Remote Users Access the System *** --------------------------------------------- http://www.securitytracker.com/id/1032589 *** Red Hat OpenSSL Locking Error in ssleay_rand_bytes() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032587 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Cloud Portal Appliance Pregenerated Default Host Keys Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39380 *** Cisco Prime Collaboration Manager SQL Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39365 *** Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=31998 *** Cisco Adaptive Security Appliance Encrypted IPSec or IKEv2 Packet Modification Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39366 *** [HTB23261]: OS Command Injection in Vesta Control Panel *** --------------------------------------------- Product: Vesta Control Panel v0.9.8Vulnerability Type: OS Command Injection [CWE-78]Risk level: Critical Creater: http://vestacp.comAdvisory Publication: May 20, 2015 [without technical details]Public Disclosure: June 17, 2015 CVE Reference: CVE-2015-4117 CVSSv2 Base Score: 9 (AV:N/AC:L/Au:S/C:C/I:C/A:C) Vulnerability Details: High-Tech Bridge Security Research Lab discovered critical vulnerability in Vesta Control Panel, which can be exploited to execute arbitrary system commands and gain... --------------------------------------------- https://www.htbridge.com/advisory/HTB23261 *** VU#842780: Vesta Control Panel is vulnerable to cross-site request forgery *** --------------------------------------------- Vulnerability Note VU#842780 Vesta Control Panel is vulnerable to cross-site request forgery Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview Vesta Control Panel is vulnerable to a cross-site request forgery (CSRF) attack. Description CWE-352: Cross-Site Request Forgery (CSRF) - CVE-2015-2861Vesta Control Panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has --------------------------------------------- http://www.kb.cert.org/vuls/id/842780 *** Bugtraq: ESA-2015-043: RSA Validation Manager Security Update for Multiple Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535777 *** GarrettCom Magnum Series Devices Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple vulnerabilities in GarrettCom's Magnum 6k and Magnum 10k product lines. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01-0 *** Security update available for Adobe Photoshop CC *** --------------------------------------------- Adobe has released an update for Photoshop CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. --------------------------------------------- https://helpx.adobe.com/security/products/photoshop/apsb15-12.html *** Security update available for Adobe Bridge CC *** --------------------------------------------- Adobe has released an update for Adobe Bridge CC for Windows and Macintosh. This update addresses vulnerabilities that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system. --------------------------------------------- https://helpx.adobe.com/security/products/bridge/apsb15-13.html *** Bugtraq: VCE3570: VCE Vision(TM) Intelligent Operations Cryptographic and Cleartext Vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535781 *** [R1] PHP < 5.4.41 Vulnerabilities Affect Tenable SecurityCenter *** --------------------------------------------- June 15, 2015 --------------------------------------------- http://www.tenable.com/security/tns-2015-06

1 0

Tageszusammenfassung - Dienstag 16-06-2015
by Daily end-of-shift report 16 Jun '15

