- Daily - CERT.at

Tageszusammenfassung - Mittwoch 3-06-2015
by Daily end-of-shift report 03 Jun '15

03 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 02-06-2015 18:00 − Mittwoch 03-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Your Website Hacked but No Signs of Infection *** --------------------------------------------- Imagine for a moment, you have a suspicion that you have somehow been hacked. You see that something is off, but you feel as if you are missing something. This is the emotionally draining world that many live in, with a paranoia and concern that grips you once you see and recognize that something is not right. --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/0D6hUcbKq34/your-website-hack… *** Holy SSH-it! Microsoft promises secure logins for Windows PowerShell *** --------------------------------------------- Now that the door has hit Ballmer on the way out, OpenSSH support is go Microsoft has finally decided to add support for SSH to PowerShell, allowing people to log into Windows systems and use software remotely over an encrypted connection. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/02/openssh_win… *** Bug des Tages: Skype hat eine "SMS des Todes" *** --------------------------------------------- Sending the characters "http://:" (without the quotes) crashes Skype, and receiving a message with those characters makes it crash any time you try to sign in again. --------------------------------------------- http://blog.fefe.de/?ts=ab900965 *** Good Patch Management Is Crucial to Cybersecurity in ICS *** --------------------------------------------- A good cybersecurity strategy for industrial control systems (ICS) must include both a systematic approach to patch management and compensating cybersecurity controls for when patching is not an option. Patch management resolves bugs, operability, reliability,... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/tK1mqdG1qkA/ *** IoT Devices Hosted On Vulnerable Clouds In Bad Neighborhoods *** --------------------------------------------- OpenDNS report finds that organizations may be more susceptible to Internet of Things devices than they realize. --------------------------------------------- http://www.darkreading.com/cloud/iot-devices-hosted-on-vulnerable-clouds-in… *** Mass break-in: researchers catch 22 more routers for the SOHOpeless list *** --------------------------------------------- A business model ripe for the bin Yet another disclosure tips 22 SOHO routers in the security bin, with everything from privilege escalation and authentication bypass to hard-coded credential backdoors. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/06/03/mass_breaki… *** Piwik: Unberechtigte können Webseiten-Statistiken abrufen *** --------------------------------------------- Installationen der Google-Analytics-Alternative Piwik sind häufig nicht korrekt konfiguriert und Dritte können ohne viel Aufwand Abrufstatistiken einsehen und sogar herunterladen. --------------------------------------------- http://heise.de/-2678572 *** SSH: Sechs Jahre alter Bug bedroht Github-Repositories *** --------------------------------------------- Ein Debian-Bug aus dem Jahr 2008 hinterlässt immer noch Spuren. Eine Analyse der öffentlichen SSH-Schlüssel bei Github zeigt: Mittels angreifbarer Schlüssel hätten Angreifer die Repositories von Projekten wie Python und Firmen wie Spotify oder Yandex manipulieren können. --------------------------------------------- http://www.golem.de/news/ssh-sechs-jahre-alter-bug-bedroht-github-repositor… *** Emergency Security Band-Aids with Systemtap *** --------------------------------------------- Software security vulnerabilities are a fact of life. So is the subsequent publicity, package updates, and suffering service restarts. Administrators are used to it, and users bear it, and it's a default and traditional method. On the other hand, in... --------------------------------------------- https://securityblog.redhat.com/2015/06/03/emergency-security-band-aids-wit… *** Krypto-Trojaner überlegt es sich anders und entschlüsselt alles wieder *** --------------------------------------------- Der Erpressungs-Trojaner Locker ist erst seit wenigen Tagen im Umlauf. Und schon ist seine Karriere wieder vorbei: Er hat vergangenen Dienstag den Befehl erhalten, alle verschlüsselten Dateien wiederherzustellen. --------------------------------------------- http://heise.de/-2678669 *** Hackers Scan All Tor Hidden Services To Find Weaknesses In The Dark Web *** --------------------------------------------- If you go down to the deep web today, you'll be following hot on the heels of a digital beast. In a matter of hours last week, the entire semi-anonymising Tor network, where activists and criminals alike try to hide from the gaze of their respective authorities, was traversed by PunkSPIDER, an automated scanner that pokes websites to uncover vulnerabilities. --------------------------------------------- http://www.forbes.com/sites/thomasbrewster/2015/06/01/dark-web-vulnerabilit… *** DSA-3277 wireshark - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in the dissectors/parsers forLBMR, web sockets, WCP, X11, IEEE 802.11 and Android Logcat, which couldresult in denial of service. --------------------------------------------- https://www.debian.org/security/2015/dsa-3277 *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Unified MeetingPlace Microsoft Outlook Reflected Cross-Site Scripting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39161 *** Cisco Unified MeetingPlace Session ID Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39162 *** Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39158 *** Cisco Adaptive Security Appliance XAUTH Bypass Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39157 *** Cisco Unified MeetingPlace Arbitrary File Download Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39163 *** Beckwith Electric TCP Initial Sequence Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a TCP initial sequence numbers vulnerability in multiple Beckwith Electric products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-153-01 *** Moxa SoftCMS Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a buffer overflow vulnerability in the Moxa SoftCMS software package. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-153-02 *** [HTB23258]: Local PHP File Inclusion in ResourceSpace *** --------------------------------------------- Product: ResourceSpace v7.1.6513Vulnerability Type: PHP File Inclusion [CWE-98]Risk level: High Creater: Montala LimitedAdvisory Publication: May 6, 2015 [without technical details]Public Disclosure: June 3, 2015 CVE Reference: CVE-2015-3648 CVSSv2 Base Score: 7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C) Vulnerability Details: High-Tech Bridge Security Research Lab discovered vulnerability in ResourceSpace, which can be exploited to include arbitrary local PHP file, execute PHP code, and compromise --------------------------------------------- https://www.htbridge.com/advisory/HTB23258 *** USN-2626-1: Qt vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2626-13rd June, 2015qt4-x11, qtbase-opensource-src vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryQt could be made to crash or run programs as your login if it opened aspecially crafted file.Software description qt4-x11 - Qt 4 libraries qtbase-opensource-src - Qt 5 libraries DetailsWolfgang Schenk discovered that Qt incorrectly handled certain malformedGIF... --------------------------------------------- http://www.ubuntu.com/usn/usn-2626-1/ Next End-of-Shift report on 2015-06-05

1 0

Tageszusammenfassung - Dienstag 2-06-2015
by Daily end-of-shift report 02 Jun '15

02 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 01-06-2015 18:00 − Dienstag 02-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit *** --------------------------------------------- What follows is a detailed analysis of the root cause of a vulnerability we call CVE-2015-X, as well as a step-by-step explanation of how to trigger it. For more on Flash vulnerabilities, we also invite you... --------------------------------------------- http://feedproxy.google.com/~r/PaloAltoNetworks/~3/JsuXUOWrYYM/ *** DYRE Banking Malware Upsurges; Europe and North America Most Affected *** --------------------------------------------- Online banking users in Europe and North America are experiencing the upsurge of DYRE, a malware family notorious for the multiple ways it steals data and its ties to parcel mule scams, among others. There has been a 125% increase of DYRE-related infections worldwide this quarter compared to the last, proving that cybercriminal interest in... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/HyDW9pkWWws/ *** Malvertising infected millions of users in 2015 *** --------------------------------------------- New research from Malwarebytes has found that malvertising is one of the primary infection vectors used to reach millions of consumers this year. The analysis looked at the three large scale zero-... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/9go1s-jFKtc/malware_news.… *** Playing with IP Reputation with Dshield & OSSEC *** --------------------------------------------- [This blogpost has also been published as a guest diary on isc.sans.org] When investigating incidents or searching for malicious activity in your logs, IP reputation is a nice way to increase the reliability of generated alerts. It can help to prioritize incidents. Let's take an example with a WordPress blog. It will, sooner or later, be targeted by a brute-force attack on the default /wp-admin page. In... --------------------------------------------- http://blog.rootshell.be/2015/06/02/playing-with-ip-reputation-with-dshield… *** Bugtraq: WebDrive 12.2 (B4172) - Buffer Overflow Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535663 *** Red Hat JBoss Fuse and A-MQ XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Files *** --------------------------------------------- http://www.securitytracker.com/id/1032442 *** Xen Security Advisories XSA-128, XSA-129, XSA-130, XSA-131 *** --------------------------------------------- Potential unintended writes to host MSI message data field via qemu, PCI MSI mask bits inadvertently exposed to guests, Guest triggerable qemu MSI-X pass-through error messages, Unmediated PCI register access in qemu --------------------------------------------- http://xenbits.xen.org/xsa/ *** USN-2625-1: Apache HTTP Server update *** --------------------------------------------- Ubuntu Security Notice USN-2625-12nd June, 2015apache2 updateA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTSSummarySeveral security improvements have been made to the Apache HTTP Server.Software description apache2 - Apache HTTP server DetailsAs a security improvement, this update makes the following changes tothe Apache package in Ubuntu 12.04 LTS:Added support for ECC keys and ECDH ciphers.The SSLProtocol configuration directive now allows specifying --------------------------------------------- http://www.ubuntu.com/usn/usn-2625-1/ *** USN-2624-1: OpenSSL update *** --------------------------------------------- Ubuntu Security Notice USN-2624-11st June, 2015openssl updateA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryThe export cipher suites have been disabled in OpenSSL.Software description openssl - Secure Socket Layer (SSL) cryptographic library and tools DetailsAs a security improvement, this update removes the export cipher suitesfrom the default cipher list to prevent their use in possible --------------------------------------------- http://www.ubuntu.com/usn/usn-2624-1/ *** Cisco Headend Digital Broadband Delivery System Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39133 *** HPSBGN03269 rev.2 - HP StoreAll OS, Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with HP StoreAll OS. This is the GNU C Library (glibc) vulnerability known as "GHOST" which could be exploited remotely resulting in execution of code. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599438 *** PCRE Heap Overflow in Regex Processing Lets Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032453

1 0

Tageszusammenfassung - Montag 1-06-2015
by Daily end-of-shift report 01 Jun '15

01 Jun '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 29-05-2015 18:00 − Montag 01-06-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Which malware lures work best? *** --------------------------------------------- More often than not, malware peddlers main goal is to deliver their malicious wares to the maximum number of users possible. Choosing the right lure is crucial to achieving that goal. Two researc... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/SXwL_z3NcUM/malware_news.… *** New Android NFC Attack Could Steal Money From Credit Cards Anytime Your Phone Is Near *** --------------------------------------------- Your NFC capable Android smartphone could be the newest weapon hackers use to steal money from the credit cards in your pocket, researchers find. In a presentation at Hack In The Box Security Conference in Amsterdam, security researchers Ricardo J. Rodriguez and Jose Vila presented a demo of a real world attack, to which all NFC capable Android phones are vulnerable. This attack, delivered through poisoned apps, exploits the NFC feature allowing unethical hackers to steal money from... --------------------------------------------- http://www.idigitaltimes.com/new-android-nfc-attack-could-steal-money-credi… *** Crypto flaws in Blockchain Android app sent Bitcoins to the wrong address *** --------------------------------------------- A comedy of programming errors could prove catastrophic for affected users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/9dMUjIT6yyo/ *** HITB Amsterdam Wrap-Up Day #2 *** --------------------------------------------- I left Amsterdam after the closing keynote and I just arrived at home. This is my quick wrap-up for the second day of Hack in the Box! The second keynote was presented by John Matherly: "The return of the Dragons". John is the guy behind Shodan, the popular devices search engine. Shodan started because Nmap was not designed to scan the whole Internet. With Shodan, Stateless... --------------------------------------------- http://blog.rootshell.be/2015/05/29/hitb-amsterdam-wrap-up-day-2-2/ *** Adventures in Social Engineering: The Evil Reference *** --------------------------------------------- I recently completed a social engineering gig targeting four bank locations. After a phone call and a few e-mails, I was able to grab some victims NTLMv2 domain hashed credentials. The Approach I developed a fictitious persona to help me... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Adventures-in-Social-En… *** Locker Ransomware Author Allegedly Releases Database Dump of Private Keys *** --------------------------------------------- Allegedly, the author of the "Locker" ransomware has uploaded a dump of the C2 server database, releasing private keys of infected hosts to the public. Allegedly, the author of the "Locker" ransomware has uploaded a dump of the C2 server database, releasing private keys of infected hosts worldwide to the public. The "author" claims that... --------------------------------------------- http://securityaffairs.co/wordpress/37346/cyber-crime/locker-ransomware-db-… *** Malware Evolution Calls for Actor Attribution? *** --------------------------------------------- What makes one novel strain of malicious software more dangerous or noteworthy than another? Is it the sheer capability and feature set of the new malware, or are these qualities meaningless without also considering the skills, intentions and ingenuity of the person wielding it? Most experts probably would say it's important to consider attribution insofar as it is knowable, but it's remarkable how seldom companies that regularly publish reports on the latest criminal innovations go... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/8rYlMnG_kmU/ *** Intelligente Städte: "Smart wäre, wenn man den ganzen Quatsch lassen würde" *** --------------------------------------------- Der White-Hat-Hacker Felix Lindner ist entsetzt, wie wenig Wert Politik und Industrie auf den Schutz der digital vernetzten Stadt vor Cyberattacken legen. --------------------------------------------- http://www.heise.de/newsticker/meldung/Intelligente-Staedte-Smart-waere-wen… *** Researchers discover hidden shell in Hola VPN software *** --------------------------------------------- Hola, an Israeli company that develops a browser plug-in promoted heavily as a means to bypass region locks on Web-based content and anonymous surfing, faced a considerable amount of backlash last week - after it was discovered they were selling access to their users connections in what one researcher called "a poorly secured botnet."On Friday, 24-hours after the quasi-botnet operation was disclosed, a group of researchers released details on a number of critical vulnerabilities in... --------------------------------------------- http://www.csoonline.com/article/2929192/data-protection/researchers-discov… *** Unzählige Apps speichern private Daten unsicher in der Cloud *** --------------------------------------------- Auf den Cloud-Servern von Apple und Co. schlummern 56 Millionen nicht optimal geschützte Datensätze. Angreifer könnten vergleichsweise einfach Fotos, Adressdaten und weitere Infos abgreifen. --------------------------------------------- http://heise.de/-2671988 *** Blue Coat: SSL Visibility Appliance web based vulnerabilities, (Sun, May 31st) *** --------------------------------------------- Blue Coat has released a security advisory for SSL Visibility Appliance. The SSL Visibility Appliance is susceptible to multiple web-based vulnerabilities in the administration console. A remote attacker can use these vulnerabilities to obtain administrative access to the SSL Visibility Appliance. All versions of SSL Visibility prior to 3.8.4 are vulnerable. The vulnerabilities exist in the WebUI are: Cross-Site Request Forgery (CVE-2015-2852): Cross-site request forgery (CSRF) vulnerability... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19749&rss *** JSA10681 - 2015-05 Out of Cycle Security Bulletin: "Logjam" passive attack on sub-1024 DH groups, and active downgrade attack of TLS to DHE_EXPORT (CVE-2015-4000) *** --------------------------------------------- Affected Products: Junos OS (XNM-SSL)*, WXOS --------------------------------------------- http://kb.juniper.net/index?page=content&id=JSA10681&actp=RSS *** Vulnerabilities in Cisco Products *** --------------------------------------------- *** Cisco Headend Digital Broadband Delivery System HTTP Response-Splitting Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38863 *** Cisco Conductor for Videoscape and Cisco Headend System Release HTTP Injection Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38945 *** Cisco Headend System Release Archive File Download Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38944 *** Cisco Headend System Release UDP TFTP and DHCP Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38938 *** Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=39130 *** Multiple Cisco Products TCP Flood Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38943 *** Security Advisory: cURL and libcurl vulnerability CVE-2015-3148 *** --------------------------------------------- (SOL16707) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16707.htm… *** Security Advisory: cURL and libcurl vulnerability CVE-2015-3143 *** --------------------------------------------- (SOL16704) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/700/sol16704.htm… *** Novell Messenger 3.0 Support Pack 1 *** --------------------------------------------- Abstract: Novell Messenger 3.0 Support Pack 1 has been released. Please be aware that there are security fixes to Messengers server and client components (see the change log below and the Readme documentation on the web). It is recommended that they are updated on an expedited basis.Document ID: 5211030Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:consoleone1.3.6h_windows.zip (46.82 MB)nm301_full_linux_multi.tar.gz (269.53 MB)nm301_client_mac_multi.zip (40.61 --------------------------------------------- https://download.novell.com/Download?buildid=j6RbJAJrtC4~ *** IDM 4.5 MSGW Driver 4.0.1.0 *** --------------------------------------------- Abstract: This is a patch for the Managed System Gateway Driver (MSGW) for Identity Manager. It installs on Identity Manager version 4.5 but can be used on IDM 4.0.2. The version of this driver is 4.0.1.0Document ID: 5211010Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:IDM45_MSGW_4010.zip (4.68 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches:IDM 4.0.2 MSGW Driver Version 4.0.0.6 --------------------------------------------- https://download.novell.com/Download?buildid=UQgGwYtht9c~ *** PHP Integer Overflows Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032433 *** PHP Multipart POST Request Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032432 *** PHP Functions That Permit Null Characters in Path Values May Let Remote Users Bypass Access Controls *** --------------------------------------------- http://www.securitytracker.com/id/1032431 *** Security Notice - Statement on Security Researchers Revealing Security Vulnerabilities in Huawei SOHO Products on Packet Storm Website *** --------------------------------------------- May 30, 2015 17:23 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Huawei Wimax CPE Bm632w Hidden Backdoor *** --------------------------------------------- Topic: Huawei Wimax CPE Bm632w Hidden Backdoor Risk: High Text:Exploit Title : Huawei Wimax CPE Bm632w Hidden Backdoor Date : 30 May 2015 Exploit Author : Koorosh Ghorbani Site : http://8... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050183 *** Security Notice - Statement on Security Researchers Revealing Security Vulnerability in Huawei CPE Products on cxsecurity Website *** --------------------------------------------- Jun 01, 2015 14:48 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** DSA-3275 fusionforge - security update *** --------------------------------------------- Ansgar Burchardt discovered that the Git plugin for FusionForge, aweb-based project-management and collaboration software, does notsufficiently validate user provided input as parameter to the method tocreate secondary Git repositories. A remote attacker can use this flawto execute arbitrary code as root via a specially crafted URL. --------------------------------------------- https://www.debian.org/security/2015/dsa-3275 *** DSA-3276 symfony - security update *** --------------------------------------------- Jakub Zalas discovered that Symfony, a framework to create websites andweb applications, was vulnerable to restriction bypass. It wasaffecting applications with ESI or SSI support enabled, that use theFragmentListener. A malicious user could call any controller via the/_fragment path by providing an invalid hash in the URL (or removingit), bypassing URL signing and security rules. --------------------------------------------- https://www.debian.org/security/2015/dsa-3276 *** ESC 8832 Data Controller Session Hijacking *** --------------------------------------------- Topic: ESC 8832 Data Controller Session Hijacking Risk: Medium Text:=begin # Exploit Title: ESC 8832 Data Controller multiple vulnerabilities # Date: 2014-05-29 # Platform: SCADA / Web Applica... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050181

1 0

Tageszusammenfassung - Freitag 29-05-2015
by Daily end-of-shift report 29 May '15

29 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 28-05-2015 18:00 − Freitag 29-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** The Empire Strikes Back Apple - how your Mac firmware security is completely broken *** --------------------------------------------- [...] What is that hole after all? Is Dark Jedi hard to achieve on Macs? No, it's extremely easy because Apple does all the dirty work for you. What the hell am I talking about? Well, Apple's S3 suspend-resume implementation is so f*cked up that they will leave the flash protections unlocked after a suspend-resume cycle. --------------------------------------------- https://reverse.put.as/2015/05/29/the-empire-strikes-back-apple-how-your-ma… *** HITB Amsterdam Wrap-Up Day #1 *** --------------------------------------------- The HITB crew is back in the beautiful city of Amsterdam for a new edition of their security conference. Here is my wrap-up for the first day! The opening keynote was assigned to Marcia Hofmann who worked for the EFF (the Electronic Frontier Foundation). Her keynote title was: "Fighting for Internet Security in the New Crypto Wars". EFF always fight for more privacy and she reviewed the history of encryption and... --------------------------------------------- http://blog.rootshell.be/2015/05/28/hitb-amsterdam-wrap-up-day-1-2/ *** Sicherheitslücken: Fehler in der Browser-Logik *** --------------------------------------------- Mit relativ simplen Methoden ist es dem 18-jährigen Webentwickler Bas Venis gelungen, schwerwiegende Sicherheitslücken im Chrome-Browser und im Flash-Plugin aufzudecken. Er ruft andere dazu auf, nach Bugs in der Logik von Browsern zu suchen. --------------------------------------------- http://www.golem.de/news/sicherheitsluecken-fehler-in-der-browser-logik-150… *** Tor: Hidden Services leichter zu deanonymisieren *** --------------------------------------------- Das Tor-Protokoll erlaubt es Angreifern relativ einfach, die Kontrolle über die Verzeichnisserver sogenannter Hidden Services zu erlangen. Dadurch ist die Deanonymisierung von Traffic deutlich einfacher als beim Zugriff auf normale Webseiten. --------------------------------------------- http://www.golem.de/news/tor-hidden-services-leichter-zu-deanonymisieren-15… *** Crypto flaws in Blockchain Android app sent Bitcoins to the wrong address *** --------------------------------------------- A comedy of programming errors could prove catastrophic for affected users. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/9dMUjIT6yyo/ *** ZyXEL schützt seine Router vor NetUSB-Lücke *** --------------------------------------------- Mit Sicherheits-Updates schließt der Netzwerkausrüster ZyXEL die kritische NetUSB-Lücke in allen betroffenen Modellen. --------------------------------------------- http://heise.de/-2671364 *** Lessons learned from Flame, three years later *** --------------------------------------------- Three years ago, on May 28th 2012, we announced the discovery of a malware known as Flame. Since that, we reported on many other advanced malware platform. Looking back at the discovery of Flame, here are some lessons we learned. --------------------------------------------- http://securelist.com/blog/opinions/70149/lessons-learned-from-flame-three-… *** Phishing Gang is Audacious Manipulator *** --------------------------------------------- Cybercriminals who specialize in phishing -- or tricking people into giving up usernames and passwords at fake bank and ecommerce sites -- arent generally considered the most sophisticated crooks, but occasionally they do exhibit creativity and chutzpah. Thats most definitely the case with a phishing gang that calls itself the "Manipulaters Team", whose Web site boasts that it specializes in brand research and development. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/qKqrwDK8oQ8/ *** A Drafty House: Analysis of the Current Use of AWS EC2 Security Groups *** --------------------------------------------- After a very confusing set of results from a survey we ran and exploring the new world of threat detection and incident response in AWS, we decided to go out and do a little research to see how the world was faring with the new security features in Amazon AWS. In short, we can safely say there is a good chunk of the EC2 users who left their front door open (actually with this analogy they also left their back door, side window, and garage open). Our analysis showed that users are: Using... --------------------------------------------- https://feeds.feedblitz.com/~/93538286/0/alienvault-blogs~A-Drafty-House-An… *** Stegosploit hides malicious code in images, this is the future of online attacks *** --------------------------------------------- Stegosploit is the technique developed by the security researcher Saumil Shah that allows an attacker to embed executable JavaScript code within an image. The security researcher Saumil Shah from Net Square security has presented at Hack In The Box conference in Amsterdam his Stegosploit project which allows an attacker to embed executable JavaScript code within an... --------------------------------------------- http://securityaffairs.co/wordpress/37302/hacking/stegosploit-malware-image… *** Statistics on botnet-assisted DDoS attacks in Q1 2015 *** --------------------------------------------- One popular DDoS scenario is a botnet-assisted attack. In Q1 2015, 23,095 botnet-assisted DDoS attacks were reported. These statistics refer to those botnets which were detected and analyzed by Kaspersky Lab. --------------------------------------------- http://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddo… *** Linux Kernel __driver_rfc4106_decrypt() Buffer Overflow May Let Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032416 *** Pivotal Cloud Foundry directory traversal *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103449 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** IBM Cognos Business Intelligence Developer 10.2.1 (backURL) Open Redirect *** --------------------------------------------- Input passed via the backURL GET parameter in /p2pd/servlet/dispatch is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. --------------------------------------------- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5244.php *** DSA-3274 virtualbox - security update *** --------------------------------------------- Jason Geffner discovered a buffer overflow in the emulated floppydisk drive, resulting in potential privilege escalation. --------------------------------------------- https://www.debian.org/security/2015/dsa-3274 *** IDS RTU 850 Directory Traversal Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a directory traversal vulnerability in IDS RTU 850C. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-148-01 *** Security Notice - Statement on Security Researchers Revealing Security Issues on Huawei Products in HITB SecConf *** --------------------------------------------- May 29, 2015 17:47 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** Security Notice-Statement on the Wooyun-disclosed XSS Vulnerability in Huawei Smartphone Browser *** --------------------------------------------- May 29, 2015 17:43 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-notices… *** SSL-TLS Implementations Cipher Block Chaining Padding Information Disclosure Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36740 *** HPSBGN03332 rev.1 - HP Operations Analytics running SSLv3, Remote Denial of Service (DoS), Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified in HP Operations Analytics running SSLv3. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in Denial of Service (DoS) or disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290405142… *** HPSBMU03267 rev.2 - HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with the HP Matrix Operating Environment and HP CloudSystem Matrix running OpenSSL. These vulnerabilities comprise the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290406517… *** HPSBMU03263 rev.3 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Insight Control running OpenSSL. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290408721… *** HPSBMU03261 rev.2 - HP Systems Insight Manager running OpenSSL on Linux and Windows, Remote Disclosure of Information *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Systems Insight Manager running OpenSSL on Linux and Windows. These vulnerabilities are related to the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?ac.admitted=143290410464…

1 0

Tageszusammenfassung - Donnerstag 28-05-2015
by Daily end-of-shift report 28 May '15

28 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 27-05-2015 18:00 − Donnerstag 28-05-2015 18:00 Handler: Stephan Richter Co-Handler: Alexander Riepl *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39012 http://tools.cisco.com/security/center/viewAlert.x?alertId=39013 http://tools.cisco.com/security/center/viewAlert.x?alertId=39015 http://tools.cisco.com/security/center/viewAlert.x?alertId=38349 http://tools.cisco.com/security/center/viewAlert.x?alertId=39041 http://tools.cisco.com/security/center/viewAlert.x?alertId=39042 *** Microsoft to Detect Search Protection Code as Malware *** --------------------------------------------- Microsoft security products will begin detecting software containing search protection functions and classifying it as malicious on June 1. --------------------------------------------- http://threatpost.com/microsoft-to-detect-search-protection-code-as-malware… *** ZDI-15-246: (0Day) Wavelink Emulation ConnectPro TermProxy WLTermProxyService.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation ConnectPro TermProxy. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-246/ *** ZDI-15-245: (0Day) Wavelink Emulation License Server LicenseServer.exe HTTP Request Headers Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Wavelink Emulation License Server. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-245/ *** Ransomware threat Locker has sleeper component *** --------------------------------------------- KnowBe4 is alerting IT managers to be vigilant of a new ransomware threat that leverages a sleeper function. --------------------------------------------- http://www.scmagazine.com/alert-warns-it-managers-of-locker-ransomware/arti… *** Apple iOS Notification Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032408 *** Angler exploit kit pushing CryptoWall 3.0, (Thu, May 28th) *** --------------------------------------------- In the past two days, Ive infected two hosts from Angler exploit kit (EK) domains at 216.245.213.0/24. Both hosts were infected with CryptoWall 3.0 ransomware using the same bitcoin address for the ransom payment: 16Z6sidfLrfNoxJNu4qM5zhRttJEUD3XoB On Tuesday, 2015-05-26 at 15:17 UTC, .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19737 *** APPLE-SA-2015-05-27-1 OS X: Flash Player plug-in blocked *** --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00002.ht… *** Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities *** --------------------------------------------- Splunk Enterprise 6.1.8, 6.0.9, and 5.0.13 address multiple vulnerabilities Multiple vulnerabilities in OpenSSL versions before 1.0.1m and 0.9.8zf (SPL-98351) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have been actively exploited. Previous Product Security Announcements can be found on .. --------------------------------------------- http://www.splunk.com/view/SP-CAAAN4P *** Grabit and the RATs *** --------------------------------------------- Not so long ago, Kaspersky clients in the United States approached Kaspersky researchers with a request to investigate a new type of malicious software that they were able to recover from their organizations' servers. The malware calls itself Grabit. --------------------------------------------- http://securelist.com/blog/research/70087/grabit-and-the-rats/ *** Trend Micro Discovers Apache Cordova Vulnerability that Allows One-Click Modification of Android Apps *** --------------------------------------------- We've discovered a vulnerability in the Apache Cordova app framework that allows attackers to modify the behavior of apps just by clicking a URL. The extent of the modifications can range from causing nuisance for app users to crashing the .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-disc… *** SAP HANA Log Injection *** --------------------------------------------- Under certain conditions the SAP HANA XS engine is vulnerable to arbitrary log injection, allowing remote authenticated attackers to write arbitrary information in log files. This could be .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050172 *** SAP HANA Information Disclosure *** --------------------------------------------- Under certain conditions some SAP HANA Database commands could be abused by a remote authenticated attacker to access information which is restricted. This could be used to gain access .. --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050171 *** SOPHOS WAF JSON Filter Bypass *** --------------------------------------------- Topic: SOPHOS WAF JSON Filter Bypass Risk: Low Text:SECURITYLABS INTELLIGENT RESEARCH - SECURITY ADVISORY http://www.securitylabs.com.br/ ADVISORY/0115 - SOPHOS WAF (WEBSERV... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050169 *** Phishers register domain names, hammer traditional targets *** --------------------------------------------- The number of domain names used for phishing reached an all-time high, according to a new report by the the Anti-Phishing Working Group (APWG). Many of these were registered by .. --------------------------------------------- http://www.net-security.org/secworld.php?id=18429 *** Crash-Benachrichtigung für iOS-Geräte: Apple stellt Bugfix in Aussicht *** --------------------------------------------- Apple will den 'Unicode of Death'-Fehler, der iPhone und iPad durch eine bestimmte Zeichenfolge zum Absturz bringt, mit einem Software-Update beheben - das Problem betrifft weit mehr als nur iMessage. --------------------------------------------- http://heise.de/-2669432 *** Oracle PeopleSoft admin credentials open to hackers *** --------------------------------------------- SAP Security experts discovered a number of unpatched vulnerabilities and weaknesses in Oracle PeopleSoft that could be exploited to obtain admin passwords. The SAP security experts, Alexander Polyakov and Alexey Tyurin, revealed that Oracle .. --------------------------------------------- http://securityaffairs.co/wordpress/37270/hacking/oracle-peoplesoft-vulnera… *** Bugtraq: [SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices *** --------------------------------------------- http://www.securityfocus.com/archive/1/535626 *** IDS, IPS and UTM - What's the Difference? *** --------------------------------------------- In our last webcast, we learned about lingering and general confusion over these crazy acronyms IDS and IPS, and how they are like or unlike UTM software modules. Everyone likes primers and simple descriptive definitions, .. --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/ids-ips-and-utm-whats-…

1 0

Tageszusammenfassung - Mittwoch 27-05-2015
by Daily end-of-shift report 27 May '15