16 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 15-06-2015 18:00 − Dienstag 16-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Dude, where's my heap? *** --------------------------------------------- Guest posted by Ivan Fratric, spraying 1TB of memoryThe ability to place controlled content to a predictable location in memory can be an important primitive in exploitation of memory corruption vulnerabilities. A technique that is commonly used to this end in browser exploitation is heap spraying: By allocating a large amount of memory an attacker ensures that some of the allocations happen in a predictable memory region. In order to break this technique, in Windows 8 Microsoft introduced High... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/06/dude-wheres-my-heap.html *** RFC 7540 - HTTP/2 protocol, (Mon, Jun 15th) *** --------------------------------------------- RFC 7540 has been out for a month now. What should we expect with this new version? 1. New frame: HTTP/2 implements a binary protocol with the following frame structure: Length: The length of the frame payload expressed as an unsigned 24-bit integer. Values greater than 2^14 must not be sent unless the receiver has set a larger value for SETTINGS_MAX_FRAME_SIZE parameter. Type: The 8-bit type of the frame. It determines the format and semantics of the frame.">Length: The length of the... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19799&rss *** LastPass Security Notice *** --------------------------------------------- We want to notify our community that on Friday, our team discovered and blocked suspicious activity on our network. In our investigation, we have found no evidence that encrypted user vault data was taken, nor that LastPass user accounts were accessed. The investigation has shown, however, that LastPass account email addresses, password reminders, server per user salts, and authentication hashes were compromised. --------------------------------------------- https://blog.lastpass.com/2015/06/lastpass-security-notice.html/ *** Blackhats exploiting MacKeeper hole to foist dangerous trojan *** --------------------------------------------- Peskware now net nasty Last months MacKeeper vulnerability is now being exploited in the wild to hijack Apple machines, according to BAE security researcher Sergei Shevchenko. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/16/blackhats_e… *** Odd HTTP User Agents, (Tue, Jun 16th) *** --------------------------------------------- Many web application firewalls do block odd user agents. However, decent vulnerability scanners will try to evade these simple protections by trying to emulate the user agent string of commonly used browsers. To figure out if I can distinguish bad from good, I compared some of the logs from our honeypotsto logs from a normalweb server (isc.sans.edu). Many of the top user agents hitting the honeypot are hardly seen on normal web sites, allowing me to identify possible vulnerability scanners. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19805&rss *** Phone hacking blitz hammers UK.bizs poor VoIP handsets *** --------------------------------------------- If I ever get my hands on those phreaking kids who hacked my phones... UK businesses are getting disproportionately targeted by a surge of attacks against Voice over IP (VoIP) systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/16/voip_hackin… *** iOS Application Security Part 45 - Enhancements in Damn Vulnerable iOS app version 2.0 *** --------------------------------------------- In this article, i would like to give a quick walkthrough of the new vulnerabilities and challenges that we have added in version 2.0 of Damn Vulnerable iOS app. In the Insecure Data storage section, we have added challenges for the following databases. Realm Database Couchbase Lite YapDatabase We have also added a new section... --------------------------------------------- http://resources.infosecinstitute.com/ios-application-security-part-45-enha… *** DSA-3289 p7zip - security update *** --------------------------------------------- Alexander Cherepanov discovered that p7zip is susceptible to adirectory traversal vulnerability. While extracting an archive, itwill extract symlinks and then follow them if they are referenced infurther entries. This can be exploited by a rogue archive to writefiles outside the current directory. --------------------------------------------- https://www.debian.org/security/2015/dsa-3289 *** VU#101500: Retrospect Backup Client uses weak password hashing *** --------------------------------------------- Vulnerability Note VU#101500 Retrospect Backup Client uses weak password hashing Original Release date: 15 Jun 2015 | Last revised: 15 Jun 2015 Overview Retrospect Backup Client is a client to a network-based backup utility. This client stores passwords in a hashed format that is weak and susceptible to collision, allowing an attacker to generate a password hash collision and gain access to the targets backup files. Description CWE-916: Use of Password Hash With Insufficient Computational... --------------------------------------------- http://www.kb.cert.org/vuls/id/101500 *** VU#626420: Pearson ProctorCache contains hard coded credentials *** --------------------------------------------- Vulnerability Note VU#626420 Pearson ProctorCache contains hard coded credentials Original Release date: 16 Jun 2015 | Last revised: 16 Jun 2015 Overview The Pearson ProctorCache software uses a hard coded password for administrative tasks. Description The ProctorCache is designed to cache the testing content, as well as cache the responses and maintain a client list of active test-takers. ProctorCache is a server software package installed locally within the LAN on a Windows system.CWE-259: --------------------------------------------- http://www.kb.cert.org/vuls/id/626420 *** Bugtraq: ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535776 *** Security Advisory: MIT Kerberos 5 vulnerability CVE-2014-5355 *** --------------------------------------------- (SOL16743) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16743.htm… *** RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-162-01 RLE Nova Wind Turbine HMI Unsecure Credentials Vulnerability that was published June 11, 2015, on the NCCIC/ICS-CERT web site. This updated advisory provides publicly disclosed vulnerabilities and mitigation measures for the RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01A *** IBM Security Bulletins *** --------------------------------------------- Vulnerability in Diffie-Hellman ciphers affects TS3400 (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects TS2900 (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects IBM Cognos Metrics Manager (CVE-2015-4000) Vulnerability in Diffie-Hellman ciphers affects the IBM Installation Manager and IBM Packaging Utility (CVE-2015-4000) Vulnerability with Diffie-Hellman ciphers may affect Lotus Quickr 8.5 for WebSphere Portal (CVE-2015-4000) Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Integrated Operations Management (CVE-2015-0491, CVE-2015-0459, CVE-2015-0469, CVE-2015-0458, CVE-2015-0480, CVE-2015-0488, CVE-2015-0478, CVE-2015-047...) IBM QRadar Incident Forensics 7.2.4 is vulnerable to a cross site scripting vulnerability. (CVE-2015-1919) Vulnerabilities in OpenSSL affect IBM Campaign, IBM ContactOptimization (CVE-2015-0209, CVE-2015-0286, CVE-2015-0288, CVE-2015-0292, CVE-2015-0293) Open Source Apache Tomcat prior to 6.0.42 as used in IBM QRadar Security Information and Event Manager 7.1 MR2, and 7.2.4 is vulnerable to HTTP request smuggling. (CVE-2014-0227) Vulnerabilities in OpenSSL affect IBM Campaign, IBM ContactOptimization (CVE-2014-3569) IBM Tealeaf Customer Experience is affected by a vulnerability in OpenSSL (CVE-2014-3511, CVE-2014-3512) Vulnerability in Diffie-Hellman ciphers affects IBM Operations Analytics - Predictive Insights (CVE-2015-4000) Vulnerability in OpenSSL affects IBM XIV Storage System Gen3 (CVE-2014-3570) Multiple vulnerabilities in IBM SDK Java Technology Edition affect IBM Business Process Manager and WebSphere Lombardi Edition April 2015 CPU --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us