27 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 26-05-2015 18:00 − Mittwoch 27-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** This is not the UEFI backdoor you are looking for *** --------------------------------------------- This is currently the top story on the Linux subreddit. It links to this Tweet which demonstrates using a System Management Mode backdoor to perform privilege escalation under Linux. This is not a story.But first, some background. System Management Mode (SMM) is a feature in most x86 processors since the 386SL back in 1990. It allows for certain events to cause the CPU to stop executing the OS, jump to an area of hidden RAM and execute code there instead, and then hand off back to the OS... --------------------------------------------- http://mjg59.dreamwidth.org/35110.html *** Breach detection: Five fatal flaws and how to avoid them *** --------------------------------------------- When the Sarbanes-Oxley Act of 2002 was passed, it fell on corporate security teams to translate its requirements into technical controls. That threw the IT Security function into the deep end of the ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uoHRSOyKltE/article.php *** Five Mistakes MSSPs Should Avoid *** --------------------------------------------- MSSPs, or Managed Security Service Providers, are at an exciting point where market acceptance, awareness and demand have converged. I view this as a positive for a potential MSSP but also for the customers and businesses they will protect, enhancing security for everyone. However, excitement and the prospect of profits can create haste, and with haste comes an increased risk of mistakes. In my role at AlienVault, Ive been fortunate enough to work with and help ensure the success of a number of... --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/five-mistakes-mssps-sh… *** Over 30% of Official Images in Docker Hub Contain High Priority Security Vulnerabilities *** --------------------------------------------- Docker Hub is a central repository for Docker developers to pull and push container images. We performed a detailed study on Docker Hub images to understand how vulnerable they are to security threats. Surprisingly, we found that more than 30% of official repositories contain images that are highly susceptible to a variety of security attacks (e.g., Shellshock, Heartbleed, Poodle, etc.). For general images... --------------------------------------------- http://www.banyanops.com/blog/analyzing-docker-hub/ *** Jetzt patchen: Synology-NAS über Fotoalbum angreifbar *** --------------------------------------------- Synologys Web-Fotoalbum Photo Station gewährt Angreifern ungewollt Zugriff auf DiskStation NAS-Systeme. Wer nicht will, dass Fremde beliebigen Code auf dem eigenen NAS ausführen, sollte den Patch des Herstellers jetzt einspielen. --------------------------------------------- http://heise.de/-2668853 *** How to Prevent a Domain Name Theft *** --------------------------------------------- 1. Introduction The domain names may cost far more than a real estate. For instance, Facebook paid USD 8.5 million to buy fb.com. The high prices of the domain names attract not only businesses, but also thieves. The domain name theft can be huge trouble for companies because it effects their brand and reputation. This... --------------------------------------------- http://resources.infosecinstitute.com/how-to-prevent-a-domain-name-theft/ *** SQL-Injection-Lücke in xt:Commerce *** --------------------------------------------- Sicherheitsupdates schließen in der Shop-Software eine Lücke, durch die Angreifer potenziell Datenbankbefehle einschleusen können. --------------------------------------------- http://heise.de/-2667569 *** Possible Wordpress Botnet C&C: errorcontent.com, (Tue, May 26th) *** --------------------------------------------- Thanks to one of our readers, for sending us this snipped of PHP he found on a Wordpress server (I added some line breaks and comments in red for readability): #2b8008# ">">/* turn off error reporting */ @ini_set(display_errors ">/* do not display errors to the user */ $wp_mezd8610 = @$_SERVER[HTTP_USER_AGENT">/* only run the code if this is Chrome or IE and not a bot */ if (( preg_match (/Gecko|MSIE/i, $wp_mezd8610) !preg_match (/bot/i, $wp_mezd8610))) { --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19733&rss *** Researchers Exploit Patched Windows Group Policy Bug *** --------------------------------------------- Researchers from Core Security were able to exploit a security vulnerability in Windows group policy -- MS15-011 -- that was patched by Microsoft in February. --------------------------------------------- http://threatpost.com/researchers-exploit-patched-windows-group-policy-bug/… *** Online-Dienst erstellt maßgeschneiderte Krypto-Trojaner *** --------------------------------------------- Die Einstiegshürde für angehende Online-Erpresser ist erneut gesunken: Ein Dienst im Tor-Netz erstellt nach wenigen Klicks den individuellen Erpressungs-Trojaner. Falls ein Opfer das geforderte Lösegeld zahlt, verdienen die Betreiber mit. --------------------------------------------- http://heise.de/-2668860 *** Security: Zwei neue Exploits auf Router entdeckt *** --------------------------------------------- Unsichere Router sind aktuell von gleich zwei Versionen von Malware bedroht. Die eine verteilt Spam über soziale Medien, die andere leitet Anfragen auf manipulierte Webseiten um. (Router, Virus) --------------------------------------------- http://www.golem.de/news/security-zwei-neue-exploits-auf-router-entdeckt-15… *** extjs Arbitrary File Read / ssrf Vulnerability *** --------------------------------------------- Topic: extjs Arbitrary File Read / ssrf Vulnerability Risk: High Text:Hi all： Baidu Security Team found a vulnerability in extjs,with this vulnerability we can read arbitrary file and request... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050162 *** USN-2622-1: OpenLDAP vulnerabilities *** --------------------------------------------- Ubuntu Security Notice USN-2622-126th May, 2015openldap vulnerabilitiesA security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.04 Ubuntu 14.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTSSummaryOpenLDAP could be made to crash if it received specially crafted networktraffic.Software description openldap - OpenLDAP utilities DetailsIt was discovered that OpenLDAP incorrectly handled certain search queriesthat returned empty attributes. A remote attacker could use this issue tocause... --------------------------------------------- http://www.ubuntu.com/usn/usn-2622-1/ *** Cisco IP Phone 7861 Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=39011 *** ZDI-15-240: Dell NetVault Backup Heap Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell NetVault Backup. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/y6osEWmyti0/ *** ZDI-15-244: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicies Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NFGleCbsATc/ *** ZDI-15-243: Arcserve Unified Data Protection Management Service EdgeServiceImpl getBackupPolicy Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose information on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OV8j2fD9GSM/ *** ZDI-15-242: Arcserve Unified Data Protection Management Service exportServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/CxxqPV5u-0s/ *** ZDI-15-241: Arcserve Unified Data Protection Management Service reportFileServlet Directory Traversal Information Disclosure and Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to disclose and delete files on vulnerable installations of Arcserve Unified Data Protection. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/MNmtjnSQ_b4/ *** SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- SAP NetWeaver XML External Entity Processing Flaw Lets Remote Users Obtain Potentially Sensitive Information --------------------------------------------- http://www.securitytracker.com/id/1032402 *** Security Advisory: Point-to-Point Protocol (PPP) vulnerability CVE-2015-3310 *** --------------------------------------------- (SOL16686) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/600/sol16686.htm… *** lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries *** --------------------------------------------- lighttpd Input Validation Flaw Lets Remote Users Inject Log File Entries --------------------------------------------- http://www.securitytracker.com/id/1032405 *** Rockwell Automation RSView32 Weak Encryption Algorithm on Passwords *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on May 12, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a password encryption vulnerability in RSView32. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02 *** Thycotic Password Manager Secret Server iOS Application MITM *** --------------------------------------------- Topic: Thycotic Password Manager Secret Server iOS Application MITM Risk: Medium Text:Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability -- http://www.info-sec.ca/adviso... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050167

1 0

Tageszusammenfassung - Dienstag 26-05-2015
by Daily end-of-shift report 26 May '15

26 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 22-05-2015 18:00 − Dienstag 26-05-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Annual Privacy Forum 2015: Call for Papers and latest news *** --------------------------------------------- The Annual Privacy Forum (APF) meeting will be taking place on the 7th and 8th of October 2015 in Luxembourg, during its Presidency of the Council of the EU. This year, the main focus of the APF will be on privacy of electronic communications. Current open calls:... --------------------------------------------- http://www.enisa.europa.eu/media/news-items/annual-privacy-forum-2015-call-… *** Securing Web APIs: The Basics with Node.js Examples *** --------------------------------------------- Introduction Public-facing APIs have tremendously increased in the last couple of years. Businesses have seen that sharing their business data with the public can be beneficial. There are many reasons for this: such as the fact that it allows the API users to create something new and interesting with the shared data, and that APIs... --------------------------------------------- http://resources.infosecinstitute.com/securing-web-apis-the-basics-with-nod… *** Android: Schlüssel werden auf zurückgesetzten Smartphones nicht gelöscht *** --------------------------------------------- Auf zurückgesetzten Android-Smartphones lassen sich Daten wiederherstellen, auch auf solchen, die zuvor verschlüsselt wurden. Anwender können kaum etwas dagegen tun. --------------------------------------------- http://www.golem.de/news/android-schluessel-werden-auf-zurueckgesetzten-sma… *** Recent Breaches a Boon to Extortionists *** --------------------------------------------- The recent breaches involving the leak of personal data on millions of customers at online hookup site Adult Friend Finder and mobile spyware maker mSpy give extortionists and blackmailers plenty of ammunition with which to ply their trade. And there is some evidence that neer-do-wells are actively trading this data and planning to abuse it for financial gain. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/spK0KOTLf64/ *** Travel smart: Tips for staying secure on the road *** --------------------------------------------- Cybercriminals dont take vacations. In fact, they feast on tourists and travelers, taking advantage of people when their guards are down or when theyre distracted by other pursuits. Wombat Security Technologies pulled together four essential tips from our security awareness and training materials that you can use to stay safe when you travel --------------------------------------------- http://www.net-security.org/secworld.php?id=18421 *** How to Pass-the-Hash with Mimikatz *** --------------------------------------------- A hidden gem in mimikatz is its ability to create a trust relationship from a username and password hash. --------------------------------------------- http://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/ *** Windows Functions in Malware Analysis - Cheat Sheet - Part 1 *** --------------------------------------------- In this article, we will learn briefly about the various windows functions commonly encountered by malware analysts. Windows Functions Accept: This function is used to listen for incoming connections. This function indicates that the program will listen for incoming connections on a socket. It is mostly used by malware to communicate with their Command and... --------------------------------------------- http://resources.infosecinstitute.com/windows-functions-in-malware-analysis… *** Exploit-Kit greift über 50 Router-Modelle an *** --------------------------------------------- Wer einen unsicher konfigurierten Router betreibt, könnte schon bald Probleme bekommen: Ein Virenforscher hat ein Exploit-Kit entdeckt, das zahlreiche Router-Modelle bekannter Hersteller angreifen kann. --------------------------------------------- http://heise.de/-2665387 *** How often should companies conduct web penetration testing? *** --------------------------------------------- Following our previous blog post "How long does website penetration testing take" we received a lot of questions from our customers and partners about the recommended frequency of penetration testing for their web applications. In this blog post we will answer that question. --------------------------------------------- https://www.htbridge.com/blog/how_often_conduct_web_penetration_testing.html *** Cisco Unified Communications Manager Multiple Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38964 *** Cisco HCS Administrative Web Interface Arbitrary Command Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38969 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** PostgreSQL Bugs Let Remote Users Deny Service and Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032396 *** Cacti Input Validation Flaw in graph.php Lets Remote Authenticated Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032385 *** VU#551972: Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files *** --------------------------------------------- Vulnerability Note VU#551972 Synology Cloud Station sync client for OS X allows regular users to claim ownership of system files Original Release date: 26 May 2015 | Last revised: 26 May 2015 Overview The Synology Cloud Station sync client for OS X contains a setuid root executable that allows regular users to claim ownership of system files. Description CWE-276: Incorrect Default Permissions - CVE-2015-2851The Synology Cloud Station sync client for OS X contains an executable named --------------------------------------------- http://www.kb.cert.org/vuls/id/551972 *** Bugtraq: Synology Photo Station multiple Cross-Site Scripting vulnerabilities *** --------------------------------------------- http://www.securityfocus.com/archive/1/535607 *** Bugtraq: Reflected Cross-Site Scripting in Synology DiskStation Manager *** --------------------------------------------- http://www.securityfocus.com/archive/1/535606 *** Bugtraq: Command injection vulnerability in Synology Photo Station *** --------------------------------------------- http://www.securityfocus.com/archive/1/535605 *** HP SiteScope Unspecified Flaw Lets Remote Authenticated Users Gain Elevated Privileges *** --------------------------------------------- http://www.securitytracker.com/id/1032395 *** GigPress <= 2.3.8 - Authenticated SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8003 *** NewStatPress 0.9.8 - XSS and SQL Injection *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/8004

1 0

Tageszusammenfassung - Freitag 22-05-2015
by Daily end-of-shift report 22 May '15

22 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 21-05-2015 18:00 − Freitag 22-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Fake jQuery Scripts in Nulled WordPress Plugins *** --------------------------------------------- We recently investigated some random redirects on a WordPress website that would only happen to certain visitors. Traffic analysis showed us that it was not a server-side redirect, rather it happened due to some script loaded by the web pages. A quick look through the HTML code revealed this script: It was very suspicious for... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/NmLDakrD_1U/fake-jquery-scrip… *** Researchers publish developer guidance for medical device security *** --------------------------------------------- The guidance is organized into 10 categories, and serves as "starting point for a more complete code," report authors said. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/jvWoZydXqwc/ *** Researchers observe SVG files being used to distribute ransomware *** --------------------------------------------- When downloaded and executed, the SVG files cause websites to open up that download what appears to be CryptoWall ransomware. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/Aa-yVI5Bd-A/ *** Exploring CVE-2015-1701 - A Win32k Elevation of Privilege Vulnerability Used in Targeted Attacks *** --------------------------------------------- Our analysis of the win32k.sys vulnerability used in a recent targeted attack reveals that it opens up an easy way to bypass the sandbox, making it a bigger threat than originally thought. As mentioned in Microsoft security bulletin MS15-051, CVE-2015-1701 is an elevation of privilege vulnerability that exists when the Win32k.sys kernel-mode driver improperly handles... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/RuzGqW0kQdY/ *** Digital Agenda Seminar: European Cyber Security Month *** --------------------------------------------- Within the context of European Cyber Security Month (ECSM) preparations, the ENISA team is organising several seminars and trainings in order to build up the coalition for Cybersecurity Education action. You are invited to participate in the second seminar in Berlin, Germany on June 5th, 2015. In this half-day seminar we discuss and provide the latest information on Digital Agenda topics such as e-skills, Network Information Security, educational tools and advocacy initiatives. To participate it is necessary to confirm participation to daria.catalui(a)enisa.europa.eu by June 4th, 2015. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/digital-agenda-seminar-european… *** Daten von Millionen zurückgesetzten Android-Smartphones wiederherstellbar *** --------------------------------------------- Wer sein Android-Smartphone verkauft hat, muss befürchten, dass trotz gelöschten Gerätespeichers noch private Daten wie etwa Nachrichten und Log-in-Daten im Speicher schlummern, die unter Umständen wiedergehergestellt werden können. --------------------------------------------- http://heise.de/-2663267 *** Forensic Analysis of Smartphone Factory Reset Function *** --------------------------------------------- ADISA, the organisation that sets security standards around the secure disposal of IT Assets, has released new research into the forensic analysis of smartphone factory reset functions. Written by Steve Mellings, Founder of ADISA, and Professor Andrew Blyth of the University of South Wales, the white paper explores how effective smartphone factory reset functions actually are at removing data. This data is then used to offer businesses and individual users advice on how best to protect their... --------------------------------------------- http://www.informationsecuritybuzz.com/forensic-analysis-of-smartphone-fact… *** When Security Makes Users Asleep! *** --------------------------------------------- It's a fact, in industries or on building sites, professional people make mistakes or, worse, get injured. Why? Because their attention is reduced at a certain point. When you're doing the same job all day long, you get tired and lack of concentration. The same can apply in information security! For a long time, more and more solutions are deployed in companies to protect their data and users. Just... --------------------------------------------- http://blog.rootshell.be/2015/05/22/when-security-makes-users-asleep/ *** Citrix Security Advisory for DHE_EXPORT TLS Vulnerability CVE-2015-4000 *** --------------------------------------------- A TLS protocol vulnerability has been recently disclosed that could result in attackers being able to intercept and modify SSL/TLS encrypted traffic ... --------------------------------------------- http://support.citrix.com/article/CTX201114 *** Citrix Security Advisory for CVE-2015-3456 *** --------------------------------------------- Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the ... --------------------------------------------- http://support.citrix.com/article/CTX201078 *** python-kerberos checkPassword() spoofing *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/103310 *** Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38946 *** ICU Buffer Overflows in resolveImplicitLevels() Let Remote Users Deny Service and Potentially Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032366 *** Schneider Electric OFS Server Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a DLL hijacking vulnerability in the Schneider Electric OPC Factory Server (OFS) server application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 *** Emerson AMS Device Manager SQL Injection Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an SQL injection vulnerability in the Emerson AMS Device Manager application. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 *** OleumTech WIO Family Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-14-202-01 OleumTech WIO Family Vulnerabilities that was published July 21, 2014. This advisory provides vulnerability details in the OleumTech WIO family including the sensors and the DH2 data collector. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-14-202-01A *** HPSBMU03336 rev.1- HP Helion OpenStack affected by VENOM, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- A potential security vulnerability has identitfied with HP Helion OpenStack. The vulnerability could be exploited resulting in Denial of Service (DoS) or execution of arbitrary code. --------------------------------------------- https://h20566.www2.hp.com/hpsc/doc/public/display?calledBy=&docId=emr_na-c… *Next End-of-Shift report on 2015-05-26*

1 0

Tageszusammenfassung - Donnerstag 21-05-2015
by Daily end-of-shift report 21 May '15

21 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 20-05-2015 18:00 − Donnerstag 21-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** RIG Exploit Kit Infection Cycle Analysis *** --------------------------------------------- Overview Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes weve observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post well cover an example of a full RIG infection cycle. Delivery... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JM9Mp15Wupg/rig-exploit-… *** New Router Attack Displays Fake Warning Messages *** --------------------------------------------- Just because security researchers report about threats doesn't mean we're exempted from them. I recently experienced an incident at home that involved tampered DNS router settings. I was redirected to warning pages that strongly resemble those used in previous FAKEAV attacks. I noticed that my home internet router DNS settings have been modified from its default settings. (My router... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/dJj2wXBlvgk/ *** Exploit kits delivering Necurs, (Thu, May 21st) *** --------------------------------------------- Introduction In the past few days, weve seenNuclear and Anglerexploit kits (EKs) deliveringmalware identified as Necurs. It certainly isntthe only payload sentfrom Nuclear and otherEKs, but I hadnt really looked into EK traffic sending Necurs lately. Documented as early as 2012, Necurs is a type of malware that opens a back door on the infected computer [1]. It may also disable antivirus products as well as download additional malware [1][2]. I sawNecurs as a malware payload from Nuclear and... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19719&rss *** Das Erste-Hilfe-Kit gegen Krypto-Trojaner *** --------------------------------------------- Mit einer Reihe von Werkzeugen will ein Forscher den Opfern von Erpressungs-Trojanern helfen, ihre Daten zu retten und ihre Systeme zu reinigen. Allerdings ist bei der Anwendung Vorsicht geboten. --------------------------------------------- http://heise.de/-2661154 *** Mumblehard Malware *** --------------------------------------------- Introduction In this article, we will learn about a malware known as Mumblehard which is known for targeting Linux and BSD OS. This malware opens a backdoor that gives the full control of the infected machine to cybercriminals. Mumblehard malware -Components Perl Backdoor Perl backdoor will request for commands from its Command &Control Server and... --------------------------------------------- http://resources.infosecinstitute.com/mumblehard-malware/ *** Logjam: the latest TLS vulnerability explained *** --------------------------------------------- 21 May 2015 by Filippo Valsorda --------------------------------------------- https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ *** The Logjam (and Another) Vulnerability against Diffie-Hellman Key Exchange *** --------------------------------------------- Logjam is a new attack against the Diffie-Hellman key-exchange protocol used in TLS. Basically: The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/the_logjam_and_.html *** CVE-2015-4000 alias "Logjam" .. *** --------------------------------------------- http://www.cert.at/services/blog/20150521111403-1485.html *** Vuln: OpenSSL CVE-2015-0288 Denial of Service Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73237 *** Vuln: OpenSSL /evp/encode.c Remote Memory Corruption Vulnerability *** --------------------------------------------- http://www.securityfocus.com/bid/73228 *** Samba Memory Corruption Error in prs_append_some_prs_data() Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032362 *** Cisco Security Manager Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=34325 *** Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38937 *** Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38927 *** DSA-3265 zendframework - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in Zend Framework, a PHPframework. Except for CVE-2015-3154, all these issues were already fixedin the version initially shipped with Jessie. --------------------------------------------- https://www.debian.org/security/2015/dsa-3265

1 0

Tageszusammenfassung - Mittwoch 20-05-2015
by Daily end-of-shift report 20 May '15

20 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 19-05-2015 18:00 − Mittwoch 20-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Logjam - vulnerabilities in Diffie-Hellman key exchange affect browsers and servers using TLS, (Wed, May 20th) *** --------------------------------------------- Theres a new vulnerability in town... As reported by the Wall Street Journal, The new bug, dubbed LogJam, is a cousin of Freak. But its in the basic design of TLS itself, meaning all Web browsers, and some email servers, are vulnerable. [1] According to the article, Internet-security experts crafted a fix for a previously undisclosed bug in security tools used by all modern Web browsers. But deploying the fix could break the Internet for thousands of websites. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19717&rss *** Logjam: PFS Deployment Guide *** --------------------------------------------- Guide to Deploying Diffie-Hellman for TLS | Our study finds that the current real-world deployment of Diffie-Hellman is less secure than previously believed. This page explains how to properly deploy Diffie-Hellman on your server. | We have three recommendations for correctly deploying Diffie-Hellman for TLS:... --------------------------------------------- https://weakdh.org/sysadmin.html *** DDoS Attacks on the rise in Q1 2015, says Akamai *** --------------------------------------------- DDoS attacks even more dangerous according to the last report published by Akamai Technologies, the "Q1 2015 State of the Internet - Security Report". According to Akamai Technologies, Q1 2015 showed that distributed denial-of-service attacks are on the rise again, and according to Akamai Technologies, Q1 set a record for the number of DDoS attacks,... --------------------------------------------- http://securityaffairs.co/wordpress/36983/security/akamai-ddos-q1-2015.html *** "Los Pollos Hermanos" ransomware - what will they think of next? *** --------------------------------------------- The latest visual meme in ransomware comes from a cult TV show...about ficticious crooks. Paul Ducklin walks you through "PolloCrypt," more correctly known as Troj/LPoLock-A... --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/jdSKvU31t58/ *** JSON, Homoiconicity, and Database Access *** --------------------------------------------- During a recent review of an internal web application based on the Node.js platform, we discovered that combining JavaScript Object Notation (JSON) and database access (database query generators or object-relational mappers, ORMs) creates interesting security challenges, particularly for JavaScript programming... --------------------------------------------- https://securityblog.redhat.com/2015/05/20/json-homoiconicity-and-database-… *** iOS Security Guide (iOS 8.3) *** --------------------------------------------- https://www.apple.com/business/docs/iOS_Security_Guide.pdf *** What We Learned From a Data Exfiltration Incident at an Electric Utility *** --------------------------------------------- We often hear about the dangers of a cyberattacks taking down the grid, but seldom is public information available about the loss of sensitive information, particularly from the OT. The confidential information in this case was the utilitys smart grid and metering R&D knowledge base, which is intellectual property and information that attackers can use to compromise the smart grid. --------------------------------------------- http://www.elp.com/articles/powergrid_international/print/volume-20/issue-5… *** 5 Signs Credentials In Your Network Are Being Compromised *** --------------------------------------------- Where should you start to keep ahead of attackers using insiders to steal corporate secrets or personal identifiable information? Check out these common scenarios. --------------------------------------------- http://www.darkreading.com/vulnerabilities---threats/5-signs-credentials-in… *** Update soll Mac-Outlook 2011 reanimieren *** --------------------------------------------- Mit Version 14.5.1 der Office-Version 2011 für OS X will Microsoft ein Problem bei Outlook beseitigen - der E-Mail-Client ließ sich nach Installation des vorausgehehenden Updates unter Umständen nicht mehr verwenden. --------------------------------------------- http://www.heise.de/newsticker/meldung/Update-soll-Mac-Outlook-2011-reanimi… *** MS15-046 - Version: 2.0 *** --------------------------------------------- V2.0 (May 19, 2015): Bulletin revised to announce the release of the Microsoft Office for Mac 14.5.1 update. The release addresses a potential issue with Microsoft Outlook for Mac when customers install the Microsoft Office for Mac 14.5.0 update. Customers who have not already installed the 14.5.0 update should install the 14.5.1 update to be fully protected from this vulnerability. To avoid the possibility of future issues with Microsoft Outlook for Mac, Microsoft recommends that customers... --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-046 *** HPSBGN03286 rev.1 - HP LoadRunner, Buffer Overflow *** --------------------------------------------- A potential security vulnerability has been identified with HP LoadRunner. The vulnerability could be exploited remotely to allow a buffer overflow. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04594015 *** HPSBUX03334 SSRT102000 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (DoS) and Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running OpenSSL. These vulnerabilities could be exploited remotely to create a remote Denial of Service (DoS) and other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679334 *** HPSBUX03333 SSRT102029 rev.1 - HP-UX Running NTP, Remote Denial of Service (DoS), or Other Vulnerabilities *** --------------------------------------------- Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to create a Denial of Service (DoS), or other vulnerabilities. --------------------------------------------- https://h20565.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04679309 *** Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability *** --------------------------------------------- 38913 --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38913 *** ZDI-15-235: ManageEngine Applications Manager CommonAPIUtil getMGList groupId SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/x_So65VKXQk/ *** ZDI-15-234: ManageEngine Applications Manager CommonAPIUtil SyncMonitors haid SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/NDUhf-djzIs/ *** ZDI-15-233: Valve Steam Client Detection Denial of Service Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute a denial of service attack on vulnerable installations of Valve Steam. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/z6v9MWWd9O4/ *** Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities *** --------------------------------------------- Topic: Hikvision DS-7108HWI-SH XML Injection, AoF and BF vulnerabilities Risk: High Text:Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Bru... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050127 *** IPsec-Tools 0-day Denial of Service *** --------------------------------------------- Topic: IPsec-Tools 0-day Denial of Service Risk: High Text:Denial of Service in IPsec-Tools Vulnerability Report May 19, 2015 Product: IPsec-Tools Version: 0.8.2 Website: http:/... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050128 *** Security Advisory - Two Privilege Escalation Vulnerabilities in Huawei Mate 7 Smartphones *** --------------------------------------------- May 20, 2015 14:40 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [HTB23257]: Stored XSS in WP Photo Album Plus WordPress Plugin *** --------------------------------------------- Product: WP Photo Album Plus WordPress Plugin v6.1.2Vulnerability Type: Cross-Site Scripting [CWE-79]Risk level: Medium Creater: J.N. BreetveltAdvisory Publication: April 29, 2015 [without technical details]Public Disclosure: May 20, 2015 CVE Reference: CVE-2015-3647 CVSSv2 Base Score: 5 (AV:N/AC:L/Au:N/C:N/I:P/A:N) Vulnerability Details: High-Tech Bridge Security Research Lab discovered stored XSS vulnerability in WP Photo Album Plus WordPress plugin, which can be exploited to perform... --------------------------------------------- https://www.htbridge.com/advisory/HTB23257 *** Bugtraq: Eisbär SCADA (All Versions - iOS, Android & W8) - Persistent UI Vulnerability *** --------------------------------------------- http://www.securityfocus.com/archive/1/535576

1 0

Tageszusammenfassung - Dienstag 19-05-2015
by Daily end-of-shift report 19 May '15

19 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 18-05-2015 18:00 − Dienstag 19-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Tracking SSL Issues with the SSL Labs API *** --------------------------------------------- The SSL and TLS protocols have been on the front of the stage for months. Besides many vulnerabilities disclosed in the OpenSSL library, the deployment of SSL and TLS is not always easy. They are weak cyphers (like RC4), weak signatures, certificates issues (self-signed, expiration or fake ones). Other useful features are mis-understood and not often not configured like PFS ("Perfect Forward Secrecy"). Encryption effectiveness is directly related... --------------------------------------------- http://blog.rootshell.be/2015/05/18/tracking-ssl-issues-with-the-ssl-labs-a… *** Magnitude Exploit Kit leading to Ransomware via Malvertising *** --------------------------------------------- Magnitude Exploit Kit is a malicious exploit package that leverages a victim's vulnerable browser plugins in order to download a malicious payload to a system. This technique is known as a drive-by-download attack, which is often leveraged on compromised websites and malicious advertising networks. We recently found a number of compromised pages following the structure of fake search engine... --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/YQBX1Zq733A/magnitude-ex… *** Website Security - How Do Websites Get Hacked? *** --------------------------------------------- In 2014 the total number of websites on the internet reached 1 billion, today it's hovering somewhere in the neighborhood of 944 million due to websites going inactive and it is expected to normalize again at 1 billion sometime in 2015. Let's take a minute to absorb that number for a moment. Another surprising statistic is... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/w0FMyW_q_bA/website-security-… *** Cyber Security Challenge 2015 *** --------------------------------------------- Cyber Security Challenge 2015 | 19. Mai 2015 | Auch heuer gibt es wieder die Cyber Security Challenge zur Suche von Hacker-Nachwuchstalenten. 2015 wird das europäische Finale zwischen 6 Ländern ausgespielt, und Österreich muss den Titel verteidigen.Die Qualifizierungsrunde läuft heuer von 4. Mai bis 3. August und steht Schülern und Studenten offen. Details siehe www.verbotengut.at.Wir wollen wieder ein gutes Team zusammenbekommen, wir bitten daher alle Leser, diesen Hinweis... --------------------------------------------- http://www.cert.at/services/blog/20150519084602-1482.html *** Cmstar Downloader: Lurid and Enfal's New Cousin *** --------------------------------------------- In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as "Enfal". Cmstar was named for the log message "CM**" used by the downloader. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/cmstar-downloader-lurid-… *** SSH-Client Putty: Trojaner-Version im Umlauf *** --------------------------------------------- Wer mit dem SSH-Client Putty auf Geräte zugreifen will, sollte auf die Quelle des Clients achten. Aktuell geistert nämlich eine Version durch das Internet, die einen Trojaner auf Computer schmuggelt, um Daten abzugreifen. --------------------------------------------- http://heise.de/-2654274 *** More on Chris Roberts and Avionics Security *** --------------------------------------------- Last month ago I blogged about security researcher Chris Roberts being detained by the FBI after tweeting about avionics security while on a United flight: But to me, the fascinating part of this story is that a computer was monitoring the Twitter feed and understood the obscure references, alerted a person who figured out who wrote them, researched what flight... --------------------------------------------- https://www.schneier.com/blog/archives/2015/05/more_on_chris_r.html *** How much money do cyber crooks collect via crypto ransomware? *** --------------------------------------------- FireEye researchers have calculated that the cybercriminals wielding TeslaCrypt and AlphaCrypt have managed to extort $76,522 from 163 victims in only two months. "This amount may seem trivial co... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/uK_6Ovw0K9M/malware_news.… *** Address spoofing Safari bug opens door for phishing attacks *** --------------------------------------------- Hacker David Leo has released a PoC exploit for a Safari vulnerability that can be misused to trick users into thinking they are on one site while they are actually on another - a boon for phishers. ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/6F6ptWfI8rw/secworld.php *** Address-Spoofing Bug Haunts Android Stock Browser *** --------------------------------------------- There's an easily exploitable vulnerability in the Android stock browser that enables an attacker to spoof the URL in the address bar and force a victim to visit a malicious site while believing he is visiting a benign one. Security researcher Rafay Baloch discovered the vulnerability and developed the technique for exploiting it. The problem... --------------------------------------------- http://threatpost.com/address-spoofing-bug-haunts-android-stock-browser/112… *** KCodes NetUSB: How a Small Taiwanese Software Company Can Impact the Security of Millions of Devices Worldwide *** --------------------------------------------- Today the SEC Consult Vulnerability Lab released an advisory regarding a vulnerability in a software component called NetUSB. This post intends to give some background information about this vulnerability.NetUSB is a proprietary technology developed by the Taiwanese company KCodes, intended to provide "USB over IP" functionality. USB devices (e.g. printers, external hard drives, flash drives) plugged into a Linux-based embedded system (e.g. a router, an access point or a dedicated... --------------------------------------------- http://blog.sec-consult.com/2015/05/kcodes-netusb-how-small-taiwanese.html *** [2015-05-19] Critical buffer overflow vulnerability in KCodes NetUSB *** --------------------------------------------- KCodes NetUSB is vulnerable to a buffer overflow via the network that results in a denial of service or code execution. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38905 *** IBM Security Bulletin: WebSphere Message Broker and IBM Integration Bus are affected by cross-site scripting (XSS) Vulnerabilities in Dojo Toolkit *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21902837 *** Moodle Multiple Flaws Let Remote Users Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Bypass Security Restrictions *** --------------------------------------------- http://www.securitytracker.com/id/1032358 *** Bugtraq: [SECURITY] [DSA 3175-2] kfreebsd-9 security update *** --------------------------------------------- http://www.securityfocus.com/archive/1/535562

1 0

Tageszusammenfassung - Montag 18-05-2015
by Daily end-of-shift report 18 May '15

18 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 15-05-2015 18:00 − Montag 18-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Cyberattacks on Oil and Gas Firms Launched with no Malware at all *** --------------------------------------------- Oil and gas industry targeted by hackers with a genuine looking windows file, not a malware. The attacks are ongoing for about two years. A unique targeted attack being underway for about two consecutive years exploits Windows file functions that look legitimate and a couple of homemade scripts - but not malware - in order... --------------------------------------------- http://securityaffairs.co/wordpress/36843/cyber-crime/cyberattacks-on-oil-a… *** Microsoft Stops Chinese Group from Using TechNet Site for Attacks (May 14, 2015) *** --------------------------------------------- Microsoft and FireEye have taken steps to prevent a group of Chinese cyber criminals known as APT17 from using the companys TechNet website in its attacks... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/38/302 *** VENOM - Does it live up to the hype?, (Sat, May 16th) *** --------------------------------------------- Unless you have been hiding under a rock this week you have heard about VENOM. The first article that I saw was fromZDNet with the headline of Bigger than Heartbleed, Venom security vulnerability threatens most datacenters. Pretty provocative stuff. Is VENOM really worth that much hype? VENOM stands for Virtualized Environment Neglected Operations Manipulation. The cuteacronym basically means that the exploit takes advantage of a vulnerability in legacy code.In short thevulnerability is... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19701&rss *** AEADs: getting better at symmetric cryptography *** --------------------------------------------- I gave a talk a couple of weeks ago at the Yahoo Unconference. The conference was at the end of a particually hard week for a bunch of reasons and I fear that the talk wasn't that great. (Afterwards I got home about 3pm and pretty much slept until the following morning.) This post is a, hopefully clearer, articulation of its contents. --------------------------------------------- http://www.imperialviolet.org/2015/05/16/aeads.html *** About the supposed factoring of a 4096 bit RSA key *** --------------------------------------------- tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key. Earlier today a blog post claiming the factoring of a 4096 bit RSA key was published and quickly made it to the top of Hacker News. The key in question was the PGP key of a well-known Linux kernel developer. I already commented on Hacker News why this is most likely wrong, but I thought Id write up some more details. To understand what is going on I have to explain some background both on RSA and... --------------------------------------------- https://blog.hboeck.de/archives/872-No,-nobody-has-factored-a-4096-bit-RSA-… *** Google App Engine: Google reagiert träge auf Java-Sicherheitslücken *** --------------------------------------------- Klammheimlich patcht Google Java-Schwachstellen in seiner Entwicklungsumgebung App Engine und ignoriert den Entdecker der Lücken weitgehend. Einige Sicherheitslücken klaffen immer noch. --------------------------------------------- http://heise.de/-2652121 *** Angreifer nutzen kritische Lücke in ProFTPD aus *** --------------------------------------------- Wer den FTP-Server ProFTPD betreibt, muss handeln: Durch eine schwerwiegende Schwachstelle können Online-Ganoven beliebigen Code ausführen. Und das tun sie auch bereits. --------------------------------------------- http://heise.de/-2652114 *** Screech! Grand Theft Auto V malware mods warning *** --------------------------------------------- Gamers find themselves in latest Mods & Rockstar punch-up Cybercrooks are cooking up malware disguised as mods for the Grand Theft Auto V video game. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/18/gta_malware… *** Rombertiks disk wiping mechanism is aimed at pirates, not researchers *** --------------------------------------------- Rombertik, the information-stealing malware that was recently analyzed by Cisco researchers and which apparently tries to prevent researchers from doing so by rewriting the computers Master Boot Reco... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/oE0fh7NZ4sg/malware_news.… *** Oracle Patches VENOM Vulnerability *** --------------------------------------------- Oracle on Saturday released its patch for the VENOM vulnerability, a guest escape flaw that affects many virtualization platforms. --------------------------------------------- http://threatpost.com/oracle-patches-venom-vulnerability/112868 *** openssh 6.8p1 heap buffer overflow *** --------------------------------------------- Topic: openssh 6.8p1 heap buffer overflow Risk: High Text:Quick background story: I started a while ago to develop a solution to use american fuzzy lop with networking input. I did so b... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050105 *** Bugtraq: [SE-2014-02] Unconfirmed / unpatched vulnerabilities in Google App Engine *** --------------------------------------------- http://www.securityfocus.com/archive/1/535548 *** ZDI-15-230: ManageEngine Applications Manager IT360UtilitiesServlet query SQL Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/qN5KZVA4xgA/ *** ZDI-15-229: ManageEngine Applications Manager DowntimeSchedulerServlet TASKID SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/PLAGhXOxQh0/ *** ZDI-15-231: Dell Sonicwall GMS Virtual Appliance Multiple Remote Code Execution Vulnerabilities *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Dell SonicWALL Global Management System (GMS) virtual appliance. Authentication is required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/HtMlLoJoKXI/ *** Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38884 *** DSA-3261 libmodule-signature-perl - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in libmodule-signature-perl, aPerl module to manipulate CPAN SIGNATURE files. The CommonVulnerabilities and Exposures project identifies the following problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3261 *** SAP Sybase Unwired Platform Online Data Proxy Discloses Password and Username Information to Local Users *** --------------------------------------------- http://www.securitytracker.com/id/1032310 *** SAP Customer Relationship Management Bugs Let Users Execute Arbitrary Code and Remote Users Inject SQL Commands *** --------------------------------------------- http://www.securitytracker.com/id/1032309 *** SAP NetWeaver RFC SDK Discloses Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032308

1 0

Tageszusammenfassung - Freitag 15-05-2015
by Daily end-of-shift report 15 May '15

15 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 13-05-2015 18:00 − Freitag 15-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38789 http://tools.cisco.com/security/center/viewAlert.x?alertId=38808 http://tools.cisco.com/security/center/viewAlert.x?alertId=38811 http://tools.cisco.com/security/center/viewAlert.x?alertId=38833 http://tools.cisco.com/security/center/viewAlert.x?alertId=38864 http://tools.cisco.com/security/center/viewAlert.x?alertId=38865 http://tools.cisco.com/security/center/viewAlert.x?alertId=38866 http://tools.cisco.com/security/center/viewAlert.x?alertId=38869 http://tools.cisco.com/security/center/viewAlert.x?alertId=38868 *** Multiple vulnerabilities in Loxone Smart Home (part 2) *** --------------------------------------------- The Loxone Smart Home vulnerabilities published in February 2015 (SA-20150227-0) have not been fixed entirely and can still be exploited. Furthermore, new security issues have been identified. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Openlitespeed <= 1.3.10 Multiple Vulnerabilities *** --------------------------------------------- http://cxsecurity.com/issue/WLB-2015050096 *** Hospira LifeCare PCA Infusion System Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-125-01 Hospira LifeCare PCA Infusion System Vulnerabilities that was published May 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification .. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A *** Organizational Challenges in the Internet of Things *** --------------------------------------------- As a result of the increase in cyber-attacks launched by nation-states, cybercriminals, hacktivist groups and other entities, it has become increasingly important to understand the ecosystem of hardware, O/S, software, and services that are used in each organization's network, including .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/organizational-c… *** Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked *** --------------------------------------------- mSpy, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the companys servers was posted on the Dark Web, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-cu… *** Vulnerabilities in PHPMyAdmin *** --------------------------------------------- http://www.phpmyadmin.net/home_page/security/PMASA-2015-3.php http://www.phpmyadmin.net/home_page/security/PMASA-2015-2.php *** Kritik an fehlenden Sicherheitsfunktionen der Apple Watch *** --------------------------------------------- Die Apple Watch lässt sich ohne Kenntnis des Gerätecodes zurücksetzen – im Unterschied zu iPhone und iPad gibt es allerdings keine Aktivierungssperre, die die frische Inbetriebnahme durch einen Dieb verhindert. --------------------------------------------- http://heise.de/-2650499 *** Erpresser drohen zahlreichen deutschen Shops mit DDoS-Attacken *** --------------------------------------------- Eine Erpresserwelle verunsichert Betreiber von deutschen Online-Shops: Wer nicht zahlt, verliert womöglich Kunden. Was tun? --------------------------------------------- http://heise.de/-2650465 *** McAfees Reinigungs-Tool Stinger installiert heimlichen Wächter *** --------------------------------------------- Wer McAfees Scan-Tool "Stinger" benutzt, um seinen PC zu säubern, bekommt ungefragt einen Virenwächter im Betastadium untergeschoben. Einen Opt-Out gibt es nicht. --------------------------------------------- http://heise.de/-2645759 *** Hacking communities in the Deep Web *** --------------------------------------------- The role of hackers has changed over the years, in the past these professionals were viewed as dangerous criminals that needed to be kept at arm's length; meanwhile today they are highly sought from private companies, intelligence .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-communities-in-the-deep-web/ *** SAP LZC LZH Compression Multiple Vulnerabilities *** --------------------------------------------- SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the .. --------------------------------------------- http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vul… *** Latest Microsoft Security Intelligence Report Now Available *** --------------------------------------------- This volume of the SIR focuses on the second half of 2014 and contains longer term trend data as well. SIR volume 18 contains data, insights and practical guidance on a range of global and regional cybersecurity threats including vulnerability disclosures, malware and unwanted software including the latest on .. --------------------------------------------- http://blogs.microsoft.com/cybertrust/2015/05/14/latest-microsoft-security-… *** If Youre Typing the Word MCRYPT Into Your Code, Youre Doing It Wrong *** --------------------------------------------- Foreword: You probably should not be deploying your own cryptography to begin with, especially if you dont already understand that encryption is not authentication. For production systems, use PECL libsodium or defuse/php-encryption and save yourself the headache. The rest of this post is intended for PHP developers who still want to write their own cryptography code, or already have. --------------------------------------------- https://paragonie.com/blog/2015/05/if-you-re-typing-word-mcrypt-into-your-c… *** One year of DANE Tales and Lessons Learned *** --------------------------------------------- https://ripe70.ripe.net/presentations/183-dane-ripe.pdf *** Cylance SPEAR Team: A Threat Actor Resurfaces *** --------------------------------------------- Attackers typically shut down campaigns or halt activity after they are exposed by security researchers, thereby creating the impression they have dropped off the map. This often leads to a false sense of security within the community and perpetuates the idea that public exposure makes us all safer. While the .. --------------------------------------------- http://blog.cylance.com/spear-a-threat-actor-resurfaces

1 0

Tageszusammenfassung - Mittwoch 13-05-2015
by Daily end-of-shift report 13 May '15

13 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 12-05-2015 18:00 − Mittwoch 13-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-09: Security updates available for Adobe Flash Player APSB15-10: Security updates available for Adobe Reader and Acrobat Customers of the affected products should consult the relevant .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1197 *** How Social Media Blacklisting Happens *** --------------------------------------------- In today's world, we are all browsing websites online and sharing content on a multitude of social media platforms every day. Worldwide social media users exceeded 2 billion back in .. --------------------------------------------- https://blog.sucuri.net/2015/05/how-social-media-blacklisting-happens.html *** Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability *** --------------------------------------------- A vulnerability in the web-based administration interface of the Cisco Headend Digital Broadband Delivery System could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38767 *** Another look at Niteris : post exploitation WMI and Fiddler checks *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html *** Adobe, Microsoft Push Critical Security Fixes *** --------------------------------------------- Microsoft today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in Windows and associated software. Separately, Adobe pushed updates to fix a slew of critical flaws in its Flash Player and Adobe Air software, .. --------------------------------------------- http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-f… *** [2015-05-13] Multiple critical vulnerabilities in WSO2 Identity Server *** --------------------------------------------- An unauthenticated attacker is able to read arbitrary local files from the WSO2 Identity Server by using the SAMLv2 authentication interface. Moreover, targeted attacks against users or administrators of the Identity Server may be conducted using CSRF and XSS vulnerabilities. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Security: Wie Google Android sicher macht *** --------------------------------------------- HTTPS soll ausgemustert, Android sicherer werden, und es soll ein PGP-Plugin für Gmail geben: Google verstärkt seinen Einsatz im Bereich IT-Sicherheit enorm. Wir haben mit Googles IT-Sicherheitsexperten Stephan Somogyi darüber gesprochen. (Google, Gmail) --------------------------------------------- http://www.golem.de/news/security-wie-google-android-sicher-macht-1505-1140… *** Microsoft Security Bulletin Summary for May 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for May 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are issued, visit Microsoft Technical Security Notifications. Microsoft also .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-may *** VENOM, don't get bitten. *** --------------------------------------------- QEMU is a generic and open source machine emulator and virtualizer and is incorporated in some Red Hat products as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM hypervisors. CVE-2015-3456 (aka VENOM) .. --------------------------------------------- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/ *** Anatomy of an APT Attack: Step by Step Approach *** --------------------------------------------- This article will explore the technique, design and the inner workings of an APT (Advanced Persistent Threat) attack. It will also relate various stages of attack with a few attacks that were custom-created to penetrate enterprises for extraction of internal data, trade secrets, and sensitive business .. --------------------------------------------- http://resources.infosecinstitute.com/anatomy-of-an-apt-attack-step-by-step… *** Spam and Phishing in the First Quarter of 2015 *** --------------------------------------------- The share of spam in email traffic in the first quarter of 2015 was 59.2%; the percentage of spam gradually declined during the quarter. Spam traffic included a large number of mass mailings with Microsoft Word or Excel attachments containing macro viruses. --------------------------------------------- http://securelist.com/analysis/quarterly-spam-reports/69932/spam-and-phishi… *** OSIsoft PI AF Incorrect Default Permissions Vulnerability *** --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 *** Edge: Wie Microsoft seinen neuen Browser absichern will *** --------------------------------------------- Detailliert beschreibt Microsoft neue und bekannte Techniken, mit denen die Sicherheit des Edge-Browsers "fundamental" verbessert werden soll. Dabei hilft auch der Verzicht auf alte Technik des Internet Explorers. --------------------------------------------- http://www.golem.de/news/edge-wie-microsoft-seinen-neuen-browser-absichern-… Aufgrund des morgigen (14.05.2015) Feiertages erscheint der nächste End-of-Shift-Report erst am Freitag, den 15.05.2015.

1 0

Tageszusammenfassung - Dienstag 12-05-2015
by Daily end-of-shift report 12 May '15

12 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 11-05-2015 18:00 − Dienstag 12-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Steganography and Malware: Concealing Code and C&C Traffic *** --------------------------------------------- In our earlier post discussing steganography, I discussed how it is now being used to hide configuration data by malware attackers. Let's go discuss this subject another facet of this topic in this post: how actual malware code is hidden in similar ways. Security analysts will probably throw their hands up in the air and say, 'we've .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/steganography-an… *** Add GitHub dorking to list of security concerns *** --------------------------------------------- One of the big lessons that weve learned in the last 10 years is that even little pieces of once disparate data, gathered in a single location, can yield startling truths. With Facebook, that lesson crystallized with the introduction of its Graph Search feature in 2013, when the online world .. --------------------------------------------- http://www.csoonline.com/article/2921177/application-security/add-github-do… *** Golem.de-Test mit Kaspersky: So sicher sind Fototerminals und Copyshops *** --------------------------------------------- Wie gefährlich ist es, mit beschreibbaren USB-Sticks und SD-Karten Fotos und Dateien ausdrucken zu lassen? Golem.de hat zusammen mit dem Sicherheitsunternehmen Kaspersky getestet, ob auch Windows-XP-Terminals ohne Virenscanner sicher sind. --------------------------------------------- http://www.golem.de/news/golem-de-test-mit-kaspersky-so-sicher-sind-fototer… *** Verschlüsselte OSGP-Kommunikation von Smart Metern leicht belauschbar *** --------------------------------------------- Wenn Geräte im Smart Grid Informationen austauschen, könnten Angreifer trotz Krypto-Einsatz zumindest beim Standard Open Smart Grid Protocol Daten abgreifen. Sicherheitsforscher machen dafür das schwache Protokoll verantwortlich. --------------------------------------------- http://heise.de/-2642228 *** The State of ASLR on Android Lollipop *** --------------------------------------------- Modern platforms like Android devices enforce execute protections on memory, so injecting code into the process is often no longer the lowest hanging fruit for exploitation. Reusing the existing code and data has become the norm, and statistical defense via Address-Space Layout randomization is still the only widely available .. --------------------------------------------- https://copperhead.co/2015/05/11/aslr-android-zygote *** How secure will our data be in the post-quantum era? *** --------------------------------------------- Build your security for the next 50 years. If the speed of processing doubles every two years, make sure your cryptographic systems can't be brute forced in 50 years. If you use 2048 bit RSA, it will take some quadrillion years to break it. Good enough, right? --------------------------------------------- https://medium.com/@amarchenkova/how-secure-will-our-data-be-in-the-post-qu… *** Bublik Trojan - Variant Evolves with New Features *** --------------------------------------------- While there are many similar types of malware in use today, Bublik is being used for malicious activity and appears to be under active development, suggesting that its creators have paying customers. Because security involves a dynamic interaction .. --------------------------------------------- http://www.isightpartners.com/2015/05/bublik-trojan-variant-evolves-with-ne…

1 0

Tageszusammenfassung - Montag 11-05-2015
by Daily end-of-shift report 11 May '15

11 May '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 08-05-2015 18:00 − Montag 11-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the wireless web authentication subsystem of Cisco Wireless LAN Controller (WLC) could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38749 *** VMSA-2015-0003.8 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability *** --------------------------------------------- A vulnerability in the local read file of the Cisco Unified Communications Manager could allow an authenticated, local attacker to execute commands and obtain an interactive Linux shell as the root user. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38763 *** Who's Scanning Your Network? (A: Everyone) *** --------------------------------------------- Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldnt believe that people actually still cared about scanning, and I told him as much: These days there are .. --------------------------------------------- http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/ *** NCSC publishes factsheet Help! My website has been defaced *** --------------------------------------------- To deface a website the attacker changes the content of existing pages or adds new ones. Hundreds of websites are defaced every day, often without being specifically targeted. It is becoming increasingly common for defacements to .. --------------------------------------------- https://www.ncsc.nl/english/current-topics/news/ncsc-publishes-factsheet-he… *** Jellyfish: Malware nistet sich in GPUs ein *** --------------------------------------------- Nutzt eine Malware den Prozessor einer Grafikkarte, ist sie nicht nur schwerer aufzuspüren, sondern kann auch die höhere Rechenleistung der GPU nutzen. Jellyfish will zeigen, dass solcher Schadcode funktioniert. --------------------------------------------- http://www.golem.de/news/jellyfish-malware-nistet-sich-in-gpus-ein-1505-113… *** Yubikey: Nie mehr schlechte Passwörter *** --------------------------------------------- Unser Autor hat 152 Onlinekonten, die er möglichst gut absichern will. Mit dem Passwortmanager Keepass und einem sogenannten Token - dem Yubikey Neo. Eine Anleitung. --------------------------------------------- http://www.golem.de/news/yubikey-nie-mehr-schlechte-passwoerter-1505-113872… *** Tor-Bridges für Amazon EC2 eingestampft *** --------------------------------------------- Ab sofort wird es schwerer, Nutzern alternative Zugänge zum Anonymisierungsnetz Tor zur Verfügung zu stellen. Das entsprechende Projekt für Cloud-Images wurde eingestellt. --------------------------------------------- http://heise.de/-2640793 *** 60 Days of Watching Hackers Attack Elasticsearch *** --------------------------------------------- Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the .. --------------------------------------------- https://jordan-wright.github.io/blog/2015/05/11/60-days-of-watching-hackers… *** Finger printing: Print the Finger of an Application *** --------------------------------------------- When performing a Web Application Security Assessment, an important step is Fingerprinting which allows for further exploitation by an attacker. So as a security researcher/pentester, we should do well at fingerprinting the web server, which gives lot of information like application name, software version, .. --------------------------------------------- http://resources.infosecinstitute.com/finger-printing-print-the-finger-of-a… *** Angler exploit kit using tricks to avoid referrer chain leading back to malvertisement provider *** --------------------------------------------- For some time I've been seeing the Angler exploit kit pop up and infect clients without through malvertising campaigns without having a referer when visitng the landing page. The reason why this is interesting is that it makes it a lot harder to track down the malicious creative IDs which can .. --------------------------------------------- http://blog.0x3a.com/post/118366451134/angler-exploit-kit-using-tricks-to-a…

1 0

{Spam?} Tageszusammenfassung - Freitag 8-05-2015
by Daily end-of-shift report 08 May '15

08 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 07-05-2015 18:00 − Freitag 08-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Upcoming Security Updates for Adobe Reader and Acrobat (APSB15-10) *** --------------------------------------------- A prenotification Security Advisory has been posted regarding upcoming Adobe Reader and Acrobat updates scheduled for Tuesday, May 12, 2015. We will continue to provide updates on the upcoming release via the Security Advisory as well as the Adobe PSIRT blog. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1193 *** Compromised WordPress sites leaking credentials *** --------------------------------------------- Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/63XGcunva0k/compromised-… *** GPU-based malware, the evolution of rootkits and keyloggers *** --------------------------------------------- Malware developers have presented two proof-of-concept malware, a rootkit and a keylogger, which exploit the GPU of the infected host. Malware authors always demonstrate a great creativity and the ability to propose even more effective solutions, recently developers have published two strains of malware, Jellyfish rootkit and the Demon keylogger, that implement an unusual way to run on a victim's... --------------------------------------------- http://securityaffairs.co/wordpress/36634/malware/gpu-based-malware.html *** Almost EVERY SAP install hackable, researchers say *** --------------------------------------------- Even worse when you tinker with it. A staggering 95 percent of enterprise SAP installations contain high-severity vulnerabilities that could allow systems to be hijacked, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/08/sap_95_perc… *** l+f: Kritische Lücke in Überwachungs-Software für kritische Systeme *** --------------------------------------------- Über einen Bug in Symantecs Server-Überwachungs-Software können Angreifer den Systemen beliebige Dateien unterjubeln und diese ausführen. --------------------------------------------- http://heise.de/-2638669 *** The USBKILL anti-forensics tool - it doesnt do *quite* what it says on the tin *** --------------------------------------------- A hacker who very modestly goes by the handle Hephaestos has just announced an "anti-forensic kill switch" dubbed, well, usbkill. It doesnt do quite what the name might suggest, and it could cut either way, so use it with care! --------------------------------------------- http://feedproxy.google.com/~r/nakedsecurity/~3/tzGEjCOTbq4/ *** Flawed Open Smart Grid Protocol is a risk for Smart Grid *** --------------------------------------------- More than four million smart meters and similar devices worldwide are open to cyber attacks due to the security issued in the Open Smart Grid Protocol. The Open Smart Grid Protocol (OSGP) is a family of specifications published by the European Telecommunications Standards Institute (ETSI) that are implemented today by more than four million smart... --------------------------------------------- http://securityaffairs.co/wordpress/36648/hacking/flaws-open-smart-grid-pro… *** IETF spezifiziert Richtlinien für den Einsatz von Verschlüsselung *** --------------------------------------------- Das Gremium für Internet-Standards dokumentiert Richtlinien für den sinnvollen Einsatz der Transportverschlüsselung TLS. Der RFC 7525 enthält gute Anleitungen, Tipps und Hinweise auf Fallstricke für jeden, der Verschlüsselung selbst einrichtet. --------------------------------------------- http://heise.de/-2639221 *** Angreifer können Viren-Scanner von BullGuard und Panda lahmlegen *** --------------------------------------------- Mehrere Antiviren-Anwendungen von BullGuard und Panda weisen eine Sicherheitslücke auf, über die Angreifer die Schutzfunktionen deaktivieren können. --------------------------------------------- http://heise.de/-2639307 *** DSA-3253 pound - security update *** --------------------------------------------- Pound, a HTTP reverse proxy and load balancer, had several issuesrelated to vulnerabilities in the Secure Sockets Layer (SSL) protocol. --------------------------------------------- https://www.debian.org/security/2015/dsa-3253 *** Sentinel 7.3 HF1 (Sentinel 7.3.0.1) Build 1800 7.3.0.1 *** --------------------------------------------- Abstract: Sentinel 7.3.0.1 upgrade patch for Sentinel 7.Document ID: 5202070Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:sentinel_server-7.3.0.1-1817.x86_64.tar.gz.sha256 (109 bytes)sentinel_server-7.3.0.1-1817.x86_64.tar.gz (1.67 GB)Products:Sentinel 7.1SentinelSentinel 7.1.1Sentinel 7.1.2Sentinel 7.XSentinel 7.3Sentinel 7.2.2Sentinel 7.2.1Sentinel 7.2Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=mBuUwDq2kD0~ *** Rockwell Automation RSLinx Classic Vulnerability *** --------------------------------------------- This advisory was originally posted to the US-CERT secure Portal library on April 21, 2015, and is being released to the NCCIC/ICS-CERT web site. This advisory provides mitigation details for a stack-based buffer overflow vulnerability in Rockwell Automation's OPCTest.exe, which is a test client for RSLinx Classic's support of the OPC-DA protocol. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-111-02 *** VMSA-2015-0003.7 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** ZDI Security Advisories for EMC AutoStart and for ManageEngine Products *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/published/ *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in current releases of IBM WebSphere Real Time *** http://www.ibm.com/support/docview.wss?uid=swg21902444 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli System Automation for Multiplatforms (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21882749 *** IBM Security Bulletin: Multiple Kernel vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022146 *** IBM Security Bulletin: A Security Vulnerability exists in the Dojo runtime that affects Rational Application Developer *** http://www.ibm.com/support/docview.wss?uid=swg21883926 *** Security Bulletin: Vulnerability in SSLv3 affects Upward Integration Modules (UIM) (CVE-2014-3566) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097659 *** IBM Security Bulletin: PowerKVM is affected by a Qemu vulnerability (CVE-2015-1779) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022149 *** IBM Security Bulletin: Multiple Unzip vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022145 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Endpoint Manager (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883852 *** Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808) *** http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5097676

1 0

Tageszusammenfassung - Donnerstag 7-05-2015
by Daily end-of-shift report 07 May '15

07 May '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 06-05-2015 18:00 − Donnerstag 07-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco UCS Central Software Arbitrary Command Execution Vulnerability *** --------------------------------------------- A vulnerability in the web framework of Cisco UCS Central Software could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** eShop 6.3.11 - Remote Code Execution *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7967 *** Multiple vulnerabilities in ManageEngine Applications Manager *** --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-170 http://www.zerodayinitiative.com/advisories/ZDI-15-169 http://www.zerodayinitiative.com/advisories/ZDI-15-168 http://www.zerodayinitiative.com/advisories/ZDI-15-167 http://www.zerodayinitiative.com/advisories/ZDI-15-166 *** Macro Malware: When Old Tricks Still Work, Part 2 *** --------------------------------------------- In the first part of this series, we discussed about the macro malware we have recently seen in the threat landscape. This second entry will delve deeper into the techniques or routines of macro malware. Unintended consequences Let us put things into .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/macro-malware-wh… *** APPLE-SA-2015-05-06-1 Safari 8.0.6, Safari 7.1.6, and Safari 6.2.6 *** --------------------------------------------- Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. --------------------------------------------- http://prod.lists.apple.com/archives/security-announce/2015/May/msg00000.ht… *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Wie gestern (06. Mai) bekannt wurde, gibt es eine Sicherheitslücke im "Genericons icon font package" von WordPress, welches in vielen populären Themes und Erweiterungen, darunter das .. --------------------------------------------- http://cert.at/warnings/all/20150507.html *** Protect your network with DNS Firewall *** --------------------------------------------- If you run your own mail server, you will quickly find out that 90% of the e-mails you receive are spam. The solution .. --------------------------------------------- http://securityblog.switch.ch/2015/05/07/protect-your-network-with-dns-fire… *** Security Operations Center *** --------------------------------------------- Ensuring the confidentiality, integrity, and availability of a modern information technology enterprise is a big job. Cyber security breaches are becoming common news. The role of .. --------------------------------------------- http://resources.infosecinstitute.com/security-operations-center/ *** Analyzing Quantum Insert Attacks *** --------------------------------------------- A Quantum Insert Attack is a classic example of man-in-the-middle attacks which resurfaced into news among the top 10 biggest .. --------------------------------------------- http://resources.infosecinstitute.com/analyzing-quantum-insert-attacks/ *** Avast verdächtigt Windows-Bibliotheken als Trojaner *** --------------------------------------------- Der Virenwächter Avast hat DLL-Dateien von Windows als gefährlich eingestuft und in Quarantäne verschoben. Danach liefen bei betroffenen Nutzern einige Programme nicht mehr. --------------------------------------------- http://heise.de/-2638093 *** Falscher PC-Experte überwies während Fernwartung Geld nach Bangkok *** --------------------------------------------- Mehrere Hundert Euro Schaden - Bank konnte Transaktion nicht mehr rückgängig machen - Polizei warnt vor Betrugsmasche mit falschen Microsoft-Mitarbeitern --------------------------------------------- http://derstandard.at/2000015448793 *** How to make two binaries with the same MD5 hash *** --------------------------------------------- One question I was asked when I demod creating two PHP files with the same hash is; does it work on compiled binaries? --------------------------------------------- http://natmchugh.blogspot.co.uk/2015/05/how-to-make-two-binaries-with-same-…

1 0

Tageszusammenfassung - Mittwoch 6-05-2015
by Daily end-of-shift report 06 May '15