1 0

Tageszusammenfassung - Montag 15-06-2015
by Daily end-of-shift report 15 Jun '15

15 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 12-06-2015 18:00 − Montag 15-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Hey kids, who wants to pwn a million BIOSes? *** --------------------------------------------- IT security bods warn of dysfunctional ecosystem, fraught with vulnerability The overlooked task of patching PC BIOS and UEFI firmware vulnerabilities leaves corporations wide open to attack, a new paper by security researchers warns. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/12/bios_securi… *** Oh look - JavaScript Droppers *** --------------------------------------------- In a typical drive-by-download attack scenario the shellcode would download and execute a malware binary. The malware binary is usually wrapped in a dropper that unpacks or de-obfuscates and executes it. Droppers' main goal is to launch malware without being detected by antiviruses and HIPS. Nowadays the most popular way of covert launching would probably... --------------------------------------------- http://labs.bromium.com/2015/06/12/oh-look-javascript-droppers/ *** NTP für Windows: Schaltsekunde könnte Probleme bereiten *** --------------------------------------------- Wer den NTP-Client für Windows installiert hat, sollte vor dem 30. Juni ein Update durchführen --------------------------------------------- http://derstandard.at/2000017430786 *** Windows Server 2003 End of Life: You Can't RIP *** --------------------------------------------- Windows XP reached end of support last year and now it's time for another end of life: Windows Server 2003. On July 14, 2015, this widely deployed Microsoft operating system will reach its end of life - a long run since its launch in April 2003. Estimates on the number of still-active Windows Server 2003 users vary from... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/FwOEN1rriTc/ *** OPM hack: Vast amounts of extremely sensitive data stolen *** --------------------------------------------- The extent of the breach suffered by the US Office of Personnel Management has apparently widened. Reports are coming in that the hackers have not only accessed Social Security numbers, job assign... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/FaMAmsBY66Y/secworld.php *** Dnstwist variiert und testet Domainnamen *** --------------------------------------------- Wer überwachen will, wie Vertipper- und Phishing-Domains für einen Domainnamen verbreitet sind, kann das Python-Skript Dnstwist nutzen. Es übernimmt viel Handarbeit und hilft bei der Analyse. --------------------------------------------- http://heise.de/-2690418 *** The top mistakes banks make defending against hackers *** --------------------------------------------- Many financial institutions fail to perform comprehensive risk analysis and assessment, exposing their companies and clients to enormous risk. --------------------------------------------- https://www.htbridge.com/blog/the-top-mistakes-banks-make-defending-against… *** Call to participate in the EU28 Cloud Security Conference *** --------------------------------------------- On June 16, in Riga, the Ministry of Defence of the Republic of Latvia and the European Union Agency for Network and Information Security (ENISA) will organise the EU28 Cloud Security Conference: Reaching the Cloud Era in the European Union. The participants of the conference will discuss the cloud security in the two parallel tracks: "Legal & Compliance" and "Technologies and Solutions". --------------------------------------------- http://www.enisa.europa.eu/media/news-items/call-to-participate-in-the-eu28… *** The Duqu 2.0 persistence module *** --------------------------------------------- We have described how Duqu 2.0 does not have a normal "persistence" mechanism. This can lead users to conclude that flushing out the malware is as simple as rebooting all the infected machines. In reality, things are a bit more complicated. --------------------------------------------- http://securelist.com/blog/research/70641/the-duqu-2-0-persistence-module/ *** Duqu 2.0 Attackers Used Stolen Foxconn Certificate to Sign Driver *** --------------------------------------------- The attackers behind the recently disclosed Duqu 2.0 APT have used stolen digital certificates to help sneak their malware past security defenses, and one of the certificates used in the attacks was issued to Foxconn, the Chinese company that manufactures products for Apple, BlackBerry, Dell, and many other companies. Researchers at Kaspersky Lab, who discovered... --------------------------------------------- http://threatpost.com/duqu-2-0-attackers-used-stolen-foxconn-certificate-to… *** Massive route leak causes Internet slowdown *** --------------------------------------------- Earlier today a massive route leak initiated by Telekom Malaysia (AS4788) caused significant network problems for the global routing system. Primarily affected was Level3 (AS3549 - formerly known as Global Crossing) and their customers. Below are some of the details as we know them now. --------------------------------------------- https://www.bgpmon.net/massive-route-leak-cause-internet-slowdown/ *** Cisco issues 16 patches to pop pesky peccant packets *** --------------------------------------------- Remote code execution for some, denial of service for the rest of us Cisco has issued a string of patches for 16 faults including a fix for a possible remote code execution in its IOS and IOS XE routing software. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/15/cisco_ipv6_… *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco Email Security Appliance Anti-Spam Scanner Bypass Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39339 *** Cisco IOS Software TCL Script Interpreter Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39343 *** Cisco Virtualization Experience Client 6215 Devices Command Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39347 *** Novell ZENworks Mobile Management Input Validation Flaw Permits Cross-Site Scripting Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032576 *** Novell Messenger 3.0 Support Pack 1 *** --------------------------------------------- Abstract: Novell Messenger 3.0 Support Pack 1 has been released. Please be aware that there are security fixes to Messengers server and client components (see the change log below and the Readme documentation on the web). It is recommended that they are updated on an expedited basis.Document ID: 5212230Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:consoleone1.3.6h_windows.zip (46.82 MB)nm301_full_linux_multi.tar.gz (269.54 MB)nm301_client_mac_multi.zip (40.62... --------------------------------------------- https://download.novell.com/Download?buildid=o8Y11QiTuc4~ *** DSA-3285 qemu-kvm - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu-kvm, a fullvirtualization solution on x86 hardware. --------------------------------------------- https://www.debian.org/security/2015/dsa-3285 *** DSA-3284 qemu - security update *** --------------------------------------------- Several vulnerabilities were discovered in qemu, a fast processoremulator. --------------------------------------------- https://www.debian.org/security/2015/dsa-3284 *** DSA-3288 libav - security update *** --------------------------------------------- Several security issues have been corrected in multiple demuxers anddecoders of the libav multimedia library. A full list of the changes isavailable at https://git.libav.org/?p=libav.git;a=blob;f=Changelog;hb=refs/tags/v11.4 --------------------------------------------- https://www.debian.org/security/2015/dsa-3288 *** DSA-3287 openssl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in OpenSSL, a Secure SocketsLayer toolkit. --------------------------------------------- https://www.debian.org/security/2015/dsa-3287 *** DSA-3286 xen - security update *** --------------------------------------------- Multiple security issues have been found in the Xen virtualisationsolution: --------------------------------------------- https://www.debian.org/security/2015/dsa-3286 *** Vulnerabilities in multiple third party TYPO3 CMS extensions *** --------------------------------------------- *** SQL Injection vulnerability in extension FAQ - Frequently Asked Questions (js_faq) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Developer Log (devlog) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Smoelenboek (ncgov_smoelenboek) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension Store Locator (locator) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** SQL Injection vulnerability in extension wt_directory (wt_directory) *** http://www.typo3.org/news/article/sql-injection-vulnerability-in-extension-… *** Arbitrary Code Execution in extension Frontend User Upload (feupload) *** http://www.typo3.org/news/article/arbitrary-code-execution-in-extension-fro… *** Cross-Site Scripting in extension BE User Log (beko_beuserlog) *** http://www.typo3.org/news/article/cross-site-scripting-in-extension-be-user… *** Arbitrary Code Execution in extension Job Fair (jobfair) *** http://www.typo3.org/news/article/arbitrary-code-execution-in-extension-job… *** Security Advisory - Web UI Authentication Vulnerability in Huawei E5756S *** --------------------------------------------- Jun 15, 2015 18:00 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** Filezilla 3.11.0.2 sftp module denial of service vulnerability *** --------------------------------------------- Topic: Filezilla 3.11.0.2 sftp module denial of service vulnerability Risk: Medium Text: # Exploit title: filezilla 3.11.0.2 sftp module denial of service vulnerability # Date: 5-6-2015 # Vendor homepage: http... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060077 *** putty v0.64 denial of service vulnerability *** --------------------------------------------- Topic: putty v0.64 denial of service vulnerability Risk: Medium Text: # Exploit title: putty v0.64 denial of service vulnerability # Date: 5-6-2015 # Vendor homepage: http://www.chiark.green... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060076 *** E-Detective Lawful Interception System multiple security vulnerabilities *** --------------------------------------------- Topic: E-Detective Lawful Interception System multiple security vulnerabilities Risk: Medium Text:Advisory: E-Detective Lawful Interception System multiple security vulnerabilities Date: 14/06/2015 CVE: ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015060075