06 May '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 05-05-2015 18:00 − Mittwoch 06-05-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Root-Shell im Krankenhaus: Hospira-Infusionspumpe mit Telnet-Lücke *** --------------------------------------------- Computer, die in Krankenhäusern die Abgabe von Medikamenten direkt ins Blut der Patienten steuern, sollten eigentlich einigermaßen abgesichert sein. Bei in US-Kliniken verbreiteten Infusionspumpen wurde jedoch eine "game-over vulnerability" entdeckt. --------------------------------------------- http://heise.de/-2633529 *** Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability *** --------------------------------------------- A vulnerability in the CUCReports page of Cisco Unity Connection could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack against the CUCReports web interface. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38675 *** Cisco Unified Communications Manager SQL Injection Vulnerability *** --------------------------------------------- A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform SQL injection attacks. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38674 *** Spearphishing: A New Weapon in Cyber Terrorism *** --------------------------------------------- Introduction: Spear phishing attacks Spear phishing and its evolutions like the watering hole attack represent one of the most insidious attack techniques adopted by the majority of threat actors in cyber space. According to the experts .. --------------------------------------------- http://resources.infosecinstitute.com/spearphishing-a-new-weapon-in-cyber-t… *** Hospira LifeCare PCA Infusion System Vulnerabilities *** --------------------------------------------- This advisory provides compensating measures for an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in the Hospira LifeCare PCA Infusion System. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 *** Studie: Die Smart City ist intelligent, aber angreifbar *** --------------------------------------------- Smarte Städte könnten zum Ziel von Hackerangriffen werden. Durch die zunehmende Vernetzung potenzieren sich die Sicherheitslücken, wie eine Studie zeigt. --------------------------------------------- http://www.golem.de/news/studie-die-smart-city-ist-intelligent-aber-angreif… *** Tinba - Yet another anti-sandbox tricks *** --------------------------------------------- Malware authors certainly do not take a breather when it comes to inventing new tricks for detecting sandbox, a very useful system to automatically analyze millions of samples nowadays. Recently, Seculert unveiled an unprecedented sandbox detection method that was employed by the Dyre/Dyreza malware. We had seen similar anti-sandbox tricks used by the .. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002810.html *** Erneut massive Sicherheitslücke bei Lenovo-Rechnern *** --------------------------------------------- Hacker konnten durch Fehler im Update-System Schadprogramme als Lenovo-Software ausgeben --------------------------------------------- http://derstandard.at/2000015349945 *** IT threat evolution in Q1 2015 *** --------------------------------------------- In the first quarter of 2015 Kaspersky Lab products detected a total of 2,2 bln malicious attacks and more than 93 mln unique malicious URLs. The story of the powerful Equation cyberespionage group was perhaps the most talked-about news story of Q1. --------------------------------------------- http://securelist.com/analysis/quarterly-malware-reports/69872/it-threat-ev… *** Nmap Cheat Sheet 5: The Final View of a Ninja Pentester *** --------------------------------------------- As we discussed in the last topic of our Nmap Series, this will be our final touch for the cheat sheet. Here we will try to cover most of the topic as required for Vulnerability Assessment and Penetration Testing. As a Ninja Pentester, .. --------------------------------------------- http://resources.infosecinstitute.com/nmap-cheat-sheet-5-the-final-view-of-… *** Explaining Security Lingo *** --------------------------------------------- This post is aimed to clarify certain terms often used in the security community. Let's start with the easiest one: vulnerability. A vulnerability is a flaw in a selected system .. --------------------------------------------- https://securityblog.redhat.com/2015/05/06/explaining-security-lingo/ *** Multiple Fortiguard products cross-site scripting vulnerabilities *** --------------------------------------------- The Web User Interface of FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiADC D models are vulnerable to reflected cross-site scripting vulnerabilities. --------------------------------------------- http://www.fortiguard.com/advisory/FG-IR-15-005/ *** JetPack and TwentyFifteen Vulnerable to DOM-based XSS - Millions of WordPress Websites Affected *** --------------------------------------------- Any WordPress Plugin or theme that leverages the genericons package is vulnerable to a DOM-based Cross-Site Scripting (XSS) vulnerability due to an insecure file included with .. --------------------------------------------- https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom… *** Google-Studie: Millionen Computer mit Adware infiziert *** --------------------------------------------- Fast 5,4 Millionen Google-Besucher haben Adware auf ihren Computern installiert. Ein Grossteil davon geht auf Googles eigene Kappe, denn viele der Werbe-Einblender stammen aus dem Chrome Web Store. --------------------------------------------- http://heise.de/-2636130

1 0

Tageszusammenfassung - Dienstag 5-05-2015
by Daily end-of-shift report 05 May '15

05 May '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 04-05-2015 18:00 − Dienstag 05-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** In-Console-Able *** --------------------------------------------- Posted by James Forshaw, giving the security community a shoulder to cry on.TL;DR; this blog post describes an unfixed bug in Windows 8.1 which allows you to escape restrictive job objects in order to help to develop a sandbox escape chain in Chrome or similar sandboxes. If you're trying to develop a secure application sandbox in user-mode you're at the mercies of the underlying operating system. While you can try and use every available security feature, sometimes the OS developer... --------------------------------------------- http://googleprojectzero.blogspot.com/2015/05/in-console-able.html *** Upatre/Dyre - the daily grind of botnet-based malspam, (Tue, May 5th) *** --------------------------------------------- Malicious spam (malspam) delivering Upatre/Dyre has been an ongoing issue for quite some time. Many organizations have posted articles about this malware. Ive read good information on Dyre last year [1, 2] and this year [3]. Upatre is the malware downloader that retrieves Dyre (Dyreza), an information stealer described as a Zeus-like banking Trojan [4]. Earlier this year, EmergingThreats reported Upatre and Dyre are under constant development [5], while SecureWorks told us banking botnets... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19657&rss *** Analogue modems allow UNSTOPPABLE Android attack ... at 13bps *** --------------------------------------------- Yes its slow, but its enough to leak data to another Android The better your Android smartphones audio, the worse its security - the audio channel is the latest path for "low and slow" data leak attacks. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/boffins_rev… *** Rombertik malware kills host computers if you attempt a cure *** --------------------------------------------- Say goodbye to your master boot record and home directory if you try to stop it Cisco researchers Ben Baker and Alex Chiu have found new malware that destroys a machines Master Boot Record and home directories if it detects meddling white hats. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/05/rombertik_m… *** Macro Malware: When Old Tricks Still Work, Part 1 *** --------------------------------------------- Now comes a time when we are reminded of why this security warning prompt in Microsoft Word matters: Figure 1. Microsoft Word security warning for macros I went around my peers this afternoon and asked, "On the top of your head, can you give me a name of an effective macro malware? Better if its... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/LjTF4yhzWt8/ *** Introducing FIDO: Automated Security Incident Response *** --------------------------------------------- Were excited to announce the open source release of FIDO (Fully Integrated Defense Operation - apologies to the FIDO Alliance for acronym collision), our system for automatically analyzing security events and responding to security incidents. --------------------------------------------- http://techblog.netflix.com/2015/05/introducing-fido-automated-security.html *** Revealing the Secrets: Advances in Android and iOS Attacks *** --------------------------------------------- In recent months, Unit 42, the cyber threat intelligence team at Palo Alto Networks, has encountered several game-changing advances in mobile malware for both iOS and Android. For example, WireLurker employed a multistage infection that... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/05/revealing-secrets-advanc… *** Steganography and Malware: Why and How *** --------------------------------------------- Threats that can evade detection are among the most dangerous kind we're facing today. We see these characteristics in the most challenging security issues like targeted attacks and zero-day exploits. Being able to stay hidden can determine the success of an attack, making it something that attackers continuously want to achieve. In this series of blog posts, we... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/G-eR3GU5L3Y/ *** ICU Project Overflow Vulnerabilities Patched *** --------------------------------------------- Buffer and integer overflow vulnerabilities have been patched in the ICU Project ICU4C library, used in hundreds of open source and enterprise software packages. --------------------------------------------- http://threatpost.com/icu-project-overflow-vulnerabilities-patched/112623 *** Usbkill Script Can Render Computers Useless *** --------------------------------------------- The idea of needing to disable a computer quickly as the police - or another potential adversary - comes through the door typically has been the concern of criminals. But in today's climate activists, journalists, and others may find themselves wanting to make their laptops unusable in short order, and that's where usbkill comes in. The new tool is a... --------------------------------------------- http://threatpost.com/usbkill-script-can-render-computers-useless/112622 *** VU#978652: Bomgar Remote Support Portal deserializes untrusted data *** --------------------------------------------- Vulnerability Note VU#978652 Bomgar Remote Support Portal deserializes untrusted data Original Release date: 05 May 2015 | Last revised: 05 May 2015 Overview Bomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data without sufficient validation, allowing an attacker to potentially execute arbitrary PHP code. Description CWE-502: Deserialization of Untrusted DataBomgar Remote Support version 14.3.1 and possibly earlier versions deserialize untrusted data... --------------------------------------------- http://www.kb.cert.org/vuls/id/978652 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM OS Images for Red Hat Linux Systems and AIX. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883879 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models. (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005217 *** IBM Security Bulletin: IBM FlashSystem 840 and IBM FlashSystem V840, -AE1 models nodes are affected by vulnerabilities in Apache's Struts library (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005078 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM FileNet System Monitor/IBM Enterprise Content Management System Monitor (CVE-2014-6585, CVE-2014-6591, CVE-2014-6593, CVE-2015-0383, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21883285 *** DSA-3250 wordpress - security update *** --------------------------------------------- Multiple security issues have been discovered in Wordpress, a weblogmanager, that could allow remote attackers to upload files with invalidor unsafe names, mount social engineering attacks or compromise a sitevia cross-site scripting, and inject SQL commands. --------------------------------------------- https://www.debian.org/security/2015/dsa-3250

1 0

Tageszusammenfassung - Montag 4-05-2015
by Daily end-of-shift report 04 May '15

04 May '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 30-04-2015 18:00 − Montag 04-05-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** eBay ignoriert XSS-Lücke ein Jahr lang *** --------------------------------------------- Eine Schwachstelle in eBay erlaubt es Angreifern eine Session mitzuschneiden und im schlimmsten Fall einen Account zu übernehmen. Die Lücke ist ein Jahr alt und wurde immer noch nicht geschlossen. --------------------------------------------- http://heise.de/-2630964 *** Threatpost News Wrap, May 1, 2015 *** --------------------------------------------- Dennis Fisher and Mike Mimoso discuss the post-RSA news, including the MySQL bug, the progress of the OpenSSL overhaul and the wildly entertaining House hearing on crypto backdoors. --------------------------------------------- http://threatpost.com/threatpost-news-wrap-may-1-2015/112538 *** 3062591 - Local Administrator Password Solution (LAPS) Now Available - Version: 1.0 *** --------------------------------------------- Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/3062591 *** New Google Password Alert extension already hacked *** --------------------------------------------- A few hours after the presentation of the Google Password Alert extension a researcher already have developed two methods to bypass it. A few hours ago, Google released the Password Alert extension that was designed to warn users when they are submitting their Google credentials to fraudulent websites. Here's how it works for consumer accounts. Once you've... --------------------------------------------- http://securityaffairs.co/wordpress/36483/hacking/password-alert-extension-… *** VolDiff, for memory image differential analysis, (Sun, May 3rd) *** --------------------------------------------- VolDiff is a bash script that runs Volatility plugins against memory images captured before and after malware execution providing a differential analysis, helping identify IOCs and understand advanced malware behaviour. I had intended to include it in my latest toolsmith article, Attack Detection: Hunting in-memory adversaries with Rekall and WinPmem, but quite literally ran out of space and time. Using WinPmem, as part of Rekall and GRR offerings, you can acquire two memory images, one clean --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19651&rss *** Traffic pattern change noted in Fiesta exploit kit, (Mon, May 4th) *** --------------------------------------------- A few hours ago, Jerome Segura, the Senior Security Researcher at Malwarebytes, tweeted about a change in traffic patterns from Fiesta exploit kit (EK) [1]. What had been semi-colons in the URLs from Fiesta EK are now commas. Here" /> Here" /> Any signatures for detecting Fiesta EK that depend on those semi-colons will need to be updated. A pcap of the traffic is available at http://malware-traffic-analysis.net/2015/05/04/2015-05-04-Fiesta-EK-traffic…, and a zip file of the --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19655&rss *** Securing the smart grid: European Network of Cyber Security *** --------------------------------------------- Dr. Klaus Kursawe is the Chief Scientist at the European Network of Cyber Security (ENCS), where he is leading the research and development activities for critical infrastructure security. In this int... --------------------------------------------- http://www.net-security.org/article.php?id=2270 *** Nasty Dyre malware bests white hat sandboxes *** --------------------------------------------- Core checker a defensive wrecker Seculert CTO Aviv Raff says a nasty piece of malware linked to widespread destruction and bank account plundering has become more dangerous with the ability to evade popular sandboxes. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/05/04/dyre_malwar… *** Anti-Phishing-Erweiterung für Chrome mehrfach unterwandert *** --------------------------------------------- Eigentlich soll das Chrome-Plug-in Passwort-Warnung Alarm schlagen, wenn Nutzer ihre Log-in-Daten auf Phishing-Webseiten eingeben. Mittlerweile wurde die Funktion aber schon zum wiederholten Male ausgehebelt. --------------------------------------------- http://heise.de/-2632031 *** Linuxwochen von 7. bis 9. Mai in Wien *** --------------------------------------------- Am FH Technikum Wien finden von Donnerstag bis Sonntag Workshops und Vorträge zu Verschlüsselung, 3D-Druck und Open Hardware statt. --------------------------------------------- http://futurezone.at/produkte/linuxwochen-von-7-bis-9-mai-in-wien/128.621.4… *** AlphaCrypt *** --------------------------------------------- We've encountered yet another encrypting ransomware variant and at this point it's expected since the scam has exploaded in popularity since it's inception in late 2013. This one has a GUI that is almost... --------------------------------------------- http://www.webroot.com/blog/2015/05/04/alphacrypt/ *** Microsoft Security Bulletin MS15-032 - Critical *** --------------------------------------------- V2.0 (April 30, 2015): Updated bulletin to inform customers running Internet Explorer on Windows Server 2003 Service Pack 2 that the 3038314 update on the Microsoft Download Center was updated on April 22, 2015. Microsoft recommends that customers who installed the 3038314 update prior to April 22 should reinstall the update to be fully protected from the vulnerabilities discussed in this bulletin. --------------------------------------------- https://technet.microsoft.com/en-us/library/security/MS15-032 *** DSA-3249 jqueryui - security update *** --------------------------------------------- Shadowman131 discovered that jqueryui, a JavaScript UI library fordynamic web applications, failed to properly sanitize its titleoption. This would allow a remote attacker to inject arbitrary codethrough cross-site scripting. --------------------------------------------- https://www.debian.org/security/2015/dsa-3249 *** DSA-3244 owncloud - security update *** --------------------------------------------- Multiple vulnerabilities were discovered in ownCloud, a cloud storageweb service for files, music, contacts, calendars and many more. --------------------------------------------- https://www.debian.org/security/2015/dsa-3244 *** IBM Security Bulletins *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Cisco Finesse Server Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38607 *** Squid SSL-Bump Certificate Validation Flaw Lets Remote Servers Bypass Client-side Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032221 *** VMSA-2015-0003.6 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** VU#581276: EMC AutoStart is vulnerable to remote code execution via specially crafted packets *** --------------------------------------------- Vulnerability Note VU#581276 EMC AutoStart is vulnerable to remote code execution via specially crafted packets Original Release date: 30 Apr 2015 | Last revised: 30 Apr 2015 Overview EMC AutoStart, version 5.5.0 and earlier, is vulnerable to remote command execution via specially crafted packets. Description EMC AutoStart is an enterprise software application developed to help networks and service maintain a high level of availability. AutoStart can manage clusters of applications or nodes --------------------------------------------- http://www.kb.cert.org/vuls/id/581276 *** Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities *** --------------------------------------------- Description Splunk Enterprise 6.2.3 and Splunk Light 6.2.3 address five vulnerabilities. Multiple vulnerabilities in OpenSSL prior to 1.0.1m (SPL-98351) Disable SSLv3 in KV Store Replication (SPL-96280) Secure flag inconsistently set for session cookies when appServerPorts!=0 (SPL-95798) Cross-site scripting in Search (SPL-95594) Cross-site scripting in management and configuration (SPL-93516) At the time of this announcement, Splunk is not aware of any cases where these vulnerabilities have --------------------------------------------- http://www.splunk.com/view/SP-CAAANZ7 *** RSA Identity Management and Governance Password Reset Weakness Lets Remote Users Gain Privileged Access *** --------------------------------------------- http://www.securitytracker.com/id/1032218 *** Security Advisory: TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 *** --------------------------------------------- (SOL14190) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/14000/100/sol14190.htm… *** OPTO 22 Multiple Product Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities that are present in the OPTO 22 PAC Project Professional, PAC Project Basic, OptoOPCServer, OptoDataLink, PAC Display Basic, and PAC Display Professional products. --------------------------------------------- https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 *** Clam AntiVirus Multiple File Processing Flaws Let Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032223 *** Dell SonicWALL Secure Remote Access Access Control Flaw in cgi-bin/editBookmark Lets Remote Users Conduct Cross-Site Request Forgery Attacks *** --------------------------------------------- http://www.securitytracker.com/id/1032227 *** SSA-311412 (Last Update 2015-05-04): Incorrect Certificate Verification in Android App HomeControl for Room Automation *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit…

1 0

Tageszusammenfassung - Donnerstag 30-04-2015
by Daily end-of-shift report 30 Apr '15

30 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 29-04-2015 18:00 − Donnerstag 30-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101 *** --------------------------------------------- The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability. --------------------------------------------- https://www.drupal.org/node/2480253 *** My Website Was Blacklisted By Google and Distributing Email Spam *** --------------------------------------------- Being blacklisted is one of the worst things that can happen to a website. The public shame coming from every visitor being stopped by the Big Red Warning page can literally destroy .. --------------------------------------------- https://blog.sucuri.net/2015/04/my-website-was-blacklisted-by-google-and-di… *** Cisco StarOS for Cisco ASR 5000 Series HTTP Packet Processing Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38580 *** Bedep trojan malware spread by the Angler exploit kit gets political *** --------------------------------------------- We recently observed what seems to be a group of cybercriminals helping spread pro-Russia messaging by artificially inflating video views and ratings on a popular video website. The .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Bedep-trojan-malware-sp… *** Cyber threat intelligence group links Russia to cyber espionage and attacks *** --------------------------------------------- "Operation Armageddon," active since at least mid-2013, exposes a cyber espionage campaign devised to provide a military advantage to Russian leadership by targeting Ukrainian government, law enforcement, and military .. --------------------------------------------- http://www.liveleak.com/view?i=b39_1430249732 *** WhatsApp durchleuchtet: Vorbildliche Verschlüsselung weitgehend nutzlos *** --------------------------------------------- Um die Frage zu beantworten wie vertrauenswürdig die von WhatsApp seit einigen Monaten eingesetzte Ende-zu-Ende-Verschlüsselung ist, hat c't sie unter die Lupe genommen: Zwar setzt WhatsApp die richtige Technik ein, viel nützt das aber trotzdem nicht. --------------------------------------------- http://heise.de/-2629081 *** Voiceprint: Stimmenerkennung ist die neue Gesichtserkennung *** --------------------------------------------- Statt mit einem Passwort können sich Bankkunden mittlerweile mit ihrer Stimme am Telefon identifizieren. Akustische Biometriesysteme werden in immer mehr Firmen eingesetzt. Die Gefahr: Auch Geheimdienste und Staaten können auf die Technik zugreifen. --------------------------------------------- http://www.golem.de/news/voiceprint-stimmenerkennung-ist-die-neue-gesichtse… *** Analysis of a MICROSOFT WORD INTRUDER sample: execution, check-in and payload delivery *** --------------------------------------------- On April 1st FireEye released a report on 'MWI; and 'MWISTAT' which is a sort of exploit kit for Word Documents if you will: A New Word Document Exploit Kit In the article FireEye goes over MWI which is the short for 'Microsoft Word Intruder' coded .. --------------------------------------------- http://blog.0x3a.com/post/117760824504/analysis-of-a-microsoft-word-intrude… *** A Brief Look at DNS Zone Transfer for Alexia's Top 1M Domains *** --------------------------------------------- The folks at Rapid7 have released another scan. This one is looking at Alexa's top 1 million domains for DNS servers which have allowed unauthenticated requests for Zone Transfer. --------------------------------------------- http://atechdad.com/a-brief-look-at-dns-zone-transfer-for-alexias-top-1m-do… *** TA15-120A: Securing End-to-End Communications *** --------------------------------------------- Securing end-to-end communications plays an important role in protecting privacy and preventing some forms of man-in-the-middle (MITM) attacks. Recently, researchers described a MITM attack used to inject code, .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A-0 *** The BACKRONYM MySQL Vulnerability *** --------------------------------------------- Earlier this year, I - along with some members of our DevOps team - noticed some interesting behavior in libmysqlclient and the MySQL CLI: no matter how hard we tried (no matter how many MYSQL_OPT_SSL_* options we set) we could not make the client enforce the use of SSL. If the server claimed not to support it, the .. --------------------------------------------- https://www.duosecurity.com/blog/backronym-mysql-vulnerability

1 0

Tageszusammenfassung - Mittwoch 29-04-2015
by Daily end-of-shift report 29 Apr '15

29 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 28-04-2015 18:00 − Mittwoch 29-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** VU#534407: Barracuda Web Filter insecurely performs SSL inspection *** --------------------------------------------- Barracuda Web Filter prior to version 8.1.0.005 does not properly check upstream certificate validity when performing SSL inspection, and delivers one of three default root CA certificates across multiple machines for SSL inspection. --------------------------------------------- http://www.kb.cert.org/vuls/id/534407 *** Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in the Overlay Transport Virtualization (OTV) processing code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38549 *** Cisco StarOS for Cisco ASR 5000 Series HAMGR Service Proxy Mobile IPv6 Processing Denial of Service Vulnerability *** --------------------------------------------- A vulnerability in proxy mobile (PM) IPv6 processing of Cisco StarOS for Cisco ASR 5000 Series devices could allow an unauthenticated, remote attacker to cause a reload of the hamgr service on the affected device. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38557 *** Android: Tausende Apps akzeptieren gefälschte Zertifikate *** --------------------------------------------- Die Schwachstelle ist seit einem halben Jahr bekannt, doch noch immer können Tausende Android-Apps mit gefälschten Zertifikaten überlistet werden, verschlüsselte Verbindungen aufzubauen. Über diese können Zugangsdaten abgegriffen werden --------------------------------------------- http://www.golem.de/news/android-tausende-apps-akzeptieren-gefaelschte-zert… *** Example setup of WordPress with static export *** --------------------------------------------- 'the only winning move is not to play' - Joshua, Wargames 2 So another advice from CIRCL is: whenever it is possible, the Content Management System component should be removed from the attack surface. This article gives an example about how to set up a system that exposes only static websites without dynamically generated content to the user and attacker. --------------------------------------------- https://www.circl.lu/pub/tr-36/ *** Malware Analysis-Basics: Static Analysis *** --------------------------------------------- Hi all, I have started learning malware analysis sometime back, and will share my learning through a series of articles on malware analysis. I will start from very basic and go to advanced level of analysis. So in this this document we .. --------------------------------------------- http://resources.infosecinstitute.com/malware-analysis-basics-static-analys… *** Und täglich grüsst die D-Link-Lücke *** --------------------------------------------- Seit mindestens August klafft eine kritische Lücke in Routern der Firmen D-Link und Trendnet. Diese geht auf ein Toolkit der Firma Realtek zurück, die Anfragen von Sicherheitsforschern für Monate beharrlich ignorierte. Nun ist die Lücke öffentlich. --------------------------------------------- http://heise.de/-2628562 *** Unboxing Linux/Mumblehard: Muttering spam from your servers *** --------------------------------------------- Today, ESET researchers reveal a family of Linux malware that stayed under the radar for more than 5 years. We have named this family Linux/Mumblehard. A white paper about this threat is available for download on WeLiveSecuriy. --------------------------------------------- http://www.welivesecurity.com/2015/04/29/unboxing-linuxmumblehard-muttering… *** Magento updaten! ASAP! *** --------------------------------------------- Für die Onlineshop-Software Magento ist bereits im Februar ein Patch (SUPEE-5344) erschienen, der eine schwerwiegende Sicherheitslücke schliesst. Die Firma Check Point, die die Schwachstelle entdeckt hat, .. --------------------------------------------- http://www.cert.at/services/blog/20150429154511-1469.html *** TA15-119A: Top 30 Targeted High Risk Vulnerabilities *** --------------------------------------------- Cyber threat actors continue to exploit unpatched software to conduct attacks against critical infrastructure organizations. As many as 85 percent of targeted attacks are .. --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-119A *** Container Security: Just The Good Parts *** --------------------------------------------- Security is usually a matter of trade-offs. Questions like: 'Is X Secure?', don't often have direct yes or no answers. A technology can mitigate certain classes of risk even .. --------------------------------------------- https://securityblog.redhat.com/2015/04/29/container-security-just-the-good… *** Report: SSDP reflection attacks spike, and other Q1 2015 DDoS trends *** --------------------------------------------- The largest distributed denial-of-service attack ever detected by Arbor Networks systems was observed in the first quarter of this year. --------------------------------------------- http://www.scmagazine.com/largest-ddos-detected-in-q1-report-says/article/4… *** ZDI-15-157: Samsung Security Manager ActiveMQ Broker Service MOVE Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-157/ *** ZDI-15-156: Samsung Security Manager ActiveMQ Broker Service PUT Method Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Security Manager. Authentication is not required to exploit this vulnerability. Successful exploitation allows an attacker to gain complete control of the system on which the product is installed. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-156/

1 0

Tageszusammenfassung - Dienstag 28-04-2015
by Daily end-of-shift report 28 Apr '15

28 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 27-04-2015 18:00 − Dienstag 28-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Fake Security Scams - 2015 Edition *** --------------------------------------------- New Year, Similar Scams In 2013, I wrote an article talking about the popular Fake Microsoft Security Scams that were doing the rounds. As expected, these type of scams have continued to grow .. --------------------------------------------- http:////www.webroot.com/blog/2015/04/27/fake-security-scams-2015-edition/ *** 10 Ways to Ensure Your Privileged Password Management Strategy Will Succeed *** --------------------------------------------- Leveraging complex, frequently updated passwords is a basic security best practice for protecting privileged accounts in your organisation. But if passwords are such a no-brainer, why do so many data breaches tie back to poor password management? --------------------------------------------- http://blog.beyondtrust.com/10-reasons-your-privileged-password-management-… *** When Prevention Fails, Incident Response Begins, (Mon, Apr 27th) *** --------------------------------------------- Ive been asked a few times this year ($dayjob) to discuss and review incident handling practices with some of our clients. This topic seems to have come up to the surface again, and with some breaches getting main-stream coverage, it only .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19629 *** WordPress 4.2.1 Security Release *** --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-2-1/ *** SendGrid: Employee Account Hacked, Used to Steal Customer Credentials *** --------------------------------------------- Sendgrid, an email service used by tens of thousands of companies -- including Silicon Valley giants as well as Bitcoin exchange Coinbase -- said attackers compromised a Sendgrid employees account, which was then used to steal the usernames, email .. --------------------------------------------- http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to… *** Booby trapped! Malvertising campaign hit Adult Site xHamster *** --------------------------------------------- A New malvertising campaign hit adult website xHamster by abusing ad provider TrafficHaus and exploiting the Google's URL shortener service. Malversting campaigns are becoming a serious problem for web users, cyber criminals are exploiting .. --------------------------------------------- http://securityaffairs.co/wordpress/36367/cyber-crime/malvertising-campaign… *** Best Free and Open Source SQL Injection Tools *** --------------------------------------------- SQL injection is one of the most common attacks against web applications. This is used against websites which use SQL to query data from the database server. A successful .. --------------------------------------------- http://resources.infosecinstitute.com/best-free-and-open-source-sql-injecti… *** Hacker tarnen sich als Rüstungsfirma und tricksen Antiviren-Programme aus *** --------------------------------------------- Angreifer nutzten die Gunst der Stunde und verschickten im Zuge einer Firmenübernahme als Willkommensnachricht getarnte Phishing-Mails, um mit einer raffinierten Methode Schadcode auf die Computer von Angestellten zu schmuggeln. --------------------------------------------- http://heise.de/-2625892 *** Kritische Sicherheitslücke in WordPress *** --------------------------------------------- Angesichts der potentiellen Auswirkung der Lücke und der hohen Anzahl an installierten WordPress Content Management Systemen bittet CERT.at um Beachtung der folgenden .. --------------------------------------------- https://cert.at/warnings/all/20150428.html *** Inside the Zeroaccess Trojan *** --------------------------------------------- The Zeroaccess trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. --------------------------------------------- http://blog.norsecorp.com/2015/04/27/inside-the-zeroaccess-trojan/ *** Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper processing of crafted RADIUS packets by a device running the affected software. An authenticated, remote attacker could exploit this vulnerability by sending crafted RADIUS packets to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38544 *** Cisco IOS Software and Cisco IOS XE Software Crafted DHCPv6 Sequence Denial of Service Vulnerability *** --------------------------------------------- The vulnerability is due to improper handling of DHCPv6 packets for a SOLICIT message for an Identity Association for Non-Temporary Addresses (IA-NA) by a device running the affected software. An unauthenticated, adjacent attacker could exploit this vulnerability by sending a crafted sequence exchange of DHCPv6 packets for a SOLICIT message for an IA-NA to an affected device. If successful, the attacker could cause the device to crash, resulting in a DoS condition. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38543

1 0

Tageszusammenfassung - Montag 27-04-2015
by Daily end-of-shift report 27 Apr '15

27 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 24-04-2015 18:00 − Montag 27-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Sicherheitslücke im Yubikey Neo *** --------------------------------------------- Der USB-Stick Yubikey Neo lässt sich auch als Smartcard nutzen. Durch einen Bug kann man die eigentlich erforderliche Eingabe der PIN umgehen. Ein Angreifer kann die Krypto-Funktionen dadurch sogar über Funk missbrauchen. --------------------------------------------- http://heise.de/-2621122 *** CVE-2015-0359 (Flash up to 17.0.0.134) and Exploit Kits *** --------------------------------------------- http://malware.dontneedcoffee.com/2015/04/cve-2015-0359-flash-up-to-1700134… *** Security Advisory: NTP vulnerability CVE-2015-1799 *** --------------------------------------------- The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16506.htm… *** What's Your Security Maturity Level? *** --------------------------------------------- Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think 15 pieces of flair). When .. --------------------------------------------- http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/ *** Sunday, April 26. 2015 How Kaspersky makes you vulnerable to the FREAK attack and other ways Antivirus software lowers your HTTPS security *** --------------------------------------------- Lately a lot of attention has been payed to software like Superfish and Privdog that intercepts TLS connections to be able to manipulate HTTPS traffic. These programs had severe (technically different) vulnerabilities that allowed attacks on HTTPS connections. --------------------------------------------- https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-vulnerable-to-t… *** Pwning a thin client in less than two minutes *** --------------------------------------------- The point of this blog post is to demonstrate that a malicious actor can compromise such thin clients in a trivial and quick way provided physical access, a standard prerequisite in an attack against a kiosk. --------------------------------------------- http://blog.malerisch.net/2015/04/pwning-hp-thin-client.html *** Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information .. --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win. *** --------------------------------------------- A lot of network defense goes wrong before any contact with an adversary, starting with how defenders conceive of the battlefield. Most defenders focus on protecting their assets, prioritizing them, and sorting them by workload and .. --------------------------------------------- http://blogs.technet.com/b/johnla/archive/2015/04/26/defenders-think-in-lis… *** IBM Security Bulletin: SPSS Statistics ActiveX Control Code Execution Vulnerability Notification *** --------------------------------------------- SPSS Statistics ActiveX control on Windows 32 bit installations could allow a remote attacker to execute arbitrary code on the system. By persuading a victim to visit a specially-crafted Web page with Internet Explorer, a local attacker could exploit this vulnerability to execute arbitrary code on the system or cause the application to crash. --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21697746 *** A Javascript-based DDoS Attack as seen by Safe Browsing *** --------------------------------------------- To protect users from malicious content, Safe Browsing's infrastructure analyzes web pages with web browsers running in virtual machines. This allows us to determine if a page contains malicious content, such as Javascript .. --------------------------------------------- http://googleonlinesecurity.blogspot.co.at/2015/04/a-javascript-based-ddos-… *** Node.js Server-Side JavaScript Injection Detection & Exploitation *** --------------------------------------------- Late last year, Burp scanner started testing for Server-Side JavaScript (SSJS) code injection. As you'd expect, this is where an attacker injects JavaScript into a server side parser and results in arbitrary code execution. --------------------------------------------- http://blog.gdssecurity.com/labs/2015/4/15/nodejs-server-side-javascript-in… *** Critical Persistent XSS 0day in WordPress *** --------------------------------------------- Yes, you've read it right: a critical, unpatched 0-day vulnerability affecting WordPress' comment mechanisms was disclosed earlier today by Klikki Oy. Who's affected If your .. --------------------------------------------- https://blog.sucuri.net/2015/04/critical-persistent-xss-0day-in-wordpress.h… *** TeslaCrypt - Decrypt It Yourself *** --------------------------------------------- After the takedown of Cryptolocker, we have seen the rise of Cryptowall. Cryptowall 2 introduced 'features' such as advanced anti-debugging techniques, only to have many of those features removed in Cryptowall 3. Ransomware is .. --------------------------------------------- http://blogs.cisco.com/security/talos/teslacrypt