1 0

Tageszusammenfassung - Freitag 12-06-2015
by Daily end-of-shift report 12 Jun '15

12 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 11-06-2015 18:00 − Freitag 12-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Gamarue dropping Lethic bot *** --------------------------------------------- The Gamarue (aka Andromeda) botnet is a highly modular botnet family that allows attackers to take complete control of an infected system and perform a range of malicious activity by downloading additional payloads. In this blog, we will cover a recent Gamarue .. --------------------------------------------- http://research.zscaler.com/2015/06/gamarue-dropping-lethic-bot.html *** Popcash Malvertising Leads to CryptoWall *** --------------------------------------------- End users face the harsh reality of malvertising with CryptoWall ransomware dropped on their systems. --------------------------------------------- https://blog.malwarebytes.org/malvertising-2/2015/06/popcash-malvertising-l… *** RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability *** --------------------------------------------- This advisory provides publicly disclosed vulnerabilities and mitigation measures for the RLE Nova-Wind Turbine HMI Unsecure Credentials Vulnerability. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-162-01 *** Microsoft flags Ask toolbar as unwanted and dangerous *** --------------------------------------------- >From this month on, all versions of Ask.coms infamous browser toolbar except the very last will be detected as unwanted .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18506 *** The June 2015 issue of our SWITCH Security Report is available! *** --------------------------------------------- Dear Reader! A new issue of our monthly SWITCH Security Report has just been released. The topics covered in this report are: What do tax authorities and contact sites have in .. --------------------------------------------- http://securityblog.switch.ch/2015/06/12/the-june-2015-issue-of-our-switch-… *** Integrating PaX into Android *** --------------------------------------------- The PaX project provides many exploit mitigation features to harden the Linux kernel far beyond the baseline security features provided by upstream. Android is close enough to a normal Linux distribution for it to work quite well out-of-the-box .. --------------------------------------------- https://copperhead.co/2015/06/11/android-pax *** Phisher setzen auf Geo-Blocking *** --------------------------------------------- Damit Phishing-Seiten länger überleben, lassen sich manche von ihnen nur aus dem Land abrufen, auf das es die Cyber-Ganoven abgesehen haben. Phishing-Filterdienste bleiben deshalb außen vor und schöpfen keinen Verdacht. --------------------------------------------- http://www.heise.de/security/meldung/Phisher-setzen-auf-Geo-Blocking-268948… *** Dyre Configuration Dumper *** --------------------------------------------- It�s been over a year since Dyre first appeared, and with a rise of infections in 2015, it doesn�t look like the attackers are stopping anytime soon. At PhishMe we�ve been .. --------------------------------------------- http://phishme.com/dyre-configuration-dumper/ *** OpenSSL-Update verursacht ABI-Probleme *** --------------------------------------------- OpenSSL veröffentlicht Updates für kleinere Sicherheitslücken - dabei ist den Entwicklern ein Fehler unterlaufen: Durch eine veränderte Datenstruktur ändert sich die Binärschnittstelle der Bibliothek, was zu Fehlfunktionen führen kann. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-openssl-update-verursacht-abi-p… *** How Heartbleed couldve been found *** --------------------------------------------- tl;dr With a reasonably simple fuzzing setup I was able to rediscover the Heartbleed bug. This uses state-of-the-art fuzzing and memory protection technology (american fuzzy lop and Address Sanitizer), but it doesnt require any prior knowledge about .. --------------------------------------------- https://blog.hboeck.de/archives/868-How-Heartbleed-couldve-been-found.html

1 0

Tageszusammenfassung - Donnerstag 11-06-2015
by Daily end-of-shift report 11 Jun '15

11 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 10-06-2015 18:00 − Donnerstag 11-06-2015 18:00 Handler: Alexander Riepl Co-Handler: Stephan Richter *** Increase in CryptoWall 3.0 from malicious spam and Angler exploit kit, (Thu, Jun 11th) *** --------------------------------------------- Introduction Since Monday2015-05-25(a bitmore than 2 weeks ago), weve seen a significantamount of CryptoWall 3.0 ransomware from">) and theAngler exploit kit (EK). A malspam campaign pushing CryptoWall 3.0 started as early as Monday 2015-05-25, but it hasincreased significantly since Monday 2015-06-08. The CryptoWall3.0push from Angler EK appears to have started around the same time. Both campaigns (malspam and Angler EK) were active as recently as Wednesday 2015-06-10. The timing of... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19785&rss *** Factsheet: Software has an expiry date *** --------------------------------------------- Software vendors regularly make announcements that certain versions of software will no longer be supported after a particular date. Such dates are known as End-of-Life. After the End-of-Life, software is no longer supported and can therefore not be considered to be secure. The NCSC advises to update systems after the announcement as soon as possible. --------------------------------------------- https://www.ncsc.nl/english/services/expertise-advice/knowledge-sharing/fac… *** Cyberangriff: Bundestag benötigt komplett neues Computer-Netzwerk *** --------------------------------------------- Das Computer-Netzwerk im Bundestag ist hinüber. Der Cyberangriff auf den deutschen Bundestag hat weitreichendere Folgen als bisher angenommen. Das Parlament muss ein völlig neues Computer-Netzwerk errichten. --------------------------------------------- http://www.golem.de/news/cyberangriff-bundestag-benoetigt-komplett-neues-co… *** Bundestag: "Von einem Totalschaden kann keine Rede sein" *** --------------------------------------------- Nur 15 Rechner sollen von dem Hacker-Angriff auf den Bundestag betroffen sein. Das berichtet der Unionsabgeordnete Thomas Jarzombek und beruft sich auf das BSI. --------------------------------------------- http://www.golem.de/news/bundestag-von-einem-totalschaden-kann-keine-rede-s… *** MSRT June 2015: BrobanDel *** --------------------------------------------- Providing further protections for our customers, this month we added three new malware families and two variants to the Microsoft Malicious Software Removal Tool (MSRT): Win32/Bagopos Win32/BrobanDel Win32/Gatak PWS:Win32/OnLineGames.AH PWS:Win32/OnLineGames.MV Gatak is a family of information-stealing malware that collects sensitive information and sends it to a remote attacker, if a system is compromised. Bagopos is another information-stealing malware family that targets credit card... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/09/msrt-june-2015-brobandel… *** Windows 10 to offer application developers new malware defenses *** --------------------------------------------- Application developers can now actively participate in malware defense - in a new way to help protect customers from dynamic script-based malware and non-traditional avenues of cyberattack. Microsoft is making that possible through the Antimalware Scan Interface (AMSI) - a generic interface standard that allows applications and services to integrate with any antimalware product present on a machine. AMSI is currently available through the Windows 10 Technical Preview, and will be fully... --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/06/09/windows-10-to-offer-appl… *** Advances in Scripting Security and Protection in Windows 10 and PowerShell V5 *** --------------------------------------------- In the last several releases of Windows, we've been working hard to make the platform much more powerful for administrators, developers, and power users alike. PowerShell is an incredibly useful and powerful language for managing Windows domains. Unfortunately, attackers can take advantage of these same properties when performing "post-exploitation" activities (actions that are performed after a system has been compromised). The PowerShell team, recognizing this behavior, have --------------------------------------------- http://blogs.technet.com/b/srd/archive/2015/06/10/advances-in-scripting-sec… *** CSDanube *** --------------------------------------------- CERT.at ist keine isolierte Einrichtung, im Gegenteil: Wir kooperieren in diversen Kreisen mit anderen Institutionen und Firmen. Das reicht von unserer Einbettung in die Umsetzung der ÖSCS, lokalen Partnern in der Industrie und Forschung bis hin zur globalen Vernetzung der CERTs. In diesem Kontext nehmen wir an einem Projekt teil, dass im Rahmen des START Programms der Danube Region Strategy gefördert wird: Es geht bei diesem Projekt darum, dass die CERTs der Region... --------------------------------------------- http://www.cert.at/services/blog/20150611115640-1547.html *** Security Advisory: Object Injection Vulnerability in WooCommerce *** --------------------------------------------- Security Risk: Dangerous Exploitation Level: Easy/Remote DREAD Score: 8/10 Vulnerability: Object Injection Patched Version: 2.3.11 During a routine audit for our WAF, we discovered a dangerous Object Injection vulnerability which could, in certain contexts, be used by an attacker to download any file on the vulnerable server. Are you at risk? The vulnerability is only... --------------------------------------------- https://blog.sucuri.net/2015/06/security-advisory-object-injection-vulnerab… *** Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities *** --------------------------------------------- This advisory provides publicly disclosed vulnerabilities and compensating measures for the Hospira Plum A+ and Symbiq Infusion System that are similar to vulnerabilities identified in the Hospira LifeCare PCA Infusion System discussed in the updated advisory ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-161-01 *** HPSBUX03337 SSRT102066 rev.1 - HP-UX Apache Web Server Suite running Apache Web Server, Tomcat v6.x, or PHP v5.4.x, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with the HP-UX Apache Web Server Suite, Tomcat Servlet Engine, and PHP. These could be exploited remotely to create a Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04686230 *** Cisco IOS XR telnetd Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39293 *** Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39280 *** Cisco Identity Services Engine Improper Web Page Controls Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39299

1 0

Tageszusammenfassung - Mittwoch 10-06-2015
by Daily end-of-shift report 10 Jun '15