1 0

Tageszusammenfassung - Freitag 24-04-2015
by Daily end-of-shift report 24 Apr '15

24 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 23-04-2015 18:00 − Freitag 24-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** When automation does not help, (Thu, Apr 23rd) *** --------------------------------------------- In a lot of web application penetration tests that Ive done in last couple of years I noticed that the amount of technical vulnerabilities (i.e. XSS or SQL injection) is slowly declining.Of course, this depends on developers awareness but also on frameworks that are used for development of such applications. One of the best (or worst, depending on the point of view) is definitely .NET (yeah, I know, it feels weird to say that Microsoft is best in something security related). With .NET... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19615&rss *** Security Advisory: NTP vulnerability CVE-2015-1798 *** --------------------------------------------- (SOL16505) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/500/sol16505.htm… *** CVE-2014-6284 - Probe login access vulnerability in SAP ASE *** --------------------------------------------- The SpiderLabs team at Trustwave published a new advisory today which details issues discovered in the SAP ASE (Adaptive Server Enterprise) by Martin Rakhmanov, a SpiderLabs Senior Researcher. SAP ASE is a relational database management system for UNIX, Linux, and... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2014-6284----Probe-… *** VMSA-2015-0003.5 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** The Rise of Counterintelligence in Malware Investigations *** --------------------------------------------- The key to operationalizing cybersecurity threat intelligence rests in the critical thinking that establishes that a given indicator is, in fact, malicious. There has been a great deal of talk about the emerging field of cybersecurity threat intelligence in recent years. CTI is the application of intelligence tactics to gain insights on adversarial actors and their tools, techniques, and procedures. However, one aspect that's not frequently discussed is the use of counterintelligence... --------------------------------------------- http://www.darkreading.com/partner-perspectives/general-dynamics-fidelis/th… *** Objectifying Cyber Intel Indicators *** --------------------------------------------- I've had the fortune of visiting a good number of SOCs (including building some) and meeting with a number of leaders in the SOC/IR space over the years- and the better teams will tell you that you simply cannot look at every single alert that fires. Expanding upon this even more, in regards to an Intel-driven IR program, this means that you cannot simply dump all indicators into production; I've seen this fail for both immature programs (overwhelmed with alerts) as well as mature... --------------------------------------------- http://seanmason.com/2014/08/25/objectifying-cyber-intel-indicators/ *** Honeywell XLWEB SCADA Path Traversal *** --------------------------------------------- Topic: Honeywell XLWEB SCADA Path Traversal Risk: Medium Text:SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual X... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040161 *** Magento-Lücke wird aktiv ausgenutzt *** --------------------------------------------- Wer einen Magento-Shop betreibt und noch nicht das jüngste Sicherheits-Update installiert hat, muss mit unerwünschten Besuchern rechnen. Hacker nutzen die Lücke aus, um SQL-Befehle in den Datenbankserver einzuschleusen. --------------------------------------------- http://heise.de/-2620110 *** IBM Products affected by Vulnerability in RC4 stream cipher ("Bar Mitzvah Attack") and other Vulnerabilities *** --------------------------------------------- https://www-304.ibm.com/connections/blogs/PSIRT/?lang=en_us *** Dyreza's anticrypt *** --------------------------------------------- In the previous post, we have described how to set up a loft to monitor Dyreza with the help of virtual machines configured with breakpoints at addresses where communications appear in clear text. Configuration file updates can thus be obtained in real-time easily. Another way to monitor this kind of malware using a decentralised architecture is to implement parts of the malicious binary in a thin client, which requires to fully understand its decryption routine details. --------------------------------------------- http://www.lexsi-leblog.com/cert-en/dyrezas-anticrypt.html *** Antiviren-Software und Apples Schutzmechanismen für Mac OS X nutzlos *** --------------------------------------------- Einem Sicherheitsforscher zufolge sei es trivial, einen Mac nachhaltig mit Malware zu verseuchen. Weder würde gängige Antivirensoftware helfen, noch Apples eigene Mechanismen wie XProtect oder das Signieren von Apps. --------------------------------------------- http://heise.de/-2620049 *** HTML5 Security: Local Storage *** --------------------------------------------- In a previous article of mine, I discussed Cross Domain Messaging in HTML5. This article walks you through another feature, called local storage, and its security. Local Storage Local storage is one of the new features added in HTML5. It was first introduced in Mozilla 1.5 and eventually embraced by the HTML5 specification. We can... --------------------------------------------- http://resources.infosecinstitute.com/html5-security-local-storage/ *** Yubikey NEO (JavaCard OpenPGP) private key operations can be accessed without PIN *** --------------------------------------------- The source code contains a logical flaw related to user PIN (aka PW1) verification that allows an attacker with local host privileges and/or physical proximity (NFC) to perform security operations without knowledge of the user's PIN code. --------------------------------------------- https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.h…

1 0

Tageszusammenfassung - Donnerstag 23-04-2015
by Daily end-of-shift report 23 Apr '15

23 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 22-04-2015 18:00 − Donnerstag 23-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Deep dive into QUANTUM INSERT *** --------------------------------------------- Summary and recommendations QUANTUMINSERT (QI) is actually a relatively old technique. In order to exploit it, you will need a monitoring capabilities to leak information of observed TCP sessions and a host that can send spoofed packets. Your spoofed packet also needs to arrive faster than the original packet to be able to be successful. Any... --------------------------------------------- http://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ *** Sicherheitsfirma warnt vor iOS-Killer-Funktion *** --------------------------------------------- Ein bösartiger Hotspot könnte iOS-Geräte in einen endlosen Reboot-Cycle schicken, warnt eine Sicherheitsfirma. Ursache ist anscheinend ein Fehler in Apples Verschlüsselungsimplementierung. --------------------------------------------- http://heise.de/-2617385 *** New Threat Report *** --------------------------------------------- Our latest comprehensive threat report, based on our analysis of H2 2014 data, is now available. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002805.html *** Mobile Threats Incident Handling: Updated ENISA material *** --------------------------------------------- http://www.enisa.europa.eu/media/news-items/mobile-threats-incident-handlin… *** Schadcode durch WLAN-Pakete *** --------------------------------------------- Durch eine Lücke in dem Standard-Tool wpa_supplicant können Angreifer anfällige Systeme über WLAN kompromittieren. Es kommt unter anderem bei Android und Linux zum Einsatz. Abhilfe schafft ein Patch, eine abgesicherte Version soll folgen. --------------------------------------------- http://heise.de/-2618115 *** wpa_supplicant P2P SSID processing vulnerability *** --------------------------------------------- A vulnerability was found in how wpa_supplicant uses SSID information parsed from management frames that create or update P2P peer entries (e.g., Probe Response frame or number of P2P Public Action frames). SSID field has valid length range of 0-32 octets. However, it is transmitted in an element that has a 8-bit length field and potential maximum payload length of 255 octets. wpa_supplicant was not sufficiently verifying the payload length on one of the code paths using the SSID received from --------------------------------------------- http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt *** SSA-237894 (Last Update 2015-04-23): Vulnerability in SIMATIC PCS 7 *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** PowerDNS decompression bug can cause crashes *** --------------------------------------------- Topic: PowerDNS decompression bug can cause crashes Risk: Medium Text:Hi everybody, Please be aware of PowerDNS Security Advisory 2015-01 (http://doc.powerdns.com/md/security/powerdns-advisory-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040155 *** Security patch 02 for ZEN 11 Appliance - Freak - See TID 7016312 *** --------------------------------------------- Abstract: Patch for CVE-2015-0204 (FREAK) - OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability for ZCM ApplianceDocument ID: 5207650Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11_Security_Patch_2.zip (12.65 MB)Products:ZENworks Configuration Management 11ZENworks Configuration Management 11.1ZENworks Configuration Management 11 SP3ZENworks Configuration Management 11.2ZENworks Configuration Management 11.2.1ZENworks Configuration Management --------------------------------------------- https://download.novell.com/Download?buildid=Ddi7yDlFrqA~ *** ZDI-15-149: Novell Zenworks Rtrlet.class Session ID Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to disclose Session IDs of logged in users on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/ly4m30xpA5I/ *** ZDI-15-148: Novell Zenworks schedule.ScheduleQuery SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/04USkHANe4s/ *** ZDI-15-147: Novell Zenworks GetStoredResult.class SQL Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/vaCwk090UHI/ *** ZDI-15-153: Novell ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENWorks. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/sPdD0Sy4sxQ/ *** ZDI-15-152: Novell Zenworks com.novell.zenworks.inventory.rtr.actionclasses.wcreports Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/GTCY2AUbObw/ *** ZDI-15-151: Novell Zenworks Rtrlet doPost Directory Traversal Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Zenworks. By default, authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/Wi0h3ROfwWc/ *** ZDI-15-150: Novell Zenworks FileViewer Information Disclosure Vulnerability *** --------------------------------------------- This vulnerability allows attackers to obtain sensitive information on vulnerable installations of Novell Zenworks. User interaction is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/-6nZPEvRTF0/ *** Security Advisory: Linux kernel vulnerabilities CVE-2014-8159 and CVE-2014-8369 *** --------------------------------------------- (SOL16478) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16478.htm… *** Security Advisory: Rsync vulnerability CVE-2007-6199 *** --------------------------------------------- (SOL15549) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/15000/500/sol15549.htm… *** Security Advisory: Linux kernel vulnerability CVE-2009-4537 *** --------------------------------------------- (SOL16479) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16479.htm… *** DSA-3232 curl - security update *** --------------------------------------------- Several vulnerabilities were discovered in cURL, an URL transfer library: --------------------------------------------- https://www.debian.org/security/2015/dsa-3232 *** iPassword Manager 2.6 Script Insertion *** --------------------------------------------- Topic: iPassword Manager 2.6 Script Insertion Risk: Low Text:Document Title: iPassword Manager v2.6 iOS - Persistent Vulnerabilities References (Source): == http://www... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040147 *** Docker Privilege Escalation *** --------------------------------------------- Topic: Docker Privilege Escalation Risk: Medium Text:TLDR; Don’t use the ‘docker’ group Docker, if you aren’t already familiar with it, is a lightweight runtime and pack... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040151 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerability in SSLv3 affects IBM/Cisco switches and directors (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005132 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affecting Sametime Unified Telephony (OpenSSL: CVE-2014-3569, CVE-2014-3570, CVE-2014-3572, CVE-2014-8725, CVE-2015-0204, CVE-2015-0205) *** http://www.ibm.com/support/docview.wss?uid=swg21882876 *** IBM Security Bulletin: RPM vulnerability issue on IBM SONAS (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005166 *** IBM Security Bulletin: RPM vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-6435) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005160 *** IBM Security Bulletin: Vulnerabilities in Network Time Protocol (NTP) affect IBM Storwize V7000 Unified (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005147 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM Storwize V7000 Unified (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005075 *** IBM Security Bulletin: Open Source GNU glibc vulnerabilities on IBM SONAS (CVE-2014-7817, CVE-2014-9087) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005152 *** IBM Security Bulletin: NSS vulnerability issue on IBM Storwize V7000 Unified (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005148 *** IBM Security Bulletin: Vulnerability in NSS affects SAN Volume Controller and Storwize Family (CVE-2014-3566) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005209 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by several OpenSSL vulnerabilities. *** http://www.ibm.com/support/docview.wss?uid=nas8N1020693 *** IBM Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect IBM Sterling B2B Integrator (CVE-2015-0209, CVE-2015-0287, CVE-2015-0292, and others) *** http://www.ibm.com/support/docview.wss?uid=swg21883249 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affects Rational Software Architect for Websphere Software *** http://www.ibm.com/support/docview.wss?uid=swg21882955 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Mobile (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701358 *** IBM Security Bulletin: Vulnerability in IBM WebSphere Application Server affects IBM Security Access Manager for Web (CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21701548 *** IBM Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005125 *** IBM Security Bulletin: Samba vulnerability issue on IBM SONAS (CVE-2015-0240) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005157 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Lifecycle Integration Adapter for HP ALM (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21883226 *** IBM Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Composite Application Manager for Transactions (CVE-2015-2808) *** http://www.ibm.com/support/docview.wss?uid=swg21701114

1 0

Tageszusammenfassung - Mittwoch 22-04-2015
by Daily end-of-shift report 22 Apr '15

22 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 21-04-2015 18:00 − Mittwoch 22-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** How attackers exploit end-users psychology *** --------------------------------------------- At RSA Conference 2015, Proofpoint released the results of its annual study that details the ways attackers exploit end-users psychology to circumvent IT security. Last year was the year attacke... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/tTatKVMFrgE/secworld.php *** How to hack Avaya phones with a simple text editor *** --------------------------------------------- At RSA conference 2015 a researcher demonstrated that Avaya's Ethernet office phones can be compromised with just a simple text editor. At the RSA conference 2015 in San Francisco, Dr Ang Cui from Columbia University PhD and Red Ballon Security cofounder announced that Avaya's Ethernet office phones can be compromised with just a simple text... --------------------------------------------- http://securityaffairs.co/wordpress/36187/hacking/how-to-hack-avaya-phone.h… *** 2 out of 3 IT pros put systems at risk by making undocumented changes *** --------------------------------------------- The Netwrix 2015 State of IT Changes Survey of more than 700 IT professionals across 40 industries found that 70% of companies forget about documenting changes, up from 57% last year. Most surprisingl... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4YM1XhU4vq4/secworld.php *** The CozyDuke APT *** --------------------------------------------- CozyDuke (aka CozyBear, CozyCar or "Office Monkeys") is a threat actor that became increasingly active in the 2nd half of 2014 and hit a variety of targets. The White House and Department of State are two of the most spectacular... --------------------------------------------- http://securelist.com/blog/research/69731/the-cozyduke-apt/ *** CozyDuke, TLP: White *** --------------------------------------------- This whitepaper provides an overview of CozyDuke, a set of tools used by one or more malicious actors for performing targeted attacks against high profile organizations, such as governmental organizations and other entities that work closely with these institutions. --------------------------------------------- https://www.f-secure.com/weblog/archives/00002804.html *** "No iOS Zone" - A New Vulnerability Allows DoS Attacks on iOS Devices *** --------------------------------------------- In today's RSA Conference presentation, (Tuesday, April 21, 2015 | 3:30 PM - 4:20 PM | West | Room: 2001) Adi Sharabani, CEO and my fellow co-founder at Skycure, and I covered the lifecycle of vulnerabilities and vendor pitfalls. We also shared some details about a vulnerability our team recently identified in iOS 8 - a vulnerability that we are currently working with Apple to fix. --------------------------------------------- https://www.skycure.com/blog/ios-shield-allows-dos-attacks-on-ios-devices/ *** Regular expressions and recommended practices *** --------------------------------------------- Whenever a security person crosses a vulnerability report, one of the the first steps is to ensure that the reported problem is actually a vulnerability. Usually, the issue falls into well known and studied categories and this step is done... --------------------------------------------- https://securityblog.redhat.com/2015/04/22/regular-expressions-and-recommen… *** RSA 2015: Thousands of Android apps found to be vulnerable *** --------------------------------------------- Vulnerability testing by CERT found tens of thousands of Android apps are vulnerable and no full register exists as they dont all get CVE assigned. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/42uHv7yPt0M/ *** RSA 2015: Experts discuss six dangerous attack techniques *** --------------------------------------------- Data breaches, ransomware, and threats against industrial control system were were discussed during an RSA Conference 2015 session on dangerous attack techniques. --------------------------------------------- http://feedproxy.google.com/~r/SCMagazineHome/~3/yup3ar8W41U/ *** SSA-994726 (Last Update 2015-04-22): GHOST Vulnerability in Siemens Industrial Products *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** SSA-451236 (Last Update 2015-04-22): Vulnerability in SIMATIC ProSave, SIMATIC CFC, SIMATIC STEP 7, SIMOTION Scout, and STARTER *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** HPSBGN03308 rev.1 - HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS), Remote Code Execution *** --------------------------------------------- A potential security vulnerability has been identified with the HP TippingPoint Security Management System (SMS) and vSMS. A vulnerability in JBOSS RMI could be exploited to allow remote code execution. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626974 *** Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting *** --------------------------------------------- Topic: Manage Engine Firewall Analyzer 8.3 Build 8300 Cross Site Scripting Risk: Low Text: = Reflected XSS Vulnerability In Manage Engine Firewall Analyzer = . contents:: Table Of Content Overview == ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040128 *** Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38486 *** Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38461 *** Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38460 *** DSA-3231 subversion - security update *** --------------------------------------------- Several vulnerabilities were discovered in Subversion, a version controlsystem. The Common Vulnerabilities and Exposures project identifies thefollowing problems:... --------------------------------------------- https://www.debian.org/security/2015/dsa-3231 *** Glibc Buffer Overflow in getanswer_r() Lets Remote Users Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1032178 *** Platform Agent 2011.1r2 *** --------------------------------------------- Abstract: The Novell Audit Platform Agent (Platform Agent) facilitates auditing events by transmitting log data from multiple applications to the Audit server.Document ID: 5207351Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:Platform-Agent_2011.1r2.sha256 (93 bytes)Platform-Agent_2011.1r2.zip (16.8 MB)Products:Sentinel 7.0Sentinel 7.0.1Sentinel 7.0.2Sentinel 7.0.3Sentinel 7.1Sentinel 7.1.1Sentinel 7.1.2Sentinel 7.2Sentinel 7.2.1Sentinel 7.2.2Sentinel 7.3Sentinel Log --------------------------------------------- https://download.novell.com/Download?buildid=dpHkpNu89zw~

1 0

Tageszusammenfassung - Dienstag 21-04-2015
by Daily end-of-shift report 21 Apr '15

21 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 20-04-2015 18:00 − Dienstag 21-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** JavaScript CPU cache snooper tells crooks EVERYTHING you do online *** --------------------------------------------- New research sends browser kingpins scurrying for fixes Four Cornell University boffins reckon they can spy on keystrokes and mouse clicks in a web browser tab by snooping on the PCs processor caches. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/21/cache_creep… *** New fileless malware found in the wild *** --------------------------------------------- Since the discovery of the Poweliks fileless Trojan in August 2014, researchers have been expecting other similar malware to pop up. The wait over: Phasebot malware, which also has fileless infecti... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/fLPIj0uz1VY/malware_news.… *** Cross-Site-Scripting: Zahlreiche Wordpress-Plugins verwenden Funktion fehlerhaft *** --------------------------------------------- Eine schlecht dokumentierte Funktion der Wordpress-API ist von zahlreichen populären Plugins fehlerhaft verwendet worden. Der Fehler führt zu Cross-Site-Scripting-Lücken: Betroffen sind unter anderem das Jetpack-Plugin, die Plugins von Yoast und das All-in-one-SEO-Plugin. --------------------------------------------- http://www.golem.de/news/cross-site-scripting-zahlreiche-wordpress-plugins-… *** 2nd workshop on National Cyber Security Strategies: 13th May *** --------------------------------------------- ENISA and the Latvian Ministry of Defence are hosting on the 13th of May 2015, the 2nd workshop on National Cyber Security Strategies in Riga, during the Presidency of the Council of the European Union. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/2nd-workshop-on-national-cyber-… *** Fehlerhafte Netzwerkbibliothek macht iOS-Apps angreifbar *** --------------------------------------------- Durch einen Bug in der Bibliothek AFNetwork kann man die verschlüsselten Verbindungen zahlreicher Apps angreifen, die sie einsetzen. Eine Online-Datenbank verrät, welche Apps betroffen waren oder sind. --------------------------------------------- http://heise.de/-2615960 *** WordPress 4.1.2 Security Release *** --------------------------------------------- WordPress 4.1.2 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately. --------------------------------------------- https://wordpress.org/news/2015/04/wordpress-4-1-2/ *** Security Advisory: glibc vulnerability CVE-2013-7424 *** --------------------------------------------- (SOL16472) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/400/sol16472.htm… *** VU#260780: NetNanny uses a shared private key and root CA *** --------------------------------------------- Vulnerability Note VU#260780 NetNanny uses a shared private key and root CA Original Release date: 20 Apr 2015 | Last revised: 20 Apr 2015 Overview NetNanny uses a shared private key and root Certificate Authority (CA), making systems broadly vulnerable to HTTPS spoofing. Description NetNanny installs a Man-in-the-Middle (MITM) proxy as well as a new trusted root CA certificate. The certificate used by NetNanny is shared among all installations of NetNanny. Furthermore, the private key used --------------------------------------------- http://www.kb.cert.org/vuls/id/260780 *** Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38455 *** Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38459 *** HPSBMU03321 rev.1 - HP Data Protector, Remote Increase of Privilege, Denial of Service (DoS), Execution of Arbitrary Code *** --------------------------------------------- Potential security vulnerabilities have been identified with HP Data Protector. These vulnerabilities could be remotely exploited to allow an increase of privilege, create a Denial of Service (DoS), or execute arbitrary code. --------------------------------------------- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_… *** HPSBGN03305 rev.1 - HP Business Service Management (BSM) products running SSLv3, Remote Disclosure of Information *** --------------------------------------------- A potential security vulnerability has been identified with HP Business Service Management (BSM), SiteScope, Business Service Management (BSM) Integration Adaptor, Operations Manager for Windows, Unix and Linux, Reporter, Operation Agent Virtual Appliance, Performance Manager, Virtualization Performance Viewer, Operations Agent, BSM Connector and Service Health Reporter running SSLv3. The vulnerability could be exploited remotely to allow disclosure of information. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626982

1 0

Tageszusammenfassung - Montag 20-04-2015
by Daily end-of-shift report 20 Apr '15

20 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 17-04-2015 18:00 − Montag 20-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Handling Special PDF Compression Methods, (Sun, Apr 19th) *** --------------------------------------------- Maarten Van Horenbeeck posted a diary entry (July 2008) explaining how scripts and data are stored in PDF documents (using streams), and demonstrated a Perl script to decompress streams. A couple of months before, I had started developing my pdf-parser tool, and Maartens diary entry motivated me to continue adding features to pdf-parser. Extracting and decompressing a stream (for example containing a JavaScript script) is easy with pdf-parser. You select the object that contains the stream... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19597&rss *** Taking Down Fraud Sites is Whac-a-Mole *** --------------------------------------------- I've been doing quite a bit of public speaking lately - usually about cybercrime and underground activity - and there's one question that nearly always comes from the audience: "Why are these fraud Web sites allowed to operate, and not simply taken down?" This post is intended to serve as the go-to spot for answering... --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/Da3rhmEIBt0/ *** An Analysis Of MS15-034 *** --------------------------------------------- By now you've undoubtedly heard about MS15-034. The following is a collection of my cursory research and thoughts on this vulnerability. --------------------------------------------- http://www.securitysift.com/an-analysis-of-ms15-034/ *** How to use a malicious JPEG to hack corporate networks *** --------------------------------------------- Security researcher Marcus Murray discovered a method to exploit a malicious JPEG to compromise modern Windows servers inside corporate networks. Security expert and penetration tester Marcus Murray discovered a way to use a malicious JPEG to compromise modern Windows servers and elevate privileges over targeted networks. The researcher has demonstrated the attack a few days.... --------------------------------------------- http://securityaffairs.co/wordpress/36130/hacking/malicious-jpeg-hack-corpo… *** Fiesta Exploit Kit Spreading Crypto-Ransomware - Who Is Affected? *** --------------------------------------------- Exploits kits have long been used to deliver threats to users, but they seem to have gone retro: it was recently being used to deliver fake antivirus malware. We closely monitor exploit kit activity because of their widespread use (we discussed their use in malvertising recently), so it was no great surprise to see the Fiesta... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/F_yFw0VwfG8/ *** "Rootpipe"-Lücke in OS X besteht offenbar weiter *** --------------------------------------------- Trotz Patch in der letzten Yosemite-Version scheint die Rechteausweitung nicht behoben zu sein. Schadcode soll die Lücke schon 2014 ausgenutzt haben. Ein Blogger zeigt unterdessen eine Möglichkeit auf, den Bug auch in früheren OS-X-Versionen zu fixen. --------------------------------------------- http://heise.de/-2612346 *** Bypassing Same Origin Policy, Part 3: Clickjacking, Cursorjacking & Filejacking *** --------------------------------------------- Same origin bypasses using clickjacking Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-same-origin-policy-part-3-c… *** Bypassing Packet Filters with IP Fragmentation Overlapping *** --------------------------------------------- 1. Introduction The process of IP fragmentation occurs when the data of the network layer is too large to be transmitted over the data link layer in one piece. Then the data of the network layer is split into several pieces (fragments), and this process is called IP fragmentation. The intention of this article is... --------------------------------------------- http://resources.infosecinstitute.com/bypassing-packet-filters-with-ip-frag… *** Threats From Within: The Out of Office Reply *** --------------------------------------------- As the guy who sends out the marketing emails at Cyveillance (yes, I'm THAT guy) I see a lot of Out-of-Office auto-responders in any given month. Having worked in cybersecurity for more than seven years, I've developed an appreciation for both information and physical security. With the RSA Conference coming up in a few days, and awaiting my barrage of Out of Office emails, I think now is the perfect time to discuss this seemingly innocuous topic. Why? Amazingly, even in the security... --------------------------------------------- https://blog.cyveillance.com/threats-from-within-the-out-of-office-reply/ *** Upatre malware gets full SSL comms encryption *** --------------------------------------------- The extremely popular Upatre Trojan downloader has undergone considerable changes that will make it and its communication more difficult to spot and block. The changes were implemented in the new v... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/qIIbd4nwtHA/malware_news.… *** Critical Magento Shoplift Vulnerability (SUPEE-5344) - Patch Immediately! *** --------------------------------------------- The Magento team released a critical security patch (SUPEE-5344) to address a remote command execution (RCE) vulnerability back in February. It's been more than two months since the release and still more than 50% of all the Magento installations have not been patched, leaving them open to attacks. This means hundreds of thousands of websites are... --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/lfn2WVKTfWo/critical-magento-… *** DSA-3228 ppp - security update *** --------------------------------------------- Emanuele Rocca discovered that ppp, a daemon implementing thePoint-to-Point Protocol, was subject to a buffer overflow whencommunicating with a RADIUS server. This would allow unauthenticatedusers to cause a denial-of-service by crashing the daemon. --------------------------------------------- https://www.debian.org/security/2015/dsa-3228 *** GnuTLS RSA PKCS security bypass *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/102423 *** Zenworks Architecture ZDI Vulnerability - See TID 7016431 *** --------------------------------------------- Abstract: Fix for ZDI-CAN-2491: ZENworks Preboot Policy Service Stack Buffer Overflow Remote Code Execution Vulnerability Document ID: 5206350Security Alert: YesDistribution Type: PublicEntitlement Required: NoFiles:ZCM_11.3.2_FRU1_Patch_921190.zip (3.53 MB)ZCM_11.2.4_MU1_Patch_921190.zip (1.63 MB)Products:ZENworks Configuration Management 11.3.2ZENworks Configuration Management 11.2.4ZENworks Configuration Management 11.3.1ZENworks Configuration Management 11 SP3Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=BJbybNUmQRQ~ *** Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-085Project: Invoice (third-party module)Version: 6.x, 7.xDate: 2015-March-25 Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionInvoice module allows you to create invoices in Drupal.The module doesnt sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.Additionally, some URLs were not --------------------------------------------- https://www.drupal.org/node/2459337 *** DSA-3229 mysql-5.5 - security update *** --------------------------------------------- Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.43. Please see the MySQL 5.5 Release Notes and OraclesCritical Patch Update advisory for further details: --------------------------------------------- https://www.debian.org/security/2015/dsa-3229 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect IBM Sterling Connect:Direct for UNIX (CVE-2015-0286, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-0209, CVE-2015-0288) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21883028 *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2015-0208, CVE-2015-0286, CVE-2015-0292) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21713653 *** IBM Security Bulletin: RC4 stream cipher vulnerability and HTTP request smuggling vulnerability affect IBM Tivoli Application Dependency Discovery Manager (TADDM) (CVE-2015-2808, CVE-2014-0227) *** --------------------------------------------- http://www.ibm.com/support/docview.wss?uid=swg21882717 *** Bugtraq: CVE-2014-7953 Android backup agent code execution *** --------------------------------------------- http://www.securityfocus.com/archive/1/535296 *** Android 4.4 MTP Path Traversal *** --------------------------------------------- Topic: Android 4.4 MTP Path Traversal Risk: Medium Text:MTP path traversal vulnerability in Android 4.4 -- doSendObjectInfo() method of the MtpServer class implemen... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040116

1 0

Tageszusammenfassung - Freitag 17-04-2015
by Daily end-of-shift report 17 Apr '15

17 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 16-04-2015 18:00 − Freitag 17-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Internet broken as usual. *** --------------------------------------------- We continue to see active exploitation against MS15-034. But nothing different from yesterday, so back to Infocon Green for now. (Fri, Apr 17th) --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19593&rss *** USB Defense: Stop Data Walking Out The Door *** --------------------------------------------- The bad news is that internal data breaches are on the rise. And one of the biggest culprits? USB devices. In the past few years, there has been many organizations tracking down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. --------------------------------------------- http://thehackernews.com/2015/04/usb-security-software.html *** US-Polizei schickt Malware an Whistleblower-Anwalt *** --------------------------------------------- Drei Whistelblower beschuldigen eine Polizei in Arkansas der Korruption und des Mobbings. Das Gericht ordnet die Freigabe von Dokumenten an. Die Polizei schickt eine Festplatte mit Passwortlogger, Backdoor und Command&Control Software. --------------------------------------------- http://heise.de/-2610436 *** On false alarms in detection of DGA botnet domains - part 1 *** --------------------------------------------- Domain Generation Algorithms are often used in botnets to create specially crafted domain names which point to C&C servers. The main purpose of this is to make it more difficult to block connections to these servers (for example with domain blacklists) or to protect the C&C channel (and botnet itself) from a takeover. Often domains generated this way are composed of random .. --------------------------------------------- http://www.cert.pl//news/9887/langswitch_lang/en *** Google's April Fool's prank inadvertently broke their security *** --------------------------------------------- As part of its traditional series of April Fools day jokes, Google used its own .google gTLD to launch a backwards version of its home page from the domain com.google on 1st April. However, this years joke inadvertently undermined an important security feature on Googles real homepage, which made it vulnerable to user interface redressing attacks such as click-jacking. This vulnerability would have allowed a remote attacker to change a users search settings, including turning off SafeSearch --------------------------------------------- http://news.netcraft.com/archives/2015/04/17/googles-april-fools-prank-inad… *** GnuTLS Certificate Validation Flaw Lets Remote Users Force a Signature Algorithm Downgrade *** --------------------------------------------- A vulnerability was reported in GnuTLS. A remote user can force the use of a weaker signature algorithm. The software does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm specified in the certificate. A remote user can exploit this to force the use of a weaker encryption algorithm. --------------------------------------------- http://www.securitytracker.com/id/1032148

1 0

Tageszusammenfassung - Donnerstag 16-04-2015
by Daily end-of-shift report 16 Apr '15

16 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 15-04-2015 18:00 − Donnerstag 16-04-2015 18:00 Handler: Alexander Riepl Co-Handler: Robert Waldner *** Impacts of a Hack on a Magento Ecommerce Website *** --------------------------------------------- Recently we wrote about the impacts of a hacked website and how it is important to give website visitors a safe online experience In this post, I'll show you how a hacked website results in almost immediate loss of money. We are not talking about drive-by infections that can be prevented by using a good anti-virus, updated software, and extensions like NoScript. ... This time, we're talking about using legitimate sites that have absolutely no externally visible signs of compromise. --------------------------------------------- https://blog.sucuri.net/2015/04/impacts-of-a-hack-on-a-magento-ecommerce-we… *** Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2015-096 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-096 Project: Services (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 16/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon Vulnerability: Access bypass, Arbitrary PHP code execution --------------------------------------------- https://www.drupal.org/node/2471879 *** Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-095 Project: Display Suite (third-party module) Version: 7.x Date: 2015-April-15 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default Vulnerability: Cross Site Scripting --------------------------------------------- https://www.drupal.org/node/2471733 *** The Delicate Art of Remote Checks - A Glance Into MS15-034 *** --------------------------------------------- Recently, the research team posted a testing script for the MS15-034 vulnerability to pastebin for the greater community to test. We received some feedback about how exactly we figured out how to check, and remote checks in general. --------------------------------------------- http://blog.beyondtrust.com/the-delicate-art-of-remote-checks-a-glance-into… *** Denial of Service Attacks Possible with OpenSSL Vulnerability CVE-2015-1787 *** --------------------------------------------- On March 19 we wrote about how OpenSSL disclosed and fixed 13 vulnerabilities to address several security holes. Among the vulnerabilities addressed was CVE-2015-1787, which can result in a complete denial of service on an application compiled with OpenSSL library. This blog post will tackle how the bug can be exploited ... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/Q6dMoVlcsE4/ *** Exploit kits (still) pushing Teslacrypt ransomware, (Thu, Apr 16th) *** --------------------------------------------- Teslacrypt is a form of ransomware that was first noted in January of this year. This malware apparently targets video game-related files. Ive seen Teslacrypt dropped by the Sweet Orange exploit kit (EK), and its also been dropped by Nuclear EK. McAfee saw it dropped by Angler EK last month. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19581&rss *** New POS Malware Emerges - Punkey *** --------------------------------------------- During a recent United States Secret Service investigation, Trustwave encountered a new family of POS malware, that we named Punkey. It appears to have evolved from the NewPOSthings family of malware first discovered by Dennis Schwarz and Dave Loftus at... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/New-POS-Malware-Emerges… *** IBM stellt seine Security-Datenbank ins Netz *** --------------------------------------------- IBM Security macht seine IT-Sicherheitsdatenbank künftig auf der Sharing-Plattform X-Force Exchange in der Cloud zugänglich. --------------------------------------------- http://heise.de/-2608795 *** crossdomain.xml : Beware of Wildcards *** --------------------------------------------- This blog entry will describe a wide spread Flash vulnerability that affected many big websites including paypal.com. The description will picture the state of the website paypal.com and ebay.com in 2013-2014. The vulnerabilities were completely fixed two weeks ago. Therefore, it is not possible to reproduce this vulnerability as-is. --------------------------------------------- http://blog.h3xstream.com/2015/04/crossdomainxml-beware-of-wildcards.html *** Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38403 *** Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-…

1 0

Tageszusammenfassung - Mittwoch 15-04-2015
by Daily end-of-shift report 15 Apr '15

15 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 14-04-2015 18:00 − Mittwoch 15-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Adobe Security Bulletins Posted *** --------------------------------------------- The following Security Bulletins have been posted today: APSB15-06: Security updates available for Adobe Flash Player APSB15-07: Security update: hotfixes available for ColdFusion APSB15-08: Security bulletin available .. --------------------------------------------- https://blogs.adobe.com/psirt/?p=1190 *** MSRT April: Unskal, Saluchtra, Dexter and IeEnablerCby *** --------------------------------------------- This month we added four new malware families to the Malicious Software Removal Tool: Win32/Saluchtra, Win32/Dexter, Win32/Unskal and Win32/IeEnablerCby, further protecting customers against malicious activity. IeEnablerCby is .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/14/msrt-april-unskal-saluch… *** Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38350 *** Cisco Web Security Appliance Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38351 *** Critical Patch Update - April 2015 *** --------------------------------------------- This Critical Patch Update contains 98 new security fixes across the product families listed below. Please note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is .. --------------------------------------------- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html *** Solaris Third Party Bulletin - April 2015 *** --------------------------------------------- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.h… *** Alte Xorg-Lücke bedroht haufenweise Drittsoftware *** --------------------------------------------- Die Lücke wurde bereits 2013 gestopft. Programme, die unter der Verwendung von Headern aus verwundbaren Versionen übersetzt wurden, sind allerdings nach wie vor angreifbar. --------------------------------------------- http://heise.de/-2606536 *** What the Ridiculous Fuck, D-Link?! *** --------------------------------------------- As mentioned in an update to my post on the HNAP bug in the DIR-890L, the same bug was reported earlier this year in the DIR-645, and a patch was released. D-Link .. --------------------------------------------- http://www.devttys0.com/2015/04/what-the-ridiculous-fuck-d-link/ *** Das Imperium schlägt zurück: Hacker-Gruppen ziehen gegeneinander zu Felde *** --------------------------------------------- Zwei Cyberspionage-Gruppen kamen sich in die Quere und attackierten sich wechselseitig. Sicherheitsforscher sehen hier einen neuen Trend, bei dem sich Hacker-Gruppen gezielt gegenseitig anfeinden. --------------------------------------------- http://heise.de/-2607493 *** Microsoft Security Bulletin Summary for April 2015 *** --------------------------------------------- This bulletin summary lists security bulletins released for April 2015. For information about how to receive automatic notifications whenever Microsoft security bulletins are .. --------------------------------------------- https://technet.microsoft.com/library/security/ms15-apr

1 0

Tageszusammenfassung - Dienstag 14-04-2015
by Daily end-of-shift report 14 Apr '15

14 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 13-04-2015 18:00 − Dienstag 14-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38306 *** Linux 4.0 freigegeben: Sicherheitslücken im laufenden Betrieb korrigieren *** --------------------------------------------- Bei Linux 4.0 lassen sich Sicherheitslücken ohne Neustart des Systems beheben. Ein verzögertes Aktualisieren von Dateieigenschaften soll die Performance von Ext4 verbessern. --------------------------------------------- http://heise.de/-2600691 *** A Tale of Two Exploits *** --------------------------------------------- CVE-2015-0336 is a type confusion vulnerability in the AS2 NetConnection class. I reported this issue in January and soon wrote a proof-of-concept exploit for the bug. The issue was patched by Adobe in March and less than a .. --------------------------------------------- http://googleprojectzero.blogspot.com/2015/04/a-tale-of-two-exploits.html *** Bioazih RAT: How clean-file metadata can help keep you safe *** --------------------------------------------- As mentioned in our previous blog post about the Microsoft Clean-File Metadata initiative, there are a number of benefits for our partners and customers who use our clean or released-file metadata, specifically during antimalware whitelisting efforts. Using the authoritative metadata manifest .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/13/bioazih-rat-how-clean-fi… *** New Trojan for Linux attacks websites *** --------------------------------------------- April 13, 2015 Doctor Web security researchers have examined a new Trojan that can infect computers with Linux operating system. This malicious program possesses the ability to scan remote websites for vulnerabilities and to attack resources with the specified HTTP protocol addresses. Criminals can .. --------------------------------------------- http://news.drweb.com/show/?i=9386&lng=en&c=9 *** IT-Sicherheit: Auch Medizintechnik lässt sich hacken *** --------------------------------------------- Überdosis nicht mehr ausgeschlossen: Der Sicherheitsforscher Billy Rios kann eine in Krankenhäusern verwendete Infusionspumpe über das Intranet manipulieren. --------------------------------------------- http://www.golem.de/news/it-sicherheit-auch-medizintechnik-laesst-sich-hack… *** As Ransomware Attacks Evolve, More Potential Victims Are at Risk *** --------------------------------------------- In early December, as most people were dealing with the stress of looking for the perfect holiday gifts and planning out their upcoming celebrations, police officers in .. --------------------------------------------- http://threatpost.com/as-ransomware-attacks-evolve-more-potential-victims-a… *** Sicherheitssoftware klemmt Windows vom IPv6-Internet ab *** --------------------------------------------- Die Sicherheitssoftware Warsaw 1.5.1 für Windows blockiert Internetserver, die sowohl über IPv6 als auch IPv4 erreichbar sind. Betroffen sind vor allem mehrere Millionen brasilianischer Windows-Geräte, deren Nutzer Homebanking betreiben. --------------------------------------------- http://heise.de/-2603192 *** TV5Monde - A (tentative) technical analysis *** --------------------------------------------- As it may appear surprising that a TV station can be forced to stop broadcasting after having its website defaced and social network accounts controlled by some hackers, I've tried to collect publicly available technical information and improve my understanding of this interesting issue. Below you .. --------------------------------------------- http://www.fixsing.com/tv5monde-a-tentative-technical-analysis/ *** Hardening IIS Security *** --------------------------------------------- Security is an essential part of a web application and should be taken into consideration from the first stage of the development process. A website couldn't ever be secure enough unless you would undertake necessary security .. --------------------------------------------- http://resources.infosecinstitute.com/hardening-iis-security/ *** Verschlüsselung: Auch Mozilla will HTTPS zum Standard machen *** --------------------------------------------- Ein Vorschlag von Mozilla sieht vor, dass der Firefox-Browser künftig bestimmte neue Features nur noch über HTTPS-Verbindungen zulässt. Langfristig wird angestrebt, dass alle Webseiten HTTPS benutzen. --------------------------------------------- http://www.golem.de/news/verschluesselung-auch-mozilla-will-https-zum-stand…

1 0

Tageszusammenfassung - Montag 13-04-2015
by Daily end-of-shift report 13 Apr '15

13 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 10-04-2015 18:00 − Montag 13-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability *** --------------------------------------------- A vulnerability in the status checking process of support remote access tunnels in the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to execute arbitrary Python code on a targeted system. --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38305 *** Hacking the D-Link DIR-890L *** --------------------------------------------- The past 6 months have been incredibly busy, and I haven't been keeping up with D-Link's latest shenanigans. In need of some entertainment, I went to their web page today and was greeted by this atrocity: I think the most .. --------------------------------------------- http://www.devttys0.com/2015/04/hacking-the-d-link-dir-890l/ *** Reversing Belkin's WPS Pin Algorithm *** --------------------------------------------- After finding D-Link's WPS algorithm, I was curious to see which vendors might have similar algorithms, so I grabbed some Belkin firmware and started dissecting it. This particular firmware uses the SuperTask! RTOS, and in fact uses the .. --------------------------------------------- http://www.devttys0.com/2015/04/reversing-belkins-wps-pin-algorithm/ *** Digital Certificates: Who Can You Trust? *** --------------------------------------------- Digital certificates are the backbone of the Public Key Infrastructure (PKI), which is the basis of trust online. Digital certificates are often compared to signatures; we can trust a document because it has a signature, or certificate authority (CA) by someone we trust. Simply put, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/digital-certific… *** APT 30 and the Mechanics of a Long-Running Cyber Espionage Operation *** --------------------------------------------- Having some of the world's most active economies, Asia Pacific countries are more likely to be a target of targeted attacks than the rest of the world. In Operation Quantum Entanglement, Pacific Ring of Fire: PlugX / Kaba and other FireEye reports, we have highlighted how Northeast Asian countries have been .. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.h… *** Polizeiorganisation Interpol verstärkt Kampf gegen Cyberkriminalität *** --------------------------------------------- Zum Kampf gegen die Internetkriminalität und andere neue Bedrohungen hat die internationale Polizeiorganisation Interpol ein Forschungszentrum in Singapur eröffnet. Der Interpol-Weltkomplex für Innovation (IGCI) soll .. --------------------------------------------- http://heise.de/-2599811 *** Windows XP noch auf zehntausenden Berliner Behörden-PCs *** --------------------------------------------- Seit einem Jahr gibt es keine offiziellen Patches mehr für Windows XP. Dennoch ist das fast 14 Jahre alte Betriebssystem noch weiter verbreitet, als Sicherheitsexperten lieb ist. In der Berliner Verwaltung sollen es sogar noch zehntausende PCs sein. Der Datenschutzbeauftragte Alexander Dix fordert nun die Abschaltung aller Behördenrechner. --------------------------------------------- http://derstandard.at/2000014223975 *** Zero Access Malware *** --------------------------------------------- The Zero Access trojan (Maxx++, Sierief, Crimeware) has affected millions of computers worldwide, and it is the number one cause of cyber click fraud and Bitcoin mining on the Internet. Once the trojan has been delivered into the system, it .. --------------------------------------------- http://resources.infosecinstitute.com/zero-access-malware/ *** Microsoft partners with Interpol, industry to disrupt global malware attack affecting more than 770,000 PCs in past six months *** --------------------------------------------- Today Interpol and the Dutch National High Tech Crime Unit (DNHTCU) announced the disruption of Simda.AT, a significant malware threat affecting more than 770,000 computers in over 190 countries. The Simda.AT variant first appeared in .. --------------------------------------------- http://blogs.technet.com/b/mmpc/archive/2015/04/12/microsoft-partners-with-… *** How to bypass Google's Santa LOCKDOWN mode *** --------------------------------------------- Santa is a binary whitelisting/blacklisting system made by Google's Macintosh Operations Team. While I refer to it as Google's Santa it is not an official Google product. It is based on a kernel extension and userland components to .. --------------------------------------------- https://reverse.put.as/2015/04/13/how-to-bypass-googles-santa-lockdown-mode/ *** Huthos VPS Provider: Totally legit, 1000% not a criminal organization - Andrew Morris *** --------------------------------------------- I observed a hacker trying to compromise one of my internet-facing Linux servers and repurpose it to sell to unknowing legitimate customers. --------------------------------------------- http://morris.guru/huthos-the-totally-100-legit-vps-provider/ *** OS X 10.10.3 soll gegen Adware helfen *** --------------------------------------------- Apple hat weitere Massnahmen gegen Adware ergriffen, die verstärkt kostenlosen Mac-Programmen beim Download beigelegt wird und unter anderem Browser-Einstellungen ändert. --------------------------------------------- http://heise.de/-2601940 *** VU#672268: Microsoft Windows NTLM automatically authenticates via SMB when following a file:// URL *** --------------------------------------------- Software running on Microsoft Windows that utilizes HTTP requests can be forwarded to a file:// protocol on a malicious server, which causes Windows to automatically attempt authentication via SMB to the malicious server in some circumstances. The .. --------------------------------------------- http://www.kb.cert.org/vuls/id/672268

1 0

Tageszusammenfassung - Freitag 10-04-2015
by Daily end-of-shift report 10 Apr '15

10 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 09-04-2015 18:00 − Freitag 10-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Beebone: FBI und Europol legen Wurm-Netz lahm *** --------------------------------------------- Das interessante am ausgeschalteten Beebone-Botnetz ist der Schädling dahinter: Es handelt sich um einen Downloader, der anderen Unrat nachlädt, sich selber weiter verbreitet und dabei ständig mutiert. --------------------------------------------- http://heise.de/-2598111 *** How To Create a Website Backup Strategy *** --------------------------------------------- We've all heard it million times before - backups are important. Still, the reality is that even today, backups remain one of the most overlooked and under-utilized precautions we can take to protect our vital data. Why are backups so important Put simply, a good set of backups can save your website when absolutely everythingRead More --------------------------------------------- http://feedproxy.google.com/~r/sucuri/blog/~3/II8TR_qV6OA/how-to-create-a-w… *** 122 online forums compromised to redirect visitors to Fiesta exploit kit *** --------------------------------------------- Over a hundred forum websites have been compromised and injected with code that redirects users to sites hosting the Fiesta exploit kit, Cyphort researchers have found. These are not highly popular... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/4VryRaL3aoc/malware_news.… *** Don't Be Fodder for China's "Great Cannon" *** --------------------------------------------- China has been actively diverting unencrypted Web traffic destined for its top online search service -- Baidu.com -- so that some visitors from outside of the country were unwittingly enlisted in a novel and unsettling series of denial-of-service attacks aimed at sidelining sites that distribute anti-censorship tools, according to research released this week. --------------------------------------------- http://feedproxy.google.com/~r/KrebsOnSecurity/~3/-n1M-QyvCoA/ *** Cisco and Level 3 team up to squash brute force server hijackers *** --------------------------------------------- #DownWithSSHPsychos Cisco and service provider Level 3 have teamed up take down netblocks linked to brute-force hack kingpins SSHPsychos, severely degrading (but not destroying) the groups potential to hack servers in the process. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/10/sshpsychos_… *** In eigener Sache: Wartungsarbeiten 16. 4. 2015 *** --------------------------------------------- In eigener Sache: Wartungsarbeiten 16.4.2015 | 10. April 2015 | Am Donnerstag, 16. April 2015, werden wir Wartungsarbeiten an unserer Infrastruktur vornehmen. Dies kann zu kurzen Service-Ausfällen führen (jeweils im Bereich weniger Minuten). Es gehen dabei keine Daten (zb Emails) verloren, es kann sich nur die Bearbeitung etwas verzögern. In dringenden Fällen können sie uns wie gewohnt telefonisch unter +43 1 505 64 16 78 erreichen. --------------------------------------------- http://www.cert.at/services/blog/20150410112411-1466.html *** Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38292 *** Red Hat JBoss XML External Entity Expansion Flaw Lets Remote Users Obtain Potentially Sensitive Information *** --------------------------------------------- http://www.securitytracker.com/id/1032017 *** VMSA-2015-0003.1 *** --------------------------------------------- VMware product updates address critical information disclosure issue in JRE --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** f5 Security Advisories *** --------------------------------------------- *** Security Advisory: FreeType vulnerabilities CVE-2014-9656 and CVE-2014-9659 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16380.htm… *** Security Advisory: Linux kernel vulnerability CVE-2014-9683 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16381.htm… *** Security Advisory: OpenSSL vulnerability CVE-2012-2110 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/200/sol16285.htm… *** Security Advisory: Linux file utility vulnerabilities CVE-2014-8116 / CVE-2014-8117 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16347.htm… *** Security Advisory: GnuPG vulnerability CVE-2013-4576 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16396.htm… *** Security Advisory: Linux RPM vulnerability CVE-2013-6435 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16383.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16389.htm… *** Security Advisory: NTP vulnerability CVE-2014-9297 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16392.htm… *** Security Advisory: Python vulnerability CVE-2006-4980 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16398.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16385.htm… *** Security Advisory: NTP vulnerability CVE-2014-9298 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16393.htm… *** Security Advisory: Apache Tomcat vulnerability CVE-2014-0227 *** https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16344.htm… *** DFN-CERT-2015-0483 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht einen Denial-of-Service-Angriff *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0483/ *** DFN-CERT-2015-0318 - IBM Java, IBM Notes, IBM Domino: Mehrere Schwachstellen ermöglichen die Übernahme der Systemkontrolle *** --------------------------------------------- 10.03.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0318/ *** Security_Advisory-Xen Vulnerabilities on Huawei FusionSphere products *** --------------------------------------------- Apr 10, 2015 10:12 --------------------------------------------- http://www.huawei.com/en/security/psirt/security-bulletins/security-advisor… *** [2015-04-10] Unauthenticated Local File Disclosure in multiple TP-LINK products *** --------------------------------------------- Attackers can read sensitive configuration files without prior authentication on multiple TP-LINK devices. These files e.g. include the administrator credentials and the WPA passphrase. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015…

1 0

Tageszusammenfassung - Donnerstag 9-04-2015
by Daily end-of-shift report 09 Apr '15

09 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 08-04-2015 18:00 − Donnerstag 09-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Securing high-risk, third-party relationships *** --------------------------------------------- High-profile attacks reveal that malicious hackers target third-party vendors and supply chain partners as a backdoor into their primary target, according to CyberArk Software. Organizations in e... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/vSpu1uYwxR4/secworld.php *** AlienSpy RAT exploited to deliver the popular Citadel Trojan *** --------------------------------------------- Security experts at Fidelis firm discovered that variants of the AlienSpy remote access trojan (RAT) are currently being used in global phishing campaigns. Cyber criminals have exploited the AlienSpy RAT to deliver the popular Citadel banking Trojan and maintain the persistence inside the targeted architecture with a backdoor mechanism. Criminal crews used AlienSpy RAT to compromise systems in... --------------------------------------------- http://securityaffairs.co/wordpress/35802/cyber-crime/alienspy-rat-citadel-… *** Apple aktualisiert Safari für OS X 10.8, 10.9 und 10.10 *** --------------------------------------------- Mit den Versionen 8.0.5, 7.1.5 und 6.2.5 seines Browsers behebt Cupertino jede Menge Sicherheitslücken, darunter auch ein altes Problem im Privatmodus. --------------------------------------------- http://heise.de/-2597649 *** 44 Relevant Cyber Security Conferences around the World *** --------------------------------------------- Wherever you may be in the world, chances are there's a cyber security event happening near you this year. Cyber security conferences are important and necessary for the industry and for each of us, individually, because they help bring together the community. What's more, innovation often spurs after having a meaningful discussion with a peer or a mentor, or after being part of a conversation on your favorite topic in the field of information security. --------------------------------------------- https://heimdalsecurity.com/blog/44-relevant-cyber-security-conferences-aro… *** Polymorphic Beebone botnet sinkholed in international police operation *** --------------------------------------------- On April 8, a global operation targeted the Beebone (also known as AAEH) botnet, a polymorphic downloader bot which installs various forms of malware on victims' computers. Initial figures show tha... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/MGj0qJKKZ0I/secworld.php *** Deadly combination of Upatre and Dyre Trojans still actively targeting users *** --------------------------------------------- Upatre (or Waski) is a downloader Trojan that has lately become the malware of choice for cyber crooks to deliver additional, more dangerous malware on users computers. A few weeks ago, Swiss and ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/IJ4tqq_YAUU/malware_news.… *** LG software disables Windows security feature, developer says *** --------------------------------------------- LG Split Screen software that comes with the companys ultra wide monitors stealthily weakens Windows users defenses by deactivating the OS User Account Control (UAC) feature, developer Christopher ... --------------------------------------------- http://feedproxy.google.com/~r/HelpNetSecurity/~3/1t_AM7tskik/secworld.php *** Hidden backdoor API to root privileges in Apple OS X *** --------------------------------------------- The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It's been there for several years (at least since 2011), I found it in October 2014 and it can be exploited to escalate privileges to root from any user account in the system. --------------------------------------------- https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-pri… *** The Banking Trojan Emotet: Detailed Analysis *** --------------------------------------------- The Emotet Trojan is a highly automated and developing, territorially-targeted bank threat. Its small size, the dispersal methods used and the modular architecture, all make Emotet a very effective weapon for the cyber-criminal. --------------------------------------------- http://securelist.com/analysis/69560/the-banking-trojan-emotet-detailed-ana… *** Apple Leaves CNNIC Root in iOS, OSX Certificate Trust Lists *** --------------------------------------------- When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether, Apple has kept the root certificates in its trusted store for both iOS and OSX. Apple on Wednesday released... --------------------------------------------- http://threatpost.com/apple-leaves-cnnic-root-in-ios-osx-certificate-trust-… *** TA15-098A: AAEH *** --------------------------------------------- Original release date: April 09, 2015 Systems Affected Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012 Overview AAEH is a family of polymorphic downloaders created with the primary purpose of downloading other malware, including password stealers, rootkits, fake antivirus, and ransomware.The United States Department of Homeland Security (DHS), in collaboration with Europol, the Federal Bureau of Investigation (FBI) and... --------------------------------------------- https://www.us-cert.gov/ncas/alerts/TA15-098A *** ZDI-15-119: IBM Tivoli Storage Manager FastBack CRYPTO_S_EncryptBufferToBuffer Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/OQuaNiGQOf8/ *** ZDI-15-118: IBM Tivoli Storage Manager FastBack Mount CMountDismount::GetVaultDump Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Tivoli Storage Manager FastBack. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://feedproxy.google.com/~r/ZDI-Published-Advisories/~3/RumTeWThXlw/ *** DFN-CERT-2015-0484 - F5 Networks BIG-IP Protocol Security Module (PSM), F5 Networks BIG-IP Systeme: Eine Schwachstelle ermöglicht das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0484/ *** DFN-CERT-2015-0477 - MantisBT: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 08.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0477/ *** Asterisk TLS Certificate Validation Flaw With Null Byte in Common Name Lets Remote Users Bypass Certificate Validation *** --------------------------------------------- http://www.securitytracker.com/id/1032052 *** CiviCRM private report - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-094 *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-094Project: CiviCRM private report (third-party module)Version: 6.x, 7.xDate: 2015-April-08 Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionCiviCRM private report module enables users to create their own private copies of CiviCRM reports, which they can modify and save to meet their needs without requiring the "Administer reports" permission.The --------------------------------------------- https://www.drupal.org/node/2467697 *** [2015-04-09] Multiple XSS & XSRF vulnerabilities in Comalatech Comala Workflows *** --------------------------------------------- XSS and XSRF vulnerabilities within the Confluence plugin Comala Workflows of Comalatech enable an attacker to perform unauthorized actions in the name of another logged-in user and attack other users of the web application with JavaScript code, browser exploits or Trojan horses. --------------------------------------------- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/2015… *** Juniper Security Advisories *** --------------------------------------------- *** JSA10679 - 2015-04 Security Bulletin: OpenSSL 8th January 2015 advisory. *** http://kb.juniper.net/index?page=content&id=JSA10679&actp=RSS *** JSA10680 - 2015-04 Security Bulletin: OpenSSL 19th March 2015 advisory *** http://kb.juniper.net/index?page=content&id=JSA10680&actp=RSS *** JSA10678 - 2015-04 Security Bulletin: Junos: Insufficient entropy on QFX3500 and QFX3600 platforms when the system boots up (CVE-2015-3006) *** http://kb.juniper.net/index?page=content&id=JSA10678&actp=RSS *** JSA10677 - 2015-04 Security Bulletin: SRX Series: Cross-Site-Scripting Vulnerability in Dynamic VPN (CVE-2015-3005). *** http://kb.juniper.net/index?page=content&id=JSA10677&actp=RSS *** JSA10676 - 2015-04 Security Bulletin: SRX Series: ISC BIND vulnerability denial of service in delegation handling (CVE-2014-8500) *** http://kb.juniper.net/index?page=content&id=JSA10676&actp=RSS *** JSA10675 - 2015-04 Security Bulletin: Junos J-Web: Clickjacking vulnerability (CVE-2015-3004) *** http://kb.juniper.net/index?page=content&id=JSA10675&actp=RSS *** JSA10674 - 2015-04 Security Bulletin: Junos: Multiple privilege escalation vulnerabilities in Junos CLI (CVE-2015-3003) *** http://kb.juniper.net/index?page=content&id=JSA10674&actp=RSS *** JSA10673 - 2015-04 Security Bulletin: IDP: Multiple vulnerabilities addressed by third party software updates. *** http://kb.juniper.net/index?page=content&id=JSA10673&actp=RSS *** JSA10672 - 2015-04 Security Bulletin: SRX Series: disconnecting from console may not automatically log out (CVE-2015-3002) *** http://kb.juniper.net/index?page=content&id=JSA10672&actp=RSS *** Apple Security Advisories *** --------------------------------------------- Apple TV 7.2 https://support.apple.com/kb/HT204662 *** iOS 8.3 *** https://support.apple.com/kb/HT204661 *** OS X Yosemite 10.10.3 and Security Update 2015-004 *** https://support.apple.com/kb/HT204659 *** Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 *** https://support.apple.com/kb/HT204658 *** OS X Yosemite 10.10.3 Combo Update *** https://support.apple.com/kb/DL1804 *** OS X Yosemite 10.10.3 Update *** https://support.apple.com/kb/DL1805 *** Security Update 2015-004 Mountain Lion *** https://support.apple.com/kb/DL1802 *** Security Update 2015-004 Mavericks *** https://support.apple.com/kb/DL1803 *** iOS 8.3 *** https://support.apple.com/kb/DL1806 *** Xcode 6.3 *** https://support.apple.com/kb/HT204663

1 0

Tageszusammenfassung - Mittwoch 8-04-2015
by Daily end-of-shift report 08 Apr '15

08 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 07-04-2015 18:00 − Mittwoch 08-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Gmail Problems Due to Expired Certificate (April 6, 2015) *** --------------------------------------------- Because Google allowed a servers security certificate to expire, Gmail users experienced problems for several hours on April 4....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/27/302 *** Aw snap! How hideous HTML can crash Chrome tabs in one click *** --------------------------------------------- Watch out for drive-by browser bombs - for now, at least A bug in the most recent version of the Chrome allows miscreants to crash browser tabs simply by embedding a link with a malformed URL in the HTML of a page. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/07/chrome_awsn… *** Drive-by-login attack identified and used in lieu of spear phishing campaigns *** --------------------------------------------- A new attack, drive-by-logins, allows attackers to target specific victims on sites they trust. --------------------------------------------- http://www.scmagazine.com/high-tech-bridge-identifies-new-attack-method-pos… *** Nuclear Exploit-Kit mit Google Ads ausgeliefert *** --------------------------------------------- Googles Werbebanner lieferten für mehrere Stunden ein gefährliches Exploit-Kit aus, das die Rechner vieler nichtsahnender Opfer mit Schadcode infiziert haben könnte. --------------------------------------------- http://heise.de/-2596908 *** Most top corporates still Heartbleeding over the internet *** --------------------------------------------- Australia crowned global head-in-sand champion A depressing 76 percent of the top 2000 global organisations have public facing systems still exposed to Heartbleed, researchers say. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/still_bleed… *** Your home automation things are a security nightmare *** --------------------------------------------- Veracode tests leave lazy devs red-faced Its not just home broadband routers that have hopeless security: according to security outfit Veracode, cloudy home automation outfits also need to hang their collective heads in shame. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/04/08/your_home_a… *** Why cybersecurity is vital during the vendor selection process *** --------------------------------------------- You likely have a list of criteria to check through during the hiring process of a vendor, but if you havent added cybersecurity standards to that list, you should. --------------------------------------------- http://www.scmagazine.com/why-cybersecurity-is-vital-during-the-vendor-sele… *** l+f: Updated euer WordPress oder ISIS kommt! *** --------------------------------------------- Das FBI schlägt Alarm: Sympathisanten des Islamischen Staates hacken haufenweise WordPress-Seiten. --------------------------------------------- http://heise.de/-2596912 *** Guide outlines specifications of smart card-based PACS *** --------------------------------------------- Smart cards are increasingly accepted as the credential of choice for securely authenticating identity, determining appropriate levels of information access and controlling physical access. To furt... --------------------------------------------- http://www.net-security.org/secworld.php?id=18179 *** A flawed ransomware encryptor *** --------------------------------------------- Last autumn, we discovered the first sample of an interesting new encryptor, TorLocker. The Trojan encrypts all files with AES-256 + RSA-2048 and uses the Tor network to contact its "owners". --------------------------------------------- http://securelist.com/blog/research/69481/a-flawed-ransomware-encryptor/ *** New Tor version fixes issues that can crash hidden services and clients *** --------------------------------------------- Two new versions of the Tor anonymity software have been released on Tuesday, with fixes for two security issues that can be exploited to crash hidden services and clients visiting them. The first ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18180 *** Don't judge the risk by the logo *** --------------------------------------------- It's been almost a year since the OpenSSL Heartbleed vulnerability, a flaw which started a trend of the branded vulnerability, changing the way security vulnerabilities affecting open-source software are being reported and perceived. Vulnerabilities are found and fixed all the... --------------------------------------------- https://securityblog.redhat.com/2015/04/08/dont-judge-the-risk-by-the-logo/ *** NTP Project ntpd reference implementation contains multiple vulnerabilities *** --------------------------------------------- NTP Project ntpd reference implementation accepts unauthenticated packets with symmetric key cryptography and does not protect symmetric associations against denial of service attacks. --------------------------------------------- https://www.kb.cert.org/vuls/id/374268 *** Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150408-ntpd --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco ASA FirePOWER Services and Cisco ASA CX Services Crafted Packets Denial of Service Vulnerability *** --------------------------------------------- cisco-sa-20150408-cxfp --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco ASA Software *** --------------------------------------------- cisco-sa-20150408-asa --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** HPSBHF03310 rev.1 - HP Thin Clients running Windows Embedded Standard 7 (WES7) or Windows Embedded Standard 2009 (WES09) with HP Easy Deploy, Remote Elevation of Privilege, Execution of Code *** --------------------------------------------- Potential security vulnerabilities have been identified with certain HP Thin Clients running Windows Embedded Standard 7 (WES7) and Windows Embedded Standard 2009 (WES09) and all versions of HP Easy Deploy. The vulnerabilities could be exploited remotely to allow elevation of privilege and execution of code. --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04629160 *** SSA-487246 (Last Update 2015-04-08): Vulnerabilities in SIMATIC HMI Devices *** --------------------------------------------- https://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_securit… *** FreeBSD IPv6 Router Advertisement Processing Flaw Lets Remote Users Deny Service *** --------------------------------------------- http://www.securitytracker.com/id/1032043 *** DSA-3214 mailman - security update *** --------------------------------------------- A path traversal vulnerability was discovered in Mailman, the mailinglist manager. Installations using a transport script (such aspostfix-to-mailman.py) to interface with their MTA instead of staticaliases were vulnerable to a path traversal attack. To successfullyexploit this, an attacker needs write access on the local file system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3214