10 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 09-06-2015 18:00 − Mittwoch 10-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39256 http://tools.cisco.com/security/center/viewAlert.x?alertId=39257 http://tools.cisco.com/security/center/viewAlert.x?alertId=39240 *** MS15-JUN - Microsoft Security Bulletin Summary for June 2015 - Version: 1.0 *** --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-JUN *** VMSA-2015-0004 *** --------------------------------------------- VMware Workstation, Fusion and Horizon View Client updates address critical security issues .. --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0004.html *** Vawtrak Uses Tor2Web making hard to track down its servers *** --------------------------------------------- Security experts at Fortinet uncovered a new strain of the Vawtrak banking Trojan is implementing an obscuring mechanism based on the Tor2Web service. The authors of the banking Trojan Vawtrak are adopting a new tactic to hide the .. --------------------------------------------- http://securityaffairs.co/wordpress/37682/malware/vawtrak-uses-tor2web.html *** iOS und OS X: Apple könnte HTTPS für Apps erzwingen *** --------------------------------------------- Entwickler von Apps für iOS und OS X sollten "so schnell wie möglich" auf sichere Verbindungen per HTTPS wechseln, empfiehlt Apple. Das Unternehmen könnte die Verschlüsselung gar für die Aufnahme im App Store erzwingen. --------------------------------------------- http://www.golem.de/news/ios-und-os-x-apple-koennte-https-fuer-apps-erzwing… *** Schlag gegen internationale Bande von Cyber-Kriminellen in Europa *** --------------------------------------------- http://derstandard.at/2000017259662 *** N-Tron 702W Hard-Coded SSH and HTTPS Encryption Keys *** --------------------------------------------- This advisory provides mitigation details for hard-coded SSH and HTTPS encryption keys in the N-Tron 702-W Industrial Wireless Access Point device. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-160-01 *** Sinapsi eSolar Light Plaintext Passwords Vulnerability *** --------------------------------------------- This advisory provides mitigation details for plain text passwords in the Sinapsi eSolar Light application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-160-02 *** Adobe, Microsoft Issue Critical Security Fixes *** --------------------------------------------- Adobe today released software updates to plug at least 13 security holes in its Flash Player software. Separately, Microsoft pushed out fixes for at least three dozen flaws .. --------------------------------------------- http://krebsonsecurity.com/2015/06/adobe-microsoft-issue-critical-security-… *** The Mystery of Duqu 2.0: a sophisticated cyberespionage actor returns *** --------------------------------------------- Kaspersky Lab uncovers Duqu 2.0 � a highly sophisticated malware platform exploiting up to three zero-day vulnerabilities. --------------------------------------------- http://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophist… *** Duqu 2.0 *** --------------------------------------------- In our full report, available at http://www.crysys.hu/duqu2/duqu2.pdf, we point out numerous similarities that we discovered between Duqu and Duqu 2.0, .. --------------------------------------------- http://blog.crysys.hu/2015/06/duqu-2-0/ *** Microsoft pusht HTTPS beim Internet Explorer und Edge-Webbrowser *** --------------------------------------------- Ab sofort sollen der Internet Explorer und Webbrowser von Windows 10 Edge das verschlüsselte Surfen über HTTPS vorantreiben. Dafür hat Microsoft jetzt Updates verteilt, die HSTS einführen. --------------------------------------------- http://heise.de/-2687051 *** Xen Security Advisory CVE-2015-3209 / XSA-135 *** --------------------------------------------- The QEMU security team has predisclosed the following advisory: pcnet_transmit loads a transmit-frame descriptor from the guest into the /tmd/ local variable to recover a length field, a status field and a guest-physical location of the associated .. --------------------------------------------- http://www.openwall.com/lists/oss-security/2015/06/10/3 *** Russische Hacker sollen hinter Cyber-Angriff auf TV-Sender stecken *** --------------------------------------------- Nicht – wie bisher angenommen – der Islamistischer Staat (IS), sondern russische Profi-Hacker sollen im April den Sendebetrieb von TV5 lahm gelegt haben. Die platzierte IS-Propaganda sei möglicherweise nur ein Täuschungsmanöver gewesen. --------------------------------------------- http://heise.de/-2687434

1 0

Tageszusammenfassung - Dienstag 9-06-2015
by Daily end-of-shift report 09 Jun '15