1 0

Tageszusammenfassung - Dienstag 7-04-2015
by Daily end-of-shift report 07 Apr '15

07 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 03-04-2015 18:00 − Dienstag 07-04-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** On Demand Webinar: Monitoring Linux/UNIX Privileged Users *** --------------------------------------------- On Demand Webinar - Randy Franklin Smith looks at how to audit what admins do inside Linux and UNIX with sudo's logging capabilities. Then, the BeyondTrust team will walk through how to augment sudo for complete control and auditing over UNIX and Linux user activity. --------------------------------------------- http://blog.beyondtrust.com/on-demand-webinar-monitoring-linuxunix-privileg… *** Dyre Wolf malware steals more than $1 million, bypasses 2FA protection *** --------------------------------------------- Campaign is crude and brazen, but rakes in cash anyway. --------------------------------------------- http://feeds.arstechnica.com/~r/arstechnica/security/~3/dSucTqiLvNI/ *** Angler Exploit Kit Utilizing 302 Cushioning and Domain Shadowing *** --------------------------------------------- Overview Angler Exploit Kit is one of the most prevalent and advanced exploit kits in use today and is continually evolving. Angler continues to utilize malvertising to push landing pages and malicious actors are still registering domains solely for serving exploits, but recently, weve noticed an increase in two new infection vectors - 302 Cushioning and Domain Shadowing. 302 Cushioning, or a --------------------------------------------- http://feedproxy.google.com/~r/zscaler/research/~3/JUMaL-rqARE/angler-explo… *** Bugs in Tor exploited to run DoS against black markets *** --------------------------------------------- A severe vulnerability in Tor network was exploited by attackers to run denial of service attacks against two underground black markets. An operator of an underground black market hosted on the Tor network revealed that hit site suffered a DoS attack that exploited a flaw in Tor architecture. The event is not isolated, a similar... --------------------------------------------- http://securityaffairs.co/wordpress/35663/hacking/bugs-in-tor-dos.html *** Bring Out Your Dead: An Update on the PCI relevance of SSLv3 *** --------------------------------------------- In October, a tidal wave of discussion surrounding SSLv3 hit the information security community with the release of the POODLE attack vector. This served to heat up existing discussions about when and how organizations would give SSLv3 the final thump... --------------------------------------------- https://www.ambiron.com/Resources/SpiderLabs-Blog/Bring-Out-Your-Dead--An-U… *** A severe arbitrary code execution in BitTorrent Sync affects various products *** --------------------------------------------- A security expert has discovered a severe vulnerability in BitTorrent Sync that can be exploited by a remote attacker to execute arbitrary code on a vulnerable machine. The security expert Andrea Micalizzi, also known as "rgod", has discovered a serious vulnerability in BitTorrent Sync (CVE-2015-2846) can be exploited by a remote attacker to execute arbitrary code. --------------------------------------------- http://securityaffairs.co/wordpress/35752/hacking/severe-flaw-bittorrent-sy… *** SS7-Schwachstellen: Firewalls sollen Angriffe mildern *** --------------------------------------------- Die Probleme im Protokoll SS7 lassen sich nicht ohne weiteres absichern, denn es wurden dafür nie entsprechende Sicherheitsmaßnahmen implementiert. Mit Firewalls können Provider Schwachstellen zumindest abmildern. --------------------------------------------- http://www.golem.de/news/ss7-schwachstellen-firewalls-sollen-angriffe-milde… *** Fuzzing: Wie man Heartbleed hätte finden können *** --------------------------------------------- Vor einem Jahr machte der Heartbleed-Bug in OpenSSL Schlagzeilen - doch solche Bugs lassen sich mit Hilfe von Fuzzing-Technologien aufspüren. Wir haben das mit den Tools American Fuzzy Lop und Address Sanitizer nachvollzogen und den Heartbleed-Bug neu entdeckt. --------------------------------------------- http://www.golem.de/news/fuzzing-wie-man-heartbleed-haette-finden-koennen-1… *** Firefox-Update: Mozilla schaltet opportunistische Verschlüsselung wieder aus *** --------------------------------------------- Nicht mal eine Woche nach Firefox 37 muss Mozilla nun Firefox 37.0.1 nachlegen. Das Sicherheits-Feature "opportunistic encryption" kann missbraucht werden, um die Sicherheit von SSL/TLS-Verbindungen zu untergraben und wurde wieder entfernt. --------------------------------------------- http://heise.de/-2596576 *** Cell Phone Opsec *** --------------------------------------------- Heres an article on making secret phone calls with cell phones. His step-by-step instructions for making a clandestine phone call are as follows: Analyze your daily movements, paying special attention to anchor points (basis of operation like home or work) and dormant periods in schedules (8-12 p.m. or when cell phones arent changing locations); Leave your daily cell phone behind... --------------------------------------------- https://www.schneier.com/blog/archives/2015/04/cell_phone_opse.html *** ZDI-15-112: ManageEngine Desktop Central MSP InventorySWMeteringServlet domain File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-112/ *** ZDI-15-113: ManageEngine OpManager MultipartRequestServlet filename File Upload Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-113/ *** ZDI-15-114: ManageEngine Desktop Central MSP AndroidCheckInServlet UDID Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine Desktop Central MSP. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-114/ *** ZDI-15-115: BitTorrent Sync btsync: Protocol Command Injection Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BitTorrent Sync. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-115/ *** ZDI-15-116: IBM Lotus Domino SSL2 Client Master Key Buffer Overflow Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-116/ *** ZDI-15-117: IBM Lotus Domino LDAP ModifyRequest add Remote Code Execution Vulnerability *** --------------------------------------------- This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Domino. Authentication is not required to exploit this vulnerability. --------------------------------------------- http://www.zerodayinitiative.com/advisories/ZDI-15-117/ *** Security Advisory: OpenSSL vulnerability CVE-2015-0287 *** --------------------------------------------- (SOL16318) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16318.htm… *** Security Advisory: OpenSSL vulnerability CVE-2009-5146 *** --------------------------------------------- (SOL16337) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16337.htm… *** Security Advisory: Multiple MySQL vulnerabilities *** --------------------------------------------- (SOL16355) --------------------------------------------- https://support.f5.com:443/kb/en-us/solutions/public/16000/300/sol16355.htm… *** SA-CONTRIB-2015-065 - Registration codes - Multiple vulnerabilities *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-065Project: Registration codes (third-party module)Version: 6.x, 7.xDate: 2015-March-04 Security risk: 16/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Cross Site Request ForgeryDescriptionRegistration codes module allows new account registrations only for users who provide a valid registration code. The module was not properly sanitizing user supplied text in some pages, thereby exposing XSS --------------------------------------------- https://www.drupal.org/node/2445955 *** OpenSSH 6.8 Insecure Functions *** --------------------------------------------- Topic: OpenSSH 6.8 Insecure Functions Risk: Low Text:-=[Advanced Information Security Corp]=- Author: Nicholas Lemonias Report Date: 2/4/2015 Email: lem.nikolas (at) gmail ... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015040029 *** IDM 4.0.2 ACF2 Driver Version 4.0.0.3 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional ACF2 Driver Version 4.0.0.3. This patch is for the Identity Manager 4.0.2 to 4.5 ACF2 Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206570Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402acf2_4003.tar.gz (2.55 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=oJ3evaNQb2M~ *** IDM 4.0.2 RACF Driver Version 4.0.0.11 Patch 3 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional RACF Driver Version 4.0.0.11. This patch is for the Identity Manager 4.0.2 to 4.5 RACF Driver. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, RACFEXEC.XMTDocument ID: 5206551Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402racf_40011.tar.gz (2.99 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches:IDM 4.0.2 RACF Driver Version 4.0.0.8 Patch2 --------------------------------------------- https://download.novell.com/Download?buildid=6F0mcIA5UQs~ *** IDM 4.0.2-4.5 Top Secret Driver Version 3.6.1.10 Patch 1 *** --------------------------------------------- Abstract: IDM 4.0.2-4.5 Bi-Directional Top Secret Driver Version 3.6.1.10. Field patch for IDMLOAD.XMT, SAMPLIB.XMT, TSSEXEC.XMTDocument ID: 5206590Security Alert: YesDistribution Type: Field Test FileEntitlement Required: NoFiles:idm402topsecret_36110.tar.gz (2.66 MB)Products:Identity Manager 4.0.2Identity Manager 4.5Superceded Patches: None --------------------------------------------- https://download.novell.com/Download?buildid=_WYyICODfL8~ *** Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38222 *** HPSBMU03296 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP BladeSystem c-Class Onboard Administrator. These vulnerabilities include the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "POODLE", which could be exploited remotely to allow a Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599440 *** HPSBGN03306 rev.1 - HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL, Remote Denial of Service (DoS) *** --------------------------------------------- Potential security vulnerabilities have been identified with HP IceWall SSO MCRP, SSO Dfw, and SSO Agent running OpenSSL. The vulnerabilities could be exploited remotely resulting in Denial of Service (DoS). --------------------------------------------- https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04626468 *** DFN-CERT-2015-0463 - Google Chrome, Chromium, Ubuntu oxide-qt: Mehrere Schwachstellen ermöglichen u. a. das Ausführen beliebigen Programmcodes *** --------------------------------------------- 07.04.2015 --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0463/ *** Security Advisory: Persistent XSS in WP-Super-Cache *** --------------------------------------------- Security Risk: Dangerous Exploitation level: Very Easy/Remote DREAD Score: 8/10 Vulnerability: Persistent XSS Patched Version: 1.4.4 During a routine audit for our Website Firewall (WAF), we discovered a dangerous Persistent XSS vulnerability affecting the very popular WP-Super-Cache plugin (more than a million active installs according to wordpress.org). The security issue, as well as another bug-fixRead More --------------------------------------------- http://blog.sucuri.net/2015/04/security-advisory-persistent-xss-in-wp-super…

1 0

Tageszusammenfassung - Freitag 3-04-2015
by Daily end-of-shift report 03 Apr '15

03 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 02-04-2015 18:00 − Freitag 03-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Website Malware - The SWF iFrame Injector Evolves *** --------------------------------------------- Last year, we released a post about a malware injector found in an Adobe Flash (.SWF) file. In that post, we showed how a .SWF file is used to inject an invisible, .. --------------------------------------------- http://blog.sucuri.net/2015/04/website-malware-the-swf-iframe-injector-evol… *** Audit Concludes No Backdoors in TrueCrypt *** --------------------------------------------- Auditors performing a cryptanalysis of TrueCrypt found four vulnerabilities, but zero backdoors in the popular open source encryption software. --------------------------------------------- http://threatpost.com/audit-concludes-no-backdoors-in-truecrypt/111994 *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38194 http://tools.cisco.com/security/center/viewAlert.x?alertId=38193 http://tools.cisco.com/security/center/viewAlert.x?alertId=38210 *** The Fine Line Between Ad and Adware: A Closer Look at the MDash SDK *** --------------------------------------------- Just last month, there were reports that Google removed three apps from its Play Store as they were discovered to be adware in disguise. At the time of the discovery, the apps were said to have been downloaded into millions of devices, .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-fine-line-be… *** VMSA-2015-0003 *** --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0003.html *** All in One SEO Pack <= 2.2.5.1 - Authentication Bypass *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7881 *** Schneider Electric VAMPSET Software Buffer Overflow Vulnerability *** --------------------------------------------- This advisory provides mitigation details for a vulnerability in the Schneider Electric VAMPSET software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-092-01 *** SSH Fingerprints Are Important, (Fri, Apr 3rd) *** --------------------------------------------- Some years ago, I was preparing Cisco certification exams. I connected via SSH to a new Cisco router, and was presented with this familiar dialog: This made me think: before proceeding, I wanted to obtain the fingerprint out-of-band, via a trusted channel, so that I could verify it. So I took a .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19543 *** Android Security - 2014 in Review *** --------------------------------------------- https://static.googleusercontent.com/media/source.android.com/en/us/devices…

1 0

Tageszusammenfassung - Donnerstag 2-04-2015
by Daily end-of-shift report 02 Apr '15

02 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 01-04-2015 18:00 − Donnerstag 02-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Phishing-Mails mit Anweisungen des Chefs oft erfolgreich *** --------------------------------------------- Phishing-Mails werden immer raffinierter. So gibt es etwa getarnte Mails vom Boss an seine Mitarbeiter, Geld zu überweisen, die höchst erfolgreich sind. --------------------------------------------- http://futurezone.at/digital-life/phishing-mails-mit-anweisungen-des-chefs-… *** User Import - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-093 *** --------------------------------------------- This module enables the import of users into Drupal, or the update of existing users, with data from a CSV file (comma separated file).Some management URLs were not properly protected. A malicious user could trick an administrator .. --------------------------------------------- https://www.drupal.org/node/2463949 *** Password Policy - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-090 *** --------------------------------------------- The Password Policy module allows enforcing restrictions on user passwords by defining password policies.The module doesnt sufficiently sanitize usernames in some administration pages, thereby exposing a Cross Site Scripting .. --------------------------------------------- https://www.drupal.org/node/2463835 *** NewPosThings Has New PoS Things *** --------------------------------------------- Arbor Networks initially posted about a new point-of-sale (PoS) malware family named NewPosThings last September, which we detect as either TSPY_POSNEWT.SM or TSPY_POSNEWT.A. We are now .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/newposthings-has… *** Google suspends CNNIC from Chromes certificate store *** --------------------------------------------- Chinese certificate authority told to re-apply.When a web client, such as a browser, attempts to make an HTTPS connection, it needs to know that no man-in-the-middle attack is taking place. The web server therefore proves its .. --------------------------------------------- http://www.virusbtn.com/blog/2015/04_02b.xml *** Frühjahrsputz bei Chrome: Fast 200 Adware-Plug-ins fliegen raus *** --------------------------------------------- Google räumt im Chrome Web Store auf und verbannt reihenweise Adware-Erweiterungen, die Millionen von Nutzern mit Werbung genervt haben. In Zukunft sollen derartige Plagegeister erst gar nicht im Web Store landen. --------------------------------------------- http://heise.de/-2595248 *** E-Mail-Sicherheit: Gedächtnislücken und Darkmail-Ideen *** --------------------------------------------- Die Internet Engineering Task Force hat sich die Vertraulichkeit der Internetprotokolle auf die Fahnen geschrieben. Was lässt sich bei E-Mails noch machen? Zum Beispiel Metadaten verbergen. Auch gibt es Versuche, sichere E-Mail handlicher zu machen. --------------------------------------------- http://heise.de/-2595167 *** Using the docker command to root the host (totally not a security issue) *** --------------------------------------------- It is possible to do a few more things more with docker besides working with containers, such as creating a root shell on the host, overwriting system configuration files, reading restricted stuff, etc. --------------------------------------------- http://reventlov.com/advisories/using-the-docker-command-to-root-the-host *** Analysis of a Romanian Botnet *** --------------------------------------------- Recently I noticed some strange entries in our web server log files. Specifically, someone was trying to exploit our servers using the ShellShock vulnerability (CVE-2014-6271) to execute a .. --------------------------------------------- http://blog.politoinc.com/2015/04/analysis-of-a-romanian-botnet/ *** Verschlüsselung: Truecrypt-Audit findet kleinere Sicherheitsprobleme *** --------------------------------------------- Die zweite Phase des Audits für die Verschlüsselungssoftware Truecrypt ist beendet. Dabei wurden die kryptographischen Funktionen untersucht. Einige Sicherheitsprobleme wurden entdeckt, sie treten aber nur in seltenen Fällen auf. --------------------------------------------- http://www.golem.de/news/verschluesselung-truecrypt-audit-findet-kleinere-s…

1 0

Tageszusammenfassung - Mittwoch 1-04-2015
by Daily end-of-shift report 01 Apr '15

01 Apr '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 31-03-2015 18:00 − Mittwoch 01-04-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38113 http://tools.cisco.com/security/center/viewAlert.x?alertId=38118 http://tools.cisco.com/security/center/viewAlert.x?alertId=38114 http://tools.cisco.com/security/center/viewAlert.x?alertId=38124 *** The Resurrection of CVE-2011-2461 *** --------------------------------------------- Security researchers Luca Carettoni and Mauro Gentile recently found during their research that even though Adobe has fixed an old vulnerability found in 2011 (CVE-2011-2461), its side effects still linger around the Internet. Your favorite .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/the-resurrection… *** OWASP/WASC Distributed Web Honeypots Project Re-Launch - Seeking Participants *** --------------------------------------------- The SpiderLabs Research Team is proud to announce that we are officially re-launching the Distributed Web Honeypots Project under the new joint OWASP/WASC project home! For those SpiderLabs Blog readers who follow our .. --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/OWASP/WASC-Distributed-… *** Intro to E-Commerce and PCI Compliance - Part I *** --------------------------------------------- Have you ever heard of the term Payment Card Industry (PCI)? Specifically, PCI compliance? If you have an e-commerce website, you probably have already heard about it. But do .. --------------------------------------------- http://blog.sucuri.net/2015/03/intro-to-e-commerce-and-pci-compliance-part-… *** Inductive Automation Ignition Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for several vulnerabilities in Inductive Automation's Ignition Software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-01 *** Ecava IntegraXor DLL Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for two DLL loading vulnerabilities in Ecava's IntegraXor SCADA Server. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-02 *** Hospira MedNet Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for four vulnerabilities in Hospira's MedNet server software. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-090-03 *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-085-01 Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities, .. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01A *** Rig Exploit Kit Changes Traffic Patterns, (Wed, Apr 1st) *** --------------------------------------------- Sometime within the past month, Rig exploit kit (EK) changed URL structure." /> Notice the PHPSSESID and ?req= patterns in the above example." /> Now, we dont see the PHPSSESID and ?req= patterns. Lets take a closer look at the more .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19533 *** Multiple Xen-vulnerabilities *** --------------------------------------------- http://www.securitytracker.com/id/1031994 http://www.securitytracker.com/id/1031998 http://www.securitytracker.com/id/1031997 *** Crypto-Ransomware Sightings and Trends for 1Q 2015 *** --------------------------------------------- It seems that cybercriminals have yet to tire of creating crypto-ransomware malware. Since the start of 2015, we have spotted several variants of crypto-ransomware plague the threat landscape. In January, the Australia-New Zealand region was beset by variants of TorrentLocker. But we soon .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/crypto-ransomwar… *** Firefox 37 verbessert Browser-Sicherheit *** --------------------------------------------- Es ist wieder einmal Update-Zeit bei Mozilla: Mit Firefox 37 gibt es nun also eine neue Version des Browsers, die vor allem Sicherheitsverbesserungen verspricht. --------------------------------------------- http://derstandard.at/2000013734909 *** A timeline of mobile botnets *** --------------------------------------------- With the recent explosion in smartphone usage, malware authors have increasingly focused their attention on mobile devices, leading to a steep rise in mobile malware over the past couple of years. In this paper, Ruchna Nigam focuses on mobile botnets, drawing up an inventory of types of known mobile bot variants. --------------------------------------------- https://www.virusbtn.com/virusbulletin/archive/2015/03/vb201503-mobile-botn… *** Google: Fünf Prozent aller Nutzer haben Adware auf ihren Rechnern *** --------------------------------------------- Bei mehr als einem Drittel davon sind es sogar mehr als vier Tools, die Werbung in Webseiten injizieren --------------------------------------------- http://derstandard.at/2000013745151 *** Smartes Türschloss August war zu gastfreundlich *** --------------------------------------------- Durch eine Lücke in vernetzten Türschlossern konnten sich deren Besitzer unangemeldet untereinander besuchen. --------------------------------------------- http://heise.de/-2593822 *** JOSE - JSON Object Signing and Encryption *** --------------------------------------------- Federated Identity Management has become very widespread in past years - in addition to enterprise deployments a lot of popular web services allow users to carry their identity over multiple sites. Social networking .. --------------------------------------------- https://securityblog.redhat.com/2015/04/01/jose-json-object-signing-and-enc… *** DNS/AXFR: Nameserver verraten Geheim-URLs *** --------------------------------------------- Das DNS-Protokoll hat eine Funktion, mit der man umfangreiche Informationen zu einer Domain abfragen kann. Dieser sogenannte AXFR-Transfer ist normalerweise .. --------------------------------------------- http://www.golem.de/news/dns-axfr-nameserver-verraten-geheim-urls-1504-1132…

1 0

Tageszusammenfassung - Dienstag 31-03-2015
by Daily end-of-shift report 31 Mar '15

31 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 30-03-2015 18:00 − Dienstag 31-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** New reconnaissance threat Trojan.Laziok targets the energy sector *** --------------------------------------------- A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised .. --------------------------------------------- http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlazio… *** WordPress Leads 1.6.1-1.6.2 - Persistent XSS *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7871 *** Drive-by code and Phishing on Swiss websites in 2014 *** --------------------------------------------- In 2014, about 1,800 Swiss websites were cleaned from drive-by code, compared with 2,700 in 2013, a decline of 33%. At the same time, the number of phishing cases affecting .ch and .li .. --------------------------------------------- http://securityblog.switch.ch/2015/03/31/drive-by-phishing-swiss-websites-2… *** Citrix Command Center Bugs Let Remote Users Download Files and Execute Arbitrary Code *** --------------------------------------------- http://www.securitytracker.com/id/1031993 *** VB2015 conference programme announced *** --------------------------------------------- >From drones to elephants: an exciting range of topics will be covered in Prague.In six months time, security researchers from around the world will gather in Prague for the 25th Virus Bulletin conference. Today we are excited to reveal the conference programme.As every year, the selection committees task .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_31.xml?rss *** IoT Research - Smartbands *** --------------------------------------------- One of the big trends in sphere of health and fitness are fitness trackers such as smartbands. Tracking devices and their mobile applications from three leading vendors were inspected in this report to shed some light on the current .. --------------------------------------------- http://securelist.com/analysis/publications/69412/iot-research-smartbands/ *** Chinas Man-on-the-Side Attack on GitHub *** --------------------------------------------- We have looked closer at this attack, and can conclude that China is using their active and passive network infrastructure in order to perform a man-on-the-side attack against GitHub. See our "TTL analysis" at the end of .. --------------------------------------------- http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-… *** Hacking Browsers: Are Browsers the Weakest Link of the Security Chain? *** --------------------------------------------- Current scenario The number of cyber attacks is constantly increasing, and according to security experts they grow even more sophisticated. The security firm Secunia has recently released its annual study of trends in software vulnerabilities, an interesting report that highlights the .. --------------------------------------------- http://resources.infosecinstitute.com/hacking-browsers-are-browsers-the-wea… *** The sad state of SMTP encryption *** --------------------------------------------- This is a quick recap of why Im sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it. --------------------------------------------- https://blog.filippo.io/the-sad-state-of-smtp-encryption/

1 0

Tageszusammenfassung - Montag 30-03-2015
by Daily end-of-shift report 30 Mar '15

30 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 27-03-2015 18:00 − Montag 30-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** iOS, OS X Library AFNetwork Patches MiTM Vulnerability *** --------------------------------------------- Until yesterday, a popular networking library for iOS and OS X, used by several apps like Pinterest and Simple was susceptible to SSL man-in-the-middle (MiTM) attacks. --------------------------------------------- http://threatpost.com/ios-os-x-library-afnetwork-patches-mitm-vulnerability… *** Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38079 *** Privilege Escalation in TYPO3 Neos *** --------------------------------------------- http://www.typo3.org/news/article/privilege-escalation-in-typo3-neos/ *** Offenbar schwerwiegendes Datenleck bei Uber *** --------------------------------------------- Offenbar kursieren im Dark Web zurzeit Zugangsdaten zu Tausenden von Nutzerkonten des Fahrdienstes Uber. Diese werden zu Spottpreisen von mehreren Anbietern laut Motherboard verhökert. Die Datensätze enthalten demnach Benutzername, Passwort und die letzten Ziffern, sowie das Verfallsdatum der .. --------------------------------------------- http://derstandard.at/2000013594365 *** British Airways: Hacker hatten Zugriff auf Bonusmeilen *** --------------------------------------------- In einem offenbar automatisierten Angriff auf Konten des British Airways Executive Club ist es Einbrechern möglicherweise gelungen, die Bonusmeilen einiger Kunden abzugreifen. --------------------------------------------- http://www.golem.de/news/british-airways-hacker-hatten-zugriff-auf-bonusmei… *** Announcing tlscompare.org *** --------------------------------------------- As part of an ongoing project on increasing TLS security we are today announcing https://tlscompare.org This webpage is about evaluating a massive extension of the ruleset for HTTPSEverywhere, a browser extension for Chrome and Firefox which .. --------------------------------------------- https://www.sba-research.org/2015/03/30/announcing-tlscompare-org/ *** Newsletter 3.7.0 - Open Redirect *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7868 *** Projekt-Hosting: Tagelanger DDoS-Angriff auf Github *** --------------------------------------------- Seit Donnerstag läuft die grösste DDoS-Attacke auf Github seit dem Entstehen des Dienstes. Experten vermuten, der Angriff gehe von chinesische Behörden aus, bestätigt wird das durch den Projekt-Hoster aber nicht. --------------------------------------------- http://www.golem.de/news/projekt-hosting-tagelanger-ddos-angriff-auf-github… *** Security Attacks via Malicious QR Codes *** --------------------------------------------- With the increasing use of smartphones, QR codes are becoming popular. Recently, WhatsApp launched its web version, which needs QR code scanning to access the web version of WhatsApp. So, many people now know what QR code is, but still more are unaware. It is very similar to a bar code we .. --------------------------------------------- http://resources.infosecinstitute.com/security-attacks-via-malicious-qr-cod… *** OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=36956 *** Ad Networks Ripe for Abuse Via Malvertising *** --------------------------------------------- Criminals have found a safe haven abusing legitimate processes, such as real-time bidding, implemented by online advertising networks to move exploits and malware, and build botnets and fraud campaigns. --------------------------------------------- http://threatpost.com/ad-networks-ripe-for-abuse-via-malvertising/111840 *** WordPress Plugin - Revslider update captions CSS file critical vulnerability *** --------------------------------------------- Today being another day at work for SecureLayer7 to recover our client's defaced website, and bang I think I hit upon a nasty vulnerability of a famous plugin. Although we successfully patched the vulnerability and we fixed the undoing of the blacklisting. On further research I stumbled .. --------------------------------------------- http://blog.securelayer7.net/wordpress-plugin-revslider-update-captions-css…

1 0

Tageszusammenfassung - Freitag 27-03-2015
by Daily end-of-shift report 27 Mar '15

27 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 26-03-2015 18:00 − Freitag 27-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Cisco Wireless LAN Controller Task Name aaaQueueReader Denial of Service Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38076 *** Verschlüsselung: Kryptographen zeigen neue Angriffe gegen RC4 *** --------------------------------------------- Eine bislang wenig beachtete Schwäche von RC4 nutzt der Kryptograph Itsik Mantin für seine neue Angriffsmethode. Ein weiterer kürzlich vorgestellter Angriff betrifft IMAP-Verbindungen. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014 Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for vulnerabilities in the Schneider Electric InduSoft Web Studio and InTouch Machine Edition 2014. Schneider Electric has released new patches that mitigate these vulnerabilities. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-085-01 *** Beta Bot Trojan *** --------------------------------------------- In this article, I would like to show how an analysis is performed on the Beta Bot trojan to identify its characteristics. The Beta Bot trojan, classified as Troj/Neurevt-A, is a dangerous trojan. This trojan is transferred to the victim machine through a phishing email, and the user downloads the files disguised .. --------------------------------------------- http://resources.infosecinstitute.com/beta-bot-trojan/ *** Cisco NX-OS Software DHCP Options Command Injection Vulnerability *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=38062 *** Microsoft will Windows-Lücke nicht schliessen *** --------------------------------------------- Google entdeckt Fehler, über den sich einfache Nutzer Systemrechte verschaffen können. --------------------------------------------- http://derstandard.at/2000013551658 *** The bizarre, pre-internet history of ransomware *** --------------------------------------------- Two months ago, I wrote a short article about helping my mother deal with CryptoWall 2.0., a form of computer virus more broadly known as ransomware. Basically what happens is this: You flip open your laptop to find you have been locked out of all your files. Then a ransom note hovers into view, written .. --------------------------------------------- https://medium.com/un-hackable/the-bizarre-pre-internet-history-of-ransomwa… *** Baidu's traffic hijacked to DDoS GitHub.com *** --------------------------------------------- As a Chinese living outside of China, I frequently visit Chinese websites, many of which use advertising and visitor tracking provided by Baidu, the largest search engine available in China. As I was browsing one of the most popular .. --------------------------------------------- http://insight-labs.org/?p=1682 *** Vulnerability: CVE-2015-0932 *** --------------------------------------------- ANTLabs InnGate devices are a popular Internet gateway for visitor-based networks. They're commonly installed in hotels, convention centers and other places that provide temporary guests access to a WiFi connection. If you've ever used WiFi in a hotel, you're familiar with these types of devices as they are typically tied to a specific room number for billing purposes. --------------------------------------------- http://blog.cylance.com//spear-team-cve-2015-0932

1 0

Tageszusammenfassung - Donnerstag 26-03-2015
by Daily end-of-shift report 26 Mar '15

26 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Mittwoch 25-03-2015 18:00 − Donnerstag 26-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Pin-up on your Smartphone!, (Thu, Mar 26th) *** --------------------------------------------- Yeah, okay, I admit that headline is cheap click bait. Originally, it said Certificate Pinning on Smartphones. If you are more interested in pin-ups on your smartphone, I fear youll have to look elsewhere :). Recently, an email provider that I use changed their Internet-facing services completely. I hadnt seen any announcement that this would happen, and the provider likely thought that since the change was transparent to the customer, no announcement was needed. But Im probably a tad more... --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19513&rss *** Data lurking: How to protect your company against overlooked insider threats *** --------------------------------------------- Enterprises often fear hackers as their number one security threat. However, they should be more scared of what happens internally. More often than not, data breaches come from employees or system err... --------------------------------------------- http://www.net-security.org/article.php?id=2245 *** Setting issue in Windows 7 and 8.1 could allow privilege escalation *** --------------------------------------------- Experts of the Project Zero have disclosed a proof-of-concept for the exploitation of a default setting in Windows 7, 8.1 that allow privilege escalation. A new security issue threatens users of Windows 7 and 8.1, this time experts are warning about a default setting in both OSs that could allow local users to elevate privileges... --------------------------------------------- http://securityaffairs.co/wordpress/35318/hacking/win-7-and-8-1-privilege-e… *** Security Harden CentOS 7 *** --------------------------------------------- This HowTo walks you through the steps required to security harden CentOS 7, it's based on the OpenSCAP benchmark, unfortunately the current version of OpenSCAP that ships with CentOS does not offically support CentOS CPEs. But there is a "workaround" that will allow OpenSCAP + OpenSCAP workbench to run on CentOS, I'll document this in a separate post. --------------------------------------------- http://highon.coffee/blog/security-harden-centos-7/ *** Encryption Solutions for the New World *** --------------------------------------------- Keeping personal information secure and protected remains a top priority for computer users who now rely heavily on information systems to manage a large part of their personal and business lives. One of the ways to make sure only authorized users have access to information is the use of encryption, a process that transforms data... --------------------------------------------- http://resources.infosecinstitute.com/encryption-solutions-for-the-new-worl… *** Who Is the Antidetect Author? *** --------------------------------------------- Earlier this month I wrote about Antidetect, a commercial tool designed to help thieves evade fraud detection schemes employed by many e-commerce companies. That piece walked readers through a sales video produced by the author of Antidetect showing the software being used to buy products online with stolen credit cards. Today, well take a closer look at clues to a possible real-life identity of this tools creator. --------------------------------------------- http://krebsonsecurity.com/2015/03/who-is-the-antidetect-author/ *** Hacking-Kit für Steuergeräte im Auto *** --------------------------------------------- Ein Hacking-Toolkit soll dabei helfen, IT-Sicherheitslücken bei Autos aufzudecken. Ziel ist es, die Hersteller zu mehr Sorgfalt bei diesem Thema zu bewegen. --------------------------------------------- http://heise.de/-2585225 *** Verschlüsselung: RC4 erneut unter Beschuss *** --------------------------------------------- Auf der Black Hat Asia hat der Kryptograph Itsik Mantin neue Angriffsmethoden gegen die RC4-Verschlüsselung vorgestellt. Den Grundstein dazu hatte Mantin bereits vor 13 Jahren gelegt. Davon unabhängig wurde kürzlich ein weiterer Angriff gegen RC4 vorgestellt, der IMAP-Verbindungen betrifft. --------------------------------------------- http://www.golem.de/news/verschluesselung-rc4-erneut-unter-beschuss-1503-11… *** WordPress Malware Causes Psuedo-Darkleech Infection *** --------------------------------------------- Darkleech is a nasty malware infection that infects web servers at the root level. It use malicious Apache modules to add hidden iFrames to certain responses. It's difficult to detect because the malware is only active when both server and site admins are not logged in, and the iFrame is only injected once a dayRead More --------------------------------------------- http://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html *** VMSA-2015-0001.2 *** --------------------------------------------- VMware vCenter Server, ESXi, Workstation, Player, and Fusion updates address security issues --------------------------------------------- http://www.vmware.com/security/advisories/VMSA-2015-0001.html *** DFN-CERT-2015-0416 - Citrix Command Center: Zwei Schwachstellen ermöglichen die Übernahme des Systems *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0416/ *** EMC Isilon OneFS Privilege Escalation *** --------------------------------------------- Topic: EMC Isilon OneFS Privilege Escalation Risk: Medium Text:ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC Identifier: ESA-2015-049 CVE Identifier: CVE-2015-... --------------------------------------------- http://cxsecurity.com/issue/WLB-2015030182 *** Security Advisories for Drupal Third-Party Modules *** --------------------------------------------- *** Linear Case - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-084 *** https://www.drupal.org/node/2459327 *** Webform Multiple File Upload - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-083 *** https://www.drupal.org/node/2459323 *** Crumbs - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-082 *** https://www.drupal.org/node/2459315 *** Petition - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-081 *** https://www.drupal.org/node/2459311 *** Invoice - Moderately Critical - Multiple vulnerabilities - Unsupported - SA-CONTRIB-2015-085 *** https://www.drupal.org/node/2459337 *** Ubercart Webform Checkout Pane - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-087 *** https://www.drupal.org/node/2459359 *** Decisions - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349 *** Decisions - Moderately Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-086 *** https://www.drupal.org/node/2459349

1 0

Tageszusammenfassung - Mittwoch 25-03-2015
by Daily end-of-shift report 25 Mar '15

25 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Dienstag 24-03-2015 18:00 − Mittwoch 25-03-2015 18:00 Handler: Robert Waldner Co-Handler: Stephan Richter *** Patched Flash Vulnerability Now Part of Exploit Kit (March 20, 2015) *** --------------------------------------------- A vulnerability in Adobes Flash Player that was patched on March 12 has already been added to an exploit kit....... --------------------------------------------- http://www.sans.org/newsletters/newsbites/r/17/23/200 *** Macro-based Malware Increases Along with Spam Volume, Now Drops BARTALEX *** --------------------------------------------- Early this year Microsoft reported an increase in macro-related threats being used to spread malware via spam. Similarly, we've been seeing a drastic increase in spammed emails with attached Microsoft Word documents and Microsoft Excel spreadsheets that come with embedded macros. Macros are a set of commands or code that are meant to help automate... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/EHquGcibJew/ *** 15,435 vulnerabilities across 3,870 applications were recorded in 2014 *** --------------------------------------------- In 2014, 15,435 vulnerabilities were discovered according to data from Secunia Research. The vulnerabilities are spread across 3,870 applications published by 500 different vendors, and these numbers ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18132 *** l+f: XXSs not dead *** --------------------------------------------- Nur weil es keine Schlagzeilen mehr macht, ist es noch lange nicht aus der Welt. Das beweist etwa eine XSS-Lücke bei Amazon. --------------------------------------------- http://heise.de/-2584311 *** Multifunctional Vawtrak malware now updated via favicons *** --------------------------------------------- The Vawtrak (aka Snifula) multifunctional malware has been around since mid-2013. Its information-stealing, backdoor and spying capabilities deservedly earned it the description as the "Swiss army kni... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2997 *** Not using IPv6? Are you sure? *** --------------------------------------------- Internet Protocol version 6 (IPv6) has been around for many years and was first supported in Red Hat Enterprise Linux 6 in 2010. Designed to provide, among other things, additional address space on the ever-growing Internet, IPv6 has only recently... --------------------------------------------- https://securityblog.redhat.com/2015/03/25/security-considerations-regardin… *** PHP 5.5.23 is available, (Wed, Mar 25th) *** --------------------------------------------- >From the fine folks at php.net: The PHP development team announces the immediate availability of PHP 5.5.23. Several bugs have been fixed as well as CVE-2015-0231, CVE-2015-2305 and CVE-2015-2331. All PHP 5.5 users are encouraged to upgrade to this version. (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19507&rss *** F-Secure: FSC-2015-2: PATH TRAVERSAL VULNERABILITY, (Wed, Mar 25th) *** --------------------------------------------- F-Secure has announced a security vulnerability affecting their corporate and consumer protection products. The details are available here: https://www.f-secure.com/en/web/labs_global/fsc-2015-2 --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19509&rss *** Researcher finds backdoor opened by Dells helper app *** --------------------------------------------- A security researcher has discovered a serious bug in Dell System Detect, the software Dell users are urged to use to download the appropriate drivers for their machines. The flaw can be exploited by ... --------------------------------------------- http://www.net-security.org/secworld.php?id=18134 *** Flash in 2015 *** --------------------------------------------- In the past few years, web exploits had three main targets: Internet Explorer, Java, and Flash. In 2013, the popularity of Java exploits peaked. Bug hunters became really good at finding Java bugs, and corrupting the security manager was a convenient exploitation technique. Multiple exploit campaigns used Java zero-days, and exploit kits (EK) universally adopted these exploits. In January of 2014, however, Oracle blocked the execution of unsigned applets by default, and exploit authors largely abandoned Java. The change left Internet Explorer and Adobe Flash as the next best targets. Both IE and Flash received attention from exploit developers, but in June of 2014, Microsoft began rolling out heap corruption mitigations such as an isolated heap and delayed frees for IE. Exploit developers again, needed to shift their focus. --------------------------------------------- https://www.fireeye.com/blog/threat-research/2015/03/flash_in_2015.html *** Guest talk: "Large-scale Automated Software Diversity - Programming Language Technology to Enhance System Security" *** --------------------------------------------- 26/03/2015 - 10:00 am - 11:00 am SBA Research Favoritenstraße 16 1040 Wien --------------------------------------------- https://www.sba-research.org/events/guest-talk-large-scale-automated-softwa… *** Cisco Security Advisories *** --------------------------------------------- *** Cisco IOS XR Software DHCPv4 Server Denial of Service Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38006 *** Cisco Mobility Service Engine Password Information Disclosure Vulnerability *** http://tools.cisco.com/security/center/viewAlert.x?alertId=38007 *** Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability *** http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699013 *** IBM Security Bulletin: NTP vulnerabilities affect IBM SmartCloud Entry (CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022036 *** IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-0204, CVE-2015-0206) *** http://www.ibm.com/support/docview.wss?uid=swg21697205 *** IBM Security Bulletin: IBM Cloud Manager with OpenStack Nova Vulnerability (CVE-2014-3708) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022097 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime Technology Edition affect Rational Functional Tester (CVE-2014-3065, CVE-2014-3566, CVE-2014-6511) *** http://www.ibm.com/support/docview.wss?uid=swg21693297 *** IBM Security Bulletin: Vulnerabilities in GSKit affect IBM Content Collector for SAP Applications (CVE-2015-0138, CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699263 *** IBM Security Bulletin : Multiple vulnerabilities in IBM Java Runtime affect IBM Integration Bus and WebSphere Message Broker *** http://www.ibm.com/support/docview.wss?uid=swg21697107 *** IBM Security Bulletin: Multiple vulnerabilities in the IBM Java Runtime affect Rational DOORS Web Access (CVE-2014-6593, CVE-2015-0410, CVE-2015-0138) *** http://www.ibm.com/support/docview.wss?uid=swg21697068 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2014-6549) (CVE-2015-0408) (CVE-2015-0412) (CVE-2015-0395) (CVE-2015-0403) (CVE-2015-0406) (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699907 *** DFN-CERT-2015-0399 GnuTLS: Mehrere Schwachstellen ermöglichen das Umgehen von Sicherheitsvorkehrungen *** --------------------------------------------- https://portal.cert.dfn.de/adv/DFN-CERT-2015-0399/ *** GE and MACTek HART Device DTM Vulnerability (Update A) *** --------------------------------------------- This updated advisory is a follow-up to the original advisory titled ICSA-15-036-01 GE and MACTek HART Device DTM Vulnerability that was published February 5, 2015, on the NCCIC/ICS-CERT web site. This advisory provides mitigation details for an improper input vulnerability in the HART Device Type Manager (DTM) library utilized in GE and MACTek's HART Device DTM. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-036-01A *** Random Article component for Joomla! multiple SQL injection *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101773

1 0

Tageszusammenfassung - Dienstag 24-03-2015
by Daily end-of-shift report 24 Mar '15

24 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Montag 23-03-2015 18:00 − Dienstag 24-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** DMARC and Spam: Why It Matters *** --------------------------------------------- Recently I discussed how TorrentLocker spam was using email authentication for its spam runs. At the time, I suggested that these spam runs were using email authentication to gather information about victim networks and potentially improve the ability to evade spam filters. DomainKeys Identified Mail's (DKIM) own specification mentions the possibility of messages with from "trusted sources" and with a... --------------------------------------------- http://feeds.trendmicro.com/~r/Anti-MalwareBlog/~3/W3IX-WkypVo/ *** Why enterprise IT and security teams should talk more *** --------------------------------------------- The "It wont happen to me" mentality combined with communication gaps between the IT and security teams greatly increases enterprises risk of being breached. --------------------------------------------- http://www.scmagazine.com/why-enterprise-it-and-security-teams-should-talk-… *** Xen shows off 35-piece cloudpocalypse collection *** --------------------------------------------- The latest fixing fashions for open-source hypervisors hit the catwalk The Xen Project has fixed 35 flaws, all rated critical, for versions 4.3 and 4.4 of its flagship hypervisor. The fixes appear to correspond to flaws identified after the late February 2014 cloudpocalypse, when major cloud providers feared they would once again need to reboot substantial parts of their server fleets to keep them secure. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/xen_shows_o… *** Four advantages of an identity behavior-based approach to cybersecurity *** --------------------------------------------- With an ever-increasing number of data breaches, more money is being poured into IT security budgets. According to Gartner, the average global security budget increased 8 percent from 2013 to 2014 and... --------------------------------------------- http://www.net-security.org/article.php?id=2243 *** KNX-Schwachstellen: Spielen mit den Lichtern der anderen *** --------------------------------------------- Das aktuelle KNX-Protokoll abzusichern, halten die Entwickler nicht für nötig. Denn Angreifer brauchen physischen Zugriff auf das System. Doch den bekommen sie leichter als gedacht - und können dann sogar Türöffner und Alarmanlagen steuern. --------------------------------------------- http://www.golem.de/news/knx-schwachstellen-spielen-mit-den-lichtern-der-an… *** BlackHat talk hibernated over 0-day in SAPs Afaria mobile manager *** --------------------------------------------- Researcher has form as a gent: he held back disclosure of medical records leak Alexander Polyakov has been forced to withdraw a talk detailing dangerous vulnerabilities into SAPs mobile device management product Afaria scheduled to be given at BlackHat Asia Pacific this week. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/24/sap_blackha… *** Google deckt erneut Missbrauch im SSL-Zertifizierungssystem auf *** --------------------------------------------- Über das Public-Key-Pinning im Webbrowser Chrome ist Google auf gefälschte Zertifikate für Google-Domains gestoßen. Diese werden von der Root-CA CNNIC beglaubigt, der viele Betriebssysteme und Browser beim Aufbau verschlüsselter Verbindungen vertrauen. --------------------------------------------- http://heise.de/-2583414 *** The importance of standards in electronic identification and trust services providers *** --------------------------------------------- ENISA publishes a new report on the importance of standards in the area of electronic identification and trust services providers. --------------------------------------------- http://www.enisa.europa.eu/media/news-items/the-importance-of-standards-in-… *** Full, cracked version of NanoCore RAT leaked, onslaught of infection attempts expected *** --------------------------------------------- NanoCore, a lesser-known remote access Trojan (RAT), has recently been spotted being delivered to employees of energy companies in Asia and the Middle East via spear-phishing emails impersonating a le... --------------------------------------------- http://www.net-security.org/malware_news.php?id=2995 *** Android Installer Hijacking Vulnerability Could Expose Android Users to Malware *** --------------------------------------------- Executive Summary We discovered a widespread vulnerability in Google's Android OS we are calling "Android Installer Hijacking", estimated to impact 49.5 percent of all current Android users. In detail: Android Installer Hijacking allows an attacker... --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijack… *** The average DDoS attack tripled in volume *** --------------------------------------------- The average packet volume for DDoS attacks increased 340 percent to 4.36 million packets per second (Mpps), and the average bit volume swelled 245 percent to 12.1 Gbps in the final quarter of 2014, ac... --------------------------------------------- http://www.net-security.org/secworld.php?id=18125 *** Privilege Gone Wild 2: Over 25% of Organizations Have No Privileged Access Controls *** --------------------------------------------- BeyondTrust recently conducted a survey, with over 700 respondents, to explore how organizations view the risk of misuse from privileged account misuse, as well as trends in addressing and mitigating those risks. --------------------------------------------- http://blog.beyondtrust.com/privilege-gone-wild-2-over-25-of-organizations-… *** Is Your Multi-Factor Authentication Solution the Real Thing? *** --------------------------------------------- In infosec, multi-factor authentication is often considered a positive, constructive element of layered security. However, some people have an oversimplified view. With multi-factor authentication, there are many nuances to consider. At BSides Austin I presented on this topic. When shopping for a multi-factor authentication solution, what should you look for? There are over 200 multi-factor authentication vendors, how do you evaluate the best one for your needs? You can weed out more the half --------------------------------------------- https://www.alienvault.com/blogs/security-essentials/is-your-multi-factor-a… *** Why Website Reinfections Happen *** --------------------------------------------- I joined Sucuri a little over a month ago. My job is actually as a Social Media Specialist, but we have this process where regardless of your job you have to learn what website infections look like and more importantly, how to clean them. It's this idea that regardless of you are you must always... --------------------------------------------- http://blog.sucuri.net/2015/03/why-website-reinfections-happen.html *** HP Security Bulletins *** --------------------------------------------- *** HPSBST03196 rev.1- HP StoreEver MSL6480 Tape Library running OpenSSL, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599191 *** HPSBGN03299 rev.1 - HP IceWall SSO Dfw, SSO Certd, MCRP, and Federation Agent running OpenSSL, Remote Disclosure of Information, Unauthorized Access *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04604357 *** HPSBHF03289 rev.1- HP ThinClient PCs running ThinPro Linux, Remote Code Execution, Denial of Service, Disclosure of information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04602055 *** HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, Remote Execution of Code *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04518183 *** HPSBMU03297 rev.1- HP Helion Application Lifecycle Service (ALS) for Linux, Remote Code Execution *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04599861 *** HPSBMU03301 rev.1 - HP BladeSystem c-Class Onboard Administrator running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04609844 *** HPSBHF03151 rev.1 - HP Integrated Lights-Out 2 and 4 (iLO 2, iLO 4), Chassis Management (iLO CM), Remote Denial of Service, Remote Execution of Code, Elevation of Privilege *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04486432 *** HPSBHF03275 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582218 *** HPSBHF03276 rev.1 - HP Integrated Lights-Out 2, 3, and 4 (iLO 2, iLO 3, iLO 4), Remote Unauthorized Access, Denial of Service (Dos) *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04582368 *** HPSBMU03292 rev.1 - HP Operations Orchestration Authentication Bypass *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595607 *** HPSBMU03291 rev.1 - HP Operations Orchestration running Powershell Operations, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04595417 *** HPSBMU03263 rev.1 - HP Insight Control running OpenSSL, Remote Disclosure of Information *** https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04574073 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: IBM InfoSphere Balanced Warehouse C3000, C4000, IBM Smart Analytics System 1050, 2050 and 5710 are affected by vulnerabilities in NTP (CVE-2014-9293, CVE-2014-9294, CVE-2014-9297, CVE-2014-9298) *** http://www.ibm.com/support/docview.wss?uid=swg21699578 *** IBM Security Bulletin: Vulnerabilities in IBM Rational ClearQuest (CVE-2014-8925) *** http://www.ibm.com/support/docview.wss?uid=swg21699148 *** IBM Security Bulletin: IBM Forms Experience Builder is affected by a Dojo Toolkit vulnerability (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21697448 *** IBM Security Bulletin: IBM Security Identity Manager Adapters passwords exposed in log files (CVE-2014-8923) *** http://www.ibm.com/support/docview.wss?uid=swg21699902 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-3566 CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698921 *** IBM Security Bulletin: Vulnerability in IBM Java SDK affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2014-3065) *** http://www.ibm.com/support/docview.wss?uid=swg21696456 *** IBM Security Bulletin: Multiple vulnerabilities in Java Runtime affect XIV Management Tools (CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005143 *** IBM Security Bulletin: Multiple vulnerabilities IBM Java SDK affect IBM Rational Connector for SAP Solution Manager (CVE-2014-6593 CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698695 *** IBM Security Bulletin: Vulnerability in Apache Struts affects SAN Volume Controller and Storwize Family (CVE-2014-7809) *** http://www.ibm.com/support/docview.wss?uid=ssg1S1005037 *** IBM Security Bulletin: Multiple Kerberos (krb5) vulnerabilities affect PowerKVM (Multiple CVEs) *** http://www.ibm.com/support/docview.wss?uid=isg3T1022076 *** IBM Security Bulletin: Security Bulletin: IBM i is affected by the following SAMBA vulnerabilities: CVE-2015-0240 *** http://www.ibm.com/support/docview.wss?uid=nas8N1020638 *** EMC Documentum xMS information disclosure *** --------------------------------------------- http://xforce.iss.net/xforce/xfdb/101741 *** DSA-3203 tor - security update *** --------------------------------------------- Several denial-of-service issues have been discovered in Tor, aconnection-based low-latency anonymous communication system. --------------------------------------------- https://www.debian.org/security/2015/dsa-3203 *** InBoundio Marketing Plugin <= 2.0.3 - Shell Upload *** --------------------------------------------- https://wpvulndb.com/vulnerabilities/7864

1 0

Tageszusammenfassung - Montag 23-03-2015
by Daily end-of-shift report 23 Mar '15

23 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Freitag 20-03-2015 18:00 − Montag 23-03-2015 18:00 Handler: Stephan Richter Co-Handler: n/a *** Apple: Those security holes we fixed last week? Youre going to need to repatch *** --------------------------------------------- Turns out those bugs werent quite squished Apple has released a follow-up to last weeks security update after finding a pair of flaws that are still vulnerable on patched systems. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/20/apple_remem… *** Drupal Compromise Analysis Including Indicators of Compromise *** --------------------------------------------- I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis Wilson, Bryant Smith and Casey Critchfield for their help with gathering data and analyzing this attack. Analysis of a real Drupal compromise In this blog post, we will... --------------------------------------------- https://www.trustwave.com/Resources/SpiderLabs-Blog/Drupal-Compromise-Analy… *** Operation Woolen Goldfish, a hacking campaign in the wild *** --------------------------------------------- Security experts at Trend micro uncovered a new hacking campaign dubbed Operation Woolen Goldfish likely run by a threat actor group known as Rocket Kitten. Security experts at Trend Micro have uncovered a new cyber espionage campaign that is targeting a number of European organisations and businesses. The attackers run a spear phishing campaign that... --------------------------------------------- http://securityaffairs.co/wordpress/35128/cyber-crime/operation-woolen-gold… *** PoSeidon the most sophisticated PoS malware until now *** --------------------------------------------- Cisco Security Team has spotted in the wild a new Point-of-Sale malware dubbed PoSeidon that is more sophisticated than previously detected PoS malware. Expert at Cisco have discovered a new Point-of-Sale (PoS) malware dubbed PoSeidon. The experts have discovered many similarities with the popular Zeus Trojan and use sophisticated methods to find card data respect other POS malware like BlackPoS, which was used... --------------------------------------------- http://securityaffairs.co/wordpress/35181/cyber-crime/poseidon-pos-malware.… *** CREEPS rejoice: Small biz Cisco phones open to eavesdrop 0-day *** --------------------------------------------- Open phones may crop up on Shodan Creeps can listen in to conversations placed over vulnerable Cisco small business phones. --------------------------------------------- http://go.theregister.com/feed/www.theregister.co.uk/2015/03/23/creeps_rejo… *** New Dridex malware evades detection with AutoClose function *** --------------------------------------------- Security experts at Proofpoint have discovered a new phishing campaign that exploits a Dridex variant that evades detection with AutoClose function. Criminal crews behind the Dridex banking malware are very prolific and are improving the popular malicious code. Recently we have discussed about a Dridex variant which was spread through phishing messages with Microsoft Office documents embedding malicious macros. The attackers exploited social engineering technique to lure... --------------------------------------------- http://securityaffairs.co/wordpress/35197/cyber-crime/new-dridex-malware.ht… *** Adobe CVE-2011-2461 Remains Exploitable Four Years After Patch *** --------------------------------------------- A Flash vulnerability that Adobe patched four years ago actually remains exploitable according to a presentation given by a pair of researchers at the TROOPERS security conference. --------------------------------------------- http://threatpost.com/adobe-cve-2011-2461-remains-exploitable-four-years-af… *** Watch for updated router firmware!, (Mon, Mar 23rd) *** --------------------------------------------- With the OpenSSL updates this week I am sure you are all diligently testing and deploying to all your vulnerable servers. Something you may not have though of is that most SOHO routers run some kind of *nix variant and will most likely make use of OpenSSL. Be sure to watch for new firmware for those devices as well. On Friday I chatted to two of the larger manufacturers and neither had any timeline for deploying new firmware containing the OpenSSL patches and both said to watch for --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19497&rss *** BIOS-Rootkit LightEater: In den dunklen Ecken abseits des Betriebssystems *** --------------------------------------------- Ein Rootkit, das unabhängig vom Betriebssystem operiert, sämtlichen Speicher auslesen kann und durch den Tausch der Festplatte im System nicht gestoppt wird - was klingt wie eine IT-Gruselgeschichte haben zwei Forscher nun öffentlich präsentiert. --------------------------------------------- http://heise.de/-2582782 *** VU#631788: Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM *** --------------------------------------------- Vulnerability Note VU#631788 Multiple BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM Original Release date: 20 Mar 2015 | Last revised: 20 Mar 2015 Overview Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. Description Multiple BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of SMRAM. According to Corey Kallenberg --------------------------------------------- http://www.kb.cert.org/vuls/id/631788 *** Multiple Vulnerabilities in OpenSSL (March 2015) Affecting Cisco Products *** --------------------------------------------- cisco-sa-20150320-openssl --------------------------------------------- http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… *** DSA-3199 xerces-c - security update *** --------------------------------------------- Anton Rager and Jonathan Brossard from the Salesforce.com ProductSecurity Team and Ben Laurie of Google discovered a denial of servicevulnerability in xerces-c, a validating XML parser library for C++. Theparser mishandles certain kinds of malformed input documents, resultingin a segmentation fault during a parse operation. An unauthenticatedattacker could use this flaw to cause an application using thexerces-c library to crash. --------------------------------------------- https://www.debian.org/security/2015/dsa-3199 *** DSA-3202 mono - security update *** --------------------------------------------- Researchers at INRIA and Xamarin discovered several vulnerabilities inmono, a platform for running and developing applications based on theECMA/ISO Standards. Monos TLS stack contained several problems thathampered its capabilities: those issues could lead to clientimpersonation (via SKIP-TLS), SSLv2 fallback, and encryption weakening(via FREAK). --------------------------------------------- https://www.debian.org/security/2015/dsa-3202 *** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-15:06.openssl [REVISED] *** --------------------------------------------- http://www.securityfocus.com/archive/1/534943 *** Xen Project 4.4.2 *** --------------------------------------------- We are pleased to announce the release of Xen 4.4.2. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.4 (tag RELEASE-4.4.2) or from this download page This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-44-series/xen-442.html *** Xen Project 4.3.4 *** --------------------------------------------- We are pleased to announce the release of Xen 4.3.4. This is available immediately from its git repository http://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=refs/heads/stable-4.3 (tag RELEASE-4.3.4) or from this page. Note that this is expected to be the last release of the 4.3 stable series. The tree will be switched to security only maintenance mode after this release. This fixes the following critical vulnerabilities:... --------------------------------------------- http://www.xenproject.org/downloads/xen-archives/xen-43-series/xen-434.html *** SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF) *** --------------------------------------------- Advisory ID: DRUPAL-SA-CONTRIB-2015-066Project: Tracking Code (third-party module)Version: 7.xDate: 2015-March-04Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescriptionTracking Code module allows you to create tracking code snippets and control their visibility.The module doesnt sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting --------------------------------------------- https://www.drupal.org/node/2445961 *** IBM Security Bulletins *** --------------------------------------------- *** IBM Security Bulletin: Vulnerabilities in OpenSSL affect Sterling Connect:Enterprise for UNIX (CVE-2014-3569, CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275) *** http://www.ibm.com/support/docview.wss?uid=swg21699211 *** IBM Security Bulletin: TLS padding vulnerability affects IBM API Management (CVE-2014-8730) *** http://www.ibm.com/support/docview.wss?uid=swg21699160 *** IBM Security Bulletin: IBM Content Collector affected by vulnerability in IBM Dojo Toolkit (CVE-2014-8917) *** http://www.ibm.com/support/docview.wss?uid=swg21694603 *** IBM Security Bulletin: Multiple security vulnerabilities in IBM Java Runtime affect IBM Rational ClearCase (CVE-2014-3566, CVE-2014-6457) *** http://www.ibm.com/support/docview.wss?uid=swg21698748 *** IBM Security Bulletin: XML External Entity Processing in Castor might affect IBM Business Process Manager (CVE-2014-3004) *** http://www.ibm.com/support/docview.wss?uid=swg21690565 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center July 2014 CPU *** http://www.ibm.com/support/docview.wss?uid=swg21695005 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Financial Transaction Manager for ACH Services, Check Services and Corporate Payment Services (CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21698702 *** IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester (CVE-2014-3566, CVE-2014-6457, CVE-2014-6593, CVE-2015-0410) *** http://www.ibm.com/support/docview.wss?uid=swg21699032 *** IBM Security Bulletin: IBM Forms Viewer can crash based on an embedded PNG image (CVE-2014-9495, CVE-2015-0973) *** http://www.ibm.com/support/docview.wss?uid=swg21697791

1 0

Tageszusammenfassung - Freitag 20-03-2015
by Daily end-of-shift report 20 Mar '15

20 Mar '15

======================= = End-of-Shift report = ======================= Timeframe: Donnerstag 19-03-2015 18:00 − Freitag 20-03-2015 18:00 Handler: Alexander Riepl Co-Handler: n/a *** Paper: Dylib hijacking on OS X *** --------------------------------------------- Patrick Wardle shows how OS X is also vulnerable to once common Windows attacks.A few years ago, DLL hijacking on Windows was really hot, despite the fact that the concept had been discussed by none other than the NSA as far .. --------------------------------------------- http://www.virusbtn.com/blog/2015/03_19.xml?rss *** FindPOS: New POS Malware Family Discovered *** --------------------------------------------- Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which .. --------------------------------------------- http://researchcenter.paloaltonetworks.com/2015/03/findpos-new-pos-malware-… *** Multiple vulnerabilities in Cisco products *** --------------------------------------------- http://tools.cisco.com/security/center/viewAlert.x?alertId=37934 http://tools.cisco.com/security/center/viewAlert.x?alertId=37947 http://tools.cisco.com/security/center/viewAlert.x?alertId=37946 *** Security Update 2015-003 *** --------------------------------------------- https://support.apple.com/kb/HT204563 *** Who Develops Code for IT Support Scareware Websites? *** --------------------------------------------- When investigating a website used as part of an IT support scam, I came across a web page that attempted to fool the visitor into thinking that the persons system was infected. The goal was to persuade the potential victim to call a Microsoft Certified Live Technician at the designated phone number .. --------------------------------------------- https://isc.sans.edu/diary.html?storyid=19489&rss *** CryptoWall 3.0 Ransomware Partners With FAREIT Spyware *** --------------------------------------------- Crypto-ransomware is once again upping the ante with its routines. We came across one crypto-ransomware variant that's combined with spyware - a first for crypto-ransomware. This development just comes at the heels of the discovery that .. --------------------------------------------- http://blog.trendmicro.com/trendlabs-security-intelligence/cryptowall-3-0-r… *** Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities *** --------------------------------------------- This advisory provides mitigation details for multiple DLL Hijacking vulnerabilities in a software component included with Rockwell Automation's FactoryTalk View Studio product. --------------------------------------------- https://ics-cert.us-cert.gov//advisories/ICSA-15-062-02 *** CVE-2015-0336 (Flash up to 16.0.0.305) and Exploit Kits *** --------------------------------------------- As reported by Malwarebytes and FireEye, Nuclear Pack is now taking advantage of a vulnerability patched with the last version of Flash Player ( 17.0.0.134 ) --------------------------------------------- http://malware.dontneedcoffee.com/2015/03/cve-2015-0336-flash-up-to-1600305… *** Erhebliche Sicherheitsmängel bei Geschenkkarten *** --------------------------------------------- Geschenkkarten lassen sich erschreckend einfach manipulieren, wird in der aktuellen Ausgabe des Computermagazins c’t gewarnt. Während Geldscheine mit immer mehr Sicherheitsmerkmalen gegen Fälschungen geschützt werden, sieht das bei den beliebten Geschenkkarten völlig anders aus. "Mit simplen Tricks .. --------------------------------------------- http://derstandard.at/2000013205756 *** Android Security Symposium, co-organized by SBA Research *** --------------------------------------------- https://www.sba-research.org/events/android-security-symposium-co-organized… *** Apple: Anti-Viren-Apps für iOS "irreführend" *** --------------------------------------------- Als Begründung für den plötzlichen Rauswurf von Anti-Viren-Software aus dem App Store hat Apple einem Bericht zufolge angeführt, diese Apps könnten Nutzer glauben lassen, es gäbe Viren für iOS. --------------------------------------------- http://heise.de/-2581916

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Daily