09 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 08-06-2015 18:00 − Dienstag 09-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Bug Bounties in Crosshairs of Proposed US Wassenaar Rules *** --------------------------------------------- Bug bounties and rewards programs provide researchers with a measure of income, and if the proposed Wassenaar rules are implemented in the U.S., that initiatives could be adversely impacted. --------------------------------------------- http://threatpost.com/bug-bounties-in-crosshairs-of-proposed-us-wassenaar-r… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39210 http://tools.cisco.com/security/center/viewAlert.x?alertId=38883 http://tools.cisco.com/security/center/viewAlert.x?alertId=39233 http://tools.cisco.com/security/center/viewAlert.x?alertId=39192 *** Fast look at Sundown EK *** --------------------------------------------- Disclaimer : There is nothing worth a post there...except mentionning this EK is around. I would put that "kit" in the same .. --------------------------------------------- http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html *** New Episode of Punkey PoS Malware Airs *** --------------------------------------------- Reruns from the 1980s are all the rage these days, and like the sitcom its based on, weve encountered a second run from the Punkey Point of Sale malware as part of an .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-Episode-of-Punkey-P… *** Website der US-Armee wegen Hackerangriffs vorübergehend stillgelegt *** --------------------------------------------- Wegen eines Hackerangriffs hat die US-Armee ihre Website vorübergehend stillgelegt. Nach der Entdeckung der Cyberattacke seien "geeignete Vorsichtsmaßnahmen" ergriffen .. --------------------------------------------- http://derstandard.at/2000017173834 *** Pin und Aktivierungssperre: Apple erhöht Sicherheit von iOS und der Apple Watch *** --------------------------------------------- Apple führt bei iOS 9 längere Pin-Codes ein, mit denen die mobilen Geräte vor unbefugtem Zugriff geschützt werden. Wer TouchID verwendet, muss ein sechsstelliges Kennwort eingeben und die Apple Watch erhält die geforderte Aktivierungssperre. --------------------------------------------- http://www.golem.de/news/pin-und-aktivierungssperre-apple-erhoeht-sicherhei… *** Amazon will SSL-Zertifizierungstelle werden *** --------------------------------------------- Amazons SSL-Zertifizierungstelle soll Server- und EV-Zertifikate ausstellen und sich dabei nicht auf Amazon-Kunden beschränken. --------------------------------------------- http://heise.de/-2683851 *** iOS: Schwachstelle in Apple Mail ermöglicht offenbar raffiniertes iCoud-Phishing *** --------------------------------------------- Ein Angreifer kann die Lücke nach Angabe eines Entwicklers dazu nutzen, den iCloud-Anmeldedialog zu imitieren, der öfters in iOS erscheint. Apple ist angeblich seit Monaten über das Problem informiert. --------------------------------------------- http://heise.de/-2684896 *** Security updates available for Adobe Flash Player (APSB15-11) *** --------------------------------------------- A Security Bulletin (APSB15-11) has been published regarding security updates for Adobe Flash Player. These updates address critical vulnerabilities, and Adobe recommends users update their product installations to the latest versions using .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1200 *** Asus schützt seine Router vor Exploit-Kit *** --------------------------------------------- Nachdem kürzlich ein Exploit-Kit aufgetaucht ist, dass über 50 Router-Modelle verschiedener Hersteller angreifen kann, hat Asus nun Firmware-Updates für 16 Router herausgebracht. --------------------------------------------- http://heise.de/-2684612 *** SweetCAPTCHA Service used to Distribute Adware *** --------------------------------------------- SweetCaptcha is free CAPTCHA service that offers to match sweet-looking images instead of making you recognize distorted digits and characters. It has integration with many website .. --------------------------------------------- https://blog.sucuri.net/2015/06/sweetcaptcha-service-used-to-distribute-adw…

1 0

Tageszusammenfassung - Montag 8-06-2015
by Daily end-of-shift report 08 Jun '15

08 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 05-06-2015 18:00 − Montag 08-06-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** �UnfriendAlert� wants your Facebook Credentials *** --------------------------------------------- For our first "PUP Friday" post, we talked about UnfriendAlert, a program that purports to notify users .. --------------------------------------------- https://blog.malwarebytes.org/online-security/2015/06/unfriendalert-wants-y… *** Changes in Oracle Database 12c password hashes *** --------------------------------------------- Oracle has made improvements to user password hashes within Oracle Database 12c. By using a PBKDF2-based SHA512 hashing algorithm, instead of simple SHA1 hash, password .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/Changes-in-Oracle-Database-1… *** [Honeypot Alert] Fritz!Box � Remote Command Execution Exploit Attempt *** --------------------------------------------- Our web honeypots picked up some exploit attempts for a remote command execution vulnerability in FRITZ!Box, a series of routers produced by AVM. This exploit targets router .. --------------------------------------------- http://trustwave.com/Resources/SpiderLabs-Blog/-Honeypot-Alert--Fritz!Box-%… *** Checking for BACNet devices inside corporate networks *** --------------------------------------------- Building automation Networks are very common today for intelligent buildings. They interconnect several type of devices like escalators, elevators, power circuits, heating, ventilating and air conditioning (HVAC) to the main control .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19771 *** Insider vs. Outsider Threats: Identify and Prevent *** --------------------------------------------- In my last article, we discussed on a step-by-step approach on APT attacks. The origin of any kind of cyber-attack is through an external or an internal source. Multiple sophisticated insider attacks resulted in the exfiltration of .. --------------------------------------------- http://resources.infosecinstitute.com/insider-vs-outsider-threats-identify-… *** Antiquated environment and bad security practices aided OPM hackers *** --------------------------------------------- By now, youve all heard about the massive breach at the US Office of Personnel Managements (OPM), and that the attackers have accessed (and likely made off with) personal information .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18484 *** Plex verschl�sselt Verbindung zur eigenen Medienzentrale *** --------------------------------------------- Den bisher größte Einsatz von Sicherheitszertifikaten heftet sich die Medienzentrale Plex auf die eigenen Fahnen. In einer Kooperation mit DigiCert bekommen sämtliche Nutzer der Software ein kostenloses SSL/TLS-Zertifikat für ihren Server ausgestellt. --------------------------------------------- http://derstandard.at/2000017144835 *** DSA-3281 - Debian Security Team PGP/GPG key change notice *** --------------------------------------------- This is a notice that the Debian Security Team has changed its PGP/GPGcontact key because of a periodic regular key rollover. --------------------------------------------- https://www.debian.org/security/2015/dsa-3281 *** Matryoshka dolls: analysing a packer for CTB locker *** --------------------------------------------- We recently encountered a phishing campaign distributing CTB locker. Victims were sent an e-mail that appeared to be from a Dutch webshop, with the e-mail describing a Fifa15 order for Playstation 3. While no one uses PS3 anymore , there were users who .. --------------------------------------------- https://www.dearbytes.com/en/nieuws/matroesjka-poppen-ctb-locker/ *** Raub im Zug: Datendiebstahl - ganz analog *** --------------------------------------------- Banden stehlen Handys und Laptops von Managern, um die Besitzer oder deren Firmen mit den erbeuteten Daten zu erpressen. --------------------------------------------- http://www.golem.de/news/raub-im-zug-datendiebstahl-ganz-analog-1506-114530… *** Malware zapft Kreditkartendaten von Oracle-Kassensystemen ab *** --------------------------------------------- Ein weiterer Schädling nistet sich in Point-of-Sales-Terminals ein und kopiert die Daten ahnungsloser Kreditkarten-Nutzer. MalaumPOS hat es auf ein weit verbreitetes Kassensystem von Oracle abgesehen. --------------------------------------------- http://heise.de/-2680638 *** Bugtraq: strongswan security update *** --------------------------------------------- Alexander E. Patrakov discovered an issue in strongSwan, an IKE/IPsec suite used to establish IPsec protected links. When an IKEv2 client authenticates the server with certificates and the client authenticates itself to the server using pre-shared key or EAP, the constraints on the .. --------------------------------------------- http://www.securityfocus.com/archive/1/535708 *** Zeus Isn�t Dead, New Version Evades All Antivirus Detection Tools *** --------------------------------------------- The venerable Zeus banking Trojan has been killed off many times; disappearing from the global Internet time and time again only to reappear with new modifications designed .. --------------------------------------------- http://www.pcrisk.com/internet-threat-news/9068-zeus-evades-all-antivirus-d… *** Many Drug Pumps Open to Variety of Security Flaws *** --------------------------------------------- In April, a security researcher disclosed a litany of severe vulnerabilities in the PCA3 drug-infusion pump manufactured by a company named Hospira. He went so far as to .. --------------------------------------------- http://threatpost.com/many-drug-pumps-open-to-variety-of-security-flaws/113…

1 0

Tageszusammenfassung - Freitag 5-06-2015
by Daily end-of-shift report 05 Jun '15

05 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 03-06-2015 18:00 − Freitag 05-06-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Zero-Day Disclosed in Unity Web Player *** --------------------------------------------- A zero-day vulnerability has been disclosed in the popular Unity Web Player browser plugin. The flaw allows an attacker crossdomain access to websites and services using the victims credentials. --------------------------------------------- http://threatpost.com/zero-day-disclosed-in-unity-web-player/113124 *** PCI Council releases PA-DSS 3.1, nixes SSL, early TLS *** --------------------------------------------- The PCI Security Standards Council revisions to PA-DSS addresses SSL vulnerabilities. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Ybnmzlufdo4/ *** Embedded: Geldautomaten sollen von XP auf Windows 10 updaten *** --------------------------------------------- Die Branchenorganisation ATM Industry Association ruft die Hersteller dazu auf, bei Geldautomaten Windows 8 und 8.1. zu überspringen. Auf Windows XP ausruhen sollen sie sich nicht. --------------------------------------------- http://www.golem.de/news/embedded-geldautomaten-sollen-von-xp-auf-windows-1… *** ICS Amsterdam 2015 *** --------------------------------------------- SANS ICS Amsterdam 2015 hosts five dedicated training courses for those tasked with securing Industrial Control Systems as well as a two day ICS Security Summit. This specialist training event takes place at the Radisson Blue Amsterdam, from September 22nd - 28th. --------------------------------------------- https://www.sans.org/event/ics-amsterdam-2015 *** Critical vulnerabilities in JSON Web Token libraries *** --------------------------------------------- Great. So, what's wrong with that? ... Meet the "none" algorithm. --------------------------------------------- http://ab0files.com/critical-vulnerabilities-in-json-web-token-libraries *** Achtung: Offene Intranets verraten zu viel *** --------------------------------------------- Viele Organisationen haben ein eigenes Intranet. Manche stellen versehentlich vertrauliche Dokumente online, die über Google auffindbar sind. Wir haben uns per Google Beispiele herausgepickt. --------------------------------------------- http://heise.de/-2680058 *** Asprox / Kuluoz Botnet Analysis *** --------------------------------------------- Introduction Kuluoz, aka Asprox, is a spam botnet that emerged in 2007. It has been known for sending mass of phishing emails used in conjunction with social engineering lures (e.g. booking confirmations, postal-themed spam, etc.) This article presents a view on the malware and its capabilities, how it communicates with the CnC, encryption schemes used,... --------------------------------------------- http://resources.infosecinstitute.com/asprox-kuluoz-botnet-analysis/ *** WLAN-Trick soll Apple-Pay-Nutzern Kreditkartendaten entlocken *** --------------------------------------------- Angreifer können die automatische WLAN-Verbindungsaufnahme von iOS dazu nutzen, um mit einem manipulierten Apple-Pay-Dialog auf Kreditkartenfang zu gehen, warnt eine Sicherheitsfirma. --------------------------------------------- http://heise.de/-2680369 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** McAfee ePolicy Orchestrator SSL/TLS spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103610 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco FireSIGHT Management Center XSS and HTML Injection Vulnerabilities *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39171 *** Cisco ONS 15454 System Software Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39172 *** Cisco Edge 340 Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39187 *** Cisco TelePresence SX20 HTTP Response Splitting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39210 *** XZERES 442SR Wind Turbine CSRF Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a cross-site request forgery vulnerability in XZERES's 442SR turbine generator operating system. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-155-01 *** Bugtraq: CA20150604-01: Security Notice for CA Common Services *** --------------------------------------------- http://www.securityfocus.com/archive/1/535684

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily